Hallo...
Ich habe ein Problem :rolley:

Und zwar folgendes... Wenn ich sachen mit dem IE mache dann gehen permanent Werbeseiten von Casino-Online oder dergleichen auf und irgendwelche Pornoseiten.

Hier der log:

Logfile of HijackThis v1.99.1
Scan saved at 20:40:30, on 21.03.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\explorer.exe
c:\progra~1\intern~1\iexplore.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Programme\Valve\Steam\Steam.exe
C:\Programme\IKManager2\IKManager.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.de/0SEDEDE/SAOS01
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 199.172.228.206:80
O2 - BHO: PreispiratenSearchURL - {0B660087-931C-4056-A04F-0423890E40B6} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {78364D99-A640-4ddf-B91A-67EFF8373045} - C:\WINDOWS\System32\appwiz.dll (file missing)
O2 - BHO: (no name) - {927A6D3A-6E22-00C2-F53E-8049AD677026} - C:\DOKUME~1\SEBAST~1\ANWEND~1\ATOMBU~1\Boob keep.exe
O2 - BHO: (no name) - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - (no file)
O2 - BHO: (no name) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O2 - BHO: CoTGT_BHO Class - {C333CF63-767F-4831-94AC-E683D962C63C} - (no file)
O2 - BHO: metaspinner media GmbH - {D3AA56A9-8137-4950-A6F9-D0190A82AF2A} - (no file)
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [BearShare] "C:\Programme\BearShare\BearShare.exe" /pause
O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [msnmsgr] "C:\Programme\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [CursorXP] C:\Programme\CursorXP\CursorXP.exe
O4 - HKCU\..\Run: [Setup Less] C:\DOKUME~1\SEBAST~1\ANWEND~1\WINONE~1\lite bait.exe
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Outpost Firewall Pro Quick Tune - {44627E97-789B-40d4-B5C2-58BD171129A1} - C:\Programme\Agnitum\Outpost Firewall\Plugins\BrowserBar\ie_bar.dll (file missing)
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) - https://signup.msn.com/pages/MsnInstC.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/Shar ... vSniff.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v ... 4624290656
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/Shar ... /cabsa.cab
O16 - DPF: {CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA} (Java Plug-in) -
O16 - DPF: {CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1_02) -
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: c:\progra~1\agnitum\outpos~1\wl_hook.dll
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Outpost Firewall Service (OutpostFirewall) - Unknown owner - C:\Programme\Agnitum\Outpost Firewall\outpost.exe (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

( Neuer Log nach deinstallation von Bearshare & HJT in eigenem Ordner )

Deinstalliere Bearshare und speichere HJT in einem eigenen Ordner. Editiere deinen ersten Post und fuege ein neues HJT Log ein. In einem neuen Post ("post reply"), bitte folgendes einfuegen:

Datfinbad
- abarbeiten und alle 4 Logs in den Thread kopieren (mit Pfad)
Die letzten 3 Monate reichen
http://virus-protect.org/datfindbat.html

1. Doppel-klick DATFINDBAT
2. Es oeffnet sich der Texteditor. Speichern als system32.txt
3. auf das Command Fenster klicken und beliebige Taste druecken
4. Es oeffnet sich der Texteditor. Speichern als Temp.txt.
5. Wiederhole Schritt 3 und speichere als WINDOWS.txt.
6. Wiederhole Schritt 3 und speichere als C.txt.
7. Poste ALLE Logs hier in diesen Thread

mfg

system32.txt:

Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: 100A-3E47

Verzeichnis von C:\WINDOWS\system32

21.03.2006 17:00 749 wuaucpl.cpl.manifest
21.03.2006 17:00 749 ncpa.cpl.manifest
21.03.2006 17:00 749 cdplayer.exe.manifest
21.03.2006 17:00 749 sapi.cpl.manifest
21.03.2006 17:00 749 nwc.cpl.manifest
21.03.2006 16:43 17.500 BMXState-{00000000-00000000-0000000B-00001102-00000002-80641102}.rfx
21.03.2006 16:43 29.808 BMXCtrlState-{00000000-00000000-0000000B-00001102-00000002-80641102}.rfx
21.03.2006 16:43 29.808 BMXBkpCtrlState-{00000000-00000000-0000000B-00001102-00000002-80641102}.rfx
21.03.2006 16:43 17.500 BMXStateBkp-{00000000-00000000-0000000B-00001102-00000002-80641102}.rfx
21.03.2006 16:43 1.080 settings.sfm
21.03.2006 16:43 1.080 settingsbkup.sfm
21.03.2006 16:43 24 DVCState-{00000000-00000000-0000000B-00001102-00000002-80641102}.dat
21.03.2006 16:43 24 DVCStateBkp-{00000000-00000000-0000000B-00001102-00000002-80641102}.dat
17.03.2006 07:03 2.262 wpa.dbl
10.03.2006 01:10 4.799.320 MRT.exe
20.02.2006 21:04 24 sysmwwod.dll
12.02.2006 19:01 4.096 ftx32.dll
12.02.2006 18:29 7.006 jupdate-1.5.0_06-b05.log
08.02.2006 17:41 2 cmd.com
08.02.2006 17:41 2 regedit.com
08.02.2006 17:41 2 taskkill.com
08.02.2006 17:41 2 tracert.com
08.02.2006 17:41 2 ping.com
08.02.2006 17:41 2 tasklist.com
08.02.2006 17:41 2 netstat.com
26.01.2006 15:16 45 initdebug.nfo
25.01.2006 04:34 118.784 sirenacm.dll
18.01.2006 13:05 57.344 avsda.dll
15.01.2006 19:35 48.156 perfc007.dat
15.01.2006 19:35 316.594 perfh007.dat
15.01.2006 19:35 39.992 perfc009.dat
15.01.2006 19:35 311.604 perfh009.dat
15.01.2006 19:35 723.744 PerfStringBackup.INI
15.01.2006 19:28 112.584 FNTCACHE.DAT
15.01.2006 18:00 257 spupdwxp.log
04.01.2006 04:35 68.096 webclnt.dll

Temp.txt:


Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: 100A-3E47

Verzeichnis von C:\DOKUME~1\SEBAST~1\LOKALE~1\Temp

21.03.2006 20:42 283 wahtmltmp00.htm
21.03.2006 20:38 16.384 ~DFDDBC.tmp
21.03.2006 18:54 59.964 ~e5.0001
21.03.2006 18:05 32.768 ~DFAC4.tmp
21.03.2006 16:35 16.384 ~DF5E05.tmp
21.03.2006 16:35 16.384 ~DF5DE9.tmp
21.03.2006 16:35 16.384 ~DF5DCD.tmp
21.03.2006 16:35 16.384 ~DF5DB1.tmp
21.03.2006 16:31 16.384 ~DFBD65.tmp
21.03.2006 16:31 16.384 ~DFBD49.tmp
21.03.2006 16:31 16.384 ~DFBD28.tmp
21.03.2006 16:31 16.384 ~DFBD0B.tmp
21.03.2006 14:18 32.768 ~DF6DC0.tmp
21.03.2006 14:11 16.384 ~DFA56D.tmp
21.03.2006 14:11 16.384 ~DF9283.tmp
21.03.2006 07:46 10.743 jusched.log
20.03.2006 18:24 198.885 bis24.exe
19.03.2006 22:07 0 ~DFB1.tmp
19.03.2006 03:13 16.384 ~DF4F8D.tmp
19.03.2006 03:13 16.384 ~DF424A.tmp

WINDOWS.txt:

Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: 100A-3E47

Verzeichnis von C:\WINDOWS

21.03.2006 17:03 227 system.ini
21.03.2006 17:03 1.221 win.ini
21.03.2006 17:00 82.377 setupapi.log
21.03.2006 17:00 749 WindowsShell.Manifest
21.03.2006 16:53 176.884 setupact.log
21.03.2006 16:44 0 0.log
21.03.2006 16:44 157 wiadebug.log
21.03.2006 16:44 1.286.747 WindowsUpdate.log
21.03.2006 16:44 50 wiaservc.log
21.03.2006 16:44 2.048 bootstat.dat
17.03.2006 16:11 3.382.479 {00000000-00000000-0000000B-00001102-00000002-80641102}.BAK
17.03.2006 16:11 3.382.479 {00000000-00000000-0000000B-00001102-00000002-80641102}.CDF
17.03.2006 13:35 40 nero.INI
15.03.2006 20:43 49 NeroDigital.ini
14.03.2006 17:39 345 sierra.ini
14.03.2006 16:40 10 popcinfo.dat
28.02.2006 21:49 1.738 eReg.dat
20.02.2006 20:57 196 cdplayer.ini
18.02.2006 12:20 30.209 spupdsvc.log
18.02.2006 07:33 110.587 comsetup.log
18.02.2006 07:33 384.674 iis6.log
18.02.2006 07:33 66.807 ntdtcsetup.log
18.02.2006 07:33 146.713 tsoc.log
18.02.2006 07:33 1.374 imsins.log
18.02.2006 07:33 17.122 ocmsn.log
18.02.2006 07:33 14.123 tabletoc.log
18.02.2006 07:33 13.131 KB911927.log
18.02.2006 07:33 22.412 medctroc.Log
18.02.2006 07:33 49.552 netfxocm.log
18.02.2006 07:33 160.546 ocgen.log
18.02.2006 07:33 15.559 msgsocm.log
18.02.2006 07:33 298.687 FaxSetup.log
18.02.2006 07:33 102.606 msmqinst.log
18.02.2006 07:33 14.973 updspapi.log
18.02.2006 07:33 1.374 imsins.BAK
18.02.2006 07:33 9.187 KB911564.log
18.02.2006 07:33 61.190 wmsetup.log
18.02.2006 07:33 9.418 KB911565.log
18.02.2006 07:32 6.633 KB913446.log
30.01.2006 12:07 54.156 QTFont.qfn
28.01.2006 18:58 1.149 wmsetup10.log
23.01.2006 15:42 107.132 UninstallFirefox.exe
23.01.2006 15:42 14.791 mozver.dat
17.01.2006 18:41 636.054 Firefox Wallpaper.bmp


C.txt:

Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: 100A-3E47

Verzeichnis von C:\

21.03.2006 20:46 0 sys.txt
21.03.2006 20:46 10.042 WINDOWS.txt
21.03.2006 20:46 10.042 system.txt
21.03.2006 20:46 48.275 Temp.txt
21.03.2006 20:45 48.275 systemtemp.txt
21.03.2006 20:45 105.511 system32.txt
21.03.2006 17:03 211 boot.ini
21.03.2006 16:44 536.870.912 pagefile.sys
19.03.2006 22:29 517 hpfr3420.xml
19.03.2006 22:29 798 hpfr3420.log
13.03.2006 14:42 2.433 test.spr
15.01.2006 17:44 47.564 NTDETECT.COM
15.01.2006 17:44 251.184 ntldr


Gruss und Danke bis hierhin
Sebastian

Cleanup!
http://www.stevengould.org/downloads/cl ... anUp40.exe
--> Bebilderte Anleitung ( http://virus-protect.org/cleanup.html )

Der Rest muss bis Heute Abend warten, oder Nikita....

mfg

Yourhighness hat geschrieben:Cleanup!
http://www.stevengould.org/downloads/cl ... anUp40.exe
--> Bebilderte Anleitung ( http://virus-protect.org/cleanup.html )

Der Rest muss bis Heute Abend warten, oder Nikita....

mfg

Okay bis hierhin alles erledigt.

Hi!

Bearshare ist noch auf dem System!

oeffne das HijackThis-->> Button "scan" -->> Haekchen setzen -->> Button "Fix checked" -->> PC neustarten

O2 - BHO: (no name) - {78364D99-A640-4ddf-B91A-67EFF8373045} - C:\WINDOWS\System32\appwiz.dll (file missing)
O2 - BHO: (no name) - {927A6D3A-6E22-00C2-F53E-8049AD677026} - C:\DOKUME~1\SEBAST~1\ANWEND~1\ATOMBU~1\Boob keep.exe
O2 - BHO: (no name) - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - (no file)
O2 - BHO: (no name) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O2 - BHO: CoTGT_BHO Class - {C333CF63-767F-4831-94AC-E683D962C63C} - (no file)
O2 - BHO: metaspinner media GmbH - {D3AA56A9-8137-4950-A6F9-D0190A82AF2A} - (no file)
O4 - HKLM\..\Run: [BearShare] "C:\Programme\BearShare\BearShare.exe" /pause
O9 - Extra button: Outpost Firewall Pro Quick Tune - {44627E97-789B-40d4-B5C2-58BD171129A1} - C:\Programme\Agnitum\Outpost Firewall\Plugins\BrowserBar\ie_bar.dll (file missing)
O16 - DPF: {CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA} (Java Plug-in) -
O23 - Service: Outpost Firewall Service (OutpostFirewall) - Unknown owner - C:\Programme\Agnitum\Outpost Firewall\outpost.exe (file missing)

---------------------------------------

Virustotal
Oben auf der Seite --> auf Durchsuchen klicken --> Datei aussuchen --> Doppelklick auf die zu prüfende Datei
--> klick auf Submit... jetzt abwarten --> kopiere das Ergebnis in das Sicherheitsforum
http://www.virustotal.com/flash/index_en.html


C:\DOKUME~1\SEBAST~1\ANWEND~1\WINONE~1\lite bait.exe

--------------------------------------

KILLBOX
Anleitung: (bebildert)
http://yourhighness.eddys-domain.de/killbox.html
- Delete File on Reboot -- anhaken
- reinkopieren:

C:\Programme\IKManager2\IKManager.exe
C:\DOKUME~1\SEBAST~1\ANWEND~1\ATOMBU~1\Boob keep.exe
C:\Programme\BearShare\BearShare.exe
C:\WINDOWS\system32\cmd.com
C:\WINDOWS\system32\regedit.com
C:\WINDOWS\system32\taskkill.com
C:\WINDOWS\system32\tracert.com
C:\WINDOWS\system32\ping.com
C:\WINDOWS\system32\tasklist.com
C:\WINDOWS\system32\netstat.com

und klicke auf das rote Kreuz, wenn gefragt wird, ob "Do you want to reboot? "----
klicke auf "no",und kopiere das nächste rein, erst beim letzten auf "yes"

----------------------------------------------------

Counterspy
Anleitung: http://virus-protect.org/counterspy.html
Download : http://www.sunbelt-software.com/CounterSpy-Download.cfm

* Klicke: "Run a Spyware Scan Now"
* nach dem Scan muss man sich entscheiden für:

*Ignore
*Remove
*Quarantaine

wähle immer Remove und starte den PC neu (dann kopiere den Scanreport ab...
falls du einen Beitrag in einem Sicherheitsforum eroeffnet hast)

mfg

Virustotal :

Da stand, dass der Report dauern kann und ich ihn per Email bekomme.

Counterspy :

Ich musste erst den windows script host aktivieren. Hab dann gegoogelt und dieses getan, da er sonst die installation abgebrochen hat. Kann ich den aktiviert lassen oder wieder deaktivieren?



Spyware Scan Details
Start Date: 22.03.2006 21:47:04
End Date: 22.03.2006 22:22:13
Total Time: 35 mins 9 secs

Detected spyware

AntiLeech Plugin Adware more information...
Details: Plugin is an Ad-Ware software which enables the broadcasting of advertisements, and execution of e-commerce and other internet related services on the user-interface of the software.
Status: Deleted

Infected files detected
c:\programme\anti-leech\alnn\al2np.dll
c:\programme\anti-leech\alnn\alhlp.exe
c:\programme\anti-leech\alnn\npalnn.dll
c:\programme\anti-leech\alnn\setup2.exe
C:\Programme\Mozilla Firefox\plugins\al2np.dll
C:\Programme\Netscape\Netscape\plugins\al2np.dll

Infected registry entries detected
HKEY_CURRENT_USER\Software\Anti-Leech\Anti-Leech Plugin
HKEY_CURRENT_USER\Software\Anti-Leech\Anti-Leech Plugin Mozilla Firefox 1.0.1 C:\Programme\Mozilla Firefox\Plugins
HKEY_CURRENT_USER\Software\Anti-Leech\Anti-Leech Plugin Mozilla Firefox 1.0.2 C:\Programme\Mozilla Firefox\Plugins
HKEY_CURRENT_USER\Software\Anti-Leech\Anti-Leech Plugin Mozilla Firefox 1.0.3 C:\Programme\Mozilla Firefox\Plugins
HKEY_CURRENT_USER\Software\Anti-Leech\Anti-Leech Plugin Mozilla Firefox 1.0.4 C:\Programme\Mozilla Firefox\Plugins
HKEY_CURRENT_USER\Software\Anti-Leech\Anti-Leech Plugin Mozilla Firefox 1.0.6 C:\Programme\Mozilla Firefox\Plugins
HKEY_CURRENT_USER\Software\Anti-Leech\Anti-Leech Plugin Mozilla Firefox 1.5.0.1 C:\Programme\Mozilla Firefox\plugins\
HKEY_CURRENT_USER\Software\Anti-Leech\Anti-Leech Plugin Netscape 7.1 C:\Programme\Netscape\Netscape\Plugins
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Anti-Leech ALNN
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Anti-Leech ALNN DisplayName Anti-Leech Plugin for Netscape, Mozilla, Opera
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Anti-Leech ALNN UninstallString C:\Programme\Anti-Leech\ALNN\setup2.exe -u


NetPumper Adware Bundler more information...
Details: Bundles with a number of adware components such as cydoor, Save!, ClockSync, and WhenU Toolbar.
Status: Deleted

Infected files detected
c:\programme\netpumper\zm\np_0123_1.exe

Infected registry entries detected
HKEY_LOCAL_MACHINE\SOFTWARE\NetPumper
HKEY_LOCAL_MACHINE\SOFTWARE\NetPumper\Affiliated\Pro\Firstrun state 2
HKEY_LOCAL_MACHINE\SOFTWARE\NetPumper VersionInfo MXzcIAgGWqKEthSsQGx3yLBJPb9s8DvJ+1veeyEu11mYEvZp6UG-KT4KsyHeUJdB3UyFvLeUpsKSM-WJj-pP+nLRm6X7yRSUkH4kuyYwQQvjygtoKcNqEGIq0WIEouJ9lj6Bpc8Oa3CGcclzNxG1oQYwFly8eWPxVPP8EKuhG0I
HKEY_CURRENT_USER\Software\NetPumper
HKEY_CURRENT_USER\Software\NetPumper\XXXSeb Field1 1770024421
HKEY_CURRENT_USER\Software\NetPumper\XXX Field2 465007510
HKEY_CURRENT_USER\Software\NetPumper\XXX Field3 1661007271
HKEY_CURRENT_USER\Software\NetPumper\XXXX Field4 30046045
HKEY_CLASSES_ROOT\Interface\{A8B0F390-E6BF-4027-A4D4-1E4363F5E27B}
HKEY_CLASSES_ROOT\Interface\{A8B0F390-E6BF-4027-A4D4-1E4363F5E27B}\ProxyStubClsid {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\Interface\{A8B0F390-E6BF-4027-A4D4-1E4363F5E27B}\ProxyStubClsid32 {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\Interface\{A8B0F390-E6BF-4027-A4D4-1E4363F5E27B}\TypeLib {1145A909-A836-44B8-B03A-48D858B0F43E}
HKEY_CLASSES_ROOT\Interface\{A8B0F390-E6BF-4027-A4D4-1E4363F5E27B}\TypeLib Version 1.2
HKEY_CLASSES_ROOT\Interface\{A8B0F390-E6BF-4027-A4D4-1E4363F5E27B} IAddUrl
HKEY_CLASSES_ROOT\Interface\{A9E33220-0B05-11D7-88D2-444553540000}
HKEY_CLASSES_ROOT\Interface\{A9E33220-0B05-11D7-88D2-444553540000}\ProxyStubClsid {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\Interface\{A9E33220-0B05-11D7-88D2-444553540000}\ProxyStubClsid32 {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\Interface\{A9E33220-0B05-11D7-88D2-444553540000}\TypeLib {1145A909-A836-44B8-B03A-48D858B0F43E}
HKEY_CLASSES_ROOT\Interface\{A9E33220-0B05-11D7-88D2-444553540000}\TypeLib Version 1.2
HKEY_CLASSES_ROOT\Interface\{A9E33220-0B05-11D7-88D2-444553540000} IAddPackage
CoolWebSearch.SDMTB Browser Plug-in more information...
Details: CoolWebSearch.SDMTB is a BHO CoolWebSearch variant that installs via known Windows exploits.
Status: Deleted

Infected files detected
c:\windows\system32\sdmtb.dll


Trojan.Desktophijack Trojan more information...
Details: Trojan.Desktophijack modifies the home page and desktop settings on a compromised computer.
Status: Deleted

Infected files detected
c:\windows\desktop.html


Looking-For.Home Search Assistant Browser Hijacker more information...
Details: Home Search Assistant is an Internet Explorer browser helper object (BHO) that changes the user's home page and modifes search results. It also spawns pop-ups on the desktop.
Status: Deleted

Infected files detected
c:\dokumente und einstellungen\sebastian \anwendungsdaten\install.dat


RBot.steam Trojan more information...
Status: Deleted

Infected files detected
C:\Das was nicht in die anderen kommt\Counter Strike Condition Zero\platform\steam_dev.exe


SpySheriff Misc more information...
Details: SpySheriff is a purported anti-spyware application to scan for and remove spyware from users' computers.
Status: Deleted

Infected files detected
C:\WINDOWS\desktop.html

Infected registry entries detected
HKEY_CURRENT_USER\Software\SNO2


BearShare P2P Program more information...
Details: BearShare is a peer-to-peer (P2P) application that allows its users to join together in a network via the Internet and share files from each other's hard drives.
Status: Deleted

Infected registry entries detected
HKEY_CLASSES_ROOT\clsid\{9f95f736-0f62-4214-a4b4-caa6738d4c07}
HKEY_CLASSES_ROOT\clsid\{9f95f736-0f62-4214-a4b4-caa6738d4c07}\InprocServer32 C:\Programme\BearShare\RunMSC.dll
HKEY_CLASSES_ROOT\clsid\{9f95f736-0f62-4214-a4b4-caa6738d4c07}\InprocServer32 ThreadingModel Apartment
HKEY_CLASSES_ROOT\clsid\{9f95f736-0f62-4214-a4b4-caa6738d4c07}\ProgID RunMSC.Loader.1
HKEY_CLASSES_ROOT\clsid\{9f95f736-0f62-4214-a4b4-caa6738d4c07}\TypeLib {905D0DF2-3A0A-4D94-853C-54A12A745905}
HKEY_CLASSES_ROOT\clsid\{9f95f736-0f62-4214-a4b4-caa6738d4c07}\VersionIndependentProgID RunMSC.Loader
HKEY_CLASSES_ROOT\clsid\{9f95f736-0f62-4214-a4b4-caa6738d4c07} Loader Class
HKEY_CLASSES_ROOT\typelib\{905d0df2-3a0a-4d94-853c-54a12a745905}
HKEY_CLASSES_ROOT\typelib\{905d0df2-3a0a-4d94-853c-54a12a745905}\1.0\0\win32 C:\Programme\BearShare\RunMSC.dll
HKEY_CLASSES_ROOT\typelib\{905d0df2-3a0a-4d94-853c-54a12a745905}\1.0\FLAGS 0
HKEY_CLASSES_ROOT\typelib\{905d0df2-3a0a-4d94-853c-54a12a745905}\1.0\HELPDIR C:\Programme\BearShare\
HKEY_CLASSES_ROOT\typelib\{905d0df2-3a0a-4d94-853c-54a12a745905}\1.0 RunMSC 1.0 Type Library


WhenU.SaveNow Adware more information...
Details: WhenU.SaveNow is an adware application that displays pop-up advertising on the desktop in response to users' web browsing.
Status: Deleted

Infected registry entries detected
HKEY_CLASSES_ROOT\runmsc.loader.1\clsid
HKEY_CLASSES_ROOT\runmsc.loader.1\clsid {9F95F736-0F62-4214-A4B4-CAA6738D4C07}
HKEY_CLASSES_ROOT\runmsc.loader\clsid
HKEY_CLASSES_ROOT\runmsc.loader\clsid {9F95F736-0F62-4214-A4B4-CAA6738D4C07}
HKEY_CLASSES_ROOT\runmsc.loader\curver
HKEY_CLASSES_ROOT\runmsc.loader\curver RunMSC.Loader.1
HKEY_CLASSES_ROOT\interface\{c285d18d-43a2-4aef-83fb-bf280e660a97}
HKEY_CLASSES_ROOT\interface\{c285d18d-43a2-4aef-83fb-bf280e660a97}\ProxyStubClsid {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{c285d18d-43a2-4aef-83fb-bf280e660a97}\ProxyStubClsid32 {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\interface\{c285d18d-43a2-4aef-83fb-bf280e660a97}\TypeLib {905D0DF2-3A0A-4D94-853C-54A12A745905}
HKEY_CLASSES_ROOT\interface\{c285d18d-43a2-4aef-83fb-bf280e660a97}\TypeLib Version 1.0
HKEY_CLASSES_ROOT\interface\{c285d18d-43a2-4aef-83fb-bf280e660a97} ILoader
HKEY_CLASSES_ROOT\clsid\{9f95f736-0f62-4214-a4b4-caa6738d4c07}
HKEY_CLASSES_ROOT\clsid\{9f95f736-0f62-4214-a4b4-caa6738d4c07}\InprocServer32 C:\Programme\BearShare\RunMSC.dll
HKEY_CLASSES_ROOT\clsid\{9f95f736-0f62-4214-a4b4-caa6738d4c07}\InprocServer32 ThreadingModel Apartment
HKEY_CLASSES_ROOT\clsid\{9f95f736-0f62-4214-a4b4-caa6738d4c07}\ProgID RunMSC.Loader.1
HKEY_CLASSES_ROOT\clsid\{9f95f736-0f62-4214-a4b4-caa6738d4c07}\TypeLib {905D0DF2-3A0A-4D94-853C-54A12A745905}
HKEY_CLASSES_ROOT\clsid\{9f95f736-0f62-4214-a4b4-caa6738d4c07}\VersionIndependentProgID RunMSC.Loader
HKEY_CLASSES_ROOT\clsid\{9f95f736-0f62-4214-a4b4-caa6738d4c07} Loader Class


Ace Password Sniffer 1.1 Password Hijacker more information...
Details: Ace password sniffer 1. is a password hijacker which captures passwords of user's PC through http, ftp, smtp, pop3, telnet.
Status: Deleted

Infected registry entries detected
HKEY_CURRENT_USER\Software\EffeTech
HKEY_CURRENT_USER\Software\EffeTech\ICQ Sniffer 15-day Evaluation Version\Reg SetupTime 90534


EtherDetect Potentially Dangerous Tool more information...
Details: EtherDetect is connection-Oriented Packet Sniffer and Protocol Analyzer. EtherDetect Packet Sniffer enables you capture full TCP/IP packets and organize them by TCP connections or UDP threads. With its powerful filter, you can customize what you need to c
Status: Deleted

Infected registry entries detected
HKEY_CURRENT_USER\Software\EffeTech
HKEY_CURRENT_USER\Software\EffeTech\ICQ Sniffer 15-day Evaluation Version\Reg SetupTime 90534


PWS-Banker Password Hijacker more information...
Status: Deleted

Infected registry entries detected
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{78364D99-A640-4ddf-B91A-67EFF8373045}
HKEY_CLASSES_ROOT\AppID\{78364D99-A640-4ddf-B91A-67EFF8373045}
HKEY_LOCAL_MACHINE\SOFTWARE\Windows phid
HKEY_LOCAL_MACHINE\SOFTWARE\Windows installer_time
HKEY_LOCAL_MACHINE\SOFTWARE\Windows ftprap


Appwiz.E Trojan more information...
Details: Appwiz.E is a program used to capture sensitive information.
Status: Deleted

Infected registry entries detected
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{78364D99-A640-4ddf-B91A-67EFF8373045}


Apwiz.AA Key Logger more information...
Details: Apwiz.AA is a program used to capture sensitive information.
Status: Deleted

Infected registry entries detected
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{78364D99-A640-4ddf-B91A-67EFF8373045}


Trojan-PSW.Win32.Agent.eo Trojan more information...
Status: Deleted

Infected registry entries detected
HKEY_CLASSES_ROOT\AppID\{78364D99-A640-4ddf-B91A-67EFF8373045}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{78364D99-A640-4ddf-B91A-67EFF8373045}


BraveSentry Misc more information...
Details: BraveSentry is a purported anti-spyware application to scan for and remove spyware from users' computers
Status: Deleted

Infected registry entries detected
HKEY_CURRENT_USER\Software\Install



Gruss

Virustotal nachtrag:

Virus Total
_______________________________________________

Scan results
File: lite_bait.exe
Date: 03/22/2006 21:38:20 (CET)
----
AntiVir 6.34.0.14/20060322 found [Heuristic/Crypted]
Avast 4.6.695.0/20060322 found nothing
AVG 386/20060322 found nothing
Avira 6.34.0.53/20060322 found nothing
BitDefender 7.2/20060322 found nothing
CAT-QuickHeal 8.00/20060322 found [(Suspicious) - DNAScan]
ClamAV devel-20060126/20060322 found [Adware.Lop-130]
DrWeb 4.33/20060322 found [Trojan.Swizzor]
eTrust-InoculateIT 23.71.108/20060322 found nothing
eTrust-Vet 12.4.2129/20060322 found [Win32/Swizzor]
Ewido 3.5/20060322 found nothing
Fortinet 2.71.0.0/20060322 found [suspicious]
F-Prot 3.16c/20060322 found nothing
Ikarus 0.2.59.0/20060322 found [AdWare.Lop.AG]
Kaspersky 4.0.2.24/20060322 found [not-a-virus:AdWare.Win32.Lop.ag]
McAfee 4724/20060322 found [Swizzor.gen]
NOD32v2 1.1455/20060322 found [Win32/TrojanDownloader.Swizzor]
Norman 5.70.10/20060322 found [Swizzor.HD]
Panda 9.0.0.4/20060322 found [Adware/Lop]
Sophos 4.03.0/20060322 found nothing
Symantec 8.0/20060322 found nothing
TheHacker 5.9.6.117/20060321 found [Trojan/Downloader.Swizzor]
UNA 1.83/20060322 found nothing
VBA32 3.10.5/20060322 found nothing

KILLBOX
Anleitung: (bebildert)
http://yourhighness.eddys-domain.de/killbox.html
- Delete File on Reboot -- anhaken
- reinkopieren:

c:\programme\anti-leech\alnn\al2np.dll
c:\programme\anti-leech\alnn\alhlp.exe
c:\programme\anti-leech\alnn\npalnn.dll
c:\programme\anti-leech\alnn\setup2.exe
C:\Programme\Mozilla Firefox\plugins\al2np.dll
C:\Programme\Netscape\Netscape\plugins\al2np.dll
c:\programme\netpumper\zm\np_0123_1.exe
c:\windows\system32\sdmtb.dll
c:\windows\desktop.html
c:\dokumente und einstellungen\sebastian chrzonowiz\anwendungsdaten\install.dat
C:\Das was nicht in die anderen kommt\Counter Strike Condition Zero\platform\steam_dev.exe
C:\WINDOWS\desktop.html
C:\DOKUME~1\SEBAST~1\ANWEND~1\WINONE~1\lite bait.exe

und klicke auf das rote Kreuz, wenn gefragt wird, ob "Do you want to reboot? "----
klicke auf "no",und kopiere das nächste rein, erst beim letzten auf "yes"

more to come. mfg

Alles erledigt!

auf C habe ich nun allerdings einen ordner.

!killbox nennt sich dieser, indem nun diese laitbait.exe datei drin ist.

Das Problem mit den sich öffnenden IE Fenstern hat sich auch erledigt!

Bis hier hin VIELEN DANK!!! Ihr habt mir wirklich sehr geholfen!

Das ist nun ein neuer HJT Log:

Logfile of HijackThis v1.99.1
Scan saved at 21:17:19, on 23.03.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Sunbelt Software\CounterSpy\Consumer\sunThreatEngine.exe
C:\Programme\Sunbelt Software\CounterSpy\Consumer\SunProtectionServer.exe
C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe
C:\Programme\Sunbelt Software\CounterSpy\Consumer\sunserver.exe
C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.de/0SEDEDE/SAOS01
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 199.172.228.206:80
O2 - BHO: PreispiratenSearchURL - {0B660087-931C-4056-A04F-0423890E40B6} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll (file missing)
O2 - BHO: (no name) - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - (no file)
O2 - BHO: (no name) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O2 - BHO: (no name) - {C333CF63-767F-4831-94AC-E683D962C63C} - (no file)
O2 - BHO: (no name) - {D3AA56A9-8137-4950-A6F9-D0190A82AF2A} - (no file)
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SunServer] C:\Programme\Sunbelt Software\CounterSpy\Consumer\sunserver.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Programme\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [CursorXP] C:\Programme\CursorXP\CursorXP.exe
O4 - HKCU\..\Run: [Setup Less] C:\DOKUME~1\SEBAST~1\ANWEND~1\WINONE~1\lite bait.exe
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll (file missing)
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) - https://signup.msn.com/pages/MsnInstC.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/Shar ... vSniff.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v ... 4624290656
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/Shar ... /cabsa.cab
O16 - DPF: {CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA} -
O16 - DPF: {CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1_02) -
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: c:\progra~1\agnitum\outpos~1\wl_hook.dll
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Outpost Firewall Service (OutpostFirewall) - Unknown owner - C:\Programme\Agnitum\Outpost Firewall\outpost.exe (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe



Ich hoffe nun ist alles i.O. .

Ich kann nur nochmal sagen wie sehr ich mich über die Hilfe freue. Thx!

gruss

Sebastian

fixe mit dem HijackThis:

O2 - BHO: PreispiratenSearchURL - {0B660087-931C-4056-A04F-0423890E40B6} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll (file missing)
O2 - BHO: (no name) - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - (no file)
O2 - BHO: (no name) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O2 - BHO: (no name) - {C333CF63-767F-4831-94AC-E683D962C63C} - (no file)
O2 - BHO: (no name) - {D3AA56A9-8137-4950-A6F9-D0190A82AF2A} - (no file)
O4 - HKCU\..\Run: [Setup Less] C:\DOKUME~1\SEBAST~1\ANWEND~1\WINONE~1\lite bait.exe

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll (file missing)

pc neustarten

http://virus-protect.org/artikel/spyware/lop1.html
loeschen:
C:\Dokumente und Einstellungen\SEBAST~1\Anwendungsdaten\WINONE....--> ist nicht der komplette Name...du musst suchen

Start -- alle Programme -- Zubehör -- Editor und kopiere folgenden Text rein:


dir %Windir%\tasks /a h > files.txt
notepad files.txt


- Speichern als: findjobs.bat
- abspeichern unter : Dateityp: alle Dateien
- speichere auf dem Desktop
- Locate findjobs.bat-- doppelklick auf die bat-Datei , der Editor öffnet sich -- poste den Text

Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: 100A-3E47

Verzeichnis von C:\WINDOWS\tasks

23.03.2006 07:52 <DIR> .
23.03.2006 07:52 <DIR> ..
23.03.2006 07:52 304 AC76EB3591999DE5.job
10.01.2002 11:44 65 desktop.ini
11.04.2005 15:38 364 FRU Task #Hewlett-Packard#hp psc 1100 series#1113230275.job
03.04.2005 16:41 6 SA.DAT
4 Datei(en) 739 Bytes

Verzeichnis von C:\Dokumente und Einstellungen\Sebastian Chrzonowiz\Desktop

Start -- alle Programme -- Zubehör -- Editor und kopiere folgenden Text rein:

%systemdrive%
cd C:\WINDOWS\Tasks
attrib -r -s -h AC76EB3591999DE5.job
del AC76EB3591999DE5.job


- Speichern als: remjob.bat
- abspeichern unter : Dateityp: alle Dateien
- speichere auf dem Desktop
- Locate remjob.bat-- doppelklick auf die bat-Datei , der Editor öffnet sich kurz ist normal

ueberpruefe mit panda, ob alles sauber ist.
http://virus-protect.org/onlinescan.html