was ist av-scanner??

den antivir meinst du??

Genau! ;) Den meine ich...

der link zum look2me destroyer funktioniert leider nicht. hast du einen anderen link??
nach dem ersten virenscann über antivir hat er keine viren gefunden.
muss aber noch die anderen schritte erledigen

Bei mir funktioniert der Link, vielleicht war er gestern abend kurz down?! ;)

Sunny

webhancer ist deinstalliert worden.

Look2Me-Destroyer V1.0.12

Scanning for infected files.....
Scan started at 24.04.2007 10:53:12


Attempting to delete infected files...

Making registry repairs.


Restoring Windows certificates.

Replaced hosts file with default windows hosts file


Restoring SeDebugPrivilege for Administratoren - Succeeded



Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\ywademjo

*******************

Script file located at: \??\C:\nojxsnea.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

File C:\36110103225.exe deleted successfully.


File C:\WINDOWS\webhdll.dll not found!
Deletion of file C:\WINDOWS\webhdll.dll failed!

Could not process line:
C:\WINDOWS\webhdll.dll
Status: 0xc0000034



File C:\WINDOWS\whinstaller.exe not found!
Deletion of file C:\WINDOWS\whinstaller.exe failed!

Could not process line:
C:\WINDOWS\whinstaller.exe
Status: 0xc0000034

File C:\Programme\myway\mybar\settings\prevcfg.htm deleted successfully.
File C:\Programme\myway\mybar\1.bin\mybar.dll deleted successfully.
File C:\WINDOWS\System32\DRIVERS\Ip6Fw.sys deleted successfully.
File C:\WINDOWS\SYSTEM32\KSYS.SYS deleted successfully.
File C:\WINDOWS\System32\wsys.dll deleted successfully.
File C:\WINDOWS\Temp\216881.exe deleted successfully.


File Folder to delete: not found!
Deletion of file Folder to delete: failed!

Could not process line:
Folder to delete:
Status: 0xc0000034



Error: C:\PROGRA~1\myway is a folder, not a file!
Deletion of file C:\PROGRA~1\myway failed!

Could not process line:
C:\PROGRA~1\myway
Status: 0xc00000ba


Completed script processing.

*******************

Finished! Terminate.


Logfile of HijackThis v1.99.1
Scan saved at 12:49:44, on 24.04.2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
C:\Programme\QuickTime\qttask.exe
C:\Programme\Java\jre1.5.0_03\bin\jusched.exe
C:\Programme\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Programme\ICQLite\ICQLite.exe
C:\Programme\T-Online\T-Online_Software_5\Basis-Software\Basis1\ToADiMon.exe
C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe
C:\Programme\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Programme\Mobile Phone Manager\bin\Mobile Phone Manager.exe
C:\PROGRA~1\MOBILE~1\bin\SCfgSrv.exe
C:\Programme\Gemeinsame Dateien\Teleca Shared\CapabilityManager.exe
C:\PROGRA~1\MOBILE~1\bin\DESPROXY.exe
C:\PROGRA~1\MOBILE~1\bin\SPHONE~1.EXE
C:\PROGRA~1\MOBILE~1\bin\SCONTA~1.EXE
C:\PROGRA~1\MOBILE~1\bin\MESSAG~1.EXE
C:\PROGRA~1\MOBILE~1\bin\MPMPim.exe
C:\Programme\Gemeinsame Dateien\Teleca Shared\Generic.exe
C:\Programme\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Programme\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\T-Online\T-Online_Software_5\Basis-Software\Basis2\kernel.exe
C:\Programme\T-Online\T-Online_Software_5\Basis-Software\Basis2\sc_watch.exe
C:\PROGRA~1\T-Online\T-ONLI~1\BASIS-~1\Basis2\PROFIL~1.EXE
C:\PROGRAMME\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
E:\***\Sonstiges\Vir_bekämpfung\HijackThis.exe

R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [ccApp] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] "C:\Programme\Gemeinsame Dateien\Symantec Shared\Security Center\UsrPrmpt.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [mmtask] "C:\Programme\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe"
O4 - HKLM\..\Run: [ICQ Lite] "C:\Programme\ICQLite\ICQLite.exe" -minimize
O4 - HKLM\..\Run: [ToADiMon.exe] C:\Programme\T-Online\T-Online_Software_5\Basis-Software\Basis1\ToADiMon.exe -TOnlineAutodialStart
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Programme\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -trayboot
O4 - Startup: Mobile Phone Manager.lnk = C:\Programme\Mobile Phone Manager\bin\Mobile Phone Manager.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Free WebSite Tools.lnk = ?
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE
O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Programme\PartyGaming.Net\PartyPokerNet\RunPF.exe
O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Programme\PartyGaming.Net\PartyPokerNet\RunPF.exe
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://h**p://messenger.zone.msn.com...t.cab31267.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://h**p://by116fd.bay116.hotmail...s/MsnPUpld.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://h**p://a1540.g.akamai.net/7/1...eInstaller.exe
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://h**p://messenger.zone.msn.com...o.cab32846.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://h**p://messenger.zone.msn.com...t.cab31267.cab
O16 - DPF: {D67AC55A-B750-41A4-BEE6-020E017A7996} - http://h**p://install.cokemusic.de/c...LER_loader.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{8150CB76-2E4C-482D-860B-801ECF513E1B}: NameServer = 217.237.148.102 217.237.151.115
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\Security Center\SymWSC.exe

was gibt es noch zu tun?? hat sie jetzt schon mittlerweile das problem mit den spammail behoben??

was muss ich jetzt noch machen?? hab mir auch den norton 2007 besorgt, um ihn nach der behandlung zu installieren

Hallo. :)

Wenn Webhancer deinstalliert ist, die anderen Dateien auch alle gelöscht sind, und du noch folgende Zeilen im HijackThis fixt:

sollte eigentlich nichts mehr schief gehen!

Vor allem solltest du dann als erstes dein System updaten:

Sonst passiert sowas immer wieder! ;)

Gruß
Sunny

also ich danke nochmal für die hilfe. werde jetzt stetig mein system updaten um solche fälle zu verhindern