| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Viren-/Trojanerfunde (u. a.): TR/Spy.SpyEyes.hdj // JAVA/Agent.KA (etc.) // TR/EyeStye.N.4Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
09.05.2011, 20:14
| #1 |
 |  Viren-/Trojanerfunde (u. a.): TR/Spy.SpyEyes.hdj // JAVA/Agent.KA (etc.) // TR/EyeStye.N.4 Hallo liebes Trojaner-Board-Team, ich habe mal so eben mein Antivir rüberlaufen lassen und musste erschreckend feststellen, dass er mir dann das hier als Ergebnis anzeigte: Avira AntiVir Personal Report file date: Montag, 9. Mai 2011 20:24 Scanning for 2703703 virus strains and unwanted programs. The program is running as an unrestricted full version. Online services are available: Licensee : Avira AntiVir Personal - FREE Antivirus Serial number : 0000149996-ADJIE-0000001 Platform : Windows XP Windows version : (Service Pack 3) [5.1.2600] Boot mode : Normally booted Username : Muskeljesus Computer name : JESUS Version information: BUILD.DAT : 10.0.0.648 31823 Bytes 01.04.2011 18:36:00 AVSCAN.EXE : 10.0.4.2 442024 Bytes 27.04.2011 13:34:15 AVSCAN.DLL : 10.0.3.0 46440 Bytes 01.04.2010 12:57:06 LUKE.DLL : 10.0.3.2 104296 Bytes 10.12.2010 20:06:32 LUKERES.DLL : 10.0.0.1 12648 Bytes 10.02.2010 23:40:50 VBASE000.VDF : 7.10.0.0 19875328 Bytes 06.11.2009 06:35:52 VBASE001.VDF : 7.11.0.0 13342208 Bytes 14.12.2010 15:27:23 VBASE002.VDF : 7.11.3.0 1950720 Bytes 09.02.2011 16:08:11 VBASE003.VDF : 7.11.5.225 1980416 Bytes 07.04.2011 21:26:37 VBASE004.VDF : 7.11.5.226 2048 Bytes 07.04.2011 21:26:37 VBASE005.VDF : 7.11.5.227 2048 Bytes 07.04.2011 21:26:37 VBASE006.VDF : 7.11.5.228 2048 Bytes 07.04.2011 21:26:37 VBASE007.VDF : 7.11.5.229 2048 Bytes 07.04.2011 21:26:37 VBASE008.VDF : 7.11.5.230 2048 Bytes 07.04.2011 21:26:37 VBASE009.VDF : 7.11.5.231 2048 Bytes 07.04.2011 21:26:37 VBASE010.VDF : 7.11.5.232 2048 Bytes 07.04.2011 21:26:37 VBASE011.VDF : 7.11.5.233 2048 Bytes 07.04.2011 21:26:37 VBASE012.VDF : 7.11.5.234 2048 Bytes 07.04.2011 21:26:37 VBASE013.VDF : 7.11.6.28 158208 Bytes 11.04.2011 13:51:34 VBASE014.VDF : 7.11.6.74 116224 Bytes 13.04.2011 13:51:34 VBASE015.VDF : 7.11.6.113 137728 Bytes 14.04.2011 14:05:54 VBASE016.VDF : 7.11.6.150 146944 Bytes 18.04.2011 13:34:14 VBASE017.VDF : 7.11.6.192 138240 Bytes 20.04.2011 13:34:14 VBASE018.VDF : 7.11.6.237 156160 Bytes 22.04.2011 13:34:14 VBASE019.VDF : 7.11.7.45 427520 Bytes 27.04.2011 15:44:32 VBASE020.VDF : 7.11.7.64 192000 Bytes 28.04.2011 15:44:32 VBASE021.VDF : 7.11.7.97 182272 Bytes 02.05.2011 18:24:00 VBASE022.VDF : 7.11.7.127 467968 Bytes 04.05.2011 18:24:01 VBASE023.VDF : 7.11.7.183 185856 Bytes 09.05.2011 18:23:54 VBASE024.VDF : 7.11.7.184 2048 Bytes 09.05.2011 18:23:54 VBASE025.VDF : 7.11.7.185 2048 Bytes 09.05.2011 18:23:54 VBASE026.VDF : 7.11.7.186 2048 Bytes 09.05.2011 18:23:54 VBASE027.VDF : 7.11.7.187 2048 Bytes 09.05.2011 18:23:54 VBASE028.VDF : 7.11.7.188 2048 Bytes 09.05.2011 18:23:54 VBASE029.VDF : 7.11.7.189 2048 Bytes 09.05.2011 18:23:54 VBASE030.VDF : 7.11.7.190 2048 Bytes 09.05.2011 18:23:54 VBASE031.VDF : 7.11.7.203 60416 Bytes 09.05.2011 18:23:54 Engineversion : 8.2.4.228 AEVDF.DLL : 8.1.2.1 106868 Bytes 30.07.2010 00:07:37 AESCRIPT.DLL : 8.1.3.61 1253754 Bytes 07.05.2011 18:24:06 AESCN.DLL : 8.1.7.2 127349 Bytes 03.12.2010 15:32:16 AESBX.DLL : 8.1.3.2 254324 Bytes 03.12.2010 15:32:22 AERDL.DLL : 8.1.9.9 639347 Bytes 25.03.2011 16:49:05 AEPACK.DLL : 8.2.6.0 549237 Bytes 09.04.2011 21:26:41 AEOFFICE.DLL : 8.1.1.22 205178 Bytes 07.05.2011 18:24:05 AEHEUR.DLL : 8.1.2.113 3494263 Bytes 07.05.2011 18:24:05 AEHELP.DLL : 8.1.16.1 246134 Bytes 04.02.2011 13:29:47 AEGEN.DLL : 8.1.5.4 397684 Bytes 04.04.2011 15:46:06 AEEMU.DLL : 8.1.3.0 393589 Bytes 03.12.2010 15:31:36 AECORE.DLL : 8.1.20.2 196982 Bytes 09.04.2011 21:26:38 AEBB.DLL : 8.1.1.0 53618 Bytes 23.04.2010 20:31:20 AVWINLL.DLL : 10.0.0.0 19304 Bytes 02.08.2010 15:09:58 AVPREF.DLL : 10.0.0.0 44904 Bytes 02.08.2010 15:09:56 AVREP.DLL : 10.0.0.9 174120 Bytes 27.04.2011 13:34:15 AVREG.DLL : 10.0.3.2 53096 Bytes 02.08.2010 15:09:56 AVSCPLR.DLL : 10.0.4.2 84840 Bytes 27.04.2011 13:34:15 AVARKT.DLL : 10.0.22.6 231784 Bytes 10.12.2010 20:06:31 AVEVTLOG.DLL : 10.0.0.8 203112 Bytes 02.08.2010 15:09:56 SQLITE3.DLL : 3.6.19.0 355688 Bytes 17.06.2010 14:27:24 AVSMTP.DLL : 10.0.0.17 63848 Bytes 02.08.2010 15:09:58 NETNT.DLL : 10.0.0.0 11624 Bytes 17.06.2010 14:27:22 RCIMAGE.DLL : 10.0.0.26 2550120 Bytes 28.01.2010 13:10:22 RCTEXT.DLL : 10.0.58.0 97128 Bytes 02.08.2010 15:10:10 Configuration settings for the scan: Jobname.............................: Manual Selection Configuration file..................: C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\PROFILES\folder.avp Logging.............................: low Primary action......................: interactive Secondary action....................: ignore Scan master boot sector.............: on Scan boot sector....................: on Boot sectors........................: C:, Process scan........................: on Scan registry.......................: on Search for rootkits.................: off Integrity checking of system files..: off Scan all files......................: Intelligent file selection Scan archives.......................: on Recursion depth.....................: 20 Smart extensions....................: on Macro heuristic.....................: on File heuristic......................: medium Start of the scan: Montag, 9. Mai 2011 20:24 The scan of running processes will be started Scan process 'avscan.exe' - '1' Module(s) have been scanned Scan process 'avcenter.exe' - '1' Module(s) have been scanned Scan process 'plugin-container.exe' - '1' Module(s) have been scanned Scan process 'firefox.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'alg.exe' - '1' Module(s) have been scanned Scan process 'jqs.exe' - '1' Module(s) have been scanned Scan process 'avshadow.exe' - '1' Module(s) have been scanned Scan process 'FreeAgentService.exe' - '1' Module(s) have been scanned Scan process 'avguard.exe' - '1' Module(s) have been scanned Scan process 'ICQ.exe' - '1' Module(s) have been scanned Scan process 'ctfmon.exe' - '1' Module(s) have been scanned Scan process 'DivXUpdate.exe' - '1' Module(s) have been scanned Scan process 'StxMenuMgr.exe' - '1' Module(s) have been scanned Scan process 'DDmService.exe' - '1' Module(s) have been scanned Scan process 'VCDDaemon.exe' - '1' Module(s) have been scanned Scan process 'avgnt.exe' - '1' Module(s) have been scanned Scan process 'BJMyPrt.exe' - '1' Module(s) have been scanned Scan process 'jusched.exe' - '1' Module(s) have been scanned Scan process 'RTHDCPL.EXE' - '1' Module(s) have been scanned Scan process 'Explorer.EXE' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'sched.exe' - '1' Module(s) have been scanned Scan process 'spoolsv.exe' - '1' Module(s) have been scanned Scan process 'Ati2evxx.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'Ati2evxx.exe' - '1' Module(s) have been scanned Scan process 'lsass.exe' - '1' Module(s) have been scanned Scan process 'services.exe' - '1' Module(s) have been scanned Scan process 'winlogon.exe' - '1' Module(s) have been scanned Scan process 'csrss.exe' - '1' Module(s) have been scanned Scan process 'smss.exe' - '1' Module(s) have been scanned Starting master boot sector scan: Master boot sector HD0 [INFO] No virus was found! Start scanning boot sectors: Boot sector 'C:\' [INFO] No virus was found! Starting to scan executable files (registry). C:\dgfusdghudf\dgfusdghudf.exe [DETECTION] Is the TR/Spy.SpyEyes.hdj Trojan The registry was scanned ( '388' files ). Starting the file scan: Begin scan in 'C:\' <XP32> C:\dgfusdghudf\dgfusdghudf.exe [DETECTION] Is the TR/Spy.SpyEyes.hdj Trojan C:\Documents and Settings\Muskeljesus\Application Data\Sun\Java\Deployment\cache\6.0\35\513d8fa3-78ef8190 [0] Archive type: ZIP [DETECTION] Contains recognition pattern of the JAVA/Agent.KA Java virus --> api/market_patch.class [DETECTION] Contains recognition pattern of the JAVA/Agent.KA Java virus --> importer/market.class [DETECTION] Contains recognition pattern of the JAVA/Exdoer.BS Java virus --> importer/parser.class [DETECTION] Contains recognition pattern of the JAVA/Agent.DV Java virus --> importer/searchers.class [DETECTION] Contains recognition pattern of the JAVA/Exdoer.BQ Java virus C:\Documents and Settings\Muskeljesus\Application Data\Sun\Java\Deployment\cache\6.0\46\65ad046e-511d9e5e [0] Archive type: ZIP [DETECTION] Contains recognition pattern of the JAVA/Agent.KA Java virus --> netbeans/PHP.class [DETECTION] Contains recognition pattern of the JAVA/Agent.KA Java virus --> plugin/Commander.class [DETECTION] Contains recognition pattern of the JAVA/Pesc.K Java virus --> plugin/Console.class [DETECTION] Contains recognition pattern of the JAVA/Exdoer.BQ Java virus --> plugin/Syntax.class [DETECTION] Contains recognition pattern of the JAVA/Exdoer.BS Java virus C:\_OTL\MovedFiles\04282011_181916\C_blyadstvoeb\blyadstvoeb.exe [DETECTION] Is the TR/EyeStye.N.4 Trojan Beginning disinfection: C:\_OTL\MovedFiles\04282011_181916\C_blyadstvoeb\blyadstvoeb.exe [DETECTION] Is the TR/EyeStye.N.4 Trojan [NOTE] The file was moved to the quarantine directory under the name '4d4b911d.qua'. C:\Documents and Settings\Muskeljesus\Application Data\Sun\Java\Deployment\cache\6.0\46\65ad046e-511d9e5e [DETECTION] Contains recognition pattern of the JAVA/Exdoer.BS Java virus [NOTE] The file was moved to the quarantine directory under the name '55b4be74.qua'. C:\Documents and Settings\Muskeljesus\Application Data\Sun\Java\Deployment\cache\6.0\35\513d8fa3-78ef8190 [DETECTION] Contains recognition pattern of the JAVA/Exdoer.BQ Java virus [NOTE] The file was moved to the quarantine directory under the name '0439e498.qua'. C:\dgfusdghudf\dgfusdghudf.exe [DETECTION] Is the TR/Spy.SpyEyes.hdj Trojan [NOTE] The registration entry <HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9678ACB43C661622> was removed successfully. [NOTE] The file was moved to the quarantine directory under the name '61dbab90.qua'. End of the scan: Montag, 9. Mai 2011 20:40 Used time: 15:59 Minute(s) The scan has been done completely. 10396 Scanned directories 246792 Files were scanned 11 Viruses and/or unwanted programs were found 0 Files were classified as suspicious 0 files were deleted 0 Viruses and unwanted programs were repaired 4 Files were moved to quarantine 0 Files were renamed 0 Files cannot be scanned 246781 Files not concerned 1876 Archives were scanned 0 Warnings 4 Notes --------------------------------------------------------------------- Es hat mich gewundert, weil ich vorher (fast) jeden Tag "Malwarebytes' Anti-Maleware" rüberlaufen ließ und er (zumindest die letzten Tage) nichts zu berichten hatte. Anbei gebe ich euch mal, was OTL und Malwarebytes' Anti-Malware" zu berichten hatten. Wie sollte ich vorgehen? Weil es soviele Funde sind, bin ich ehrlich gesagt als Laie recht überfordert. Ich danke euch für jede Hilfe! MfG Wenn ihr noch irgendwelche zusätzlichen Informationen/Angaben braucht, raus damit, ich werde jetzt alle paar Minuten F5 drücken.  |
|
10.05.2011, 11:33
| #2 |
| /// Malware-holic   | Viren-/Trojanerfunde (u. a.): TR/Spy.SpyEyes.hdj // JAVA/Agent.KA (etc.) // TR/EyeStye.N.4 hi,
__________________wieso musst du, wenn ich fragen darf, jeden tag nach malware scannen. dann stimmt mit deinen sicherheitsvorkehrungen was nicht... poste bitte alle Malwarebytes logs mit funden, unter Malwarebytes logdateien.
__________________ |
|
10.05.2011, 11:35
| #3 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Viren-/Trojanerfunde (u. a.): TR/Spy.SpyEyes.hdj // JAVA/Agent.KA (etc.) // TR/EyeStye.N.4Zitat:
Gibt es noch weitere Logs von Malwarebytes? Wenn ja bitte alle posten, die in Malwarebytes im Reiter Logdateien sichtbar sind.
__________________ |
|
10.05.2011, 11:51
| #4 |
| | Viren-/Trojanerfunde (u. a.): TR/Spy.SpyEyes.hdj // JAVA/Agent.KA (etc.) // TR/EyeStye.N.4 @markusg: Sagen wir es so, ich wurde ein wenig paranoid nach dem einen Fund, den auch cosinus anspricht. Ich Depp habe einfach die Schritte in einem anderen Forumbeitrag übernommen (siehe http://www.trojaner-board.de/98043-v...-gefunden.html). Komischerweise war Antivir dann auch still. Warte, die Logs reiche ich nach. @cosinus: Der Fall in dem Forum war meinem so ähnlich, da dachte ich, es könnte nicht schaden sich daran zu halten. Wird nicht nochmal passieren! Edit: Die Logs mit Funden werde ich per Editieren hier nennen, damit ihr nicht so suchen müsst. Danke nochmals! Logs, wo etwas gefunden wurde, sind: Nr. 01 (mbam-log-2011-04-28 (17-24-55)), Nr. 04 (mbam-log-2011-05-03 (22-41-28)), Nr. 10 (mbam-log-2011-05-06 (04-34-54)) Geändert von Yakul (10.05.2011 um 12:02 Uhr) |
|
10.05.2011, 11:52
| #5 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Viren-/Trojanerfunde (u. a.): TR/Spy.SpyEyes.hdj // JAVA/Agent.KA (etc.) // TR/EyeStye.N.4 Pack beim nächsten Mal alle Logs in eine Zip-Datei und lad diese hoch. Sonst wird das für uns eine Klickorgie 
__________________ Logfiles bitte immer in CODE-Tags posten |
|
10.05.2011, 12:20
| #6 |
| | Viren-/Trojanerfunde (u. a.): TR/Spy.SpyEyes.hdj // JAVA/Agent.KA (etc.) // TR/EyeStye.N.4 @cosinus: Ich hoffe, es wird kein nächstes Mal geben  |
|
10.05.2011, 12:23
| #7 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Viren-/Trojanerfunde (u. a.): TR/Spy.SpyEyes.hdj // JAVA/Agent.KA (etc.) // TR/EyeStye.N.4 Welches Script hast du für den OTL-Fix genommen?
__________________ Logfiles bitte immer in CODE-Tags posten |
|
10.05.2011, 12:32
| #8 |
| | Viren-/Trojanerfunde (u. a.): TR/Spy.SpyEyes.hdj // JAVA/Agent.KA (etc.) // TR/EyeStye.N.4 Script? Also ich habe mich lediglich an deine Anweisung gehalten, die du wem anderes empfohlen hast. Wenn ich mich richtig erinnere, habe ich das, was du dort geschrieben hast für mich auch übernommen, siehe http://www.trojaner-board.de/98043-v...-gefunden.html (Ist ein Link zu Eurem Forum, keine Angst) --------------------------------------------------------------------- :OTL O4 - HKCU..\Run: [34D27A2BB6A8FBF9] C:\blyadstvoeb\blyadstvoeb.exe (Trend Micro Inc.) O32 - HKLM CDRom: AutoRun - 1 [2011.04.09 05:47:21 | 000,013,958 | -HS- | C] () -- C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\43nhg11de6n2f1e3bn40f5of0svg0r [2011.04.09 05:47:21 | 000,013,958 | -HS- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\43nhg11de6n2f1e3bn40f5of0svg0r :Files C:\blyadstvoeb :Commands [purity] [resethosts] [emptytemp] ---------------------------------------------------------------------- Hilft dir das weiter? |
|
10.05.2011, 12:59
| #9 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Viren-/Trojanerfunde (u. a.): TR/Spy.SpyEyes.hdj // JAVA/Agent.KA (etc.) // TR/EyeStye.N.4 Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!) Code:
ATTFilter :OTL
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008.09.21 21:33:26 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2007.09.21 11:39:49 | 000,582,656 | R--- | M] (Nival Interactive) - E:\AutoRun.exe -- [ UDF ]
O32 - AutoRun File - [2007.09.21 11:39:49 | 000,302,430 | R--- | M] () - E:\AutoRun.ico -- [ UDF ]
O32 - AutoRun File - [2007.09.21 11:39:50 | 000,000,047 | R--- | M] () - E:\autorun.inf -- [ UDF ]
O32 - AutoRun File - [2008.07.23 11:12:23 | 000,000,000 | R--D | M] - E:\Autorun -- [ UDF ]
[2011.05.03 22:13:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Muskeljesus\Application Data\Siiqi
[2011.05.03 22:41:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Muskeljesus\Application Data\Unyrul
:Commands
[purity]
[resethosts]
[emptytemp]
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet. Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
10.05.2011, 13:08
| #10 |
| | Viren-/Trojanerfunde (u. a.): TR/Spy.SpyEyes.hdj // JAVA/Agent.KA (etc.) // TR/EyeStye.N.4 Hier die Logfile, die OTL nach dem Neustart rausgegeben hat: (Soll ich dir so etwas eigentlich lieber über Anhänge schicken oder passt es so?) ----------------------------------------------------------------------- All processes killed ========== OTL ========== HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully! C:\AUTOEXEC.BAT moved successfully. File move failed. E:\AutoRun.exe scheduled to be moved on reboot. File move failed. E:\AutoRun.ico scheduled to be moved on reboot. File move failed. E:\autorun.inf scheduled to be moved on reboot. File not found. C:\Documents and Settings\Muskeljesus\Application Data\Siiqi folder moved successfully. C:\Documents and Settings\Muskeljesus\Application Data\Unyrul folder moved successfully. ========== COMMANDS ========== C:\WINDOWS\System32\drivers\etc\Hosts moved successfully. HOSTS file reset successfully [EMPTYTEMP] User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: Muskeljesus ->Temp folder emptied: 20810688 bytes ->Temporary Internet Files folder emptied: 26231170 bytes ->Java cache emptied: 1565 bytes ->FireFox cache emptied: 7655184 bytes ->Flash cache emptied: 7410 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 32768 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes RecycleBin emptied: 11750 bytes Total Files Cleaned = 52,00 mb OTL by OldTimer - Version 3.2.22.3 log created on 05102011_140244 Files\Folders moved on Reboot... File move failed. E:\AutoRun.exe scheduled to be moved on reboot. File move failed. E:\AutoRun.ico scheduled to be moved on reboot. File move failed. E:\autorun.inf scheduled to be moved on reboot. Registry entries deleted on Reboot... ---------------------------------------------------------------------- |
|
10.05.2011, 13:13
| #11 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Viren-/Trojanerfunde (u. a.): TR/Spy.SpyEyes.hdj // JAVA/Agent.KA (etc.) // TR/EyeStye.N.4 Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html Das Tool so einstellen wie unten im Bild angegeben - also beide Haken setzen, auf Start scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.  Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, bitte unhide ausführen: Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop. Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )  Vista und 7 User müssen das Tool per Rechtsklick als Administrator ausführen!
__________________ Logfiles bitte immer in CODE-Tags posten |
|
10.05.2011, 13:26
| #12 |
| | Viren-/Trojanerfunde (u. a.): TR/Spy.SpyEyes.hdj // JAVA/Agent.KA (etc.) // TR/EyeStye.N.4 Hallo, habe das Kaspersky-Programm durchlaufen lassen und am Ende gibt es keinen "Report"-Knopf. Es könnte vielleicht daran liegen, dass er nichts entdeckt hat. Hier mal ein Screenshot. |
|
10.05.2011, 13:35
| #13 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Viren-/Trojanerfunde (u. a.): TR/Spy.SpyEyes.hdj // JAVA/Agent.KA (etc.) // TR/EyeStye.N.4 Hast du es per Rechtsklick als Admin ausgeführt?
__________________ Logfiles bitte immer in CODE-Tags posten |
|
10.05.2011, 13:39
| #14 | |
| | Viren-/Trojanerfunde (u. a.): TR/Spy.SpyEyes.hdj // JAVA/Agent.KA (etc.) // TR/EyeStye.N.4Zitat:
---------------------------------------------------------------------------- 2011/05/10 14:19:34.0218 2580 TDSS rootkit removing tool 2.5.0.0 May 1 2011 14:20:16 2011/05/10 14:19:34.0390 2580 ================================================================================ 2011/05/10 14:19:34.0390 2580 SystemInfo: 2011/05/10 14:19:34.0390 2580 2011/05/10 14:19:34.0390 2580 OS Version: 5.1.2600 ServicePack: 3.0 2011/05/10 14:19:34.0390 2580 Product type: Workstation 2011/05/10 14:19:34.0390 2580 ComputerName: JESUS 2011/05/10 14:19:34.0390 2580 UserName: Muskeljesus 2011/05/10 14:19:34.0390 2580 Windows directory: C:\WINDOWS 2011/05/10 14:19:34.0390 2580 System windows directory: C:\WINDOWS 2011/05/10 14:19:34.0390 2580 Processor architecture: Intel x86 2011/05/10 14:19:34.0390 2580 Number of processors: 2 2011/05/10 14:19:34.0390 2580 Page size: 0x1000 2011/05/10 14:19:34.0390 2580 Boot type: Normal boot 2011/05/10 14:19:34.0390 2580 ================================================================================ 2011/05/10 14:19:34.0593 2580 Initialize success 2011/05/10 14:19:46.0734 3896 ================================================================================ 2011/05/10 14:19:46.0734 3896 Scan started 2011/05/10 14:19:46.0734 3896 Mode: Manual; 2011/05/10 14:19:46.0734 3896 ================================================================================ 2011/05/10 14:19:47.0312 3896 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys 2011/05/10 14:19:47.0406 3896 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys 2011/05/10 14:19:47.0609 3896 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys 2011/05/10 14:19:47.0703 3896 AFD (7618d5218f2a614672ec61a80d854a37) C:\WINDOWS\System32\drivers\afd.sys 2011/05/10 14:19:48.0500 3896 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys 2011/05/10 14:19:48.0609 3896 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys 2011/05/10 14:19:48.0906 3896 ati2mtag (c06659ff381423d6cb19a91c2a2f80ad) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys 2011/05/10 14:19:49.0046 3896 AtiHdmiService (dc6957811ff95f2dd3004361b20d8d3f) C:\WINDOWS\system32\drivers\AtiHdmi.sys 2011/05/10 14:19:49.0140 3896 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys 2011/05/10 14:19:49.0234 3896 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys 2011/05/10 14:19:49.0312 3896 avgio (0b497c79824f8e1bf22fa6aacd3de3a0) C:\Program Files\Avira\AntiVir Desktop\avgio.sys 2011/05/10 14:19:49.0453 3896 avgntflt (47b879406246ffdced59e18d331a0e7d) C:\WINDOWS\system32\DRIVERS\avgntflt.sys 2011/05/10 14:19:49.0593 3896 avipbb (5fedef54757b34fb611b9ec8fb399364) C:\WINDOWS\system32\DRIVERS\avipbb.sys 2011/05/10 14:19:49.0687 3896 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys 2011/05/10 14:19:49.0812 3896 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys 2011/05/10 14:19:49.0968 3896 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys 2011/05/10 14:19:50.0093 3896 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys 2011/05/10 14:19:50.0187 3896 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys 2011/05/10 14:19:50.0796 3896 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys 2011/05/10 14:19:50.0906 3896 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys 2011/05/10 14:19:51.0046 3896 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys 2011/05/10 14:19:51.0140 3896 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys 2011/05/10 14:19:51.0265 3896 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys 2011/05/10 14:19:51.0468 3896 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys 2011/05/10 14:19:51.0578 3896 ElbyCDIO (44996a2addd2db7454f2ca40b67d8941) C:\WINDOWS\system32\Drivers\ElbyCDIO.sys 2011/05/10 14:19:51.0671 3896 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys 2011/05/10 14:19:51.0796 3896 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys 2011/05/10 14:19:51.0890 3896 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys 2011/05/10 14:19:52.0015 3896 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys 2011/05/10 14:19:52.0093 3896 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys 2011/05/10 14:19:52.0187 3896 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys 2011/05/10 14:19:52.0312 3896 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys 2011/05/10 14:19:52.0609 3896 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys 2011/05/10 14:19:52.0703 3896 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys 2011/05/10 14:19:52.0828 3896 hidusb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys 2011/05/10 14:19:53.0015 3896 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys 2011/05/10 14:19:53.0234 3896 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys 2011/05/10 14:19:53.0375 3896 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys 2011/05/10 14:19:53.0687 3896 IntcAzAudAddService (19afbb8427ce65042599555e578170df) C:\WINDOWS\system32\drivers\RtkHDAud.sys 2011/05/10 14:19:53.0937 3896 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys 2011/05/10 14:19:54.0031 3896 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys 2011/05/10 14:19:54.0140 3896 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys 2011/05/10 14:19:54.0265 3896 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys 2011/05/10 14:19:54.0406 3896 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys 2011/05/10 14:19:54.0531 3896 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys 2011/05/10 14:19:54.0640 3896 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys 2011/05/10 14:19:54.0734 3896 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys 2011/05/10 14:19:54.0859 3896 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys 2011/05/10 14:19:54.0937 3896 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys 2011/05/10 14:19:55.0093 3896 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys 2011/05/10 14:19:55.0187 3896 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys 2011/05/10 14:19:55.0328 3896 L1e (93e64bab9dee162ca0ca5258d132a047) C:\WINDOWS\system32\DRIVERS\l1e51x86.sys 2011/05/10 14:19:55.0515 3896 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys 2011/05/10 14:19:55.0640 3896 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys 2011/05/10 14:19:55.0765 3896 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys 2011/05/10 14:19:55.0890 3896 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys 2011/05/10 14:19:56.0000 3896 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys 2011/05/10 14:19:56.0140 3896 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys 2011/05/10 14:19:56.0281 3896 MRxSmb (0ea4d8ed179b75f8afa7998ba22285ca) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 2011/05/10 14:19:56.0406 3896 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys 2011/05/10 14:19:56.0546 3896 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys 2011/05/10 14:19:56.0640 3896 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys 2011/05/10 14:19:56.0734 3896 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys 2011/05/10 14:19:56.0859 3896 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys 2011/05/10 14:19:56.0968 3896 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys 2011/05/10 14:19:57.0093 3896 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys 2011/05/10 14:19:57.0203 3896 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys 2011/05/10 14:19:57.0312 3896 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys 2011/05/10 14:19:57.0406 3896 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys 2011/05/10 14:19:57.0546 3896 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys 2011/05/10 14:19:57.0671 3896 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys 2011/05/10 14:19:57.0765 3896 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys 2011/05/10 14:19:57.0875 3896 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys 2011/05/10 14:19:58.0015 3896 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys 2011/05/10 14:19:58.0156 3896 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys 2011/05/10 14:19:58.0234 3896 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys 2011/05/10 14:19:58.0343 3896 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys 2011/05/10 14:19:58.0468 3896 NwlnkIpx (8b8b1be2dba4025da6786c645f77f123) C:\WINDOWS\system32\DRIVERS\nwlnkipx.sys 2011/05/10 14:19:58.0609 3896 NwlnkNb (56d34a67c05e94e16377c60609741ff8) C:\WINDOWS\system32\DRIVERS\nwlnknb.sys 2011/05/10 14:19:58.0718 3896 NwlnkSpx (c0bb7d1615e1acbdc99757f6ceaf8cf0) C:\WINDOWS\system32\DRIVERS\nwlnkspx.sys 2011/05/10 14:19:58.0859 3896 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\drivers\Parport.sys 2011/05/10 14:19:58.0937 3896 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys 2011/05/10 14:19:59.0078 3896 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys 2011/05/10 14:19:59.0203 3896 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys 2011/05/10 14:19:59.0343 3896 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys 2011/05/10 14:19:59.0515 3896 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys 2011/05/10 14:20:00.0125 3896 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys 2011/05/10 14:20:00.0218 3896 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys 2011/05/10 14:20:00.0343 3896 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys 2011/05/10 14:20:00.0468 3896 PxHelp20 (e42e3433dbb4cffe8fdd91eab29aea8e) C:\WINDOWS\system32\Drivers\PxHelp20.sys 2011/05/10 14:20:01.0015 3896 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys 2011/05/10 14:20:01.0125 3896 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 2011/05/10 14:20:01.0218 3896 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys 2011/05/10 14:20:01.0375 3896 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys 2011/05/10 14:20:01.0500 3896 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys 2011/05/10 14:20:01.0640 3896 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys 2011/05/10 14:20:01.0750 3896 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys 2011/05/10 14:20:01.0875 3896 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys 2011/05/10 14:20:01.0984 3896 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys 2011/05/10 14:20:02.0109 3896 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys 2011/05/10 14:20:02.0203 3896 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys 2011/05/10 14:20:02.0312 3896 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys 2011/05/10 14:20:02.0437 3896 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys 2011/05/10 14:20:02.0609 3896 SONYPVU1 (a1eceeaa5c5e74b2499eb51d38185b84) C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS 2011/05/10 14:20:02.0812 3896 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys 2011/05/10 14:20:02.0921 3896 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys 2011/05/10 14:20:03.0031 3896 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys 2011/05/10 14:20:03.0171 3896 ssmdrv (a36ee93698802cd899f98bfd553d8185) C:\WINDOWS\system32\DRIVERS\ssmdrv.sys 2011/05/10 14:20:03.0265 3896 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys 2011/05/10 14:20:03.0406 3896 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys 2011/05/10 14:20:03.0843 3896 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys 2011/05/10 14:20:03.0953 3896 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys 2011/05/10 14:20:04.0078 3896 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys 2011/05/10 14:20:04.0187 3896 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys 2011/05/10 14:20:04.0281 3896 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys 2011/05/10 14:20:04.0515 3896 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys 2011/05/10 14:20:04.0718 3896 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys 2011/05/10 14:20:04.0843 3896 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys 2011/05/10 14:20:04.0921 3896 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys 2011/05/10 14:20:05.0062 3896 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys 2011/05/10 14:20:05.0156 3896 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys 2011/05/10 14:20:05.0281 3896 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 2011/05/10 14:20:05.0406 3896 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys 2011/05/10 14:20:05.0515 3896 VClone (94d73b62e458fb56c9ce60aa96d914f9) C:\WINDOWS\system32\DRIVERS\VClone.sys 2011/05/10 14:20:05.0609 3896 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys 2011/05/10 14:20:05.0828 3896 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys 2011/05/10 14:20:05.0921 3896 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys 2011/05/10 14:20:06.0125 3896 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys 2011/05/10 14:20:06.0234 3896 WpdUsb (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\DRIVERS\wpdusb.sys 2011/05/10 14:20:06.0375 3896 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys 2011/05/10 14:20:06.0515 3896 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys 2011/05/10 14:20:06.0640 3896 ================================================================================ 2011/05/10 14:20:06.0640 3896 Scan finished 2011/05/10 14:20:06.0640 3896 ================================================================================ ----------------------------------------------------------------------- |
|
10.05.2011, 14:08
| #15 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Viren-/Trojanerfunde (u. a.): TR/Spy.SpyEyes.hdj // JAVA/Agent.KA (etc.) // TR/EyeStye.N.4 Dann bitte jetzt CF ausführen: ComboFix Ein Leitfaden und Tutorium zur Nutzung von ComboFix
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
__________________ Logfiles bitte immer in CODE-Tags posten |
|
| Themen zu Viren-/Trojanerfunde (u. a.): TR/Spy.SpyEyes.hdj // JAVA/Agent.KA (etc.) // TR/EyeStye.N.4 |
| .dll, anti-malware, antivir, csrss.exe, desktop, ergebnis, explorer.exe, file, free, java, java/agent.ka, java/exdoer.bq, java/exdoer.bs, lsass.exe, malwarebytes, microsoft, nt.dll, service pack 3, service.exe, services, services.exe, software, spoolsv.exe, svchost.exe, system, virus, windows, winlogon.exe |
Linear-Darstellung
