|
Bitte mal mein LogFile checken... Hallo Leute, bin ganz neu auf dem Gebiet von Hijack, hab schon oft davon gehört, kenn mich damit leider nich genau aus. Ich hoffe es schaut mal jemand über mein Logfile drüber. Hab es mal benutzt, da mein Rechner in letzter Zeit Zicken macht. :( Vorallem wüsst ich gern was die ganzen xxx seiten da unten zu suchen haben. :koch: Hab ich mir da was eingefangen??? Vielen Dank im vorraus. LastBoyScout Logfile of HijackThis v1.99.1 Scan saved at 00:51:49, on 02.07.2005 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\Ati2evxx.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\spoolsv.exe D:\PcProgs\AntiVir6\AVGUARD.EXE D:\PcProgs\AntiVir6\AVWUPSRV.EXE D:\PcProgs\CPUCooL\CooLSrv.exe C:\WINNT\System32\svchost.exe C:\WINNT\system32\Winregs8.exe C:\WINNT\system32\regsvc.exe C:\WINNT\system32\MSTask.exe C:\WINNT\System32\tcpsvcs.exe C:\WINNT\system32\stisvc.exe C:\WINNT\system32\ZoneLabs\vsmon.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\System32\mspmspsv.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\Ati2evxx.exe C:\WINNT\Explorer.EXE D:\InetProgs\ZoneAlarm\zlclient.exe D:\PcProgs\AntiVir6\AVGNT.EXE C:\TuneUp 2003\MemOptimizer.exe C:\Programme\Internet Explorer\iexplore.exe D:\PcProgs\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = wyw.die-staemme.de R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - Wer das liest ist doof! O1 - Hosts: 66.159.20.51 astalavista.box.sk O1 - Hosts: 66.159.18.17 wyw.greatfreehost.com O1 - Hosts: 66.159.18.17 greatfreehost.com O1 - Hosts: 66.159.18.17 wyw.hotfreehost.com O1 - Hosts: 66.159.18.17 hotfreehost.com O1 - Hosts: 66.159.18.17 wyw.agreathost.net O1 - Hosts: 66.159.18.17 agreathost.net O1 - Hosts: 66.159.18.17 www32.smutserver.com O1 - Hosts: 66.159.18.17 www31.smutserver.com O1 - Hosts: 66.159.18.17 www30.smutserver.com O1 - Hosts: 66.159.18.17 smutserver.com O1 - Hosts: 66.159.18.17 www10.kinghost.com O1 - Hosts: 66.159.18.17 www9.kinghost.com O1 - Hosts: 66.159.18.17 www7.kinghost.com O1 - Hosts: 66.159.18.17 www8.kinghost.com O1 - Hosts: 66.159.18.17 www6.kinghost.com O1 - Hosts: 66.159.18.17 www5.kinghost.com O1 - Hosts: 66.159.18.17 www4.kinghost.com O1 - Hosts: 66.159.18.17 wyw.kinghost.com O1 - Hosts: 66.159.18.17 www3.kinghost.com O1 - Hosts: 66.159.18.17 www2.kinghost.com O1 - Hosts: 66.159.18.17 www1.kinghost.com O1 - Hosts: 66.159.18.17 kinghost.com O1 - Hosts: 66.159.18.17 wyw.ndhosting.com O1 - Hosts: 66.159.18.17 www2.ndhosting.com O1 - Hosts: 66.159.18.17 www3.ndhosting.com O1 - Hosts: 66.159.18.17 www1.ndhosting.com O1 - Hosts: 66.159.18.17 ndhosting.com O1 - Hosts: 66.159.18.17 wyw.freesmutpages.com O1 - Hosts: 66.159.18.17 apornhost.com O1 - Hosts: 66.159.18.17 nasty-pages.com O1 - Hosts: 66.159.18.17 wyw.nasty-pages.com O1 - Hosts: 66.159.18.17 sexyfreehost.com O1 - Hosts: 66.159.18.17 wyw.apornhost.com O1 - Hosts: 66.159.18.17 wyw.sexyfreehost.com O1 - Hosts: 66.159.18.17 x4web.com O1 - Hosts: 66.159.18.17 wyw.x4web.com O1 - Hosts: 66.159.18.17 sexplanets.com O1 - Hosts: 66.159.18.17 tgpfriendly.com O1 - Hosts: 66.159.18.17 magnaplza.com O1 - Hosts: 66.159.18.17 free-xxx-server.com O1 - Hosts: 66.159.18.17 wyw.free-xxx-server.com O1 - Hosts: 66.159.18.17 libereco.net O1 - Hosts: 66.159.18.17 0190-dialer.com O1 - Hosts: 66.159.18.17 wyw.0190-dialer.com O1 - Hosts: 66.159.18.17 wyw.libereco.net O1 - Hosts: 66.159.18.17 xxxod.net O1 - Hosts: 66.159.18.17 altsights.com O1 - Hosts: 66.159.18.17 wyw.altsights.com O1 - Hosts: 66.159.18.17 wyw.xxxod.net O1 - Hosts: 66.159.18.17 adulthosting.com O1 - Hosts: 66.159.18.17 wyw.adulthosting.com O1 - Hosts: 66.159.18.17 superhova.com O1 - Hosts: 66.159.18.17 bestpornhost.com O1 - Hosts: 66.159.18.17 wyw.superhova.com O1 - Hosts: 66.159.18.17 wyw.bestpornhost.com O1 - Hosts: 66.159.18.17 hostingfree.com O1 - Hosts: 66.159.18.17 wyw.hostingfree.com O1 - Hosts: 66.159.18.17 xfreehosting.com O1 - Hosts: 66.159.18.17 wyw.xfreehosting.com O1 - Hosts: 66.159.18.17 blinghosting.com O1 - Hosts: 66.159.18.17 wyw.blinghosting.com O1 - Hosts: 66.159.18.17 x-x-x-hosting.com O1 - Hosts: 66.159.18.17 wyw.x-x-x-hosting.com O1 - Hosts: 66.159.18.17 pornparks.com O1 - Hosts: 66.159.18.17 wyw.pornparks.com O1 - Hosts: 66.159.18.17 sexls.com O1 - Hosts: 66.159.18.17 wyw.sexls.com O1 - Hosts: 66.159.18.17 royalfreehost.com O1 - Hosts: 66.159.18.17 wyw.royalfreehost.com O1 - Hosts: 66.159.18.17 pleasuremedia.com O1 - Hosts: 66.159.18.17 wyw.pleasuremedia.com O1 - Hosts: 66.159.18.17 wyw.mtree.com O1 - Hosts: 66.159.18.17 mtree.com O1 - Hosts: 66.159.18.17 nocreditcard.com O1 - Hosts: 66.159.18.17 wyw.nocreditcard.com O1 - Hosts: 66.159.18.17 movies-etc.com O1 - Hosts: 66.159.18.17 wyw.movies-etc.com O1 - Hosts: 66.159.18.17 22469.com O1 - Hosts: 66.159.18.17 alehina.com O1 - Hosts: 66.159.18.17 allowednet.com O1 - Hosts: 66.159.18.17 amateurnudephoto.com O1 - Hosts: 66.159.18.17 amateursgonebad.com O1 - Hosts: 66.159.18.17 badbimbo.com O1 - Hosts: 66.159.18.17 beautifulbondage.com O1 - Hosts: 66.159.18.17 big-xxx-movies.com O1 - Hosts: 66.159.18.17 bizshura.com O1 - Hosts: 66.159.18.17 boyanxxx.com O1 - Hosts: 66.159.18.17 cleanadulthost.com O1 - Hosts: 66.159.18.17 cleanpornhost.com O1 - Hosts: 66.159.18.17 cyberxxxhost.com O1 - Hosts: 66.159.18.17 discretesex.com O1 - Hosts: 66.159.18.17 easythumbs.com O1 - Hosts: 66.159.18.17 exscapeporn.com O1 - Hosts: 66.159.18.17 free-freeporn.com O1 - Hosts: 66.159.18.17 freepornofreeporn.com O1 - Hosts: 66.159.18.17 glamourmodelsgonebad.com O1 - Hosts: 66.159.18.17 hot-adult-clips.com O1 - Hosts: 66.159.18.17 hottestbabes.net O1 - Hosts: 66.159.18.17 hot3movie.com O1 - Hosts: 66.159.18.17 huge-cock-big-cock.com O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\PcProgs\Acrobat5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\PcProgs\SPYBOT~1\SDHelper.dll O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - D:\INETPR~1\FlashGet\jccatch.dll O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - D:\INETPR~1\FlashGet\fgiebar.dll O3 - Toolbar: @msdxmLC.dll,-1@1031,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon O4 - HKLM\..\Run: [Zone Labs Client] "D:\InetProgs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [AVGCtrl] "D:\PcProgs\AntiVir6\AVGNT.EXE" /min O4 - HKCU\..\Run: [TuneUp MemOptimizer] C:\TuneUp 2003\MemOptimizer.exe autostart O8 - Extra context menu item: Alles mit FlashGet laden - D:\InetProgs\FlashGet\jc_all.htm O8 - Extra context menu item: Mit FlashGet laden - D:\InetProgs\FlashGet\jc_link.htm O9 - Extra button: Recherche-Assistent - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Encarta Researcher\EROPROJ.DLL O9 - Extra button: Preispiraten - {94A15285-AAE6-44E8-B2D7-4A2C6CDA9185} - D:\PcProgs\Preispiraten\preispiraten.exe O9 - Extra button: ICQ 4.1 - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\InetProgs\ICQLite\ICQLite.exe O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\InetProgs\ICQLite\ICQLite.exe O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\INETPR~1\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\INETPR~1\FlashGet\flashget.exe O16 - DPF: {CFCB7308-782F-11D4-BE27-000102598CE4} (NPX Control) - hyyp://kr.pristontale.com/nprotect/nprotect/npx.cab O16 - DPF: {FB48C7B0-EB66-4BE6-A1C5-9DDF3C37249A} (MCSendMessageHandler Class) - hyyp://xtraz.icq.com/xtraz/activex/MISBH.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{A492AC7B-220F-496A-8F89-3DC0B4C83819}: NameServer = 217.237.150.33 217.237.151.161 O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - D:\PcProgs\AntiVir6\AVGUARD.EXE O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINNT\system32\Ati2evxx.exe O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - D:\PcProgs\AntiVir6\AVWUPSRV.EXE O23 - Service: CPUCooLServer Service (CPUCooLServer) - Unknown owner - D:\PcProgs\CPUCooL\CooLSrv.exe O23 - Service: Verwaltungsdienst für die Verwaltung logischer Datenträger (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe O23 - Service: Network DDE Client (NetDDEclnt) - Unknown owner - C:\WINNT\system32\Winregs8.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINNT\system32\ZoneLabs\vsmon.exe *Links mit wyw hab ich editiert* |
Hallo, fixe alle O1 Einträge und eventuell diesen [1], sofern der Dienst nicht bekannt ist. Scanne ebenfalls mit eScan AntiVirus im abgesicherten Modus und poste uns die Virus Log Information. [1] O23 - Service: Network DDE Client (NetDDEclnt) - Unknown owner - C:\WINNT\system32\Winregs8.exe |
Wie fixe ich diese O1 Einträge??? Und wo kommen die überhaupt her??? Escan wird gemacht! |
Zitat:
Zitat:
|
Hier mein LogFile, nachdem ich die O1 Einträge gefixt hab: Logfile of HijackThis v1.99.1 Scan saved at 13:38:01, on 03.07.2005 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\Ati2evxx.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\spoolsv.exe D:\PcProgs\AntiVir6\AVGUARD.EXE D:\PcProgs\AntiVir6\AVWUPSRV.EXE D:\PcProgs\CPUCooL\CooLSrv.exe C:\WINNT\System32\svchost.exe C:\WINNT\system32\Winregs8.exe C:\WINNT\system32\regsvc.exe C:\WINNT\system32\MSTask.exe C:\WINNT\System32\tcpsvcs.exe C:\WINNT\system32\stisvc.exe C:\WINNT\system32\ZoneLabs\vsmon.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\System32\mspmspsv.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\Ati2evxx.exe C:\WINNT\Explorer.EXE D:\InetProgs\ZoneAlarm\zlclient.exe D:\PcProgs\AntiVir6\AVGNT.EXE C:\TuneUp 2003\MemOptimizer.exe D:\PcProgs\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hyyp://wyw.die-staemme.de/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - Wer das liest ist doof! R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = hyyp://wyw.t-online.de/software/ie50/setpxy.pac R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=proxy.btx.dtag.de:80;ftp=ftp-proxy.btx.dtag.de:80 O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\PcProgs\Acrobat5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\PcProgs\SPYBOT~1\SDHelper.dll O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - D:\INETPR~1\FlashGet\jccatch.dll O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - D:\INETPR~1\FlashGet\fgiebar.dll O3 - Toolbar: @msdxmLC.dll,-1@1031,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon O4 - HKLM\..\Run: [Zone Labs Client] "D:\InetProgs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [AVGCtrl] "D:\PcProgs\AntiVir6\AVGNT.EXE" /min O4 - HKCU\..\Run: [TuneUp MemOptimizer] C:\TuneUp 2003\MemOptimizer.exe autostart O8 - Extra context menu item: Alles mit FlashGet laden - D:\InetProgs\FlashGet\jc_all.htm O8 - Extra context menu item: Mit FlashGet laden - D:\InetProgs\FlashGet\jc_link.htm O9 - Extra button: Recherche-Assistent - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Encarta Researcher\EROPROJ.DLL O9 - Extra button: Preispiraten - {94A15285-AAE6-44E8-B2D7-4A2C6CDA9185} - D:\PcProgs\Preispiraten\preispiraten.exe O9 - Extra button: ICQ 4.1 - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\InetProgs\ICQLite\ICQLite.exe O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\InetProgs\ICQLite\ICQLite.exe O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\INETPR~1\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\INETPR~1\FlashGet\flashget.exe O16 - DPF: {CFCB7308-782F-11D4-BE27-000102598CE4} (NPX Control) - hyyp://kr.pristontale.com/nprotect/nprotect/npx.cab O16 - DPF: {FB48C7B0-EB66-4BE6-A1C5-9DDF3C37249A} (MCSendMessageHandler Class) - hyyp://xtraz.icq.com/xtraz/activex/MISBH.cab O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - D:\PcProgs\AntiVir6\AVGUARD.EXE O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINNT\system32\Ati2evxx.exe O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - D:\PcProgs\AntiVir6\AVWUPSRV.EXE O23 - Service: CPUCooLServer Service (CPUCooLServer) - Unknown owner - D:\PcProgs\CPUCooL\CooLSrv.exe O23 - Service: Verwaltungsdienst für die Verwaltung logischer Datenträger (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe O23 - Service: Network DDE Client (NetDDEclnt) - Unknown owner - C:\WINNT\system32\Winregs8.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINNT\system32\ZoneLabs\vsmon.exe Jetzt das Virus Log von Escan: File C:\WINNT\system32\Winregs8.exe infected by "Backdoor.Win32.Codbot.ae" Virus! Action Taken: No Action Taken. File C:\WINNT\system32\Winregs8.exe infected by "Backdoor.Win32.Codbot.ae" Virus! Action Taken: No Action Taken. Object "AltNet Spyware/Adware" found in File System! Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "DivX.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "qt-mt331.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "divxdec_0411.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "unicows.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "divxdec_0407.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "divx_xx0c.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "dpuGUI10.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "PSIKey.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "dpv10.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "divxdec_040c.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "dpus10.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "dpude.qm". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "divx_xx11.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "divx_xx07.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "dpu10.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{B0693766-5278-4ec6-B9E1-3CE40560EF5A}" refers to invalid object "CaPlgin.ax". Action Taken: No Action Taken. Entry "HKCR\CLSID\{D98E820F-6ACD-4dc0-921E-9841E3D8B4A7}" refers to invalid object "F:\player\WMMP.EXE". Action Taken: No Action Taken. Entry "HKCR\CLSID\{F4C6D6E0-A8FB-4281-BE24-1662D646FE2B}" refers to invalid object "F:\player\WMMP.EXE". Action Taken: No Action Taken. Entry "HKCR\CLSID\{FBE840E5-13A5-4cff-B2A9-4D1E64A17FF2}" refers to invalid object "F:\player\WMMP.EXE". Action Taken: No Action Taken. File C:\WINNT\autoload.exe tagged as not-a-virus:Tool.Win32.Autoloader. No Action Taken. File C:\WINNT\_MSRSTRT.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\WINNT\system32\IExplore8.exe infected by "Backdoor.Win32.Rbot.gen" Virus! Action Taken: No Action Taken. File C:\DOKUME~1\MeinName\LOKALE~1\TEMPOR~1\Content.IE5\BTTJZ1EM\script[2].php infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken. File C:\DOKUME~1\MeinName\LOKALE~1\TEMPOR~1\Content.IE5\R79PD592\archive[1].jar infected by "Exploit.Java.Bytverify" Virus! Action Taken: No Action Taken. File C:\DOKUME~1\MeinName\LOKALE~1\TEMPOR~1\Content.IE5\U4UXNT40\sload[1].chm infected by "Trojan-Downloader.Win32.VB.kq" Virus! Action Taken: No Action Taken. File C:\Dokumente und Einstellungen\MeinName\Lokale Einstellungen\Temporary Internet Files\Content.IE5\BTTJZ1EM\script[2].php infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken. File C:\Dokumente und Einstellungen\MeinName\Lokale Einstellungen\Temporary Internet Files\Content.IE5\R79PD592\archive[1].jar infected by "Exploit.Java.Bytverify" Virus! Action Taken: No Action Taken. File C:\Dokumente und Einstellungen\MeinName\Lokale Einstellungen\Temporary Internet Files\Content.IE5\U4UXNT40\sload[1].chm infected by "Trojan-Downloader.Win32.VB.kq" Virus! Action Taken: No Action Taken. File C:\Programme\Mplayer\System\unwise32.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\WINNT\autoload.exe tagged as not-a-virus:Tool.Win32.Autoloader. No Action Taken. File C:\WINNT\system32\IExplore8.exe infected by "Backdoor.Win32.Rbot.gen" Virus! Action Taken: No Action Taken. File C:\WINNT\system32\Macromed\Shockwave 8\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\WINNT\_MSRSTRT.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File D:\BLuB\Blödsinn\Fun\INBOX.exe tagged as not-a-virus:Effect.Win16.MessageMates. No Action Taken. File D:\BLuB\Blödsinn\Fun\Schniedel.exe infected by "not-virus:BadJoke.Win32.Delf.m" Virus! Action Taken: No Action Taken. File D:\BLuB\Blödsinn\Fun\Viagra.exe tagged as not-a-virus:Joke.Win32.Viagra. No Action Taken. File D:\BLuB\Blödsinn\FunnyProgs\INBOX.exe tagged as not-a-virus:Effect.Win16.MessageMates. No Action Taken. File D:\BLuB\Blödsinn\FunnyProgs\Viagra.exe tagged as not-a-virus:Joke.Win32.Viagra. No Action Taken. File D:\Downloads\InetProgs\Flashget.exe tagged as "not-a-virus:AdWare.Cydoor". Action Taken: No Action Taken. File D:\Downloads\InetProgs\iMeshV31.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File D:\Downloads\InetProgs\mirc614.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.14. No Action Taken. File D:\Downloads\InetProgs\PopUpStopper26.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File D:\Downloads\Progs\Ad-aware 6.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File D:\Downloads\Progs\Ad-aware Deutsch Lang.pack.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File D:\Downloads\Progs\Adaware Version 5.83.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File D:\Downloads\Progs\Adaware Version 6 Build 181.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File D:\Downloads\Progs\Audiograbber\Audiograbber.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File D:\Downloads\Progs\MediaPlayer7.1\DIVXPRO502GAINBUNDLE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File D:\Downloads\Progs\Zonealarm German.ace tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File D:\Downloads\Progs\Zonealarm.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File D:\Downloads\Spiele\EsseXScriptpack2.2.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File D:\InetProgs\FlashGet\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File D:\InetProgs\Game spy\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File D:\InetProgs\Gamespy\ArcadeInstallFull111b.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File D:\InetProgs\Gamespy\ArcadeInstallFull13e.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File D:\InetProgs\Gamespy\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File D:\InetProgs\ICQLite\Unwise32.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File D:\InetProgs\mIRC\mirc.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.14. No Action Taken. File D:\PcProgs\ACDSee\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File D:\PcProgs\Ad-Aware SE Personal\Plugins\Langs\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File D:\PcProgs\Ad-Aware SE Personal\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File D:\PcProgs\Paint Shop Pro 5\Unwise.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File E:\Downloads2\Nicht getestet\Proggies\aida32ee_393.zip tagged as not-a-virus:Tool.Win32.AIDA.3862. No Action Taken. File E:\Downloads2\Nicht getestet\Proggies\Craagle.exe tagged as "not-a-virus:AdWare.Craagle.19". Action Taken: No Action Taken. File E:\Downloads2\Nicht getestet\Proggies\Steinberg Clean 5.0.1.23.rar tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File E:\Empire Earth 2\ArcadeInstallEEARTH2_20.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File E:\Steam\SteamApps\emailadresse\counter-strike\cstrike\ProblemFixer.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File E:\Steam\SteamApps\emailadresse\counter-strike\cstrike\SayscriptKonfiguration.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File E:\Steam\SteamApps\emailadresse\counter-strike\cstrike\UninstallEsseX.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File E:\Steam\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File E:\zNewInstall\McAffeePersonalFirewallPlus.zip tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File E:\zNewInstall\Progs\Ad-aware\Ad-Aware SE 1.05.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File E:\zNewInstall\Progs\Ad-aware\Ad-Aware SE LangPack.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File E:\zNewInstall\Zone Alarm 51.039.004.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File E:\zNewInstall\Zone Alarm Setup 51.033 Deutsch.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. Dann hätte ich noch ein paar Fragen: - Was genau hab ich gemacht, als ich die O1 Einträge "gefixt" hab?? - Was ist eine CWS Infektion?? - Was haben die ganzen Virusmeldungen von Escan zu Bedeuten?? - Was der Eintrag O23 mit der Winregs8.exe bedeutet, weiss ich nich hatte gehofft ihr habt ne Antwort für mich. ;) - Was gehört noch nicht in mein FileLog?? z.B. Pristontale hab ich schon seit Ewigkeiten gelöscht. Viele Fragen, ich hoffe ihr könnt mir noch ein paar Infos dazu geben, damit ich mal weiter in der Sache durchblicke. Danke. so far LastBoyScout |
Zitat:
|
was ist denn dieses Backdoor Win32 und wo fängt man sich sowas ein? |
Zitat:
Zitat:
|
un woran erkennt man diese Malware und was ist das schon wieder??? :confused: |
|
| Alle Zeitangaben in WEZ +1. Es ist jetzt 11:21 Uhr. |
Copyright ©2000-2025, Trojaner-Board