BDS/HacDef.073.B.1 -> wer kann mir bei der Beseitigung helfen?

#31 Hallo@summs

Nichts zu sehen .....

Suche mal, ob du folgendes findest:
hxdefdrv.sys
inatjoy.dll
motkrtin.dll
witadr.dll
winunins.exe
winunins.ini
svhost.exe

und in der Registry:
Start<Ausfuehren<regedit

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Network Service = “%Windows%\<trojan executable> -sr –0
eventuell:
C:\WINDOWS\svhost.exe -sr -0

HKLM\System\CurrentControlSet\Services\HackerDefender100
HKLM\SYSTEM\CurrentControlSet\Services\HackerDefenderDrv100

________________________________________________________________

<Das eScan AV Toolkit (mwav.exe) herunterladen, oeffnen, aber nicht scannen
http://www.mwti.net/antivirus/free_utilities.asp
*
danach die "kavupd.exe" (automatisches Update ueber DOS) ausführen. (oder unter Start<Ausfuehren<%temp% die kavupd.exe suchen) und anklicken.

<gehe in den abgesicherten Modus
http://www.tu-berlin.de/www/software/virus/savemode.shtml

und den Scanner mit der "mwav.exe" starten. Alle Häkchen setzen :
Auswählen: Memory, Startup-Folders, Registry, System Folders, Services, Drive/All Local drives
<und "Scan " klicken.

<Öffne die mwav.log -> Bearbeiten -> Suchen ->
Wenn man infizierte Dateien in dem eScan Log finden will, sollte man nach infected suchen und die Eintraege hier posten,

dann berichte.
mfg
Sabina
__________
MfG Sabina

rund um die PC-Sicherheit

#32 hier sind die gefundenen sachen aus dem mwav.log

Code

Thu Nov 04 15:07:49 2004 => C:\WINDOWS\hxdefdrv.sys possibly infected and removed by background antivirus package!
Thu Nov 04 15:07:58 2004 => File C:\WINDOWS\hxdefdrv.sys infected by "BkCln.Unknown" Virus. Action Taken: No Action Taken.
Thu Nov 04 15:09:53 2004 => File C:\WINDOWS\System32\tssmte.02e infected by "Trojan.JS.StartPage.u" Virus. Action Taken: No Action Taken.
Thu Nov 04 15:09:53 2004 => File C:\WINDOWS\System32\tydnii.6h7 infected by "Trojan.JS.StartPage.u" Virus. Action Taken: No Action Taken.
Thu Nov 04 15:10:07 2004 => File C:\WINDOWS\System32\stvxna.gl6 infected by "Trojan.JS.StartPage.u" Virus. Action Taken: No Action Taken.
Thu Nov 04 15:10:07 2004 => File C:\WINDOWS\System32\zzcrsx.8oe infected by "Trojan.JS.StartPage.u" Virus. Action Taken: No Action Taken.
Thu Nov 04 15:10:07 2004 => File C:\WINDOWS\System32\jlqlaa.s9m infected by "Trojan.JS.StartPage.u" Virus. Action Taken: No Action Taken.
Thu Nov 04 15:10:07 2004 => File C:\WINDOWS\System32\vnwwnf.v44 infected by "Trojan.JS.StartPage.u" Virus. Action Taken: No Action Taken.
Thu Nov 04 15:10:08 2004 => File C:\WINDOWS\System32\yzndip.38h infected by "Trojan.JS.StartPage.u" Virus. Action Taken: No Action Taken.
Thu Nov 04 15:10:08 2004 => File C:\WINDOWS\System32\szhjdb.wc1 infected by "Trojan.JS.StartPage.u" Virus. Action Taken: No Action Taken.

Thu Nov 04 15:10:08 2004 => File C:\WINDOWS\System32\jqdqpo.863 infected by "Trojan.JS.StartPage.u" Virus. Action Taken: No Action Taken.

Thu Nov 04 15:10:11 2004 => File C:\WINDOWS\System32\telnet.exe.tmp infected by "Trojan.Win32.StartPage.pc" Virus. Action Taken: No Action Taken.

Thu Nov 04 15:10:44 2004 => File C:\FOUND.000\FILE0298.CHK infected by "Worm.Win32.Padobot.k" Virus. Action Taken: No Action Taken.

Thu Nov 04 15:10:58 2004 => File C:\FOUND.000\FILE0594.CHK infected by "Worm.Win32.Padobot.k" Virus. Action Taken: No Action Taken.

Thu Nov 04 15:11:02 2004 => File C:\FOUND.000\FILE0715.CHK infected by "TrojanDownloader.Win32.IstBar.gen" Virus. Action Taken: No Action Taken.

Thu Nov 04 15:11:02 2004 => File C:\FOUND.000\FILE0717.CHK infected by "TrojanDownloader.Win32.Small.hs" Virus. Action Taken: No Action Taken.

Thu Nov 04 15:11:08 2004 => File C:\FOUND.000\FILE0865.CHK infected by "Backdoor.HacDef.073.b" Virus. Action Taken: No Action Taken.

Thu Nov 04 15:14:15 2004 => File C:\WINDOWS\System32\qdzpgc.934 infected by "Trojan.JS.StartPage.u" Virus. Action Taken: No Action Taken.

Thu Nov 04 15:14:15 2004 => File C:\WINDOWS\System32\slgqms.fv2 infected by "Trojan.JS.StartPage.u" Virus. Action Taken: No Action Taken.

Thu Nov 04 15:14:15 2004 => File C:\WINDOWS\System32\bfzpvo.vd4 infected by "Trojan.JS.StartPage.u" Virus. Action Taken: No Action Taken.

Thu Nov 04 15:14:15 2004 => File C:\WINDOWS\System32\tssmte.02e infected by "Trojan.JS.StartPage.u" Virus. Action Taken: No Action Taken.

Thu Nov 04 15:14:15 2004 => File C:\WINDOWS\System32\tydnii.6h7 infected by "Trojan.JS.StartPage.u" Virus. Action Taken: No Action Taken.

Thu Nov 04 15:14:27 2004 => File C:\WINDOWS\System32\stvxna.gl6 infected by "Trojan.JS.StartPage.u" Virus. Action Taken: No Action Taken.

Thu Nov 04 15:14:27 2004 => File C:\WINDOWS\System32\zzcrsx.8oe infected by "Trojan.JS.StartPage.u" Virus. Action Taken: No Action Taken.

Thu Nov 04 15:14:27 2004 => File C:\WINDOWS\System32\jlqlaa.s9m infected by "Trojan.JS.StartPage.u" Virus. Action Taken: No Action Taken.

Thu Nov 04 15:14:28 2004 => File C:\WINDOWS\System32\vnwwnf.v44 infected by "Trojan.JS.StartPage.u" Virus. Action Taken: No Action Taken.

Thu Nov 04 15:14:28 2004 => File C:\WINDOWS\System32\yzndip.38h infected by "Trojan.JS.StartPage.u" Virus. Action Taken: No Action Taken.

Thu Nov 04 15:14:28 2004 => File C:\WINDOWS\System32\szhjdb.wc1 infected by "Trojan.JS.StartPage.u" Virus. Action Taken: No Action Taken.

Thu Nov 04 15:14:28 2004 => File C:\WINDOWS\System32\jqdqpo.863 infected by "Trojan.JS.StartPage.u" Virus. Action Taken: No Action Taken.

Thu Nov 04 15:14:30 2004 => File C:\WINDOWS\System32\telnet.exe.tmp infected by "Trojan.Win32.StartPage.pc" Virus. Action Taken: No Action Taken.

Thu Nov 04 15:18:00 2004 => File C:\WINDOWS\System32\slgqms.fv2 infected by "Trojan.JS.StartPage.u" Virus. Action Taken: No Action Taken.

Thu Nov 04 15:18:00 2004 => File C:\WINDOWS\System32\bfzpvo.vd4 infected by "Trojan.JS.StartPage.u" Virus. Action Taken: No Action Taken.

Thu Nov 04 15:18:00 2004 => File C:\WINDOWS\System32\tssmte.02e infected by "Trojan.JS.StartPage.u" Virus. Action Taken: No Action Taken.


Thu Nov 04 15:18:00 2004 => File C:\WINDOWS\System32\tydnii.6h7 infected by "Trojan.JS.StartPage.u" Virus. Action Taken: No Action Taken.

Thu Nov 04 15:18:12 2004 => File C:\WINDOWS\System32\stvxna.gl6 infected by "Trojan.JS.StartPage.u" Virus. Action Taken: No Action Taken.

Thu Nov 04 15:18:12 2004 => File C:\WINDOWS\System32\zzcrsx.8oe infected by "Trojan.JS.StartPage.u" Virus. Action Taken: No Action Taken.

Thu Nov 04 15:18:13 2004 => File C:\WINDOWS\System32\jlqlaa.s9m infected by "Trojan.JS.StartPage.u" Virus. Action Taken: No Action Taken.

Thu Nov 04 15:18:13 2004 => File C:\WINDOWS\System32\vnwwnf.v44 infected by "Trojan.JS.StartPage.u" Virus. Action Taken: No Action Taken.

Thu Nov 04 15:18:13 2004 => File C:\WINDOWS\System32\yzndip.38h infected by "Trojan.JS.StartPage.u" Virus. Action Taken: No Action Taken.

Thu Nov 04 15:18:13 2004 => File C:\WINDOWS\System32\szhjdb.wc1 infected by "Trojan.JS.StartPage.u" Virus. Action Taken: No Action Taken.

Thu Nov 04 15:18:13 2004 => File C:\WINDOWS\System32\jqdqpo.863 infected by "Trojan.JS.StartPage.u" Virus. Action Taken: No Action Taken.

Thu Nov 04 15:18:15 2004 => File C:\WINDOWS\System32\telnet.exe.tmp infected by "Trojan.Win32.StartPage.pc" Virus. Action Taken: No Action Taken.

Thu Nov 04 15:18:29 2004 => File C:\FOUND.000\FILE0298.CHK infected by "Worm.Win32.Padobot.k" Virus. Action Taken: No Action Taken.

Thu Nov 04 15:18:33 2004 => File C:\FOUND.000\FILE0594.CHK infected by "Worm.Win32.Padobot.k" Virus. Action Taken: No Action Taken.

Thu Nov 04 15:18:36 2004 => File C:\FOUND.000\FILE0715.CHK infected by "TrojanDownloader.Win32.IstBar.gen" Virus. Action Taken: No Action Taken.

Thu Nov 04 15:18:36 2004 => File C:\FOUND.000\FILE0717.CHK infected by "TrojanDownloader.Win32.Small.hs" Virus. Action Taken: No Action Taken.


Thu Nov 04 15:18:40 2004 => File C:\FOUND.000\FILE0865.CHK infected by "Backdoor.HacDef.073.b" Virus. Action Taken: No Action Taken

Thu Nov 04 15:18:51 2004 => File C:\Dokumente und Einstellungen\lippo\Lokale Einstellungen\Temp\alchem.cab infected by "TrojanDownloader.Win32.Alchemic" 

Thu Nov 04 15:18:52 2004 => File C:\Dokumente und Einstellungen\lippo\Lokale Einstellungen\Temp\pscanw.exe infected by "TrojanDropper.Win32.PurityScan.d" 

Thu Nov 04 15:18:56 2004 => File C:\Dokumente und Einstellungen\lippo\Lokale Einstellungen\Temporary Internet Files\Content.IE5\SH4PKACT\hta[1].hta infected by "TrojanDropper.VBS.Inor.bv" Virus. Action Taken: No Action Taken.

Thu Nov 04 15:18:56 2004 => File C:\Dokumente und Einstellungen\lippo\Lokale Einstellungen\Temporary Internet Files\Content.IE5\SH4PKACT\0006_regular[1].cab infected by "TrojanDownloader.Win32.IstBar.gen" Virus. Action Taken: No Action Taken.

das ist nur ein teil der gefunden sachen... ich muss jetzt weg, deswegen habe ich keine zeit mehr die anderen alle einzufügen... soll ich die noch nachposten ?? das sind nämlich insgesammt über 100 infizierte dateien !

#33 Hallo@summs

Das ist ganz einfach...lade das eScan-Tool, was auch loescht und scanne im abgesicherten Modus.

#eScan-Trial
http://www.mwti.net/antivirus/escan/escandl_antivirus.asp (15-Tage- trial-Freeversion)
klicke auf: awn2k3e.exe

mfg
Sabina
__________
MfG Sabina

rund um die PC-Sicherheit