|
Seltsame Firewall-Meldung Hi, ich habe in den letzten Tagen einige Malware entfernt, doch drei merkwürdige Erscheinungen bleiben:
Logfile of HijackThis v1.99.1 Scan saved at 02:51:55, on 30.11.2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Programme\Ahead\InCD\InCDsrv.exe C:\WINDOWS\system32\spoolsv.exe C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe C:\Programme\Alwil Software\Avast4\aswUpdSv.exe C:\Programme\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\System32\cisvc.exe C:\WINDOWS\System32\CTSvcCDA.EXE C:\Programme\HealthMonitor\HealthMonitor.exe C:\WINDOWS\System32\inetsrv\inetinfo.exe C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\mqsvc.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\mqtgsvc.exe C:\Programme\TortoiseSVN\bin\TSVNCache.exe C:\Programme\WinPortrait\wpctrl.exe C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe C:\Programme\Java\jre1.5.0_05\bin\jusched.exe C:\PROGRA~1\INTERN~2\MEDIAKEY.EXE C:\Programme\Ahead\InCD\InCD.exe C:\PROGRAMME\SCANJET\PrecisionScanLT\hppwrsav.exe C:\PROGRA~1\D4\D4.exe C:\Programme\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe C:\WINDOWS\system32\CTHELPER.EXE C:\Programme\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Programme\Acronis\TrueImage\TrueImageMonitor.exe C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe C:\Programme\Creative\MediaSource\RemoteControl\RCMan.EXE C:\WINDOWS\system32\ctfmon.exe C:\Programme\GnuPT\GPGRelay\GPGrelay.exe C:\Programme\IMAP Notify\IMAPNotify.exe C:\PROGRA~1\INTERN~2\KBOSDCtl.EXE C:\Programme\Miranda IM\miranda32.exe C:\PROGRA~1\INTERN~2\KCodeMsg.EXE C:\WINDOWS\msagent\AgentSvr.exe C:\Programme\PopTray\PopTray.exe C:\Programme\GnuPT\WPT\WinPT.exe C:\Programme\WinPortrait\floater.exe C:\WINDOWS\system32\wuauclt.exe C:\Programme\Alwil Software\Avast4\ashMaiSv.exe C:\Programme\Alwil Software\Avast4\ashWebSv.exe C:\Programme\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/advanced_search?hl=de R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.int.robustsoft.de:3128 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = robustsoft.de;int.robustsoft.de;<local> O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: (no name) - {826B2228-BC09-49F2-B5F8-42CE26B1B712} - (no file) O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O4 - HKLM\..\Run: [PivotSoftware] "C:\Programme\WinPortrait\wpctrl.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_05\bin\jusched.exe O4 - HKLM\..\Run: [SBDrvDet] C:\Programme\Creative\SB Drive Det\SBDrvDet.exe /r O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [MediaKey] C:\PROGRA~1\INTERN~2\MEDIAKEY.EXE O4 - HKLM\..\Run: [InCD] C:\Programme\Ahead\InCD\InCD.exe O4 - HKLM\..\Run: [hppwrsav] C:\PROGRAMME\SCANJET\PrecisionScanLT\hppwrsav.exe O4 - HKLM\..\Run: [Dimension4] C:\PROGRA~1\D4\D4.exe O4 - HKLM\..\Run: [CTSysVol] C:\Programme\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE O4 - HKLM\..\Run: [CTDVDDET] C:\Programme\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [Acronis True Image Monitor] "C:\Programme\Acronis\TrueImage\TrueImageMonitor.exe" O4 - HKLM\..\Run: [Acronis Scheduler2 Service] C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe O4 - HKCU\..\Run: [RemoteCenter] C:\Programme\Creative\MediaSource\RemoteControl\RCMan.EXE O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - Startup: GPGRelay.lnk = C:\Programme\GnuPT\GPGRelay\GPGrelay.exe O4 - Startup: IMAP Notify.lnk = C:\Program Files\IMAP Notify\IMAPNotify.exe O4 - Startup: Miranda IM.lnk = C:\Programme\Miranda IM\miranda32.exe O4 - Startup: PopTray.lnk = C:\Programme\PopTray\PopTray.exe O4 - Startup: Windows Privacy Tray.lnk = C:\Programme\GnuPT\WPT\WinPT.exe O4 - Global Startup: AutoCAD-Startbeschleuniger.lnk = C:\Programme\Gemeinsame Dateien\Autodesk Shared\acstart16.exe O8 - Extra context menu item: Im Standard-Aggregator abonnieren - C:\Dokumente und Einstellungen\pschoenb\Anwendungsdaten\RssBandit\iecontext_subscribefeed.htm O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_05\bin\npjpi150_05.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_05\bin\npjpi150_05.dll O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesde.dll O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesde.dll O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Share in Hello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Programme\Hello\PicasaCapture.dll O9 - Extra 'Tools' menuitem: Share in H&ello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Programme\Hello\PicasaCapture.dll O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/downloads/kws/kavwebscan_unicode.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Programme\Yahoo!\Common\yinsthelper.dll O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/084aeb38bbac7e759a23/netzip/RdxIE601_de.cab O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20040428/qtinstall.info.apple.com/saba/de/win/QuickTimeInstaller.exe O16 - DPF: {6BEA1C48-1850-486C-8F58-C7354BA3165E} - O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/win/ActiveXPlugin.cab O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/2,0,0,4474/mcfscan.cab O16 - DPF: {FB48C7B0-EB66-4BE6-A1C5-9DDF3C37249A} (MCSendMessageHandler Class) - http://xtraz.icq.com/xtraz/activex/MISBH.cab O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = robustsoft.de O17 - HKLM\Software\..\Telephony: DomainName = robustsoft.de O17 - HKLM\System\CCS\Services\Tcpip\..\{1DE48C90-E102-4F49-9639-D27AAA5F93A0}: Domain = robustsoft.de O17 - HKLM\System\CCS\Services\Tcpip\..\{1DE48C90-E102-4F49-9639-D27AAA5F93A0}: NameServer = 195.243.152.186 O17 - HKLM\System\CCS\Services\Tcpip\..\{C2AF60CB-CD58-4FC3-B150-DF4309C17F32}: Domain = robustsoft.de O17 - HKLM\System\CCS\Services\Tcpip\..\{C2AF60CB-CD58-4FC3-B150-DF4309C17F32}: NameServer = 195.243.152.186 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = robustsoft.de O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = robustsoft.de,int.robustsoft.de O17 - HKLM\System\CS1\Services\Tcpip\..\{1DE48C90-E102-4F49-9639-D27AAA5F93A0}: Domain = robustsoft.de O17 - HKLM\System\CS1\Services\Tcpip\..\{1DE48C90-E102-4F49-9639-D27AAA5F93A0}: NameServer = 195.243.152.186 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = robustsoft.de,int.robustsoft.de O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Programme\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Programme\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programme\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Programme\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTSvcCDA.EXE O23 - Service: CVSNT (CVS) - GNU - C:\Programme\cvsnt\cvsservice.exe O23 - Service: CVSNT Locking Service (CVSLock) - Unknown owner - C:\Programme\cvsnt\cvslock.exe O23 - Service: HealthMonitor - Vittorio Pavesi - C:\Programme\HealthMonitor\HealthMonitor.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Programme\Ahead\InCD\InCDsrv.exe O23 - Service: Macromedia Licensing Service - Macromedia - C:\Programme\Gemeinsame Dateien\Macromedia Shared\Service\Macromedia Licensing.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing) O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware - C:\Programme\SiSoftware\SiSoftware Sandra Lite 2005.SR1\RpcDataSrv.exe O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware - C:\Programme\SiSoftware\SiSoftware Sandra Lite 2005.SR1\RpcSandraSrv.exe O23 - Service: VNC Server (winvnc) - Unknown owner - C:\Programme\TightVNC\WinVNC.exe" -service (file missing) |
Scanne mal dein System mit Escan und teile uns anschliessend die Ergebnisse mit. |
Zitat:
Hier das Log: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Funde für "infected" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Wed Nov 30 16:52:39 2005 => System found infected with w32/rbot-ank Email-Flooder ({19e28afc-eae3-4ce5-ac83-2407b42f57c9})! Action taken: No Action Taken. Wed Nov 30 16:52:40 2005 => System found infected with searchexe Spyware/Adware ({807553e5-5146-11d5-a672-00b0d022e945})! Action taken: No Action Taken. Wed Nov 30 16:52:40 2005 => System found infected with w32/rbot-ank Email-Flooder ({19e28afc-eae3-4ce5-ac83-2407b42f57c9})! Action taken: No Action Taken. Wed Nov 30 16:52:40 2005 => System found infected with netster Spyware/Adware ({56336bcb-3d8a-11d6-a00b-0050da18de71})! Action taken: No Action Taken. Wed Nov 30 16:52:46 2005 => System found infected with clipgenie Spyware/Adware (channels.ini)! Action taken: No Action Taken. Wed Nov 30 16:52:59 2005 => System found infected with whistlesoftware Spyware/Adware (version.ini)! Action taken: No Action Taken. Wed Nov 30 16:53:06 2005 => System found infected with hotbar Spyware/Adware (wbemess.lo_)! Action taken: No Action Taken. Wed Nov 30 16:53:17 2005 => System found infected with whistlesoftware Spyware/Adware (version.ini)! Action taken: No Action Taken. Wed Nov 30 16:55:47 2005 => Total Disinfected Files: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Funde für "tagged" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Funde für "offending" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Wed Nov 30 16:52:42 2005 => Offending Key found: HKLM\Software\gnu !!! Wed Nov 30 16:52:42 2005 => Offending Key found: HKCU\Software\gnu !!! Wed Nov 30 16:52:45 2005 => Offending Folder found: C:\Programme\gnu Wed Nov 30 16:52:46 2005 => Offending file found: C:\Dokumente und Einstellungen\pschoenb\Anwendungsdaten\chessbase\channels.ini Wed Nov 30 16:52:59 2005 => Offending file found: C:\Dokumente und Einstellungen\pschoenb\Eigene Dateien\projekte\java\workspace\.metadata\version.ini Wed Nov 30 16:53:06 2005 => Offending file found: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\spybot - search & destroy\backups\wbemess.lo_ Wed Nov 30 16:53:17 2005 => Offending file found: C:\Dokumente und Einstellungen\pschoenb\Eigene Dateien\projekte\java\workspace\.metadata\version.ini ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Statistiken: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Wed Nov 30 16:55:47 2005 => Total Virus(es) Found: 11 Wed Nov 30 16:55:47 2005 => Total Errors: 417 Wed Nov 30 16:55:47 2005 => Time Elapsed: 00:04:25 Wed Nov 30 16:55:47 2005 => Total Objects Scanned: 29916 Wed Nov 30 16:55:47 2005 => Virus Database Date: 2005/11/30 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~ © Haui ;-) ~~~~~~~ ~~~~~~~ Dank an Cidre ~~~~~~~ |
| Alle Zeitangaben in WEZ +1. Es ist jetzt 06:17 Uhr. |
Copyright ©2000-2025, Trojaner-Board