Hallo, soeben hat mein Antivirus-Programm ( Antivir ) einen Virus ( HTML/Exploit-mhtml ) auf meinem PC gefunden.
Habe ihn umgehend gelöscht. War das richtig ?
Hier noch meine Logfile. Kann mir einer helfen ?
Muss ich da noch was löschen ?
Logfile of HijackThis v1.99.0
Scan saved at 17:59:01, on 16.02.2005
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\INTERNAT.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\AVPERSONAL\AVGCTRL.EXE
C:\PROGRAM FILES\WEBWASHER\WWASHER.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\OSA.EXE
C:\PROGRAM FILES\WINZIP\WZQKPICK.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\OJWLEB.EXE
C:\PROGRAM FILES\MOZILLA FIREFOX\FIREFOX.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\HPZSTATX.EXE
C:\PROGRAM FILES\WINZIP\WINZIP32.EXE
C:\WINDOWS\TEMP\HIJACKTHIS.EXE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://192.168.254.254/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Bağlantılar
O1 - Hosts: 212.95.121.66 powerforen.de #2004-12-31 16:02:48
O1 - Hosts: 212.227.192.109 spotlight.de #2004-12-31 16:10:55
O1 - Hosts: 207.46.248.248 support.microsoft.com #2004-12-31 16:02:48
O1 - Hosts: 217.115.142.67 top-freeware.de #2004-12-31 16:02:48
O1 - Hosts: 212.101.97.233 uyeler.mynet.com #2004-12-31 16:02:48
O1 - Hosts: 212.101.97.122 webmail.mynet.com #2004-12-31 16:02:48
O1 - Hosts: 66.94.229.254 www.alltheweb.com #2004-12-31 16:02:48
O1 - Hosts: 217.160.214.90 www.audiograbber.de #2004-12-31 16:02:49
O1 - Hosts: 204.228.150.3 www.computerhope.com #2004-12-31 16:02:50
O1 - Hosts: 195.185.212.30 www.dateiname.info #2004-12-31 16:02:51
O1 - Hosts: 62.93.210.234 www.dooyoo.de #2004-12-31 16:02:51
O1 - Hosts: 62.146.52.202 www.freewarestar.de #2004-12-31 16:03:03
O1 - Hosts: 212.23.248.54 www.geneva-link.ch #2004-12-31 16:03:04
O1 - Hosts: 66.218.77.68 www.geocities.com #2004-12-31 16:03:04
O1 - Hosts: 80.85.5.66 www.gige.de #2004-12-31 16:03:04
O1 - Hosts: 200.69.128.99 www.mirrors.net.ar #2004-12-31 16:03:05
O1 - Hosts: 212.114.34.34 www.multimeta.com #2004-12-31 16:12:22
O1 - Hosts: 212.101.97.35 www.mynet.com #2004-12-31 16:03:05
O1 - Hosts: 213.198.18.239 www.nutzwerk.de #2004-12-31 16:03:05
O1 - Hosts: 194.221.112.214 www.softonic.de #2004-12-31 16:15:25
O1 - Hosts: 212.87.39.165 www.tariftip.de #2004-12-31 16:03:09
O1 - Hosts: 217.115.142.93 www.thunderbird-mail.de #2004-12-31 16:03:10
O1 - Hosts: 213.218.162.213 www.tuneup.de #2004-12-31 16:03:10
O1 - Hosts: 217.69.65.129 www.u32.de #2004-12-31 16:03:10
O1 - Hosts: 216.109.118.60 www.yahoo.de #2004-12-31 16:00:48
O1 - Hosts: 212.187.242.205 www.zdnet.de #2004-12-31 16:03:10
O1 - Hosts: 212.187.242.205 www.zdnet.de #2004-12-31 16:03:10
O1 - Hosts: 212.187.242.205 www.zdnet.de #2004-12-31 16:03:10
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: (no name) - {7D153C9E-FD2E-8FDA-0A46-FBCACFD79899} - C:\WINDOWS\SYSTEM\WSKE.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O3 - Toolbar: &Radyo - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [internat.exe] internat.exe
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [AVGCtrl] C:\PROGRAM FILES\AVPERSONAL\AVGCTRL.EXE /min
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [WebWasher] C:\PROGRAM FILES\WEBWASHER\WWASHER.EXE
O4 - Startup: Office Başlangıç.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: Zur Filterliste hinzufügen (WebWasher) - http://-Web.Washer-/ie_add
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O15 - Trusted IP range: 69.50.161.82
O15 - Trusted IP range: (HKLM)
O16 - DPF: {99B6E512-3893-4155-9964-8EB8E06099CB} (WebSpyWareKiller Class) - http://www.anonymizer.com/anti-spyware/2.6/freescanner/WebSWK.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
O16 - DPF: {8EB3FF4E-86A1-4717-884D-7BA2D38272CB} (F-Secure Online Scanner) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
cengizdurmaz Gast |
