|
Zitat:
Jetzt musst du dir eben die Arbeit machen und die mwav.log durchsuchen. |
Ja ich hab das ja schon alles rausgesucht und das sind 90 Viren :balla: Und mehr als 150 Zeilen... Soll ich das nich doch lieber als Textdatei einfügen? mfg Tomasch |
Thu Apr 07 21:20:31 2005 => Scanning HKLM\SYSTEM\CurrentControlSet\Services\VxD Thu Apr 07 21:20:40 2005 => System found infected with VX2 Spyware/Adware ({92daf5c1-2135-4e0c-b7a0-259abfcd3904})! Action taken: No Action Taken. Thu Apr 07 21:20:40 2005 => File System Found infected by "VX2 Spyware/Adware" Virus. Action Taken: No Action Taken. Thu Apr 07 21:20:40 2005 => System found infected with VX2 Spyware/Adware ({bb0d5adc-028d-4185-9288-722ddce2c757})! Action taken: No Action Taken. Thu Apr 07 21:20:40 2005 => File System Found infected by "VX2 Spyware/Adware" Virus. Action Taken: No Action Taken. Thu Apr 07 21:20:40 2005 => System found infected with VX2 Spyware/Adware ({00000049-8f91-4d9c-9573-f016e7626484})! Action taken: No Action Taken. Thu Apr 07 21:20:40 2005 => File System Found infected by "VX2 Spyware/Adware" Virus. Action Taken: No Action Taken. Thu Apr 07 21:20:40 2005 => System found infected with VX2 Spyware/Adware ({DDFFA75A-E81D-4454-89FC-B9FD0631E726})! Action taken: No Action Taken. Thu Apr 07 21:20:40 2005 => File System Found infected by "VX2 Spyware/Adware" Virus. Action Taken: No Action Taken. Thu Apr 07 21:20:41 2005 => Offending value found in HKCU\Software\VB and VBA Program Settings !!! Thu Apr 07 21:20:41 2005 => System found infected with VB and VBA Program Settings Spyware/Adware! Action taken: No Action Taken. Thu Apr 07 21:20:41 2005 => File System Found infected by "VB and VBA Program Settings Spyware/Adware" Virus. Action Taken: No Action Taken. Thu Apr 07 21:20:41 2005 => System found infected with text/html Spyware/Adware! Action taken: No Action Taken. Thu Apr 07 21:20:41 2005 => File System Found infected by "text/html Spyware/Adware" Virus. Action Taken: No Action Taken. Thu Apr 07 21:22:19 2005 => File C:\WINDOWS\ceres.dll infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. Thu Apr 07 21:22:20 2005 => File C:\WINDOWS\icont.exe infected by "not-a-virus:AdWare.AdURL.c" Virus. Action Taken: No Action Taken. Thu Apr 07 21:22:20 2005 => Scanning File C:\WINDOWS\iconu.exe Thu Apr 07 21:22:20 2005 => File C:\WINDOWS\iconu.exe infected by "not-a-virus:AdWare.Zestyfind" Virus. Action Taken: No Action Taken. Thu Apr 07 21:24:47 2005 => File C:\DOKUME~1\Thomas\LOKALE~1\Temp\B51831533\build2.exe infected by "not-a-virus:AdWare.ToolBar.ISearch.d" Virus. Action Taken: No Action Taken. Thu Apr 07 21:24:48 2005 => File C:\DOKUME~1\Thomas\LOKALE~1\Temp\bw2.com infected by "not-a-virus:AdWare.AdURL.c" Virus. Action Taken: No Action Taken. Thu Apr 07 21:24:49 2005 => File C:\DOKUME~1\Thomas\LOKALE~1\Temp\etnbaees.exe infected by "not-a-virus:AdWare.Lop.m" Virus. Action Taken: No Action Taken. Thu Apr 07 21:24:54 2005 => File C:\DOKUME~1\Thomas\LOKALE~1\Temp\GLB645.tmp infected by "not-a-virus:AdWare.VirtualBouncer.j" Virus. Action Taken: No Action Taken. Thu Apr 07 21:24:55 2005 => File C:\DOKUME~1\Thomas\LOKALE~1\Temp\gvveybpe.exe infected by "not-a-virus:AdWare.Lop.m" Virus. Action Taken: No Action Taken. Thu Apr 07 21:28:09 2005 => File C:\DOKUME~1\Thomas\LOKALE~1\TEMPOR~1\Content.IE5\KDUJ4HYB\AppWrap[1].exe infected by "not-a-virus:AdWare.AdURL.c" Virus. Action Taken: No Action Taken. Thu Apr 07 21:28:09 2005 => Scanning File C:\DOKUME~1\Thomas\LOKALE~1\TEMPOR~1\Content.IE5\KDUJ4HYB\AppWrap[2].exe Thu Apr 07 21:28:09 2005 => File C:\DOKUME~1\Thomas\LOKALE~1\TEMPOR~1\Content.IE5\KDUJ4HYB\AppWrap[2].exe infected by "Trojan-Downloader.Win32.Small.ru" Virus. Action Taken: No Action Taken. Thu Apr 07 21:28:09 2005 => Scanning File C:\DOKUME~1\Thomas\LOKALE~1\TEMPOR~1\Content.IE5\KDUJ4HYB\AppWrap[3].exe Thu Apr 07 21:28:09 2005 => File C:\DOKUME~1\Thomas\LOKALE~1\TEMPOR~1\Content.IE5\KDUJ4HYB\AppWrap[3].exe infected by "not-a-virus:AdWare.AdURL.c" Virus. Action Taken: No Action Taken. Thu Apr 07 21:28:09 2005 => Scanning File C:\DOKUME~1\Thomas\LOKALE~1\TEMPOR~1\Content.IE5\KDUJ4HYB\AppWrap[4].exe Thu Apr 07 21:28:09 2005 => File C:\DOKUME~1\Thomas\LOKALE~1\TEMPOR~1\Content.IE5\KDUJ4HYB\AppWrap[4].exe infected by "Trojan-Downloader.Win32.Small.ru" Virus. Action Taken: No Action Taken. Thu Apr 07 21:28:09 2005 => Scanning File C:\DOKUME~1\Thomas\LOKALE~1\TEMPOR~1\Content.IE5\KDUJ4HYB\AppWrap[5].exe Thu Apr 07 21:28:09 2005 => File C:\DOKUME~1\Thomas\LOKALE~1\TEMPOR~1\Content.IE5\KDUJ4HYB\AppWrap[5].exe infected by "not-a-virus:AdWare.Zestyfind" Virus. Action Taken: No Action Taken. Thu Apr 07 21:28:09 2005 => Scanning File C:\DOKUME~1\Thomas\LOKALE~1\TEMPOR~1\Content.IE5\KDUJ4HYB\AppWrap[6].exe Thu Apr 07 21:28:09 2005 => File C:\DOKUME~1\Thomas\LOKALE~1\TEMPOR~1\Content.IE5\KDUJ4HYB\AppWrap[6].exe infected by "not-a-virus:AdWare.AdURL.c" Virus. Action Taken: No Action Taken. Thu Apr 07 21:29:09 2005 => File C:\DOKUME~1\Thomas\LOKALE~1\TEMPOR~1\Content.IE5\KDUJ4HYB\Installer[1].exe infected by "not-a-virus:AdWare.Look2Me.ab" Virus. Action Taken: No Action Taken. Fri Apr 08 15:22:36 2005 => Scanning HKLM\SYSTEM\CurrentControlSet\Services\VxD Fri Apr 08 15:23:05 2005 => System found infected with VX2 Spyware/Adware ({92daf5c1-2135-4e0c-b7a0-259abfcd3904})! Action taken: No Action Taken. Fri Apr 08 15:23:05 2005 => File System Found infected by "VX2 Spyware/Adware" Virus. Action Taken: No Action Taken. Fri Apr 08 15:23:05 2005 => System found infected with VX2 Spyware/Adware ({bb0d5adc-028d-4185-9288-722ddce2c757})! Action taken: No Action Taken. Fri Apr 08 15:23:05 2005 => File System Found infected by "VX2 Spyware/Adware" Virus. Action Taken: No Action Taken. Fri Apr 08 15:23:05 2005 => System found infected with VX2 Spyware/Adware ({00000049-8f91-4d9c-9573-f016e7626484})! Action taken: No Action Taken. Fri Apr 08 15:23:05 2005 => File System Found infected by "VX2 Spyware/Adware" Virus. Action Taken: No Action Taken. Fri Apr 08 15:23:05 2005 => System found infected with VX2 Spyware/Adware ({DDFFA75A-E81D-4454-89FC-B9FD0631E726})! Action taken: No Action Taken. Fri Apr 08 15:23:05 2005 => File System Found infected by "VX2 Spyware/Adware" Virus. Action Taken: No Action Taken. Fri Apr 08 15:23:06 2005 => Offending value found in HKCU\Software\VB and VBA Program Settings !!! Fri Apr 08 15:23:06 2005 => System found infected with VB and VBA Program Settings Spyware/Adware! Action taken: No Action Taken. Fri Apr 08 15:23:06 2005 => File System Found infected by "VB and VBA Program Settings Spyware/Adware" Virus. Action Taken: No Action Taken. Fri Apr 08 15:23:06 2005 => System found infected with text/html Spyware/Adware! Action taken: No Action Taken. Fri Apr 08 15:23:06 2005 => File System Found infected by "text/html Spyware/Adware" Virus. Action Taken: No Action Taken. Fri Apr 08 15:24:44 2005 => File C:\WINDOWS\ceres.dll infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. Fri Apr 08 15:24:45 2005 => File C:\WINDOWS\icont.exe infected by "not-a-virus:AdWare.AdURL.c" Virus. Action Taken: No Action Taken. Fri Apr 08 15:24:45 2005 => Scanning File C:\WINDOWS\iconu.exe Fri Apr 08 15:24:45 2005 => File C:\WINDOWS\iconu.exe infected by "not-a-virus:AdWare.Zestyfind" Virus. Action Taken: No Action Taken. Fri Apr 08 15:25:42 2005 => File C:\WINDOWS\System32\l26olcj31fo.dll infected by "not-a-virus:AdWare.Look2Me.ab" Virus. Action Taken: No Action Taken. Fri Apr 08 15:27:13 2005 => File C:\DOKUME~1\Thomas\LOKALE~1\Temp\B51831533\build2.exe infected by "not-a-virus:AdWare.ToolBar.ISearch.d" Virus. Action Taken: No Action Taken. Fri Apr 08 15:27:14 2005 => File C:\DOKUME~1\Thomas\LOKALE~1\Temp\bw2.com infected by "not-a-virus:AdWare.AdURL.c" Virus. Action Taken: No Action Taken. Fri Apr 08 15:27:17 2005 => File C:\DOKUME~1\Thomas\LOKALE~1\Temp\etnbaees.exe infected by "not-a-virus:AdWare.Lop.m" Virus. Action Taken: No Action Taken. Fri Apr 08 15:27:23 2005 => File C:\DOKUME~1\Thomas\LOKALE~1\Temp\GLB645.tmp infected by "not-a-virus:AdWare.VirtualBouncer.j" Virus. Action Taken: No Action Taken. Fri Apr 08 15:27:24 2005 => File C:\DOKUME~1\Thomas\LOKALE~1\Temp\gvveybpe.exe infected by "not-a-virus:AdWare.Lop.m" Virus. Action Taken: No Action Taken. Fri Apr 08 15:30:37 2005 => File C:\DOKUME~1\Thomas\LOKALE~1\TEMPOR~1\Content.IE5\KDUJ4HYB\AppWrap[1].exe infected by "not-a-virus:AdWare.AdURL.c" Virus. Action Taken: No Action Taken. Fri Apr 08 15:30:37 2005 => Scanning File C:\DOKUME~1\Thomas\LOKALE~1\TEMPOR~1\Content.IE5\KDUJ4HYB\AppWrap[2].exe Fri Apr 08 15:30:37 2005 => File C:\DOKUME~1\Thomas\LOKALE~1\TEMPOR~1\Content.IE5\KDUJ4HYB\AppWrap[2].exe infected by "Trojan-Downloader.Win32.Small.ru" Virus. Action Taken: No Action Taken. Fri Apr 08 15:30:37 2005 => Scanning File C:\DOKUME~1\Thomas\LOKALE~1\TEMPOR~1\Content.IE5\KDUJ4HYB\AppWrap[3].exe Fri Apr 08 15:30:37 2005 => File C:\DOKUME~1\Thomas\LOKALE~1\TEMPOR~1\Content.IE5\KDUJ4HYB\AppWrap[3].exe infected by "not-a-virus:AdWare.AdURL.c" Virus. Action Taken: No Action Taken. Fri Apr 08 15:30:37 2005 => Scanning File C:\DOKUME~1\Thomas\LOKALE~1\TEMPOR~1\Content.IE5\KDUJ4HYB\AppWrap[4].exe Fri Apr 08 15:30:37 2005 => File C:\DOKUME~1\Thomas\LOKALE~1\TEMPOR~1\Content.IE5\KDUJ4HYB\AppWrap[4].exe infected by "Trojan-Downloader.Win32.Small.ru" Virus. Action Taken: No Action Taken. Fri Apr 08 15:30:37 2005 => Scanning File C:\DOKUME~1\Thomas\LOKALE~1\TEMPOR~1\Content.IE5\KDUJ4HYB\AppWrap[5].exe Fri Apr 08 15:30:37 2005 => File C:\DOKUME~1\Thomas\LOKALE~1\TEMPOR~1\Content.IE5\KDUJ4HYB\AppWrap[5].exe infected by "not-a-virus:AdWare.Zestyfind" Virus. Action Taken: No Action Taken. Fri Apr 08 15:30:37 2005 => Scanning File C:\DOKUME~1\Thomas\LOKALE~1\TEMPOR~1\Content.IE5\KDUJ4HYB\AppWrap[6].exe Fri Apr 08 15:30:38 2005 => File C:\DOKUME~1\Thomas\LOKALE~1\TEMPOR~1\Content.IE5\KDUJ4HYB\AppWrap[6].exe infected by "not-a-virus:AdWare.AdURL.c" Virus. Action Taken: No Action Taken. Fri Apr 08 15:30:38 2005 => Scanning File C:\DOKUME~1\Thomas\LOKALE~1\TEMPOR~1\Content.IE5\KDUJ4HYB\AppWrap[7].exe Fri Apr 08 15:30:38 2005 => File C:\DOKUME~1\Thomas\LOKALE~1\TEMPOR~1\Content.IE5\KDUJ4HYB\AppWrap[7].exe infected by "Trojan-Dropper.Win32.Small.of" Virus. Action Taken: No Action Taken. Fri Apr 08 15:30:38 2005 => Scanning File C:\DOKUME~1\Thomas\LOKALE~1\TEMPOR~1\Content.IE5\KDUJ4HYB\AppWrap[8].exe Fri Apr 08 15:30:38 2005 => File C:\DOKUME~1\Thomas\LOKALE~1\TEMPOR~1\Content.IE5\KDUJ4HYB\AppWrap[8].exe infected by "Trojan-Downloader.Win32.Small.ru" Virus. Action Taken: No Action Taken. Fri Apr 08 15:30:38 2005 => Scanning File C:\DOKUME~1\Thomas\LOKALE~1\TEMPOR~1\Content.IE5\KDUJ4HYB\AppWrap[9].exe Fri Apr 08 15:30:38 2005 => File C:\DOKUME~1\Thomas\LOKALE~1\TEMPOR~1\Content.IE5\KDUJ4HYB\AppWrap[9].exe infected by "Trojan-Dropper.Win32.Small.of" Virus. Action Taken: No Action Taken. Fri Apr 08 15:31:38 2005 => File C:\DOKUME~1\Thomas\LOKALE~1\TEMPOR~1\Content.IE5\KDUJ4HYB\Installer[1].exe infected by "not-a-virus:AdWare.Look2Me.ab" Virus. Action Taken: No Action Taken. Fri Apr 08 15:32:05 2005 => File C:\DOKUME~1\Thomas\LOKALE~1\TEMPOR~1\Content.IE5\SDU74TIN\AppWrap[1].exe infected by "not-a-virus:AdWare.Zestyfind" Virus. Action Taken: No Action Taken. Fri Apr 08 15:32:05 2005 => Scanning File C:\DOKUME~1\Thomas\LOKALE~1\TEMPOR~1\Content.IE5\SDU74TIN\AppWrap[2].exe Fri Apr 08 15:32:05 2005 => File C:\DOKUME~1\Thomas\LOKALE~1\TEMPOR~1\Content.IE5\SDU74TIN\AppWrap[2].exe infected by "Trojan-Downloader.Win32.Small.ru" Virus. Action Taken: No Action Taken. |
Fri Apr 08 15:33:19 2005 => File C:\DOKUME~1\Thomas\LOKALE~1\TEMPOR~1\Content.IE5\SXQN8HAJ\AppWrap[1].exe infected by "Trojan-Dropper.Win32.Small.of" Virus. Action Taken: No Action Taken. Fri Apr 08 15:35:29 2005 => File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AXIS MODE ATOM DART\Tick Four.exe infected by "not-a-virus:AdWare.Lop.j" Virus. Action Taken: No Action Taken. Fri Apr 08 15:35:29 2005 => Scanning File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AXIS MODE ATOM DART\Upload Ford.exe Fri Apr 08 15:35:29 2005 => File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AXIS MODE ATOM DART\Upload Ford.exe infected by "not-a-virus:AdWare.Lop.j" Virus. Action Taken: No Action Taken. Fri Apr 08 15:37:58 2005 => File C:\Dokumente und Einstellungen\Thomas\Eigene Dateien\Download\Programme\FX-Scanner.exe infected by "HackTool.Win32.FxScanner" Virus. Action Taken: No Action Taken. Fri Apr 08 15:42:34 2005 => File C:\Dokumente und Einstellungen\Thomas\Eigene Dateien\Things\Theme Xp\Explorer Bar\96453.exe infected by "not-a-virus:AdWare.Gator.3103" Virus. Action Taken: No Action Taken. Fri Apr 08 15:42:36 2005 => File C:\Dokumente und Einstellungen\Thomas\Eigene Dateien\Things\Theme Xp\Visual Styles\98643.exe infected by "not-a-virus:AdWare.EZula.z" Virus. Action Taken: No Action Taken. Fri Apr 08 15:42:41 2005 => File C:\Dokumente und Einstellungen\Thomas\Lokale Einstellungen\Temp\B51831533\build2.exe infected by "not-a-virus:AdWare.ToolBar.ISearch.d" Virus. Action Taken: No Action Taken. Fri Apr 08 15:42:43 2005 => File C:\Dokumente und Einstellungen\Thomas\Lokale Einstellungen\Temp\bw2.com infected by "not-a-virus:AdWare.AdURL.c" Virus. Action Taken: No Action Taken. Fri Apr 08 15:42:47 2005 => File C:\Dokumente und Einstellungen\Thomas\Lokale Einstellungen\Temp\etnbaees.exe infected by "not-a-virus:AdWare.Lop.m" Virus. Action Taken: No Action Taken. Fri Apr 08 15:42:53 2005 => File C:\Dokumente und Einstellungen\Thomas\Lokale Einstellungen\Temp\GLB645.tmp infected by "not-a-virus:AdWare.VirtualBouncer.j" Virus. Action Taken: No Action Taken. Fri Apr 08 15:42:54 2005 => File C:\Dokumente und Einstellungen\Thomas\Lokale Einstellungen\Temp\gvveybpe.exe infected by "not-a-virus:AdWare.Lop.m" Virus. Action Taken: No Action Taken. Fri Apr 08 15:46:08 2005 => File C:\Dokumente und Einstellungen\Thomas\Lokale Einstellungen\Temporary Internet Files\Content.IE5\KDUJ4HYB\AppWrap[1].exe infected by "not-a-virus:AdWare.AdURL.c" Virus. Action Taken: No Action Taken. Fri Apr 08 15:46:08 2005 => File C:\Dokumente und Einstellungen\Thomas\Lokale Einstellungen\Temporary Internet Files\Content.IE5\KDUJ4HYB\AppWrap[2].exe infected by "Trojan-Downloader.Win32.Small.ru" Virus. Action Taken: No Action Taken. Fri Apr 08 15:46:09 2005 => File C:\Dokumente und Einstellungen\Thomas\Lokale Einstellungen\Temporary Internet Files\Content.IE5\KDUJ4HYB\AppWrap[3].exe infected by "not-a-virus:AdWare.AdURL.c" Virus. Action Taken: No Action Taken. Fri Apr 08 15:46:09 2005 => Scanning File C:\Dokumente und Einstellungen\Thomas\Lokale Einstellungen\Temporary Internet Files\Content.IE5\KDUJ4HYB\AppWrap[4].exe Fri Apr 08 15:46:09 2005 => File C:\Dokumente und Einstellungen\Thomas\Lokale Einstellungen\Temporary Internet Files\Content.IE5\KDUJ4HYB\AppWrap[4].exe infected by "Trojan-Downloader.Win32.Small.ru" Virus. Action Taken: No Action Taken. Fri Apr 08 15:46:09 2005 => Scanning File C:\Dokumente und Einstellungen\Thomas\Lokale Einstellungen\Temporary Internet Files\Content.IE5\KDUJ4HYB\AppWrap[5].exe Fri Apr 08 15:46:09 2005 => File C:\Dokumente und Einstellungen\Thomas\Lokale Einstellungen\Temporary Internet Files\Content.IE5\KDUJ4HYB\AppWrap[5].exe infected by "not-a-virus:AdWare.Zestyfind" Virus. Action Taken: No Action Taken. Fri Apr 08 15:46:09 2005 => Scanning File C:\Dokumente und Einstellungen\Thomas\Lokale Einstellungen\Temporary Internet Files\Content.IE5\KDUJ4HYB\AppWrap[6].exe Fri Apr 08 15:46:09 2005 => File C:\Dokumente und Einstellungen\Thomas\Lokale Einstellungen\Temporary Internet Files\Content.IE5\KDUJ4HYB\AppWrap[6].exe infected by "not-a-virus:AdWare.AdURL.c" Virus. Action Taken: No Action Taken. Fri Apr 08 15:46:09 2005 => Scanning File C:\Dokumente und Einstellungen\Thomas\Lokale Einstellungen\Temporary Internet Files\Content.IE5\KDUJ4HYB\AppWrap[7].exe Fri Apr 08 15:46:09 2005 => File C:\Dokumente und Einstellungen\Thomas\Lokale Einstellungen\Temporary Internet Files\Content.IE5\KDUJ4HYB\AppWrap[7].exe infected by "Trojan-Dropper.Win32.Small.of" Virus. Action Taken: No Action Taken. Fri Apr 08 15:46:09 2005 => Scanning File C:\Dokumente und Einstellungen\Thomas\Lokale Einstellungen\Temporary Internet Files\Content.IE5\KDUJ4HYB\AppWrap[8].exe Fri Apr 08 15:46:09 2005 => File C:\Dokumente und Einstellungen\Thomas\Lokale Einstellungen\Temporary Internet Files\Content.IE5\KDUJ4HYB\AppWrap[8].exe infected by "Trojan-Downloader.Win32.Small.ru" Virus. Action Taken: No Action Taken. Fri Apr 08 15:46:09 2005 => Scanning File C:\Dokumente und Einstellungen\Thomas\Lokale Einstellungen\Temporary Internet Files\Content.IE5\KDUJ4HYB\AppWrap[9].exe Fri Apr 08 15:46:09 2005 => File C:\Dokumente und Einstellungen\Thomas\Lokale Einstellungen\Temporary Internet Files\Content.IE5\KDUJ4HYB\AppWrap[9].exe infected by "Trojan-Dropper.Win32.Small.of" Virus. Action Taken: No Action Taken. Fri Apr 08 15:47:04 2005 => File C:\Dokumente und Einstellungen\Thomas\Lokale Einstellungen\Temporary Internet Files\Content.IE5\KDUJ4HYB\Installer[1].exe infected by "not-a-virus:AdWare.Look2Me.ab" Virus. Action Taken: No Action Taken. Fri Apr 08 15:47:26 2005 => File C:\Dokumente und Einstellungen\Thomas\Lokale Einstellungen\Temporary Internet Files\Content.IE5\SDU74TIN\AppWrap[1].exe infected by "not-a-virus:AdWare.Zestyfind" Virus. Action Taken: No Action Taken. Fri Apr 08 15:47:26 2005 => Scanning File C:\Dokumente und Einstellungen\Thomas\Lokale Einstellungen\Temporary Internet Files\Content.IE5\SDU74TIN\AppWrap[2].exe Fri Apr 08 15:47:27 2005 => File C:\Dokumente und Einstellungen\Thomas\Lokale Einstellungen\Temporary Internet Files\Content.IE5\SDU74TIN\AppWrap[2].exe infected by "Trojan-Downloader.Win32.Small.ru" Virus. Action Taken: No Action Taken. Fri Apr 08 15:48:27 2005 => File C:\Dokumente und Einstellungen\Thomas\Lokale Einstellungen\Temporary Internet Files\Content.IE5\SXQN8HAJ\AppWrap[1].exe infected by "Trojan-Dropper.Win32.Small.of" Virus. Action Taken: No Action Taken. Fri Apr 08 15:53:44 2005 => File C:\Programme\AVPersonal\INFECTED\qservice.VIR infected by "Trojan-Spy.Win32.ProAgent.20" Virus. Action Taken: No Action Taken. Fri Apr 08 15:54:00 2005 => File C:\Programme\C2Media\Setup.exe infected by "not-a-virus:AdWare.Lop" Virus. Action Taken: No Action Taken. Fri Apr 08 16:00:52 2005 => File C:\Programme\Mozilla Firefox\extensions\{2bafa858-4ff3-4207-822e-ef46d1b431de}\chrome\isearch.jar infected by "not-a-virus:AdWare.ToolBar.ISearch.e" Virus. Action Taken: No Action Taken. Fri Apr 08 16:05:20 2005 => File C:\System Volume Information\_restore{FE7B9722-F13D-4BCF-BB4C-3DA9F26DF5F0}\RP10\A0007597.dll infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. Fri Apr 08 16:05:24 2005 => File C:\System Volume Information\_restore{FE7B9722-F13D-4BCF-BB4C-3DA9F26DF5F0}\RP12\A0007645.exe infected by "not-a-virus:AdWare.Zestyfind" Virus. Action Taken: No Action Taken. Fri Apr 08 16:05:24 2005 => File C:\System Volume Information\_restore{FE7B9722-F13D-4BCF-BB4C-3DA9F26DF5F0}\RP12\A0007648.exe infected by "not-a-virus:AdWare.ToolBar.ISearch.d" Virus. Action Taken: No Action Taken. Fri Apr 08 16:05:24 2005 => File C:\System Volume Information\_restore{FE7B9722-F13D-4BCF-BB4C-3DA9F26DF5F0}\RP12\A0007649.dll infected by "not-a-virus:AdWare.Look2Me.ab" Virus. Action Taken: No Action Taken. Fri Apr 08 16:05:24 2005 => File C:\System Volume Information\_restore{FE7B9722-F13D-4BCF-BB4C-3DA9F26DF5F0}\RP12\A0007653.dll infected by "not-a-virus:AdWare.Look2Me.ab" Virus. Action Taken: No Action Taken. Fri Apr 08 16:05:25 2005 => File C:\System Volume Information\_restore{FE7B9722-F13D-4BCF-BB4C-3DA9F26DF5F0}\RP12\A0007682.exe infected by "not-a-virus:AdWare.ToolBar.ISearch.d" Virus. Action Taken: No Action Taken. Fri Apr 08 16:05:26 2005 => File C:\System Volume Information\_restore{FE7B9722-F13D-4BCF-BB4C-3DA9F26DF5F0}\RP12\A0007686.dll infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. Fri Apr 08 16:05:26 2005 => File C:\System Volume Information\_restore{FE7B9722-F13D-4BCF-BB4C-3DA9F26DF5F0}\RP12\A0007694.dll infected by "not-a-virus:AdWare.Look2Me.ab" Virus. Action Taken: No Action Taken. Fri Apr 08 16:05:26 2005 => File C:\System Volume Information\_restore{FE7B9722-F13D-4BCF-BB4C-3DA9F26DF5F0}\RP12\A0007695.exe infected by "not-a-virus:AdWare.ToolBar.ISearch.d" Virus. Action Taken: No Action Taken. Fri Apr 08 16:05:26 2005 => File C:\System Volume Information\_restore{FE7B9722-F13D-4BCF-BB4C-3DA9F26DF5F0}\RP12\A0007708.dll infected by "not-a-virus:AdWare.Look2Me.ab" Virus. Action Taken: No Action Taken. Fri Apr 08 16:05:26 2005 => File C:\System Volume Information\_restore{FE7B9722-F13D-4BCF-BB4C-3DA9F26DF5F0}\RP12\A0007709.dll infected by "not-a-virus:AdWare.Look2Me.ab" Virus. Action Taken: No Action Taken. Fri Apr 08 16:06:46 2005 => File C:\System Volume Information\_restore{FE7B9722-F13D-4BCF-BB4C-3DA9F26DF5F0}\RP6\A0007466.exe infected by "not-a-virus:AdWare.ToolBar.ISearch.d" Virus. Action Taken: No Action Taken. Fri Apr 08 16:06:47 2005 => File C:\System Volume Information\_restore{FE7B9722-F13D-4BCF-BB4C-3DA9F26DF5F0}\RP6\A0007468.dll infected by "not-a-virus:AdWare.ToolBar.ISearch.d" Virus. Action Taken: No Action Taken. Fri Apr 08 16:06:50 2005 => File C:\System Volume Information\_restore{FE7B9722-F13D-4BCF-BB4C-3DA9F26DF5F0}\RP6\A0007477.EXE infected by "not-a-virus:AdWare.VirtualBouncer.j" Virus. Action Taken: No Action Taken. Fri Apr 08 16:06:51 2005 => File C:\System Volume Information\_restore{FE7B9722-F13D-4BCF-BB4C-3DA9F26DF5F0}\RP6\A0007483.EXE infected by "not-a-virus:AdWare.VirtualBouncer.j" Virus. Action Taken: No Action Taken. Fri Apr 08 16:06:51 2005 => File C:\System Volume Information\_restore{FE7B9722-F13D-4BCF-BB4C-3DA9F26DF5F0}\RP6\A0007489.exe infected by "not-a-virus:AdWare.ToolBar.ISearch.d" Virus. Action Taken: No Action Taken. Fri Apr 08 16:06:51 2005 => File C:\System Volume Information\_restore{FE7B9722-F13D-4BCF-BB4C-3DA9F26DF5F0}\RP6\A0007490.exe infected by "not-a-virus:AdWare.VirtualBouncer.c" Virus. Action Taken: No Action Taken. Fri Apr 08 16:06:54 2005 => File C:\System Volume Information\_restore{FE7B9722-F13D-4BCF-BB4C-3DA9F26DF5F0}\RP8\A0007538.dll infected by "not-a-virus:AdWare.Look2Me.ab" Virus. Action Taken: No Action Taken. Fri Apr 08 16:06:54 2005 => File C:\System Volume Information\_restore{FE7B9722-F13D-4BCF-BB4C-3DA9F26DF5F0}\RP8\A0007539.dll infected by "not-a-virus:AdWare.Look2Me.ab" Virus. Action Taken: No Action Taken. Fri Apr 08 16:06:54 2005 => File C:\System Volume Information\_restore{FE7B9722-F13D-4BCF-BB4C-3DA9F26DF5F0}\RP8\A0007548.dll infected by "not-a-virus:AdWare.Look2Me.ab" Virus. Action Taken: No Action Taken. Fri Apr 08 16:06:54 2005 => File C:\System Volume Information\_restore{FE7B9722-F13D-4BCF-BB4C-3DA9F26DF5F0}\RP8\A0007549.dll infected by "not-a-virus:AdWare.Look2Me.ab" Virus. Action Taken: No Action Taken. Fri Apr 08 16:06:54 2005 => File C:\System Volume Information\_restore{FE7B9722-F13D-4BCF-BB4C-3DA9F26DF5F0}\RP8\A0007558.dll infected by "not-a-virus:AdWare.Look2Me.ab" Virus. Action Taken: No Action Taken. Fri Apr 08 16:06:55 2005 => File C:\System Volume Information\_restore{FE7B9722-F13D-4BCF-BB4C-3DA9F26DF5F0}\RP8\A0007567.dll infected by "not-a-virus:AdWare.Look2Me.ab" Virus. Action Taken: No Action Taken. Fri Apr 08 16:07:04 2005 => File C:\WINDOWS\ceres.dll infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken. Fri Apr 08 16:07:06 2005 => File C:\WINDOWS\Downloaded Program Files\DS3.dll infected by "Trojan-Downloader.Win32.Agent.jt" Virus. Action Taken: No Action Taken. Fri Apr 08 16:07:29 2005 => File C:\WINDOWS\icont.exe infected by "not-a-virus:AdWare.AdURL.c" Virus. Action Taken: No Action Taken. Fri Apr 08 16:07:30 2005 => File C:\WINDOWS\iconu.exe infected by "not-a-virus:AdWare.Zestyfind" Virus. Action Taken: No Action Taken. Fri Apr 08 16:08:46 2005 => File C:\WINDOWS\isrvs\desktop.exe infected by "not-a-virus:AdWare.ToolBar.ISearch.d" Virus. Action Taken: No Action Taken. Fri Apr 08 16:08:47 2005 => File C:\WINDOWS\isrvs\mfiltis.dll infected by "not-a-virus:AdWare.ToolBar.ISearch.d" Virus. Action Taken: No Action Taken. Fri Apr 08 16:10:40 2005 => File C:\WINDOWS\system\UpdInst.exe infected by "not-a-virus:AdWare.Look2Me.ab" Virus. Action Taken: No Action Taken. Fri Apr 08 16:16:33 2005 => File C:\WINDOWS\system32\l26olcj31fo.dll infected by "not-a-virus:AdWare.Look2Me.ab" Virus. Action Taken: No Action Taken. Fri Apr 08 16:18:55 2005 => File C:\WINDOWS\Temp\B51831533\build2.exe infected by "not-a-virus:AdWare.ToolBar.ISearch.d" Virus. Action Taken: No Action Taken. Fri Apr 08 16:18:58 2005 => File C:\WINDOWS\Temp\bw2.com infected by "Trojan-Dropper.Win32.Small.of" Virus. Action Taken: No Action Taken. Fri Apr 08 16:35:23 2005 => Total Objects Scanned: 168424 Fri Apr 08 16:35:23 2005 => Total Virus(es) Found: 90 Fri Apr 08 16:35:23 2005 => Total Disinfected Files: 0 Fri Apr 08 16:35:23 2005 => Total Files Renamed: 0 Fri Apr 08 16:35:23 2005 => Total Deleted Objects: 0 Fri Apr 08 16:35:23 2005 => Total Errors: 48 Fri Apr 08 16:35:23 2005 => Time Elapsed: 01:13:25 Fri Apr 08 16:35:23 2005 => Virus Database Date: 2005/04/06 Fri Apr 08 16:35:23 2005 => Virus Database Count: 124827 Fazit: Ich ahne böses....:teufel1: |
Das is jetzt die ganze Liste nur Viren :teufel1: Aber ich schätze ma die Hälfte stimmt net ganz... mfg Tomasch |
Aufgrund der Einträge im HijackThis-Log würde ich dir zum Neuaufsetzen raten. Das ist die einzige wirklich sichere Methode! Alternativ: Spybot Search&Destroy und Ad-Aware runterladen, installieren und updaten. Die Systemwiederherstellung deaktivieren. In den abgesicherten Modus booten. -> Im Internet Explorer-> Extras-> Internetoptionen-> Reiter "allgemein" -> Verlauf leeren + Cookies löschen + Dateien löschen (auch Offlineinhalte) -> Win-Taste + R -> "temp" (ohne"") -> Enter-> alle Dateien löschen -> Win-Taste + R -> "%temp%" (ohne"") -> Enter-> alle Dateien löschen -> Die restlichen Dateien manuell löschen. Vernachlässigen kannst du folgendes: Zitat:
Neue HjT-Log posten. Nochmals, absolute Sicherheit gibt's nur durch formatieren! |
Hmm ich denk mal ich hab jetzt was anderes... hab das gemacht alle Dateien gelöscht aber jetzt hab ich nen Prozess der andauernd dieses Fenster öffnet: http://img237.echo.cx/img237/6296/unbenannt15pf.jpg Wenn ich den Prozess schließe kommt der Prozess unter nem zufällig generierten Namen immer wieder... Auch wenn ich den aussem Systemstart rausnehm kommt der immer wieder... Was soll ich tun?? mfg Tomasch |
Hab nochma mit Escan gescannt: File C:\WINDOWS\system32\guard.tmp infected by "not-a-virus:AdWare.Look2Me.ab" Virus. Action Taken: No Action Taken. File System Found infected by "VB and VBA Program Settings Spyware/Adware" Virus. Action Taken: No Action Taken. File System Found infected by "text/html Spyware/Adware" Virus. Action Taken: No Action Taken. File System Found infected by "addestroyer Spyware/Adware" Virus. Action Taken: No Action Taken. File C:\WINDOWS\System32\guard.tmp infected by "not-a-virus:AdWare.Look2Me.ab" Virus. Action Taken: No Action Taken. File C:\WINDOWS\System32\lv32.dll infected by "not-a-virus:AdWare.Look2Me.ab" Virus. Action Taken: No Action Taken. File C:\Dokumente und Einstellungen\Thomas\Eigene Dateien\Download\Patch\Postal2Patch1337.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\Dokumente und Einstellungen\Thomas\Eigene Dateien\Download\Programme\Share Proggis\netpumper-1.20.1-setup.exe infected by "not-a-virus:AdWare.SaveNow.v" Virus. Action Taken: No Action Taken. File C:\Dokumente und Einstellungen\"Benutzername"\Eigene Dateien\Things\PHP\xampp-win32-1.4.11-installer.exe tagged as not-a-virus:RiskWare.Tool.PrcView.3725. No Action Taken. File C:\System Volume Information\_restore{FE7B9722-F13D-4BCF-BB4C-3DA9F26DF5F0}\RP2\A0000009.dll infected by "not-a-virus:AdWare.Look2Me.ab" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{FE7B9722-F13D-4BCF-BB4C-3DA9F26DF5F0}\RP2\A0000028.dll infected by "not-a-virus:AdWare.Look2Me.ab" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{FE7B9722-F13D-4BCF-BB4C-3DA9F26DF5F0}\RP2\A0000032.dll infected by "not-a-virus:AdWare.Look2Me.ab" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Downloaded Program Files\DS3.dll infected by "Trojan-Downloader.Win32.Agent.jt" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\guard.tmp infected by "not-a-virus:AdWare.Look2Me.ab" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\lv32.dll infected by "not-a-virus:AdWare.Look2Me.ab" Virus. Action Taken: No Action Taken. File D:\Spiele\Counter Strike\hltv.exe tagged as not-a-virus:RiskWare.Proxy.Hltv. No Action Taken. |
Noch ne Hijacker Scan, helft mir doch bitte :(: Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Programme\TGTSoft\StyleXP\StyleXPService.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\Programme\AVPersonal\AVGUARD.EXE C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\Explorer.exe C:\WINDOWS\System32\snmp.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\dwwin.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\Programme\AVPersonal\AVGNT.EXE C:\Programme\Messenger Plus! 3\MsgPlus.exe C:\WINDOWS\system32\rundll32.exe C:\Programme\Winamp\winamp.exe C:\Dokumente und Einstellungen\Thomas\Desktop\LeechEx.exe C:\Programme\MSN Messenger\msnmsgr.exe C:\Programme\Spybot - Search & Destroy\SpybotSD.exe c:\windows\system32\idwbjxd.exe C:\Dokumente und Einstellungen\Thomas\Eigene Dateien\Download\Programme\Hackthis1_99_1.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://bnhlblovgnz.com/CWC94l2Uk5DI4...72ppl4iy0.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tomasch.de.vu/ F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [AVGCtrl] "C:\Programme\AVPersonal\AVGNT.EXE" /min O4 - HKLM\..\Run: [MessengerPlus3] "C:\Programme\Messenger Plus! 3\MsgPlus.exe" O4 - HKLM\..\Run: [xzitkr] c:\windows\system32\idwbjxd.exe O4 - HKCU\..\Run: [MessengerPlus3] "C:\Programme\Messenger Plus! 3\MsgPlus.exe" /WinStart O4 - HKCU\..\Run: [msn] C:\\Programme\\MSN Messenger\\msnmsgr.exe O8 - Extra context menu item: Download with NetPumper - C:\Programme\NetPumper\AddUrl.htm O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\j2re1.4.2_06\bin\npjpi142_06.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\j2re1.4.2_06\bin\npjpi142_06.dll O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Programme\WinHTTrack\WinHTTrackIEBar.dll O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Programme\WinHTTrack\WinHTTrackIEBar.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE (file missing) O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE (file missing) O12 - Plugin for .dll: C:\Programme\Opera\PLUGINS\NPNetPumper_Application.dll O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O16 - DPF: {14F65762-96FB-44B9-8DAC-93845F377A0E} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.co...haringctrl.cab O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O16 - DPF: {AD0B8220-7DA4-4C0A-8532-B25A9F631D3D} (VacPro.internazionale_ver10) - http://advnt01.com/dialer/internazionale_ver10.CAB O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary...o.cab32846.cab O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by21fd.bay21.hotmail.msn.com/...x/HMAtchmt.ocx O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary...n.cab31267.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{0FBBFAE9-FDE3-46B9-BEA2-962BC8D9975F}: NameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\..\{A6B26F98-2F78-4188-9519-4784ECDC3857}: NameServer = 192.168.2.1 O17 - HKLM\System\CS1\Services\Tcpip\..\{0FBBFAE9-FDE3-46B9-BEA2-962BC8D9975F}: NameServer = 192.168.2.1 O17 - HKLM\System\CS2\Services\Tcpip\..\{0FBBFAE9-FDE3-46B9-BEA2-962BC8D9975F}: NameServer = 192.168.2.1 O18 - Filter: text/html - {950238FB-C706-4791-8674-4D429F85897E} - (no file) O20 - Winlogon Notify: WebCheck - C:\WINDOWS\system32\q8680ijue8o80.dll O23 - Service: Adobe LM Service - Unknown owner - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Programme\AVPersonal\AVGUARD.EXE O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: StyleXPService - Unknown owner - C:\Programme\TGTSoft\StyleXP\StyleXPService.exe O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe |
Jetzt fährt der PC auch noch nach ner ZEit den PC runter wenn ich den Prozess nich regelmäßig beende :S Bitte helft mir!!! :heulen: mfg Tomasch |
| Alle Zeitangaben in WEZ +1. Es ist jetzt 19:47 Uhr. |
Copyright ©2000-2025, Trojaner-Board