Wir Lösche ich Worm Alcra.B?

#76 caezano

1.
Einzelne Dateien scannen
Oben auf der Seite --> auf Durchsuchen klicken --> Datei aussuchen --> Doppelklick auf die zu prüfende Datei --> klick auf Submit... jetzt abwarten
http://www.virustotal.com/flash/index_en.html

C:\WINDOWS\System32\nulware.exe
C:\Program Files\Common Files\Mdn2.exe

--------------------------------------------------------------------

2.
C:\StubInstaller.exe --> loeschen

3.
scanne mit Ewido und poste den scanreport
http://virus-protect.org/ewido.html
__________
MfG Sabina

rund um die PC-Sicherheit

#77 hier der scanreport von Ewido :

+ Erstellt am: 16:16:06, 02.03.2006
+ Report-Checksumme: 9F538501

+ Scanergebnis:

HKLM\SOFTWARE\Classes\MediaAccX.Installer -> Adware.WinAd : Gesäubert mit Backup
HKLM\SOFTWARE\Classes\MediaAccX.Installer\CLSID -> Adware.WinAd : Gesäubert mit Backup
:mozilla.9:C:\Dokumente und Einstellungen\Adil\Anwendungsdaten\Mozilla\Firefox\Profiles\ogog35j4.default\cookies.txt -> TrackingCookie.Ivwbox : Gesäubert mit Backup

:mozilla.395:C:\Dokumente und Einstellungen\Adil\Anwendungsdaten\Mozilla\Firefox\Profiles\ogog35j4.default\cookies.txt -> TrackingCookie.Hitbox : Gesäubert mit Backup
:mozilla.399:C:\Dokumente und Einstellungen\Adil\Anwendungsdaten\Mozilla\Firefox\Profiles\ogog35j4.default\cookies.txt -> TrackingCookie.Adtech : Gesäubert mit Backup
:mozilla.407:C:\Dokumente und Einstellungen\Adil\Anwendungsdaten\Mozilla\Firefox\Profiles\ogog35j4.default\cookies.txt -> TrackingCookie.Addcontrol : Gesäubert mit Backup
C:\Dokumente und Einstellungen\Adil\Cookies\adil@2o7[1].txt -> TrackingCookie.2o7 : Gesäubert mit Backup
C:\Dokumente und Einstellungen\Adil\Cookies\adil@ivwbox[2].txt -> TrackingCookie.Ivwbox : Gesäubert mit Backup
C:\Dokumente und Einstellungen\Adil\Startmenü\Programme\WhenU -> Adware.SaveNow : Gesäubert mit Backup
C:\Dokumente und Einstellungen\Adil\Startmenü\Programme\WhenU\Uninstall.lnk -> Adware.SaveNow : Gesäubert mit Backup
C:\WINDOWS\Downloaded Program Files\MediaAccX.dll -> Adware.WinAD : Gesäubert mit Backup


::Report Ende

#78 caezano

Zitat

Einzelne Dateien scannen
Oben auf der Seite --> auf Durchsuchen klicken --> Datei aussuchen --> Doppelklick auf die zu prüfende Datei --> klick auf Submit... jetzt abwarten-->poste es hier
http://www.virustotal.com/flash/index_en.html

C:\WINDOWS\System32\nulware.exe
C:\Program Files\Common Files\Mdn2.exe

__________
MfG Sabina

rund um die PC-Sicherheit

#79 Hallo habe mir auch den Wurm ( ) eingefangen ... Hier der HijackThis Report :
Wie soll ich nun weiter vorgehen??? Bitte um schnelle Hilfe danke schonmal


Logfile of HijackThis v1.99.1
Scan saved at 01:01:19, on 23.04.2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\spoolsv.exe
C:\RECYCLER\services.exe
C:\Programme\Gemeinsame Dateien\Logitech\QCDriver2\LVCOMS.EXE
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
D:\Programme\AntiVir\AVWUPSRV.EXE
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Programme\LevelOne\Surveillance System\Launcher_LO.exe
C:\Programme\VeriSign\NAVI\naviagent.exe
D:\Programme\Radmin\r_server.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\LevelOne\Surveillance System\Monitor_LO.exe
C:\WINDOWS\System32\wuauclt.exe
D:\Programme\ICQLite\ICQLite.exe
D:\Programme\Winamp\Winamp.exe
D:\Programme\teamspeak2_RC2\TeamSpeak.exe
D:\Programme\Xfire\Xfire.exe
C:\PROGRAMME\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATIPTAXX.EXE
D:\Programme\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe
C:\Programme\Internet Explorer\iexplore.exe
D:\Programme\WinRAR\WinRAR.exe
C:\Programme\Outlook Express\msimn.exe
C:\DOKUME~1\sYlog!c\LOKALE~1\Temp\Rar$EX09.125\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://82.179.166.192/search.php?v=6&aff=1051584
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://82.179.166.192/index.php?v=6&aff=1051584
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *new-search.net*;*x-google.net*
R3 - URLSearchHook: i-Nav IDN SearchHook - {CE000994-A58C-4441-8938-744CD72AB27F} - C:\Programme\VeriSign\i-Nav\i-nav_4_2_1.dll
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
F2 - REG:system.ini: Shell=explorer.exe C:\RECYCLER\services.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Programme\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: i-Nav IDN Resolver - {CE000992-A58C-4441-8938-744CD72AB27F} - C:\Programme\VeriSign\i-Nav\i-nav_4_2_1.dll
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - D:\Programme\FlashFXP\IEFlash.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [QuickTime Task] "D:\Programme\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\\PSDrvCheck.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Programme\Gemeinsame Dateien\Logitech\QCDriver2\LVCOMS.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\RunOnce: [ICQ Lite] D:\Programme\ICQLite\ICQLite.exe -trayboot
O4 - Global Startup: Microsoft Office.lnk = D:\Programme\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Hilfe zu i-Nav - {CE000992-A58C-4441-8938-744CD72AB27F} - http://idn.verisign-grs.com/plug-in/support/index.jsp (file missing)
O9 - Extra 'Tools' menuitem: Hilfe zu i-Nav - {CE000992-A58C-4441-8938-744CD72AB27F} - http://idn.verisign-grs.com/plug-in/support/index.jsp (file missing)
O9 - Extra button: (no name) - {CE000996-A58C-4441-8938-744CD72AB27F} - C:\Programme\VeriSign\i-Nav\i-nav_4_2_1.dll
O9 - Extra 'Tools' menuitem: Optionen für i-Nav - {CE000996-A58C-4441-8938-744CD72AB27F} - C:\Programme\VeriSign\i-Nav\i-nav_4_2_1.dll
O10 - Broken Internet access because of LSP provider 'xfire_lsp_9717.dll' missing
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by15fd.bay15.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {F919FBD3-A96B-4679-AF26-F551439BB5FD} - http://locator1.cdn.imagesrvr.com/sites/winfixer.com/www/pages/scanner_de/WinFixer2005ScannerInstallDE.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: csrs - csrs.dll (file missing)
O23 - Service: Adobe LM Service - Unknown owner - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - D:\PROGRAMME\ANTIVIR\AVGUARD.EXE
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - D:\Programme\AntiVir\AVWUPSRV.EXE
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Level One Surveillance System Launcher (LevelOne_ST3402) - Level One - C:\Programme\LevelOne\Surveillance System\Launcher_LO.exe
O23 - Service: VeriSign Updater (navi) - VeriSign, Inc. - C:\Programme\VeriSign\NAVI\naviagent.exe
O23 - Service: Remote Administrator Service (r_server) - Unknown owner - D:\Programme\Radmin\r_server.exe" /service (file missing)
O23 - Service: StyleXPService - Unknown owner - C:\Programme\TGTSoft\StyleXP\StyleXPService.exe

MfG,

#80 Dexion

stelle den CleanUp genauso ein, wie hier angegeben:
http://virus-protect.org/cleanup.html

Kopiere diese 4 Textdateien ab . (rechtsklick mit der Maus -> den Text markieren -> kopieren -> einfügen) Sie sind nach Datum geordnet. (kopiere nur die letzten 3 Monate ab)
http://virus-protect.org/datfindbat.html

echo.zip
entpacken--> klicke echo.bat --> der Texteditor wird sich öffnen--> Text abkopieren http://virus-protect.org/bat/echo.zip
__________
MfG Sabina

rund um die PC-Sicherheit

#81 ich habe auch den wurm so sieht es bei mir aus wer kann mir helfen wie sieht es aus???

Logfile of HijackThis v1.99.1
Scan saved at 23:48:37, on 24.04.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
D:\Programme\FRITZ!DSL\IGDCTRL.EXE
C:\WINDOWS\system32\svchost.exe
D:\Programme\Wireless LAN Utility\tiwlnsvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\ATI Technologies\ATI.ACE\cli.exe
C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe
C:\Programme\D-Link\Air USB Utility\AirCFG.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
D:\Programme\Wireless LAN Utility\TIWLANCu.exe
D:\PROGRA~1\WALLPA~1\WallpaperJugglerM.exe
D:\Programme\ICQLite\ICQLite.exe
C:\Programme\ATI Technologies\ATI.ACE\cli.exe
C:\Programme\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
D:\Dokumente und Einstellungen\Sebastian.SN112049980318.001\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://google.icq.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.google.de/
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - D:\Programme\ICQToolbar\toolbaru.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programme\MSN Toolbar\01.01.2607.0\de\msntb.dll (file missing)
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - D:\Programme\ICQToolbar\toolbaru.dll
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ATICCC] "c:\Programme\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [D-Link Air USB Utility] C:\Programme\D-Link\Air USB Utility\AirCFG.exe
O4 - HKLM\..\Run: [BearShare] "C:\Programme\BearShare\BearShare.exe" /pause
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\Run: [TI WLAN] D:\Programme\Wireless LAN Utility\TIWLANCu.exe
O4 - HKLM\..\Run: [Wallpaper Juggler Monitor] "D:\PROGRA~1\WALLPA~1\WallpaperJugglerM.exe"
O4 - HKLM\..\Run: [ICQ Lite] D:\Programme\ICQLite\ICQLite.exe -minimize
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKCU\..\Run: [ActiveMultiwallpaper] D:\Programme\ActiveMultiwallpaper\Changer.exe
O4 - HKCU\..\RunOnce: [ICQ Lite] D:\Programme\ICQLite\ICQLite.exe -trayboot
O4 - Global Startup: Microsoft Office.lnk = D:\Programme\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &ICQ Toolbar Search - res://D:\Programme\ICQToolbar\toolbaru.dll/SEARCH.HTML
O8 - Extra context menu item: Download with NetPumper - C:\Programme\NetPumper\AddUrl.htm
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://D:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Programme\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1145914374421
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab

O16 - DPF: {DECEAAA2-370A-49BB-9362-68C3A58DDC62} - http://static.zangocash.com/cab/Seekmo/ie/bridge-c24.cab?9d450ca2261f89af789aab38d
b4e10ddeb3bb451f7c233931d34f2380afe5a2a2bafdc292518e8ae6fc9e4ab0d46
a6b080c1929fd407547f1cd9e9e415
3daec7937382cda8:d075e8ea8f5d0dcdea43fc78836d4b32

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - AVIRA GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVM IGD CTRL Service - AVM Berlin - D:\Programme\FRITZ!DSL\IGDCTRL.EXE
O23 - Service: AVM FRITZ!web Routing Service (de_serv) - AVM Berlin - C:\Programme\Gemeinsame Dateien\AVM\de_serv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: TI Wlan Service (tiwlnsvc) - Unknown owner - D:\Programme\Wireless LAN Utility\tiwlnsvc.exe

#82 Kerberloni

1.
stelle den CleanUp genauso ein, wie hier angegeben:
http://virus-protect.org/cleanup.html

2.
Kopiere diese 4 Textdateien ab . (rechtsklick mit der Maus -> den Text markieren -> kopieren -> einfügen) Sie sind nach Datum geordnet. (kopiere nur die letzten 3 Monate ab)
http://virus-protect.org/datfindbat.html

3.
echo.zip
entpacken--> klicke echo.bat --> der Texteditor wird sich öffnen--> Text abkopieren http://virus-protect.org/bat/echo.zip
__________
__________
MfG Sabina

rund um die PC-Sicherheit

#83 Hey,

Verzeichnis von C:\WINDOWS\system32

26.04.2006 14:06 13.646 wpa.dbl
26.04.2006 00:13 384 DVCState-{00000001-00000000-00000007-00001102-00000004-20021102}.dat
26.04.2006 00:13 1.080 settingsbkup.sfm
26.04.2006 00:13 1.080 settings.sfm
26.04.2006 00:13 384 DVCStateBkp-{00000001-00000000-00000007-00001102-00000004-20021102}.dat
26.04.2006 00:13 33.232 BMXState-{00000001-00000000-00000007-00001102-00000004-20021102}.rfx
26.04.2006 00:13 32.448 BMXBkpCtrlState-{00000001-00000000-00000007-00001102-00000004-20021102}.rfx
26.04.2006 00:13 32.448 BMXCtrlState-{00000001-00000000-00000007-00001102-00000004-20021102}.rfx
26.04.2006 00:13 33.232 BMXStateBkp-{00000001-00000000-00000007-00001102-00000004-20021102}.rfx
23.04.2006 13:23 173.568 schedsvc.dll
23.04.2006 13:23 265.216 mstask.dll
23.04.2006 13:23 306.688 netapi32.dll
23.04.2006 13:23 10.752 mstinit.exe
13.04.2006 17:29 176.167 rmoc3260.dll
13.04.2006 17:29 5.632 pndx5032.dll
13.04.2006 17:29 6.656 pndx5016.dll
13.04.2006 17:29 278.528 pncrt.dll
08.04.2006 12:31 113.318 srsc.dat
07.04.2006 18:43 8 srsc.le
06.04.2006 21:48 5.143.456 MRT.exe
27.03.2006 08:10 39.992 perfc009.dat
27.03.2006 08:10 311.604 perfh009.dat
27.03.2006 08:10 316.594 perfh007.dat
27.03.2006 08:10 48.156 perfc007.dat
27.03.2006 08:10 723.744 PerfStringBackup.INI
22.03.2006 17:46 2.702.336 MSHTML.DLL
22.03.2006 03:29 612.352 xpsp2res.dll
21.03.2006 15:36 1.339.392 SHDOCVW.DLL
17.03.2006 07:03 8.392.192 shell32.dll
17.03.2006 02:49 25.600 verclsid.exe
11.03.2006 02:35 29.696 hp951E.tmp
11.03.2006 02:33 27.661 ldD52E.tmp
03.03.2006 15:46 462.848 URLMON.DLL
03.03.2006 15:46 498.176 MSTIME.DLL
27.02.2006 14:25 50.688 INETRES.DLL
27.02.2006 14:25 229.376 MSOEACCT.DLL
27.02.2006 14:25 44.032 MSIDENT.DLL
27.02.2006 13:31 596.480 INETCOMM.DLL
27.02.2006 13:31 91.136 MSOERT2.DLL
24.02.2006 15:20 582.144 WININET.DLL
24.02.2006 15:20 236.032 IEPEERS.DLL
24.02.2006 14:24 192.512 DXTRANS.DLL
04.01.2006 05:37 64.000 webclnt.dll
03.01.2006 00:38 260.608 gdi32.dll

Verzeichnis von Temp :

26.04.2006 16:25 978 TmpICQMagic_{05736BBE-C20F-4F10-A6DE-4DB1E3564B0E}3127.html
26.04.2006 16:13 983 TmpICQMagic_{EC202595-1DFD-4301-A1EA-13C1E331B505}27673.html
26.04.2006 16:03 16.384 ~DF7425.tmp
26.04.2006 16:03 16.384 ~DF69DE.tmp
26.04.2006 16:03 512 ~DF69E9.tmp
26.04.2006 00:01 5.743 ICQ6E.tmp
26.04.2006 00:01 17.601 ICQ6F.tmp

edit (Sabina)

Verzeichnis von C:Windows

26.04.2006 14:23 155 winamp.ini
26.04.2006 14:14 1.254.382 WindowsUpdate.log
26.04.2006 14:06 0 0.log
26.04.2006 14:06 159 wiadebug.log
26.04.2006 14:06 50 wiaservc.log
26.04.2006 14:06 2.048 bootstat.dat
26.04.2006 00:13 32.630 SchedLgU.Txt
25.04.2006 18:55 116 NeroDigital.ini
23.04.2006 14:17 41.260 Q817287.log
23.04.2006 14:17 1.337.412 setupapi.log
23.04.2006 14:16 19.680 dahotfix.log
23.04.2006 14:16 13.171 xpsp1hfm.log
23.04.2006 14:16 87.146 iis6.log
23.04.2006 14:16 219.315 tsoc.log
23.04.2006 14:16 1.374 imsins.log
23.04.2006 14:16 129.626 comsetup.log
23.04.2006 14:16 118.146 ntdtcsetup.log
23.04.2006 14:16 21.777 KB840374.log
23.04.2006 14:16 194.355 ocgen.log
23.04.2006 14:16 19.975 ocmsn.log
23.04.2006 14:16 27.680 msgsocm.log
23.04.2006 14:16 556.781 FaxSetup.log
23.04.2006 14:15 1.374 imsins.BAK
23.04.2006 14:15 40.018 KB823182.log
23.04.2006 14:14 25.608 KB839645.log
23.04.2006 14:14 23.260 Q329834.log
23.04.2006 14:14 39.049 KB823559.log
23.04.2006 14:13 22.744 Q329048.log
23.04.2006 14:13 25.087 KB828035.log
23.04.2006 14:12 26.053 KB840987.log
23.04.2006 14:12 19.948 KB837001.log
23.04.2006 14:11 34.035 Q810833.log
23.04.2006 14:10 20.345 Q828026.log
23.04.2006 14:09 20.458 KB873376.log
23.04.2006 14:08 29.600 Q811630.log
23.04.2006 14:07 29.921 KB824105.log
23.04.2006 14:06 27.088 Q814033.log
23.04.2006 14:06 15.471 KB841533.log
23.04.2006 14:05 25.236 Q810565.log
23.04.2006 14:05 23.042 Q815021.log
23.04.2006 14:04 22.243 Q329441.log
23.04.2006 14:04 21.735 Q817606.log
23.04.2006 14:03 19.188 Q329170.log
23.04.2006 14:03 3.294 Q329115.log
23.04.2006 14:02 2.713 Q329390.log
23.04.2006 14:02 1.750 Q323255.log
23.04.2006 14:02 9.431 KB841873.log
23.04.2006 02:41 24.400 KB908531.log
23.04.2006 02:41 24.454 updspapi.log
23.04.2006 02:41 22.835 KB911562.log
23.04.2006 02:40 11.538 KB912812-IE6SP1-20060322.182418.log
23.04.2006 02:40 10.161 KB911567-OE6SP1-20060316.165634.log
23.04.2006 00:38 195 setupact.log
18.04.2006 20:14 620 win.ini
18.04.2006 14:38 288 muma2003.INI
18.04.2006 14:09 4.934.279 {00000001-00000000-00000007-00001102-00000004-20021102}.CDF
09.04.2006 14:25 9.957 svcpack.log
08.04.2006 12:02 464 sampler.INI
08.04.2006 12:02 475 beatbox.INI
16.03.2006 18:48 923 spupdsvc.log
16.03.2006 15:38 13.154 KB911927.log
16.03.2006 15:38 9.580 KB911565.log
16.03.2006 15:38 6.012 KB914798.log
16.03.2006 15:37 9.639 KB911564.log
16.03.2006 15:37 11.992 KB912919.log
16.03.2006 15:37 12.012 KB908519.log
16.03.2006 15:36 8.096 KB913446.log
30.01.2006 16:43 2.560 _MSRSTRT.EXE
28.01.2006 04:31 6.750 mozver.dat
18.01.2006 14:36 10.245 KB910437.log
18.01.2006 14:36 7.096 KB905915-IE6SP1-20051122.175908.log
18.01.2006 14:36 7.574 KB835409.log
15.01.2006 00:31 4.934.061 {00000001-00000000-00000007-00001102-00000004-20021102}.BAK

Verzeichnis von C

26.04.2006 16:31 0 sys.txt
26.04.2006 16:30 13.025 system.txt
26.04.2006 16:29 149.906 systemtemp.txt
26.04.2006 16:26 99.649 system32.txt
26.04.2006 14:06 1.610.612.736 pagefile.sys
21.12.2005 22:47 185.028 Installer.log
21.12.2005 22:45 0 Debug.QC6

So das wars ertmal

#84 Dexion

1. wende den Cleanup an, (siehe oben),dann den PC neustarten
Verzeichnis von Temp : muss leer sein

2.
das fehlt:...also noch posten
echo.zip
entpacken--> klicke echo.bat --> der Texteditor wird sich öffnen--> Text abkopieren http://virus-protect.org/bat/echo.zip
__________
MfG Sabina

rund um die PC-Sicherheit

#85 So habe jez nochmal Clean up gemacht und dann Pc Neu-Gestartet


Temp :

26.04.2006 22:54 54.272 ginstall.dll
26.04.2006 22:46 983 TmpICQMagic_{EC202595-1DFD-4301-A1EA-13C1E331B505}22856.html
26.04.2006 22:45 978 TmpICQMagic_{05736BBE-C20F-4F10-A6DE-4DB1E3564B0E}3519.html
26.04.2006 21:33 16.384 ~DFBEFE.tmp
26.04.2006 21:32 16.384 ~DFAF6A.tmp
26.04.2006 00:01 17.601 ICQ6F.tmp
26.04.2006 00:01 5.743 ICQ6E.tmp

edit Sabina


Soo

#86 Dexion

du hast die temporaeren Dateien nicht geloescht... es ist alles wie vorher...

**
Einzelne Dateien scannen
Oben auf der Seite --> auf Durchsuchen klicken (oder gleich reinkopieren...) --> Datei aussuchen --> Doppelklick auf die zu prüfende Datei --> klick auf Submit... jetzt abwarten
http://www.virustotal.com/flash/index_en.html

C:\RECYCLER\services.exe

kopiere den Report ab.


**
öffne das HijackThis -- Button "scan" -- vor die Malware-Einträge Häkchen setzen -- Button "Fix checked" -- PC neustarten

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://82.179.166.192/search.php?v=6&aff=1051584
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://82.179.166.192/index.php?v=6&aff=1051584

R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
F2 - REG:system.ini: Shell=explorer.exe C:\RECYCLER\services.exe

O16 - DPF: {F919FBD3-A96B-4679-AF26-F551439BB5FD} - http://locator1.cdn.imagesrvr.com/sites/winfixer.com/www/pages/scanner_de/WinFixer2005ScannerInstallDE.cab
O20 - Winlogon Notify: csrs - csrs.dll (file missing)

PC neustarten

**
KILLBOX - Pocket KillBox
http://virus-protect.org/killbox.html

Options: Delete on Reboot --> anhaken
und klicke auf das rote Kreuz, wenn gefragt wird, ob "Do you want to reboot? "---- klicke auf "yes"
reinkopieren: ...

C:\RECYCLER\services.exe

PC neustarten

**
Datenträgerbereinigung: und Löschen der Temporary-Dateien
<Start<Ausfuehren--> reinschreiben : cleanmgr
loesche nur:
#Click:Temporäre Internet Files/Temporäre Internet Dateien, o.k.
#Click:Temporäre Dateien, o.k

**
scanne mit ewido und poste den scanreport
http://virus-protect.org/ewido.html
__________
MfG Sabina

rund um die PC-Sicherheit

#87 So hier die ganzen Scans :

STATUS: FINISHEDComplete scanning result of "ginstall.dll", received in VirusTotal at 04.27.2006, 00:31:22 (CET).

Antivirus Version Update Result
AntiVir 6.34.0.24 04.20.2006 no virus found
Avast 4.6.695.0 04.26.2006 no virus found
AVG 386 04.26.2006 no virus found
Avira 6.34.1.58 04.26.2006 no virus found
BitDefender 7.2 04.26.2006 no virus found
CAT-QuickHeal 8.00 04.26.2006 no virus found
ClamAV devel-20060202 04.26.2006 no virus found
DrWeb 4.33 04.26.2006 no virus found
eTrust-InoculateIT 23.71.140 04.27.2006 no virus found
eTrust-Vet 12.4.2179 04.26.2006 no virus found
Ewido 3.5 04.26.2006 no virus found
Fortinet 2.71.0.0 04.26.2006 no virus found
F-Prot 3.16c 04.26.2006 no virus found
Ikarus 0.2.59.0 04.26.2006 no virus found
Kaspersky 4.0.2.24 04.26.2006 no virus found
McAfee 4749 04.26.2006 no virus found
NOD32v2 1.1508 04.26.2006 no virus found
Norman 5.90.17 04.26.2006 no virus found
Panda 9.0.0.4 04.26.2006 no virus found
Sophos 4.05.0 04.26.2006 no virus found
Symantec 8.0 04.27.2006 no virus found
TheHacker 5.9.7.135 04.25.2006 no virus found
UNA 1.83 04.26.2006 no virus found
VBA32 3.11.0 04.26.2006 no virus found

edit Sabina


Bei HiJackThis all fixed bis auf
F2 - REG:system.ini: Shell=explorer.exe C:\RECYCLER\services.exe
hat der net gefunden?!?

1.Neustart

Von CounterSpy

Spyware Scan Details
Start Date: 27.04.2006 01:14:15
End Date: 27.04.2006 01:48:53
Total Time: 34 mins 38 secs

Detected spyware

AntiLeech Plugin Adware (General) more information...
Details: Plugin is an Ad-Ware software which enables the broadcasting of advertisements, and execution of e-commerce and other internet related services on the user-interface of the software.
Status: Deleted

Infected files detected
c:\programme\anti-leech\alie_1.0.1.8\al2np.dll
c:\programme\anti-leech\alie_1.0.1.8\alhlp.exe
c:\programme\anti-leech\alie_1.0.1.8\alie.dll
c:\programme\anti-leech\alie_1.0.1.8\alie.inf
c:\programme\anti-leech\alie_1.0.1.8\iesetup2.exe
D:\Programme\Anti-Leech\ALIE_1.0.1.9\al2np.dll
D:\Programme\Anti-Leech\ALIE_1.0.1.9\alhlp.exe
d:\Programme\Anti-Leech\ALIE_1.0.1.9\alie.dll

Infected registry entries detected
HKEY_CLASSES_ROOT\AntiLeech.ALIE.1
HKEY_CLASSES_ROOT\AntiLeech.ALIE.1\CLSID {056738EE-E15C-11D6-B876-0050BF5D85C7}
HKEY_CLASSES_ROOT\AntiLeech.ALIE.1 Anti-Leech Plug-in
HKEY_CLASSES_ROOT\AntiLeech.ALIE
HKEY_CLASSES_ROOT\AntiLeech.ALIE\CLSID {056738EE-E15C-11D6-B876-0050BF5D85C7}
HKEY_CLASSES_ROOT\AntiLeech.ALIE\CurVer AntiLeech.ALIE.1
HKEY_CLASSES_ROOT\AntiLeech.ALIE Anti-Leech Plug-in
HKEY_CLASSES_ROOT\CLSID\{056738EE-E15C-11D6-B876-0050BF5D85C7}
HKEY_CLASSES_ROOT\CLSID\{056738EE-E15C-11D6-B876-0050BF5D85C7}\InprocServer32 D:\PROGRA~1\ANTI-L~1\ALIE_1~1.9\alie.dll
HKEY_CLASSES_ROOT\CLSID\{056738EE-E15C-11D6-B876-0050BF5D85C7}\InprocServer32 ThreadingModel Apartment
HKEY_CLASSES_ROOT\CLSID\{056738EE-E15C-11D6-B876-0050BF5D85C7}\ProgID AntiLeech.ALIE.1
HKEY_CLASSES_ROOT\CLSID\{056738EE-E15C-11D6-B876-0050BF5D85C7}\TypeLib {056738E1-E15C-11D6-B876-0050BF5D85C7}
HKEY_CLASSES_ROOT\CLSID\{056738EE-E15C-11D6-B876-0050BF5D85C7}\VersionIndependentProgID AntiLeech.ALIE
HKEY_CLASSES_ROOT\CLSID\{056738EE-E15C-11D6-B876-0050BF5D85C7} Anti-Leech Plug-in
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Anti-Leech ALIE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Anti-Leech ALIE DisplayName Anti-Leech Plugin for Internet Explorer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Anti-Leech ALIE UninstallString D:\Programme\Anti-Leech\ALIE_1.0.1.9\iesetup2.exe uninstall


DesktopScam Trojan Downloader more information...
Details: DesktopScam is a trojan that is downloaded with rogue security applicatons in order to frighten the affected user into purchasing the rogue program.
Status: Deleted

Infected files detected
c:\windows\system32\1024\ld92ad.tmp


Infected registry entries detected
HKEY_CURRENT_USER\Software\Classes\clsid\{C9FA1DC9-1FB3-C2A8-2F1A-DC1A33E7AF9D}
HKEY_CURRENT_USER\Software\Classes\clsid\{C9FA1DC9-1FB3-C2A8-2F1A-DC1A33E7AF9D}\InProcServer32 C:\WINDOWS\System32\ginuerep.dll
HKEY_CURRENT_USER\Software\Classes\clsid\{C9FA1DC9-1FB3-C2A8-2F1A-DC1A33E7AF9D}\InProcServer32 ThreadingModel Apartment


Radmin22 Commercial Remote Control Tool more information...
Details: This kind of Remote Administration Tool is potentially dangerous and should be remove from your system if you do not know how it was installed.
Status: Deleted

Infected files detected
c:\windows\system32\r_server.exe
c:\windows\system32\raddrv.dll
D:\Programme\Radmin\raddrv.dll

Infected registry entries detected
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters Port
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters Timeout
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters EnableLogFile
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters LogFilePath c:\logfile.txt
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters FilterIp
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters DisableTrayIcon
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters AutoAllow
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters AskUser
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters EnableEventLog
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters NTAuthEnabled
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters Parameter
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters Port
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters Timeout
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters EnableLogFile
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters LogFilePath c:\logfile.txt
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters FilterIp
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters DisableTrayIcon
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters AutoAllow
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters AskUser
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters EnableEventLog
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters NTAuthEnabled
HKEY_LOCAL_MACHINE\SYSTEM\RAdmin\v2.0\Server\Parameters Parameter


BearShare P2P Program more information...
Details: BearShare is a peer-to-peer (P2P) application that allows its users to join together in a network via the Internet and share files from each other's hard drives.
Status: Deleted

Infected files detected
c:\dokumente und einstellungen\\desktop\bearshare.lnk
D:\Programme\BearShare\BSidle.dll
D:\Programme\BearShare\Webstats.exe
D:\Programme\BearShare\Webstats.ini
d:\programme\bearshare\runmsc.dll

Infected registry entries detected
HKEY_CLASSES_ROOT\clsid\{9f95f736-0f62-4214-a4b4-caa6738d4c07}
HKEY_CLASSES_ROOT\clsid\{9f95f736-0f62-4214-a4b4-caa6738d4c07}\InprocServer32 D:\Programme\BearShare\RunMSC.dll
HKEY_CLASSES_ROOT\clsid\{9f95f736-0f62-4214-a4b4-caa6738d4c07}\InprocServer32 ThreadingModel Apartment
HKEY_CLASSES_ROOT\clsid\{9f95f736-0f62-4214-a4b4-caa6738d4c07}\ProgID RunMSC.Loader.1
HKEY_CLASSES_ROOT\clsid\{9f95f736-0f62-4214-a4b4-caa6738d4c07}\TypeLib {905D0DF2-3A0A-4D94-853C-54A12A745905}
HKEY_CLASSES_ROOT\clsid\{9f95f736-0f62-4214-a4b4-caa6738d4c07}\VersionIndependentProgID RunMSC.Loader
HKEY_CLASSES_ROOT\clsid\{9f95f736-0f62-4214-a4b4-caa6738d4c07} Loader Class
HKEY_CLASSES_ROOT\gnufile
HKEY_CLASSES_ROOT\gnufile\shell\open\command "D:\Programme\BearShare\BearShare.exe" "%1"
HKEY_CLASSES_ROOT\gnufile gnutella
HKEY_CLASSES_ROOT\gnufile BrowserFlags 8
HKEY_CLASSES_ROOT\gnufile EditFlags 65536
HKEY_CLASSES_ROOT\typelib\{905d0df2-3a0a-4d94-853c-54a12a745905}
HKEY_CLASSES_ROOT\typelib\{905d0df2-3a0a-4d94-853c-54a12a745905}\1.0\0\win32 D:\Programme\BearShare\RunMSC.dll
HKEY_CLASSES_ROOT\typelib\{905d0df2-3a0a-4d94-853c-54a12a745905}\1.0\FLAGS 0
HKEY_CLASSES_ROOT\typelib\{905d0df2-3a0a-4d94-853c-54a12a745905}\1.0\HELPDIR D:\Programme\BearShare\
HKEY_CLASSES_ROOT\typelib\{905d0df2-3a0a-4d94-853c-54a12a745905}\1.0 RunMSC 1.0 Type Library
HKEY_CURRENT_USER\appevents\eventlabels\bearsharechatnotifymsg
HKEY_CURRENT_USER\appevents\eventlabels\bearsharechatnotifymsg Chat Message Waiting
HKEY_CURRENT_USER\appevents\schemes\apps\bearshare
HKEY_CURRENT_USER\appevents\schemes\apps\bearshare\BearShareChatNotifyMsg\.Current D:\Programme\BearShare\sounds\notify.wav
HKEY_CURRENT_USER\appevents\schemes\apps\bearshare\BearShareChatNotifyMsg
HKEY_CURRENT_USER\appevents\schemes\apps\bearshare BearShare
HKEY_LOCAL_MACHINE\software\bearshare
HKEY_LOCAL_MACHINE\software\bearshare InstallDir D:\Programme\BearShare
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\bearshare
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\bearshare DisplayName BearShare
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\bearshare UninstallString D:\PROGRA~1\BEARSH~1\UNWISE.EXE D:\PROGRA~1\BEARSH~1\INSTALL.LOG
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\bearshare DisplayVersion 5.2.1.4
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\bearshare HelpLink http://bearshare.com/help.htm
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\bearshare Publisher Free Peers, Inc.
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\bearshare URLInfoAbout http://www.freepeers.com
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\bearshare DisplayIcon D:\Programme\BearShare\BearShare.exe,-128
HKEY_USERS\.default\appevents\eventlabels\bearsharechatnotifymsg
HKEY_USERS\.default\appevents\eventlabels\bearsharechatnotifymsg Chat Message Waiting
HKEY_USERS\.default\appevents\schemes\apps\bearshare
HKEY_USERS\.default\appevents\schemes\apps\bearshare\BearShareChatNotifyMsg\.Current D:\Programme\BearShare\sounds\notify.wav
HKEY_USERS\.default\appevents\schemes\apps\bearshare\BearShareChatNotifyMsg
HKEY_USERS\.default\appevents\schemes\apps\bearshare BearShare
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\BearShare
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\BearShare SlowInfoCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\BearShare Changed 0


WhenU.Save Adware (General) more information...
Details: WhenU.SaveNow is an adware application that displays pop-up advertising on the desktop in response to users' web browsing.
Status: Deleted

Infected files detected
C:\Dokumente und Einstellungen\\Lokale Einstellungen\Temp\saveinstwm.exe
D:\Programme\BearShare\RunMSC.dll

Infected registry entries detected
HKEY_CLASSES_ROOT\runmsc.loader.1\clsid
HKEY_CLASSES_ROOT\runmsc.loader.1\clsid {9F95F736-0F62-4214-A4B4-CAA6738D4C07}
HKEY_CLASSES_ROOT\runmsc.loader\clsid
HKEY_CLASSES_ROOT\runmsc.loader\clsid {9F95F736-0F62-4214-A4B4-CAA6738D4C07}
HKEY_CLASSES_ROOT\runmsc.loader\curver
HKEY_CLASSES_ROOT\runmsc.loader\curver RunMSC.Loader.1
HKEY_CLASSES_ROOT\interface\{c285d18d-43a2-4aef-83fb-bf280e660a97}
HKEY_CLASSES_ROOT\interface\{c285d18d-43a2-4aef-83fb-bf280e660a97}\ProxyStubClsid {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{c285d18d-43a2-4aef-83fb-bf280e660a97}\ProxyStubClsid32 {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{c285d18d-43a2-4aef-83fb-bf280e660a97}\TypeLib {905D0DF2-3A0A-4D94-853C-54A12A745905}
HKEY_CLASSES_ROOT\interface\{c285d18d-43a2-4aef-83fb-bf280e660a97}\TypeLib Version 1.0
HKEY_CLASSES_ROOT\interface\{c285d18d-43a2-4aef-83fb-bf280e660a97} ILoader
HKEY_CLASSES_ROOT\clsid\{9f95f736-0f62-4214-a4b4-caa6738d4c07}
HKEY_CLASSES_ROOT\clsid\{9f95f736-0f62-4214-a4b4-caa6738d4c07}\InprocServer32 D:\Programme\BearShare\RunMSC.dll
HKEY_CLASSES_ROOT\clsid\{9f95f736-0f62-4214-a4b4-caa6738d4c07}\InprocServer32 ThreadingModel Apartment
HKEY_CLASSES_ROOT\clsid\{9f95f736-0f62-4214-a4b4-caa6738d4c07}\ProgID RunMSC.Loader.1
HKEY_CLASSES_ROOT\clsid\{9f95f736-0f62-4214-a4b4-caa6738d4c07}\TypeLib {905D0DF2-3A0A-4D94-853C-54A12A745905}
HKEY_CLASSES_ROOT\clsid\{9f95f736-0f62-4214-a4b4-caa6738d4c07}\VersionIndependentProgID RunMSC.Loader
HKEY_CLASSES_ROOT\clsid\{9f95f736-0f62-4214-a4b4-caa6738d4c07} Loader Class


AvenueMedia.InternetOptimizer Browser Plug-in more information...
Details: Internet Optimizer, also known as DyFuCA, is an adware application that hijacks the user's browser error page.
Status: Deleted

Infected registry entries detected
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Internet Optimizer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Internet Optimizer SlowInfoCache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Internet Optimizer Changed 0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\AMeOpt


IST.SideFind Adware (General) more information...
Details: SideFind installs an adware Internet Explorer browser helper object that installs some extra buttons.
Status: Deleted

Infected registry entries detected
HKEY_CURRENT_USER\software\microsoft\internet explorer\extensions\cmdmapping {10e42047-deb9-4535-a118-b3f6ec39b807}


ATDMT.com Cookie (General) more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count
Status: Deleted

Infected cookies detected



DoubleClick Cookie (General) more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count
Status: Deleted

Infected cookies detected



Zedo Cookie (General) more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count
Status: Deleted

Infected cookies detected

#88 Dexion

0.
fixe mit dem HijackThis:

O16 - DPF: {F919FBD3-A96B-4679-AF26-F551439BB5FD} - http://locator1.cdn.imagesrvr.com/sites/winfixer.com/www/pages/scanner_de/WinFixer2005ScannerInstallDE.cab
O20 - Winlogon Notify: csrs - csrs.dll (file missing)
O23 - Service: Remote Administrator Service (r_server) - Unknown owner - D:\Programme\Radmin\r_server.exe" /service (file missing

PC neustarten

1.
SmitRem2.8
http://noahdfear.geekstogo.com/click%20counter/click.php?id=1
Doppelklick: smitRem.exe -> Klicke: Start --> klicke: ok

Starte den PC neu --> in den abgesicherten Modus (Taste F8 drücken, wenn der PC hochfährt)


- * öffne smitRem --> Doppelklick: RunThis.bat warte, bis der Scan beendet ist (der Bildschirm wird blau werden. das ist normal)

wenn ein uninstaller vorhanden ist, den smitRem entfernt, wird der uninstaller gestartet. Klicke einfach den Uninstall button und warte, bis deinstalliert wurde.

----------------------------

2.
scanne mit ewido und poste den scanreport
http://virus-protect.org/ewido.html
__________
MfG Sabina

rund um die PC-Sicherheit

#89 Hallo,

Habe alles gemacht, hier der Report :

---------------------------------------------------------
ewido anti-malware - Scan Report
---------------------------------------------------------

+ Erstellt am: 23:04:22, 27.04.2006
+ Report-Checksumme: 41DA05DC

+ Scanergebnis:

:mozilla.35:C:\Dokumente und Einstellungen\sYlog!c\Anwendungsdaten\Mozilla\Firefox\Profiles\default.9zz\cookies.txt -> TrackingCookie.Onestat : Gesäubert mit Backup
:mozilla.41:C:\Dokumente und Einstellungen\sYlog!c\Anwendungsdaten\Mozilla\Firefox\Profiles\default.9zz\cookies.txt -> TrackingCookie.Adtech : Gesäubert mit Backup
:mozilla.42:C:\Dokumente und Einstellungen\sYlog!c\Anwendungsdaten\Mozilla\Firefox\Profiles\default.9zz\cookies.txt -> TrackingCookie.Adtech : Gesäubert mit Backup
C:\Dokumente und Einstellungen\sYlog!c\Complete\ Coach Carter -ftp fast-.zip/Setup.exe -> Worm.VB.an : Gesäubert mit Backup
C:\Dokumente und Einstellungen\sYlog!c\Complete\ System Shock 2.zip/Setup.exe -> Worm.VB.an : Gesäubert mit Backup
C:\Dokumente und Einstellungen\sYlog!c\Complete\ Tantra Lounge Vol.2

edit Sabina

#90 Dexion

alles wieder in Ordnung ? Was meint dein Virenscanner ?
__________
MfG Sabina

rund um die PC-Sicherheit