hilfe erbeten
 

habe hier ein infiziertes system. Kann mir mal bitte jemand die escan log und die hjt log auswerten und mir sagen was ich dagegen tun kann.

thx
urs

escan:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Header
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Microsoft Windows XP [Version 5.1.2600]
Fri Feb 16 20:58:21 2007 => Deleting Registry Key: HKLM\Software\Microsoft\Windows\CurrentVersion\uninstall\video activex object
Fri Feb 16 16:37:55 2007 => Virus Database Date: 2/16/2007
Fri Feb 16 16:38:20 2007 => Virus Database Date: 2/16/2007
Fri Feb 16 20:53:03 2007 => Virus Database Date: 2/16/2007
Fri Feb 16 20:56:01 2007 => Virus Database Date: 2/16/2007
Fri Feb 16 22:04:39 2007 => Virus Database Date: 2/16/2007
Fri Feb 16 22:05:03 2007 => Virus Database Date: 2/16/2007
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Infektionsmeldungen
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Fri Feb 16 20:58:20 2007 => System found infected with spywarequake Corrupted Adware/Spyware ({661173ee-fa31-4769-97d4-b556b5d09bda})! Action taken: Entries Removed.
Fri Feb 16 20:58:25 2007 => System found infected with smitfraud Browser Hijacker (online security guide.url)! Action taken: Entries Removed.
Fri Feb 16 20:58:25 2007 => System found infected with smitfraud Browser Hijacker (security troubleshooting.url)! Action taken: Entries Removed.
Fri Feb 16 20:58:25 2007 => System found infected with smitfraud Browser Hijacker (online security guide.url)! Action taken: Entries Removed.
Fri Feb 16 20:58:25 2007 => System found infected with smitfraud Browser Hijacker (security troubleshooting.url)! Action taken: Entries Removed.
~~~~~~~~~~~
Dateien
~~~~~~~~~~~
~~~~ Infected files
~~~~~~~~~~~
Fri Feb 16 21:01:32 2007 => File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Symantec\Norton AntiVirus\Quarantine\1013297C.tmp//CryptFF infected by "Email-Worm.Win32.Bagle.gen" Virus! Action Taken: File Deleted.
Fri Feb 16 21:03:25 2007 => File C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\Identities\{B174353D-63B6-4F62-AADC-E0B434D38F6F}\Microsoft\Outlook Express\Gelöschte Objekte.dbx/[From:"Anne" <***@yahoo.com>][Subject:Humphrie][Time:2006/12/22 09:33:... infected by "Email-Worm.Win32.Bagle.mail" Virus! Action Taken: No Action Taken.
Fri Feb 16 21:14:24 2007 => File C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Temporary Internet Files\Content.IE5\VSW4TQ9L\vasetup.1558[1].exe//PE_Patch.UPX//UPX//data0007 infected by "Trojan-Downloader.Win32.Zlob.bog" Virus! Action Taken: File Deleted.
Fri Feb 16 21:36:29 2007 => File C:\RECYCLER\S-1-5-21-1406798487-3723314705-3210121192-1006\Dc102.bak/[From:"Anne" <***@yahoo.com>][Subject:Humphrie][Time:2006/12/22 09:33:25]/text/html infected by "Email-Worm.Win32.Bagle.mail" Virus! Action Taken: File Deleted.
Fri Feb 16 21:37:22 2007 => File C:\RECYCLER\S-1-5-21-1406798487-3723314705-3210121192-1006\Dc121.bak/[From:"Anne" <***@yahoo.com>][Subject:Humphrie][Time:2006/12/22 09:33:25]/text/html infected by "Email-Worm.Win32.Bagle.mail" Virus! Action Taken: File Deleted.
Fri Feb 16 21:39:15 2007 => File C:\RECYCLER\S-1-5-21-1406798487-3723314705-3210121192-1006\Dc45.bak/[From:"Anne" <***@yahoo.com>][Subject:Humphrie][Time:2006/12/22 09:33:25]/text/html infected by "Email-Worm.Win32.Bagle.mail" Virus! Action Taken: File Deleted.
Fri Feb 16 21:39:58 2007 => File C:\RECYCLER\S-1-5-21-1406798487-3723314705-3210121192-1006\Dc64.bak/[From:"Anne" <***@yahoo.com>][Subject:Humphrie][Time:2006/12/22 09:33:25]/text/html infected by "Email-Worm.Win32.Bagle.mail" Virus! Action Taken: File Deleted.
Fri Feb 16 21:40:44 2007 => File C:\RECYCLER\S-1-5-21-1406798487-3723314705-3210121192-1006\Dc83.bak/[From:"Anne" <***@yahoo.com>][Subject:Humphrie][Time:2006/12/22 09:33:25]/text/html infected by "Email-Worm.Win32.Bagle.mail" Virus! Action Taken: File Deleted.
Fri Feb 16 21:46:03 2007 => File C:\System Volume Information\_restore{22DE99A3-49F6-48CA-9CB1-AB19DE94D58C}\RP83\A0004701.exe infected by "Trojan-Downloader.Win32.Zlob.boi" Virus! Action Taken: File Deleted.
Fri Feb 16 21:46:05 2007 => File C:\System Volume Information\_restore{22DE99A3-49F6-48CA-9CB1-AB19DE94D58C}\RP83\A0004742.exe infected by "Trojan-Downloader.Win32.Zlob.boi" Virus! Action Taken: File Deleted.
Fri Feb 16 21:46:05 2007 => File C:\System Volume Information\_restore{22DE99A3-49F6-48CA-9CB1-AB19DE94D58C}\RP83\A0004751.exe infected by "Trojan-Downloader.Win32.Zlob.boi" Virus! Action Taken: File Deleted.
Fri Feb 16 21:46:05 2007 => File C:\System Volume Information\_restore{22DE99A3-49F6-48CA-9CB1-AB19DE94D58C}\RP83\A0004758.exe infected by "Trojan-Downloader.Win32.Zlob.boi" Virus! Action Taken: File Deleted.
Fri Feb 16 21:46:06 2007 => File C:\System Volume Information\_restore{22DE99A3-49F6-48CA-9CB1-AB19DE94D58C}\RP83\A0004769.exe infected by "Trojan-Downloader.Win32.Zlob.boi" Virus! Action Taken: File Deleted.
Fri Feb 16 21:46:07 2007 => File C:\System Volume Information\_restore{22DE99A3-49F6-48CA-9CB1-AB19DE94D58C}\RP84\A0004780.exe infected by "Trojan-Downloader.Win32.Zlob.boi" Virus! Action Taken: File Deleted.
Fri Feb 16 21:46:08 2007 => File C:\System Volume Information\_restore{22DE99A3-49F6-48CA-9CB1-AB19DE94D58C}\RP84\A0004791.exe infected by "Trojan-Downloader.Win32.Zlob.boi" Virus! Action Taken: File Deleted.
Fri Feb 16 21:46:08 2007 => File C:\System Volume Information\_restore{22DE99A3-49F6-48CA-9CB1-AB19DE94D58C}\RP84\A0004802.exe infected by "Trojan-Downloader.Win32.Zlob.boi" Virus! Action Taken: File Deleted.
Fri Feb 16 21:46:08 2007 => File C:\System Volume Information\_restore{22DE99A3-49F6-48CA-9CB1-AB19DE94D58C}\RP84\A0004817.exe infected by "Trojan-Downloader.Win32.Zlob.boi" Virus! Action Taken: File Deleted.
Fri Feb 16 21:46:09 2007 => File C:\System Volume Information\_restore{22DE99A3-49F6-48CA-9CB1-AB19DE94D58C}\RP84\A0004828.exe infected by "Trojan-Downloader.Win32.Zlob.boi" Virus! Action Taken: File Deleted.
Fri Feb 16 21:46:09 2007 => File C:\System Volume Information\_restore{22DE99A3-49F6-48CA-9CB1-AB19DE94D58C}\RP84\A0004837.exe infected by "Trojan-Downloader.Win32.Zlob.boi" Virus! Action Taken: File Deleted.
Fri Feb 16 21:46:09 2007 => File C:\System Volume Information\_restore{22DE99A3-49F6-48CA-9CB1-AB19DE94D58C}\RP84\A0004848.exe infected by "Trojan-Downloader.Win32.Zlob.boi" Virus! Action Taken: File Deleted.
Fri Feb 16 21:46:09 2007 => File C:\System Volume Information\_restore{22DE99A3-49F6-48CA-9CB1-AB19DE94D58C}\RP84\A0004860.exe infected by "Trojan-Downloader.Win32.Zlob.boi" Virus! Action Taken: File Deleted.
Fri Feb 16 21:46:10 2007 => File C:\System Volume Information\_restore{22DE99A3-49F6-48CA-9CB1-AB19DE94D58C}\RP84\A0004875.exe infected by "Trojan-Downloader.Win32.Zlob.boi" Virus! Action Taken: File Deleted.
~~~~~~~~~~~
~~~~ Tagged files
~~~~~~~~~~~
Fri Feb 16 21:15:18 2007 => File C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Temporary Internet Files\Content.IE5\WLMVOHE7\zugang-gratis[1].exe tagged as "not-a-virus:AdWare.Win32.Stud.a". Action Taken: File Deleted.
~~~~~~~~~~~
~~~~ Offending files
~~~~~~~~~~~
Fri Feb 16 20:58:25 2007 => Offending file found: C:\DOKUME~1\ALLUSE~1\Desktop\ONLINE~1.URL
Fri Feb 16 20:58:25 2007 => Offending file found: C:\DOKUME~1\ALLUSE~1\Desktop\SECURI~1.URL
Fri Feb 16 20:58:25 2007 => Offending file found: C:\DOKUME~1\ALLUSE~1\STARTM~1\ONLINE~1.URL
Fri Feb 16 20:58:25 2007 => Offending file found: C:\DOKUME~1\ALLUSE~1\STARTM~1\SECURI~1.URL
~~~~~~~~~~~
Ordner
~~~~~~~~~~~
Fri Feb 16 20:58:23 2007 => Offending Folder found: C:\Programme\spydawn
Fri Feb 16 20:58:23 2007 => Offending Folder found: C:\Programme\video activex object
~~~~~~~~~~~
Registry
~~~~~~~~~~~
Fri Feb 16 20:58:21 2007 => Offending Key found: HKLM\Software\Microsoft\Windows\CurrentVersion\uninstall\video activex object !!!
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Statistiken:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~







______________________________________________________________


HJTLog:

Logfile of HijackThis v1.99.1
Scan saved at 22:26:23, on 16.02.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Gemeinsame Dateien\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\o2flash.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\sm56hlpr.exe
C:\Programme\CyberLink\PowerDVD\PDVDServ.exe
C:\Programme\QuickTime\qttask.exe
C:\Programme\iTunes\iTunesHelper.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\MESSEN~1\Msmsgs.exe
C:\Programme\iPod\bin\iPodService.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Dokumente und Einstellungen\***\Desktop\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Programme\Gemeinsame Dateien\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Programme\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Norton-Symbolleiste anzeigen - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Programme\Gemeinsame Dateien\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] C:\Programme\CyberLink\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Programme\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programme\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Programme\Norton Internet Security\osCheck.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "c:\PROGRA~1\MESSEN~1\Msmsgs.exe" /background
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: Easy-WebPrint - Drucken - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint - Schnelldruck - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint - Vorschau - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint - Zu Druckliste hinzufügen - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @c:\Programme\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @c:\Programme\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\Programme\Messenger\msmsgs.exe
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O21 - SSODL: eitheror - {2016a466-91a2-43c6-97d8-2fd380f065ef} - C:\WINDOWS\system32\higehsg.dll
O23 - Service: Automatisches LiveUpdate - Scheduler - Symantec Corporation - C:\Programme\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\VAScanner\comHost.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Kennwortprüfung (ISPwdSvc) - Symantec Corporation - C:\Programme\Norton Internet Security\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: O2Micro Flash Memory (O2Flash) - Unknown owner - C:\WINDOWS\system32\o2flash.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\AppCore\AppSvc32.exe

Morgen,

Aus deinem Zoo hast du wohl alle vertrieben außer diesen Worm.

Ach, dein Hijacklogfike sagt jedoch noch mehr:
das ist der Win32.Rogue.Spydawn.

-> Also nachdem da einiges an Würmern und Trojanern auf deinem
System war / ist, rate ich doch zu einem Neu aufsetzen (siehe sig). Der
Schaden ist an deinem System wahrscheinlich schon sehr hoch.

mfg Cleriker

Hi,
wer lernen will muss fragen, nicht? :D
Daher mal eine leichte Off-Topic-Frage:
Und mich irritiert schon länger,dass solche Einträge:
als Kontaminierung aufgefaßt werden.

An sich ist dass doch nur eine Email die vom Outlook heruntergeladen wurde und dann gelöscht worden ist, müßte man da nicht erst noch den Anhang auch tatsächlich ausführen, bevor sich der Wurm breit macht. Ansonsten wären ja sämtliche Mailprogramme nen riesiges Sicherheitsloch, oder? :o

lg myrtille