escan Log!!
 

Hallo,

ich habe bei mir mal escan durchlaufen lassen und das wurde gefunden.
Kann mir jemand bei der auswertung bzw beseitigung helfen??


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Header
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Microsoft Windows XP [Version 5.1.2600]
Wed Aug 29 01:26:48 2007 => Version 9.3.8 (C:\DOKUME~1\Besitzer\LOKALE~1\Temp\mexe.com)
Wed Aug 29 02:05:00 2007 => Virus Database Date: 8/22/2007
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Infektionsmeldungen
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Wed Aug 29 01:37:45 2007 => System found infected with yahoospymon Spyware/Adware ({a4643a87-99a0-4404-9bc5-2322bdd61637})! Action taken: No Action Taken.
Wed Aug 29 01:37:45 2007 => System found infected with yahoospymon Spyware/Adware ({a46e5261-9956-4767-88ca-dfced050d09e})! Action taken: No Action Taken.
Wed Aug 29 01:37:45 2007 => System found infected with yahoospymon Spyware/Adware ({a7ec2cd3-9941-4fd4-9d01-105dc16a4313})! Action taken: No Action Taken.
Wed Aug 29 01:37:46 2007 => System found infected with video activex access Trojan ({7e853d72-626a-48ec-a868-ba8d5e23e045})! Action taken: No Action Taken.
Wed Aug 29 01:37:46 2007 => System found infected with yahoospymon Spyware/Adware ({1df3afed-99e0-4474-9900-954b8fd24e86})! Action taken: No Action Taken.
Wed Aug 29 01:37:46 2007 => System found infected with yahoospymon Spyware/Adware ({06544919-f559-4ae5-9001-f903bd8a84e6})! Action taken: No Action Taken.
Wed Aug 29 01:37:46 2007 => System found infected with yahoospymon Spyware/Adware ({4340df8e-d7a3-4675-be74-80077b2b3e81})! Action taken: No Action Taken.
Wed Aug 29 01:37:46 2007 => System found infected with yahoospymon Spyware/Adware ({51a0888c-9970-44de-8c2c-835ba870d06f})! Action taken: No Action Taken.
Wed Aug 29 01:37:46 2007 => System found infected with yahoospymon Spyware/Adware ({5acae4b8-62d9-4124-a58a-9b1258b77e99})! Action taken: No Action Taken.
Wed Aug 29 01:37:46 2007 => System found infected with yahoospymon Spyware/Adware ({7d37ded8-1945-4e42-a3fd-b9620e0ad8e3})! Action taken: No Action Taken.
Wed Aug 29 01:37:46 2007 => System found infected with whenu.savenow Spyware/Adware ({c285d18d-43a2-4aef-83fb-bf280e660a97})! Action taken: No Action Taken.
Wed Aug 29 01:37:46 2007 => System found infected with yahoospymon Spyware/Adware ({c4c23b78-db98-444c-b601-dcac6ebbec54})! Action taken: No Action Taken.
Wed Aug 29 01:37:46 2007 => System found infected with yahoospymon Spyware/Adware ({ccb7fb40-99ec-4678-9202-52798da78aba})! Action taken: No Action Taken.
Wed Aug 29 01:37:46 2007 => System found infected with yahoospymon Spyware/Adware ({d12fb216-99da-4eb3-9cc0-c0f760b174a0})! Action taken: No Action Taken.
Wed Aug 29 01:37:46 2007 => System found infected with yahoospymon Spyware/Adware ({d56c1af1-3fde-471c-9bc2-c52515f260c1})! Action taken: No Action Taken.
Wed Aug 29 01:37:46 2007 => System found infected with yahoospymon Spyware/Adware ({e656b867-992c-4462-a27d-ebe604ec3a48})! Action taken: No Action Taken.
Wed Aug 29 01:38:00 2007 => System found infected with uplink Adware (inetload.dll)! Action taken: No Action Taken.
Wed Aug 29 01:38:00 2007 => System found infected with uplink Adware (inetload.dll)! Action taken: No Action Taken.
Wed Aug 29 01:38:05 2007 => System found infected with yahoospymon Spyware/Adware (C:\WINDOWS\system32\mxpvct25.dat)! Action taken: No Action Taken.
~~~~~~~~~~~
Dateien
~~~~~~~~~~~
~~~~ Infected files
~~~~~~~~~~~
~~~~~~~~~~~
~~~~ Tagged files
~~~~~~~~~~~
~~~~~~~~~~~
~~~~ Offending files
~~~~~~~~~~~
Wed Aug 29 01:38:00 2007 => Offending file found: C:\Dokumente und Einstellungen\Besitzer\Lokale Einstellungen\temp\nskb.tmp\inetload.dll
Wed Aug 29 01:38:00 2007 => Offending file found: C:\Dokumente und Einstellungen\Besitzer\Lokale Einstellungen\temp\nssd.tmp\inetload.dll
Wed Aug 29 01:38:05 2007 => Offending file found: C:\WINDOWS\system32\mxpvct25.dat
~~~~~~~~~~~
Ordner
~~~~~~~~~~~
Wed Aug 29 01:37:52 2007 => Offending Folder found: C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\icq\bart\1024
~~~~~~~~~~~
Registry
~~~~~~~~~~~
Wed Aug 29 01:37:48 2007 => Offending Key found: HKLM\Software\magnet !!!
Wed Aug 29 01:37:49 2007 => Offending Key found: HKCU\\chilkat.email2 !!!
Wed Aug 29 01:37:49 2007 => Offending Key found: HKCU\\chilkat.emailbundle2 !!!
Wed Aug 29 01:37:49 2007 => Offending Key found: HKCU\\chilkat.mailman2 !!!
Wed Aug 29 01:37:49 2007 => Offending Key found: HKCU\\chilkatmail2.chilkatemail2 !!!
Wed Aug 29 01:37:49 2007 => Offending Key found: HKCU\\chilkatmail2.chilkatemailbundle2 !!!
Wed Aug 29 01:37:49 2007 => Offending Key found: HKCU\\chilkatmail2.chilkatmailman2 !!!
Wed Aug 29 01:37:49 2007 => Offending Key found: HKCU\\magnet !!!
Wed Aug 29 01:37:49 2007 => Offending Key found: HKLM\System\CurrentControlSet\Services\nwsapagent !!!
Wed Aug 29 01:37:49 2007 => Offending Key found: HKLM\System\ControlSet002\Services\nwsapagent !!!
Wed Aug 29 01:37:49 2007 => Offending Key found: HKLM\System\ControlSet003\Services\nwsapagent !!!
Wed Aug 29 01:38:10 2007 => Offending Key found: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\X !!!
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Statistiken:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Hi,

welche Probleme hast du mit dem PC? Kein escan im abgesicherten Modus? Poste zusätzlich ein HJT-log. Aus den Einträgen allein werde ich ehrlich gesagt auch nicht schlau. Nutzt du winamp? Yahoo-Toolbar installiert? Azureus auf jeden Fall ;) und das ist gern Quell allen Übels.

Gruß