www.ad-w-a-r-e.com bzw. www.a-d-w-a-r-e.com

#1 Habe mir irgendetwas super nerviges eingefangen.
Spy Sweeper blockiert immer oben angegebene Zugriffsversuche.
Vorher sprang alle paar Minuten Firefox mit nerviger Werbung auf. Nervt immer noch, da permanent geblockt wird.

Nachfolgend mein HijackThis-Log
Bin völlig verzweifelt. Vorab Dank für Hilfe

Logfile of HijackThis v1.99.1
Scan saved at 16:13:28, on 01.02.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\brss01a.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe
C:\Programme\ewido anti-malware\ewidoctrl.exe
C:\Programme\ewido anti-malware\ewidoguard.exe
C:\Programme\FSI\F-Prot\fpavupdm.exe
C:\Programme\Norton AntiVirus\navapsvc.exe
C:\Programme\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\Security Center\SymWSC.exe
C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\LAUNCH~1\CPLBCL53.EXE
C:\Programme\CyberLink\PowerDVD\PDVDServ.exe
C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe
C:\PROGRA~1\GEMEIN~1\XCPCSync\TRANSL~1\ErPhn2\ErTray.exe
C:\Programme\iTunes\iTunesHelper.exe
C:\Programme\QuickTime\qttask.exe
C:\Programme\iPod\bin\iPodService.exe
C:\PROGRA~1\GEMEIN~1\Lexware\INTERN~1\LxTrans.exe
C:\Programme\FSI\F-Prot\F-Sched.exe
C:\Programme\FSI\F-Prot\F-StopW.EXE
C:\Programme\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Gemeinsame Dateien\Ahead\lib\NMBgMonitor.exe
C:\Programme\Gemeinsame Dateien\Lexware\Update Manager\LxUpdateManager.exe
C:\Programme\SpamPal\spampal.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Dokumente und Einstellungen\CS\Desktop\hijackthis_199\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 194.248.240.42:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programme\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar1.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\CPLBCL53.EXE
O4 - HKLM\..\Run: [RemoteControl] C:\Programme\CyberLink\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ccApp] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [XTNDConnect PC - ErPhn2] C:\PROGRA~1\GEMEIN~1\XCPCSync\TRANSL~1\ErPhn2\ErTray.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Programme\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [TransferManager] C:\PROGRA~1\GEMEIN~1\Lexware\INTERN~1\LxTrans.exe /Embedding
O4 - HKLM\..\Run: [FRISK FP-Scheduler] C:\Programme\FSI\F-Prot\F-Sched.exe STARTUP
O4 - HKLM\..\Run: [F-StopW] C:\Programme\FSI\F-Prot\F-StopW.EXE
O4 - HKLM\..\Run: [SpySweeper] "C:\Programme\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programme\Gemeinsame Dateien\Ahead\lib\NMBgMonitor.exe"
O4 - Startup: SpamPal.lnk = C:\Programme\SpamPal\spampal.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Lexware Info Service.lnk = C:\Programme\Gemeinsame Dateien\Lexware\Update Manager\LxUpdateManager.exe
O8 - Extra context menu item: &Google-Suche - res://c:\programme\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Ins Deutsche übersetzen - res://c:\programme\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Alles mit FlashGet laden - C:\Programme\FlashGet\jc_all.htm
O8 - Extra context menu item: Im Cache gespeicherte Seite - res://c:\programme\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Mit FlashGet laden - C:\Programme\FlashGet\jc_link.htm
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Verweisseiten - res://c:\programme\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Ähnliche Seiten - res://c:\programme\google\GoogleToolbar1.dll/cmsimilar.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\Programme\IrfanView\Ebay\Ebay.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - http://cm4all01.kundenserver.de/app/static/activex/msxml4.cab
O20 - Winlogon Notify: policies - C:\WINDOWS\
O20 - Winlogon Notify: URL - C:\WINDOWS\system32\irj2l51o1.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Gatewaydienst auf Anwendungsebene (ALG) - Unknown owner - C:\WINDOWS\System32\alg.exe (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Programme\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Programme\ewido anti-malware\ewidoguard.exe
O23 - Service: F-Prot Antivirus Update Monitor - FRISK Software - C:\Programme\FSI\F-Prot\fpavupdm.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto-Protect-Dienst (navapsvc) - Symantec Corporation - C:\Programme\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Programme\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\GEMEIN~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Programme\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\Security Center\SymWSC.exe

#2 CarstenHH

stelle den CleanUp genauso ein, wie hier angegeben:
http://virus-protect.org/cleanup.html

Kopiere diese 4 Textdateien. Sie sind nach Datum geordnet. (kopiere nur die letzten 3 Monate ab)
http://virus-protect.org/datfindbat.html
__________
MfG Sabina

rund um die PC-Sicherheit

#3 Verzeichnis von C:\WINDOWS\system32

01.02.2006 17:04 234.965 guard.tmp
01.02.2006 16:07 234.965 mxexch40.dll
01.02.2006 16:05 235.025 irpml5711.dll
01.02.2006 15:14 234.965 irj2l51o1.dll
01.02.2006 13:49 236.780 XYerObex.dll
30.01.2006 17:37 192.976 FNTCACHE.DAT
30.01.2006 16:56 1.158 wpa.dbl
25.01.2006 11:16 492.544 WRLogonNtf.dll
25.01.2006 11:16 8.192 ssiefr.EXE
25.01.2006 11:16 17.920 wrlzma.dll
19.01.2006 09:06 6.948 jupdate-1.5.0_06-b05.log
05.01.2006 04:41 2.836.320 MRT.exe
03.01.2006 15:31 91.904 S32EVNT1.DLL
29.12.2005 03:54 280.064 gdi32.dll
25.12.2005 00:52 1.024 NTIMPEG2.dll
07.12.2005 18:05 573.952 DivX.dll
07.12.2005 18:05 716.800 DivXdec.ax
07.12.2005 18:05 679.936 divx_xx07.dll
07.12.2005 18:05 663.552 divx_xx11.dll
07.12.2005 18:05 679.936 divx_xx0c.dll
05.12.2005 21:51 10.716 dsm_ja.qm
05.12.2005 21:51 15.172 dsm_fr.qm
05.12.2005 21:51 15.331 dsm_de.qm
01.12.2005 04:31 1.492.480 shdocvw.dll
01.12.2005 01:33 544.768 zvkonline50VC7.dll
01.12.2005 01:31 122.880 LxMail20VC7.dll
01.12.2005 01:21 221.184 LXBtr20VC7.dll
01.12.2005 01:19 176.128 LxBasicsVC7.dll
01.12.2005 01:00 135.168 MMedia20VC7.dll
01.12.2005 00:59 290.816 LxXtremeVC7.dll
01.12.2005 00:57 14.336 LXTPSW10VC7.dll
01.12.2005 00:57 761.856 LXTool40VC7.dll
01.12.2005 00:57 675.840 lxter10VC7.dll
01.12.2005 00:54 131.072 LXReportManage.ocx
01.12.2005 00:53 192.512 LXPrnUtil10.dll
24.11.2005 01:31 929.792 LXTool50VC7.dll
24.11.2005 00:58 3.013.632 mshtml.dll
24.11.2005 00:58 1.022.464 browseui.dll
23.11.2005 05:00 4.276 divxsm.tlb
23.11.2005 05:00 778.240 DivXsm.exe
16.11.2005 10:07 65.536 PXTToolVC7.dll
10.11.2005 13:03 127.078 javaws.exe
10.11.2005 13:03 49.265 jpicpl32.cpl
10.11.2005 11:27 49.250 javaw.exe
10.11.2005 11:27 49.248 java.exe
10.11.2005 01:39 303.104 LxImport50VC7.dll
10.11.2005 01:38 159.744 LXDasi30VC7.dll
10.11.2005 01:38 225.280 LXBtr30VC7.dll
10.11.2005 01:37 176.128 LxBasics20VC7.dll
10.11.2005 01:00 1.409.024 LxXtreme30VC7.dll
09.11.2005 12:18 282.679 dnt27.dll
09.11.2005 12:17 77.882 dntvmc27.dll
09.11.2005 12:17 73.785 dntvm27.dll
09.11.2005 12:13 282.624 dnt27VC7.dll
09.11.2005 12:11 86.016 dntvmc27VC7.dll
09.11.2005 12:11 77.824 dntvm27VC7.dll
05.11.2005 04:16 606.208 urlmon.dll
05.11.2005 04:16 1.056.256 danim.dll

Verzeichnis von C:\DOKUME~1\CS\LOKALE~1\Temp

Verzeichnis von C:\WINDOWS

01.02.2006 17:06 31 LxTrans.INI
01.02.2006 16:41 26 Lic.xxx
01.02.2006 16:07 4.234 ModemLog_Agere Systems AC'97 Modem.txt
01.02.2006 16:07 159 wiadebug.log
01.02.2006 16:07 0 0.log
01.02.2006 16:07 2.048 bootstat.dat
01.02.2006 16:06 32.556 SchedLgU.Txt
01.02.2006 16:06 50 wiaservc.log
01.02.2006 16:05 1.831.194 WindowsUpdate.log
01.02.2006 15:12 350.708 ntbtlog.txt
01.02.2006 12:11 178.493 wmsetup.log
01.02.2006 12:10 1.691 OEWABLog.txt
01.02.2006 10:44 500.546 setupapi.log
31.01.2006 17:45 695 win.ini
31.01.2006 16:43 220.743 setupact.log
30.01.2006 19:45 3.872.041 pfirewall.log
30.01.2006 18:04 0 winsysupd41.dat
30.01.2006 18:04 0 myupdates1.dat
30.01.2006 18:03 43 drsmartload2.dat
30.01.2006 17:59 0 uniq
30.01.2006 16:46 1.409 QTFont.for
30.01.2006 16:46 54.156 QTFont.qfn
30.01.2006 12:12 0 PROTOCOL.INI
30.01.2006 09:20 40.840 MKDEMSG.LOG
30.01.2006 09:20 3.072 MKDEWE.TRN
29.01.2006 17:31 116 NeroDigital.ini
27.01.2006 11:52 3.298 tm.ini
26.01.2006 15:15 285 WISO.INI
25.01.2006 11:16 478.720 WRUninstall.dll
11.01.2006 09:09 197.962 tsoc.log
11.01.2006 09:09 106.384 ntdtcsetup.log
11.01.2006 09:09 1.374 imsins.log
11.01.2006 09:09 10.124 KB908519.log
11.01.2006 09:09 170.587 comsetup.log
11.01.2006 09:09 25.404 msgsocm.log
11.01.2006 09:09 25.993 ocmsn.log
11.01.2006 09:09 282.939 ocgen.log
11.01.2006 09:09 72.059 iis6.log
11.01.2006 09:09 498.802 FaxSetup.log
06.01.2006 08:57 11.034 KB912919.log
06.01.2006 08:57 1.355 imsins.BAK
06.01.2006 08:56 24.870 updspapi.log
02.01.2006 11:21 4.525 ODBCINST.INI
02.01.2006 11:21 1.998 KB829558.log
30.12.2005 12:37 231 BUHL.INI
23.12.2005 17:17 448 nsw.log
16.12.2005 11:05 9.894 KB910437.log
16.12.2005 11:05 15.873 KB905915.log
13.12.2005 10:43 400 XSearch.ini
13.12.2005 10:42 102 XIndex.ini
13.12.2005 10:42 134 XTree.ini
10.11.2005 11:00 11.782 KB896424.log

Verzeichnis von C:\

01.02.2006 17:10 0 sys.txt
01.02.2006 17:10 12.874 system.txt
01.02.2006 17:10 121 systemtemp.txt
01.02.2006 17:09 112.160 system32.txt
01.02.2006 16:41 2 AVPCallback.log
01.02.2006 16:07 536.399.872 hiberfil.sys
01.02.2006 16:07 804.495.360 pagefile.sys
31.01.2006 16:42 1.885 smitfiles.txt
26.01.2006 13:31 147 LxDasi.Log
02.06.2005 12:07 26.501 MDacLog.txt

#4 CarstenHH

KILLBOX - Pocket KillBox
http://virus-protect.org/killbox.html

Options: Delete on Reboot --> anhaken
und klicke auf das rote Kreuz, wenn gefragt wird, ob "Do you want to reboot? "---- klicke auf "no",und kopiere das nächste rein, erst beim letzten auf "yes"
reinkopieren:

C:\WINDOWS\system32\guard.tmp
C:\WINDOWS\system32\mxexch40.dll
C:\WINDOWS\system32\irpml5711.dll
C:\WINDOWS\system32\irj2l51o1.dll
C:\WINDOWS\system32\XYerObex.dll
C:\WINDOWS\winsysupd41.dat
C:\WINDOWS\myupdates1.dat
C:\WINDOWS\drsmartload2.dat
C:\WINDOWS\uniq

PC neustarten

nach dem Neustart suche: C:\!KillBox
und loesche alle dort befindlichen Dateien manuell

Hoster.zip -> anwenden
http://www.funkytoad.com/download/hoster.zip
Press 'Restore Original Hosts' and press 'OK' Exit Program.

l2mfix.
http://virus-protect.org/l2mfix.html
klicke : Option 2--> nach Neustart+ Scan --> poste den scanreport
__________
MfG Sabina

rund um die PC-Sicherheit

#5 Hier der l2mfix-Report:

L2mfix 010406
Creating Account.
Der Befehl wurde erfolgreich ausgef�hrt.

Adding Administrative privleges.
Checking for L2MFix account(0=no 1=yes):
1
Granting SeDebugPrivilege to L2MFIX ... successful

Running From:
C:\WINDOWS\system32

Killing Processes!

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 652 'smss.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 748 'winlogon.exe'
Killing PID 748 'winlogon.exe'
Killing PID 748 'winlogon.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 1780 'explorer.exe'
Killing PID 1780 'explorer.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Error, Cannot find a process with an image name of rundll32.exe
Restoring Sedebugprivilege:
Granting SeDebugPrivilege to Administratoren ... successful

Scanning First Pass. Please Wait!

First Pass Completed

Second Pass Scanning

Second pass Completed!
Desktop.ini sucessfully removed




Restoring Windows Update Certificates.:

The following Is the Current Export of the Winlogon notify key:
****************************************************************************
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\policies]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Themes]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\irpml5711.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WRNotifier]
"Asynchronous"=dword:00000000
"DllName"="WRLogonNTF.dll"
"Impersonate"=dword:00000001
"Lock"="WRLock"
"StartScreenSaver"="WRStartScreenSaver"
"StartShell"="WRStartShell"
"Startup"="WRStartup"
"StopScreenSaver"="WRStopScreenSaver"
"Unlock"="WRUnlock"
"Shutdown"="WRShutdown"
"Logoff"="WRLogoff"
"Logon"="WRLogon"


The following are the files found:
****************************************************************************

Registry Entries that were Deleted:
Please verify that the listing looks ok.
If there was something deleted wrongly there are backups in the backreg folder.
****************************************************************************
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{B2CFA862-1099-4F3D-A56A-2A61CD050526}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{B2CFA862-1099-4F3D-A56A-2A61CD050526}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{B2CFA862-1099-4F3D-A56A-2A61CD050526}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{B2CFA862-1099-4F3D-A56A-2A61CD050526}\InprocServer32]
@="C:\\WINDOWS\\system32\\evfpixpsets.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{55B143D8-CFF7-4CD1-9B1C-F6660C7B0027}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{55B143D8-CFF7-4CD1-9B1C-F6660C7B0027}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{55B143D8-CFF7-4CD1-9B1C-F6660C7B0027}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{55B143D8-CFF7-4CD1-9B1C-F6660C7B0027}\InprocServer32]
@="C:\\WINDOWS\\system32\\XYerObex.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{427ABBAB-ACE4-492D-92EA-59485455DF06}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{427ABBAB-ACE4-492D-92EA-59485455DF06}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{427ABBAB-ACE4-492D-92EA-59485455DF06}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{427ABBAB-ACE4-492D-92EA-59485455DF06}\InprocServer32]
@="C:\\WINDOWS\\system32\\mxexch40.dll"
"ThreadingModel"="Apartment"

REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{B2CFA862-1099-4F3D-A56A-2A61CD050526}"=-
"{55B143D8-CFF7-4CD1-9B1C-F6660C7B0027}"=-
"{427ABBAB-ACE4-492D-92EA-59485455DF06}"=-
[-HKEY_CLASSES_ROOT\CLSID\{B2CFA862-1099-4F3D-A56A-2A61CD050526}]
[-HKEY_CLASSES_ROOT\CLSID\{55B143D8-CFF7-4CD1-9B1C-F6660C7B0027}]
[-HKEY_CLASSES_ROOT\CLSID\{427ABBAB-ACE4-492D-92EA-59485455DF06}]
REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"SV1"=""
****************************************************************************
Desktop.ini Contents:
****************************************************************************
[.ShellClassInfo]
CLSID={645FF040-5081-101B-9F08-00AA002F954E}
****************************************************************************
Checking for L2MFix account(0=no 1=yes):
0
Zipping up files for submission:
zip warning: name not matched: dlls\*.*

zip error: Nothing to do! (backup.zip)
adding: backregs/notibac.reg (deflated 88%)
adding: backregs/shell.reg (deflated 73%)
adding: backregs/B2CFA862-1099-4F3D-A56A-2A61CD050526.reg (deflated 70%)
adding: backregs/55B143D8-CFF7-4CD1-9B1C-F6660C7B0027.reg (deflated 70%)
adding: backregs/427ABBAB-ACE4-492D-92EA-59485455DF06.reg (deflated 70%)

#6 scanne mit SpySweeper (trial) und kopiere den scanreport
http://virus-protect.org/spysweeper.html
__________
MfG Sabina

rund um die PC-Sicherheit

#7 Spy Sweeper Scanreport

********
18:20: | Beginn der Sitzung, Mittwoch, 1. Februar 2006 |
18:20: Spy Sweeper gestartet

18:58: Gefundene Spuren: 0

#8 wunderbar...es scheint alles sauber zu sein

Dennoch: mache einen Onlinescan mit kaspersky und kopiere den scanreport
http://virus-protect.org/onlinescan.html
__________
MfG Sabina

rund um die PC-Sicherheit

#9 Ja, im Grunde schon. kaspersky hat aber noch was gefunden:

-------------------------------------------------------------------------------
KASPERSKY ON-LINE SCANNER REPORT
Wednesday, February 01, 2006 23:40:59
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky On-line Scanner version: 5.0.67.0
Kaspersky Anti-Virus database last update: 1/02/2006
Kaspersky Anti-Virus database records: 163702
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: standard
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\
E:\

Scan Statistics:
Total number of scanned objects: 83064
Number of viruses found: 4
Number of infected objects: 10
Number of suspicious objects: 2
Duration of the scan process: 4627 sec

Infected Object Name - Virus Name
C:\System Volume Information\_restore{250B27CE-5FD8-4052-9062-8FB0DED8A590}\RP492\A0051272.exe Suspicious: Type_Win32
C:\System Volume Information\_restore{250B27CE-5FD8-4052-9062-8FB0DED8A590}\RP501\A0051630.exe Infected: Trojan-Downloader.Win32.INService.gen
C:\System Volume Information\_restore{250B27CE-5FD8-4052-9062-8FB0DED8A590}\RP502\A0052184.exe Infected: Trojan-Spy.Win32.Small.dg
C:\System Volume Information\_restore{250B27CE-5FD8-4052-9062-8FB0DED8A590}\RP502\A0052185.exe Infected: Trojan-Spy.Win32.Small.dg
C:\System Volume Information\_restore{250B27CE-5FD8-4052-9062-8FB0DED8A590}\RP502\A0052186.exe Infected: Trojan-Spy.Win32.Small.dg
C:\System Volume Information\_restore{250B27CE-5FD8-4052-9062-8FB0DED8A590}\RP502\A0052187.exe Infected: Trojan-Spy.Win32.Small.dg
C:\System Volume Information\_restore{250B27CE-5FD8-4052-9062-8FB0DED8A590}\RP502\A0052188.exe Infected: Trojan-Spy.Win32.Small.dg
C:\System Volume Information\_restore{250B27CE-5FD8-4052-9062-8FB0DED8A590}\RP502\A0052189.exe Infected: Trojan-Downloader.Win32.Tiny.al
C:\System Volume Information\_restore{250B27CE-5FD8-4052-9062-8FB0DED8A590}\RP502\A0052190.exe Infected: Trojan-Downloader.Win32.Tiny.al
C:\System Volume Information\_restore{250B27CE-5FD8-4052-9062-8FB0DED8A590}\RP502\A0052191.exe Infected: Trojan-Downloader.Win32.Tiny.al
C:\System Volume Information\_restore{250B27CE-5FD8-4052-9062-8FB0DED8A590}\RP502\A0052193.exe Infected: Trojan-Downloader.Win32.Tiny.al

Scan process completed.

Es besteht dann noch folgendes Problem:

Nach Naustart zeigt der Taskmanager unter Prozesse einen Leerlaufprozeß an: CPU Auslastung bis zu 99%, Speicher 16K
Dabei permanente Festplattenzugriffe. Das geht eine gute halbe Stunde.
Das gesamte System ist während dieser Zeit fast komplett lahmgelegt.

Aber ansonsten schon mal 1000 Dank!

Wenn ich dieses Prob noch mit Deiner Hilfe in Griff bekäme, wäre es das absolute Sahnehäubchen

#10 CarstenHH

1. deinstalliere den Spysweeper wieder (er lastet das System zu sehr aus)

2. Arbeitsplatz-->Rechtsklick, dann auf Eigenschaften--->Reiter Systemwiederherstellung--->Häkchen setzen bei Systemwiederherstellung auf allen Laufwerken deaktivieren.
http://virus-protect.org/systemwiederherstellung.html

neustarten und wieder aktivieren.
--------------------------------------------------------------------------------
Dann sollte wieder alles in Ordnung sein
__________
MfG Sabina

rund um die PC-Sicherheit

#11 Hat leider nichts gebracht.

Um den Virus in den Griff zu bekommen, hatte ich neben Norton AV zusätzlich F-Prot installiert. Liegt es vielleicht daran, dass ich jetzt beide im Realtime-Scan laufen habe?

#12 ja, das kann sein... du haettest nichts weiter laden sollen, als ich angegeben hatte.
Deinstalliere den F-Prot und den spysweeper und was du sonst noch geladen hast.
__________
MfG Sabina

rund um die PC-Sicherheit