eScan/ mwav.log zeigt Spy-/Adware an - in Ordner die leer sind

Dieses Thema im Forum "Sicherheit" wurde erstellt von WIZO9247, 26. Oktober 2005.

Status des Themas:
Es sind keine weiteren Antworten möglich.
  1. WIZO9247

    WIZO9247 ROM

    Registriert seit:
    26. Oktober 2005
    Beiträge:
    4
    Hallo,
    ich bin neu hier und bräuchte dringend Hilfe.
    Habe escan durchgeführt und das kam dabei raus:

    infected

    Wed Oct 26 16:02:52 2005 => ***** Scanning Registry and File system for Adware/Spyware *****
    Wed Oct 26 16:02:52 2005 => Loading Spyware Signatures from new External Database (Size: 144406).
    Wed Oct 26 16:02:53 2005 => Indexed Spyware Databases Successfully Created...

    Wed Oct 26 16:02:57 2005 => System found infected with stylexp Spyware/Adware ({c333cf63-767f-4831-94ac-e683d962c63c})! Action taken: No Action Taken.
    Wed Oct 26 16:03:09 2005 => Offending file found: C:\Dokumente und Einstellungen\Kerstin\Lokale Einstellungen\temporary internet files\content.ie5\89abcdef\common[1].js
    Wed Oct 26 16:03:09 2005 => System found infected with whenu.savenow Spyware/Adware (common[1].js)! Action taken: No Action Taken.

    Wed Oct 26 16:03:09 2005 => Offending file found: C:\Dokumente und Einstellungen\Kerstin\Lokale Einstellungen\temporary internet files\content.ie5\ghijklmn\common[1].js
    Wed Oct 26 16:03:09 2005 => System found infected with whenu.savenow Spyware/Adware (common[1].js)! Action taken: No Action Taken.

    Wed Oct 26 16:03:10 2005 => Offending file found: C:\Dokumente und Einstellungen\Kerstin\Lokale Einstellungen\temporary internet files\content.ie5\k3c9kbgn\common[1].js
    Wed Oct 26 16:03:10 2005 => System found infected with whenu.savenow Spyware/Adware (common[1].js)! Action taken: No Action Taken.

    Wed Oct 26 16:03:10 2005 => Offending file found: C:\Dokumente und Einstellungen\Kerstin\Lokale Einstellungen\temporary internet files\content.ie5\opqrstuv\blank[1].htm
    Wed Oct 26 16:03:10 2005 => System found infected with whenu.savenow Spyware/Adware (blank[1].htm)! Action taken: No Action Taken.

    Wed Oct 26 16:03:10 2005 => Offending file found: C:\Dokumente und Einstellungen\Kerstin\Lokale Einstellungen\temporary internet files\content.ie5\opqrstuv\common[1].js
    Wed Oct 26 16:03:10 2005 => System found infected with whenu.savenow Spyware/Adware (common[1].js)! Action taken: No Action Taken.

    Wed Oct 26 16:03:11 2005 => Offending file found: C:\Dokumente und Einstellungen\Kerstin\Lokale Einstellungen\Temporary Internet Files\content.ie5\89abcdef\common[1].js
    Wed Oct 26 16:03:11 2005 => System found infected with whenu.savenow Spyware/Adware (common[1].js)! Action taken: No Action Taken.

    Wed Oct 26 16:03:12 2005 => Offending file found: C:\Dokumente und Einstellungen\Kerstin\Lokale Einstellungen\Temporary Internet Files\content.ie5\ghijklmn\common[1].js
    Wed Oct 26 16:03:12 2005 => System found infected with whenu.savenow Spyware/Adware (common[1].js)! Action taken: No Action Taken.

    Wed Oct 26 16:03:12 2005 => Offending file found: C:\Dokumente und Einstellungen\Kerstin\Lokale Einstellungen\Temporary Internet Files\content.ie5\k3c9kbgn\common[1].js
    Wed Oct 26 16:03:12 2005 => System found infected with whenu.savenow Spyware/Adware (common[1].js)! Action taken: No Action Taken.

    Wed Oct 26 16:03:12 2005 => Offending file found: C:\Dokumente und Einstellungen\Kerstin\Lokale Einstellungen\Temporary Internet Files\content.ie5\opqrstuv\blank[1].htm
    Wed Oct 26 16:03:12 2005 => System found infected with whenu.savenow Spyware/Adware (blank[1].htm)! Action taken: No Action Taken.

    Wed Oct 26 16:03:12 2005 => Offending file found: C:\Dokumente und Einstellungen\Kerstin\Lokale Einstellungen\Temporary Internet Files\content.ie5\opqrstuv\common[1].js
    Wed Oct 26 16:03:12 2005 => System found infected with whenu.savenow Spyware/Adware (common[1].js)! Action taken: No Action Taken.


    Wed Oct 26 16:03:18 2005 => ***** Scanning Registry for errors created because of Adware/Spyware *****
    Wed Oct 26 16:03:18 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\system32\QTPlugin.OCX". Action Taken: No Action Taken.

    Wed Oct 26 16:03:19 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Ahead\NeroDigital\settings.xml". Action Taken: No Action Taken.

    Wed Oct 26 16:03:19 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Hewlett-Packard\hpz\glue\deu\drivers\com_lang\hpf2p808.dat". Action Taken: No Action Taken.

    Wed Oct 26 16:03:19 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Hewlett-Packard\hp deskjet assistant\3500\sample1.ldl". Action Taken: No Action Taken.

    Wed Oct 26 16:03:19 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Hewlett-Packard\HP Software Update\local.xml". Action Taken: No Action Taken.

    Wed Oct 26 16:03:19 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Hewlett-Packard\webreg\bin\hpqdlg08.rsc". Action Taken: No Action Taken.

    Wed Oct 26 16:03:19 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Hewlett-Packard\webreg\bin\hpqmsg08.rsc". Action Taken: No Action Taken.

    Wed Oct 26 16:03:19 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Hewlett-Packard\webreg\Help\hpqtap08.tdb". Action Taken: No Action Taken.

    Wed Oct 26 16:03:19 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Hewlett-Packard\webreg\bin\hpqwrg.rsc". Action Taken: No Action Taken.

    Wed Oct 26 16:03:20 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\cmmgr32.exe" refers to invalid object "C:\WINDOWS\System32\cmmgr32.exe". Action Taken: No Action Taken.

    Wed Oct 26 16:03:20 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\DSC308" refers to invalid object "C:\Programme\DXG\DSC308\DSC308". Action Taken: No Action Taken.

    Wed Oct 26 16:03:20 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\NikonView.exe" refers to invalid object "C:\Programme\Nikon\NkView5\NikonView.exe". Action Taken: No Action Taken.

    Wed Oct 26 16:03:20 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\SmartSurfer3.0" refers to invalid object "C:\Programme\WEBDE\SmartSurfer3.0\SmartSurfer3.0". Action Taken: No Action Taken.

    Wed Oct 26 16:03:20 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\SmartSurfer3.1" refers to invalid object "C:\Programme\WEBDE\SmartSurfer3.1\SmartSurfer3.1". Action Taken: No Action Taken.

    Wed Oct 26 16:03:20 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\winzip.exe" refers to invalid object "D:\WINZIP\winzip32.exe". Action Taken: No Action Taken.

    Wed Oct 26 16:03:20 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\winzip32.exe" refers to invalid object "D:\WINZIP\winzip32.exe". Action Taken: No Action Taken.

    Wed Oct 26 16:03:20 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Programme\Gemeinsame Dateien\Adaptec Shared\Upgrade\". Action Taken: No Action Taken.

    Wed Oct 26 16:03:21 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".kmd". Action Taken: No Action Taken.

    Wed Oct 26 16:03:21 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".part". Action Taken: No Action Taken.

    Wed Oct 26 16:03:21 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".PMO". Action Taken: No Action Taken.

    Wed Oct 26 16:03:21 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".pwt". Action Taken: No Action Taken.

    Wed Oct 26 16:03:21 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".USR". Action Taken: No Action Taken.

    Wed Oct 26 16:03:21 2005 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object "OpenWithList". Action Taken: No Action Taken.

    Wed Oct 26 16:03:21 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Beach Tranquility". Action Taken: No Action Taken.

    Wed Oct 26 16:03:21 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Mickey and Friends Desktop". Action Taken: No Action Taken.

    Wed Oct 26 16:03:21 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Mozilla Firefox (1.0.2)". Action Taken: No Action Taken.

    Wed Oct 26 16:03:21 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "New.net". Action Taken: No Action Taken.

    Wed Oct 26 16:03:21 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "ParadiseLagoon". Action Taken: No Action Taken.

    Wed Oct 26 16:03:21 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "StyleXP". Action Taken: No Action Taken.

    Wed Oct 26 16:03:21 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "WinZip". Action Taken: No Action Taken.

    Wed Oct 26 16:03:28 2005 => Entry "HKCR\CLSID\{E0D79304-84BE-11CE-9641-444553540000}" refers to invalid object "D:\WINZIP\WZSHLSTB.DLL". Action Taken: No Action Taken.

    Wed Oct 26 16:03:28 2005 => Entry "HKCR\CLSID\{E0D79305-84BE-11CE-9641-444553540000}" refers to invalid object "D:\WINZIP\WZSHLSTB.DLL". Action Taken: No Action Taken.

    Wed Oct 26 16:03:28 2005 => Entry "HKCR\CLSID\{E0D79306-84BE-11CE-9641-444553540000}" refers to invalid object "D:\WINZIP\WZSHLSTB.DLL". Action Taken: No Action Taken.

    Wed Oct 26 16:03:28 2005 => Entry "HKCR\CLSID\{E0D79307-84BE-11CE-9641-444553540000}" refers to invalid object "D:\WINZIP\WZSHLSTB.DLL". Action Taken: No Action Taken.

    Wed Oct 26 16:03:29 2005 => Entry "HKCR\.acl" refers to invalid object "ACLFile". Action Taken: No Action Taken.

    Wed Oct 26 16:03:30 2005 => Entry "HKCR\.aw" refers to invalid object "AWFile". Action Taken: No Action Taken.

    Wed Oct 26 16:03:30 2005 => Entry "HKCR\.col" refers to invalid object "COLFile". Action Taken: No Action Taken.

    Wed Oct 26 16:03:30 2005 => Entry "HKCR\.det" refers to invalid object "DETFile". Action Taken: No Action Taken.

    Wed Oct 26 16:03:30 2005 => Entry "HKCR\.elm" refers to invalid object "ELMFile". Action Taken: No Action Taken.

    Wed Oct 26 16:03:30 2005 => Entry "HKCR\.ffa" refers to invalid object "FFAFile". Action Taken: No Action Taken.

    Wed Oct 26 16:03:30 2005 => Entry "HKCR\.ffl" refers to invalid object "FFLFile". Action Taken: No Action Taken.

    Wed Oct 26 16:03:30 2005 => Entry "HKCR\.fft" refers to invalid object "FFTFile". Action Taken: No Action Taken.

    Wed Oct 26 16:03:30 2005 => Entry "HKCR\.ffx" refers to invalid object "FFXFile". Action Taken: No Action Taken.

    Wed Oct 26 16:03:30 2005 => Entry "HKCR\.frg" refers to invalid object "Access.Fragment". Action Taken: No Action Taken.

    Wed Oct 26 16:03:30 2005 => Entry "HKCR\.gst" refers to invalid object "MSMap.Datainst.8". Action Taken: No Action Taken.

    Wed Oct 26 16:03:30 2005 => Entry "HKCR\.idc" refers to invalid object "idcfile". Action Taken: No Action Taken.

    Wed Oct 26 16:03:30 2005 => Entry "HKCR\.ldb" refers to invalid object "Access.LockFile.9". Action Taken: No Action Taken.

    Wed Oct 26 16:03:30 2005 => Entry "HKCR\.lex" refers to invalid object "LEXFile". Action Taken: No Action Taken.

    Wed Oct 26 16:03:30 2005 => Entry "HKCR\.opc" refers to invalid object "OPCFile". Action Taken: No Action Taken.

    Wed Oct 26 16:03:30 2005 => Entry "HKCR\.pcb" refers to invalid object "PCBFile". Action Taken: No Action Taken.

    Wed Oct 26 16:03:31 2005 => Entry "HKCR\.pip" refers to invalid object "PIPFile". Action Taken: No Action Taken.

    Wed Oct 26 16:03:31 2005 => Entry "HKCR\.sll" refers to invalid object "SSLFile". Action Taken: No Action Taken.

    Wed Oct 26 16:03:31 2005 => Entry "HKCR\.stf" refers to invalid object "STFFile". Action Taken: No Action Taken.

    Wed Oct 26 16:03:31 2005 => Entry "HKCR\.tuw" refers to invalid object "TUWFile". Action Taken: No Action Taken.

    Wed Oct 26 16:03:31 2005 => Entry "HKCR\.wll" refers to invalid object "Word.Addin.8". Action Taken: No Action Taken.

    Wed Oct 26 16:03:31 2005 => Entry "HKCR\ActMsg.Session" refers to invalid object "{3FA7DEB3-6438-101B-ACC1-00AA00423326}". Action Taken: No Action Taken.

    Wed Oct 26 16:03:31 2005 => Entry "HKCR\Alg.AlgSetup" refers to invalid object "{27D0BCCC-344D-4287-AF37-0C72C161C14C}". Action Taken: No Action Taken.

    Wed Oct 26 16:03:31 2005 => Entry "HKCR\Alg.AlgSetup.1" refers to invalid object "{27D0BCCC-344D-4287-AF37-0C72C161C14C}". Action Taken: No Action Taken.

    Wed Oct 26 16:03:32 2005 => Entry "HKCR\Connection Manager Profile\shell\open\command" refers to invalid object "C:\WINDOWS\System32\CMMGR32.EXE "%1"". Action Taken: No Action Taken.

    Wed Oct 26 16:03:33 2005 => Entry "HKCR\MailFileAtt" refers to invalid object "{00020D05-0000-0000-C000-000000000046}". Action Taken: No Action Taken.

    Wed Oct 26 16:03:33 2005 => Entry "HKCR\mapifvbx.object" refers to invalid object "{41116C00-8B90-101B-96CD-00AA003B14FC}". Action Taken: No Action Taken.

    Wed Oct 26 16:03:33 2005 => Entry "HKCR\mapifvbx.object.1" refers to invalid object "{41116C00-8B90-101B-96CD-00AA003B14FC}". Action Taken: No Action Taken.

    Wed Oct 26 16:03:35 2005 => Entry "HKCR\Plenoptic.Plenoptic" refers to invalid object "{607C27E9-AB27-11d3-A116-A0EA50C10801}". Action Taken: No Action Taken.

    Wed Oct 26 16:03:35 2005 => Entry "HKCR\Plenoptic.Plenoptic.1" refers to invalid object "{607C27E9-AB27-11d3-A116-A0EA50C10801}". Action Taken: No Action Taken.

    Wed Oct 26 16:03:35 2005 => Entry "HKCR\ppifile\shell\open\command" refers to invalid object "%SystemRoot%\System32\msppcnfg.exe /Config %1". Action Taken: No Action Taken.

    Wed Oct 26 16:03:35 2005 => Entry "HKCR\quicktime\shell\open\command" refers to invalid object "C:\PROGRA~2\QUICKT~1\QuickTimePlayer.exe -u"%1"". Action Taken: No Action Taken.

    Wed Oct 26 16:03:35 2005 => Entry "HKCR\QuickTime.aif\shell\open\command" refers to invalid object "C:\PROGRA~2\QUICKT~1\QuickTimePlayer.exe "%1"". Action Taken: No Action Taken.

    Wed Oct 26 16:03:35 2005 => Entry "HKCR\QuickTime.aifc\shell\open\command" refers to invalid object "C:\PROGRA~2\QUICKT~1\QuickTimePlayer.exe "%1"". Action Taken: No Action Taken.

    Wed Oct 26 16:03:35 2005 => Entry "HKCR\QuickTime.aiff\shell\open\command" refers to invalid object "C:\PROGRA~2\QUICKT~1\QuickTimePlayer.exe "%1"". Action Taken: No Action Taken.

    Wed Oct 26 16:03:35 2005 => Entry "HKCR\QuickTime.dif\shell\open\command" refers to invalid object "C:\PROGRA~2\QUICKT~1\QuickTimePlayer.exe "%1"". Action Taken: No Action Taken.

    Wed Oct 26 16:03:35 2005 => Entry "HKCR\QuickTime.dv\shell\open\command" refers to invalid object "C:\PROGRA~2\QUICKT~1\QuickTimePlayer.exe "%1"". Action Taken: No Action Taken.

    Wed Oct 26 16:03:36 2005 => Entry "HKCR\QuickTime.mac\shell\open\command" refers to invalid object "C:\PROGRA~2\QUICKT~1\PictureViewer.exe "%1"". Action Taken: No Action Taken.

    Wed Oct 26 16:03:36 2005 => Entry "HKCR\QuickTime.mov\shell\open\command" refers to invalid object "C:\PROGRA~2\QUICKT~1\QuickTimePlayer.exe "%1"". Action Taken: No Action Taken.

    Wed Oct 26 16:03:36 2005 => Entry "HKCR\QuickTime.pct\shell\open\command" refers to invalid object "C:\PROGRA~2\QUICKT~1\PictureViewer.exe "%1"". Action Taken: No Action Taken.

    Wed Oct 26 16:03:36 2005 => Entry "HKCR\QuickTime.pic\shell\open\command" refers to invalid object "C:\PROGRA~2\QUICKT~1\PictureViewer.exe "%1"". Action Taken: No Action Taken.

    -----------------------------------------------------

    eSacn check findet keine Dateien zum löschen!
    Angegebe Ordner sind leer! - bei infected!!
    Wie ist das mit den errors d.h. invalid object - um was handelt es sich dabei genau?

    Bitte um Hilfe, Danke im voraus! :o)
     
  2. Jasager

    Jasager Viertel Gigabyte

    Registriert seit:
    6. Dezember 2004
    Beiträge:
    2.642
    Hallo,
    bei den "refers to invalid object" Meldungen handelt es sich um verwaiste Registrykeys, diese kannst du z.B. mit Regseeker entfernen. Genauso wie diesen Registrykey, aber nach dem mußt du dann suchen:
    Wed Oct 26 16:02:57 2005 => System found infected with stylexp Spyware/Adware ({c333cf63-767f-4831-94ac-e683d962c63c})! Action taken: No Action Taken.

    Dann solltest du noch die temporären Internetdateien löschen (im IE auf Extras>>Internetoptionen), das sollte es dann eigentlich schon gewesen sein.


    Grüße Jasager
     
  3. WIZO9247

    WIZO9247 ROM

    Registriert seit:
    26. Oktober 2005
    Beiträge:
    4
    Danke für die schnelle Antwort :o), hab´ mir auch gleich das Prog. runtergeladen und ausgeführt. Die Fehler und StyleXP ist weg, leider aber zeigt eScan immer noch 8 gefundene Viren an:

    ----------------
    Wed Oct 26 22:16:39 2005 => ***** Scanning Registry and File system for Adware/Spyware *****
    Wed Oct 26 22:16:39 2005 => Loading Spyware Signatures from new External Database (Size: 144406).
    Wed Oct 26 22:16:39 2005 => Indexed Spyware Databases Successfully Created...

    Wed Oct 26 22:17:04 2005 => Offending file found: C:\Dokumente und Einstellungen\Kerstin\Lokale Einstellungen\temporary internet files\content.ie5\89abcdef\common[1].js
    Wed Oct 26 22:17:04 2005 => System found infected with whenu.savenow Spyware/Adware (common[1].js)! Action taken: Keine Aktion vorgenommen.

    Wed Oct 26 22:17:04 2005 => Offending file found: C:\Dokumente und Einstellungen\Kerstin\Lokale Einstellungen\temporary internet files\content.ie5\ghijklmn\common[1].js
    Wed Oct 26 22:17:04 2005 => System found infected with whenu.savenow Spyware/Adware (common[1].js)! Action taken: Keine Aktion vorgenommen.

    Wed Oct 26 22:17:04 2005 => Offending file found: C:\Dokumente und Einstellungen\Kerstin\Lokale Einstellungen\temporary internet files\content.ie5\k3c9kbgn\common[1].js
    Wed Oct 26 22:17:04 2005 => System found infected with whenu.savenow Spyware/Adware (common[1].js)! Action taken: Keine Aktion vorgenommen.

    Wed Oct 26 22:17:04 2005 => Offending file found: C:\Dokumente und Einstellungen\Kerstin\Lokale Einstellungen\temporary internet files\content.ie5\opqrstuv\common[1].js
    Wed Oct 26 22:17:04 2005 => System found infected with whenu.savenow Spyware/Adware (common[1].js)! Action taken: Keine Aktion vorgenommen.

    Wed Oct 26 22:17:05 2005 => Offending file found: C:\Dokumente und Einstellungen\Kerstin\Lokale Einstellungen\Temporary Internet Files\content.ie5\89abcdef\common[1].js
    Wed Oct 26 22:17:05 2005 => System found infected with whenu.savenow Spyware/Adware (common[1].js)! Action taken: Keine Aktion vorgenommen.

    Wed Oct 26 22:17:06 2005 => Offending file found: C:\Dokumente und Einstellungen\Kerstin\Lokale Einstellungen\Temporary Internet Files\content.ie5\ghijklmn\common[1].js
    Wed Oct 26 22:17:06 2005 => System found infected with whenu.savenow Spyware/Adware (common[1].js)! Action taken: Keine Aktion vorgenommen.

    Wed Oct 26 22:17:06 2005 => Offending file found: C:\Dokumente und Einstellungen\Kerstin\Lokale Einstellungen\Temporary Internet Files\content.ie5\k3c9kbgn\common[1].js
    Wed Oct 26 22:17:06 2005 => System found infected with whenu.savenow Spyware/Adware (common[1].js)! Action taken: Keine Aktion vorgenommen.

    Wed Oct 26 22:17:06 2005 => Offending file found: C:\Dokumente und Einstellungen\Kerstin\Lokale Einstellungen\Temporary Internet Files\content.ie5\opqrstuv\common[1].js
    Wed Oct 26 22:17:06 2005 => System found infected with whenu.savenow Spyware/Adware (common[1].js)! Action taken: Keine Aktion vorgenommen.
    ------------------

    Wie kann ich noch vorgehen? Die angegebenen Ordner sind leeeeer!
    *DANKE*
     
  4. Jasager

    Jasager Viertel Gigabyte

    Registriert seit:
    6. Dezember 2004
    Beiträge:
    2.642
    Hallo,
    erstmal sind sie das nicht, dir wird nur der Inhalt nicht angezeigt. Hast du die temporären Internetdateien gelöscht (mit dem Account Kerstin eigeloggt)?


    Grüße Jasager
     
  5. WIZO9247

    WIZO9247 ROM

    Registriert seit:
    26. Oktober 2005
    Beiträge:
    4
    Ja, eigentlich schon.
     
  6. Jasager

    Jasager Viertel Gigabyte

    Registriert seit:
    6. Dezember 2004
    Beiträge:
    2.642
    Hallo,
    kann aber eigentlich nicht sein, denn die Dateien sind in den temporären Internetdateien. Nochmal, du bist auch mit dem Konto Kerstin eingeloggt?
    Du kannst auch mal das hier mal machen, und die Dateien manuell löschen.


    Grüße Jasager
     
  7. WIZO9247

    WIZO9247 ROM

    Registriert seit:
    26. Oktober 2005
    Beiträge:
    4
    Hab´ ich jetzt auch gemacht, und immer noch zeigt mir eScan 8 Viren an - Ordner sind echt rutzebutz leer. Ja ich bin unter "Kerstin" eingeloggt.
     
Status des Themas:
Es sind keine weiteren Antworten möglich.

Diese Seite empfehlen