Downloads mit IE, Firefox und Opera brechen ab - nur FlashGet funktioniert

#16 Ich habe es ja auch runterbekommen und das log versehentlich in meinem letzten Beitrag gepostet, weil ich Deinen Beitrag hier auf der 2. Seite übersehen habe

Hier ist es noch einmal. Die mailbombe habe ich gelöscht.

AVZ Antiviral Toolkit log; AVZ version is 4.29
Scanning started at 13.01.2008 21:05:16
Database loaded: signatures - 144795, NN profile(s) - 2, microprograms of healing - 55, signature database released 12.01.2008 16:59
Heuristic microprograms loaded: 371
SPV microprograms loaded: 9
Digital signatures of system files loaded: 68438
Heuristic analyzer mode: Medium heuristics level
Healing mode: disabled
Windows version: 5.1.2600, Service Pack 2 ; AVZ is launched with administrator rights
System Recovery: enabled
1. Searching for Rootkits and programs intercepting API functions
1.1 Searching for user-mode API hooks
Analysis: kernel32.dll, export table found in section .text
Analysis: ntdll.dll, export table found in section .text
Analysis: user32.dll, export table found in section .text
Analysis: advapi32.dll, export table found in section .text
Analysis: ws2_32.dll, export table found in section .text
Analysis: wininet.dll, export table found in section .text
Analysis: rasapi32.dll, export table found in section .text
Analysis: urlmon.dll, export table found in section .text
Analysis: netapi32.dll, export table found in section .text
1.2 Searching for kernel-mode API hooks
Driver loaded successfully
SDT found (RVA=0846E0)
Kernel ntkrnlpa.exe found in memory at address 804D7000
SDT = 8055B6E0
KiST = 80503940 (284)
Function NtClose (19) intercepted (805BAF64->F78BC514), hook C:\WINDOWS\system32\Drivers\sbhr.sys
Function NtConnectPort (1F) intercepted (805A30A4->F4378EB0), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted
Function NtCreateFile (25) intercepted (80577ED2->F4375870), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted
Function NtCreateKey (29) intercepted (80622104->F4380700), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted
Function NtCreatePort (2E) intercepted (805A3BC0->F4379270), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted
Function NtCreateProcess (2F) intercepted (805CFAD4->F437F500), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted
Function NtCreateProcessEx (30) intercepted (805CFA1E->F437F730), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted
Function NtCreateSection (32) intercepted (805A9E9E->F4383090), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted
Function NtCreateThread (35) intercepted (805CF8BC->F7B4489C), hook not defined
Function NtCreateWaitablePort (38) intercepted (805A3BE4->F4379350), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted
Function NtDeleteFile (3E) intercepted (80575ABA->F4375EF0), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted
Function NtDeleteKey (3F) intercepted (80622594->F4381720), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted
Function NtDeleteValueKey (41) intercepted (80622764->F4381360), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted
Function NtDuplicateObject (44) intercepted (805BC940->F437F270), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted
Function NtLoadKey (62) intercepted (80623E34->F4381A60), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted
Function NtOpenFile (74) intercepted (80578FD0->F4375D40), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted
Function NtOpenKey (77) intercepted (8062349A->F78BC4D0), hook C:\WINDOWS\system32\Drivers\sbhr.sys
Function NtOpenProcess (7A) intercepted (805C9CFE->F7B44888), hook not defined
Function NtOpenThread (80) intercepted (805C9F8A->F7B4488D), hook not defined
Function NtRenameKey (C0) intercepted (80621B2A->F43821D0), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted
Function NtReplaceKey (C1) intercepted (80623CE4->F4381D50), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted
Function NtRequestWaitReplyPort (C8) intercepted (805A184A->F4378B50), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted
Function NtRestoreKey (CC) intercepted (8062050C->F4382000), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted
Function NtSecureConnectPort (D2) intercepted (805A2838->F4379060), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted
Function NtSetInformationFile (E0) intercepted (80579E38->F4376060), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted
Function NtSetValueKey (F7) intercepted (806207C4->F4380ED7), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted
Function NtTerminateProcess (101) intercepted (805D1226->F7B44897), hook not defined
Function NtWriteVirtualMemory (115) intercepted (805B2E0C->F7B44892), hook not defined
Functions checked: 284, intercepted: 28, restored: 0
1.3 Checking IDT and SYSENTER
Analysis for CPU 1
Analysis for CPU 2
Checking IDT and SYSENTER - complete
1.4 Searching for masking processes and drivers
Checking not performed: the extended monitoring driver (AVZPM) is not installed
2. Scanning memory
Number of processes found: 62
Number of modules loaded: 675
Memory checking - complete
3. Scanning disks
Direct reading C:\WINDOWS\system32\config\system.LOG
Direct reading C:\WINDOWS\system32\config\SysEvent.Evt
Direct reading C:\WINDOWS\system32\config\AppEvent.Evt
Direct reading C:\WINDOWS\system32\config\SecEvent.Evt
Direct reading C:\WINDOWS\system32\config\Internet.evt
Direct reading C:\WINDOWS\system32\config\DEFAULT
Direct reading C:\WINDOWS\system32\config\SECURITY
Direct reading C:\WINDOWS\system32\config\SYSTEM
Direct reading C:\WINDOWS\system32\config\SAM
Direct reading C:\WINDOWS\system32\drivers\fidbox.dat
Direct reading C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP
Direct reading C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP
Direct reading C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP
Direct reading C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA
Direct reading C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR
Direct reading C:\WINDOWS\system32\CatRoot2\edb.log
Direct reading C:\WINDOWS\system32\CatRoot2\tmp.edb
Direct reading C:\WINDOWS\Internet Logs\tvDebug.log
Direct reading C:\WINDOWS\Internet Logs\fwpktlog.txt
Direct reading C:\WINDOWS\Internet Logs\NAME-BE95EFD57D.ldb
Direct reading C:\WINDOWS\Internet Logs\IAMDB.RDB
Direct reading C:\WINDOWS\WindowsUpdate.log
Direct reading C:\WINDOWS\SchedLgU.Txt
Direct reading C:\WINDOWS\SoftwareDistribution\ReportingEvents.log
Direct reading C:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen\Anwendungsdaten\Microsoft\Windows\UsrClass.dat
Direct reading C:\Dokumente und Einstellungen\NetworkService\ntuser.dat
Direct reading C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Verlauf\History.IE5\index.dat
Direct reading C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Temporary Internet Files\Content.IE5\index.dat
Direct reading C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\Microsoft\Windows\UsrClass.dat
Direct reading C:\Dokumente und Einstellungen\LocalService\Cookies\index.dat
Direct reading C:\Dokumente und Einstellungen\LocalService\ntuser.dat
Direct reading C:\Dokumente und Einstellungen\jürgen potbelsek\Lokale Einstellungen\Temp\~DFCCE5.tmp
Direct reading C:\Dokumente und Einstellungen\jürgen potbelsek\Lokale Einstellungen\Temp\~DF5E02.tmp
Direct reading C:\Dokumente und Einstellungen\jürgen potbelsek\Lokale Einstellungen\Temp\Perflib_Perfdata_d04.dat
Direct reading C:\Dokumente und Einstellungen\jürgen potbelsek\Lokale Einstellungen\Verlauf\History.IE5\index.dat
Direct reading C:\Dokumente und Einstellungen\jürgen potbelsek\Lokale Einstellungen\Verlauf\History.IE5\MSHist012008011320080114\index.dat
Direct reading C:\Dokumente und Einstellungen\jürgen potbelsek\Lokale Einstellungen\Temporary Internet Files\Content.IE5\index.dat
Direct reading C:\Dokumente und Einstellungen\jürgen potbelsek\Lokale Einstellungen\Anwendungsdaten\Microsoft\Windows\UsrClass.dat
Direct reading C:\Dokumente und Einstellungen\jürgen potbelsek\Lokale Einstellungen\Anwendungsdaten\Microsoft\Media Player\CurrentDatabase_360.wmdb
Direct reading C:\Dokumente und Einstellungen\jürgen potbelsek\Lokale Einstellungen\Anwendungsdaten\Pando\Pando Files\cert\cert8.db
Direct reading C:\Dokumente und Einstellungen\jürgen potbelsek\Lokale Einstellungen\Anwendungsdaten\Pando\Pando Files\cert\key3.db
Direct reading C:\Dokumente und Einstellungen\jürgen potbelsek\Lokale Einstellungen\Anwendungsdaten\Pando\Pando Files\pando.log
Direct reading C:\Dokumente und Einstellungen\jürgen potbelsek\Lokale Einstellungen\Anwendungsdaten\Last.fm\Client\lastfmhelper.log
Direct reading C:\Dokumente und Einstellungen\jürgen potbelsek\Cookies\index.dat
Direct reading C:\Dokumente und Einstellungen\jürgen potbelsek\Anwendungsdaten\T-Online\T-Online_Software_6\Info-Cockpit\Info-Cockpit.trc
Direct reading C:\Dokumente und Einstellungen\jürgen potbelsek\ntuser.dat
Direct reading C:\System Volume Information\_restore{EB62F0EB-EC16-4051-AB47-83F0C89DF097}\RP344\change.log
Semele_07.12.01_22-35_hr3_160_TVOON_DE.mpg.avi.otrkey MailBomb detected !
D:\System Volume Information\_restore{EB62F0EB-EC16-4051-AB47-83F0C89DF097}\RP337\A0215111.exe >>>>> AdvWare.Win32.MyWebSearch.aw
4. Checking Winsock Layered Service Provider (SPI/LSP)
LSP settings checked. No errors detected
5. Searching for keyboard/mouse/windows events hooks (Keyloggers, Trojan DLLs)
C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis1\AdHndCnt.dll --> Suspicion for a Keylogger or Trojan DLL
C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis1\AdHndCnt.dll>>> Behavioral analysis:
Behaviour typical for keyloggers not detected
C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis1\AAdHnd.DLL --> Suspicion for a Keylogger or Trojan DLL
C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis1\AAdHnd.DLL>>> Behavioral analysis:
Behaviour typical for keyloggers not detected
C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis1\ADParmIF.dll --> Suspicion for a Keylogger or Trojan DLL
C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis1\ADParmIF.dll>>> Behavioral analysis:
Behaviour typical for keyloggers not detected
Note: Do NOT delete suspicious files, send them for analysis (see FAQ for more details), because there are lots of useful hooking DLLs
6. Searching for opened TCP/UDP ports used by malicious programs
Checking disabled by user
7. Heuristic system check
Checking complete
8. Searching for vulnerabilities
>> Services: potentially dangerous service allowed TermService (Terminaldienste)
>> Services: potentially dangerous service allowed SSDPSRV (SSDP-Suchdienst)
>> Services: potentially dangerous service allowed Schedule (Taskplaner)
>> Services: potentially dangerous service allowed mnmsrvc (NetMeeting-Remotedesktop-Freigabe)
>> Services: potentially dangerous service allowed RDSessMgr (Sitzungs-Manager für Remotedesktophilfe)
> Services: please bear in mind that the set of services depends on the use of the PC (home PC, office PC connected to corporate network, etc)!
>> Security: disk drives' autorun is enabled
>> Security: administrative shares (C$, D$ ...) are enabled
>> Security: anonymous user access is enabled
>> Security: sending Remote Assistant queries is enabled
Checking complete
9. Troubleshooting wizard
Checking complete
Files scanned: 301057, extracted from archives: 189011, malicious programs found 1, suspicions - 0
Scanning finished at 13.01.2008 22:54:40
Time of scanning: 01:49:25
If you have a suspicion on presence of viruses or questions on the suspected objects,
you can address http://virusinfo.info conference

#17 mach mal den Zonealarm aus ... dann lade etwas und berichte, wie es läuft
__________
Gruss
Pinguin

bin dabei, meine Seite + Proggies zu aktualisieren: http://www.virus-protect.org/

#18 Hi Pinguin,
Firefox hat den Download nicht gestartet.
Dann habe ich die Verbindung gekappt
und neu aufgebaut.
Jetzt hat Opera den Download in akzeptabler Geschwindigkeit geschafft.
Auch beim IE geht es ohne Probleme.
Ich habe Firefox nochmals versucht.
Beim zweiten Mal hat es auch hier geklappt.
Wie kommt denn das ?
Ich habe bei ZoneAlarm keine Einstellungen verändert.
Sven1950

Nachtrag:
Sehr seltsam,
ich habe jetzt zone alarm wieder angestellt
und der Download funktioniert sogar mit Firefox
sven 1950

#19 Wunder und Misterium , wohin man blickt
na, wichtig ist, dass alles wieder klappt.
__________
Gruss
Pinguin

bin dabei, meine Seite + Proggies zu aktualisieren: http://www.virus-protect.org/

#20 Ja und noch einmal ganz vielen Dank
Sven1950
PS: Muss ich sonst noch etwas tun ?