Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   TR/StartPage.QC.1 und TR/Dldr.Small.OR unter WinXP (https://www.trojaner-board.de/8475-tr-startpage-qc-1-tr-dldr-small-winxp.html)

Jadefox 15.10.2004 19:30
TR/StartPage.QC.1 und TR/Dldr.Small.OR unter WinXP
 
Hallo,

AntiVir hat den Trojaner "TR/Dldr.Small.OR" gefunden, der lässt sich aber nicht löschen. Desweiteren teilt mir AntiVir jetzt bei jedem Aufruf mit, dass im Master-Bootsektor der Festplatte HD0 Code von "TR/StartPage.QC.1" gefunden wurde und dass dieses Programm nicht entfernbar ist. Danach wird AntiVir sofort beendet.

Das ist mein Logfile. Ich hoffe, es kann mir jemand helfen.

Logfile of HijackThis v1.98.2
Scan saved at 20:29:08, on 15.10.2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
D:\Programme\AVPersonal\AVGUARD.EXE
D:\Programme\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\RunDll32.exe
C:\WINDOWS\System32\PRISMSTA.EXE
D:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
D:\Programme\AVPersonal\AVGNT.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\Programme\Messenger\msmsgs.exe
D:\Programme\Telekom\Eumex 404PC\Capictrl.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Internet Explorer\IEXPLORE.EXE
C:\Programme\Internet Explorer\IEXPLORE.EXE
C:\Dokumente und Einstellungen\Stefanie\Lokale Einstellungen\Temp\Temporäres Verzeichnis 2 für hijackthis.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [PRISMSTA.EXE] PRISMSTA.EXE START
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [EPSON Stylus C84 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus C84 Series" /O5 "LPT1:" /M "Stylus C84"
O4 - HKLM\..\Run: [Zone Labs Client] "D:\Programme\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [AVGCtrl] D:\Programme\AVPersonal\AVGNT.EXE /min
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background
O4 - Startup: Joint Operations Typhoon Rising Produktregistrierung.lnk = C:\Dokumente und Einstellungen\Stefanie\Lokale Einstellungen\Temp\{0C9187BF-180B-4A30-AA9B-8344FC82B00D}\{0325F1C1-883A-41AB-8981-B27359ABDFAF}\NOVG.EXE
O4 - Global Startup: CAPIControl.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
O17 - HKLM\System\CCS\Services\Tcpip\..\{472677A5-0244-4B39-AE59-9D03EDD5F12D}: NameServer = 62.27.27.62 62.27.53.66
O21 - SSODL: SystemCheck - {54645654-2225-4455-44A1-9F4543D34544} - C:\WINDOWS\System32\vbsys.dll



Danke schon mal,
Jadefox

*Christian* 16.10.2004 00:52
Lösche diese Dateien im abges. Modus:

C:\Dokumente und Einstellungen\Stefanie\Lokale Einstellungen\Temp\{0C9187BF-180B-4A30-AA9B-8344FC82B00D}\{0325F1C1-883A-41AB-8981-B27359ABDFAF}\NOVG.EXE
C:\WINDOWS\System32\vbsys.dl

Fixe mit HijackThis dies:

O4 - Startup: Joint Operations Typhoon Rising Produktregistrierung.lnk =
C:\Dokumente und Einstellungen\Stefanie\Lokale
Einstellungen\Temp\{0C9187BF-180B-4A30-AA9B-8344FC82B00D}\{0325F1C1-883A-41AB-8981-B27359ABDFAF}\NOVG.EXE
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
O21 - SSODL: SystemCheck - {54645654-2225-4455-44A1-9F4543D34544} -
C:\WINDOWS\System32\vbsys.dl


Lösche deine Temp. Internet Files.

Jadefox 16.10.2004 14:44
Hallo,

Die Datei habe ich nicht gefunden und konnte sie somit auch nicht löschen, in Hijackthis konnte ich sie fixen:

C:\Dokumente und Einstellungen\Stefanie\Lokale Einstellungen\Temp\
{0C9187BF-180B-4A30-AA9B-8344FC82B00D}\{0325F1C1-883A-41AB-8981-B27359ABDFAF}\NOVG.EXE

Das neue Logfile sieht so aus:

Logfile of HijackThis v1.98.2
Scan saved at 15:39:08, on 16.10.2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
D:\Programme\AVPersonal\AVGUARD.EXE
D:\Programme\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\RunDll32.exe
C:\WINDOWS\System32\PRISMSTA.EXE
D:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
D:\Programme\AVPersonal\AVGNT.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\Programme\Messenger\msmsgs.exe
D:\Programme\Telekom\Eumex 404PC\Capictrl.exe
C:\WINDOWS\System32\wuauclt.exe
D:\Programme\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [PRISMSTA.EXE] PRISMSTA.EXE START
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [EPSON Stylus C84 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus C84 Series" /O5 "LPT1:" /M "Stylus C84"
O4 - HKLM\..\Run: [Zone Labs Client] "D:\Programme\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [AVGCtrl] D:\Programme\AVPersonal\AVGNT.EXE /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background
O4 - Global Startup: CAPIControl.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE

Vielen Dank,

Jadefox

*Christian* 16.10.2004 17:53
Schaut sauber aus.

Leere deinen Temp-Ordner.

Installiere SP2!

Jadefox 17.10.2004 10:10
Hab mit www.windowsupdate.com alles installiert. Temp + Temporary Internet Files geleert.

AntiVir meldet immer noch den Trojaner TR/StartPage.QC.1 und beendet sich dann.
Sollte ich das Virenprogramm vielleicht runterschmeißen und neu installieren?

Gruß, Jadefox

*Christian* 17.10.2004 11:48
Nein.

Scanne mal hiermit im abgesicherten Modus: http://www.trojaner-board.de/42731-escan-anleitung.html

Poste anschließend wo und was gefunden wurde.

Shadowdance 17.10.2004 23:26
@ Jadefox

wenn Du den eScan durchgeführt hast, kannst Du die Einträge folgendermassen posten: "Öffne die mwav.log -> Bearbeiten -> Suchen -> infected eingeben -> Weitersuchen -> Treffer markieren/kopieren und ins Forumübertragen"

oder löschen, aber bitte im abgesicherten Modus, bei deaktivierter Systemwiederherstellung:

"Öffne die mwav.log -> Bearbeiten -> Suchen -> infected eingeben -> Weitersuchen -> Treffer markieren/kopieren undin die Windows Suche übertragen -> löschen!" Nach dem Löschen bitte die Systemwiederherstellung aktivieren und in den normalen Modus booten.

SD

Jadefox 22.10.2004 07:42
Hallo,
das ist, was escan gefunden hat. Infected gab's nicht, aber unten in der Übersicht stand, dass er 65 Viruse gefunden hat... Der Rest war "Size Restriction". Hat das was zu bedeuten? Ich hab die nicht alle hier gepostet, das wäre zu viel gewesen.

Tue Oct 19 08:18:58 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0100.dlm tagged as not-a-virus:Cracker.AssasinPatch. No Action Taken.

Tue Oct 19 08:19:00 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0100a.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:19:03 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0101.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:19:04 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0102.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:19:07 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0200a.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:19:08 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0201.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:19:08 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0202.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:19:15 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0300a.dlm tagged as not-a-virus:Cracker.Game.HotHook.dll. No Action Taken.

Tue Oct 19 08:19:19 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0301.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:19:20 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0302.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:20:09 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0600a.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:20:10 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0601.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:20:12 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0602.dlm tagged as not-a-virus:Cracker.Game.HotHook.dll. No Action Taken.

Tue Oct 19 08:20:12 2004 => *** File D:\Daniel\GTA Vice City Cars\DHL\0603.dlm having Size Restriction ***

Tue Oct 19 08:20:19 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0700a.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:20:20 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0701.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:20:20 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0702.dlm tagged as not-a-virus:Cracker.Game.HotHook.dll. No Action Taken.

Tue Oct 19 08:20:33 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0800.dlm tagged as not-a-virus:Cracker.AssasinPatch. No Action Taken.

Tue Oct 19 08:20:33 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0800a.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:20:34 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0801.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:20:51 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0900a.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:20:51 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0901.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:21:04 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1000.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:21:06 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1000a.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:21:07 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1001.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:21:13 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1100.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:21:13 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1100a.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:21:14 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1101.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:21:15 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1102.dlm tagged as not-a-virus:Cracker.AssasinPatch. No Action Taken.

Tue Oct 19 08:21:22 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1200a.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:21:26 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1201.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:21:26 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1202.dlm tagged as not-a-virus:Cracker.Game.HotHook.dll. No Action Taken.

Tue Oct 19 08:21:29 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1300.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:21:31 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1300a.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:21:31 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1301.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:21:32 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1302.dlm tagged as not-a-virus:Cracker.Game.HotHook.dll. No Action Taken.

Tue Oct 19 08:21:36 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1400.dlm tagged as not-a-virus:Cracker.Game.HotHook.dll. No Action Taken.

Tue Oct 19 08:21:36 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1400a.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:21:47 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1501.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:21:55 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1600.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:22:00 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1600a.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:22:01 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1601.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:22:07 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1701.DLM tagged as not-a-virus:FalseAlarm.DrWeb.Backdoor.Theef.111. No Action Taken.
Tue Oct 19 08:22:09 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1799.dlm tagged as not-a-virus:Cracker.AssasinPatch. No Action Taken.

Tue Oct 19 08:22:10 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1800.DLM tagged as not-a-virus:Cracker.Game.HotHook.dll. No Action Taken.

Tue Oct 19 08:22:11 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1801.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:22:11 2004 => *** File D:\Daniel\GTA Vice City Cars\DHL\1802.dlm having Size Restriction ***

Tue Oct 19 08:22:14 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1900.DLM tagged as not-a-virus:Cracker.Game.HotHook.dll. No Action Taken.

Tue Oct 19 08:22:15 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1901.DLM tagged as not-a-virus:Cracker.Game.HotHook.dll. No Action Taken.

Tue Oct 19 08:22:15 2004 => *** File D:\Daniel\GTA Vice City Cars\DHL\1902.dlm having Size Restriction ***

Tue Oct 19 08:22:15 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1999.dlm tagged as not-a-virus:Cracker.Game.HotHook.dll. No Action Taken.

Tue Oct 19 08:22:18 2004 => File D:\Daniel\GTA Vice City Cars\DHL\2001.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:22:18 2004 => *** File D:\Daniel\GTA Vice City Cars\DHL\2002.dlm having Size Restriction ***

Tue Oct 19 08:22:22 2004 => File D:\Daniel\GTA Vice City Cars\DHL\2100.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:22:22 2004 => Scanning File D:\Daniel\GTA Vice City Cars\DHL\2101.DLM
Tue Oct 19 08:22:25 2004 => File D:\Daniel\GTA Vice City Cars\DHL\2101.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:22:32 2004 => File D:\Daniel\GTA Vice City Cars\DHL\2201.DLM tagged as not-a-virus:Cracker.Game.HotHook.dll. No Action Taken.

Tue Oct 19 08:22:38 2004 => File D:\Daniel\GTA Vice City Cars\DHL\2300.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:22:40 2004 => File D:\Daniel\GTA Vice City Cars\DHL\2301.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:22:59 2004 => File D:\Daniel\GTA Vice City Cars\DHL\2501.DLM tagged as not-a-virus:Cracker.Game.HotHook.dll. No Action Taken.

Tue Oct 19 08:23:01 2004 => File D:\Daniel\GTA Vice City Cars\DHL\2601.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:23:03 2004 => File D:\Daniel\GTA Vice City Cars\DHL\2701.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:23:03 2004 => Scanning File D:\Daniel\GTA Vice City Cars\DHL\2800.DLM
Tue Oct 19 08:23:07 2004 => File D:\Daniel\GTA Vice City Cars\DHL\2800.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:23:07 2004 => Scanning File D:\Daniel\GTA Vice City Cars\DHL\2801.dlm
Tue Oct 19 08:23:07 2004 => File D:\Daniel\GTA Vice City Cars\DHL\2801.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:23:07 2004 => Scanning File D:\Daniel\GTA Vice City Cars\DHL\2900.DLM
Tue Oct 19 08:23:07 2004 => File D:\Daniel\GTA Vice City Cars\DHL\2900.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:23:07 2004 => Scanning File D:\Daniel\GTA Vice City Cars\DHL\3000.DLM
Tue Oct 19 08:23:08 2004 => File D:\Daniel\GTA Vice City Cars\DHL\3000.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:23:08 2004 => Scanning File D:\Daniel\GTA Vice City Cars\DHL\3100.DLM
Tue Oct 19 08:23:09 2004 => File D:\Daniel\GTA Vice City Cars\DHL\3100.DLM tagged as not-a-virus:Cracker.Game.HotHook.dll. No Action Taken.

Shadowdance 22.10.2004 08:33
@ Jadefox,

such bitte aus dem eScan Log all die Dateien raus, bei denen steht:

infected by "xxx" Virus. Action Taken: No Action Taken
tagged as not-a-virus:AdWare

poste vorallem die Einträge, die einen "Virus" zu erkennen geben.

SD

Jadefox 23.10.2004 13:00
Hi,
escan hat nichts mit "infected" gefunden. Die einzigen Einträge, die als Virus in der Statistik am Ende angegeben wurden sind die hier:

Sat Oct 23 12:40:33 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0100.dlm tagged as not-a-virus:Cracker.AssasinPatch. No Action Taken.
Sat Oct 23 12:40:36 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0100a.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:40:38 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0101.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:40:39 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0102.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:40:42 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0200a.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:40:43 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0201.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:40:43 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0202.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:40:51 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0300a.dlm tagged as not-a-virus:Cracker.Game.HotHook.dll. No Action Taken.
Sat Oct 23 12:40:55 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0301.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:40:56 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0302.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:41:02 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0400a.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:41:07 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0402.dlm tagged as not-a-virus:Cracker.Game.HotHook.dll. No Action Taken.
Sat Oct 23 12:41:26 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0502.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:41:45 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0600a.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:41:46 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0601.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:41:47 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0602.dlm tagged as not-a-virus:Cracker.Game.HotHook.dll. No Action Taken.
Sat Oct 23 12:41:55 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0700a.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:41:56 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0701.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:41:56 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0702.dlm tagged as not-a-virus:Cracker.Game.HotHook.dll. No Action Taken.
Sat Oct 23 12:42:08 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0800.dlm tagged as not-a-virus:Cracker.AssasinPatch. No Action Taken.
Sat Oct 23 12:42:08 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0800a.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:42:09 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0801.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:42:25 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0900a.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:42:25 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0901.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:42:38 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1000.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:42:40 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1000a.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:42:41 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1001.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:42:47 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1100.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:42:47 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1100a.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:42:48 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1101.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:42:49 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1102.dlm tagged as not-a-virus:Cracker.AssasinPatch. No Action Taken.
Sat Oct 23 12:42:55 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1200a.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:42:59 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1201.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:42:59 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1202.dlm tagged as not-a-virus:Cracker.Game.HotHook.dll. No Action Taken.
Sat Oct 23 12:43:02 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1300.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:43:04 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1300a.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:43:04 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1301.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:43:05 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1302.dlm tagged as not-a-virus:Cracker.Game.HotHook.dll. No Action Taken.
Sat Oct 23 12:43:09 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1400.dlm tagged as not-a-virus:Cracker.Game.HotHook.dll. No Action Taken.
Sat Oct 23 12:43:09 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1400a.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:43:20 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1501.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:43:28 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1600.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:43:33 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1600a.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:43:34 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1601.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:43:40 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1701.DLM tagged as not-a-virus:FalseAlarm.DrWeb.Backdoor.Theef.111. No Action Taken.
Sat Oct 23 12:43:42 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1799.dlm tagged as not-a-virus:Cracker.AssasinPatch. No Action Taken.
Sat Oct 23 12:43:43 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1800.DLM tagged as not-a-virus:Cracker.Game.HotHook.dll. No Action Taken.
Sat Oct 23 12:43:44 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1801.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:43:47 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1900.DLM tagged as not-a-virus:Cracker.Game.HotHook.dll. No Action Taken.
Sat Oct 23 12:43:48 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1901.DLM tagged as not-a-virus:Cracker.Game.HotHook.dll. No Action Taken.
Sat Oct 23 12:43:48 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1999.dlm tagged as not-a-virus:Cracker.Game.HotHook.dll. No Action Taken.
Sat Oct 23 12:43:51 2004 => File D:\Daniel\GTA Vice City Cars\DHL\2001.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:43:55 2004 => File D:\Daniel\GTA Vice City Cars\DHL\2100.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:43:58 2004 => File D:\Daniel\GTA Vice City Cars\DHL\2101.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:44:05 2004 => File D:\Daniel\GTA Vice City Cars\DHL\2201.DLM tagged as not-a-virus:Cracker.Game.HotHook.dll. No Action Taken.
Sat Oct 23 12:44:11 2004 => File D:\Daniel\GTA Vice City Cars\DHL\2300.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:44:13 2004 => File D:\Daniel\GTA Vice City Cars\DHL\2301.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:44:31 2004 => File D:\Daniel\GTA Vice City Cars\DHL\2501.DLM tagged as not-a-virus:Cracker.Game.HotHook.dll. No Action Taken.
Sat Oct 23 12:44:34 2004 => File D:\Daniel\GTA Vice City Cars\DHL\2601.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:44:36 2004 => File D:\Daniel\GTA Vice City Cars\DHL\2701.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:44:39 2004 => File D:\Daniel\GTA Vice City Cars\DHL\2800.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:44:39 2004 => File D:\Daniel\GTA Vice City Cars\DHL\2801.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:44:40 2004 => File D:\Daniel\GTA Vice City Cars\DHL\2900.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:44:41 2004 => File D:\Daniel\GTA Vice City Cars\DHL\3000.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:44:42 2004 => File D:\Daniel\GTA Vice City Cars\DHL\3100.DLM tagged as not-a-virus:Cracker.Game.HotHook.dll. No Action Taken.

Sonst wurde nichts gefunden.

Jade

Shadowdance 24.10.2004 10:12
Hallo Jadefox,

einer der seltenen Fälle, dass ich etwas ratlos dreinschaue. Du könntest nun natürlich den Ordner File D:\Daniel\GTA Vice City Cars\DHL\ leeren. Aber 'not-a-virus:Cracker.Game.HotHook. ' sagt mir garnichts. Mal sehen, ob die anderen damit etwas anfangen können.

Poste bitte noch ein Hijack This Logfile.

SD

Jadefox 24.10.2004 16:16
Hier ist das Logfile. Bin am überlegen, ob ich nicht einfach den PC formatiere. Dann wär der Trojaner auch auf jeden Fall weg :-)...

Logfile of HijackThis v1.98.2
Scan saved at 17:14:17, on 24.10.2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
D:\Programme\AVPersonal\AVGUARD.EXE
D:\Programme\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\RunDll32.exe
C:\WINDOWS\system32\PRISMSTA.EXE
D:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
D:\Programme\AVPersonal\AVGNT.EXE
C:\Programme\Java\j2re1.4.2_05\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Messenger\msmsgs.exe
D:\Programme\Telekom\Eumex 404PC\Capictrl.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
D:\Programme\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [PRISMSTA.EXE] PRISMSTA.EXE START
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [EPSON Stylus C84 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus C84 Series" /O5 "LPT1:" /M "Stylus C84"
O4 - HKLM\..\Run: [Zone Labs Client] "D:\Programme\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [AVGCtrl] D:\Programme\AVPersonal\AVGNT.EXE /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background
O4 - Global Startup: CAPIControl.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{472677A5-0244-4B39-AE59-9D03EDD5F12D}: NameServer = 62.27.27.62 62.27.53.66

Shadowdance 25.10.2004 00:28
Hallo Jadefox,

boote in den abgesicherten Modus, deaktiviere die Systemwiederherstellung, und fixe dann mit Hijack This (Häkchen setzen und fix checked klicken):

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)

Boote in den normalen Modus. Aktiviere die Systemwiederherstellung.

vergleiche hierzu die automatische Auswertung

Gibt Dein AntiVirenProgramm einen Pfad an, WO sich der Virus befindet?

SD

Jadefox 26.10.2004 19:43
Hi,
ich glaube, jetzt ist der Virus weg. Es wurde von AntiVir in einem Fehlermeldefenster ein Pfad angezeigt, in dem sich der TR/StartPage.QC.1 befunden hat. Darunter waren verschiedene Optionen, u.a. auch löschen. Wenn man das mit deaktivierter Systemwiederherstellung gemacht hat, konnte man AntiVir wieder ohne Fehlermeldung starten. Bin grad dabei, ein Update für AntiVir runterzuladen, danach werde ich es mal übers System laufen lassen. Dann meld ich mich nochmal.
Vielen Dank schon mal für die ganze Mühe!!!!!

Gruß, Jadefox

Jadefox 26.10.2004 21:18
Anscheinend ist der Virus jetzt tatsächlich weg. Danke nochmal für alles!!

Jade


Alle Zeitangaben in WEZ +1. Es ist jetzt 15:11 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131