Home » Viren, Trojaner & Malware Forum » lpdriver.sys --> lpdriver.sys, Added by the W32/Tilebot-H » Themenansicht
lpdriver.sys --> lpdriver.sys, Added by the W32/Tilebot-H |
||
|---|---|---|
| #0
| ||
|
17.11.2005, 01:37
Ehrenmitglied
 Beiträge: 29434 |
||
 
|
|
|
|
17.11.2005, 01:38
Ehrenmitglied
Themenstarter Beiträge: 29434 |
#2
Zitat die einträge O16 geben mir aber zu denken? ich habe doch eine anti virus software installiert?! __________ MfG Sabina rund um die PC-Sicherheit |
|
|
|
|
|
|
17.11.2005, 01:38
Ehrenmitglied
Themenstarter Beiträge: 29434 |
#3
Zitat unikos __________ MfG Sabina rund um die PC-Sicherheit |
|
|
|
|
|
|
17.11.2005, 01:39
Ehrenmitglied
Themenstarter Beiträge: 29434 |
#4
Zitat Volume in Laufwerk C: hat keine Bezeichnung. __________ MfG Sabina rund um die PC-Sicherheit |
|
|
|
|
|
|
17.11.2005, 01:39
Ehrenmitglied
Themenstarter Beiträge: 29434 |
#5
Zitat unikos__________ __________ MfG Sabina rund um die PC-Sicherheit |
|
|
|
|
|
|
17.11.2005, 01:42
Ehrenmitglied
Themenstarter Beiträge: 29434 |
#6
Zitat ich kann nicht mehr über den thread antworten?! wenn ich auf den button drücke, bekomme ich nicht das eingabefeld. __________ MfG Sabina rund um die PC-Sicherheit |
|
|
|
|
|
|
17.11.2005, 01:46
Ehrenmitglied
Themenstarter Beiträge: 29434 |
#7
KILLBOX
http://virus-protect.org/killbox.html Delete File on Reboot -- anhaken reinkopieren: ... und klicke auf das rote Kreuz, wenn gefragt wird, ob "Do you want to reboot? "---- klicke auf "no",und kopiere das nächste rein, erst beim letzten auf "yes" C:\WINDOWS\system32\lpdriver.sys C:\WINDOWS\system32\TFTP3332 C:\WINDOWS\system32\TFTP3352 C:\WINDOWS\system32\TFTP3512 C:\WINDOWS\system32\TFTP3376 C:\WINDOWS\system32\TFTP3480 C:\WINDOWS\system32\TFTP2340 C:\WINDOWS\system32\TFTP3356 C:\WINDOWS\system32\TFTP652 C:\WINDOWS\system32\TFTP572 C:\WINDOWS\system32\TFTP3008 C:\WINDOWS\system32\install.exe C:\WINDOWS\system32\x.bat C:\WINDOWS\System32\sys_xp.exe C:\WINDOWS\system32\sys_xp.exeopenopenopen C:\WINDOWS\system32\sys_xp.exeopenopenopenopen C:\WINDOWS\system32\re_file.exe C:\WINDOWS\pre2.exe C:\WINDOWS\Germany.exe C:\WINDOWS\inetinfomon.exe C:\Program Files\Vpyj\Gexeu.exe C:\Program Files\Vpyj C:\WINDOWS\unslive.exe C:\WINDOWS\etb\pokapoka66.exe C:\WINDOWS\etb C:\debug.dcd C:\debug.src C:\debug.param C:\et20050910.log C:\et20050909.log C:\pok20050909.log C:\et20050908.log C:\pok20050908.log C:\et20050907.log C:\pok20050907.log C:\et20050906.log C:\pok20050906.log C:\et20050905.log C:\pok20050905.log C:\et20050904.log C:\pok20050904.log C:\pok20050903.log C:\et20050903.log C:\et20050902.log C:\pok20050902.log C:\pok20050901.log C:\et20050901.log C:\pok20050831.log C:\et20050831.log C:\pok20050830.log C:\et20050830.log C:\pok20050829.log C:\et20050829.log C:\WINDOWS\etb PC neustarten Bagle-Removaltool (scanne) http://securityresponse.symantec.com/avcenter/venc/data/w32.beagle@mm.removal.tool.html ServiceFilter.zip http://virus-protect.org/artikel/tools/ServiceFilter.zip - entzippen - scannen - POST_THIS.TXT abkopieren __________ MfG Sabina rund um die PC-Sicherheit |
|
|
|
|
|
|
17.11.2005, 02:22
Member
Beiträge: 25 |
#8
hi
 okbin gerade be den letzten scans. windows.etp habe ich manuel gelöscht. ist dann auch nicht mehr aufgetaucht. das habe ich bis jetzt: Results of a file scan This is a report processed by VirusTotal on 11/17/2005 at 00:32:29 (CET) after scanning the file "msu.exe" file. Antivirus Version Update Result AntiVir 6.32.0.6 11.16.2005 SPR/Spam.Delf.J Avast 4.6.695.0 11.16.2005 no virus found AVG 718 11.15.2005 no virus found Avira 6.32.0.6 11.16.2005 SPR/Spam.Delf.J BitDefender 7.2 11.17.2005 no virus found CAT-QuickHeal 8.00 11.16.2005 (Suspicious) - DNAScan ClamAV devel-20051108 11.15.2005 no virus found DrWeb 4.33 11.16.2005 no virus found eTrust-Iris 7.1.194.0 11.16.2005 no virus found eTrust-Vet 11.9.1.0 11.16.2005 no virus found Fortinet 2.48.0.0 11.16.2005 Spam_SPM-tr F-Prot 3.16c 11.15.2005 no virus found Ikarus 0.2.59.0 11.16.2005 no virus found Kaspersky 4.0.2.24 11.16.2005 SpamTool.Win32.Delf.j McAfee 4630 11.17.2005 Spam-SPM NOD32v2 1.1289 11.16.2005 no virus found Norman 5.70.10 11.16.2005 no virus found Panda 8.02.00 11.16.2005 no virus found Sophos 3.99.0 11.16.2005 no virus found Symantec 8.0 11.15.2005 Trojan.Spexta TheHacker 5.9.1.036 11.16.2005 no virus found VBA32 3.10.5 11.16.2005 SpamTool.Win32.Delf.j C:\black update.exe . hat mehr als 10 mb! go back lautet der befehl? C:\WINDOWS\unslive.exe kann ich nicht finden! Habe uinst001.exe + unin0407.exe + unvise32qt.exe This is a report processed by VirusTotal on 11/17/2005 at 02:11:52 (CET) after scanning the file "spupdsvc.exe" file. Antivirus Version Update Result AntiVir 6.32.0.6 11.16.2005 no virus found Avast 4.6.695.0 11.16.2005 no virus found AVG 718 11.15.2005 no virus found Avira 6.32.0.6 11.16.2005 no virus found BitDefender 7.2 11.17.2005 no virus found CAT-QuickHeal 8.00 11.16.2005 no virus found ClamAV devel-20051108 11.15.2005 no virus found DrWeb 4.33 11.16.2005 no virus found eTrust-Iris 7.1.194.0 11.16.2005 no virus found eTrust-Vet 11.9.1.0 11.16.2005 no virus found Fortinet 2.48.0.0 11.17.2005 no virus found F-Prot 3.16c 11.15.2005 no virus found Ikarus 0.2.59.0 11.16.2005 no virus found Kaspersky 4.0.2.24 11.17.2005 no virus found McAfee 4630 11.17.2005 no virus found NOD32v2 1.1289 11.16.2005 no virus found Norman 5.70.10 11.16.2005 no virus found Panda 8.02.00 11.16.2005 no virus found Sophos 3.99.0 11.16.2005 no virus found Symantec 8.0 11.15.2005 no virus found TheHacker 5.9.1.036 11.16.2005 no virus found VBA32 3.10.5 11.16.2005 no virus found This is a report processed by VirusTotal on 11/17/2005 at 02:16:51 (CET) after scanning the file "spmsg.dll" file. Antivirus Version Update Result AntiVir 6.32.0.6 11.16.2005 no virus found Avast 4.6.695.0 11.16.2005 no virus found AVG 718 11.15.2005 no virus found Avira 6.32.0.6 11.16.2005 no virus found BitDefender 7.2 11.17.2005 no virus found CAT-QuickHeal 8.00 11.16.2005 no virus found ClamAV devel-20051108 11.15.2005 no virus found DrWeb 4.33 11.16.2005 no virus found eTrust-Iris 7.1.194.0 11.16.2005 no virus found eTrust-Vet 11.9.1.0 11.16.2005 no virus found Fortinet 2.48.0.0 11.17.2005 no virus found F-Prot 3.16c 11.15.2005 no virus found Ikarus 0.2.59.0 11.16.2005 no virus found Kaspersky 4.0.2.24 11.17.2005 no virus found McAfee 4630 11.17.2005 no virus found NOD32v2 1.1289 11.16.2005 no virus found Norman 5.70.10 11.16.2005 no virus found Panda 8.02.00 11.16.2005 no virus found Sophos 3.99.0 11.16.2005 no virus found Symantec 8.0 11.15.2005 no virus found TheHacker 5.9.1.036 11.16.2005 no virus found VBA32 3.10.5 11.16.2005 no virus found The script did not recognize the services listed below. This does not mean that they are a problem. To copy the entire contents of this document for posting: At the top of this window click "Edit" then "Select All" Next click "Edit" again then "Copy" Now right click in the forum post box then click "Paste" ######################################## ServiceFilter 1.1 by rand1038 Microsoft Windows XP Professional Version: 5.1.2600 Service Pack 1 Nov 17, 2005 00:43:55 ---> Begin Service Listing <--- Unknown Service # 1 Service Name: MGABGEXE Display Name: MGABGEXE Start Mode: Auto Start Name: LocalSystem Description: ... Service Type: Own Process Path: c:\windows\system32\mgabg.exe State: Running Process ID: 1592 Started: Wahr Exit Code: 0 Accept Pause: Falsch Accept Stop: Wahr Unknown Service #4 Service Name: SwPrv Display Name: MS Software Shadow Copy Provider Start Mode: Manual Start Name: LocalSystem Description: Verwaltet Software-basierte Schattenkopien des Volumeschattenkopie-Dienstes. Software-basierte ... Service Type: Own Process Path: c:\windows\system32\dllhost.exe /processid:{9672c603-91c2-4a35-bb7c-07a190c0c689} State: Stopped Process ID: 0 Started: Falsch Exit Code: 1077 Accept Pause: Falsch Accept Stop: Falsch Unknown Service # 5 Service Name: virus Display Name: change me please Start Mode: Disabled Start Name: LocalSystem Description: this is it, you're ... Service Type: Own Process Path: "c:\windows\sysdat.exe" State: Stopped Process ID: 0 Started: Falsch Exit Code: 1077 Accept Pause: Falsch Accept Stop: Falsch ---> End Service Listing <--- There are 82 Win32 services on this machine. 5 were unrecognized. Script Execution Time: 0,6879883 seconds. REGEDIT4 ; RegSrch.vbs © Bill James ; Registry search results for string "Lpdriver" 17.11.2005 00:45:00 ; NOTE: This file will be deleted when you close WordPad. ; You must manually save this file to a new location if you want to refer to it again later. ; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.) [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Lpdriver] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Lpdriver] "DisplayName"="Lpdriver" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Lpdriver\Security] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Lpdriver] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Lpdriver] "DisplayName"="Lpdriver" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Lpdriver\Security] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Lpdriver] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Lpdriver] "DisplayName"="Lpdriver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Lpdriver\Security] REGEDIT4 ; RegSrch.vbs © Bill James ; Registry search results for string "TlntSvr" 17.11.2005 00:46:00 ; NOTE: This file will be deleted when you close WordPad. ; You must manually save this file to a new location if you want to refer to it again later. ; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\TlntSvr.Exe] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{FE9E4896-A014-11D1-855C-00A0C944138C}] @="TlntSvr" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{FE9E4896-A014-11D1-855C-00A0C944138C}] "LocalService"="TlntSvr" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FE9E48A2-A014-11D1-855C-00A0C944138C}\InProcServer32] @="C:\\WINDOWS\\System32\\tlntsvrp.dll" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FE9E48A4-A014-11D1-855C-00A0C944138C}\LocalServer32] @="C:\\WINDOWS\\System32\\tlntsvr.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FE9E48A4-A014-11D1-855C-00A0C944138C}\ProgID] @="TlntSvr.EnumTelnetClientsSvr.1" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FE9E48A4-A014-11D1-855C-00A0C944138C}\VersionIndependentProgID] @="TlntSvr.EnumTelnetClientsSvr" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TlntSvr.EnumTelnetClientsSvr] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TlntSvr.EnumTelnetClientsSvr\CLSID] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TlntSvr.EnumTelnetClientsSvr.1] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TlntSvr.EnumTelnetClientsSvr.1\CLSID] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{FE9E4895-A014-11D1-855C-00A0C944138C}\1.0] @="TlntSvr 1.0 Type Library" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{FE9E4895-A014-11D1-855C-00A0C944138C}\1.0\0\win32] @="C:\\WINDOWS\\System32\\tlntsvr.exe" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application\Tlntsvr] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application\Tlntsvr] "EventMessageFile"="C:\\WINDOWS\\System32\\tlntsvr.exe;C:\\WINDOWS\\System32\\xpsp1res.dll" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TlntSvr] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TlntSvr\Security] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Eventlog\Application\Tlntsvr] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Eventlog\Application\Tlntsvr] "EventMessageFile"="C:\\WINDOWS\\System32\\tlntsvr.exe;C:\\WINDOWS\\System32\\xpsp1res.dll" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\TlntSvr] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\TlntSvr\Security] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Tlntsvr] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Tlntsvr] "EventMessageFile"="C:\\WINDOWS\\System32\\tlntsvr.exe;C:\\WINDOWS\\System32\\xpsp1res.dll" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TlntSvr] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TlntSvr\Security] sophos und trend micro sind jetzt schon 90 min. am scanen. ich habe 4 festplatten auf dem rechner. muss jetzt ins bett. mache morgen weiter, lasse den pc weiter scannen danke dir. Sophos Anti-Virus Version 3.99.0 [Win32/Intel] Virus data version 3.99, November 2005 Includes detection for 113157 viruses, trojans and worms Copyright (c) 1989-2005 Sophos Plc, www.sophos.com System time 00:55:13, System date 17 November 2005 Command line qualifiers are: -f -di -all -remove -mime -mbr -noc -archive -opt=ISCabinet IDE directory is: c:\AV-CLS\Sophos Full Scanning >>> Virus 'Troj/Istbar-Fam' found in file c:\!KillBox\install.exe Removal successful >>> Virus 'Troj/Elitebar-K' found in file c:\!KillBox\pokapoka63.exe Removal successful Could not open c:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\Microsoft\Windows\UsrClass.dat Could not open c:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\Microsoft\Windows\UsrClass.dat.LOG Could not open c:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen\Anwendungsdaten\Microsoft\Windows\UsrClass.dat Could not open c:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen\Anwendungsdaten\Microsoft\Windows\UsrClass.dat.LOG Password protected file c:\Dokumente und Einstellungen\unikos\Anwendungsdaten\Adobe\Acrobat\6.0\Messages\DEU\read0600win_DEUadbe0041.pdf Password protected file c:\Dokumente und Einstellungen\unikos\Anwendungsdaten\Adobe\Acrobat\6.0\Messages\DEU\read0600win_DEUyhoo0011.pdf >>> Virus fragment 'W95/Whog-878b' found in file c:\Dokumente und Einstellungen\unikos\Desktop\Plat7susArcorAL.exe\SfxArchiveData\data1.cab\ICAB:000bbd59 >>> Virus fragment 'W95/CIH-10xx' found in file c:\Dokumente und Einstellungen\unikos\Desktop\Plat7susArcorAL.exe\SfxArchiveData\data1.cab\ICAB:001a410e >>> Virus fragment 'W95/CIH-10xx' found in file c:\Dokumente und Einstellungen\unikos\Desktop\Plat7susArcorAL.exe\SfxArchiveData\data2.cab\ICAB:006cd21d\sdisk2 >>> Virus fragment 'W95/CIH-10xx' found in file c:\Dokumente und Einstellungen\unikos\Desktop\Plat7susArcorAL.exe\SfxArchiveData\data2.cab\ICAB:009d3571 >>> Virus fragment 'W95/Whog-878b' found in file c:\Dokumente und Einstellungen\unikos\Desktop\Plat7susArcorAL.exe\SfxArchiveData\pavDll.dll Removal successful Password protected file c:\Dokumente und Einstellungen\unikos\Eigene Dateien\Eigene Bilder\logo material\las boca\laboca014.zip\laboca014.tif Could not open c:\Dokumente und Einstellungen\unikos\Lokale Einstellungen\Anwendungsdaten\Microsoft\Windows\UsrClass.dat Could not open c:\Dokumente und Einstellungen\unikos\Lokale Einstellungen\Anwendungsdaten\Microsoft\Windows\UsrClass.dat.LOG Could not open c:\Dokumente und Einstellungen\unikos\Lokale Einstellungen\Temp\~DF16A6.tmp Could not open c:\Dokumente und Einstellungen\unikos\Lokale Einstellungen\Temp\~DF1F7F.tmp Could not open c:\Dokumente und Einstellungen\unikos\Lokale Einstellungen\Temp\~DF713E.tmp Password protected file c:\Programme\Adobe\Acrobat 6.0\Reader\Messages\DEU\RdrMsgDEU.pdf Password protected file c:\Programme\Adobe\Acrobat 6.0\Reader\Messages\ENU\RdrMsgENU.pdf >>> Virus fragment 'W95/Whog-878b' found in file c:\Programme\InstallShield Installation Information\{E91563B4-D9EC-11D5-A2BB-00606771B69D}\data1.cab\ICAB:000bbd59 >>> Virus fragment 'W95/CIH-10xx' found in file c:\Programme\InstallShield Installation Information\{E91563B4-D9EC-11D5-A2BB-00606771B69D}\data1.cab\ICAB:001a410e Removal successful >>> Virus fragment 'W95/Whog-878b' found in file c:\Programme\InstallShield Installation Information\{E91563B4-D9EC-11D5-A2BB-00606771B69D}\Pavdll.dll Removal successful >>> Virus fragment 'W95/CIH-10xx' found in file c:\Programme\Panda Software\Panda Antivirus Platinum\Pavcl.com Removal successful >>> Virus fragment 'W95/Whog-878b' found in file c:\Programme\Panda Software\Panda Antivirus Platinum\pavdll.dll Removal failed >>> Virus fragment 'W95/CIH-10xx' found in file c:\Programme\Panda Software\Panda Antivirus Platinum\Sdisk2.img\sdisk2 Removal successful >>> Virus 'Troj/Elitebar-I' found in file c:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0031356.dll Removal successful >>> Virus 'Troj/Elitebar-I' found in file c:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0031366.dll Removal successful >>> Virus 'Troj/Elitebar-I' found in file c:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0031384.dll Removal successful >>> Virus 'Troj/Elitebar-I' found in file c:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0031405.dll Removal successful >>> Virus 'Troj/Elitebar-I' found in file c:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0032405.dll Removal successful >>> Virus 'Troj/Elitebar-I' found in file c:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0032444.dll Removal successful >>> Virus 'Troj/Elitebar-I' found in file c:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0032453.dll Removal successful >>> Virus 'Troj/Elitebar-I' found in file c:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0032477.dll Removal successful >>> Virus 'Troj/Elitebar-I' found in file c:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0032486.dll Removal successful >>> Virus 'Troj/Elitebar-I' found in file c:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0032521.dll Removal successful >>> Virus 'Troj/Elitebar-I' found in file c:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0032530.dll Removal successful >>> Virus 'Troj/Elitebar-I' found in file c:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0032539.dll Removal successful >>> Virus 'Troj/Elitebar-I' found in file c:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0032551.dll Removal successful >>> Virus 'Troj/Elitebar-I' found in file c:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0032561.dll Removal successful >>> Virus 'Troj/Istsvc-A' found in file c:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0032619.exe Removal successful >>> Virus 'Troj/Elitebar-I' found in file c:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0036301.dll Removal successful >>> Virus 'Troj/Elitebar-I' found in file c:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0036312.dll Removal successful >>> Virus 'Troj/Elitebar-I' found in file c:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0036347.dll Removal successful >>> Virus 'Troj/Elitebar-I' found in file c:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0036359.dll Removal successful >>> Virus 'Troj/Elitebar-I' found in file c:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0036373.dll Removal successful >>> Virus 'Troj/Elitebar-I' found in file c:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0036386.dll Removal successful >>> Virus 'Troj/Elitebar-I' found in file c:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0036397.dll Removal successful >>> Virus 'Troj/Elitebar-I' found in file c:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0036448.dll Removal successful >>> Virus 'Troj/Istbar-Fam' found in file c:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP92\A0042705.exe Removal successful >>> Virus 'Troj/Elitebar-K' found in file c:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP92\A0042719.exe Removal successful >>> Virus 'Troj/Elitebar-I' found in file c:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP92\A0042727.dll Removal successful >>> Virus 'Troj/Istbar-Fam' found in file c:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP92\A0042736.exe Removal successful >>> Virus 'Troj/Elitebar-K' found in file c:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP92\A0042737.exe Removal successful >>> Virus fragment 'W95/Whog-878b' found in file c:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP92\A0042738.exe\SfxArchiveData\data1.cab\ICAB:000bbd59 >>> Virus fragment 'W95/CIH-10xx' found in file c:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP92\A0042738.exe\SfxArchiveData\data1.cab\ICAB:001a410e >>> Virus fragment 'W95/CIH-10xx' found in file c:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP92\A0042738.exe\SfxArchiveData\data2.cab\ICAB:006cd21d\sdisk2 >>> Virus fragment 'W95/CIH-10xx' found in file c:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP92\A0042738.exe\SfxArchiveData\data2.cab\ICAB:009d3571 >>> Virus fragment 'W95/Whog-878b' found in file c:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP92\A0042738.exe\SfxArchiveData\pavDll.dll Removal successful >>> Virus fragment 'W95/Whog-878b' found in file c:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP92\A0042745.dll Removal successful >>> Virus fragment 'W95/CIH-10xx' found in file c:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP92\A0042747.com Removal successful >>> Virus 'Troj/Agent-DJ' found in file c:\WINDOWS\Cursors\binnet.dll Removal failed Could not open c:\WINDOWS\system32\config\system.LOG >>> Virus 'Troj/Istsvc-A' found in file c:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\CIIOK4WS\istrecover[1].exe Removal successful Could not open c:\WINDOWS\system32\spool\PRINTERS\FP00000.SHD >>> Virus 'W32/Netsky-T' found in file c:\WINDOWS\uinmzertinmds.opm Removal successful Could not open PHYSICAL:0081:0000:0000:0001 Could not open PHYSICAL:0082:0000:0000:0001 Could not open PHYSICAL:0083:0000:0000:0001 Could not open PHYSICAL:0084:0000:0000:0001 5 master boot records swept. 57450 files swept in 4 hours, 13 minutes and 33 seconds. 76 errors were encountered. 51 viruses were discovered. 42 files out of 57450 were infected. Please send infected samples to Sophos for analysis. For advice consult www.sophos.com, email support@sophos.com or telephone +44 1235 559933 61 encrypted files were not checked. Ending Sophos Anti-Virus. der report von trend micro lässt sich nicht kopieren! Dieser Beitrag wurde am 17.11.2005 um 11:26 Uhr von unikos editiert.
|
|
|
|
|
|
|
17.11.2005, 12:00
Ehrenmitglied
Themenstarter Beiträge: 29434 |
#9
Registry Search Tool
Doppelklick:regsrch.vbs reinkopieren: sysdat.exe und hier posten --------------------------------------------------------------------- Loesche mit der Killbox oder manuell: C:\msu.exe\msu.exe C:\msu.exe c:\windows\sysdat.exe Start-->ausfuehren--> regedit bearbeiten--> suchen--> Lpdriver Klicke auf Bearbeiten -- Berechtigung und klicke dann auf Vollzugriff -- [Übernehmen] und auf [OK]. Erneuter [Rechtsklick] auf den Schlüssel und versuche diesen zu löschen. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Lpdriver] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Lpdriver] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Lpdriver] PC neustarten scanne mit Kaspersky und poste den scanreport http://virus-protect.org/onlinescan.html suche und loesche: C:\Program Files\system64.dat c:\windows\System32\lpdriver.sys (falls es nicht schon geloscht ist...) ---------------------------------------------------------------- ist fuer mich: 25.02.2005 04:34 22.752 spupdsvc.exe Zitat Charakteristik: spupdsvc.exe befindet sich im Ordner C:\Windows\System32. Die Dateigröße unter Windows XP ist 15872 bytes.24.02.2005 19:34 15.584 spmsg.dll ??? __________ MfG Sabina rund um die PC-Sicherheit |
|
|
|
|
|
|
17.11.2005, 12:09
Member
Beiträge: 25 |
#10
Virus Scan Report File
-------------------------------------------------------------------------------- Virus Scan Information -------------------------------------------------------------------------------- McAfee VirusScan for Win32 v4.40.0 Copyright (c) 1992-2004 Networks Associates Technology Inc. All rights reserved. (408) 988-3832 LICENSED COPY - Sep 23 2004 Scan engine v4.4.00 for Win32. Virus data file v4630 created Nov 16 2005 Scanning for 159421 viruses, trojans and variants. Scanning C: [] C:\msu.exe\msu.exe ... Found the Spam-SPM trojan !!! The file or process has been deleted. Scanning C:\*.* C:\!KillBox\binnet.dll ... Found potentially unwanted program Adware-Virtumundo. The file or process has been deleted. C:\!KillBox\Germany.exe ... Found potentially unwanted program Dialer-263. The file or process has been deleted. C:\!KillBox\inetinfomon.exe\inetinfomon.exe ... Found the Spam-SPM trojan !!! The file or process has been deleted. C:\!KillBox\x.bat ... Found the Generic component trojan !!! The file or process has been deleted. C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Temporary Internet Files\Content.IE5\UNS5DO7D\Microsoft_Update[1].exe\Microsoft_Update[1].exe ... Found the Spam-SPM trojan !!! The file or process has been deleted. C:\Dokumente und Einstellungen\unikos\Desktop\hijackthis.zip\BACKUP-20051110-010637-949.DLL ... Found potentially unwanted program Adware-Adpower. C:\Programme\Gemeinsame Dateien\WinSoftware\CrXML.dll ... Found potentially unwanted program WinFixer. The file or process has been deleted. C:\WINDOWS\Cursors\binnet.dll ... Found potentially unwanted program Adware-Virtumundo. C:\WINDOWS\pre2.exe ... Found the AdClicker-BA trojan !!! The file or process has been deleted. Zitat 13.09.2005 10:22 14.336 pre2.exeC:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\1XV0513Y\cmctl[1].dll ... Found potentially unwanted program Adware-ISTbar. The file or process has been deleted. C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\1XV0513Y\nem220[1].dll ... Found potentially unwanted program Adware-DFC. The file or process has been deleted. C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\1XV0513Y\power_remove[1].exe\power_remove[1].exe ... Found potentially unwanted program PowerScan. The file or process has been deleted. C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\1XV0513Y\SAcc.prod.11jui2005.exe[1]\SAcc.prod.11jui2005.exe[1] ... Found potentially unwanted program Adware-SurfAccuracy. The file or process has been deleted. C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\9RXGD02G\istbarcm[1].dll\istbarcm[1].dll ... Found potentially unwanted program YourSiteBar. The file or process has been deleted. C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\9RXGD02G\istsvc[1].exe\istsvc[1].exe ... Found potentially unwanted program Adware-ISTbar.b. The file or process has been deleted. C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\9RXGD02G\package_MARKETING27[1].exe ... Found potentially unwanted program Adware-BB. The file or process has been deleted. C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\9RXGD02G\sfbho13[1].dll\sfbho13[1].dll ... Found potentially unwanted program Adware-SideFind. The file or process has been deleted. C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\CIIOK4WS\istdownload[1].exe\istdownload[1].exe ... Found potentially unwanted program Adware-ISTbar.b. The file or process has been deleted. C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\CIIOK4WS\sacc_remove[1].exe\sacc_remove[1].exe ... Found potentially unwanted program Adware-SurfAccuracy. The file or process has been deleted. C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\W5KPBWZT\optimize[1].exe ... Found potentially unwanted program Adware-DFC. The file or process has been deleted. C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\W5KPBWZT\powerscan[1].exe ... Found potentially unwanted program PowerScan. The file or process has been deleted. C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\W5KPBWZT\sidefind13[1].dll ... Found potentially unwanted program Adware-SideFind. The file or process has been deleted. C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\W5KPBWZT\sidefind[1].exe\sidefind[1].exe ... Found potentially unwanted program Adware-SideFind. The file or process has been deleted. -------------------------------------------------------------------------------- Visit the McAfee Online Web Site Need some help or advice? Send email to Technical |
|
|
|
|
|
|
17.11.2005, 12:17
Ehrenmitglied
Themenstarter Beiträge: 29434 |
#11
Killbox:
DelTree (include SubDirectories) Man will zum Beispiel einen Ordner löschen . Nun muss man nicht alle Dateien im Ordner einzeln eingeben, sondern klickt die Option DelTree (include subdirectories). Hierbei wird ein komplettes Archiv mitsamt der Unterordner gelöscht. C:\Programme\Gemeinsame Dateien\WinSoftware <---ist der Winfixer CCleaner http://www.ccleaner.com/ccdownload.asp lösche alle temp-Dateien __________ MfG Sabina rund um die PC-Sicherheit |
|
|
|
|
|
|
17.11.2005, 12:25
Ehrenmitglied
Themenstarter Beiträge: 29434 |
#12
wenn das alles erledig ist, loeschen wir Adware-Virtumundo
 __________ MfG Sabina rund um die PC-Sicherheit |
|
|
|
|
|
|
17.11.2005, 22:21
Member
Beiträge: 25 |
#13
sysdat.exe bekomme ich keinen report?! meldet aber: das nichts gefunden wurde.
C:\msu.exe\msu.exe C:\msu.exe c:\windows\sysdat.exe [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Lpdriver] C:\Program Files\system64.dat habe ich nicht gefunden! kaspersky scan sieht nicht gut aus: KASPERSKY ON-LINE SCANNER REPORT Thursday, November 17, 2005 22:32:15 Operating System: Microsoft Windows XP Professional, Service Pack 1 (Build 2600) Kaspersky On-line Scanner version: 5.0.67.0 Kaspersky Anti-Virus database last update: 17/11/2005 Kaspersky Anti-Virus database records: 150711 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: standard Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ E:\ F:\ G:\ H:\ I:\ J:\ K:\ L:\ Scan Statistics: Total number of scanned objects: 61698 Number of viruses found: 11 Number of infected objects: 59 Number of suspicious objects: 0 Duration of the scan process: 1789 sec Infected Object Name - Virus Name C:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0031314.dll Infected: Trojan-Downloader.Win32.Agent.tv C:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0031367.dll Infected: Trojan-Downloader.Win32.Agent.tv C:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0031385.dll Infected: Trojan-Downloader.Win32.Agent.tv C:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0031406.dll Infected: Trojan-Downloader.Win32.Agent.tv C:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0032406.dll Infected: Trojan-Downloader.Win32.Agent.tv C:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0032426.exe Infected: Backdoor.Win32.EggDrop.1616 C:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0032445.dll Infected: Trojan-Downloader.Win32.Agent.tv C:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0032454.dll Infected: Trojan-Downloader.Win32.Agent.tv C:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0032478.dll Infected: Trojan-Downloader.Win32.Agent.tv C:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0032487.dll Infected: Trojan-Downloader.Win32.Agent.tv C:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0032522.dll Infected: Trojan-Downloader.Win32.Agent.tv C:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0032531.dll Infected: Trojan-Downloader.Win32.Agent.tv C:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0032540.dll Infected: Trojan-Downloader.Win32.Agent.tv C:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0032552.dll Infected: Trojan-Downloader.Win32.Agent.tv C:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0032562.dll Infected: Trojan-Downloader.Win32.Agent.tv C:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0032620.exe Infected: Trojan-Downloader.Win32.Dyfuca.ei C:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0032621.dll Infected: Trojan-Downloader.Win32.Dyfuca.gen C:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0032622.exe Infected: Trojan-Downloader.Win32.IstBar.gen C:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0032623.dll Infected: Trojan-Downloader.Win32.Dyfuca.dt C:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0036278.dll Infected: Trojan-Downloader.Win32.Agent.tv C:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0036279.dll Infected: Trojan-Downloader.Win32.Agent.tv C:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0036302.dll Infected: Trojan-Downloader.Win32.Agent.tv C:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0036303.dll Infected: Trojan-Downloader.Win32.Agent.tv C:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0036304.dll Infected: Trojan-Downloader.Win32.Agent.tv C:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0036313.dll Infected: Trojan-Downloader.Win32.Agent.tv C:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0036314.dll Infected: Trojan-Downloader.Win32.Agent.tv C:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0036315.dll Infected: Trojan-Downloader.Win32.Agent.tv C:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0036348.dll Infected: Trojan-Downloader.Win32.Agent.tv C:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0036349.dll Infected: Trojan-Downloader.Win32.Agent.tv C:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0036350.dll Infected: Trojan-Downloader.Win32.Agent.tv C:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0036360.dll Infected: Trojan-Downloader.Win32.Agent.tv C:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0036361.dll Infected: Trojan-Downloader.Win32.Agent.tv C:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0036362.dll Infected: Trojan-Downloader.Win32.Agent.tv C:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0036374.dll Infected: Trojan-Downloader.Win32.Agent.tv C:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0036375.dll Infected: Trojan-Downloader.Win32.Agent.tv C:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0036376.dll Infected: Trojan-Downloader.Win32.Agent.tv C:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0036387.dll Infected: Trojan-Downloader.Win32.Agent.tv C:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0036388.dll Infected: Trojan-Downloader.Win32.Agent.tv C:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0036389.dll Infected: Trojan-Downloader.Win32.Agent.tv C:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0036398.dll Infected: Trojan-Downloader.Win32.Agent.tv C:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0036399.dll Infected: Trojan-Downloader.Win32.Agent.tv C:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0036400.dll Infected: Trojan-Downloader.Win32.Agent.tv C:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0036429.exe Infected: Trojan-Downloader.Win32.Agent.tv C:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0036442.dll Infected: Trojan-Downloader.Win32.Agent.tv C:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0036449.dll Infected: Trojan-Downloader.Win32.Agent.tv C:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP87\A0036509.dll Infected: Trojan-Downloader.Win32.Agent.tv C:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP92\A0042707.exe Infected: Trojan.Win32.Dialer.jr C:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP92\A0042708.exe Infected: SpamTool.Win32.Delf.j C:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP92\A0042709.exe Infected: Trojan.Win32.Small.cy C:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP92\A0042718.exe Infected: Trojan-Downloader.Win32.Agent.tv C:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP92\A0042728.dll Infected: Trojan-Downloader.Win32.Agent.tv C:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP92\A0042743.exe Infected: Trojan.Win32.Small.cy C:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP92\A0042744.exe Infected: Trojan.Win32.Small.cy C:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP92\A0042759.exe Infected: SpamTool.Win32.Delf.j C:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP92\A0042760.exe Infected: Trojan.Win32.Dialer.jr C:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP92\A0042761.exe Infected: SpamTool.Win32.Delf.j C:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP92\A0042764.exe Infected: Trojan-Dropper.Win32.Small.aeq C:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP92\A0042765.exe Infected: Trojan-Downloader.Win32.Agent.tv C:\System Volume Information\_restore{E173A2FC-2294-43A5-8C5E-885E438A6625}\RP92\A0042782.dll Infected: Trojan.Win32.Crypt.o Scan process completed. über die killbox wird der zugriff auf die: -system volume information verweigert! wie soll ich die viren löschen? Dieser Beitrag wurde am 17.11.2005 um 22:41 Uhr von unikos editiert.
|
|
|
|
|
|
|
18.11.2005, 00:20
Ehrenmitglied
Themenstarter Beiträge: 29434 |
#14
kopiere in die killbox: -->loeschen !!!!!!!!!
(wenn es noch da ist, wird es angezeigt) c:\windows\sysdat.exe C:\Program Files\system64.dat dann neustarten Doppelklick:regsrch.vbs reinkopieren: Lpdriver Press 'OK' warten, bis die Suche beendet ist. (Ergebnis bitte posten) ServiceFilter.zip http://virus-protect.org/artikel/tools/ServiceFilter.zip - entzippen - scannen - POST_THIS.TXT abkopieren Deaktivieren Wiederherstellung «XP Arbeitsplatz-->rechtsklick, dann auf Eigenschaften--->Reiter Systemwiederherstellung--->Häkchen setzen bei Systemwiederherstellung auf allen Laufwerken deaktivieren. http://service1.symantec.com/SUPPORT/INTER/tsgeninfointl.nsf/gdocid/20030807105707924 scanne mit Panda und poste den scanbericht http://virus-protect.org/onlinescan.html -------------------------------------------------------------------------------- (wenn die Reinigung beendet ist, aktiviere die Systemwiederherstellung wieder) __________ MfG Sabina rund um die PC-Sicherheit |
|
|
|
|
|
|
18.11.2005, 01:27
Member
Beiträge: 25 |
#15
c:\windows\sysdat.exe
C:\Program Files\system64.dat hab ich reinkopiert: daten existieren nicht! Doppelklick:regsrch.vbs hat nichts gefunden, bekomme aber keinen report! auch nach 5 minuten nicht. vorher habe ich ok gedrückt. The script did not recognize the services listed below. This does not mean that they are a problem. To copy the entire contents of this document for posting: At the top of this window click "Edit" then "Select All" Next click "Edit" again then "Copy" Now right click in the forum post box then click "Paste" ######################################## ServiceFilter 1.1 by rand1038 Microsoft Windows XP Professional Version: 5.1.2600 Service Pack 1 Nov 18, 2005 01:38:57 ---> Begin Service Listing <--- Unknown Service # 1 Service Name: MGABGEXE Display Name: MGABGEXE Start Mode: Auto Start Name: LocalSystem Description: ... Service Type: Own Process Path: c:\windows\system32\mgabg.exe State: Running Process ID: 1580 Started: Wahr Exit Code: 0 Accept Pause: Falsch Accept Stop: Wahr Unknown Service # 2 Service Name: PAVFIRES Display Name: Panda Firewall Service Start Mode: Auto Start Name: LocalSystem Description: ... Service Type: Own Process Path: c:\programme\panda software\panda antivirus platinum\firewall\pavfires.exe State: Running Process ID: 1608 Started: Wahr Exit Code: 0 Accept Pause: Falsch Accept Stop: Wahr Unknown Service # 3 Service Name: PAVSRV Display Name: Panda anti-virus service Start Mode: Auto Start Name: LocalSystem Description: ... Service Type: Own Process Path: c:\programme\panda software\panda antivirus platinum\pavsrv51.exe State: Running Process ID: 1944 Started: Wahr Exit Code: 0 Accept Pause: Falsch Accept Stop: Wahr Unknown Service #4 Service Name: SwPrv Display Name: MS Software Shadow Copy Provider Start Mode: Manual Start Name: LocalSystem Description: Verwaltet Software-basierte Schattenkopien des Volumeschattenkopie-Dienstes. Software-basierte ... Service Type: Own Process Path: c:\windows\system32\dllhost.exe /processid:{9672c603-91c2-4a35-bb7c-07a190c0c689} State: Stopped Process ID: 0 Started: Falsch Exit Code: 1077 Accept Pause: Falsch Accept Stop: Falsch Unknown Service # 5 Service Name: virus Display Name: change me please Start Mode: Disabled Start Name: LocalSystem Description: this is it, you're ... Service Type: Own Process Path: "c:\windows\sysdat.exe" State: Stopped Process ID: 0 Started: Falsch Exit Code: 1077 Accept Pause: Falsch Accept Stop: Falsch ---> End Service Listing <--- There are 82 Win32 services on this machine. 5 were unrecognized. Script Execution Time: 1,078125 seconds. Dieser Beitrag wurde am 18.11.2005 um 01:39 Uhr von unikos editiert.
|
|
|
|
|
|
Um auf dieses Thema zu ANTWORTEN
bitte erst » hier kostenlos registrieren!!
bitte erst » hier kostenlos registrieren!!
Folgende Themen könnten Dich auch interessieren:
Copyright © 2024, Protecus.de - Protecus Team - Impressum / Mediadaten
Zitat
__________
MfG Sabina
rund um die PC-Sicherheit