TR/Vundo.Gen (geht nicht weg, nervt, grr! ;))

#16 1. scanreport (ich weiß nicht ob das der richtige ist, es ist nicht wirklich einer gekommen, ich hab jetzt mal rumgesucht und jetzt gibts einen "scan log" -->

SUPERAntiSpyware Scan Log
Generated 09/15/2006 at 06:00 PM

Core Rules Database Version : 3083
Trace Rules Database Version: 1115

Memory Thread detected : 0
Registry Thread detected : 106
File Thread detected : 25

Adware.IST/YourSiteBar
HKLM\Software\Classes\CLSID\{86227D9C-0EFE-4f8a-AA55-30386A3F5686}
HKCR\CLSID\{86227D9C-0EFE-4f8a-AA55-30386A3F5686}
HKCR\CLSID\{86227D9C-0EFE-4f8a-AA55-30386A3F5686}
HKCR\CLSID\{86227D9C-0EFE-4f8a-AA55-30386A3F5686}\Implemented Categories
HKCR\CLSID\{86227D9C-0EFE-4f8a-AA55-30386A3F5686}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}
HKCR\CLSID\{86227D9C-0EFE-4f8a-AA55-30386A3F5686}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}
HKCR\CLSID\{86227D9C-0EFE-4f8a-AA55-30386A3F5686}\InprocServer32
HKCR\CLSID\{86227D9C-0EFE-4f8a-AA55-30386A3F5686}\InprocServer32#ThreadingModel
HKCR\CLSID\{86227D9C-0EFE-4f8a-AA55-30386A3F5686}\ProgID
HKCR\CLSID\{86227D9C-0EFE-4f8a-AA55-30386A3F5686}\Programmable
HKCR\CLSID\{86227D9C-0EFE-4f8a-AA55-30386A3F5686}\TypeLib
HKCR\CLSID\{86227D9C-0EFE-4f8a-AA55-30386A3F5686}\VersionIndependentProgID
C:\PROGRA~1\YOURSI~1\ysb.dll
HKU\S-1-5-21-1409082233-117609710-725345543-1006\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser#{86227D9C-0EFE-4F8A-AA55-30386A3F5686}
HKCR\Ysb.YsbObj.1
HKCR\Ysb.YsbObj
HKCR\TypeLib\{86227D9C-0EFE-4f8a-AA55-30386A3F5686}

Adware.WhenU
C:\Programme\Save\SaveNowupdate.exe
C:\Programme\Save
C:\System Volume Information\_restore{1E7DE658-4200-4403-BDB0-5CD040566E68}\RP525\A0133464.exe
C:\System Volume Information\_restore{1E7DE658-4200-4403-BDB0-5CD040566E68}\RP525\A0133465.exe
C:\System Volume Information\_restore{1E7DE658-4200-4403-BDB0-5CD040566E68}\RP528\A0133512.exe
C:\System Volume Information\_restore{1E7DE658-4200-4403-BDB0-5CD040566E68}\RP528\A0133513.exe
C:\System Volume Information\_restore{1E7DE658-4200-4403-BDB0-5CD040566E68}\RP528\A0133514.exe
C:\System Volume Information\_restore{1E7DE658-4200-4403-BDB0-5CD040566E68}\RP528\A0133583.exe

Adware.Avenue Media/Internet Optimizer
HKU\S-1-5-21-1409082233-117609710-725345543-1006\Software\Microsoft\Internet Explorer\URLSearchHooks#_{CFBFAE00-17A6-11D0-99CB-00C04FD64497}

Trojan.Malware
HKCR\MezziaCodec.Chl
HKCR\MezziaCodec.Chl\CLSID

Malware.SpywareQuake
C:\Programme\SpyQuake2.com\ignored.lst
C:\Programme\SpyQuake2.com\ref.dat
C:\Programme\SpyQuake2.com\Spy-Quake2.exe
C:\Programme\SpyQuake2.com\sq.ini
C:\Programme\SpyQuake2.com
HKCR\TypeLib\{5E05EA9F-1EA7-4D0B-A09B-D5E29EC758B9}
HKCR\TypeLib\{5E05EA9F-1EA7-4D0B-A09B-D5E29EC758B9}\1.0
HKCR\TypeLib\{5E05EA9F-1EA7-4D0B-A09B-D5E29EC758B9}\1.0\0
HKCR\TypeLib\{5E05EA9F-1EA7-4D0B-A09B-D5E29EC758B9}\1.0\0\win32
HKCR\TypeLib\{5E05EA9F-1EA7-4D0B-A09B-D5E29EC758B9}\1.0\FLAGS
HKCR\TypeLib\{5E05EA9F-1EA7-4D0B-A09B-D5E29EC758B9}\1.0\HELPDIR
HKCR\Interface\{2DD8D482-8F1C-4180-AA8E-9D5819E5F2EA}
HKCR\Interface\{2DD8D482-8F1C-4180-AA8E-9D5819E5F2EA}\ProxyStubClsid
HKCR\Interface\{2DD8D482-8F1C-4180-AA8E-9D5819E5F2EA}\ProxyStubClsid32
HKCR\Interface\{2DD8D482-8F1C-4180-AA8E-9D5819E5F2EA}\TypeLib
HKCR\Interface\{2DD8D482-8F1C-4180-AA8E-9D5819E5F2EA}\TypeLib#Version
HKCR\Interface\{411F83B1-A0EC-4155-AF99-0137F5EFB270}
HKCR\Interface\{411F83B1-A0EC-4155-AF99-0137F5EFB270}\ProxyStubClsid
HKCR\Interface\{411F83B1-A0EC-4155-AF99-0137F5EFB270}\ProxyStubClsid32
HKCR\Interface\{411F83B1-A0EC-4155-AF99-0137F5EFB270}\TypeLib
HKCR\Interface\{411F83B1-A0EC-4155-AF99-0137F5EFB270}\TypeLib#Version
HKCR\Interface\{4E3645AF-7A81-4F83-9B8C-1E4F930D873F}
HKCR\Interface\{4E3645AF-7A81-4F83-9B8C-1E4F930D873F}\ProxyStubClsid
HKCR\Interface\{4E3645AF-7A81-4F83-9B8C-1E4F930D873F}\ProxyStubClsid32
HKCR\Interface\{4E3645AF-7A81-4F83-9B8C-1E4F930D873F}\TypeLib
HKCR\Interface\{4E3645AF-7A81-4F83-9B8C-1E4F930D873F}\TypeLib#Version
HKCR\Interface\{61032A65-2371-4C89-B5BB-DF73090FB5EA}
HKCR\Interface\{61032A65-2371-4C89-B5BB-DF73090FB5EA}\ProxyStubClsid
HKCR\Interface\{61032A65-2371-4C89-B5BB-DF73090FB5EA}\ProxyStubClsid32
HKCR\Interface\{61032A65-2371-4C89-B5BB-DF73090FB5EA}\TypeLib
HKCR\Interface\{61032A65-2371-4C89-B5BB-DF73090FB5EA}\TypeLib#Version
HKCR\Interface\{66189AF2-7726-46E8-8628-0F95AB854792}
HKCR\Interface\{66189AF2-7726-46E8-8628-0F95AB854792}\ProxyStubClsid
HKCR\Interface\{66189AF2-7726-46E8-8628-0F95AB854792}\ProxyStubClsid32
HKCR\Interface\{66189AF2-7726-46E8-8628-0F95AB854792}\TypeLib
HKCR\Interface\{66189AF2-7726-46E8-8628-0F95AB854792}\TypeLib#Version
HKCR\Interface\{7A2F6251-6C99-4DA5-9827-954EB45DCB82}
HKCR\Interface\{7A2F6251-6C99-4DA5-9827-954EB45DCB82}\ProxyStubClsid
HKCR\Interface\{7A2F6251-6C99-4DA5-9827-954EB45DCB82}\ProxyStubClsid32
HKCR\Interface\{7A2F6251-6C99-4DA5-9827-954EB45DCB82}\TypeLib
HKCR\Interface\{7A2F6251-6C99-4DA5-9827-954EB45DCB82}\TypeLib#Version
HKCR\Interface\{82C6C396-DD7B-4CE5-B668-C0087D1F3A1F}
HKCR\Interface\{82C6C396-DD7B-4CE5-B668-C0087D1F3A1F}\ProxyStubClsid
HKCR\Interface\{82C6C396-DD7B-4CE5-B668-C0087D1F3A1F}\ProxyStubClsid32
HKCR\Interface\{82C6C396-DD7B-4CE5-B668-C0087D1F3A1F}\TypeLib
HKCR\Interface\{82C6C396-DD7B-4CE5-B668-C0087D1F3A1F}\TypeLib#Version
HKCR\Interface\{853E0D78-F4C2-47CB-A3F5-A774DA60DFCD}
HKCR\Interface\{853E0D78-F4C2-47CB-A3F5-A774DA60DFCD}\ProxyStubClsid
HKCR\Interface\{853E0D78-F4C2-47CB-A3F5-A774DA60DFCD}\ProxyStubClsid32
HKCR\Interface\{853E0D78-F4C2-47CB-A3F5-A774DA60DFCD}\TypeLib
HKCR\Interface\{853E0D78-F4C2-47CB-A3F5-A774DA60DFCD}\TypeLib#Version
HKCR\Interface\{94786C47-EB3F-4BD5-A66B-0D49E2C90541}
HKCR\Interface\{94786C47-EB3F-4BD5-A66B-0D49E2C90541}\ProxyStubClsid
HKCR\Interface\{94786C47-EB3F-4BD5-A66B-0D49E2C90541}\ProxyStubClsid32
HKCR\Interface\{94786C47-EB3F-4BD5-A66B-0D49E2C90541}\TypeLib
HKCR\Interface\{94786C47-EB3F-4BD5-A66B-0D49E2C90541}\TypeLib#Version
HKCR\Interface\{9989A9BC-9828-467E-AF06-E3B279E6E97B}
HKCR\Interface\{9989A9BC-9828-467E-AF06-E3B279E6E97B}\ProxyStubClsid
HKCR\Interface\{9989A9BC-9828-467E-AF06-E3B279E6E97B}\ProxyStubClsid32
HKCR\Interface\{9989A9BC-9828-467E-AF06-E3B279E6E97B}\TypeLib
HKCR\Interface\{9989A9BC-9828-467E-AF06-E3B279E6E97B}\TypeLib#Version
HKCR\Interface\{B2B3702A-5425-489E-A3AF-EDCCAFEBA019}
HKCR\Interface\{B2B3702A-5425-489E-A3AF-EDCCAFEBA019}\ProxyStubClsid
HKCR\Interface\{B2B3702A-5425-489E-A3AF-EDCCAFEBA019}\ProxyStubClsid32
HKCR\Interface\{B2B3702A-5425-489E-A3AF-EDCCAFEBA019}\TypeLib
HKCR\Interface\{B2B3702A-5425-489E-A3AF-EDCCAFEBA019}\TypeLib#Version
HKCR\Interface\{C1C56112-2B2E-4D3C-8CFC-7E10C77FACEF}
HKCR\Interface\{C1C56112-2B2E-4D3C-8CFC-7E10C77FACEF}\ProxyStubClsid
HKCR\Interface\{C1C56112-2B2E-4D3C-8CFC-7E10C77FACEF}\ProxyStubClsid32
HKCR\Interface\{C1C56112-2B2E-4D3C-8CFC-7E10C77FACEF}\TypeLib
HKCR\Interface\{C1C56112-2B2E-4D3C-8CFC-7E10C77FACEF}\TypeLib#Version
HKCR\Interface\{D01D4AAB-22C5-427F-A941-C4B65A3D8A23}
HKCR\Interface\{D01D4AAB-22C5-427F-A941-C4B65A3D8A23}\ProxyStubClsid
HKCR\Interface\{D01D4AAB-22C5-427F-A941-C4B65A3D8A23}\ProxyStubClsid32
HKCR\Interface\{D01D4AAB-22C5-427F-A941-C4B65A3D8A23}\TypeLib
HKCR\Interface\{D01D4AAB-22C5-427F-A941-C4B65A3D8A23}\TypeLib#Version
HKCR\Interface\{DDB0D689-FAE0-4165-9F7C-877602F9DD66}
HKCR\Interface\{DDB0D689-FAE0-4165-9F7C-877602F9DD66}\ProxyStubClsid
HKCR\Interface\{DDB0D689-FAE0-4165-9F7C-877602F9DD66}\ProxyStubClsid32
HKCR\Interface\{DDB0D689-FAE0-4165-9F7C-877602F9DD66}\TypeLib
HKCR\Interface\{DDB0D689-FAE0-4165-9F7C-877602F9DD66}\TypeLib#Version
HKCR\Interface\{E5AD5BD5-C710-45E0-ABD3-E770FE85DAE8}
HKCR\Interface\{E5AD5BD5-C710-45E0-ABD3-E770FE85DAE8}\ProxyStubClsid
HKCR\Interface\{E5AD5BD5-C710-45E0-ABD3-E770FE85DAE8}\ProxyStubClsid32
HKCR\Interface\{E5AD5BD5-C710-45E0-ABD3-E770FE85DAE8}\TypeLib
HKCR\Interface\{E5AD5BD5-C710-45E0-ABD3-E770FE85DAE8}\TypeLib#Version
HKCR\Interface\{EB5CA3AF-26C1-467B-9A55-2820E0451AAB}
HKCR\Interface\{EB5CA3AF-26C1-467B-9A55-2820E0451AAB}\ProxyStubClsid
HKCR\Interface\{EB5CA3AF-26C1-467B-9A55-2820E0451AAB}\ProxyStubClsid32
HKCR\Interface\{EB5CA3AF-26C1-467B-9A55-2820E0451AAB}\TypeLib
HKCR\Interface\{EB5CA3AF-26C1-467B-9A55-2820E0451AAB}\TypeLib#Version
C:\System Volume Information\_restore{1E7DE658-4200-4403-BDB0-5CD040566E68}\RP528\A0133614.exe

Adware.MyWay
HKLM\Software\MyWay

Trojan.WinAntiSpyware/WinAntiVirus 2006
C:\Dokumente und Einstellungen\Alischa\Desktop\WinAntiVirusPro2006FreeInstall_de.exe
C:\WINDOWS\Downloaded Program Files\CONFLICT.1\UWA6PU_0001_N91M2107NetInstaller.exe
C:\WINDOWS\Downloaded Program Files\CONFLICT.2\UWA6PU_0001_N91M2107NetInstaller.exe
C:\WINDOWS\Downloaded Program Files\CONFLICT.3\UWA6PU_0001_N91M2107NetInstaller.exe
C:\WINDOWS\Downloaded Program Files\CONFLICT.4\UWA6PU_0001_N91M2107NetInstaller.exe
C:\WINDOWS\Downloaded Program Files\CONFLICT.5\UWA6PU_0001_N91M2107NetInstaller.exe
C:\WINDOWS\Downloaded Program Files\UWA6PU_0001_N91M2107NetInstaller.exe

Unclassified.Unknown Origin
C:\Program Files\Logitech\Desktop Messenger\8876480\6.1.4.68-8876480L\Program\Restart.exe

Adware.IST/SideFind
C:\System Volume Information\_restore{1E7DE658-4200-4403-BDB0-5CD040566E68}\RP528\A0133510.dll

Adware.180solutions/Search Assistant
C:\System Volume Information\_restore{1E7DE658-4200-4403-BDB0-5CD040566E68}\RP528\A0133517.dll


dazu noch die frage: ich hab jetzt die ganzen sachen mal in quarantäne verschoben. soll ich die dann bei "manage quarantine" "removen"? ja, oder?

****

logs von datfindbat
Datentr„ger in Laufwerk C: ist DRV1_VOL1
Volumeseriennummer: 621F-A560

Verzeichnis von C:\WINDOWS\system32

11.09.2006 19:37 8.960.936 MRT.exe
30.08.2006 12:43 2.206 wpa.dbl
21.08.2006 14:26 16.896 fltlib.dll
21.08.2006 11:14 23.040 fltmc.exe
12.08.2006 12:04 267.008 FNTCACHE.DAT
28.07.2006 13:28 3.075.072 mshtml.dll
27.07.2006 15:25 679.424 inetcomm.dll
25.07.2006 22:33 615.936 urlmon.dll
21.07.2006 10:29 72.704 hlink.dll
14.07.2006 17:38 332.288 netapi32.dll
14.07.2006 17:25 546.304 hhctrl.ocx
13.07.2006 15:34 8.494.592 shell32.dll
12.07.2006 19:34 400.760 perfh009.dat
12.07.2006 19:34 62.422 perfc009.dat
12.07.2006 19:34 415.454 perfh007.dat
12.07.2006 19:34 75.186 perfc007.dat
12.07.2006 19:34 926.938 PerfStringBackup.INI
05.07.2006 12:55 1.057.792 kernel32.dll


***

Datentr„ger in Laufwerk C: ist DRV1_VOL1
Volumeseriennummer: 621F-A560

Verzeichnis von C:\DOKUME~1\Tamara\LOKALE~1\Temp

15.09.2006 18:03 738 LVCOMSX.LOG
15.09.2006 14:54 408 jusched.log
17.02.2006 16:55 143.360 SSUPDATE.EXE
09.09.2005 15:44 24.576 IadHide4.dll
4 Datei(en) 169.082 Bytes
0 Verzeichnis(se), 25.323.294.720 Bytes frei


****

Datentr„ger in Laufwerk C: ist DRV1_VOL1
Volumeseriennummer: 621F-A560

Verzeichnis von C:\WINDOWS

15.09.2006 18:09 1.432.470 WindowsUpdate.log
15.09.2006 18:03 0 0.log
15.09.2006 18:03 159 wiadebug.log
15.09.2006 18:03 2.652 BRMFBIDI.INI
15.09.2006 18:03 50 wiaservc.log
15.09.2006 18:03 2.048 bootstat.dat
15.09.2006 18:02 32.686 SchedLgU.Txt
15.09.2006 13:51 54.156 QTFont.qfn
14.09.2006 18:22 243.716 comsetup.log
14.09.2006 18:22 149.900 ntdtcsetup.log
14.09.2006 18:22 890.930 iis6.log
14.09.2006 18:22 331.973 tsoc.log
14.09.2006 18:22 38.349 ocmsn.log
14.09.2006 18:22 1.374 imsins.log
14.09.2006 18:22 35.101 tabletoc.log
14.09.2006 18:22 12.005 KB920685.log
14.09.2006 18:22 42.738 medctroc.Log
14.09.2006 18:22 122.690 netfxocm.log
14.09.2006 18:22 373.838 ocgen.log
14.09.2006 18:22 35.939 msgsocm.log
14.09.2006 18:22 694.947 FaxSetup.log
14.09.2006 18:22 241.138 msmqinst.log
14.09.2006 18:21 1.374 imsins.BAK
14.09.2006 18:21 13.683 KB920872.log
14.09.2006 18:21 811.574 setupapi.log
14.09.2006 18:21 12.199 KB919007.log
14.09.2006 18:21 8.569 KB922582.log
14.09.2006 18:21 39.095 updspapi.log
14.09.2006 18:20 27.479.754 dp2_log.txt
14.09.2006 14:35 3.696 ggieknwm.txt
10.09.2006 12:05 1.409 QTFont.for
09.09.2006 18:50 49 NeroDigital.ini
19.08.2006 21:07 11.943.990 Firefox Wallpaper.bmp
11.08.2006 18:02 17.590 KB920214.log
11.08.2006 18:02 17.900 KB922616.log
11.08.2006 18:02 17.535 KB921398.log
11.08.2006 18:02 20.379 KB918899.log
11.08.2006 18:01 10.873 KB920670.log
11.08.2006 18:01 11.378 KB917422.log
10.08.2006 23:03 12.377 KB920683.log
09.08.2006 18:01 11.891 KB921883.log
12.07.2006 19:06 11.940 KB917159.log
12.07.2006 19:05 12.459 KB914388.log
12.07.2006 19:04 10.415 KB916595.log
03.07.2006 14:09 180.059 setupact.log
03.07.2006 14:06 234.190 ntbtlog.txt


***

Datentr„ger in Laufwerk C: ist DRV1_VOL1
Volumeseriennummer: 621F-A560

Verzeichnis von C:\

15.09.2006 18:11 0 sys.txt
15.09.2006 18:10 11.842 system.txt
15.09.2006 18:10 438 systemtemp.txt
15.09.2006 18:05 109.930 system32.txt
15.09.2006 18:03 792.723.456 pagefile.sys
15.09.2006 14:43 8.312 avenger.txt
15.09.2006 14:02 12.779 ComboFix.txt
15.09.2006 13:59 159 ComboFix2.txt
15.09.2006 13:58 159 ComboFix3.txt
07.07.2006 19:56 57.588 files.txt
03.07.2006 14:14 1.506 rapport.txt


***

antivir bringt seit dem neustart nach superantispyware keine meldungen mehr *juhu* und in meine eigenen dateien kann ich auch wieder hinein!! (:

... und am sonntag wird mein computer endlich neu aufgesetzt - nach 2 jahren (ja, ich hör schon die informatikerInnen unter euch aufjaulen....)

lg tam

#17 Hallo Sabina!
Mit dr.web wurden keine Viren gefunden und im bericht stand auch nichts.
Der pc scheint jetzt sauber zu sein... vielen dank!