SpySherif

[Cilgin_Tarik]

das ist ja mal was geiles

ich kriege ein virus und dann auch noch ein viren program dazu...

aber das problem ist ich finde denn virus nicht und spysherif kann ich auch nicht löschen

der will nur das ich was bezahle um das volle program zu haben

habe mich ein bischen durchgelesen

hier hijack

Logfile of HijackThis v1.99.1
Scan saved at 09:52:42, on 26.01.2006
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\windows\system32\rundll32.exe
C:\windows\system32\spoolsv.exe
C:\windows\explorer.exe
C:\WINDOWS\inet20003\services.exe
C:\Programme\Softwin\BitDefender8\bdoesrv.exe
C:\PROGRA~1\Softwin\BITDEF~1\bdnagent.exe
C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe
C:\Programme\Anti-Blaxx\Anti-Blaxx.exe
C:\Programme\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Programme\Daily Weather Forecast\weather.exe
C:\Programme\DAEMON Tools\daemon.exe
C:\windows\smss.exe
C:\windows\System32\ctfmon.exe
C:\winstall.exe
C:\Program Files\SpySheriff\SpySheriff.exe
C:\PROGRA~1\GEMEIN~1\qokf\qokfm.exe
C:\Programme\Gemeinsame Dateien\PCSuite\DataLayer\DataLayer.exe
C:\PROGRA~1\GEMEIN~1\PCSuite\Services\SERVIC~1.EXE
C:\Programme\Gemeinsame Dateien\Windows\services32.exe
C:\WINDOWS\inet20003\mm4.exe
C:\Programme\FRITZ!DSL\IGDCTRL.EXE
C:\WINDOWS\dGFyaWs\command.exe
C:\windows\System32\nvsvc32.exe
C:\Programme\Webroot\Spy Sweeper\WRSSSDK.exe
C:\windows\System32\dllcache\IExplore.exe
C:\Programme\Gemeinsame Dateien\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Programme\Gemeinsame Dateien\Softwin\BitDefender Scan Server\bdss.exe
C:\windows\System32\javaw.exe
C:\windows\System32\dllcache\IExplore.exe
C:\windows\System32\dllcache\IExplore.exe
C:\Programme\Softwin\BitDefender8\vsserv.exe
C:\windows\System32\svchost.exe
C:\windows\System32\dllcache\IExplore.exe
C:\PROGRA~1\Network\network.exe
C:\Programme\Internet Explorer\IEXPLORE.EXE
C:\Programme\WinRAR\WinRAR.exe
C:\Programme\MSN Messenger\msnmsgr.exe
C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\Rar$EX74.609\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: Shell=explorer.exe                                                                                                    "C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\ibm00003.exe"
F3 - REG:win.ini: run=C:\WINDOWS\inet20003\services.exe
O2 - BHO: (no name) - {5321E378-FFAD-4999-8C62-03CA8155F0B3} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [NVRTCLK] C:\WINDOWS\System32\NVRTCLK\NVRTClk.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [BDOESRV] C:\Programme\Softwin\BitDefender8\bdoesrv.exe
O4 - HKLM\..\Run: [BDNewsAgent] "C:\PROGRA~1\Softwin\BITDEF~1\bdnagent.exe"
O4 - HKLM\..\Run: [BDMCon] C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe
O4 - HKLM\..\Run: [Anti-Blaxx Manager] C:\Programme\Anti-Blaxx\Anti-Blaxx.exe
O4 - HKLM\..\Run: [Daily Weather Forecast] C:\Programme\Daily Weather Forecast\weather.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Programme\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [Microsoft Windows Session Manager Subsystem] C:\windows\smss.exe
O4 - HKLM\..\Run: [Microsoft Windows Logon Process] C:\windows\winlogon.exe
O4 - HKLM\..\Run: [xp_system] C:\WINDOWS\inet20003\services.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Programme\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\windows\System32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Programme\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [qokf] C:\PROGRA~1\GEMEIN~1\qokf\qokfm.exe
O4 - HKCU\..\Run: [xp_system] C:\WINDOWS\inet20003\services.exe
O4 - Startup: Verknüpfung mit AJSTART.lnk = C:\Programme\AJStarter\AJSTART.exe
O8 - Extra context menu item: RapidShare-Download - res://C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\ir_ext_temp_0\AutoPlay\Docs\more-rapid.exe/RsMenExt.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\windows\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\windows\web\related.htm
O9 - Extra button: Klicke hier um das Projekt xp-AntiSpy zu unterstützen - {F1013E44-E913-409D-B380-3C7E64F3C36A} - C:\Programme\xp-AntiSpy\sponsoring\sponsor.html (HKCU)
O9 - Extra 'Tools' menuitem: Unterstützung für xp-AntiSpy - {F1013E44-E913-409D-B380-3C7E64F3C36A} - C:\Programme\xp-AntiSpy\sponsoring\sponsor.html (HKCU)
O15 - Trusted Zone: *.sxload.com
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) - https://signup.msn.com/pages/MsnInstC.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1110721377483
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {CE69F98F-2AF3-4306-BAC6-A79070EDA1B4} (Zylom Loader Object) - http://eu.download.games.yahoo.com/zylom/activex/zylomloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3202A01C-6336-4DAA-AC06-433074DDDEB2}: NameServer = 192.168.122.252,192.168.122.253
O17 - HKLM\System\CS1\Services\Tcpip\..\{3202A01C-6336-4DAA-AC06-433074DDDEB2}: NameServer = 192.168.122.252,192.168.122.253
O17 - HKLM\System\CS2\Services\Tcpip\..\{3202A01C-6336-4DAA-AC06-433074DDDEB2}: NameServer = 192.168.122.252,192.168.122.253
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: Reliability - C:\WINDOWS\system32\sslsrv32.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVM IGD CTRL Service - AVM Berlin - C:\Programme\FRITZ!DSL\IGDCTRL.EXE
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Programme\Gemeinsame Dateien\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\dGFyaWs\command.exe
O23 - Service: AVM FRITZ!web Routing Service (de_serv) - AVM Berlin - C:\Programme\Gemeinsame Dateien\AVM\de_serv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\windows\System32\nvsvc32.exe
O23 - Service: Steganos Live Encryption Engine (Version 503) [Service] (SLEE_503_SERVICE) - Unknown owner - C:\WINDOWS\System32\SLEE503.exe (file missing)
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Programme\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Programme\Softwin\BitDefender8\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Programme\Gemeinsame Dateien\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)

[tyco]

Schmeiss erstmal diesen dubiosen SpySherif von der Platte, der bringt nen Virus mit. Da Du es nicht deinstallieren kannst, lösche einfach das Verzeichnis. Mache ein WindowsUpdate.

Sodann deaktiviere die Systemwiederherstellung und starte den Rechner im abgesicherten Modus (F8). Dann scanne den Rechner im abgesicherten Modus mit HijackThis und fixe folgende Einträge:

C:\WINDOWS\inet20003\services.exe

C:\windows\smss.exe

C:\winstall.exe

C:\Program Files\SpySheriff\SpySheriff.exe

C:\PROGRA~1\GEMEIN~1\qokf\qokfm.exe

C:\Programme\Gemeinsame Dateien\Windows\services32.exe

C:\WINDOWS\inet20003\mm4.exe

C:\WINDOWS\dGFyaWs\command.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html

F3 - REG:win.ini: run=C:\WINDOWS\inet20003\services.exe

O2 - BHO: (no name) - {5321E378-FFAD-4999-8C62-03CA8155F0B3} - (no file)

O4 - HKLM\..\Run: [Microsoft Windows Session Manager Subsystem] C:\windows\smss.exe

O4 - HKLM\..\Run: [Microsoft Windows Logon Process] C:\windows\winlogon.exe

O4 - HKLM\..\Run: [xp_system] C:\WINDOWS\inet20003\services.exe

O4 - HKCU\..\Run: [qokf] C:\PROGRA~1\GEMEIN~1\qokf\qokfm.exe

O4 - HKCU\..\Run: [xp_system] C:\WINDOWS\inet20003\services.exe

O4 - Startup: Verknüpfung mit AJSTART.lnk = C:\Programme\AJStarter\AJSTART.exe

O9 - Extra button: Klicke hier um das Projekt xp-AntiSpy zu unterstützen - {F1013E44-E913-409D-B380-3C7E64F3C36A} - C:\Programme\xp-AntiSpy\sponsoring\sponsor.html (HKCU)

O9 - Extra 'Tools' menuitem: Unterstützung für xp-AntiSpy - {F1013E44-E913-409D-B380-3C7E64F3C36A} - C:\Programme\xp-AntiSpy\sponsoring\sponsor.html (HKCU)

O15 - Trusted Zone: *.sxload.com

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)

O20 - Winlogon Notify: Reliability - C:\WINDOWS\system32\sslsrv32.dll

O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\dGFyaWs\command.exe

Leere den Papierkorb. Du solltest den Rechner anschliessend nochmal mit Spybot Search & Destroy im abgesicherten Modus scannen.