Spyware, bitte um Hilfe!
 

Hallo Leute,

vielleicht könnt Ihr mir weiterhelfen. Ich habe beim E-Scan folgende Fehlermeldungen:

Object "wareout Adware" found in File System! Action Taken: No Action Taken.
Object "Wareout adware" found in File System! Action Taken: No Action Taken.
Object "ezula Spyware/Adware" found in File System! Action Taken: No Action Taken.

Sind diese Objekte gefährlich?? Wen ja, wie kann ich sie loswerden? Ich habe noch zusätzlich die Logfile vom Hijacker dazugefügt:

ogfile of HijackThis v1.99.1
Scan saved at 13:13:54, on 30.07.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Gemeinsame Dateien\AccSys\AccWLSvc.exe
C:\Programme\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
C:\Programme\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZONELABS\vsmon.exe
C:\Programme\Gemeinsame Dateien\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Programme\Gemeinsame Dateien\Softwin\BitDefender Scan Server\bdss.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Programme\Synaptics\SynTP\SynTPLpr.exe
C:\Programme\Synaptics\SynTP\SynTPEnh.exe
C:\Programme\Launch Manager\QtZgAcer.EXE
C:\Programme\Acer\Notebook Manager\almxptray.exe
C:\Programme\QDI\UDTools\UDTools.exe
C:\Programme\WLAN Monitor\wlconfig.exe
C:\Programme\Softwin\BitDefender Free Edition\bdmcon.exe
C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe
C:\Programme\Java\jre1.5.0_03\bin\jusched.exe
C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
C:\Programme\Messenger\msmsgs.exe
C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
C:\Programme\Skype\Phone\Skype.exe
C:\Programme\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Hijackthis\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http:///
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar3.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar3.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Programme\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [LManager] C:\Programme\Launch Manager\QtZgAcer.EXE
O4 - HKLM\..\Run: [AcerNotebookManager] C:\Programme\Acer\Notebook Manager\almxptray.exe
O4 - HKLM\..\Run: [hpfsched] C:\WINDOWS\hpfsched.exe
O4 - HKLM\..\Run: [UDTools] C:\Programme\QDI\UDTools\UDTools.exe
O4 - HKLM\..\Run: [wlconfig] C:\Programme\WLAN Monitor\wlconfig.exe -autostart
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [BDMCon] C:\Programme\Softwin\BitDefender Free Edition\\bdmcon.exe
O4 - HKLM\..\Run: [BDNewsAgent] C:\Programme\Softwin\BitDefender Free Edition\\bdnagent.exe
O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Skype] "C:\Programme\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Service Manager.lnk = C:\Programme\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Google-Suche - res://c:\programme\google\GoogleToolbar3.dll/cmsearch.html
O8 - Extra context menu item: &Ins Deutsche übersetzen - res://c:\programme\google\GoogleToolbar3.dll/cmwordtrans.html
O8 - Extra context menu item: Im Cache gespeicherte Seite - res://c:\programme\google\GoogleToolbar3.dll/cmcache.html
O8 - Extra context menu item: Verweisseiten - res://c:\programme\google\GoogleToolbar3.dll/cmbacklinks.html
O8 - Extra context menu item: Ähnliche Seiten - res://c:\programme\google\GoogleToolbar3.dll/cmsimilar.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2EF3FB47-7B1E-4536-BA4D-51427BD45DFA} (PIXACO Drag and Drop upload plugin) - http://www.pixaco.de/static/download/pixacodndupload.cab
O16 - DPF: {3EEFCD4B-E9FD-4601-BE5D-C5C1776E51D3} (AICPASSV.Spreadsheet) - http://www.cpa-exam.org/AICPATutorialv2/install/SSItem.cab
O16 - DPF: {4DCCD2FC-132F-45EC-BFDA-72235B85047C} (AICPAAuthLit.AuthLitItem) - http://www.cpa-exam.org/AICPATutorialv2/install/SimItems.cab
O16 - DPF: {51EA44E6-C8C3-4E30-8F3D-D8EE71A44DCB} (Upload Control) - https://img.web.de/v/fotoalbum/activex/upload_1115.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1134583194644
O16 - DPF: {909A35CA-61DC-4437-887E-30ED6D89F6C8} (AICPAUI.ucHyperlink) - http://www.cpa-exam.org/AICPATutorialv2/install/General.cab
O16 - DPF: {96F2228B-0D43-48AC-B857-29972C87EBA4} (AICPACR.ConstructedResponse) - http://www.cpa-exam.org/AICPATutorialv2/install/CRItem.CAB
O16 - DPF: {C2D46EE6-57E2-4E81-AD94-E4DE41C12C8E} (AICPAViewer.clsViewer) - http://www.cpa-exam.org/AICPATutorialv2/install/AICPAViewer.cab
O16 - DPF: {D4C9E474-9A6C-4FBF-B13A-4BE2BDD34FD5} (AICPA treeView control) - http://www.cpa-exam.org/AICPATutorialv2/install/AICPAViewerIL.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AccSys WiFi Server (AccWLSvc) - AccSys GmbH - C:\Programme\Gemeinsame Dateien\AccSys\AccWLSvc.exe
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - AVIRA GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Programme\Gemeinsame Dateien\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZONELABS\vsmon.exe
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Programme\Gemeinsame Dateien\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)

Danke für Eure Hilfe!
Pedro

Hallo,

poste das gesamte Logfile, wie hier beschrieben.

Gruß

Schrulli

un Jul 30 15:59:16 2006 => ***** Scanning Registry and File system for Adware/Spyware *****
Sun Jul 30 15:59:16 2006 => Loading Spyware Signatures from new External Database (Size: 161180).
Sun Jul 30 15:59:16 2006 => Indexed Spyware Databases Successfully Created...

Sun Jul 30 15:59:18 2006 => Offending Key found: HKLM\Software\Microsoft\Windows\CurrentVersion\ruins !!!
Sun Jul 30 15:59:25 2006 => Object "wareout Adware" found in File System! Action Taken: No Action Taken.

Sun Jul 30 15:59:25 2006 => Offending Key found: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ruins !!!
Sun Jul 30 15:59:25 2006 => Object "Wareout adware" found in File System! Action Taken: No Action Taken.

Sun Jul 30 15:59:28 2006 => Offending file found: C:\Dokumente und Einstellungen\Peter\Favoriten\privat\reise\flüge\expedia.url
Sun Jul 30 15:59:28 2006 => System found infected with ezula Spyware/Adware (expedia.url)! Action taken: No Action Taken.

Hallo,

noch mal versuchen

Gruß :)

Schrulli

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Infektionsmeldungen
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Sun Jul 30 13:17:40 2006 => System found infected with ezula Spyware/Adware (expedia.url)! Action taken: No Action Taken.
Sun Jul 30 15:59:28 2006 => System found infected with ezula Spyware/Adware (expedia.url)! Action taken: No Action Taken.
Sun Jul 30 13:17:38 2006 => Object "wareout Adware" found in File System! Action Taken: No Action Taken.
Sun Jul 30 13:17:38 2006 => Object "Wareout adware" found in File System! Action Taken: No Action Taken.
Sun Jul 30 15:59:25 2006 => Object "wareout Adware" found in File System! Action Taken: No Action Taken.
Sun Jul 30 15:59:25 2006 => Object "Wareout adware" found in File System! Action Taken: No Action Taken.
~~~~~~~~~~~
Dateien
~~~~~~~~~~~
~~~~ Infected files
~~~~~~~~~~~
~~~~~~~~~~~
~~~~ Offending files
~~~~~~~~~~~
Sun Jul 30 13:17:40 2006 => Offending file found: C:\Dokumente und Einstellungen\Peter\Favoriten\privat\reise\flüge\expedia.url
Sun Jul 30 15:59:28 2006 => Offending file found: C:\Dokumente und Einstellungen\Peter\Favoriten\privat\reise\flüge\expedia.url
~~~~~~~~~~~
~~~~ Tagged files
~~~~~~~~~~~
~~~~~~~~~~~
Ordner
~~~~~~~~~~~
~~~~~~~~~~~
Registry
~~~~~~~~~~~
Sun Jul 30 13:17:36 2006 => Offending Key found: HKLM\Software\Microsoft\Windows\CurrentVersion\ruins !!!
Sun Jul 30 13:17:38 2006 => Offending Key found: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ruins !!!
Sun Jul 30 15:59:18 2006 => Offending Key found: HKLM\Software\Microsoft\Windows\CurrentVersion\ruins !!!
Sun Jul 30 15:59:25 2006 => Offending Key found: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ruins !!!
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Statistiken:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Sun Jul 30 14:12:55 2006 => Total Errors: 124
Sun Jul 30 16:04:19 2006 => Total Errors: 3
Sun Jul 30 14:12:55 2006 => Time Elapsed: 00:55:59
Sun Jul 30 16:04:19 2006 => Time Elapsed: 00:05:59
Sun Jul 30 14:12:55 2006 => Total Objects Scanned: 57229
Sun Jul 30 16:04:19 2006 => Total Objects Scanned: 16826
Sun Jul 30 13:16:46 2006 => Virus Database Date: 6/28/2006
Sun Jul 30 14:12:55 2006 => Virus Database Date: 6/28/2006
Sun Jul 30 14:17:06 2006 => Virus Database Date: 6/28/2006
Sun Jul 30 15:57:48 2006 => Virus Database Date: 6/28/2006
Sun Jul 30 16:04:19 2006 => Virus Database Date: 6/28/2006
Sun Jul 30 16:26:02 2006 => Virus Database Date: 6/28/2006
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
--------------------------------------------------
C:\Dokumente und Einstellungen\Peter\Lokale Einstellungen\Temp\MWAV.LOG

Hallo,

sieht imho sauber aus, die Offending Einträge sind fales positives.

Gruß

Schrulli

Sorry, ich verstehe Dich nicht. Was meinst Du mit "imho sauber" und "fales positives? Wenn alles OK ist, warum tauchen diese Meldungen auf?

Hallo,

imho liest Du hier nach oder = In My Humble Opinion = meiner bescheidenen Meinung nach.
Als false postives werden Falschmeldungen bezeichnet.
eScan meldet Dir Dateien als verdächtig, die eine gewisse Schreibweise, wie bekannte Schadsoftware haben.
Soweit also alles in Ordnung bei Dir.

Gruß

Schrulli