ich hoffe du hast keine einwahlverbindung sondern dsl.
hier sind noch ein paar hinweise, programme.
ansonsten kann ich dir dazu raten regelmässig die windowsupdates zu machen und dir einen guten virenscanner und ein gutes antispy programm zuzulegen.
du kannst deine büchse auch online für lau checken.
geh mal auf
http://www3.ca.com/securityadvisor/virusinfo
hier ist noch eine Beschreibung des Virus von dir, scheint ein Trojaner zu sein:
Description
Win32.Betalire are a family of trojans that display popup advertisements when a user is connected to the Internet. The trojan may also download files and modify the user's default Internet Explorer settings, and install an IE toolbar. Most variants are downloaded onto the affected system, while some are dropped onto the system by a Betalire dropper component. These trojans hide their presence from the user, making them difficult to remove.
Method of Infection
The main Betalire executable usually uses the filename pokapoka6<x>.exe, where <x> is a value from 1 upwards. Samples received by CA from the wild have used the following filenames:
pokapoka61.exe
pokapoka62.exe
pokapoka63.exe
When executed, Win32.Betalire adds a value to the following registry key so that it can be executed at each Windows start:
HKLMSoftwareMicrosoftWindowsCurrentVersionRun
Common value names it sets include the following:
System service61
System service62
System service63
These values point to the location the trojan was executed from, which is usually the %Windows%etb directory. For example, some Betalire variants have set the following registry value:
HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunSystem service63 = "%Windows%etbpokapoka63.exe"
The trojan drops a number of DLLs, one of which is used by the trojan to download files. Depending on the variant, this DLL uses one of the following file names:
xud2f.dll
xud_63.dll
xud_62.dll
Another DLL dropped by Betalire is used to hide its presence from the user. It does this by injecting itself into running processes. It avoids injecting itself into any process that contains any of the following strings in its name:
protector
system
msnmgr
mdm
lsass
spoolsv
iexplore
idle
csrss
smss
svchost
pokapoka
temp
test
vmware
The DLL uses one of the following file names, depending on the variant:
nt_hide61.dll
nt_hide62.dll
nt_hide63.dll
The following files are dropped into the %Temp% directory:
<random number>.tmp
<random number>.tmp1
<random number> is usually in a specific format, for example:
197154_364_212_1604_0.41.tmp
66608_1792_1884_2112_0.41.tmp1
Note: %Temp% is a variable location and refers to the directory designated for temporary files. The malware determines the location of the current Temp folder by querying the operating system. A typical path is "C
ocuments and Settings<username>Local SettingsTemp", or "C:WINDOWSTEMP".
The trojan also creates the folder "%Windows%etb" and creates the file etb.ini in this folder. This file is used by the trojan to store information such as the trojan version, the executable's filepath, date of infection, etc.
Return to top
Payload
Displays Popups
Betalire downloads a configuration file from the "msupdater.com" domain. This file contains a number of URLs related to advertising sites. The trojan periodically displays popups in Internet Explorer that connect to these sites.
Downloads and Executes Arbitrary Files
Betalire is capable of downloading a number of files from the "searchmiracle.com" domain. Files that may be downloaded include updates of the trojan.
Modifies System Settings
Betalire may modify the following registry entries in order to change the user's default Internet Explorer homepage and/or default start page.
HKCUSoftwareMicrosoftInternet ExplorerMainSearch Page
HKCUSoftwareMicrosoftInternet ExplorerMainSearch Bar
HKCUSoftwareMicrosoftInternet ExplorerSearchURL
HKCUSoftwareMicrosoftInternet ExplorerSearchSearchAssistant
The trojan also installs an Internet Explorer toolbar.
Analysis by Amir Fouda
Return to top
GRUß, Sofia Loreen