Virus - securitynetpage.net

#1 Hallo, ich habe wie viele andere auch mir den Virus eingefangen, das sich meine Startseite immer zu securitynetpage.net/ ändert und es
immer dieses erscheint "Warning W32.Myzor.FK@yf. ist a virus that infects....."" Will es nicht alleine machen, da ich meinen Rechner nicht gleich schrotten möchte. Brauche eine Idiotensichere Anleitung, da ich nicht das Genie bin.


Habe jetzt auch ein Highjack Scan gemacht.

#
# An unexpected error has been detected by HotSpot Virtual Machine:
#
# EXCEPTION_ACCESS_VIOLATION (0xc0000005) at pc=0x7c9110f3, pid=1896, tid=3504
#
# Java VM: Java HotSpot(TM) Client VM (1.5.0_06-b05 mixed mode, sharing)
# Problematic frame:
# C [ntdll.dll+0x10f3]
#

--------------- T H R E A D ---------------

Current thread (0x059b73b8): JavaThread "AWT-EventQueue-2" [_thread_in_native, id=3504]

siginfo: ExceptionCode=0xc0000005, writing address 0x05a4981c

Registers:
EAX=0x00000000, EBX=0x2b3262c8, ECX=0x0652f55c, EDX=0x05a49814
ESP=0x0652f56c, EBP=0x0652f5a4, ESI=0x05a49800, EDI=0x05a49814
EIP=0x7c9110f3, EFLAGS=0x00010246

Top of Stack: (sp=0x0652f56c)
0x0652f56c: 6d0d7ce2 05a49814 059b73b8 059b7478
0x0652f57c: 6d0c80a3 059b73b8 2aad1ec0 2b3262c8
0x0652f58c: 20e002b8 00000000 0652f580 0652fce4
0x0652f59c: 6d0f34d0 00000000 0652f5d8 030d899c
0x0652f5ac: 059b7478 0652f5e8 00000009 20e002b8
0x0652f5bc: 0652f5b4 00000000 0652f5e8 2b327238
0x0652f5cc: 00000000 2b3262c8 0652f5e8 0652f608
0x0652f5dc: 030d2923 00000000 030d6449 20e002b8

Instructions: (pc=0x7c9110f3)
0x7c9110e3: 24 00 00 00 00 90 90 90 90 90 8b 54 24 04 33 c0
0x7c9110f3: ff 4a 08 75 26 89 42 0c f0 ff 4a 04 7d 03 c2 04


Stack: [0x06430000,0x06530000), sp=0x0652f56c, free space=1021k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
C [ntdll.dll+0x10f3]
j sun.awt.windows.WComponentPeer._dispose()V+0
j sun.awt.windows.WComponentPeer.disposeImpl()V+23
j sun.awt.windows.WObjectPeer.dispose()V+42
j java.awt.Component.removeNotify()V+211
j java.awt.Container.removeNotify()V+67
j java.awt.Container.removeNotify()V+38
j java.awt.Container.removeNotify()V+38
j java.awt.Frame.removeNotify()V+51
j java.awt.Window$1DisposeAction.run()V+105
j java.awt.Window.doDispose()V+16
j java.awt.Window.dispose()V+1
j F.handleEvent(Ljava/awt/Event;)Z+168
j F.action(Ljava/awt/Event;Ljava/lang/Object;)Z+344
J java.awt.Component.handleEvent(Ljava/awt/Event;)Z
v ~RuntimeStub::alignment_frame_return Runtime1 stub
j F.handleEvent(Ljava/awt/Event;)Z+175
j java.awt.Window.postEvent(Ljava/awt/Event;)Z+2
J java.awt.Component.postEvent(Ljava/awt/Event;)Z
J java.awt.Component.postEvent(Ljava/awt/Event;)Z
J java.awt.Component.postEvent(Ljava/awt/Event;)Z
J java.awt.Component.postEvent(Ljava/awt/Event;)Z
J java.awt.Component.dispatchEventImpl(Ljava/awt/AWTEvent;)V
J java.awt.EventQueue.dispatchEvent(Ljava/awt/AWTEvent;)V
J java.awt.EventDispatchThread.pumpOneEventForHierarchy(ILjava/awt/Component;)Z
J java.awt.EventDispatchThread.pumpEventsForHierarchy(ILjava/awt/Conditional;Ljava/awt/Component;)V
v ~OSRAdapter
j java.awt.EventDispatchThread.pumpEvents(ILjava/awt/Conditional;)V+4
j java.awt.EventDispatchThread.pumpEvents(Ljava/awt/Conditional;)V+3
j java.awt.EventDispatchThread.run()V+9
v ~StubRoutines::call_stub
V [jvm.dll+0x845a9]
V [jvm.dll+0xd9317]
V [jvm.dll+0x8447a]
V [jvm.dll+0x841d7]
V [jvm.dll+0x9ed69]
V [jvm.dll+0x109fe3]
V [jvm.dll+0x109fb1]
C [msvcrt.dll+0x2a3b0]
C [kernel32.dll+0xb50b]

Java frames: (J=compiled Java code, j=interpreted, Vv=VM code)
j sun.awt.windows.WComponentPeer._dispose()V+0
j sun.awt.windows.WComponentPeer.disposeImpl()V+23
j sun.awt.windows.WObjectPeer.dispose()V+42
j java.awt.Component.removeNotify()V+211
j java.awt.Container.removeNotify()V+67
j java.awt.Container.removeNotify()V+38
j java.awt.Container.removeNotify()V+38
j java.awt.Frame.removeNotify()V+51
j java.awt.Window$1DisposeAction.run()V+105
j java.awt.Window.doDispose()V+16
j java.awt.Window.dispose()V+1
j F.handleEvent(Ljava/awt/Event;)Z+168
j F.action(Ljava/awt/Event;Ljava/lang/Object;)Z+344
J java.awt.Component.handleEvent(Ljava/awt/Event;)Z
v ~RuntimeStub::alignment_frame_return Runtime1 stub
j F.handleEvent(Ljava/awt/Event;)Z+175
j java.awt.Window.postEvent(Ljava/awt/Event;)Z+2
J java.awt.Component.postEvent(Ljava/awt/Event;)Z
J java.awt.Component.postEvent(Ljava/awt/Event;)Z
J java.awt.Component.postEvent(Ljava/awt/Event;)Z
J java.awt.Component.postEvent(Ljava/awt/Event;)Z
J java.awt.Component.dispatchEventImpl(Ljava/awt/AWTEvent;)V
J java.awt.EventQueue.dispatchEvent(Ljava/awt/AWTEvent;)V
J java.awt.EventDispatchThread.pumpOneEventForHierarchy(ILjava/awt/Component;)Z
J java.awt.EventDispatchThread.pumpEventsForHierarchy(ILjava/awt/Conditional;Ljava/awt/Component;)V
v ~OSRAdapter
j java.awt.EventDispatchThread.pumpEvents(ILjava/awt/Conditional;)V+4
j java.awt.EventDispatchThread.pumpEvents(Ljava/awt/Conditional;)V+3
j java.awt.EventDispatchThread.run()V+9
v ~StubRoutines::call_stub

--------------- P R O C E S S ---------------

Java Threads: ( => current thread )
0x059991e8 JavaThread "Thread-6" [_thread_in_native, id=764]
0x068cfb60 JavaThread "Thread-5" [_thread_blocked, id=3188]
0x0599ae88 JavaThread "Image Animator 0" daemon [_thread_blocked, id=3116]
=>0x059b73b8 JavaThread "AWT-EventQueue-2" [_thread_in_native, id=3504]
0x059b78a0 JavaThread "thread applet-GroupChat.class" [_thread_blocked, id=2936]
0x0599e6c0 JavaThread "AWT-EventQueue-0" [_thread_blocked, id=1800]
0x059803f0 JavaThread "traceMsgQueueThread" daemon [_thread_blocked, id=2988]
0x05953930 JavaThread "AWT-Windows" daemon [_thread_in_native, id=1200]
0x05953508 JavaThread "AWT-Shutdown" [_thread_blocked, id=1500]
0x0597c0e8 JavaThread "Java2D Disposer" daemon [_thread_blocked, id=2344]
0x028a3a30 JavaThread "Low Memory Detector" daemon [_thread_blocked, id=3072]
0x028a2600 JavaThread "CompilerThread0" daemon [_thread_blocked, id=2156]
0x028a19a8 JavaThread "Signal Dispatcher" daemon [_thread_blocked, id=264]
0x0289caa0 JavaThread "Finalizer" daemon [_thread_blocked, id=2932]
0x0286f1d8 JavaThread "Reference Handler" daemon [_thread_blocked, id=2488]
0x027f5330 JavaThread "main" [_thread_in_native, id=1364]

Other Threads:
0x0033bbd0 VMThread [id=3252]
0x0033bee0 WatcherThread [id=348]

VM state:not at safepoint (normal execution)

VM Mutex/Monitor currently owned by a thread: None

Heap
def new generation total 4224K, used 768K [0x20a50000, 0x20ee0000, 0x211b0000)
eden space 3776K, 18% used [0x20a50000, 0x20b00d60, 0x20e00000)
from space 448K, 13% used [0x20e00000, 0x20e0f308, 0x20e70000)
to space 448K, 0% used [0x20e70000, 0x20e70000, 0x20ee0000)
tenured generation total 55368K, used 34797K [0x211b0000, 0x247c2000, 0x26a50000)
the space 55368K, 62% used [0x211b0000, 0x233ab610, 0x233ab800, 0x247c2000)
compacting perm gen total 8192K, used 1891K [0x26a50000, 0x27250000, 0x2aa50000)
the space 8192K, 23% used [0x26a50000, 0x26c28f80, 0x26c29000, 0x27250000)
ro space 8192K, 63% used [0x2aa50000, 0x2af5b178, 0x2af5b200, 0x2b250000)
rw space 12288K, 46% used [0x2b250000, 0x2b7e9fa8, 0x2b7ea000, 0x2be50000)

Dynamic libraries:
0x00400000 - 0x00419000 C:\Programme\Internet Explorer\IEXPLORE.EXE
0x7c910000 - 0x7c9c7000 C:\WINDOWS\system32\ntdll.dll
0x7c800000 - 0x7c906000 C:\WINDOWS\system32\kernel32.dll
0x77be0000 - 0x77c38000 C:\WINDOWS\system32\msvcrt.dll
0x77d10000 - 0x77da0000 C:\WINDOWS\system32\USER32.dll
0x77ef0000 - 0x77f37000 C:\WINDOWS\system32\GDI32.dll
0x77f40000 - 0x77fb6000 C:\WINDOWS\system32\SHLWAPI.dll
0x77da0000 - 0x77e4a000 C:\WINDOWS\system32\ADVAPI32.dll
0x77e50000 - 0x77ee1000 C:\WINDOWS\system32\RPCRT4.dll
0x77730000 - 0x7789f000 C:\WINDOWS\system32\SHDOCVW.dll
0x77a50000 - 0x77ae5000 C:\WINDOWS\system32\CRYPT32.dll
0x77af0000 - 0x77b02000 C:\WINDOWS\system32\MSASN1.dll
0x76880000 - 0x76905000 C:\WINDOWS\system32\CRYPTUI.dll
0x76bf0000 - 0x76c1e000 C:\WINDOWS\system32\WINTRUST.dll
0x76c50000 - 0x76c78000 C:\WINDOWS\system32\IMAGEHLP.dll
0x770f0000 - 0x7717c000 C:\WINDOWS\system32\OLEAUT32.dll
0x774b0000 - 0x775ed000 C:\WINDOWS\system32\ole32.dll
0x597d0000 - 0x59824000 C:\WINDOWS\system32\NETAPI32.dll
0x77180000 - 0x77227000 C:\WINDOWS\system32\WININET.dll
0x76f20000 - 0x76f4d000 C:\WINDOWS\system32\WLDAP32.dll
0x77bd0000 - 0x77bd8000 C:\WINDOWS\system32\VERSION.dll
0x773a0000 - 0x774a2000 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll
0x7c9d0000 - 0x7d1ef000 C:\WINDOWS\system32\SHELL32.dll
0x5d450000 - 0x5d4e7000 C:\WINDOWS\system32\comctl32.dll
0x5b0f0000 - 0x5b128000 C:\WINDOWS\system32\uxtheme.dll
0x746a0000 - 0x746eb000 C:\WINDOWS\system32\MSCTF.dll
0x75f20000 - 0x7601d000 C:\WINDOWS\system32\BROWSEUI.dll
0x20000000 - 0x20013000 C:\WINDOWS\system32\browselc.dll
0x77b10000 - 0x77b32000 C:\WINDOWS\system32\appHelp.dll
0x76f90000 - 0x7700f000 C:\WINDOWS\system32\CLBCATQ.DLL
0x77010000 - 0x770e3000 C:\WINDOWS\system32\COMRes.dll
0x77230000 - 0x772d0000 C:\WINDOWS\system32\urlmon.dll
0x77fc0000 - 0x77fd1000 C:\WINDOWS\system32\Secur32.dll
0x779f0000 - 0x77a46000 C:\WINDOWS\System32\cscui.dll
0x765a0000 - 0x765bd000 C:\WINDOWS\System32\CSCDLL.dll
0x778f0000 - 0x779e4000 C:\WINDOWS\system32\SETUPAPI.dll
0x10000000 - 0x1000a000 C:\Programme\Media-Codec\iesplugin.dll
0x01370000 - 0x013fe000 C:\WINDOWS\system32\shdoclc.dll
0x01600000 - 0x0160e000 C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
0x7c340000 - 0x7c396000 C:\WINDOWS\system32\MSVCR71.dll
0x01650000 - 0x01656000 C:\Programme\Media-Codec\isaddon.dll
0x6d600000 - 0x6d62d000 C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
0x5f1a0000 - 0x5f1b7000 C:\WINDOWS\system32\OLEPRO32.DLL
0x7dbe0000 - 0x7ded4000 C:\WINDOWS\system32\mshtml.dll
0x74640000 - 0x74667000 C:\WINDOWS\system32\msls31.dll
0x76bb0000 - 0x76bbb000 C:\WINDOWS\system32\PSAPI.DLL
0x76970000 - 0x76a21000 C:\WINDOWS\system32\SXS.DLL
0x01a90000 - 0x01d69000 C:\WINDOWS\system32\xpsp2res.dll
0x74670000 - 0x7469a000 C:\WINDOWS\system32\msimtf.dll
0x76330000 - 0x7634d000 C:\WINDOWS\system32\IMM32.DLL
0x6bd10000 - 0x6bd24000 C:\Programme\Microsoft Office\Office12\msohev.dll
0x78130000 - 0x781cb000 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.91_x-ww_0de56c07\MSVCR80.dll
0x75dc0000 - 0x75e51000 C:\WINDOWS\system32\MLANG.dll
0x71a30000 - 0x71a3a000 C:\WINDOWS\system32\wsock32.dll
0x71a10000 - 0x71a27000 C:\WINDOWS\system32\WS2_32.dll
0x71a00000 - 0x71a08000 C:\WINDOWS\system32\WS2HELP.dll
0x719b0000 - 0x719f0000 C:\WINDOWS\system32\mswsock.dll
0x76ea0000 - 0x76edc000 C:\WINDOWS\system32\RASAPI32.DLL
0x76e50000 - 0x76e62000 C:\WINDOWS\system32\rasman.dll
0x76e70000 - 0x76e9f000 C:\WINDOWS\system32\TAPI32.dll
0x76e40000 - 0x76e4e000 C:\WINDOWS\system32\rtutils.dll
0x76af0000 - 0x76b1e000 C:\WINDOWS\system32\WINMM.dll
0x6bd00000 - 0x6bd0d000 C:\WINDOWS\system32\SYNCOR11.DLL
0x66710000 - 0x66769000 C:\WINDOWS\system32\hnetcfg.dll
0x719f0000 - 0x719f8000 C:\WINDOWS\System32\wshtcpip.dll
0x77c40000 - 0x77c63000 C:\WINDOWS\system32\msv1_0.dll
0x76d20000 - 0x76d39000 C:\WINDOWS\system32\iphlpapi.dll
0x72240000 - 0x72245000 C:\WINDOWS\system32\sensapi.dll
0x76620000 - 0x766d5000 C:\WINDOWS\system32\USERENV.dll
0x76ee0000 - 0x76f07000 C:\WINDOWS\system32\DNSAPI.dll
0x76f80000 - 0x76f86000 C:\WINDOWS\system32\rasadhlp.dll
0x75bf0000 - 0x75c5e000 C:\WINDOWS\system32\jscript.dll
0x73270000 - 0x732d7000 C:\WINDOWS\system32\vbscript.dll
0x73d30000 - 0x73e2e000 C:\WINDOWS\system32\MFC42.DLL
0x61dc0000 - 0x61dce000 C:\WINDOWS\system32\MFC42LOC.DLL
0x02c40000 - 0x02dd4000 C:\WINDOWS\system32\Macromed\Flash\Flash.ocx
0x76350000 - 0x7639a000 C:\WINDOWS\system32\comdlg32.dll
0x72c90000 - 0x72c99000 C:\WINDOWS\system32\wdmaud.drv
0x72c80000 - 0x72c88000 C:\WINDOWS\system32\msacm32.drv
0x77bb0000 - 0x77bc5000 C:\WINDOWS\system32\MSACM32.dll
0x77ba0000 - 0x77ba7000 C:\WINDOWS\system32\midimap.dll
0x6d590000 - 0x6d5a2000 C:\Programme\Java\jre1.5.0_06\bin\npjpi150_06.dll
0x6d400000 - 0x6d417000 C:\Programme\Java\jre1.5.0_06\bin\jpiexp32.dll
0x76f70000 - 0x76f78000 C:\WINDOWS\System32\winrnr.dll
0x6d450000 - 0x6d468000 C:\Programme\Java\jre1.5.0_06\bin\jpishare.dll
0x6d670000 - 0x6d804000 C:\PROGRA~1\Java\JRE15~1.0_0\bin\client\jvm.dll
0x6d280000 - 0x6d288000 C:\PROGRA~1\Java\JRE15~1.0_0\bin\hpi.dll
0x6d640000 - 0x6d64c000 C:\PROGRA~1\Java\JRE15~1.0_0\bin\verify.dll
0x6d300000 - 0x6d31d000 C:\PROGRA~1\Java\JRE15~1.0_0\bin\java.dll
0x6d660000 - 0x6d66f000 C:\PROGRA~1\Java\JRE15~1.0_0\bin\zip.dll
0x6d000000 - 0x6d167000 C:\Programme\Java\jre1.5.0_06\bin\awt.dll
0x72f70000 - 0x72f96000 C:\WINDOWS\system32\WINSPOOL.DRV
0x736d0000 - 0x73719000 C:\WINDOWS\system32\ddraw.dll
0x73b30000 - 0x73b36000 C:\WINDOWS\system32\DCIMAN32.dll
0x738b0000 - 0x73980000 C:\WINDOWS\system32\D3DIM700.DLL
0x6d240000 - 0x6d27d000 C:\Programme\Java\jre1.5.0_06\bin\fontmanager.dll
0x6d1f0000 - 0x6d203000 C:\Programme\Java\jre1.5.0_06\bin\deploy.dll
0x6d5d0000 - 0x6d5ef000 C:\Programme\Java\jre1.5.0_06\bin\RegUtils.dll
0x06060000 - 0x06326000 C:\WINDOWS\system32\msi.dll
0x6d3e0000 - 0x6d3f5000 C:\Programme\Java\jre1.5.0_06\bin\jpicom32.dll
0x06530000 - 0x06538000 C:\WINDOWS\system32\xpsp3res.dll
0x6d4c0000 - 0x6d4d3000 C:\Programme\Java\jre1.5.0_06\bin\net.dll
0x6d4e0000 - 0x6d4e9000 C:\Programme\Java\jre1.5.0_06\bin\nio.dll
0x6d910000 - 0x6d91a000 C:\WINDOWS\system32\ddrawex.dll
0x71cc0000 - 0x71cdc000 C:\WINDOWS\system32\actxprxy.dll
0x66d10000 - 0x66d1c000 C:\WINDOWS\system32\ImgUtil.dll
0x5e6e0000 - 0x5e6ec000 C:\WINDOWS\system32\pngfilt.dll

VM Arguments:
jvm_args: -Xbootclasspath/a:C:\PROGRA~1\Java\JRE15~1.0_0\lib\deploy.jar;C:\PROGRA~1\Java\JRE15~1.0_0\lib\plugin.jar -Xmx96m -Djavaplugin.maxHeapSize=96m -Xverify:remote -Djavaplugin.version=1.5.0_06 -Djavaplugin.nodotversion=150_06 -Dbrowser=sun.plugin -DtrustProxy=true -Dapplication.home=C:\PROGRA~1\Java\JRE15~1.0_0 -Djava.protocol.handler.pkgs=sun.plugin.net.protocol -Djavaplugin.vm.options=-Djava.class.path=C:\PROGRA~1\Java\JRE15~1.0_0\classes -Xbootclasspath/a:C:\PROGRA~1\Java\JRE15~1.0_0\lib\deploy.jar;C:\PROGRA~1\Java\JRE15~1.0_0\lib\plugin.jar -Xmx96m -Djavaplugin.maxHeapSize=96m -Xverify:remote -Djavaplugin.version=1.5.0_06 -Djavaplugin.nodotversion=150_06 -Dbrowser=sun.plugin -DtrustProxy=true -Dapplication.home=C:\PROGRA~1\Java\JRE15~1.0_0 -Djava.protocol.handler.pkgs=sun.plugin.net.protocol vfprintf
java_command: <unknown>
Launcher Type: generic

Environment Variables:
CLASSPATH=.;C:\Programme\Java\jre1.5.0_06\lib\ext\QTJava.zip
PATH=C:\PROGRA~1\Java\JRE15~1.0_0\bin;C:\Programme\Internet Explorer;;C:\Programme\QuickTime\QTSystem\;.
USERNAME=Michael
OS=Windows_NT
PROCESSOR_IDENTIFIER=x86 Family 15 Model 3 Stepping 3, GenuineIntel



--------------- S Y S T E M ---------------

OS: Windows XP Build 2600 Service Pack 2

CPU:total 1 family 15, cmov, cx8, fxsr, mmx, sse, sse2, ht

Memory: 4k page, physical 523504k(82528k free), swap 1279956k(822112k free)

vm_info: Java HotSpot(TM) Client VM (1.5.0_06-b05) for windows-x86, built on Nov 10 2005 11:12:14 by "java_re" with MS VC++ 6.0

________________________________________________________________

Was muss ich jetzt weiter tun damit dieser Virus endlich runter fliegt.
bitte ich brauche echt hilfe

#2 mit deinem HijackThis kan ich nicht (viel) anfangen:

Hijackthis --
http://computercops.biz/zx/Merijn/hijackthis.zip
http://virus-protect.org/hjtkurz.html
Lade/entpacke HijackThis in einem Ordner
--> None of the above just start the program --> Save--> Savelog -->es öffnet sich der Editor
nun das KOMPLETTE Log mit rechtem Mausklick abkopieren und ins Forum mit rechtem Mausklick "einfügen"

poste das log
http://virus-protect.org/artikel/tools/combofix.html

stelle den CleanUp genauso ein, wie hier angegeben:
http://virus-protect.org/cleanup.html

Kopiere diese 4 Textdateien ab . (rechtsklick mit der Maus -> den Text markieren -> kopieren -> einfügen) Sie sind nach Datum geordnet. (kopiere nur die letzten 3 Monate ab)
http://virus-protect.org/datfindbat.html
__________
MfG Sabina

rund um die PC-Sicherheit

#3 Hier das highjack logfile

Logfile of HijackThis v1.99.1
Scan saved at 16:15:44, on 07.09.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\AntiVirenKit InternetSecurity\AVKTray\AVKTray.exe
C:\Programme\iTunes\iTunesHelper.exe
C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
C:\Programme\CyberLink\PowerDVD\PDVDServ.exe
C:\Programme\Gemeinsame Dateien\G DATA\AVKProxy\AVKProxy.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\AntiVirenKit InternetSecurity\AVK\AVKService.exe
C:\Programme\AntiVirenKit InternetSecurity\AVK\AVKWCtl.exe
C:\Programme\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Programme\iPod\bin\iPodService.exe
C:\Programme\Internet Explorer\IEXPLORE.EXE
C:\DOKUME~1\Michael\LOKALE~1\Temp\Rar$EX00.234\HijackThis.exe

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {202a961f-23ae-42b1-9505-ffe3c818d717} - C:\Programme\Media-Codec\isaddon.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: Protection Bar - {fe2d25c1-c1db-4b5e-9390-af1cb5302f32} - C:\Programme\Media-Codec\iesplugin.dll (file missing)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [AVKTray] "C:\Programme\AntiVirenKit InternetSecurity\AVKTray\AVKTray.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programme\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [RemoteControl] C:\Programme\CyberLink\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programme\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Windows Registry Repair Pro] C:\Programme\3B Software\Windows Registry Repair Pro\RegistryRepairPro.exe 4
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1154543235068
O17 - HKLM\System\CCS\Services\Tcpip\..\{C7C97A14-6CE8-498A-B6C4-A86DAA557844}: NameServer = 192.168.0.234,154.15.251.134
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AVKProxy - G DATA Software AG - C:\Programme\Gemeinsame Dateien\G DATA\AVKProxy\AVKProxy.exe
O23 - Service: AVK Service (AVKService) - Unknown owner - C:\Programme\AntiVirenKit InternetSecurity\AVK\AVKService.exe
O23 - Service: AVK Wächter (AVKWCtl) - Unknown owner - C:\Programme\AntiVirenKit InternetSecurity\AVK\AVKWCtl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programme\Analog Devices\SoundMAX\SMAgent.exe

#4 ttmeister5

0.
poste das log
http://virus-protect.org/artikel/tools/combofix.html

1.
mediacodec.zip laden -> http://virus-protect.org/zip/mediacodec.zip entpacken auf dem Desktop -> mediacodec.reg ->doppeltklicken und der Registry mit "ja/yes" beifügen

2.
Avenger
http://virus-protect.org/artikel/tools/avenger.html
kopiere rein:

Zitat

Files to delete:
C:\Programme\Media-Codec\isaddon.dll
C:\Programme\Media-Codec\isamini.exe
C:\Programme\Media-Codec\isamonitor.exe
C:\Programme\Media-Codec\isauninst.exe
C:\Programme\Media-Codec\iesplugin.dll
C:\Programme\Media-Codec\ot.ico
C:\Programme\Media-Codec\ts.ico
C:\Programme\Media-Codec\pmmon.exe
C:\Programme\Media-Codec\pmsngr.exe
C:\Programme\Media-Codec\pmuninst.exe
C:\Programme\Media-Codec\uninst.exe
C:\Programme\Media-Codec\ecodec.exe

Folders to delete:
C:\Programme\Media-Codec

Klicke die gruene Ampel
das Script wird nun ausgeführt, dann wird der PC automatisch neustarten

3.
scanne mit smitfraudfix
http://virus-protect.org/artikel/tools/smitfrautfix.html

4.
öffne das HijackThis -- Button "scan" -- vor die Malware-Einträge Häkchen setzen -- Button "Fix checked" -- PC neustarten

Zitat

O2 - BHO: (no name) - {202a961f-23ae-42b1-9505-ffe3c818d717} - C:\Programme\Media-Codec\isaddon.dll
O3 - Toolbar: Protection Bar - {fe2d25c1-c1db-4b5e-9390-af1cb5302f32} - C:\Programme\Media-Codec\iesplugin.dll (file missing)

__________
MfG Sabina

rund um die PC-Sicherheit

#5 Danke, habe den Virus runtergekriegt, aber irgendwie anders.
msn gelöscht und noch was anderes.

trozdem danke für die schnelle hilfe

#6

Zitat

msn gelöscht und noch was anderes.

na..du musst es wissen...die Anweisungen zum Loeschen vom Virus habe ich genau gegeben, wenn du sie nicht anwendest, und wahllos rumloeschst, so ist es dein Problem.
__________
MfG Sabina

rund um die PC-Sicherheit

#7 Hat aber geklappt, bis jetzt ist der Virus weg, und mein Virenprogramm zeigt mir auch nichts mehr an, also muss es ja geklappt haben, da mir davor immer viren angezeigt worden sind.

mfg