|
HighJacker Problem? Hallo alle zusammen. Seit gestern hab ich folgendes Problem. Mein Internet Explorer öffnet laufend Pop Ups von selbst, desweiteren findet mein Virenscanner einen Virus der sich nur "Trojan Horse" nennt. Mein Internetexplorer hat seit neuestem eine neue Startseite und in meinen Favoriten hab ich laufend neue Links gespeichert. Ich hab mal ein Logfile von HijackThis erstellen lassen. Logfile of HijackThis v1.99.1 Scan saved at 14:13:02, on 25.06.2005 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Programme\Gemeinsame Dateien\Symantec Shared\ccProxy.exe C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe C:\Programme\Norton Internet Security\ISSVC.exe C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe C:\Programme\Gemeinsame Dateien\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe C:\WINDOWS\System32\drivers\CDAC11BA.EXE C:\Programme\Norton Internet Security\Norton AntiVirus\navapsvc.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\wanmpsvc.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\RunDll32.exe C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLDial.exe C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe C:\Programme\NETGEAR\WG311TSU\Utility\Gear311T.exe D:\Nokia\Nokia PC Suite 6\LaunchApplication.exe C:\Programme\Gemeinsame Dateien\PCSuite\DataLayer\DataLayer.exe C:\Programme\iPod\bin\iPodService.exe C:\WINDOWS\System32\ctfmon.exe C:\PROGRA~1\GEMEIN~1\PCSuite\Services\SERVIC~1.EXE C:\Programme\DV Series\Console\Watch.exe C:\Programme\Messenger\msmsgs.exe C:\WINDOWS\msfe.exe D:\Nokia\NOKIAP~1\VFSWRA~1.EXE D:\AOL 9.0\waol.exe D:\AOL 9.0\shellmon.exe C:\Programme\Internet Explorer\iexplore.exe C:\Programme\Gemeinsame Dateien\Aol\aoltpspd.exe I:\Program Files\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\lkkzu.dll/sp.html#12047 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\lkkzu.dll/sp.html#12047 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\lkkzu.dll/sp.html#12047 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\lkkzu.dll/sp.html#12047 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\lkkzu.dll/sp.html#12047 R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\lkkzu.dll/sp.html#12047 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\lkkzu.dll/sp.html#12047 R3 - Default URLSearchHook is missing O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx O2 - BHO: GDS module - {A084A565-B09B-4e4c-A497-7CC50AEAB2A7} - C:\WINDOWS\gds5.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programme\Norton Internet Security\Norton AntiVirus\NavShExt.dll O2 - BHO: Class - {DD5394B0-238F-DA76-6C71-E9FE22E42CC1} - C:\WINDOWS\ntbz32.dll O2 - BHO: Class - {E2FF7285-6F6F-9283-CBCD-D4E370856A52} - C:\WINDOWS\ntbz32.dll O2 - BHO: Class - {F05AEE59-1D1C-D18A-A8AF-CA446E213233} - C:\WINDOWS\ntbz32.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programme\Norton Internet Security\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [NAV Agent] D:\Norton\NORTON~1\navapw32.exe O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe O4 - HKLM\..\Run: [InCD] D:\Brenner\InCD.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [CloneCDTray] "D:\CloneCD\CloneCDTray.exe" /s O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [VRPalmFightFish] E:\bettabetta\????.exe O4 - HKLM\..\Run: [AOLDialer] C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLDial.exe O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Programme\Gemeinsame Dateien\Symantec Shared\Security Center\UsrPrmpt.exe O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer O4 - HKLM\..\Run: [ccApp] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [QuickTime Task] "D:\Programme\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [AS00_Gear311T] C:\Programme\NETGEAR\WG311TSU\Utility\Gear311T.exe -hide O4 - HKLM\..\Run: [iTunesHelper] D:\i-tunes\iTunesHelper.exe O4 - HKLM\..\Run: [PCSuiteTrayApplication] D:\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray O4 - HKLM\..\Run: [DataLayer] C:\Programme\Gemeinsame Dateien\PCSuite\DataLayer\DataLayer.exe O4 - HKLM\..\Run: [iexplore.exe] C:\Programme\Internet Explorer\iexplore.exe O4 - HKLM\..\Run: [crsg.exe] C:\WINDOWS\crsg.exe O4 - HKLM\..\Run: [netue.exe] C:\WINDOWS\system32\netue.exe O4 - HKLM\..\Run: [sysos.exe] C:\WINDOWS\sysos.exe O4 - HKLM\..\Run: [msfe.exe] C:\WINDOWS\msfe.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [AIM] F:\Programme\AIM95\aim.exe -cnetwait.odl O4 - HKCU\..\Run: [MsnMsgr] "C:\Programme\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [Yahoo! Pager] D:\Programme\Yahoo!\Messenger\ypager.exe -quiet O4 - HKCU\..\Run: [PcSync] D:\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog O4 - Global Startup: Acrobat Assistant.lnk = C:\Programme\Adobe\Acrobat 5.0\Distillr\AcroTray.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: AOL 9.0 Tray-Symbol.lnk = D:\AOL 9.0\aoltray.exe O4 - Global Startup: Microsoft Office.lnk = D:\Programme\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: Watch.lnk = C:\Programme\DV Series\Console\Watch.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - d:\Programme\Java\j2re1.4.1_02\bin\npjpi141_02.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - d:\Programme\Java\j2re1.4.1_02\bin\npjpi141_02.dll O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - D:\Programme\Yahoo!\Messenger\yhexbmes0411.dll O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - D:\Programme\Yahoo!\Messenger\yhexbmes0411.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - F:\Programme\AIM95\aim.exe O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE O9 - Extra button: concept/design's onlineTV - {FFD99A02-B23A-48AA-8C78-8F5F2E8A9E83} - D:\onlineTV\onlineTV.exe O12 - Plugin for .spop: C:\Programme\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://h**p://game18.zylomgames.com/...amesplayer.cab O16 - DPF: {D67AC55A-B750-41A4-BEE6-020E017A7996} - http://h**p://www.popfile.de/myplayl...LER_loader.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{4980117F-88F3-452C-BE06-1B7D6CC49A79}: NameServer = 192.170.0.1 O17 - HKLM\System\CCS\Services\Tcpip\..\{788218A8-6172-4586-A364-FED3CB9C5884}: NameServer = 192.168.0.1 O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe O23 - Service: C-DillaCdaC11BA - C-Dilla Ltd - C:\WINDOWS\System32\drivers\CDAC11BA.EXE O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccProxy.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Programme\iPod\bin\iPodService.exe O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Programme\Norton Internet Security\ISSVC.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: Norton AntiVirus Auto-Protect-Dienst (navapsvc) - Symantec Corporation - C:\Programme\Norton Internet Security\Norton AntiVirus\navapsvc.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: SAVScan - Symantec Corporation - C:\Programme\Norton Internet Security\Norton AntiVirus\SAVScan.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\GEMEIN~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\Security Center\SymWSC.exe O23 - Service: TSMService - T-Systems Nova, Berkom - D:\T-DSL SpeedManager\tsmsvc.exe O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe Kann mir jemand sagen welche Auswirkungen der Trojaner noch haben kann und wie ich ihn löschen kann? Kann es sein das durch ihn irgendwelche Kosten entstanden sind? Ich hab eine DSL Leitung. Wenn ich versuch den Trojaner über Norton Antivirus zu löschen kommt er laufend mit einem neuen Namen wieder. Mfg. Sven |
Interesssant wäre gewesen, wo Norton den Trojaner findet und wie er ihn nennt.Nun gut, gehe wie folgt cor: Scanne dein System im abgesicherten Modus mit Escan. Halte dich dabei bitte genauestens an die Anleitung und teile uns anschliessend die Ergebnisse mit. |
Hallo cronos Ok werde ich gleich Probieren. Er findet die Datei in C:\Windows\system32\ Gruß Sven |
Hallo cronos So jetzt ist er endlich mit scannen fertig. Er hat mir angezeigt, dass er den Virus 75 mal gefunden hat. Wenn bei meinem Virenscanner der Hinweis kommt "Virus Warnung" zeigt er auch jedesmal eine neue Datei an. jetzt ist es z.B. C:\Windows\system32\ntkz.exe Gruß Sven |
Zitat:
Poste doch einfach die Virus Log Information so, wie es auch in der Anleitung beschrieben wird. Wende danach den Cleaner an und beseitige die restliche Malware manuell... |
Hallo alle zusammen, Ich hab den Cleaner gestartet. Allerdings seh ich keinen Fortschritt. Der Rechner startet auch nicht neu. Hier sind die Log´s vom Cleaner. --------------------------- (26.6.05 22:25:59) SPSeHjFix started v1.1.2 (26.6.05 22:25:59) OS: WinXP Service Pack 1 (5.1.2600) (26.6.05 22:25:59) Language: deutsch (26.6.05 22:25:59) Win-Path: C:\WINDOWS (26.6.05 22:25:59) System-Path: C:\WINDOWS\System32 (26.6.05 22:25:59) Temp-Path: C:\DOKUME~1\Sven\LOKALE~1\Temp\ (26.6.05 22:26:05) Disinfection started (26.6.05 22:26:05) Bad-Dll(IEP): c:\windows\system32\lkkzu.dll (26.6.05 22:26:05) UBF: 4 - UBB: 3 - UBR: 28 (26.6.05 22:26:05) UBF: 4 - UBB: 3 - UBR: 28 (26.6.05 22:26:05) Bad IE-pages: deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Search Bar: res://c:\windows\system32\lkkzu.dll/sp.html#12047 deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Search Page: res://c:\windows\system32\lkkzu.dll/sp.html#12047 deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Start Page: about:blank deleted: HKCU\Software\Microsoft\Internet Explorer\Search, SearchAssistant: res://c:\windows\system32\lkkzu.dll/sp.html#12047 deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Search Bar: res://c:\windows\system32\lkkzu.dll/sp.html#12047 deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Search Page: res://c:\windows\system32\lkkzu.dll/sp.html#12047 deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Start Page: about:blank deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Default_Page_URL: about:blank deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Default_Search_URL: res://c:\windows\system32\lkkzu.dll/sp.html#12047 deleted: HKLM\Software\Microsoft\Internet Explorer\Search, SearchAssistant: res://c:\windows\system32\lkkzu.dll/sp.html#12047 (26.6.05 22:26:05) Stealth-String not found (26.6.05 22:26:05) No locked Files to delete. End without Reboot (26.6.05 22:26:15) Disinfection started (26.6.05 22:26:15) Bad-Dll(IEP): c:\windows\system32\lkkzu.dll (26.6.05 22:26:15) UBF: 4 - UBB: 3 - UBR: 28 (26.6.05 22:26:15) UBF: 4 - UBB: 3 - UBR: 28 (26.6.05 22:26:15) Bad IE-pages: (none) (26.6.05 22:26:15) Stealth-String not found (26.6.05 22:26:15) No locked Files to delete. End without Reboot (26.6.05 22:27:24) SPSeHjFix started v1.1.2 (26.6.05 22:27:24) OS: WinXP Service Pack 1 (5.1.2600) (26.6.05 22:27:24) Language: deutsch (26.6.05 22:27:24) Win-Path: C:\WINDOWS (26.6.05 22:27:24) System-Path: C:\WINDOWS\System32 (26.6.05 22:27:24) Temp-Path: C:\DOKUME~1\Sven\LOKALE~1\Temp\ (26.6.05 22:27:25) Disinfection started (26.6.05 22:27:25) Bad-Dll(IEP): c:\windows\system32\lkkzu.dll (26.6.05 22:27:25) UBF: 4 - UBB: 3 - UBR: 28 (26.6.05 22:27:25) UBF: 4 - UBB: 3 - UBR: 28 (26.6.05 22:27:25) Bad IE-pages: deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Search Bar: res://c:\windows\system32\lkkzu.dll/sp.html#12047 deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Search Page: res://c:\windows\system32\lkkzu.dll/sp.html#12047 deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Start Page: about:blank deleted: HKCU\Software\Microsoft\Internet Explorer\Search, SearchAssistant: res://c:\windows\system32\lkkzu.dll/sp.html#12047 deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Search Bar: res://c:\windows\system32\lkkzu.dll/sp.html#12047 deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Search Page: res://c:\windows\system32\lkkzu.dll/sp.html#12047 deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Start Page: about:blank deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Default_Page_URL: about:blank deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Default_Search_URL: res://c:\windows\system32\lkkzu.dll/sp.html#12047 deleted: HKLM\Software\Microsoft\Internet Explorer\Search, SearchAssistant: res://c:\windows\system32\lkkzu.dll/sp.html#12047 (26.6.05 22:27:25) Stealth-String not found (26.6.05 22:27:25) No locked Files to delete. End without Reboot ---------------------------- Wenn ich die Logs von Escan hier einfügen möchte oder Anhängen möchte kommt ein Fehler. Gruß Sven |
Wenn du den kompletten Inhalt der mwav.log hier posten oder anhängen willst, dann ist dies klar. Poste nur den Inhalt der 'C:\eScan_neu.txt'. |
Hallo, Das hab ich probiert. Ich probier es nochmal. Gruß Sven ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~ Funde für "infected" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~ Sat Jun 25 17:01:15 2005 => File C:\WINDOWS\ntbz32.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus! Action Taken: No Action Taken. Sat Jun 25 17:01:25 2005 => File C:\WINDOWS\gds5.dll infected by "Trojan-Downloader.Win32.Small.azf" Virus! Action Taken: No Action Taken. Sat Jun 25 17:01:25 2005 => File C:\WINDOWS\ntbz32.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus! Action Taken: No Action Taken. Sat Jun 25 17:01:35 2005 => File C:\WINDOWS\msfe.exe infected by "Trojan-Downloader.Win32.Agent.bq" Virus! Action Taken: No Action Taken. Sat Jun 25 17:01:55 2005 => System found infected with Alexa Spyware/Adware ({c95fe080-8f5d-11d2-a20b-00aa003c157a})! Action taken: No Action Taken. Sat Jun 25 17:02:52 2005 => System found infected with CWS.therealsearch Spyware/Adware (waol.exe)! Action taken: No Action Taken. Sat Jun 25 17:10:22 2005 => File C:\DOKUME~1\Sven\LOKALE~1\TEMPOR~1\Content.IE5\U327QLIZ\ss_stopsign[1].exe infected by "Trojan-Downloader.Win32.Wren.i" Virus! Action Taken: No Action Taken. Sat Jun 25 17:20:32 2005 => File C:\Dokumente und Einstellungen\Sven\Lokale Einstellungen\Temporary Internet Files\Content.IE5\U327QLIZ\ss_stopsign[1].exe infected by "Trojan-Downloader.Win32.Wren.i" Virus! Action Taken: No Action Taken. Sat Jun 25 17:20:53 2005 => File C:\ms32.tmp infected by "Trojan-Downloader.Win32.Small.azk" Virus! Action Taken: No Action Taken. Sat Jun 25 17:24:46 2005 => File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\0118178B.htm infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken. Sat Jun 25 17:24:46 2005 => File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\123B09B8.tmp infected by "Email-Worm.Win32.Mabutu.a" Virus! Action Taken: No Action Taken. Sat Jun 25 17:24:46 2005 => File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\29310685.htm infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken. Sat Jun 25 17:24:46 2005 => File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\29353081.htm infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken. Sat Jun 25 17:24:46 2005 => File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\294F0064.htm infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken. Sat Jun 25 17:24:46 2005 => File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\29A44407.htm infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken. Sat Jun 25 17:24:46 2005 => File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\29CB3BDC.htm infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken. Sat Jun 25 17:24:46 2005 => File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\29DE37C6.htm infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken. Sat Jun 25 17:24:47 2005 => File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\2FA4736F.exe infected by "Trojan-Downloader.Win32.Agent.bq" Virus! Action Taken: No Action Taken. Sat Jun 25 17:24:47 2005 => File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\479F02CD.htm infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken. Sat Jun 25 17:24:47 2005 => File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\47A656C6.htm infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken. Sat Jun 25 17:24:47 2005 => File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\47F44670.htm infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken. Sat Jun 25 17:24:47 2005 => File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\4812404F.htm infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken. Sat Jun 25 17:24:47 2005 => File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\4822123D.htm infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken. Sat Jun 25 17:24:47 2005 => File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\6D9473CA.htm infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken. Sat Jun 25 17:24:47 2005 => File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\6D9D71C0.htm infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken. Sat Jun 25 17:24:47 2005 => File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\6DAE43AE.htm infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken. Sat Jun 25 17:24:48 2005 => File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\6DBE159C.htm infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken. Sat Jun 25 17:24:48 2005 => File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\6E1A2D37.htm infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken. Sat Jun 25 17:24:48 2005 => File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\6E6572E4.htm infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken. Sat Jun 25 17:24:48 2005 => File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\6E7B18CB.htm infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken. Sat Jun 25 17:24:48 2005 => File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\6E8940BD.htm infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken. Sat Jun 25 17:24:48 2005 => File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\6F2C7409.htm infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken. Sat Jun 25 17:25:22 2005 => File C:\System Volume Information\_restore{CFBF59A3-153F-4E79-9670-A4A8F5DB5C12}\RP540\A0171224.exe infected by "Trojan-Downloader.Win32.Agent.bq" Virus! Action Taken: No Action Taken. Sat Jun 25 17:25:22 2005 => File C:\System Volume Information\_restore{CFBF59A3-153F-4E79-9670-A4A8F5DB5C12}\RP540\A0171225.exe infected by "Trojan-Downloader.Win32.Agent.bq" Virus! Action Taken: No Action Taken. Sat Jun 25 17:25:23 2005 => File C:\System Volume Information\_restore{CFBF59A3-153F-4E79-9670-A4A8F5DB5C12}\RP540\A0171240.exe infected by "Trojan-Downloader.Win32.Agent.bq" Virus! Action Taken: No Action Taken. Sat Jun 25 17:46:55 2005 => File D:\Kampffisch-Game.exe infected by "P2P-Worm.Win32.Franvir" Virus! Action Taken: No Action Taken. Sat Jun 25 18:06:17 2005 => File E:\sortieren\Kampffisch-Game.exe infected by "P2P-Worm.Win32.Franvir" Virus! Action Taken: No Action Taken. Sat Jun 25 18:30:47 2005 => Total Disinfected Files: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~ Funde für "tagged" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~ Sat Jun 25 17:04:18 2005 => File C:\WINDOWS\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. Sat Jun 25 17:05:12 2005 => File C:\WINDOWS\System32\lkkzu.dll tagged as "not-a-virus:AdWare.SearchPage". Action Taken: No Action Taken. Sat Jun 25 17:07:54 2005 => File C:\DOKUME~1\Sven\LOKALE~1\Temp\SFX3F1.tmp\TDM\TDMInstall.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. Sat Jun 25 17:18:21 2005 => File C:\Dokumente und Einstellungen\Sven\Lokale Einstellungen\Temp\SFX3F1.tmp\TDM\TDMInstall.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. Sat Jun 25 17:21:35 2005 => File C:\Programme\DV Series\Uninstall.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. Sat Jun 25 17:24:45 2005 => File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\00FA02C8.dll tagged as "not-a-virus:AdWare.SearchPage". Action Taken: No Action Taken. Sat Jun 25 17:24:46 2005 => File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\098D3959.dll tagged as "not-a-virus:AdWare.SearchPage". Action Taken: No Action Taken. Sat Jun 25 17:24:46 2005 => File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\2FA4736F.dll tagged as "not-a-virus:AdWare.SearchPage". Action Taken: No Action Taken. Sat Jun 25 17:24:47 2005 => File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\4C2106F1.dll tagged as "not-a-virus:AdWare.SearchPage". Action Taken: No Action Taken. Sat Jun 25 17:24:47 2005 => File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\63BC2A65.dll tagged as "not-a-virus:AdWare.SearchPage". Action Taken: No Action Taken. Sat Jun 25 17:25:20 2005 => File C:\System Volume Information\_restore{CFBF59A3-153F-4E79-9670-A4A8F5DB5C12}\RP540\A0171173.dll tagged as "not-a-virus:AdWare.SearchPage". Action Taken: No Action Taken. Sat Jun 25 17:25:22 2005 => File C:\System Volume Information\_restore{CFBF59A3-153F-4E79-9670-A4A8F5DB5C12}\RP540\A0171222.dll tagged as "not-a-virus:AdWare.SearchPage". Action Taken: No Action Taken. Sat Jun 25 17:25:23 2005 => File C:\System Volume Information\_restore{CFBF59A3-153F-4E79-9670-A4A8F5DB5C12}\RP540\A0171239.dll tagged as "not-a-virus:AdWare.SearchPage". Action Taken: No Action Taken. Sat Jun 25 17:36:31 2005 => File C:\WINDOWS\system32\lkkzu.dll tagged as "not-a-virus:AdWare.SearchPage". Action Taken: No Action Taken. Sat Jun 25 17:36:38 2005 => File C:\WINDOWS\system32\Macromed\Shockwave 8\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. Sat Jun 25 17:38:45 2005 => File C:\WINDOWS\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. Sat Jun 25 17:41:43 2005 => File D:\AOL 9.0\Jiti\Jiti_mm.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. Sat Jun 25 17:54:46 2005 => File D:\Programme\Lavasoft\Ad-aware 6\Lang\Language-pack 2\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. Sat Jun 25 17:54:46 2005 => File D:\Programme\Lavasoft\Ad-aware 6\Unwise.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. Sat Jun 25 17:56:32 2005 => File D:\Programme\Pixelnet\Pixel2Picture\Unwise.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. Sat Jun 25 17:56:38 2005 => File D:\Programme\Yahoo!\Installs\ymsgrie.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. Sat Jun 25 17:57:05 2005 => File D:\Programme\Yahoo!\Messenger\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. Sat Jun 25 18:01:33 2005 => File E:\Auslagerung Temp (Windows)\AOL\comp01.000 tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. Sat Jun 25 18:02:58 2005 => File E:\Fun Bilder\Flash\gun.exe tagged as not-a-virus:Effect.Win16.Gun. No Action Taken. Sat Jun 25 18:03:09 2005 => File E:\Fun Bilder\Programme\Langeweile1_1.exe tagged as not-a-virus:Joke.Win32.Langeweile. No Action Taken. Sat Jun 25 18:07:45 2005 => File F:\Programme\AIM95\unwise32.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. Sat Jun 25 18:24:12 2005 => File I:\Downloads\menuorc5.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. Sat Jun 25 18:27:12 2005 => File I:\Downloads\Software\Internet\Addaware 6.0\aaw-lang-pack.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. Sat Jun 25 18:27:12 2005 => File I:\Downloads\Software\Internet\Addaware 6.0\aaw6.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. Sat Jun 25 18:27:24 2005 => File I:\Downloads\Software\Internet\Messenger\Yahoo Messenger\ymsgrde.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. Sat Jun 25 18:27:28 2005 => File I:\Downloads\Software\Internet\Messenger\Yahoo Messenger\ymsgrde1.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. Sat Jun 25 18:27:32 2005 => File I:\Downloads\Software\Internet\Messenger\Yahoo Messenger\ymsgrde2.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. Sat Jun 25 18:27:36 2005 => File I:\Downloads\Software\Internet\Messenger\Yahoo Messenger\ymsgrde3.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. Sat Jun 25 18:28:14 2005 => File I:\Downloads\Spiele\Mini Spiele\sharkattack.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~ Statistiken: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~ Sat Jun 25 18:30:47 2005 => Total Virus(es) Found: 75 Sat Jun 25 18:30:47 2005 => Total Errors: 210 Sat Jun 25 18:30:47 2005 => Time Elapsed: 01:29:47 Sat Jun 25 18:30:47 2005 => Total Objects Scanned: 197284 Sat Jun 25 17:00:43 2005 => Virus Database Date: 2005/06/24 Sat Jun 25 18:30:47 2005 => Virus Database Date: 2005/06/24 Sat Jun 25 18:43:54 2005 => Virus Database Date: 2005/06/24 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~ ~~~~~~~ © Haui ;-) ~~~~~~~ ~~~~~~~ Dank an Cidre ~~~~~~~ |
Hallo alle zusammen Das Problem besteht weiterhin. Ich hab jetzt mit verschiedenen Viren Scannern mein System gescannt. Hab auch immer die Datei welche der Trojaner erstellt entfernen können. Aber sobald ich länger im Internet bin oder den Internet Explorer öffne kommt eine neue Virenmeldung. Gruß Sven ------------------ Ich hab mit der neuesten Version von Ad Aware meinen PC durchsucht und noch etwas gefunden was sich CoolWebsearch nennt. Wenn ich es mit Ad Aware lösche kommt es beim nächsten Überprüfen wieder. |
Hallo alle zusammen Danke für eure Hilfe. Ich habe das Problem jetzt behoben. Gruß Sven |
Hallo BettaSven, dann wäre es für uns und andere Hilfesuchenden sicherlich interessant, wenn du uns mitteilen würdest, was letztendlich zum Erfolg führte. ;) |
| Alle Zeitangaben in WEZ +1. Es ist jetzt 03:57 Uhr. |
Copyright ©2000-2025, Trojaner-Board