Hallo!

jetzt brauch ich auch mal hilfe. Habe schon den MediaPass durch verschiedenes versucht los zu werden. Scheint nicht geklappt zu haben. Ausserdem sind noch 3andere Sachen dabei, die ich nicht los werde. MediaPass, ap9h4qmo, sahAgent.

Bedenkliche Einträge:
O14 - IERESET.INF: SEARCH_PAGE_URL=
O14 - IERESET.INF: START_PAGE_URL=
O4 - HKLM\..\Run: [Media Pass] C:\Program Files\Media Pass\MediaPass.exe
O4 - HKLM\..\Run: [ap9h4qmo] C:\WINDOWS\SYSTEM\ap9h4qmo.exe

Hier mal mein Logfile:

Logfile of HijackThis v1.99.1
Scan saved at 15:45:46, on 13.03.05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v5.00 (5.00.2614.3500)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\WINDOWS\SYSTEM\ATI2EVXX.EXE
C:\PROGRAMME\EXECUTIVE SOFTWARE\DISKEEPER\DKSERVICE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAMME\ZONE LABS\ZONEALARM\ZLCLIENT.EXE
C:\PROGRAMME\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATIPTAXX.EXE
C:\PROGRAMME\AVPERSONAL\AVGCTRL.EXE
C:\WINDOWS\SYSTEM\AP9H4QMO.EXE
C:\PROGRAMME\FREE DOWNLOAD MANAGER\FDM.EXE
C:\PROGRAMME\TRILLIAN\TRILLIAN.EXE
C:\PROGRAMME\OPENOFFICE.ORG1.1.4\PROGRAM\SOFFICE.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAMME\MOZILLA FIREFOX\FIREFOX.EXE
C:\EIGENE DATEIEN\HJT\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.de/
O2 - BHO: WgBHO Class - {67E9834D-B226-49E6-B6F6-85AA64E14BA3} - C:\PROGRAMME\FREE DOWNLOAD MANAGER\IEFDM.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAMME\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: Search Bar - {0A8CE102-FA03-4612-9BEE-7FE5452F4CB1} - C:\WINDOWS\SYSTEM\srchbar.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Media Pass] C:\Program Files\Media Pass\MediaPass.exe
O4 - HKLM\..\Run: [AVGCtrl] "C:\PROGRA~1\AVPERS~1\AVGCTRL.EXE" /min
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [ap9h4qmo] C:\WINDOWS\SYSTEM\ap9h4qmo.exe
O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKLM\..\RunServices: [ATIPOLL] ati2evxx.exe
O4 - HKLM\..\RunServices: [ATISmart] C:\WINDOWS\SYSTEM\ati2s9ag.exe
O4 - HKLM\..\RunServices: [DkService] C:\Programme\Executive Software\Diskeeper\DkService.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] C:\WINDOWS\SYSTEM\mstask.exe
O4 - HKCU\..\Run: [Free Download Manager] C:\Programme\Free Download Manager\fdm.exe -autorun
O4 - Startup: OpenOffice.org 1.1.4.lnk = C:\Programme\OpenOffice.org1.1.4\program\quickstart.exe
O4 - Startup: Adobe Gamma Loader.exe.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: Download by Free Download Manager - file://C:\Programme\Free Download Manager\dllink.htm
O8 - Extra context menu item: Download web site by Free Download Manager - file://C:\Programme\Free Download Manager\dlpage.htm
O8 - Extra context menu item: Download all by Free Download Manager - file://C:\Programme\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected by Free Download Manager - file://C:\Programme\Free Download Manager\dlselected.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_01\bin\npjpi150_01.dll
O14 - IERESET.INF: SEARCH_PAGE_URL=
O14 - IERESET.INF: START_PAGE_URL=
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 192.168.122.252,192.168.122.253

S&D & Adaware SE habe ich schon laufen lassen, aber es scheint nicht zu helfen. HJT delete file on reboot auch, doofe dinger....
Danke schon mal. Clearprog & Winoptimizer auch laufen lassen. Online scan hab ich noch nicht gemacht.

Achso. Diese blöde nachrichten bekomme ich auch immer bei adware scan. Obwohl ich Temp vorher erst gelöscht hab:

C:\WINDOWS\TEMP\AAWTMP\C659644\321FE7\START.EXE
Ist das Trojanische Pferd TR/Dldr.Small.GL3
C:\WINDOWS\TEMP\AAWTMP\C659644\2D8E42\START.EXE
Ist das Trojanische Pferd TR/Click.Small.AD.5

Ad-Aware SE Build 1.05
Logfile Created on:Sonntag, 13. März 2005 15:50:54
Created with Ad-Aware SE Personal, free for private use.
Using definitions file:SE1R32 10.03.2005
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

References detected during the scan:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
MRU List(TAC index:0):1 total references
SahAgent(TAC index:9):11 total references
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Ad-Aware SE Settings
===========================
Set : Search for negligible risk entries
Set : Safe mode (always request confirmation)
Set : Scan active processes
Set : Scan registry
Set : Deep-scan registry
Set : Scan my IE Favorites for banned URLs
Set : Scan my Hosts file

Extended Ad-Aware SE Settings
===========================
Set : Unload recognized processes & modules during scan
Set : Scan registry for all users instead of current user only
Set : Always try to unload modules before deletion
Set : Let Windows remove files in use at next reboot
Set : Delete quarantined objects after restoring
Set : Include basic Ad-Aware settings in log file
Set : Include additional Ad-Aware settings in log file
Set : Include reference summary in log file
Set : Include alternate data stream details in log file
Set : Play sound at scan completion if scan locates critical objects


13.03.05 15:50:54 - Scan started. (Full System Scan)

MRU List Object Recognized!
Location: : software\microsoft\directdraw\mostrecentapplication
Description : most recent application to use microsoft directdraw


Listing running processes
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

#:1 [KERNEL32.DLL]
FilePath : C:\WINDOWS\SYSTEM\
ProcessID : 4279173197
Threads : 4
Priority : High
FileVersion : 4.10.2222
ProductVersion : 4.10.2222
ProductName : Betriebssystem Microsoft(R) Windows(R)
CompanyName : Microsoft Corporation
FileDescription : Kernkomponente des Win32-Kernel
InternalName : KERNEL32
LegalCopyright : Copyright (C) Microsoft Corp. 1991-1999
OriginalFilename : KERNEL32.DLL

#:2 [MSGSRV32.EXE]
FilePath : C:\WINDOWS\SYSTEM\
ProcessID : 4294932733
Threads : 1
Priority : Normal
FileVersion : 4.10.2222
ProductVersion : 4.10.2222
ProductName : Betriebssystem Microsoft(R) Windows(R)
CompanyName : Microsoft Corporation
FileDescription : Windows 32-Bit-VxD-Meldungsserver
InternalName : MSGSRV32
LegalCopyright : Copyright (C) Microsoft Corp. 1992-1998
OriginalFilename : MSGSRV32.EXE

SahAgent Object Recognized!
Type : Process
Data : QH4MKBV9.DLL
Category : Data Miner
Comment : (CSI MATCH)
Object : C:\WINDOWS\SYSTEM\
FileVersion : 4, 0, 0, 2
ProductVersion : 4, 0, 0, 2

Warning! SahAgent Object found in memory(C:\WINDOWS\SYSTEM\QH4MKBV9.DLL)


#:3 [MPREXE.EXE]
FilePath : C:\WINDOWS\SYSTEM\
ProcessID : 4294920013
Threads : 1
Priority : Normal
FileVersion : 4.10.1998
ProductVersion : 4.10.1998
ProductName : Microsoft(R) Windows(R) Operating System
CompanyName : Microsoft Corporation
FileDescription : WIN32 Network Interface Service Process
InternalName : MPREXE
LegalCopyright : Copyright (C) Microsoft Corp. 1993-1998
OriginalFilename : MPREXE.EXE

#:4 [VSMON.EXE]
FilePath : C:\WINDOWS\SYSTEM\ZONELABS\
ProcessID : 4294949229
Threads : 16
Priority : Normal
FileVersion : 5.5.062.011
ProductVersion : 5.5.062.011
ProductName : TrueVector Service
CompanyName : Zone Labs LLC
FileDescription : TrueVector Service
InternalName : vsmon
LegalCopyright : Copyright © 1998-2005, Zone Labs LLC
OriginalFilename : vsmon.exe

SahAgent Object Recognized!
Type : Process
Data : QH4MKBV9.DLL
Category : Data Miner
Comment : (CSI MATCH)
Object : C:\WINDOWS\SYSTEM\
FileVersion : 4, 0, 0, 2
ProductVersion : 4, 0, 0, 2

Warning! SahAgent Object found in memory(C:\WINDOWS\SYSTEM\QH4MKBV9.DLL)


#:5 [ATI2EVXX.EXE]
FilePath : C:\WINDOWS\SYSTEM\
ProcessID : 4294714769
Threads : 2
Priority : Normal


#:6 [DKSERVICE.EXE]
FilePath : C:\PROGRAMME\EXECUTIVE SOFTWARE\DISKEEPER\
ProcessID : 4294949305
Threads : 3
Priority : Normal
FileVersion : 8.0.459.0
ProductVersion : 8.0.459.0
ProductName : Diskeeper (TM) Disk Defragmenter
CompanyName : Executive Software International, Inc.
FileDescription : DKSERVICE.EXE
InternalName : DKSERVICE
LegalCopyright : © 1995-2003 Executive Software Int'l, Inc.
OriginalFilename : DKSERVICE

SahAgent Object Recognized!
Type : Process
Data : QH4MKBV9.DLL
Category : Data Miner
Comment : (CSI MATCH)
Object : C:\WINDOWS\SYSTEM\
FileVersion : 4, 0, 0, 2
ProductVersion : 4, 0, 0, 2

Warning! SahAgent Object found in memory(C:\WINDOWS\SYSTEM\QH4MKBV9.DLL)


#:7 [MSTASK.EXE]
FilePath : C:\WINDOWS\SYSTEM\
ProcessID : 4294710805
Threads : 2
Priority : Normal
FileVersion : 4.71.1959.1
ProductVersion : 4.71.1959.1
ProductName : Taskplaner für Microsoft® Windows®
CompanyName : Microsoft Corporation
FileDescription : Taskplaner-Engine
InternalName : TaskScheduler
LegalCopyright : Copyright (C) Microsoft Corp. 1997
OriginalFilename : mstask.exe

SahAgent Object Recognized!
Type : Process
Data : QH4MKBV9.DLL
Category : Data Miner
Comment : (CSI MATCH)
Object : C:\WINDOWS\SYSTEM\
FileVersion : 4, 0, 0, 2
ProductVersion : 4, 0, 0, 2

Warning! SahAgent Object found in memory(C:\WINDOWS\SYSTEM\QH4MKBV9.DLL)


#:8 [EXPLORER.EXE]
FilePath : C:\WINDOWS\
ProcessID : 4294708877
Threads : 4
Priority : Normal
FileVersion : 4.72.3110.1
ProductVersion : 4.72.3110.1
ProductName : Betriebssystem Microsoft(R) Windows NT(R)
CompanyName : Microsoft Corporation
FileDescription : Windows-Explorer
InternalName : explorer
LegalCopyright : Copyright (C) Microsoft Corp. 1981-1997
OriginalFilename : EXPLORER.EXE

SahAgent Object Recognized!
Type : Process
Data : QH4MKBV9.DLL
Category : Data Miner
Comment : (CSI MATCH)
Object : C:\WINDOWS\SYSTEM\
FileVersion : 4, 0, 0, 2
ProductVersion : 4, 0, 0, 2

Warning! SahAgent Object found in memory(C:\WINDOWS\SYSTEM\QH4MKBV9.DLL)


#:9 [TASKMON.EXE]
FilePath : C:\WINDOWS\
ProcessID : 4294777173
Threads : 1
Priority : Normal
FileVersion : 4.10.1998
ProductVersion : 4.10.1998
ProductName : Microsoft(R) Windows(R) Operating System
CompanyName : Microsoft Corporation
FileDescription : Task Monitor
InternalName : TaskMon
LegalCopyright : Copyright (C) Microsoft Corp. 1998
OriginalFilename : TASKMON.EXE

#:10 [SYSTRAY.EXE]
FilePath : C:\WINDOWS\SYSTEM\
ProcessID : 4294795505
Threads : 2
Priority : Normal
FileVersion : 4.10.2222
ProductVersion : 4.10.2222
ProductName : Betriebssystem Microsoft(R) Windows(R)
CompanyName : Microsoft Corporation
FileDescription : Systemanwendung für Taskleiste
InternalName : SYSTRAY
LegalCopyright : Copyright (C) Microsoft Corp. 1993-1998
OriginalFilename : SYSTRAY.EXE

SahAgent Object Recognized!
Type : Process
Data : QH4MKBV9.DLL
Category : Data Miner
Comment : (CSI MATCH)
Object : C:\WINDOWS\SYSTEM\
FileVersion : 4, 0, 0, 2
ProductVersion : 4, 0, 0, 2

Warning! SahAgent Object found in memory(C:\WINDOWS\SYSTEM\QH4MKBV9.DLL)


#:11 [ZLCLIENT.EXE]
FilePath : C:\PROGRAMME\ZONE LABS\ZONEALARM\
ProcessID : 4294791645
Threads : 6
Priority : Normal
FileVersion : 5.5.062.011
ProductVersion : 5.5.062.011
ProductName : Zone Labs Client
CompanyName : Zone Labs LLC
FileDescription : Zone Labs Client
InternalName : zlclient
LegalCopyright : Copyright © 1998-2005, Zone Labs LLC
OriginalFilename : zlclient.exe

SahAgent Object Recognized!
Type : Process
Data : QH4MKBV9.DLL
Category : Data Miner
Comment : (CSI MATCH)
Object : C:\WINDOWS\SYSTEM\
FileVersion : 4, 0, 0, 2
ProductVersion : 4, 0, 0, 2

Warning! SahAgent Object found in memory(C:\WINDOWS\SYSTEM\QH4MKBV9.DLL)


#:12 [ATIPTAXX.EXE]
FilePath : C:\PROGRAMME\ATI TECHNOLOGIES\ATI CONTROL PANEL\
ProcessID : 4294806233
Threads : 1
Priority : Normal
FileVersion : 6.14.10.5090
ProductVersion : 6.14.10.5090
ProductName : ATI Desktop Component
CompanyName : ATI Technologies, Inc.
FileDescription : ATI Desktop Control Panel
InternalName : Atiptaxx.exe
LegalCopyright : Copyright (C) 1998-2004 ATI Technologies Inc.
OriginalFilename : Atiptaxx.exe

SahAgent Object Recognized!
Type : Process
Data : QH4MKBV9.DLL
Category : Data Miner
Comment : (CSI MATCH)
Object : C:\WINDOWS\SYSTEM\
FileVersion : 4, 0, 0, 2
ProductVersion : 4, 0, 0, 2

Warning! SahAgent Object found in memory(C:\WINDOWS\SYSTEM\QH4MKBV9.DLL)


#:13 [AVGCTRL.EXE]
FilePath : C:\PROGRAMME\AVPERSONAL\
ProcessID : 4294829093
Threads : 3
Priority : Normal


SahAgent Object Recognized!
Type : Process
Data : QH4MKBV9.DLL
Category : Data Miner
Comment : (CSI MATCH)
Object : C:\WINDOWS\SYSTEM\
FileVersion : 4, 0, 0, 2
ProductVersion : 4, 0, 0, 2

Warning! SahAgent Object found in memory(C:\WINDOWS\SYSTEM\QH4MKBV9.DLL)


#:14 [AP9H4QMO.EXE]
FilePath : C:\WINDOWS\SYSTEM\
ProcessID : 4294827785
Threads : 4
Priority : Normal
FileVersion : 4, 0, 0, 4
ProductVersion : 4, 0, 0, 4

SahAgent Object Recognized!
Type : Process
Data : QH4MKBV9.DLL
Category : Data Miner
Comment : (CSI MATCH)
Object : C:\WINDOWS\SYSTEM\
FileVersion : 4, 0, 0, 2
ProductVersion : 4, 0, 0, 2

Warning! SahAgent Object found in memory(C:\WINDOWS\SYSTEM\QH4MKBV9.DLL)


SahAgent Object Recognized!
Type : Process
Data : AP9H4QMO.EXE
Category : Data Miner
Comment : (CSI MATCH)
Object : C:\WINDOWS\SYSTEM\
FileVersion : 4, 0, 0, 4
ProductVersion : 4, 0, 0, 4

Warning! SahAgent Object found in memory(C:\WINDOWS\SYSTEM\AP9H4QMO.EXE)

"C:\WINDOWS\SYSTEM\AP9H4QMO.EXE"Process terminated successfully

#:15 [FDM.EXE]
FilePath : C:\PROGRAMME\FREE DOWNLOAD MANAGER\
ProcessID : 4294062393
Threads : 6
Priority : Normal
FileVersion : 1.0
ProductVersion : 1.0
ProductName : Free Download Manager
FileDescription : Free Download Manager
InternalName : Free Download Manager
LegalCopyright : Copyright (C) 2003
OriginalFilename : fdm.exe

#:16 [TRILLIAN.EXE]
FilePath : C:\PROGRAMME\TRILLIAN\
ProcessID : 4294091309
Threads : 22
Priority : Normal
FileVersion : 3.1.0.121
ProductVersion : 3.1.0.121
ProductName : Trillian
CompanyName : Cerulean Studios
FileDescription : Trillian
InternalName : Trillian
LegalCopyright : © Cerulean Studios, LLC. All rights reserved.
OriginalFilename : Trillian.exe

#:17 [SOFFICE.EXE]
FilePath : C:\PROGRAMME\OPENOFFICE.ORG1.1.4\PROGRAM\
ProcessID : 4294099597
Threads : 4
Priority : Normal
FileVersion : 6.00.8779
ProductVersion : 6.00.8779
CompanyName : OpenOffice.org
FileDescription : OpenOffice.org 1.1.4
InternalName : SOFFICE
LegalCopyright : Copyright © 2000 by Sun Microsystems, Inc.
OriginalFilename : SOFFICE.EXE

#:18 [WMIEXE.EXE]
FilePath : C:\WINDOWS\SYSTEM\
ProcessID : 4294132325
Threads : 3
Priority : Normal
FileVersion : 5.00.1755.1
ProductVersion : 5.00.1755.1
ProductName : Microsoft(R) Windows NT(R) Operating System
CompanyName : Microsoft Corporation
FileDescription : WMI service exe housing
InternalName : wmiexe
LegalCopyright : Copyright (C) Microsoft Corp. 1981-1998
OriginalFilename : wmiexe.exe

#:19 [DDHELP.EXE]
FilePath : C:\WINDOWS\SYSTEM\
ProcessID : 4293982633
Threads : 3
Priority : Realtime
FileVersion : 4.06.03.0518
ProductVersion : 4.06.03.0518
ProductName : Microsoft® DirectX for Windows® 95 and 98
CompanyName : Microsoft Corporation
FileDescription : Microsoft DirectX Helper
InternalName : ddhelp.exe
LegalCopyright : Copyright © Microsoft Corp. 1994-1999
OriginalFilename : ddhelp.exe

#:20 [FIREFOX.EXE]
FilePath : C:\PROGRAMME\MOZILLA FIREFOX\
ProcessID : 4294182737
Threads : 4
Priority : Normal


#:21 [AD-AWARE.EXE]
FilePath : C:\PROGRAMME\LAVASOFT\AD-AWARE SE PERSONAL\
ProcessID : 4294233381
Threads : 2
Priority : Normal
FileVersion : 6.2.0.206
ProductVersion : VI.Second Edition
ProductName : Lavasoft Ad-Aware SE
CompanyName : Lavasoft Sweden
FileDescription : Ad-Aware SE Core application
InternalName : Ad-Aware.exe
LegalCopyright : Copyright © Lavasoft Sweden
OriginalFilename : Ad-Aware.exe
Comments : All Rights Reserved

Memory scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 1
Objects found so far: 12


Started registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Registry Scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 12


Started deep registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Deep registry scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 12


Started Tracking Cookie scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»


Tracking cookie scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 12



Deep scanning and examining files (c:)
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Disk Scan Result for c:\
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 12


Performing conditional scans...
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Conditional scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 12

16:00:27 Scan Complete

Summary Of This Scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Total scanning time:00:09:32.810
Objects scanned:43510
Objects identified:1
Objects ignored:0
New critical objects:1

Hier noch der Escan:

Sun Mar 13 16:38:02 2005 => File C:\WINDOWS\SYSTEM\srchbar.dll infected by "not-a-virus:AdWare.ToolBar.VB.f" Virus. Action Taken: No Action Taken.
Sun Mar 13 16:38:12 2005 => File C:\WINDOWS\SYSTEM\ap9h4qmo.exe infected by "not-a-virus:AdWare.Sahat.o" Virus. Action Taken: No Action Taken.
Sun Mar 13 16:38:56 2005 => File C:\WINDOWS\a95kfrhe.exe infected by "not-a-virus:AdWare.Sahat.o" Virus. Action Taken: No Action Taken.
Sun Mar 13 16:41:29 2005 => File C:\WINDOWS\SYSTEM\unregister.exe infected by "not-a-virus:AdWare.ToolBar.VB.f" Virus. Action Taken: No Action Taken
Sun Mar 13 16:41:42 2005 => File C:\WINDOWS\SYSTEM\qh4mkbv9.dll infected by "not-a-virus:AdWare.Sahat.l" Virus. Action Taken: No Action Taken.
Sun Mar 13 16:41:43 2005 => File C:\WINDOWS\SYSTEM\q17i9a4j.exe infected by "not-a-virus:AdWare.Sahat.o" Virus. Action Taken: No Action Taken.
Sun Mar 13 16:43:51 2005 => File C:\WINDOWS\SYSTEM\unregister.exe infected by "not-a-virus:AdWare.ToolBar.VB.f" Virus. Action Taken: No Action Taken.
Sun Mar 13 16:43:58 2005 => File C:\WINDOWS\SYSTEM\qh4mkbv9.dll infected by "not-a-virus:AdWare.Sahat.l" Virus. Action Taken: No Action Taken.
Sun Mar 13 16:43:59 2005 => File C:\WINDOWS\SYSTEM\q17i9a4j.exe infected by "not-a-virus:AdWare.Sahat.o" Virus. Action Taken: No Action Taken.
Sun Mar 13 16:51:16 2005 => File C:\WINDOWS\a95kfrhe.exe infected by "not-a-virus:AdWare.Sahat.o" Virus. Action Taken: No Action Taken.
Sun Mar 13 16:58:03 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\OPTIMIZE.VIR
Sun Mar 13 16:58:03 2005 => File C:\Programme\AVPersonal\INFECTED\OPTIMIZE.VIR infected by "Trojan-Downloader.Win32.Dyfuca.du" Virus. Action Taken: No Action Taken.
Sun Mar 13 16:58:03 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\DAE81AFA.0F5
Sun Mar 13 16:58:03 2005 => File C:\Programme\AVPersonal\INFECTED\DAE81AFA.0F5 infected by "Trojan-Downloader.Win32.IstBar.gen" Virus. Action Taken: No Action Taken.
Sun Mar 13 16:58:03 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\#INDEX#
Sun Mar 13 17:25:39 2005 => File C:\Program Files\AdTools Service\AdToolsComm.dll infected by "not-a-virus:AdWare.WinAD.z" Virus. Action Taken: No Action Taken.

DANKE & LG,

Hallo@Yourhighness

#öffne das HijackThis-->> Button "scan" -->> Häkchen setzen -->> Button "Fix checked" -->> PC neustarten

O3 - Toolbar: Search Bar - {0A8CE102-FA03-4612-9BEE-7FE5452F4CB1} - C:\WINDOWS\SYSTEM\srchbar.dll
O4 - HKLM\..\Run: [Media Pass] C:\Program Files\Media Pass\MediaPass.exe
O4 - HKLM\..\Run: [ap9h4qmo] C:\WINDOWS\SYSTEM\ap9h4qmo.exe

PC neustarten

•KillBox
http://www.bleepingcomputer.com/files/killbox.php

•Delete File on Reboot <--anhaken

und klick auf das rote Kreuz,
wenn gefragt wird, ob "Do you want to reboot? "----> klicke auf "no",und kopiere das naechste rein, erst beim letzten auf "yes"

C:\WINDOWS\SYSTEM\ap9h4qmo.exe
C:\WINDOWS\SYSTEM\q17i9a4j.exe
C:\WINDOWS\SYSTEM\qh4mkbv9.dll
C:\WINDOWS\a95kfrhe.exe
C:\WINDOWS\SYSTEM\srchbar.dll
C:\WINDOWS\SYSTEM\unregister.exe
C:\Program Files\AdTools Service\AdToolsComm.dll
C:\Program Files\Media Pass\MediaPass.exe
C:\Program Files\Media Pass\MediaPassK.exe
C:\Program Files\Media Pass\MediaPassC.dll
C:\Program Files\Media Pass\Info.txt
C:\WINDOWS\temp\USB.exe
C:\WINDOWS\temp\oddworldz.exe
C:\WINDOWS\temp\istinstall.exe

PC neustarten

ueberpruefe, ob das geloescht ist.

C:\WINDOWS\temp\USB.exe
C:\WINDOWS\temp\oddworldz.exe
C:\WINDOWS\temp\istinstall.exe

#RegCleaner
(Tip: Lade RegCleaner, stelle das Tool in Deutsch ein und saeubere ueber <Tools<Registry saeubern<alles durchfuehren < den PC (du kannst alles angezeigte Loeschen, denn es verbleibt eine Sicherung)
http://www.chip.de/downloads/c_downloads_8830516.html

dann poste das neue Log vom HijackThis

Der Eintrag war gar ned mehr doa:

O4 - HKLM\..\Run: [Media Pass] C:\Program Files\Media Pass\MediaPass.exe
...
ueberpruefe, ob das geloescht ist.

C:\WINDOWS\temp\USB.exe
C:\WINDOWS\temp\oddworldz.exe
C:\WINDOWS\temp\istinstall.exe

Dateien nicht mehr vorhanden. Mhhm - hab ich noch mal adaware laufen gehabt? LOL.

Registry dingens hab ich laufen lassen und alles gelöscht. Aber irgendwie ist das mit auf Deutsch einstellen an mir vorbei geganen? Aber Englisch ist ja auch kein Problem

Logfile of HijackThis v1.99.1
Scan saved at 20:08:02, on 13.03.05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v5.00 (5.00.2614.3500)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\WINDOWS\SYSTEM\ATI2EVXX.EXE
C:\PROGRAMME\EXECUTIVE SOFTWARE\DISKEEPER\DKSERVICE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAMME\ZONE LABS\ZONEALARM\ZLCLIENT.EXE
C:\PROGRAMME\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATIPTAXX.EXE
C:\PROGRAMME\AVPERSONAL\AVGCTRL.EXE
C:\PROGRAMME\FREE DOWNLOAD MANAGER\FDM.EXE
C:\PROGRAMME\OPENOFFICE.ORG1.1.4\PROGRAM\SOFFICE.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAMME\MOZILLA FIREFOX\FIREFOX.EXE
C:\PROGRAMME\TRILLIAN\TRILLIAN.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\EIGENE DATEIEN\HJT\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.de/
O2 - BHO: WgBHO Class - {67E9834D-B226-49E6-B6F6-85AA64E14BA3} - C:\PROGRAMME\FREE DOWNLOAD MANAGER\IEFDM.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAMME\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AVGCtrl] "C:\PROGRA~1\AVPERS~1\AVGCTRL.EXE" /min
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKLM\..\RunServices: [ATIPOLL] ati2evxx.exe
O4 - HKLM\..\RunServices: [ATISmart] C:\WINDOWS\SYSTEM\ati2s9ag.exe
O4 - HKLM\..\RunServices: [DkService] C:\Programme\Executive Software\Diskeeper\DkService.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] C:\WINDOWS\SYSTEM\mstask.exe
O4 - HKCU\..\Run: [Free Download Manager] C:\Programme\Free Download Manager\fdm.exe -autorun
O4 - Startup: OpenOffice.org 1.1.4.lnk = C:\Programme\OpenOffice.org1.1.4\program\quickstart.exe
O4 - Startup: Adobe Gamma Loader.exe.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: Download by Free Download Manager - file://C:\Programme\Free Download Manager\dllink.htm
O8 - Extra context menu item: Download web site by Free Download Manager - file://C:\Programme\Free Download Manager\dlpage.htm
O8 - Extra context menu item: Download all by Free Download Manager - file://C:\Programme\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected by Free Download Manager - file://C:\Programme\Free Download Manager\dlselected.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_01\bin\npjpi150_01.dll
O14 - IERESET.INF: SEARCH_PAGE_URL=
O14 - IERESET.INF: START_PAGE_URL=
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 192.168.122.252,192.168.122.253

DANKE!

ja, mein Englisch-Engel

Das mit dem "Deutsch" war einfach abkopiert .......

Na, ich hät mir auch zugetraut das ichs übersehen hab LOL. Der HJT Log ist doch jetzt sauber oder?
Danke&LG,

im Prinzip ja, nur das hier...das gefaellt mir nicht:

O14 - IERESET.INF: SEARCH_PAGE_URL=
O14 - IERESET.INF: START_PAGE_URL=

O14 = Veränderungen unter "Webeinstellungen zurücksetzen"

gehe zur Systemsteuerung --> Internetoptionen --> auf dem Reiter Allgemein bei Temporäre Internetdateien klickst du Dateien löschen --> auch bei Alle Offlineinhalte löschen das Häkchen setzen und mit OK bestätigen --> Auf den Reiter Programme gehen und dort auf Webeinstellungen zurücksetzen klicken, mit Ja bestätigen, fall Nachfrage kommt --> auf Übernehmen und abschließend auf OK klicken

Ja die Einträge waren mir auch aufgefallen. Hatte Sie auch schon mal mit HJT gefixt. Habe jetzt das mit den Inet Optionen gemacht. Warte mal, werd noch mal HJT laufen lassen und schaun ob einträge jetzt weg sind...sind noch da....Oder muss ich erst neustarten, wieder O14 Einträge anklicken, fixen und Neustarten?.
Danke & LG,

EDIT: Hatte es tatsächlich übersehen. Habs jetzt auf Deutsch umgestellt .