Geschrieben von Julio am 17.08.2005 um 16:29:
3.PC - Noch zu retten ?
Hallo allerseits !
Momentan gibt es vorallem ein Problem :
Unten rechts (bei der Uhr) blinkt ein "gelbes Dreieck mit nem ! drin". Das muß irgendwas mit razespyware.net zu tun haben. Der Pc fängt an zu laggen und es hilft nur noch "stecker raus".
Hier die loggs :
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
Funde für "infected"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
Wed Aug 17 15:29:11 2005 => File C:\WINNT\system32\wininet.dll infected by "Virus.Win32.Nsag.b" Virus! Action Taken: No
Action Taken.
Wed Aug 17 15:29:11 2005 => File C:\WINNT\system32\OLEEXT.dll infected by "Trojan.Win32.Small.ev" Virus! Action Taken: No
Action Taken.
Wed Aug 17 15:29:15 2005 => File C:\WINNT\System32\msole32.exe infected by "Trojan-Clicker.Win32.Agent.cr" Virus! Action
Taken: No Action Taken.
Wed Aug 17 15:29:25 2005 => File C:\WINNT\system32\msole32.exe infected by "Trojan-Clicker.Win32.Agent.cr" Virus! Action
Taken: No Action Taken.
Wed Aug 17 15:33:05 2005 => File C:\Dokumente und Einstellungen\b\Lokale Einstellungen\Temp\temp.frAF7D infected by
"Trojan.Win32.Puper.ak" Virus! Action Taken: No Action Taken.
Wed Aug 17 15:35:01 2005 => Scanning Folder: C:\Programme\AVPersonal\INFECTED\*.*
Wed Aug 17 15:44:59 2005 => File C:\WINNT\popuper.exe infected by "Trojan.Win32.Puper.ak" Virus! Action Taken: No Action
Taken.
Wed Aug 17 15:51:03 2005 => C:\WINNT\system32\fff.exe possibly infected and removed by background antivirus package!
Wed Aug 17 15:51:03 2005 => File C:\WINNT\system32\fff.exe infected by "BkCln.Unknown" Virus! Action Taken: No Action Taken.
Wed Aug 17 15:51:18 2005 => File C:\WINNT\system32\intmon.exe infected by "Trojan.Win32.Puper.aj" Virus! Action Taken: No
Action Taken.
Wed Aug 17 15:51:59 2005 => C:\WINNT\system32\Netmon.exe possibly infected and removed by background antivirus package!
Wed Aug 17 15:51:59 2005 => File C:\WINNT\system32\Netmon.exe infected by "BkCln.Unknown" Virus! Action Taken: No Action
Taken.
Wed Aug 17 15:52:05 2005 => C:\WINNT\system32\nnn.exe possibly infected and removed by background antivirus package!
Wed Aug 17 15:52:05 2005 => File C:\WINNT\system32\nnn.exe infected by "BkCln.Unknown" Virus! Action Taken: No Action Taken.
Wed Aug 17 15:52:15 2005 => File C:\WINNT\system32\ole32vbs.exe infected by "Trojan.Win32.Favadd.ai" Virus! Action Taken: No
Action Taken.
Wed Aug 17 15:52:16 2005 => File C:\WINNT\system32\oleext.dll infected by "Trojan.Win32.Small.ev" Virus! Action Taken: No
Action Taken.
Wed Aug 17 15:52:48 2005 => File C:\WINNT\system32\TFTP1360 infected by "Backdoor.Win32.SdBot.abk" Virus! Action Taken: No
Action Taken.
Wed Aug 17 15:52:49 2005 => File C:\WINNT\system32\TFTP1692 infected by "Backdoor.Win32.SdBot.abk" Virus! Action Taken: No
Action Taken.
Wed Aug 17 15:53:04 2005 => File C:\WINNT\system32\wininet.dll infected by "Virus.Win32.Nsag.b" Virus! Action Taken: No
Action Taken.
Wed Aug 17 16:08:01 2005 => Total Disinfected Files: 0
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
Funde für "tagged"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
Wed Aug 17 15:38:54 2005 => File C:\Programme\ps_uninstaller.exe tagged as "not-a-virus:AdWare.PurityScan.bu". Action Taken:
No Action Taken.
Wed Aug 17 15:43:30 2005 => File C:\WINNT\cns~.dll tagged as "not-a-virus:AdWare.AdBreak". Action Taken: No Action Taken.
Wed Aug 17 16:00:59 2005 => File D:\Kani\Vorlagen\Bussgeldkatalog.exe tagged as "not-a-virus
orn-Dialer.Win32.ALifeDialer". Action Taken: No Action Taken.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
Statistiken:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
Wed Aug 17 16:08:01 2005 => Total Virus(es) Found: 18
Wed Aug 17 16:08:01 2005 => Total Errors: 61
Wed Aug 17 16:08:01 2005 => Time Elapsed: 00:51:13
Wed Aug 17 16:08:01 2005 => Total Objects Scanned: 43148
Wed Aug 17 15:16:30 2005 => Virus Database Date: 2005/08/17
Wed Aug 17 16:08:01 2005 => Virus Database Date: 2005/08/17
Wed Aug 17 16:09:58 2005 => Virus Database Date: 2005/08/17
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
~~~~~~~ © Haui ;-) ~~~~~~~
~~~~~~~ Dank an Cidre ~~~~~~~
Logfile of HijackThis v1.99.1
Scan saved at 15:07:50, on 17.08.2005
Platform: Windows 2000 SP2 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 SP1 (5.00.2920.0000)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Programme\AVPersonal\AVGUARD.EXE
C:\Programme\AVPersonal\AVWUPSRV.EXE
C:\WINNT\System32\svchost.exe
C:\PROGRA~1\Agnitum\OUTPOS~1.0\outpost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\msole32.exe
C:\Programme\AVPersonal\AVGNT.EXE
C:\Programme\WEBDE\SmartSurfer2.31\SmartSurfer.exe
C:\bases_X\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about :blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://www.freenet.de/
O3 - Toolbar: @msdxmLC.dll,-1@1031,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [AVGCtrl] "C:\Programme\AVPersonal\AVGNT.EXE" /min
O4 - HKLM\..\Run: [Outpost Firewall] C:\PROGRA~1\Agnitum\OUTPOS~1.0\outpost.exe /waitservice
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Google Search - res://c:\programme\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\programme\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\programme\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\programme\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\programme\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Browser-Anpassung für Outpost Firewall - {44627E97-789B-40d4-B5C2-58BD171129A1} - C:\PROGRA~1\Agnitum\OUTPOS~1.0\Plugins\BrowserBar\ie_bar.dll
O16 - DPF: symsupportutil - h**ps://www-secure.symantec.com/region/de/techsupp/activedata/symsupportuti
l.CAB
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - h**ps://www-secure.symantec.com/region/de/techsupp/activedata/ActiveData.ca
b
O17 - HKLM\System\CCS\Services\Tcpip\..\{D1FCCD5A-CF2A-4427-8D56-05D5525BCC6C}: NameServer = 192.168.120.252,192.168.120.253
O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34545} - (no file)
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Programme\AVPersonal\AVGUARD.EXE
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: AVM FRITZ!web Routing Service (de_serv) - AVM Berlin - C:\PROGRAMME\FRITZ!\de_serv.exe
O23 - Service: Verwaltungsdienst für die Verwaltung logischer Datenträger (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: NeroSVC - Unknown owner - C:\Programme\ahead\Nero\Misc\NeroSVC.exe
O23 - Service: Net Functions Monitoring (Netmon) - Unknown owner - C:\WINNT\system32\uuu.exe (file missing)
O23 - Service: Outpost Firewall Service (OutpostFirewall) - Agnitum Ltd. - C:\PROGRA~1\Agnitum\OUTPOS~1.0\outpost.exe
Achja, ich habe noch keine Viren entfernt, da ich erst Eure Meinung hören wollte !
Ciao
Julio
