Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Nicht löschbares Etwas bremst meinen PC (https://www.trojaner-board.de/19711-loeschbares-etwas-bremst-meinen-pc.html)

Digga 10.07.2005 18:53

Nicht löschbares Etwas bremst meinen PC
 
Ich habe einige Zeit dämlicher Weise mein Anti-Vir nicht angehabt. Ein paar Tage später hatte ich den Salat alles an meinem PC stockte oder ging nicht mehr. Habe daraufhin Massen von Würmern und Viren löschen können. Aber dieses penetrante Ding bzw Dinger, kann das nicht so genau definieren, bleiben egal was ich mache. Habe schon Norton AntiVir, SpybotSD und HijackThis ausprobiert.
Um mal zu zeigen wovon ich hier spreche poste ich mal meine SpabotSD Result:

DyFuCA.InternetOptimizer: Einstellungen (Registrierungsdatenbank-Schlüssel, fixing failed)
HKEY_USERS\S-1-5-18\Software\Policies\Avenue Media

DyFuCA.InternetOptimizer: Einstellungen (Registrierungsdatenbank-Schlüssel, fixing failed)
HKEY_USERS\.DEFAULT\Software\Policies\Avenue Media

DyFuCA.InternetOptimizer: Einstellungen (Registrierungsdatenbank-Schlüssel, fixing failed)
HKEY_USERS\S-1-5-18\Software\Avenue Media

DyFuCA.InternetOptimizer: Einstellungen (Registrierungsdatenbank-Schlüssel, fixing failed)
HKEY_USERS\.DEFAULT\Software\Avenue Media

DyFuCA.InternetOptimizer: Einstellungen (Registrierungsdatenbank-Schlüssel, fixing failed)
HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Policies\AMeOpt

DyFuCA.InternetOptimizer: Einstellungen (Registrierungsdatenbank-Schlüssel, fixing failed)
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\AMeOpt

ISearchTech.PowerScan: Benutzer-Einstellungen (Registrierungsdatenbank-Schlüssel, fixing failed)
HKEY_USERS\S-1-5-18\Software\PowerScan

ISearchTech.PowerScan: Benutzer-Einstellungen (Registrierungsdatenbank-Schlüssel, fixing failed)
HKEY_USERS\.DEFAULT\Software\PowerScan

ISearchTech.PowerScan: Einstellungen (Registrierungsdatenbank-Schlüssel, fixing failed)
HKEY_USERS\S-1-5-18\Software\IST

ISearchTech.PowerScan: Einstellungen (Registrierungsdatenbank-Schlüssel, fixing failed)
HKEY_USERS\.DEFAULT\Software\IST

ISearchTech.SideFind: Einstellungen (Registrierungsdatenbank-Schlüssel, fixing failed)
HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Explorer Bars\{8CBA1B49-8144-4721-A7B1-64C578C9EED7}

ISearchTech.SideFind: Einstellungen (Registrierungsdatenbank-Schlüssel, fixing failed)
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Explorer Bars\{8CBA1B49-8144-4721-A7B1-64C578C9EED7}

ISearchTech.SideFind: Einstellungen (Registrierungsdatenbank-Schlüssel, fixing failed)
HKEY_LOCAL_MACHINE\SOFTWARE\ISTbar


--- Spybot - Search && Destroy version: 1.3 ---
2005-04-26 Includes\Cookies.sbi
2005-07-07 Includes\Dialer.sbi
2005-07-07 Includes\Hijackers.sbi
2005-06-23 Includes\Keyloggers.sbi
2004-11-29 Includes\LSP.sbi
2005-07-07 Includes\Malware.sbi
2005-06-09 Includes\PUPS.sbi
2005-04-27 Includes\Revision.sbi
2005-06-09 Includes\Security.sbi
2005-07-07 Includes\Spybots.sbi
2005-02-17 Includes\Tracks.uti
2005-07-07 Includes\Trojans.sbi



Ich hoffe mal jemand von euch kann mir da weiterhelfen wo mein Wissen und das meiner Freunde endete...

cronos 10.07.2005 18:55

Poste zunächst ein Hijackthis-Logfile .

Digga 10.07.2005 19:43

Alles klar:


Logfile of HijackThis v1.99.1
Scan saved at 20:42:08, on 10.07.2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Norton AntiVirus\navapsvc.exe
C:\Programme\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Programme\Java\jre1.5.0_02\bin\jusched.exe
C:\Programme\D-Tools\daemon.exe
C:\Programme\Microsoft Hardware\Keyboard\type32.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\winssh.exe
C:\Programme\ICQ\Icq.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Programme\Internet Explorer\iexplore.exe
C:\Dokumente und Einstellungen\Digga\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
R3 - Default URLSearchHook is missing
O1 - Hosts: <html><head>
O1 - Hosts: <title>404 Not Found</title>
O1 - Hosts: </head><body>
O1 - Hosts: <h1>Not Found</h1>
O1 - Hosts: <p>The requested URL /task.php was not found on this server.</p>
O1 - Hosts: <hr />
O1 - Hosts: <address>Apache/2.0.51 (Fedora) Server at mexxgood.com Port 80</address>
O1 - Hosts: </body></html>
O1 - Hosts: <html><head>
O1 - Hosts: <title>404 Not Found</title>
O1 - Hosts: </head><body>
O1 - Hosts: <h1>Not Found</h1>
O1 - Hosts: <p>The requested URL /task.php was not found on this server.</p>
O1 - Hosts: <hr />
O1 - Hosts: <address>Apache/2.0.51 (Fedora) Server at mexxgood.com Port 80</address>
O1 - Hosts: </body></html>
O1 - Hosts: <html><head>
O1 - Hosts: <title>404 Not Found</title>
O1 - Hosts: </head><body>
O1 - Hosts: <h1>Not Found</h1>
O1 - Hosts: <p>The requested URL /task.php was not found on this server.</p>
O1 - Hosts: <hr />
O1 - Hosts: <address>Apache/2.0.51 (Fedora) Server at mexxgood.com Port 80</address>
O1 - Hosts: </body></html>
O1 - Hosts: <html><head>
O1 - Hosts: <title>404 Not Found</title>
O1 - Hosts: </head><body>
O1 - Hosts: <h1>Not Found</h1>
O1 - Hosts: <p>The requested URL /task.php was not found on this server.</p>
O1 - Hosts: <hr />
O1 - Hosts: <address>Apache/2.0.51 (Fedora) Server at mexxgood.com Port 80</address>
O1 - Hosts: </body></html>
O1 - Hosts: <html><head>
O1 - Hosts: <title>404 Not Found</title>
O1 - Hosts: </head><body>
O1 - Hosts: <h1>Not Found</h1>
O1 - Hosts: <p>The requested URL /task.php was not found on this server.</p>
O1 - Hosts: <hr />
O1 - Hosts: <address>Apache/2.0.51 (Fedora) Server at mexxgood.com Port 80</address>
O1 - Hosts: </body></html>
O1 - Hosts: <html><head>
O1 - Hosts: <title>404 Not Found</title>
O1 - Hosts: </head><body>
O1 - Hosts: <h1>Not Found</h1>
O1 - Hosts: <p>The requested URL /task.php was not found on this server.</p>
O1 - Hosts: <hr />
O1 - Hosts: <address>Apache/2.0.51 (Fedora) Server at mexxgood.com Port 80</address>
O1 - Hosts: </body></html>
O1 - Hosts: <html><head>
O1 - Hosts: <title>404 Not Found</title>
O1 - Hosts: </head><body>
O1 - Hosts: <h1>Not Found</h1>
O1 - Hosts: <p>The requested URL /task.php was not found on this server.</p>
O1 - Hosts: <hr />
O1 - Hosts: <address>Apache/2.0.51 (Fedora) Server at mexxgood.com Port 80</address>
O1 - Hosts: </body></html>
O1 - Hosts: <html><head>
O1 - Hosts: <title>404 Not Found</title>
O1 - Hosts: </head><body>
O1 - Hosts: <h1>Not Found</h1>
O1 - Hosts: <p>The requested URL /task.php was not found on this server.</p>
O1 - Hosts: <hr />
O1 - Hosts: <address>Apache/2.0.51 (Fedora) Server at mexxgood.com Port 80</address>
O1 - Hosts: </body></html>
O1 - Hosts: <html><head>
O1 - Hosts: <title>404 Not Found</title>
O1 - Hosts: </head><body>
O1 - Hosts: <h1>Not Found</h1>
O1 - Hosts: <p>The requested URL /task.php was not found on this server.</p>
O1 - Hosts: <hr />
O1 - Hosts: <address>Apache/2.0.51 (Fedora) Server at mexxgood.com Port 80</address>
O1 - Hosts: </body></html>
O1 - Hosts: <html><head>
O1 - Hosts: <title>404 Not Found</title>
O1 - Hosts: </head><body>
O1 - Hosts: <h1>Not Found</h1>
O1 - Hosts: <p>The requested URL /task.php was not found on this server.</p>
O1 - Hosts: <hr />
O1 - Hosts: <address>Apache/2.0.51 (Fedora) Server at mexxgood.com Port 80</address>
O1 - Hosts: </body></html>
O1 - Hosts: <html><head>
O1 - Hosts: <title>404 Not Found</title>
O1 - Hosts: </head><body>
O1 - Hosts: <h1>Not Found</h1>
O1 - Hosts: <p>The requested URL /task.php was not found on this server.</p>
O1 - Hosts: <hr />
O1 - Hosts: <address>Apache/2.0.51 (Fedora) Server at mexxgood.com Port 80</address>
O1 - Hosts: </body></html>
O1 - Hosts: <html><head>
O1 - Hosts: <title>404 Not Found</title>
O1 - Hosts: </head><body>
O1 - Hosts: <h1>Not Found</h1>
O1 - Hosts: <p>The requested URL /task.php was not found on this server.</p>
O1 - Hosts: <hr />
O1 - Hosts: <address>Apache/2.0.51 (Fedora) Server at mexxgood.com Port 80</address>
O1 - Hosts: </body></html>
O1 - Hosts: <html><head>
O1 - Hosts: <title>404 Not Found</title>
O1 - Hosts: </head><body>
O1 - Hosts: <h1>Not Found</h1>
O1 - Hosts: <p>The requested URL /task.php was not found on this server.</p>
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programme\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programme\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programme\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [IntelliType] "C:\Programme\Microsoft Hardware\Keyboard\type32.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Programme\Gemeinsame Dateien\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Network Access] winssh.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [mouse] mouse.exe
O4 - HKLM\..\RunServices: [IExplorer7 Java Scripting] IExplore327.exe
O4 - HKLM\..\RunServices: [Network Access] winssh.exe
O4 - HKLM\..\RunServices: [mouse] mouse.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Microsoft AntiSpyware helper - {F936157F-DB85-4ABB-A129-9A26B074D16C} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {F936157F-DB85-4ABB-A129-9A26B074D16C} - (no file) (HKCU)
O15 - Trusted Zone: http://ny.contentmatch.net (HKLM)
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/62...ridge-c267.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Programme\Yahoo!\Common\yinsthelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{5BF59F55-739F-43EF-8ED8-C2B804CF345E}: NameServer = 217.237.151.225 217.237.150.225
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Programme\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Programme\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Programme\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\GEMEIN~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe

cronos 10.07.2005 19:56

Da hast du dir ja eine erstklassige Malwaresammlung angelegt.
Alleine aufrund dieses Schädlings ist dein System als kompromittiert zu betrachten, von dem anderen Mist will ich gar nicht erst anfangen (HTML-Code in der Host-Datei, andere Einträge, die auf weiteren Backdoor-Befall schließen lassen).
Du solltest dein System nach dieser Anleitung neu aufsetzen, um ähnliches in Zukunft zu vermeiden.
Warum eine Bereinigung hier nicht zum Erfolg führen kann:

http://www.mathematik.uni-marburg.de...al.html#sec2.5


Alle Zeitangaben in WEZ +1. Es ist jetzt 11:52 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131