Hijacklogthis

Halllo, habe einen W32/Krepper und folgendes Log. Was tun ?

Logfile of HijackThis v1.99.0
Scan saved at 16:34:20, on 01.02.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\NORMAN\bin\ZANDA.EXE
C:\Programme\Analog Devices\SoundMAX\SMAgent.exe
C:\NORMAN\Nvc\BIN\nvcoas.exe
C:\NORMAN\Nvc\BIN\NVCSCHED.EXE
C:\NORMAN\bin\NJEEVES.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Programme\Java\j2re1.4.2_06\bin\jusched.exe
C:\Programme\Analog Devices\SoundMAX\SMTray.exe
C:\Programme\Analog Devices\SoundMAX\DrvLsnr.exe
C:\Programme\COMPAQ\Easy Access Button Support\StartEAK.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fppdis2a.exe
C:\NORMAN\bin\ZLH.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\NORMAN\Nvc\bin\cclaw.exe
C:\Programme\Sony Ericsson\Mobile\audevicemgr.exe
c:\PROGRA~1\INTUWA~1\Shared\MROUTE~1\MROUTE~2.EXE
C:\PROGRA~1\SONYER~1\Mobile\CONNEC~1\CONNMN~1.EXE
C:\Programme\Compaq\Easy Access Button Support\CPQEAKSYSTEMTRAY.EXE
C:\Programme\Compaq\Easy Access Button Support\CPQEADM.EXE
C:\Compaq\EAKDRV\EAUSBKBD.EXE
C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Dokumente und Einstellungen\rs\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOKUME~1\rs\LOKALE~1\Temp\sp.dll/sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOKUME~1\rs\LOKALE~1\Temp\sp.dll/sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {67C6C5EA-82D8-4F0C-8DC0-7FDDA59FBA90} - C:\WINDOWS\system32\jjcg.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\j2re1.4.2_06\bin\jusched.exe
O4 - HKLM\..\Run: [Smapp] C:\Programme\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [DrvLsnr] C:\Programme\Analog Devices\SoundMAX\DrvLsnr.exe
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [SetRefresh] C:\Programme\Compaq\SetRefresh\SetRefresh.exe
O4 - HKLM\..\Run: [CPQEASYACC] C:\Programme\COMPAQ\Easy Access Button Support\StartEAK.exe
O4 - HKLM\..\Run: [pdfFactory Pro Dispatcher v2] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fppdis2a.exe
O4 - HKLM\..\Run: [Norman ZANDA] C:\NORMAN\bin\ZLH.EXE /LOAD /SPLASH
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Telefonverbindungsmonitor.lnk = ?
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O9 - Extra->Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = org.ixtegra.int
O17 - HKLM\Software\..\Telephony: DomainName = org.ixtegra.int
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = org.ixtegra.int
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = org.ixtegra.int
O18 - Filter: text/html - {7AD35386-7216-4681-B3E1-878C88C9565D} - C:\WINDOWS\system32\jjcg.dll
O18 - Filter: text/plain - {7AD35386-7216-4681-B3E1-878C88C9565D} - C:\WINDOWS\system32\jjcg.dll
O20 - AppInit_DLLs: p3e3d92oon4.dll
O23 - Service: Norman API-hooking helper - Unknown - C:\NORMAN\Nvc\BIN\nipsvc.exe
O23 - Service: Norman NJeeves - Unknown - C:\NORMAN\bin\NJEEVES.EXE
O23 - Service: Norman ZANDA - Unknown - C:\NORMAN\bin\ZANDA.EXE
O23 - Service: Norman Virus Control on-access component - Norman ASA - C:\NORMAN\Nvc\BIN\nvcoas.exe
O23 - Service: Norman Virus Control Scheduler - Norman Data Defense Systems - C:\NORMAN\Nvc\BIN\NVCSCHED.EXE
O23 - Service: SoundMAX Agent Service - Analog Devices, Inc. - C:\Programme\Analog Devices\SoundMAX\SMAgent.exe

Gruss Felixxx

http://www.wintotal.de/Tipps/Eintrag.php?TID=873

Ziemlich weit unten ist der Hinweis aufs sp.html-Entfernungstool.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOKUME~1\rs\LOKALE~1\Temp\sp.dll/sp.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOKUME~1\rs\LOKALE~1\Temp\sp.dll/sp.html

fixen

O17 - HKLM\Software\..\Telephony: DomainName = org.ixtegra.int
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = org.ixtegra.int
O17 - HKLM\System\CS2\Services\Tcpip\ParameteO18 - Filter: text/html -
O18 - Filter: text/html - {7AD35386-7216-4681-B3E1-878C88C9565D} - C:\WINDOWS\system32\jjcg.dll
O18 - Filter: text/plain - {7AD35386-7216-4681-B3E1-878C88C9565D} - C:\WINDOWS\system32\jjcg.dll
O20 - AppInit_DLLs: p3e3d92oon4.dll

was ist das? wenn Du nicht weisst, woher das kommt.... fixen!

Der sp.html-Hijacker ist echt ne Zecke. Fixen allein mit HiJackThis kann da fast nix machen, der kommt wieder. An dem Entfernungstool kommt man eigentlich nicht vorbei.

right, Smartie.....

unsere Posts haben sich überschnitten, an das Tool hab ich nicht gedacht. Er scheint auch keine Firewall installiert zu haben?