|
Mein HiJackThis Log Hallo, hier ist mein HiJackThis Log. Bitte sagt mir, welche Einträge ich löschen kann und welche nicht. Logfile of HijackThis v1.98.2 Scan saved at 11:15:24, on 02.09.2004 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\WINNT\downlo~1\l8vfnqx\12es0g92.exe C:\WINNT\System32\cisvc.exe C:\WINNT\System32\svchost.exe C:\Programme\Network Associates\Common Framework\FrameworkService.exe C:\Programme\Network Associates\VirusScan\Mcshield.exe C:\Programme\Network Associates\VirusScan\VsTskMgr.exe C:\WINNT\402B.tmp:egxyc C:\oracle\ora92\bin\omtsreco.exe C:\WINNT\system32\regsvc.exe C:\WINNT\system32\MSTask.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\system32\mspmspsv.exe C:\WINNT\system32\svchost.exe C:\WINNT\Explorer.EXE C:\WINNT\system32\winal32.exe C:\Programme\Network Associates\VirusScan\SHSTAT.EXE C:\Programme\Network Associates\Common Framework\UpdaterUI.exe C:\Programme\Java\j2re1.4.2_05\bin\jusched.exe C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe C:\Programme\Logitech\iTouch\iTouch.exe C:\PROGRA~1\MICROS~2\Office\OUTLOOK.EXE C:\Programme\Logitech\iTouch\kbdtray.exe C:\Programme\Gemeinsame Dateien\System\MAPI\1031\nt\MAPISP32.EXE C:\WINNT\System32\cidaemon.exe C:\PROGRA~1\WinZip\winzip32.exe C:\DOKUME~1\PaulG\LOKALE~1\Temp\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\system32\zabfw.dll/sp.html#29126 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\system32\zabfw.dll/sp.html#29126 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINNT\system32\zabfw.dll/sp.html#29126 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\system32\zabfw.dll/sp.html#29126 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\system32\zabfw.dll/sp.html#29126 R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\system32\zabfw.dll/sp.html#29126 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R3 - Default URLSearchHook is missing O2 - BHO: (no name) - {7E7168C5-2938-535D-4C66-51171D04D1A1} - C:\WINNT\atlib32.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar2.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar2.dll O4 - HKLM\..\Run: [winal32.exe] C:\WINNT\system32\winal32.exe O4 - HKLM\..\Run: [ShStatEXE] "C:\Programme\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Programme\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\j2re1.4.2_05\bin\jusched.exe O4 - HKLM\..\Run: [apppk32.exe] C:\WINNT\system32\apppk32.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot O4 - HKCU\..\Run: [Spyware Begone] C:\Programme\freescan.exe -FastScan O4 - Startup: iTouch.lnk = C:\Programme\Logitech\iTouch\iTouch.exe O4 - Startup: Microsoft Outlook.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: &Google Search - res://c:\programme\google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: Download with Star Downloader - C:\Programme\Star Downloader\sdie.htm O8 - Extra context menu item: Im Cache gespeicherte Seite - res://c:\programme\google\GoogleToolbar2.dll/cmcache.html O8 - Extra context menu item: Verweisseiten - res://c:\programme\google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Ähnliche Seiten - res://c:\programme\google\GoogleToolbar2.dll/cmsimilar.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\system32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\system32\msjava.dll O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = intranet.wiererbau.com O17 - HKLM\System\CCS\Services\Tcpip\..\{825C5604-CBAF-4F9D-8AED-5D1D965030A3}: NameServer = 192.168.1.10 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = intranet.wiererbau.com O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = intranet.wiererbau.com |
Lass bitte zunächst mal E-Scan wie hier beschrieben durchlaufen, da sind einige Prozesse dabei, die mir sehr verdächtig erscheinen (neben den definitiven Schädlingen). Poste danach ein neues Log: http://www.trojaner-board.de/42731-escan-anleitung.html und schreibe die Namen der von E-Scan gefundenen Schädlinge dazu. |
Hallo, Zitat:
Zitat:
Zitat:
|
Hallo habe nun E-Scan durchlaufen lassen. Dies die Liste der Schädlinge: File C:\WINNT\system32\winmr.exe infected by "TrojanDownloader.Win32.Agent.ap" Virus. Action Taken: File Renamed. File C:\WINNT\syspf32.exe infected by "TrojanDownloader.Win32.Agent.ap" Virus. Action Taken: File Renamed. File C:\WINNT\_MSRSTRT.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\WINNT\system32\cmxij.dll infected by "TrojanDownloader.Win32.WinShow.ak" Virus. Action Taken: File Deleted. File C:\WINNT\system32\cnrba.dll infected by "TrojanDownloader.Win32.WinShow.ak" Virus. Action Taken: File Deleted. File C:\WINNT\system32\echsd.dll infected by "TrojanDownloader.Win32.WinShow.ak" Virus. Action Taken: File Deleted. File C:\WINNT\system32\eibwt.dll infected by "TrojanDownloader.Win32.WinShow.ak" Virus. Action Taken: File Deleted. File C:\WINNT\system32\ekkqs.dll infected by "TrojanDownloader.Win32.WinShow.ak" Virus. Action Taken: File Deleted. File C:\WINNT\system32\gtehy.dll infected by "TrojanDownloader.Win32.WinShow.ak" Virus. Action Taken: File Deleted. File C:\WINNT\system32\gtsbd.dll infected by "TrojanDownloader.Win32.WinShow.ak" Virus. Action Taken: File Deleted. File C:\WINNT\system32\gzhpf.dll infected by "TrojanDownloader.Win32.WinShow.ak" Virus. Action Taken: File Deleted. File C:\WINNT\system32\hnqvi.dll infected by "TrojanDownloader.Win32.WinShow.ak" Virus. Action Taken: File Deleted. File C:\WINNT\system32\hrszy.dll infected by "TrojanDownloader.Win32.WinShow.ak" Virus. Action Taken: File Deleted. File C:\WINNT\system32\htrsd.dll infected by "TrojanDownloader.Win32.WinShow.ak" Virus. Action Taken: File Deleted. File C:\WINNT\system32\ia.dll tagged as not-a-virus:RiskWare.Dialer.E-Group.e. No Action Taken. File C:\WINNT\system32\icrqb.dll infected by "TrojanDownloader.Win32.WinShow.ak" Virus. Action Taken: File Deleted. File C:\WINNT\system32\iemeq.dll infected by "TrojanDownloader.Win32.WinShow.ak" Virus. Action Taken: File Deleted. File C:\WINNT\system32\iozkf.dll infected by "TrojanDownloader.Win32.WinShow.ak" Virus. Action Taken: File Deleted. File C:\WINNT\system32\itmye.dll infected by "TrojanDownloader.Win32.WinShow.ak" Virus. Action Taken: File Deleted. File C:\WINNT\system32\jdahv.dll infected by "TrojanDownloader.Win32.WinShow.ak" Virus. Action Taken: File Deleted. File C:\WINNT\system32\jvlsr.dll infected by "TrojanDownloader.Win32.WinShow.ak" Virus. Action Taken: File Deleted. File C:\WINNT\system32\kbrok.dll infected by "TrojanDownloader.Win32.WinShow.ak" Virus. Action Taken: File Deleted. File C:\WINNT\system32\khpnm.dll infected by "TrojanDownloader.Win32.WinShow.ak" Virus. Action Taken: File Deleted. File C:\WINNT\system32\knwmc.dll infected by "TrojanDownloader.Win32.WinShow.ak" Virus. Action Taken: File Deleted. File C:\WINNT\system32\kzkbi.dll infected by "TrojanDownloader.Win32.WinShow.ak" Virus. Action Taken: File Deleted. File C:\WINNT\system32\letjx.dll infected by "TrojanDownloader.Win32.WinShow.ak" Virus. Action Taken: File Deleted. File C:\WINNT\system32\lsqxp.dll infected by "TrojanDownloader.Win32.WinShow.ak" Virus. Action Taken: File Deleted. File C:\WINNT\system32\luhej.dll infected by "TrojanDownloader.Win32.WinShow.ak" Virus. Action Taken: File Deleted. File C:\WINNT\system32\mfczv32.exe infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: File Deleted. File C:\WINNT\system32\nnaqo.dll infected by "TrojanDownloader.Win32.WinShow.ak" Virus. Action Taken: File Deleted. File C:\WINNT\system32\ntyy.dll infected by "TrojanDownloader.Win32.Agent.bq" Virus. Action Taken: File Deleted. File C:\WINNT\system32\okyke.dll infected by "TrojanDownloader.Win32.WinShow.ak" Virus. Action Taken: File Deleted. File C:\WINNT\system32\pgdic.dll infected by "TrojanDownloader.Win32.WinShow.ak" Virus. Action Taken: File Deleted. File C:\WINNT\system32\ptvlh.dll infected by "TrojanDownloader.Win32.WinShow.ak" Virus. Action Taken: File Deleted. File C:\WINNT\system32\qrvhl.dll infected by "TrojanDownloader.Win32.WinShow.ak" Virus. Action Taken: File Deleted. File C:\WINNT\system32\rfnos.dll infected by "TrojanDownloader.Win32.WinShow.ak" Virus. Action Taken: File Deleted. File C:\WINNT\system32\rljxb.dll infected by "TrojanDownloader.Win32.WinShow.ak" Virus. Action Taken: File Deleted. File C:\WINNT\system32\rzemt.dll infected by "TrojanDownloader.Win32.WinShow.ak" Virus. Action Taken: File Deleted. File C:\WINNT\system32\sfokq.dll infected by "TrojanDownloader.Win32.WinShow.ak" Virus. Action Taken: File Deleted. File C:\WINNT\system32\soufj.dll infected by "TrojanDownloader.Win32.WinShow.ak" Virus. Action Taken: File Deleted. File C:\WINNT\system32\SPmsnt.exe infected by "Backdoor.Small.bb" Virus. Action Taken: File Renamed. File C:\WINNT\system32\tbjbx.dll infected by "TrojanDownloader.Win32.WinShow.ak" Virus. Action Taken: File Deleted. File C:\WINNT\system32\tilhf.dll infected by "TrojanDownloader.Win32.WinShow.ak" Virus. Action Taken: File Deleted. File C:\WINNT\system32\tkjqq.dll infected by "TrojanDownloader.Win32.WinShow.ak" Virus. Action Taken: File Deleted. File C:\WINNT\system32\tnzhl.dll infected by "TrojanDownloader.Win32.WinShow.ak" Virus. Action Taken: File Deleted. File C:\WINNT\system32\urbvz.dll infected by "TrojanDownloader.Win32.WinShow.ak" Virus. Action Taken: File Deleted. File C:\WINNT\system32\vcvcr.dll infected by "TrojanDownloader.Win32.WinShow.ak" Virus. Action Taken: File Deleted. File C:\WINNT\system32\vomyi.dll infected by "TrojanDownloader.Win32.WinShow.ak" Virus. Action Taken: File Deleted. File C:\WINNT\system32\vpcfb.dll infected by "TrojanDownloader.Win32.WinShow.ak" Virus. Action Taken: File Deleted. File C:\WINNT\system32\xrirk.dll infected by "TrojanDownloader.Win32.WinShow.ak" Virus. Action Taken: File Deleted. File C:\WINNT\system32\xruet.dll infected by "TrojanDownloader.Win32.WinShow.ak" Virus. Action Taken: File Deleted. File C:\WINNT\system32\xwqwn.dll infected by "TrojanDownloader.Win32.WinShow.ak" Virus. Action Taken: File Deleted. File C:\WINNT\system32\xyigu.dll infected by "TrojanDownloader.Win32.WinShow.ak" Virus. Action Taken: File Deleted. File C:\WINNT\system32\yeyvb.dll infected by "TrojanDownloader.Win32.WinShow.ak" Virus. Action Taken: File Deleted. File C:\WINNT\system32\ypgga.dll infected by "TrojanDownloader.Win32.WinShow.ak" Virus. Action Taken: File Deleted. File C:\WINNT\system32\zabfw.dll infected by "TrojanDownloader.Win32.WinShow.ak" Virus. Action Taken: File Deleted. File C:\WINNT\system32\zurut.dll infected by "TrojanDownloader.Win32.WinShow.ak" Virus. Action Taken: File Deleted. File C:\Dokumente und Einstellungen\PaulG\Anwendungsdaten\Sun\Java\Deployment\cache\javapi\v1.0\jar\count4.jar-4a5f2737-29e31514.zip infected by "Trojan.Java.ClassLoader.o" Virus. Action Taken: File Deleted. File C:\Dokumente und Einstellungen\PaulG\Lokale Einstellungen\Anwendungsdaten\Microsoft\Internet Explorer\V0.15.dat infected by "Trojan.Win32.Dialui" Virus. Action Taken: File Deleted. File C:\Download\spyblocs.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\program files\WindUpdates\Comm.dll infected by "TrojanDownloader.Win32.Agent.bf" Virus. Action Taken: File Deleted. File C:\WINNT\Downloaded Program Files\v2.dll infected by "not-a-virus:AdvWare.ToolBar.EliteBar.f" Virus. Action Taken: File Renamed. File C:\WINNT\eawvi.dll infected by "TrojanDownloader.Win32.WinShow.ak" Virus. Action Taken: File Deleted. File C:\WINNT\fzdox.dll infected by "TrojanDownloader.Win32.WinShow.ak" Virus. Action Taken: File Deleted. File C:\WINNT\idmmk.dll infected by "TrojanDownloader.Win32.WinShow.ak" Virus. Action Taken: File Deleted. File C:\WINNT\system32\engyi.dll infected by "TrojanDownloader.Win32.WinShow.ak" Virus. Action Taken: File Deleted. File C:\WINNT\system32\ia.dll tagged as not-a-virus:RiskWare.Dialer.E-Group.e. No Action Taken. File C:\WINNT\system32\services\coolers.exe infected by "Trojan.Win32.Dialer.ce" Virus. Action Taken: File Deleted. File C:\WINNT\system32\services\losvse.exe infected by "Trojan.Win32.Dialer.u" Virus. Action Taken: File Deleted. File C:\WINNT\vxueq.dll infected by "TrojanDownloader.Win32.WinShow.ak" Virus. Action Taken: File Deleted. File C:\WINNT\_MSRSTRT.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. |
Hallo Gatterer Paul, auch ohne das eigentliche Ergebnis des eScan vor Augen zu haben, halte ich Dein System für völlig verseucht. Ich zitiere daher MountainKing, der das a.a.O. so gut formuliert hat: Formatieren+Neuaufsetzen Zitat:
- PC-Sicherheit - www.windowsupdate.com - Browserwechsel - Entfernungstools von Spyware und Adware - Eine Auswahl Virenscanner SD |
| Alle Zeitangaben in WEZ +1. Es ist jetzt 12:00 Uhr. |
Copyright ©2000-2025, Trojaner-Board