Hijack sagt es soll jemand drauf schauen der Ahnung hat...

[Rubberduck]

Hallo zusammen,
mit großem Interesse lese ich in diesem Forum. Obwohl mein Rechner nicht wirklich spinnt, würde ich mich doch freuen wenn einer der Fachleute hier mal auf die AUswertung schauen würde. Vermute das einiges dabei ist was nicht unbedingt da rein gehört.

Dank im voraus und ein Lob für dieses Forum

Logfile of HijackThis v1.98.2
Scan saved at 18:06:24, on 13.09.2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccProxy.exe
C:\Programme\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Programme\Norton Internet Security\Norton AntiVirus\SAVScan.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Apoint\Apoint.exe
C:\Programme\SigmaTel\C-Major Audio\stacmon.exe
C:\WINDOWS\System32\ICO.EXE
C:\WINDOWS\System32\ezSP_Px.exe
C:\Programme\Sony\HotKey Utility\HKserv.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe
C:\Programme\drag'n drop cd+dvd\BinFiles\DragDrop.exe
C:\Programme\Messenger\msmsgs.exe
C:\Dokumente und Einstellungen\Wolfgang\Anwendungsdaten\ttor.exe
C:\WINDOWS\System32\qzhkquok.exe
C:\Programme\Sony\HotKey Utility\HKWnd.exe
C:\Programme\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Programme\powerpanel\Program\PcfMgr.exe
C:\Programme\Microsoft Office\Office\FINDFAST.EXE
C:\Programme\Microsoft Office\Office\OSA.EXE
C:\Programme\Apoint\Apntex.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Dokumente und Einstellungen\Wolfgang\Lokale Einstellungen\Temp\Temporäres Verzeichnis 1 für hijackthis1982.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.msn.de/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.de/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.168.0.2
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {61A93E7B-C118-53BA-8773-105504D82466} - C:\WINDOWS\System32\bfyvgnq.dll
O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Programme\Gemeinsame Dateien\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programme\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Programme\Gemeinsame Dateien\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programme\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Apoint] C:\Programme\Apoint\Apoint.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SigmaTel StacMon] C:\Programme\SigmaTel\C-Major Audio\stacmon.exe
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe
O4 - HKLM\..\Run: [HKSERV.EXE] C:\Programme\Sony\HotKey Utility\HKserv.exe
O4 - HKLM\..\Run: [ccApp] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Programme\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [Drag'n Drop CD+DVD] C:\Programme\drag'n drop cd+dvd\BinFiles\DragDrop.exe /StartUp
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [ToADiMon.exe] C:\T-ONLINE\BSW4\ToADiMon.exe -TOnlineAutodialStart
O4 - HKLM\..\Run: [websx] C:\Programme\websx\int113779.exe -auto
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKCU\..\Run: [Awei] C:\Dokumente und Einstellungen\Wolfgang\Anwendungsdaten\ttor.exe
O4 - HKCU\..\Run: [Awpqr] C:\WINDOWS\System32\qzhkquok.exe
O4 - Startup: Microsoft-Indexerstellung.lnk = C:\Programme\Microsoft Office\Office\FINDFAST.EXE
O4 - Startup: Office-Start.lnk = C:\Programme\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: Acrobat Assistant.lnk = C:\Programme\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: PowerPanel.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE
O14 - IERESET.INF: START_PAGE_URL=http://www.club-vaio.sony-europe.com/
O15 - Trusted Zone: *.sony-europe.com
O15 - Trusted Zone: *.sonystyle-europe.com
O15 - Trusted Zone: *.vaio-link.com

[Nikita]

Hallo @Rubberduck

Dein PC ist von einem Dialer und Backdoors verseucht.

1. Deaktiviere die Wiederherstellung
http://service1.symantec.com/SUPPORT/IN ... 7105707924

2. Fixe mit dem HijackThis:(dann neustarten)

O2 - BHO: (no name) - {61A93E7B-C118-53BA-8773-105504D82466} - C:\WINDOWS\System32\bfyvgnq.dll
Dialer:
O4 - HKLM\..\Run: [websx] C:\Programme\websx\int113779.exe -auto
O4 - HKCU\..\Run: [Awei] C:\Dokumente und Einstellungen\Wolfgang\Anwendungsdaten\ttor.exe
O4 - HKCU\..\Run: [Awpqr] C:\WINDOWS\System32\qzhkquok.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)

neustarten

Windows Explorer -> "Extras/Ordneroptionen" -> "Ansicht" -> Haken entfernen bei "Geschützte Systemdateien ausblenden (empfohlen)" und "Alle Dateien und Ordner anzeigen" aktivieren -> "OK"

1.Start< Einstellungen< Systemsteuerung<Internet Optionen
2.Internet Explorer<Menüleiste Extras<Internet Optionen<Allgemein<Verlauf" leeren, Cookies, TemporaryInternetfiles (auch Offline) loeschen


1.Deinstalliere den Dialer (es sei denn, du brauchst ihn...)
C:\Programme\websx\int113779.exe

2.Loesche die dateien (nicht die Ordner selbst)

C:\WINDOWS\Temp\
C:\Temp\
C:\Documents and Settings\username\Local Settings\Temp\


C:\Dokumente und Einstellungen\Default User\Cookies\*.*
C:\Dokumente und Einstellungen\Default User\Lokale Einstellungen\Temp\*.*
C:\Dokumente und Einstellungen\Default User\Lokale Einstellungen\Temporary Internet Files\*.*
C:\Dokumente und Einstellungen\Default User\Lokale Einstellungen\Temporary Internet Files\Content.IE5\*.*
C:\Dokumente und Einstellungen\Default User\Lokale Einstellungen\Verlauf\*.*
C:\Dokumente und Einstellungen\Default User\Lokale Einstellungen\Verlauf\History.IE5\*.*

3.#Lade den "eScan" erstelle vorher eine C:\ base und entpacke dort den Scanner
http://www.mwti.net/antivirus/free_utilities.asp
suche mit der Suchfunktion von Windows eine "kavupd.exe" und anklicken.(kann auch im Temporary-Ordner sein)
Start<Ausfuehren< %temp%
Es oeffnet sich ein DOS-Fenster und es wird ein Update ausgeführt (dauert ein bisschen)

#Gehe unbedingt in den abgesicherten Modus (!)
http://www.bsi.de/av/texte/winsave.htm
#suche "mwav.exe und starte so den< eScan<. Alle Häkchen setzen und "Clean-Scan" klicken.

#Nach dem Scann, gehe wieder in den Normalmodus , scanne noch mal und poste alles, was als <deleted< und <renamed< und <no action taken< gefunden wurde das neue Log vom HijackThis noch mal.
(denn es gibt bestimmt Dinge, die manuell geloescht werden muessen)
...........................................................................................................

#Neue YAW Anti-Dialer Software Adresse: http://www.emsisoft.de
http://www.yaw.at/

IE Spyad
http://www.pctipp.ch/downloads/dl/27634.asp
IE Spyad legt x-verschiedene unseriöse Webseiten direkt in die Eingeschränkte Zone des Internet Explorers.
Immer mehr Webseiten wollen Ihnen teuren Software-Schrott unterjubeln. Ob Spyware, Adware, billige Porno-Seiten oder teure Dialer - es gibt nichts, was unseriöse Gestalten nicht zum Kauf anbieten. Und da sie genau wissen, dass Sie nicht auf ihre luschen Angebote reinfallen, versuchen sie es mit Tricks.

ALTERNATIVBROWSER : zum IE
#Firefox
http://firebird-browser.de/

#Autostart-Manager
http://www.gschwarz.de/download.htm

NT- Dienste sicher konfigurieren http://www.ntsvcfg.de/ oder www.dingens.org

Personal Firewalls
http://www.joergkrusesweb.de/internet/s ... dex-2.html

mfg
Nikita

[Rubberduck]

Das ging ja schnell mit der Antwort. Danke schon mal dafür!!!
Alles abzuarbeiten war weit schwieriger für mich...

Upps, nachdem ich die Sachen jetzt reinkopiert habe stelle ich fest das es doch heftig viel ist.....
Ob der erste Scann wirklich notwendig ist kannst wohl nur du entscheiden, deswegen lasse ich ihn hier drin stehen.....

PS:1.Deinstalliere den Dialer (es sei denn, du brauchst ihn...)
C:\Programme\websx\int113779.exe habe ich nicht gefunden

Also hier ist erstmal das Ergebnis des ersten Scanns:

File C:\WINDOWS\ml-cleanup.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\WINDOWS\Ole32ws.dll tagged as not-a-virus:PornWare.Dialer.OnlineDialer. No Action Taken.
File C:\WINDOWS\System32\bfyvgnq.dll infected by "TrojanDownloader.Win32.PurityScan.k" Virus. Action Taken: File Deleted.
File C:\WINDOWS\System32\qzhkquok.exe infected by "TrojanDownloader.Win32.PurityScan.j" Virus. Action Taken: File Deleted.
File C:\Dokumente und Einstellungen\Wolfgang\Anwendungsdaten\Sun\Java\Deployment\cache\javapi\v1.0\file\Dummy.class-1d59cbfc-5519b8c0.class infected by "Trojan.Java.ClassLoader.Dummy.c" Virus. Action Taken: File Deleted.
File C:\Dokumente und Einstellungen\Wolfgang\Anwendungsdaten\Sun\Java\Deployment\cache\javapi\v1.0\jar\ar3.jar-32075939-205f03d7.zip infected by "Trojan.Java.ClassLoader.k" Virus. Action Taken: File Deleted.
File C:\Dokumente und Einstellungen\Wolfgang\Anwendungsdaten\Sun\Java\Deployment\cache\javapi\v1.0\jar\ar3.jar-3c0efa2b-231bf499.zip infected by "Trojan.Java.ClassLoader.k" Virus. Action Taken: File Deleted.
File C:\Dokumente und Einstellungen\Wolfgang\Anwendungsdaten\Sun\Java\Deployment\cache\javapi\v1.0\jar\ar3.jar-4a9df386-3122846c.zip infected by "Trojan.Java.ClassLoader.k" Virus. Action Taken: File Deleted.
File C:\Dokumente und Einstellungen\Wolfgang\Anwendungsdaten\Sun\Java\Deployment\cache\javapi\v1.0\jar\ar3.jar-5157872c-7a6f86c8.zip infected by "Trojan.Java.ClassLoader.k" Virus. Action Taken: File Deleted.
File C:\Dokumente und Einstellungen\Wolfgang\Anwendungsdaten\Sun\Java\Deployment\cache\javapi\v1.0\jar\ar3.jar-58581c27-71d5959c.zip infected by "Trojan.Java.ClassLoader.k" Virus. Action Taken: File Deleted.
File C:\Dokumente und Einstellungen\Wolfgang\Anwendungsdaten\Sun\Java\Deployment\cache\javapi\v1.0\jar\ar3.jar-588fab9e-52349b93.zip infected by "Trojan.Java.ClassLoader.k" Virus. Action Taken: File Deleted.
File C:\Dokumente und Einstellungen\Wolfgang\Anwendungsdaten\Sun\Java\Deployment\cache\javapi\v1.0\jar\arc.zip-2611cb6c-130ee32d.zip infected by "Trojan.Java.Femad" Virus. Action Taken: File Deleted.
File C:\Dokumente und Einstellungen\Wolfgang\Anwendungsdaten\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive.jar-648fb064-39653fca.zip infected by "Exploit.Java.Bytverify" Virus. Action Taken: File Renamed.
File C:\Dokumente und Einstellungen\Wolfgang\Anwendungsdaten\Sun\Java\Deployment\cache\javapi\v1.0\jar\counter.jar-7271642a-6d20caf0.zip infected by "Trojan.Java.ClassLoader.Dummy.d" Virus. Action Taken: File Deleted.
File C:\Dokumente und Einstellungen\Wolfgang\Anwendungsdaten\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv74.jar-170b188f-46b4f85c.zip infected by "Trojan.Java.ClassLoader.h" Virus. Action Taken: File Deleted.
File C:\Dokumente und Einstellungen\Wolfgang\Anwendungsdaten\ttor.exe infected by "TrojanDownloader.Win32.PurityScan.e" Virus. Action Taken: File Deleted.
File C:\Dokumente und Einstellungen\Wolfgang\Eigene Dateien\EIGENE_DATEIEN\WRENAME.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Drivers\NorthBridgeDriver\AGP\htpatch\HTpatch.exe tagged as not-a-virus:Tool.Win32.HTPatch.b. No Action Taken.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\045F485F.class infected by "Trojan.Java.ClassLoader.b" Virus. Action Taken: File Deleted.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\088B69C8.class infected by "Exploit.Java.Bytverify" Virus. Action Taken: File Renamed.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\09EF4A41.class infected by "Exploit.Java.Bytverify" Virus. Action Taken: File Renamed.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\0BF33409.class infected by "Exploit.Java.Bytverify" Virus. Action Taken: File Renamed.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\0C4B21A8.zip infected by "Exploit.Java.Bytverify" Virus. Action Taken: File Renamed.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\0D9F4546.zip infected by "TrojanDownloader.Java.OpenConnection.b" Virus. Action Taken: File Deleted.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\0DA8054E.html infected by "TrojanDownloader.JS.Small.d" Virus. Action Taken: File Deleted.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\0DDA3906.zip infected by "Trojan.Java.ClassLoader.c" Virus. Action Taken: File Deleted.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\0DE5112E.class infected by "Exploit.Java.Bytverify" Virus. Action Taken: File Renamed.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\16136CE4.class infected by "Exploit.Java.Bytverify" Virus. Action Taken: File Renamed.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\1C5E363D.zip infected by "Exploit.Java.Bytverify" Virus. Action Taken: File Renamed.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\1E5C4C0D.zip infected by "Exploit.Java.Bytverify" Virus. Action Taken: File Renamed.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\20CD03DC.class infected by "Trojan.Java.ClassLoader.k" Virus. Action Taken: File Deleted.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\21561024.zip infected by "Trojan.Java.ClassLoader.o" Virus. Action Taken: File Deleted.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\22BF3739.zip infected by "Exploit.Java.Bytverify" Virus. Action Taken: File Renamed.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\27287174.class infected by "Trojan.Java.ClassLoader.i" Virus. Action Taken: File Deleted.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\2755258B.zip infected by "TrojanDownloader.Java.OpenConnection.b" Virus. Action Taken: File Deleted.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\28AE5FD5.class infected by "Trojan.Java.ClassLoader.k" Virus. Action Taken: File Deleted.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\28F40470.class infected by "Trojan.Java.ClassLoader.k" Virus. Action Taken: File Deleted.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\2DD35EC0.class infected by "Trojan.Java.ClassLoader.k" Virus. Action Taken: File Deleted.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\31F33444.html infected by "TrojanDownloader.JS.Small.d" Virus. Action Taken: File Deleted.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\334B7B27.zip infected by "TrojanDownloader.Java.OpenConnection.l" Virus. Action Taken: File Deleted.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\34EB222E.class infected by "Trojan.Java.ClassLoader.k" Virus. Action Taken: File Deleted.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\35216BFD.class infected by "Exploit.Java.Bytverify" Virus. Action Taken: File Renamed.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\39C43AF8.html infected by "Exploit.CodeBaseExec" Virus. Action Taken: File Renamed.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\39C764F5.zip infected by "TrojanDownloader.Java.OpenConnection.b" Virus. Action Taken: File Deleted.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\39DC03FC.zip infected by "TrojanDownloader.Java.OpenConnection.b" Virus. Action Taken: File Deleted.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\3BB875EF.zip infected by "TrojanDownloader.Java.OpenConnection.b" Virus. Action Taken: File Deleted.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\3E736BD2.html infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\3E7615CE.html infected by "TrojanDownloader.JS.Small.d" Virus. Action Taken: File Deleted.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\3EA70B98.class infected by "Exploit.Java.Bytverify" Virus. Action Taken: File Renamed.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\3FC92458.html infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\41E10A0B.zip infected by "Trojan.Java.ClassLoader.c" Virus. Action Taken: File Deleted.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\42B36EA5.html infected by "TrojanDownloader.JS.Small.d" Virus. Action Taken: File Deleted.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\42FA36E5.class infected by "Exploit.Java.Bytverify" Virus. Action Taken: File Renamed.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\43EB47CC.html infected by "Exploit.CodeBaseExec" Virus. Action Taken: File Renamed.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\43F96FBE.zip infected by "TrojanDownloader.Java.OpenConnection.b" Virus. Action Taken: File Deleted.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\445A5B52.zip infected by "Trojan.Java.ClassLoader.c" Virus. Action Taken: File Deleted.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\47CE760F.html infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\490160BD.html infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\49797F6D.class infected by "Trojan.Java.ClassLoader.k" Virus. Action Taken: File Deleted.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\4D807341.html infected by "Exploit.CodeBaseExec" Virus. Action Taken: File Renamed.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\4D8D1B33.zip infected by "TrojanDownloader.Java.OpenConnection.b" Virus. Action Taken: File Deleted.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\525F19E4.class infected by "Trojan.Java.ClassLoader.i" Virus. Action Taken: File Deleted.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\53862A3F.class infected by "Trojan.Java.ClassLoader.i" Virus. Action Taken: File Deleted.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\53C65821.zip infected by "Trojan.Java.ClassLoader.c" Virus. Action Taken: File Deleted.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\55C511C7.zip infected by "Trojan.Java.ClassLoader.o" Virus. Action Taken: File Deleted.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\56085FA5.zip infected by "Trojan.Java.Needy.c" Virus. Action Taken: File Deleted.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\574B1C41.html infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\57551A36.exe infected by "TrojanProxy.Win32.Mitglieder.m" Virus. Action Taken: File Deleted.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\575B6E2F.exe infected by "TrojanProxy.Win32.Mitglieder.m" Virus. Action Taken: File Deleted.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\57656C24.class infected by "Trojan.Java.ClassLoader.Dummy.e" Virus. Action Taken: File Deleted.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\576F6A19.class infected by "Exploit.Java.Bytverify" Virus. Action Taken: File Renamed.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\585A3917.zip infected by "Trojan.Java.ClassLoader.c" Virus. Action Taken: File Deleted.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\589F2ACB.class infected by "Trojan.Java.ClassLoader.l" Virus. Action Taken: File Deleted.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\5B110662.class infected by "Trojan.Java.ClassLoader.l" Virus. Action Taken: File Deleted.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\5B14305E.class infected by "Exploit.Java.Bytverify" Virus. Action Taken: File Renamed.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\5F59333B.zip infected by "TrojanDownloader.Java.OpenConnection.l" Virus. Action Taken: File Deleted.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\65766463.class infected by "Exploit.Java.Bytverify" Virus. Action Taken: File Renamed.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\69285270.zip infected by "Trojan.Java.ClassLoader.c" Virus. Action Taken: File Deleted.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\6B234844.zip infected by "Trojan.Java.ClassLoader.o" Virus. Action Taken: File Deleted.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\6CBD5D25.html infected by "TrojanDownloader.JS.Small.d" Virus. Action Taken: File Deleted.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\6EE325D6.class infected by "Trojan.Java.Femad" Virus. Action Taken: File Deleted.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\6EF01E14.html infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\6FED4F26.class infected by "Trojan.Java.ClassLoader.l" Virus. Action Taken: File Deleted.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\6FF07922.class infected by "Exploit.Java.Bytverify" Virus. Action Taken: File Renamed.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\70274FB4.html infected by "TrojanDownloader.JS.Small.d" Virus. Action Taken: File Deleted.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\7064507A.zip infected by "TrojanDownloader.Java.OpenConnection.l" Virus. Action Taken: File Deleted.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\70BC3E19.html infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\71322598.zip infected by "TrojanDownloader.Java.OpenConnection.l" Virus. Action Taken: File Deleted.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\72AD2BF7.class infected by "Trojan.Java.ClassLoader.i" Virus. Action Taken: File Deleted.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\736A2F27.html infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\74931BE0.zip infected by "TrojanDownloader.Java.OpenConnection.l" Virus. Action Taken: File Deleted.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\74BE3DB1.class infected by "Trojan.Java.ClassLoader.i" Virus. Action Taken: File Deleted.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\75501F0F.html infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\758114D9.zip infected by "TrojanDownloader.Java.OpenConnection.l" Virus. Action Taken: File Deleted.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\75936425.class infected by "Trojan.Java.ClassLoader.d" Virus. Action Taken: File Deleted.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\75936425.php infected by "TrojanDownloader.JS.Small.d" Virus. Action Taken: File Deleted.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\75C459EF.class infected by "Trojan.Java.ClassLoader.i" Virus. Action Taken: File Deleted.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\78914485.class infected by "Trojan.Java.ClassLoader.i" Virus. Action Taken: File Deleted.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\795A5E68.class infected by "Trojan.Java.ClassLoader.k" Virus. Action Taken: File Deleted.
File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\7AB02884.html infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.
File C:\Programme\PurityScan\PuritySCAN.exe infected by "TrojanDropper.Win32.PurityScan.b" Virus. Action Taken: File Deleted.
File C:\RECYCLER\S-1-5-21-2755818936-995931522-2858800933-1006\Dc2.exe tagged as not-a-virus:PornWare.Dialer.ALifeDialer. No Action Taken.
File C:\WINDOWS\ml-cleanup.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\WINDOWS\Ole32ws.dll tagged as not-a-virus:PornWare.Dialer.OnlineDialer. No Action Taken.
File C:\WINDOWS\ml-cleanup.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\WINDOWS\Ole32ws.dll tagged as not-a-virus:PornWare.Dialer.OnlineDialer. No Action Taken.

Und hier das des zweiten Scanns:

File C:\WINDOWS\ml-cleanup.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.

File C:\WINDOWS\Ole32ws.dll tagged as not-a-virus:PornWare.Dialer.OnlineDialer. No Action Taken.

File C:\Dokumente und Einstellungen\Wolfgang\Eigene Dateien\EIGENE_DATEIEN\WRENAME.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.

File C:\Drivers\NorthBridgeDriver\AGP\htpatch\HTpatch.exe tagged as not-a-virus:Tool.Win32.HTPatch.b. No Action Taken.

File C:\RECYCLER\S-1-5-21-2755818936-995931522-2858800933-1006\Dc2.exe tagged as not-a-virus:PornWare.Dialer.ALifeDialer. No Action Taken.

File C:\WINDOWS\ml-cleanup.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.

File C:\WINDOWS\Ole32ws.dll tagged as not-a-virus:PornWare.Dialer.OnlineDialer. No Action Taken.

File C:\WINDOWS\ml-cleanup.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.

File C:\WINDOWS\Ole32ws.dll tagged as not-a-virus:PornWare.Dialer.OnlineDialer. No Action Taken.


Und HijackLog:

Logfile of HijackThis v1.98.2
Scan saved at 19:50:29, on 14.09.2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Apoint\Apoint.exe
C:\Programme\SigmaTel\C-Major Audio\stacmon.exe
C:\WINDOWS\System32\ICO.EXE
C:\WINDOWS\System32\ezSP_Px.exe
C:\Programme\Sony\HotKey Utility\HKserv.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe
C:\Programme\drag'n drop cd+dvd\BinFiles\DragDrop.exe
C:\Programme\Apoint\Apntex.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccProxy.exe
C:\Programme\Sony\HotKey Utility\HKWnd.exe
C:\Programme\Messenger\msmsgs.exe
C:\Programme\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Programme\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Programme\Norton Internet Security\Norton AntiVirus\SAVScan.exe
C:\Programme\powerpanel\Program\PcfMgr.exe
C:\Programme\Microsoft Office\Office\FINDFAST.EXE
C:\Programme\Microsoft Office\Office\OSA.EXE
C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe
C:\WINDOWS\System32\snmp.exe
C:\Programme\Outlook Express\msimn.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\DOKUME~1\Wolfgang\LOKALE~1\Temp\mwavscan.com
C:\DOKUME~1\Wolfgang\LOKALE~1\Temp\kavss.exe
C:\Dokumente und Einstellungen\Wolfgang\Lokale Einstellungen\Temp\Temporäres Verzeichnis 2 für hijackthis1982.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.msn.de/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.de/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.168.0.2
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Programme\Gemeinsame Dateien\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programme\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Programme\Gemeinsame Dateien\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programme\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Apoint] C:\Programme\Apoint\Apoint.exe

Berge von Arbeit... Ein ganz dickes Lob an Dich und die anderen superfreundlichen Helfer hier im Forum

Gruß
Rubberduck

[Nikita]

Nun ja, da hatte sich ganz schoen was angesammelt.

Loesche manuell:
C:\WINDOWS\Ole32ws.dll
C:\RECYCLER\S-1-5-21-2755818936-995931522-2858800933-1006\Dc2.exe

Dann deinstalliere den Symantec und lade ihn neu, es kann sein, dass er zerstoert ist und in Zukunft loesche die malware (also nicht alles in Quarantaene nehmen.

Dann scanne noch mal mit mwav.exe und poste das neue Virenlog.

mfg
Nikita

(surfe mit dem Firefox oder Opera und beherzige die Sicherheits-Tipps)