Search extender & shopping wizard, kann mir bitte jemad helfen

#16 nun gut ich warte auf die Scanlogs und werde immer warten, bevor ich was schreibe. Ich bearbeite viele Threads pro Tag und da kann es schon mal zu Missverstaendnissen kommen. Entschuldige
__________
MfG Sabina

rund um die PC-Sicherheit

#17 Ok

Hier die Scanlogs:


Virus Scan Report File
Virus Scan Information

McAfee VirusScan for Win32 v4.40.0
Copyright (c) 1992-2004 Networks Associates Technology Inc. All rights reserved.
(408) 988-3832 LICENSED COPY - Sep 23 2004

Scan engine v4.4.00 for Win32.
Virus data file v4679 created Jan 20 2006
Scanning for 172110 viruses, trojans and variants.

Virus Scan Results



01/22/2006 11:41:01


Options:
/ADL /UNZIP /WINMEM /SUB /ANALYZE /PANALYZE /STREAMS /CLEAN /ALL /DEL /MIME /PROGRAM /EXCLUDE C:\AV-CLS\EXCLIST.TXT /HTML "C:\AV-CLS\MCAFEE\SCANREPORT.HTML"

Scanning C: [proggys]
Scanning C:\*.*
C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\EA GAMES\Battlefield Vietnam\Spiele BF Vietnam online mit GameSpyArcade!.url ... Found potentially unwanted program Adware-Url.gen.
The file or process has been deleted.
C:\Dokumente und Einstellungen\razor\Favoriten\Going Places\Air Tickets.lnk ... Found potentially unwanted program Adware-ISTbar.lnk.
The file or process has been deleted.
C:\Dokumente und Einstellungen\razor\Favoriten\Going Places\Car Rentals.lnk ... Found potentially unwanted program Adware-ISTbar.lnk.
The file or process has been deleted.
C:\Dokumente und Einstellungen\razor\Favoriten\Going Places\Hotel Deals.lnk ... Found potentially unwanted program Adware-ISTbar.lnk.
The file or process has been deleted.
C:\Dokumente und Einstellungen\razor\Favoriten\Going Places\Luggage.lnk ... Found potentially unwanted program Adware-ISTbar.lnk.
The file or process has been deleted.
C:\Dokumente und Einstellungen\razor\Favoriten\Shop\Auctions.lnk ... Found potentially unwanted program Adware-ISTbar.lnk.
The file or process has been deleted.
C:\Dokumente und Einstellungen\razor\Favoriten\Shop\Books.lnk ... Found potentially unwanted program Adware-ISTbar.lnk.
The file or process has been deleted.
C:\Dokumente und Einstellungen\razor\Favoriten\Shop\Computers.lnk ... Found potentially unwanted program Adware-ISTbar.lnk.
The file or process has been deleted.
C:\Dokumente und Einstellungen\razor\Favoriten\Shop\Discount.lnk ... Found potentially unwanted program Adware-ISTbar.lnk.
The file or process has been deleted.
C:\Dokumente und Einstellungen\razor\Favoriten\Shop\Flowers.lnk ... Found potentially unwanted program Adware-ISTbar.lnk.
The file or process has been deleted.
C:\Dokumente und Einstellungen\razor\Favoriten\Shop\Golf.lnk ... Found potentially unwanted program Adware-ISTbar.lnk.
The file or process has been deleted.
C:\Dokumente und Einstellungen\razor\Favoriten\Shop\Jewelry.lnk ... Found potentially unwanted program Adware-ISTbar.lnk.
The file or process has been deleted.
C:\Dokumente und Einstellungen\razor\Favoriten\Shop\Movies.lnk ... Found potentially unwanted program Adware-ISTbar.lnk.
The file or process has been deleted.
C:\Dokumente und Einstellungen\razor\Favoriten\Shop\Music.lnk ... Found potentially unwanted program Adware-ISTbar.lnk.
The file or process has been deleted.
C:\Dokumente und Einstellungen\razor\Favoriten\Shop\Online Store.lnk ... Found potentially unwanted program Adware-ISTbar.lnk.
The file or process has been deleted.
C:\Dokumente und Einstellungen\razor\Favoriten\Shop\Perfume.lnk ... Found potentially unwanted program Adware-ISTbar.lnk.
The file or process has been deleted.
C:\Dokumente und Einstellungen\razor\Favoriten\Shop\Sleepwear.lnk ... Found potentially unwanted program Adware-ISTbar.lnk.
The file or process has been deleted.
C:\Dokumente und Einstellungen\razor\Favoriten\Sites about\Ab scissor.url ... Found potentially unwanted program Adware-Url.gen.
The file or process has been deleted.
C:\Dokumente und Einstellungen\razor\Favoriten\Sites about\Broadband comparison.url ... Found potentially unwanted program Adware-Url.gen.
The file or process has been deleted.
C:\Dokumente und Einstellungen\razor\Favoriten\Sites about\Credit counseling.url ... Found potentially unwanted program Adware-Url.gen.
The file or process has been deleted.
C:\Dokumente und Einstellungen\razor\Favoriten\Sites about\Credit report.url ... Found potentially unwanted program Adware-Url.gen.
The file or process has been deleted.
C:\Dokumente und Einstellungen\razor\Favoriten\Sites about\Crm software.url ... Found potentially unwanted program Adware-Url.gen.
The file or process has been deleted.
C:\Dokumente und Einstellungen\razor\Favoriten\Sites about\Debt credit card.url ... Found potentially unwanted program Adware-Url.gen.
The file or process has been deleted.
C:\Dokumente und Einstellungen\razor\Favoriten\Sites about\Escorts.url ... Found potentially unwanted program Adware-Url.gen.
The file or process has been deleted.
C:\Dokumente und Einstellungen\razor\Favoriten\Sites about\Fha.url ... Found potentially unwanted program Adware-Url.gen.
The file or process has been deleted.
C:\Dokumente und Einstellungen\razor\Favoriten\Sites about\Health insurance.url ... Found potentially unwanted program Adware-Url.gen.
The file or process has been deleted.
C:\Dokumente und Einstellungen\razor\Favoriten\Sites about\Help desk software.url ... Found potentially unwanted program Adware-Url.gen.
The file or process has been deleted.
C:\Dokumente und Einstellungen\razor\Favoriten\Sites about\Insurance home.url ... Found potentially unwanted program Adware-Url.gen.
The file or process has been deleted.
C:\Dokumente und Einstellungen\razor\Favoriten\Sites about\Loan for debt consolidation.url ... Found potentially unwanted program Adware-Url.gen.
The file or process has been deleted.
C:\Dokumente und Einstellungen\razor\Favoriten\Sites about\Loan for people with bad credit.url ... Found potentially unwanted program Adware-Url.gen.
The file or process has been deleted.
C:\Dokumente und Einstellungen\razor\Favoriten\Sites about\Marketing email.url ... Found potentially unwanted program Adware-Url.gen.
The file or process has been deleted.
C:\Dokumente und Einstellungen\razor\Favoriten\Sites about\Mortgage insurance.url ... Found potentially unwanted program Adware-Url.gen.
The file or process has been deleted.
C:\Dokumente und Einstellungen\razor\Favoriten\Sites about\Mortgage life insurance.url ... Found potentially unwanted program Adware-Url.gen.
The file or process has been deleted.
C:\Dokumente und Einstellungen\razor\Favoriten\Sites about\Nevada corporations.url ... Found potentially unwanted program Adware-Url.gen.
The file or process has been deleted.
C:\Dokumente und Einstellungen\razor\Favoriten\Sites about\Online Betting Site.url ... Found potentially unwanted program Adware-Url.gen.
The file or process has been deleted.
C:\Dokumente und Einstellungen\razor\Favoriten\Sites about\Online gambling casino.url ... Found potentially unwanted program Adware-Url.gen.
The file or process has been deleted.
C:\Dokumente und Einstellungen\razor\Favoriten\Sites about\Online instant loan.url ... Found potentially unwanted program Adware-Url.gen.
The file or process has been deleted.
C:\Dokumente und Einstellungen\razor\Favoriten\Sites about\Order phentermine.url ... Found potentially unwanted program Adware-Url.gen.
The file or process has been deleted.
C:\Dokumente und Einstellungen\razor\Favoriten\Sites about\Payroll advance.url ... Found potentially unwanted program Adware-Url.gen.
The file or process has been deleted.
C:\Dokumente und Einstellungen\razor\Favoriten\Sites about\Personal loans online.url ... Found potentially unwanted program Adware-Url.gen.
The file or process has been deleted.
C:\Dokumente und Einstellungen\razor\Favoriten\Sites about\Personal loans with bad credit.url ... Found potentially unwanted program Adware-Url.gen.
The file or process has been deleted.
C:\Dokumente und Einstellungen\razor\Favoriten\Sites about\Prescription Drugs Rx Online.url ... Found potentially unwanted program Adware-Url.gen.
The file or process has been deleted.
C:\Dokumente und Einstellungen\razor\Favoriten\Sites about\Refinancing my mortgage.url ... Found potentially unwanted program Adware-Url.gen.
The file or process has been deleted.
C:\Dokumente und Einstellungen\razor\Favoriten\Sites about\Tahoe vacation rental.url ... Found potentially unwanted program Adware-Url.gen.
The file or process has been deleted.
C:\Dokumente und Einstellungen\razor\Favoriten\Sites about\Unsecured bad credit loans.url ... Found potentially unwanted program Adware-Url.gen.
The file or process has been deleted.
C:\Dokumente und Einstellungen\razor\Favoriten\Sites about\Videos.url ... Found potentially unwanted program Adware-Url.gen.
The file or process has been deleted.
C:\Dokumente und Einstellungen\razor\Favoriten\Sites about\What is hydrocodone.url ... Found potentially unwanted program Adware-Url.gen.
The file or process has been deleted.
C:\Dokumente und Einstellungen\razor\Favoriten\Technology\Adware Remover.lnk ... Found potentially unwanted program Adware-ISTbar.lnk.
The file or process has been deleted.
C:\Dokumente und Einstellungen\razor\Favoriten\Technology\Anti-Virus.lnk ... Found potentially unwanted program Adware-ISTbar.lnk.
The file or process has been deleted.
C:\Dokumente und Einstellungen\razor\Favoriten\Technology\PC Cleaner.lnk ... Found potentially unwanted program Adware-ISTbar.lnk.
The file or process has been deleted.
C:\Dokumente und Einstellungen\razor\Favoriten\Technology\Tech & gadgets.lnk ... Found potentially unwanted program Adware-ISTbar.lnk.
The file or process has been deleted.

C:\WINDOWS\ipuy.exe ... Found trojan or variant New Malware.q !!!
Please send a copy of the file to McAfee
The file or process has been deleted.
C:\WINDOWS\system32\apitf32.exe ... Found trojan or variant New Malware.q !!!
Please send a copy of the file to McAfee
The file or process has been deleted.
C:\WINDOWS\system32\ieyt32.exe ... Found trojan or variant New Malware.q !!!
Please send a copy of the file to McAfee
The file or process has been deleted.
C:\WINDOWS\system32\javaur32.exe ... Found trojan or variant New Malware.q !!!
Please send a copy of the file to McAfee
The file or process has been deleted.
C:\WINDOWS\system32\sdkhd.exe ... Found trojan or variant New Malware.q !!!
Please send a copy of the file to McAfee
The file or process has been deleted.

Summary report on C:\*.*
File(s)
Total files: ........... 150001
Clean: ................. 149466
Possibly Infected: ..... 5
Cleaned: ............... 0
Deleted: ............... 56
Non-critical Error(s): 2
Master Boot Record(s): ......... 2
Possibly Infected: ..... 0
Boot Sector(s): ................ 1
Possibly Infected: ..... 0
Scanning D: []
Scanning D:\*.*
D:\Programme\Hijackthis\backups\backup-20060117-220141-433.dll ... Found the AdClicker-AJ.gen trojan !!!
The file or process has been deleted.
D:\Programme\Hijackthis\backups\backup-20060117-220901-793.dll ... Found the AdClicker-AJ.gen trojan !!!
The file or process has been deleted.
D:\Programme\Hijackthis\backups\backup-20060117-220902-910.dll ... Found the AdClicker-AJ.gen trojan !!!
The file or process has been deleted.
D:\Programme\Hijackthis\backups\backup-20060117-221654-665.dll ... Found the AdClicker-AJ.gen trojan !!!
The file or process has been deleted.
D:\Programme\Hijackthis\backups\backup-20060119-231547-255.dll ... Found the AdClicker-AJ.gen trojan !!!
The file or process has been deleted.
D:\Programme\Hijackthis\backups\backup-20060119-231547-710.dll ... Found the AdClicker-AJ.gen trojan !!!
The file or process has been deleted.
D:\Razor\Andere\desktoptoys an Zocker\d013.exe ... Found potentially unwanted program Joke-Buttons.
The file or process has been deleted.
D:\Razor\Andere\desktoptoys an Zocker\DESKTOP.EXE ... Found potentially unwanted program Joke-StressRelief.
The file or process has been deleted.
D:\Razor\Andere\desktoptoys an Zocker\Elchtest.exe ... Found potentially unwanted program Joke-Flipped.
The file or process has been deleted.
D:\Razor\Andere\desktoptoys an Zocker\FELIX2.EXE ... Found potentially unwanted program Joke-ScreenMates.
The file or process has been deleted.
D:\Razor\Andere\desktoptoys an Zocker\gruess_gott.exe ... Found potentially unwanted program Joke-Buttons.b.
The file or process has been deleted.
D:\Razor\Andere\desktoptoys an Zocker\maus.exe ... Found potentially unwanted program Joke-MouseShoot.
The file or process has been deleted.
D:\Razor\Andere\desktoptoys an Zocker\shake.exe ... Found potentially unwanted program Joke-CrazyMouse.
The file or process has been deleted.

Summary report on D:\*.*
File(s)
Total files: ........... 37017
Clean: ................. 37011
Possibly Infected: ..... 6
Cleaned: ............... 0
Deleted: ............... 13
Master Boot Record(s): ......... 2
Possibly Infected: ..... 0
Boot Sector(s): ................ 1
Possibly Infected: ..... 0
Scanning H: [Games]
Scanning H:\*.*
H:\GAMES\SuddenStrike\www.gamespyarcade.com.url ... Found potentially unwanted program Adware-Url.gen.
The file or process has been deleted.

Summary report on H:\*.*
File(s)
Total files: ........... 201563
Clean: ................. 200631
Possibly Infected: ..... 0
Cleaned: ............... 0
Deleted: ............... 1
Non-critical Error(s): 3
Master Boot Record(s): ......... 2
Possibly Infected: ..... 0
Boot Sector(s): ................ 1
Possibly Infected: ..... 0
Scanning I: [MP3s]
Scanning I:\*.*

Summary report on I:\*.*
File(s)
Total files: ........... 6535
Clean: ................. 6534
Possibly Infected: ..... 0
Cleaned: ............... 0
Non-critical Error(s): 1
Master Boot Record(s): ......... 2
Possibly Infected: ..... 0
Boot Sector(s): ................ 1
Possibly Infected: ..... 0


Time: 02:41.36


Visit the McAfee Online Web Site
Need some help or advice? Send email to Technical Support.


-------------------------------------------------------------------------------
KASPERSKY ON-LINE SCANNER REPORT
Monday, January 23, 2006 01:07:03
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky On-line Scanner version: 5.0.67.0
Kaspersky Anti-Virus database last update: 22/01/2006
Kaspersky Anti-Virus database records: 161988
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: standard
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\
F:\
G:\
H:\
I:\

Scan Statistics:
Total number of scanned objects: 165368
Number of viruses found: 1
Number of infected objects: 3
Number of suspicious objects: 0
Duration of the scan process: 5806 sec

Infected Object Name - Virus Name
C:\Programme\Password-Finder\PWFinder.dll Infected: Trojan-Spy.Win32.Qeds.c
D:\Razor\Progys\password.exe/data0001 Infected: Trojan-Spy.Win32.Qeds.c
D:\Razor\Progys\password.exe Infected: Trojan-Spy.Win32.Qeds.c

Scan process completed.

#18 loesche, falls es noch da ist, mit der killbox:

C:\Programme\Password-Finder\PWFinder.dll
C:\Programme\Password-Finder
D:\Razor\Progys\password.exe/data0001
D:\Razor\Progys\password.exe

scanne noch einmal mit Kaspersky und kopiere den scanreport
http://virus-protect.org/onlinescan.html

ich will sehen, ob die Streams geloescht sind.....

Zitat

C:\WINDOWS\CoD.INI:thndip:$DATA Infected: Trojan.Win32.Agent.bi
C:\WINDOWS\KB890046.log:nklcc:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\KB890175.log:olfxhh:$DATA Infected: Trojan.Win32.Agent.bi
C:\WINDOWS\KB905749.log:uzfpkk:$DATA Infected: Trojan-Downloader.Win32.Agent.bc
C:\WINDOWS\NewRecorder.reg:zkwgq:$DATA Infected: Trojan-Downloader.Win32.Agent.bc

__________
MfG Sabina

rund um die PC-Sicherheit

#19 C:\Programme\Password-Finder lies sich nicht löschen.

Kaspersky (dritter Versuch):


-------------------------------------------------------------------------------
KASPERSKY ON-LINE SCANNER REPORT
Monday, January 23, 2006 22:56:05
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky On-line Scanner version: 5.0.67.0
Kaspersky Anti-Virus database last update: 23/01/2006
Kaspersky Anti-Virus database records: 162156
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: standard
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\
F:\
G:\
H:\
I:\

Scan Statistics:
Total number of scanned objects: 165509
Number of viruses found: 1
Number of infected objects: 3
Number of suspicious objects: 0
Duration of the scan process: 8233 sec

Infected Object Name - Virus Name
C:\!Submit\password.exe/data0001 Infected: Trojan-Spy.Win32.Qeds.c
C:\!Submit\password.exe Infected: Trojan-Spy.Win32.Qeds.c
C:\!Submit\PWFinder.dll Infected: Trojan-Spy.Win32.Qeds.c

Scan process completed.

#20 razor_89

C:\!Submit\ <--loeschen

dann sollte wieder alles in Ordnung sein
__________
MfG Sabina

rund um die PC-Sicherheit

#21 Ordner !submit und C:\Programme\Password-Finder manuel gelöscht.
Danke dir vielmals!!!

MfG Kai