ishst.exe & ismini.exe -> Trojaner? Wie zu löschen?

#16 das ist der text, den du einkopieren + abspeichern sollst (ohne Zitat)

Zitat

cd\
dir "C:\WINDOWS\System32\update" >>files.txt
dir "C:\WINDOWS\system32\appmgmt" >>files.txt
dir "C:\WINDOWS\ERDNT" >>files.txt
dir "C:\Program Files" >>files.txt
dir "C:\Program Files\windowsupdate" >>files.txt
dir "C:\Program Files\nimocodec pack" >>files.txt
notepad files.txt

__________
MfG Sabina

rund um die PC-Sicherheit

#17 Ok. Ich bekomme 2 Textkasten.

Eins kann ich nicht kopieren, ich glaube aber es ist nur ein Arbeits log vom Programm? Der andere ist hier:


Volume in drive C is Local Disk
Volume Serial Number is B478-529A

Directory of C:\WINDOWS\System32

Volume in drive C is Local Disk
Volume Serial Number is B478-529A

Directory of C:\WINDOWS\system32\appmgmt

08-02-2007 18:08 <DIR> .
08-02-2007 18:08 <DIR> ..
08-02-2007 18:08 <DIR> MACHINE
08-02-2007 18:08 <DIR> S-1-5-21-299502267-1326574676-1801674531-1003
0 File(s) 0 bytes
4 Dir(s) 2.101.379.072 bytes free
Volume in drive C is Local Disk
Volume Serial Number is B478-529A

Directory of C:\WINDOWS\ERDNT

11-02-2007 09:18 <DIR> .
11-02-2007 09:18 <DIR> ..
11-02-2007 09:18 <DIR> subs
0 File(s) 0 bytes
3 Dir(s) 2.101.374.976 bytes free
Volume in drive C is Local Disk
Volume Serial Number is B478-529A

Directory of C:\Program Files

08-02-2007 18:11 <DIR> .
08-02-2007 18:11 <DIR> ..
29-01-2007 22:15 <DIR> Adobe
30-11-2006 18:03 <DIR> ATI Technologies
29-01-2007 22:08 <DIR> Common Files
04-02-2007 22:17 <DIR> CyberLink
08-02-2007 18:11 <DIR> D-Tools
05-12-2006 21:23 <DIR> DivX
30-11-2006 17:47 <DIR> Grisoft
02-12-2006 14:45 <DIR> Hewlett-Packard
26-11-2006 20:06 <DIR> Internet Explorer
26-11-2006 20:27 <DIR> Messenger
26-11-2006 20:07 <DIR> microsoft frontpage
26-11-2006 20:06 <DIR> Movie Maker
13-02-2007 21:51 <DIR> Mozilla Firefox
26-11-2006 20:04 <DIR> MSN
26-11-2006 20:04 <DIR> MSN Gaming Zone
26-11-2006 20:05 <DIR> NetMeeting
10-01-2007 17:45 <DIR> NimoCodec Pack
26-11-2006 20:04 <DIR> Online Services
26-11-2006 20:05 <DIR> Outlook Express
11-02-2007 16:17 <DIR> Paint Shop Pro 6
30-11-2006 17:51 <DIR> Winamp
08-02-2007 17:18 <DIR> Windows Media Player
26-11-2006 20:04 <DIR> Windows NT
05-12-2006 18:38 <DIR> WS_FTP Pro
26-11-2006 20:07 <DIR> xerox
05-12-2006 21:27 <DIR> XviD
30-11-2006 17:32 <DIR> Zone Labs
0 File(s) 0 bytes
29 Dir(s) 2.101.374.976 bytes free
Volume in drive C is Local Disk
Volume Serial Number is B478-529A

Directory of C:\Program Files\windowsupdate

21-01-2007 20:06 <DIR> V4
0 File(s) 0 bytes
1 Dir(s) 2.101.374.976 bytes free
Volume in drive C is Local Disk
Volume Serial Number is B478-529A

Directory of C:\Program Files\nimocodec pack

10-01-2007 17:45 <DIR> .
10-01-2007 17:45 <DIR> ..
10-01-2007 17:45 39.241 uninstall.exe
1 File(s) 39.241 bytes
2 Dir(s) 2.101.374.976 bytes free

#18 virustotal
Oben auf der Seite --> auf Durchsuchen klicken --> Datei aussuchen (oder gleich die Datei mit korrektem Pfad einkopieren) --> Doppelklick auf die zu prüfende Datei --> klick auf "Send"... jetzt abwarten - dann mit der rechten Maustaste den Text markieren -> kopieren - einfügen
http://www.virustotal.com/flash/index_en.html

C:\WINDOWS\System32\update\Update.exe

»»
poste hier den scanreport

-----------------------------------------------------------
««
Avenger - (ohne "Zitat" reinkopieren)
http://virus-protect.org/artikel/tools/avenger.html
Input script manually (anhaken)
kopiere in: View/edit script

Zitat

Registry values to delete:
HKLM\software\microsoft\windows\currentversion\policies\explorer\run|ishst.exe

Files to delete:
C:\WINDOWS\system32\ismini.exe
C:\WINDOWS\system32\ishst.exe

Folders to delete:
C:\Program Files\nimocodec pack

Klicke die gruene Ampel
das Script wird nun ausgeführt, dann wird der PC automatisch neustarten

««
smitfraud.fix abarbeiten (Option 1 und 2 - lasse auch die Registry mitreinigen)
http://virus-protect.org/artikel/tools/smitfrautfix.html
__________
MfG Sabina

rund um die PC-Sicherheit

#19 Zum Anfang 1. Stufe:

STATUS: FINISHEDComplete scanning result of "Update.exe", received in VirusTotal at 02.15.2007, 06:59:37 (CET).

Antivirus Version Update Result
AntiVir 7.3.1.37 02.14.2007 no virus found
Authentium 4.93.8 02.15.2007 no virus found
Avast 4.7.936.0 02.14.2007 no virus found
AVG 386 02.14.2007 no virus found
BitDefender 7.2 02.15.2007 no virus found
CAT-QuickHeal 9.00 02.15.2007 no virus found
ClamAV devel-20060426 02.15.2007 no virus found
DrWeb 4.33 02.14.2007 no virus found
eSafe 7.0.14.0 02.14.2007 no virus found
eTrust-Vet 30.4.3400 02.15.2007 no virus found
Ewido 4.0 02.14.2007 no virus found
Fortinet 2.85.0.0 02.15.2007 no virus found
F-Prot 4.2.1.29 02.15.2007 no virus found
F-Secure 6.70.13030.0 02.14.2007 no virus found
Ikarus T3.1.0.31 02.15.2007 no virus found
Kaspersky 4.0.2.24 02.15.2007 no virus found
McAfee 4963 02.14.2007 no virus found
Microsoft 1.2204 02.15.2007 no virus found
NOD32v2 2062 02.15.2007 no virus found
Norman 5.80.02 02.14.2007 no virus found
Panda 9.0.0.4 02.14.2007 no virus found
Prevx1 V2 02.15.2007 no virus found
Sophos 4.14.0 02.13.2007 no virus found
Sunbelt 2.2.907.0 02.15.2007 no virus found
Symantec 10 02.15.2007 no virus found
TheHacker 6.1.6.057 02.14.2007 no virus found
UNA 1.83 02.14.2007 no virus found
VBA32 3.11.2 02.14.2007 no virus found
VirusBuster 4.3.19:9 02.14.2007 no virus found


Aditional Information
File size: 0 bytes
MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709

#20 arbeite also das avengerscript und smitfraudfix ab
__________
MfG Sabina

rund um die PC-Sicherheit

#21 Sabina


Danke sehr! Ich glaube nicht, dass es notwendig ist smitfraudfix zu verwenden. Ich denke die 2 .exe Dateis sind nun gelöscht worden (ich finde sie auch nicht mehr unter c:/windows/system32):

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\chqerdmt

*******************

Script file located at: \??\C:\Documents and Settings\wfdxmxph.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

File C:\WINDOWS\system32\ismini.exe deleted successfully.
File C:\WINDOWS\system32\ishst.exe deleted successfully.
Folder C:\Program Files\nimocodec pack deleted successfully.
Registry value HKLM\software\microsoft\windows\currentversion\policies\explorer\run|ishst.exe deleted successfully.

Completed script processing.

*******************

Finished! Terminate.