Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung

Log-Analyse und Auswertung: Boo/TDss.A nach Entfernen(?) von Alureon.A gefunden

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML.

 
Alt 15.06.2011, 22:42   #9
zabbn
 
Boo/TDss.A nach Entfernen(?) von Alureon.A gefunden - Standard

Boo/TDss.A nach Entfernen(?) von Alureon.A gefunden



Die Datei sollte einen HP-Treiber-Setup ausführen (ich hatte keine Lust den 100kbit/s Download von der Originalsite abzuwarten... schlechte entscheidung)

Hier das logfile von combofix:

Combofix Logfile:
Code:
ATTFilter
ComboFix 11-06-15.02 - Greg 15.06.2011  23:32:38.1.4 - x64
Microsoft Windows 7 Ultimate   6.1.7600.0.1252.49.1031.18.4094.3042 [GMT 2:00]
ausgeführt von:: c:\users\Greg\Desktop\cofi.exe
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((   Dateien erstellt von 2011-05-15 bis 2011-06-15  ))))))))))))))))))))))))))))))
.
.
2011-06-14 17:38 . 2011-05-29 07:11	39984	----a-w-	c:\windows\SysWow64\drivers\mbamswissarmy.sys
2011-06-14 17:38 . 2011-06-14 17:38	--------	d-----w-	c:\programdata\Malwarebytes
2011-06-14 17:38 . 2011-06-14 17:38	--------	d-----w-	c:\program files (x86)\Malwarebytes' Anti-Malware
2011-06-14 17:38 . 2011-05-29 07:11	25912	----a-w-	c:\windows\system32\drivers\mbam.sys
2011-06-14 16:56 . 2011-06-14 16:56	--------	d-----w-	C:\$WINDOWS.~BT
2011-06-14 16:16 . 2011-06-14 16:16	--------	d-----w-	c:\programdata\Avira
2011-06-14 16:16 . 2011-06-14 16:16	--------	d-----w-	c:\program files (x86)\Avira
2011-06-14 16:16 . 2011-04-01 15:07	83120	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2011-06-14 16:16 . 2011-04-01 15:07	116568	----a-w-	c:\windows\system32\drivers\avipbb.sys
2011-06-14 13:33 . 2011-06-14 17:42	--------	d-----w-	c:\programdata\Spybot - Search & Destroy
2011-06-14 13:33 . 2011-06-14 17:37	--------	d-----w-	c:\program files (x86)\SpybotS&D
2011-06-14 10:22 . 2011-05-24 17:12	8718160	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{559FD441-C988-4EC7-8AA8-AD45A921A337}\mpengine.dll
2011-06-12 20:42 . 2011-06-12 20:42	--------	d-----w-	c:\program files (x86)\YouTube Downloader
2011-06-09 10:41 . 2011-06-09 10:41	--------	d-----w-	c:\windows\system32\appmgmt
2011-06-09 10:31 . 2011-06-09 16:30	--------	d-----w-	c:\program files (x86)\EA Sports
2011-06-09 08:38 . 2011-06-09 08:38	404640	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-06-09 08:37 . 2011-06-09 08:37	--------	d-----w-	C:\Programs
2011-06-08 21:53 . 2009-07-14 01:41	101376	----a-w-	c:\windows\system32\Spool\prtprocs\x64\HPZPPWN7.DLL
2011-06-08 21:08 . 2003-06-12 21:25	7062	----a-w-	c:\windows\SysWow64\audiopid.vxd
2011-06-08 21:07 . 2011-06-08 21:07	--------	d--h--w-	c:\program files (x86)\Creative Installation Information
2011-06-08 21:07 . 2011-06-08 21:07	--------	d-----w-	c:\program files (x86)\Common Files\Creative
2011-06-08 21:07 . 2011-06-08 21:07	--------	d-----w-	c:\program files (x86)\Common Files\Creative Labs Shared
2011-06-08 21:07 . 2011-06-08 21:07	--------	d-----w-	c:\program files\Creative
2011-06-08 21:07 . 2011-06-09 08:55	--------	d-----w-	c:\program files (x86)\Creative
2011-06-08 21:07 . 2011-06-08 21:13	--------	d-----w-	c:\programdata\Creative
2011-06-08 21:07 . 2008-02-04 08:27	102400	----a-w-	c:\windows\SysWow64\cttele32.dll
2011-06-08 21:07 . 2008-02-04 08:28	107008	----a-w-	c:\windows\system32\cttele64.dll
2011-06-08 17:24 . 2011-06-08 17:29	--------	d-----w-	c:\programdata\regid.1986-12.com.adobe
2011-06-08 17:21 . 2003-04-18 17:06	8192	----a-w-	c:\windows\SysWow64\srvany.exe
2011-06-08 17:18 . 2011-06-08 17:18	--------	d-----w-	c:\program files (x86)\Adobe Media Player
2011-06-08 17:08 . 2011-06-08 17:08	--------	d-----w-	c:\program files (x86)\Common Files\Adobe AIR
2011-06-08 16:42 . 2011-06-08 16:42	--------	d-----w-	c:\program files\Eraser
2011-06-08 16:41 . 2011-06-08 16:41	--------	d-----w-	c:\windows\SysWow64\QuickTime
2011-06-08 16:41 . 2011-06-08 16:41	--------	d-----w-	c:\program files (x86)\3ivx
2011-06-08 16:41 . 2011-06-08 16:41	--------	d-----w-	c:\program files (x86)\Common Files\Java
2011-06-08 16:39 . 2011-06-08 16:39	--------	d-----w-	c:\program files (x86)\Microsoft Synchronization Services
2011-06-08 16:38 . 2011-06-08 16:38	--------	d-----w-	c:\windows\PCHEALTH
2011-06-08 16:38 . 2011-06-08 16:38	--------	d-----w-	c:\program files (x86)\Microsoft.NET
2011-06-08 16:38 . 2011-06-08 16:38	--------	d-----w-	c:\program files (x86)\Microsoft SQL Server Compact Edition
2011-06-08 16:37 . 2011-06-08 16:37	--------	d-----w-	c:\program files (x86)\Microsoft Analysis Services
2011-06-08 16:37 . 2011-06-08 16:40	--------	d-----w-	c:\programdata\Microsoft Help
2011-06-08 16:36 . 2011-06-08 16:36	--------	d-----r-	C:\MSOCache
2011-06-08 16:30 . 2011-06-08 16:30	513080	----a-w-	c:\windows\system32\drivers\sptd.sys
2011-06-08 16:30 . 2011-06-08 16:30	--------	d-----w-	c:\program files (x86)\DAEMON Tools Lite
2011-06-08 16:19 . 2011-06-08 16:19	--------	d-----w-	c:\programdata\ATI
2011-06-08 16:18 . 2011-06-08 16:18	0	----a-w-	c:\windows\ativpsrm.bin
2011-06-08 16:02 . 2011-05-24 17:14	270720	------w-	c:\windows\system32\MpSigStub.exe
2011-06-08 16:02 . 2011-06-08 16:02	--------	d-----w-	C:\ATI
2011-06-08 16:01 . 2011-06-08 16:01	--------	d-----w-	c:\program files (x86)\Renesas Electronics
2011-06-08 16:00 . 2011-06-08 16:00	--------	d-----w-	c:\program files\7-Zip
2011-06-08 15:56 . 2011-01-13 11:58	74272	----a-w-	c:\windows\system32\RtNicProp64.dll
2011-06-08 15:56 . 2011-01-13 11:58	413800	----a-w-	c:\windows\system32\drivers\Rt64win7.sys
2011-06-08 15:56 . 2011-01-13 11:58	107552	----a-w-	c:\windows\system32\RTNUninst64.dll
2011-06-08 15:56 . 2011-06-08 15:56	--------	d-----w-	c:\program files (x86)\Realtek
2011-06-08 15:56 . 2011-06-09 08:56	--------	d--h--w-	c:\program files (x86)\InstallShield Installation Information
2011-06-08 15:56 . 2011-06-08 17:20	--------	d-----w-	c:\program files (x86)\Common Files\Adobe
2011-06-08 15:55 . 2011-06-08 16:12	--------	d-----w-	c:\programdata\DivX
2011-06-08 15:55 . 2011-06-14 17:08	--------	d-----w-	c:\programdata\DAEMON Tools Lite
2011-06-08 15:54 . 2011-06-08 15:54	--------	d-----w-	c:\program files (x86)\DVDVideoSoft
2011-06-08 15:54 . 2011-06-08 15:54	--------	d-----w-	c:\program files (x86)\Common Files\Plasmoo
2011-06-08 15:54 . 2011-06-08 15:54	--------	d-----w-	c:\program files (x86)\YouTube Converter
2011-06-08 15:54 . 2011-06-08 15:54	--------	d-----w-	c:\program files (x86)\Common Files\DVDVideoSoft
2011-06-08 15:52 . 2011-06-08 16:13	--------	d-----w-	c:\program files (x86)\Google
2011-06-08 15:52 . 2011-06-08 15:52	--------	d-----w-	c:\program files (x86)\GrabIt
2011-06-08 15:52 . 2011-06-08 15:52	--------	d-----w-	c:\windows\SysWow64\Macromed
2011-06-08 15:50 . 2011-06-08 15:50	--------	d-----w-	c:\program files (x86)\OpenOffice.org 3
2011-06-08 15:49 . 2011-05-04 02:52	472808	----a-w-	c:\windows\SysWow64\deployJava1.dll
2011-06-08 15:49 . 2011-06-08 16:41	--------	d-----w-	c:\program files (x86)\Java
2011-06-08 15:47 . 2011-06-09 16:36	--------	d-sh--w-	c:\windows\Installer
2011-06-08 15:46 . 2011-06-08 15:46	--------	d-----w-	c:\program files (x86)\Opera
2011-06-08 15:46 . 2011-06-08 21:53	--------	d-----w-	c:\program files (x86)\Mozilla Thunderbird
2011-06-08 15:46 . 2011-06-08 15:46	230352	----a-w-	c:\windows\system32\drivers\truecrypt.sys
2011-06-08 15:46 . 2011-06-08 15:46	--------	d-----w-	c:\program files\TrueCrypt
2011-06-08 15:45 . 2011-06-08 15:45	--------	d-----w-	c:\program files (x86)\VideoLAN
2011-06-08 15:43 . 2011-06-08 15:43	--------	d-----w-	c:\program files (x86)\QuickPar
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-05-04 23:28 . 2011-05-04 23:28	59904	----a-w-	c:\windows\SysWow64\OVDecode.dll
2011-05-04 23:27 . 2011-05-04 23:27	51712	----a-w-	c:\windows\SysWow64\OpenCL.dll
2011-05-04 23:27 . 2011-05-04 23:27	12385280	----a-w-	c:\windows\SysWow64\amdocl.dll
2011-04-20 02:44 . 2011-04-20 02:44	9319936	----a-w-	c:\windows\system32\drivers\atikmdag.sys
2011-04-20 02:30 . 2011-04-20 02:30	22900736	----a-w-	c:\windows\system32\atio6axx.dll
2011-04-20 02:09 . 2011-04-20 02:09	151552	----a-w-	c:\windows\system32\atiapfxx.exe
2011-04-20 02:09 . 2011-04-20 02:09	676864	----a-w-	c:\windows\SysWow64\aticfx32.dll
2011-04-20 02:07 . 2011-04-20 02:07	795648	----a-w-	c:\windows\system32\aticfx64.dll
2011-04-20 02:07 . 2011-04-20 02:07	17693184	----a-w-	c:\windows\SysWow64\atioglxx.dll
2011-04-20 02:05 . 2011-04-20 02:05	462848	----a-w-	c:\windows\system32\ATIDEMGX.dll
2011-04-20 02:04 . 2011-04-20 02:04	480256	----a-w-	c:\windows\system32\atieclxx.exe
2011-04-20 02:04 . 2011-04-20 02:04	203776	----a-w-	c:\windows\system32\atiesrxx.exe
2011-04-20 02:03 . 2011-04-20 02:03	120320	----a-w-	c:\windows\system32\atitmm64.dll
2011-04-20 02:02 . 2011-04-20 02:02	423424	----a-w-	c:\windows\system32\atipdl64.dll
2011-04-20 02:02 . 2011-04-20 02:02	356352	----a-w-	c:\windows\SysWow64\atipdlxx.dll
2011-04-20 02:02 . 2011-04-20 02:02	278528	----a-w-	c:\windows\SysWow64\Oemdspif.dll
2011-04-20 02:02 . 2011-04-20 02:02	16384	----a-w-	c:\windows\system32\atimuixx.dll
2011-04-20 02:02 . 2011-04-20 02:02	59392	----a-w-	c:\windows\system32\atiedu64.dll
2011-04-20 02:02 . 2011-04-20 02:02	43520	----a-w-	c:\windows\SysWow64\ati2edxx.dll
2011-04-20 01:59 . 2011-04-20 01:59	4161536	----a-w-	c:\windows\SysWow64\atidxx32.dll
2011-04-20 01:49 . 2011-04-20 01:49	4951552	----a-w-	c:\windows\system32\atidxx64.dll
2011-04-20 01:46 . 2011-04-20 01:46	51200	----a-w-	c:\windows\system32\aticalrt64.dll
2011-04-20 01:46 . 2011-04-20 01:46	46080	----a-w-	c:\windows\SysWow64\aticalrt.dll
2011-04-20 01:46 . 2011-04-20 01:46	44544	----a-w-	c:\windows\system32\aticalcl64.dll
2011-04-20 01:46 . 2011-04-20 01:46	44032	----a-w-	c:\windows\SysWow64\aticalcl.dll
2011-04-20 01:45 . 2011-04-20 01:45	7768064	----a-w-	c:\windows\system32\aticaldd64.dll
2011-04-20 01:42 . 2011-04-20 01:42	6389760	----a-w-	c:\windows\SysWow64\aticaldd.dll
2011-04-20 01:40 . 2011-04-20 01:40	1222656	----a-w-	c:\windows\system32\atiumd6v.dll
2011-04-20 01:40 . 2011-04-20 01:40	1923584	----a-w-	c:\windows\SysWow64\atiumdmv.dll
2011-04-20 01:40 . 2011-04-20 01:40	3868672	----a-w-	c:\windows\system32\atiumd6a.dll
2011-04-20 01:38 . 2011-04-20 01:38	4286464	----a-w-	c:\windows\SysWow64\atiumdag.dll
2011-04-20 01:31 . 2011-04-20 01:31	5440000	----a-w-	c:\windows\system32\atiumd64.dll
2011-04-20 01:30 . 2011-04-20 01:30	4056576	----a-w-	c:\windows\SysWow64\atiumdva.dll
2011-04-20 01:27 . 2011-04-20 01:27	58880	----a-w-	c:\windows\system32\coinst.dll
2011-04-20 01:23 . 2011-04-20 01:23	366080	----a-w-	c:\windows\system32\atiadlxx.dll
2011-04-20 01:23 . 2011-04-20 01:23	262144	----a-w-	c:\windows\SysWow64\atiadlxy.dll
2011-04-20 01:22 . 2011-04-20 01:22	14848	----a-w-	c:\windows\system32\atig6pxx.dll
2011-04-20 01:22 . 2011-04-20 01:22	12800	----a-w-	c:\windows\SysWow64\atiglpxx.dll
2011-04-20 01:22 . 2011-04-20 01:22	12800	----a-w-	c:\windows\system32\atiglpxx.dll
2011-04-20 01:22 . 2011-04-20 01:22	39936	----a-w-	c:\windows\system32\atig6txx.dll
2011-04-20 01:22 . 2011-04-20 01:22	32768	----a-w-	c:\windows\SysWow64\atigktxx.dll
2011-04-20 01:22 . 2011-04-20 01:22	306176	----a-w-	c:\windows\system32\drivers\atikmpag.sys
2011-04-20 01:21 . 2011-04-20 01:21	40960	----a-w-	c:\windows\system32\atiuxp64.dll
2011-04-20 01:21 . 2011-04-20 01:21	31232	----a-w-	c:\windows\SysWow64\atiuxpag.dll
2011-04-20 01:21 . 2011-04-20 01:21	38912	----a-w-	c:\windows\system32\atiu9p64.dll
2011-04-20 01:21 . 2011-04-20 01:21	29184	----a-w-	c:\windows\SysWow64\atiu9pag.dll
2011-04-20 01:20 . 2011-04-20 01:20	53248	----a-w-	c:\windows\system32\drivers\ati2erec.dll
2011-04-20 01:13 . 2011-04-20 01:13	53760	----a-w-	c:\windows\system32\atimpc64.dll
2011-04-20 01:13 . 2011-04-20 01:13	53760	----a-w-	c:\windows\system32\amdpcom64.dll
2011-04-20 01:13 . 2011-04-20 01:13	52736	----a-w-	c:\windows\SysWow64\atimpc32.dll
2011-04-20 01:13 . 2011-04-20 01:13	52736	----a-w-	c:\windows\SysWow64\amdpcom32.dll
2011-04-19 20:10 . 2011-04-19 20:10	61952	----a-w-	c:\windows\system32\OVDecode64.dll
2011-04-19 20:10 . 2011-04-19 20:10	53760	----a-w-	c:\windows\system32\OpenCL.dll
2011-04-19 20:10 . 2011-04-19 20:10	16116224	----a-w-	c:\windows\system32\amdocl64.dll
2011-03-30 18:46 . 2011-03-30 18:46	114704	----a-w-	c:\windows\system32\drivers\AtihdW76.sys
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2011-01-20 1305408]
"AdobeBridge"="c:\program files (x86)\Adobe\Adobe Bridge CS5\Bridge.exe" [2010-03-09 11989960]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-10 932288]
"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-11-17 113288]
"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2011-03-21 1230704]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-04-19 336384]
"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992]
"CTxfiHlp"="CTXFIHLP.EXE" [2010-05-05 25600]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2011-03-28 281768]
"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-05-29 449584]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-06-08 136176]
R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-05-29 366640]
R3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2011-06-08 79360]
R3 CT20XUT;CT20XUT;c:\windows\system32\drivers\CT20XUT.SYS [x]
R3 CTEXFIFX;CTEXFIFX;c:\windows\system32\drivers\CTEXFIFX.SYS [x]
R3 CTHWIUT;CTHWIUT;c:\windows\system32\drivers\CTHWIUT.SYS [x]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2011-04-19 365568]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2011-03-28 136360]
S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys [x]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [x]
S3 CT20XUT.SYS;CT20XUT.SYS;c:\windows\System32\drivers\CT20XUT.SYS [x]
S3 CTEXFIFX.SYS;CTEXFIFX.SYS;c:\windows\System32\drivers\CTEXFIFX.SYS [x]
S3 CTHWIUT.SYS;CTHWIUT.SYS;c:\windows\System32\drivers\CTHWIUT.SYS [x]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [x]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2011-06-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-06-08 16:13]
.
2011-06-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-06-08 16:13]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Eraser"="c:\progra~1\Eraser\Eraser.exe" [2010-11-04 980368]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Free YouTube to MP3 Converter - c:\users\Greg\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: {{B4B52284-A248-4c51-9F7C-F0A0C67FCC9D} - c:\users\Greg\Desktop\PartyCasino.lnk
TCP: DhcpNameServer = 80.69.100.198 80.69.100.206
FF - ProfilePath - c:\users\Greg\AppData\Roaming\Mozilla\Firefox\Profiles\sc8m8ss8.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10s_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10s_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10s.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10s.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10s.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10s.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Creative\Shared Files\CTAudSvc.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2011-06-15  23:39:16 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2011-06-15 21:39
.
Vor Suchlauf: 9 Verzeichnis(se), 454.474.932.224 Bytes frei
Nach Suchlauf: 14 Verzeichnis(se), 454.572.920.832 Bytes frei
.
- - End Of File - - 592C1368376D75283E42478329C2EFE8
         
--- --- ---

 

Themen zu Boo/TDss.A nach Entfernen(?) von Alureon.A gefunden
anderen, antivir, bluescreen, boo/tdss.a, bootsektor, bösartige, einträge, entfernen, entfernt, ergebnisse, erneut, exe, laufen, malwarebytes, neustart, probleme, reboot, scan, scanne, scannen, schließe, thema, threads, usern, verschwunden




Ähnliche Themen: Boo/TDss.A nach Entfernen(?) von Alureon.A gefunden


  1. Nach Avira Update: Win 7- BOO/TDss.O wurde im Masterbootsektor gefunden
    Log-Analyse und Auswertung - 22.01.2014 (23)
  2. BOO /TDss.O im Masterbootsektor gefunden nach Installation von Windows 7 auf einer zweiten internen Festplatte
    Plagegeister aller Art und deren Bekämpfung - 07.01.2014 (33)
  3. Trojaner TR/TDss.abx und TR/Alureon, Dateien weg
    Log-Analyse und Auswertung - 05.10.2012 (43)
  4. BOO/TDss.M im Masterbootsektor gefunden.(Antivir) Auch nach Systemrücksetzung mit Samsung Recovery
    Plagegeister aller Art und deren Bekämpfung - 03.11.2011 (36)
  5. AW: TDSSKiller: Google Umleitungen, TDSS, TDL3, Alureon rootkit entfernen
    Mülltonne - 05.10.2011 (0)
  6. BOO/TDss.M im Masterbootsektor gefunden - wie entfernen?
    Log-Analyse und Auswertung - 20.05.2011 (26)
  7. AntiVir hat TR/ALUREON gefunden.
    Plagegeister aller Art und deren Bekämpfung - 07.03.2011 (5)
  8. Unerwünschtes Programm 'BDS/TDSS.6246458.1' [backdoor] gefunden! + Trojaner "TR/Alureon.EC.63"
    Plagegeister aller Art und deren Bekämpfung - 30.01.2011 (1)
  9. BOO/Alureon.A Bootsektor Virus gefunden von Antivir
    Plagegeister aller Art und deren Bekämpfung - 18.10.2010 (11)
  10. Virus Alureon.H gefunden! Wie werde ich den wieder los?
    Plagegeister aller Art und deren Bekämpfung - 20.08.2010 (22)
  11. 'TR/Alureon.B' und 'HTML/Crypted.Gen' gefunden
    Plagegeister aller Art und deren Bekämpfung - 09.08.2010 (27)
  12. Trojaner TR/Alureon.B gefunden :-((
    Plagegeister aller Art und deren Bekämpfung - 09.08.2010 (3)
  13. Trojaner TR/Alureon.B gefunden
    Log-Analyse und Auswertung - 09.08.2010 (6)
  14. TDSSKiller: Google Umleitungen, TDSS, TDL3, Alureon rootkit entfernen
    Anleitungen, FAQs & Links - 19.01.2010 (2)
  15. Packed.Win32.TDSS.y Trojaner Win32/Alureon.BF
    Plagegeister aller Art und deren Bekämpfung - 08.10.2009 (3)
  16. Trojan:Win32/Alureon!inf gefunden von "MS Windows-Tool zum Entfernen bösartiger Sw"
    Plagegeister aller Art und deren Bekämpfung - 05.05.2009 (18)
  17. Backdoor.TDSS.asz und TDSS.atb gefunden
    Mülltonne - 28.11.2008 (0)

Zum Thema Boo/TDss.A nach Entfernen(?) von Alureon.A gefunden - Die Datei sollte einen HP-Treiber-Setup ausführen (ich hatte keine Lust den 100kbit/s Download von der Originalsite abzuwarten... schlechte entscheidung) Hier das logfile von combofix: Combofix Logfile: Code: Alles auswählen Aufklappen - Boo/TDss.A nach Entfernen(?) von Alureon.A gefunden...
Archiv
Du betrachtest: Boo/TDss.A nach Entfernen(?) von Alureon.A gefunden auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.