| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Habe auch den BKA TrojanerWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
28.07.2011, 21:20
| #16 |
| /// Winkelfunktion /// TB-Süch-Tiger™   |  Habe auch den BKA Trojaner Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten. GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen. Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst. Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM! Downloade dir bitte  aswMBR.exe und speichere die Datei auf deinem Desktop.
Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
29.07.2011, 08:49
| #17 |
 | Habe auch den BKA Trojaner Moin Cosinus,
__________________hab jetzt GMER durchlaufen lassen. Osam lass ich jetzt durchlaufen. Hier das log von gmer: GMER Logfile: Code:
ATTFilter GMER 1.0.15.15641 - GMER - Rootkit Detector and Remover
Rootkit scan 2011-07-29 09:45:20
Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 TOSHIBA_ rev.DL25
Running: 2s9pygeo.exe; Driver: C:\Users\******~1\AppData\Local\Temp\kwldiaod.sys
---- System - GMER 1.0.15 ----
SSDT 8CE0850C ZwCreateThread
SSDT 8CE084F8 ZwOpenProcess
SSDT 8CE084FD ZwOpenThread
SSDT 8CE08507 ZwTerminateProcess
---- Kernel code sections - GMER 1.0.15 ----
.text ntkrnlpa.exe!KeSetEvent + 221 824BA9A4 4 Bytes [0C, 85, E0, 8C] {OR AL, 0x85; LOOPNZ 0xffffffffffffff90}
.text ntkrnlpa.exe!KeSetEvent + 3F1 824BAB74 4 Bytes [F8, 84, E0, 8C]
.text ntkrnlpa.exe!KeSetEvent + 40D 824BAB90 4 Bytes [FD, 84, E0, 8C]
.text ntkrnlpa.exe!KeSetEvent + 621 824BADA4 4 Bytes [07, 85, E0, 8C]
.text C:\Windows\system32\drivers\hardlock.sys section is writeable [0x81E68400, 0x82482, 0xE8000020]
.protectÿÿÿÿhardlockentry point in ".protectÿÿÿÿhardlockentry point in ".protectÿÿÿÿhardlockentry point in ".p" section [0x81F08420] C:\Windows\system32\drivers\hardlock.sys entry point in ".protectÿÿÿÿhardlockentry point in ".protectÿÿÿÿhardlockentry point in ".p" section [0x81F08420]
.protectÿÿÿÿhardlockunknown last code section [0x81F08200, 0x5105, 0xE0000020] C:\Windows\system32\drivers\hardlock.sys unknown last code section [0x81F08200, 0x5105, 0xE0000020]
---- User IAT/EAT - GMER 1.0.15 ----
IAT C:\Windows\Explorer.EXE[2180] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown] [740F7817] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2180] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage] [7414A86D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2180] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI] [740FBB22] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2180] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode] [740EF695] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2180] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup] [740F75E9] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2180] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC] [740EE7CA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2180] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStreamICM] [74128395] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2180] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStream] [740FDA60] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2180] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight] [740EFFFA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2180] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth] [740EFF61] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2180] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage] [740E71CF] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2180] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFileICM] [7417CAE2] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2180] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFile] [7411C8D8] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2180] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics] [740ED968] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2180] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree] [740E6853] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2180] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc] [740E687E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2180] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode] [740F2AD1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
---- Devices - GMER 1.0.15 ----
AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Dateisystem-Filter-Manager/Microsoft Corporation)
AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Dateisystem-Filter-Manager/Microsoft Corporation)
---- EOF - GMER 1.0.15 ----
|
|
29.07.2011, 09:00
| #18 |
| | Habe auch den BKA Trojaner So hier noch das log von osam:
__________________OSAM Logfile: Code:
ATTFilter Report of OSAM: Autorun Manager v5.0.11926.0 Online Solutions. Complex Protection for Information Systems Saved at 09:58:27 on 29.07.2011 OS: Windows Vista Home Premium Edition Service Pack 2 (Build 6002), 32-bit Default Browser: Mozilla Corporation Firefox 3.5.11 Scanner Settings [x] Rootkits detection (hidden registry) [x] Rootkits detection (hidden files) [x] Retrieve files information [x] Check Microsoft signatures Filters [ ] Trusted entries [ ] Empty entries [x] Hidden registry entries (rootkit activity) [x] Exclusively opened files [x] Not found files [x] Files without detailed information [x] Existing files [ ] Non-startable services [ ] Non-startable drivers [x] Active entries [x] Disabled entries [Common] -----( %SystemRoot%\Tasks )----- "1-Klick-Wartung.job" - "TuneUp Software GmbH" - C:\Program Files\TuneUp Utilities 2009\OneClickStarter.exe [Control Panel Objects] -----( %SystemRoot%\system32 )----- "ddbaccpl.cpl" - "DataDesign AG" - C:\Windows\system32\ddbaccpl.cpl "ddbacctm.cpl" - "DataDesign AG" - C:\Windows\system32\ddbacctm.cpl "DivXControlPanelApplet.cpl" - "DivX, Inc." - C:\Windows\system32\DivXControlPanelApplet.cpl [Drivers] -----( HKLM\SYSTEM\CurrentControlSet\Services )----- "adfs" (adfs) - ? - C:\Windows\system32\drivers\adfs.sys (File not found) "avgio" (avgio) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avgio.sys "avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys "avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys "catchme" (catchme) - ? - C:\Users\KAMMER~1\AppData\Local\Temp\catchme.sys (File not found) "cpudrv" (cpudrv) - ? - C:\Program Files\SystemRequirementsLab\cpudrv.sys (File found, but it contains no detailed information) "HPFXBULK" (HPFXBULK) - "Hewlett Packard" - C:\Windows\System32\drivers\hpfxbulk.sys "HPFXFAX" (HPFXFAX) - "Hewlett Packard" - C:\Windows\System32\drivers\hpfxfax.sys "Huawei DataCard USB Fake" (hwusbfake) - ? - C:\Windows\System32\DRIVERS\ewusbfake.sys (File not found) "kwldiaod" (kwldiaod) - ? - C:\Users\KAMMER~1\AppData\Local\Temp\kwldiaod.sys (Hidden registry entry, rootkit activity | File not found) "MBAMProtector" (MBAMProtector) - "Malwarebytes Corporation" - C:\Windows\system32\drivers\mbam.sys "PRODIGY" (PRODIGY) - "B-phreaks" - C:\Windows\System32\Drivers\PRODIGY.SYS "ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys "Upper Class Filter Driver" (NTIDrvr) - "NewTech Infosystems, Inc." - C:\Windows\System32\DRIVERS\NTIDrvr.sys "ZTE Diagnostic Port" (ZTEusbser6k) - ? - C:\Windows\System32\DRIVERS\ZTEusbser6k.sys (File not found) "ZTE Mass Storage Filter Driver" (massfilter) - ? - C:\Windows\System32\drivers\massfilter.sys (File not found) "ZTE NMEA Port" (ZTEusbnmea) - ? - C:\Windows\System32\DRIVERS\ZTEusbnmea.sys (File not found) "ZTE Proprietary USB Driver" (ZTEusbmdm6k) - ? - C:\Windows\System32\DRIVERS\ZTEusbmdm6k.sys (File not found) [Explorer] -----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )----- {F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll {7D4D6379-F301-4311-BEBA-E26EB0561882} "{7D4D6379-F301-4311-BEBA-E26EB0561882}" - ? - (File not found | COM-object registry key not found) -----( HKLM\Software\Classes\Protocols\Handler )----- {3D9F03FA-7A94-11D3-BE81-0050048385D1} "Data Page Pluggable Protocol mso-offdap Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL {828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL {828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )----- {42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office10\msohev.dll {00020d75-0000-0000-c000-000000000046} "Microsoft Outlook" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office10\MLSHEXT.DLL {B327765E-D724-4347-8B16-78AE18552FC3} "NeroDigitalIconHandler" - ? - (File not found | COM-object registry key not found) {7F1CF152-04F8-453A-B34C-E609530A9DC8} "NeroDigitalPropSheetHandler" - ? - (File not found | COM-object registry key not found) {0006F045-0000-0000-C000-000000000046} "Outlook-Dateisymbolerweiterung" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office10\OLKFSTUB.DLL {45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll {4838CD50-7E5D-4811-9B17-C47A85539F28} "TuneUp Disk Space Explorer Shell Extension" - "TuneUp Software" - C:\Program Files\TuneUp Utilities 2009\DseShExt-x86.dll {4858E7D9-8E12-45a3-B6A3-1CD128C9D403} "TuneUp Shredder Shell Extension" - "TuneUp Software" - C:\Program Files\TuneUp Utilities 2009\SDShelEx-win32.dll {44440D00-FF19-4AFC-B765-9A0970567D97} "TuneUp Theme Extension" - "TuneUp Software" - C:\Windows\System32\uxtuneup.dll {BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL {B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - ? - C:\Program Files\WinRAR\rarext.dll (File found, but it contains no detailed information) [Internet Explorer] -----( HKCU\SOFTWARE\Microsoft\Internet Explorer\Extensions )----- "PokerTime" - ? - C:\MicroGaming\Poker\PokerTimeMPP\MPPoker.exe (File not found) "Quatro Casino" - ? - C:\Microgaming\Casino\QuatroCasino\casinogame.exe (File not found) -----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )----- <binary data> "ITBar7Layout" - ? - (File not found | COM-object registry key not found) -----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )----- {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} "{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}" - ? - (File not found | COM-object registry key not found) / hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )----- {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "Adobe PDF Reader" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} "SSVHelper Class" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll {9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [Logon] -----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )----- "desktop.ini" - ? - C:\Users\Kammerzofe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini -----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )----- "desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini -----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )----- "StartupPrograms" - ? - rdpclip (File not found) -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )----- "avgnt" - "Avira GmbH" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min "IAAnotif" - "Intel Corporation" - "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" "Malwarebytes' Anti-Malware" - "Malwarebytes Corporation" - "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray [Print Monitors] -----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )----- "HP Fax Port" - "Hewlett-Packard Company" - C:\Windows\system32\hppfaxprintermon5.dll "HP Standard TCP/IP Port" - "Hewlett Packard" - C:\Windows\system32\HpTcpMon.dll [Services] -----( HKLM\SYSTEM\CurrentControlSet\Services )----- "@%SystemRoot%\System32\TuneUpDefragService.exe,-1" (TuneUp.Defrag) - "TuneUp Software" - C:\Windows\System32\TuneUpDefragService.exe "@C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe "ALaunch Service" (ALaunchService) - ? - C:\Acer\ALaunch\ALaunchSvc.exe "Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe "Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\sched.exe "hpqcxs08" (hpqcxs08) - "Hewlett-Packard Co." - C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll "Intel(R) Matrix Storage Event Monitor" (IAANTMON) - "Intel Corporation" - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe "MBAMService" (MBAMService) - "Malwarebytes Corporation" - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe "Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe "Net Driver HPZ12" (Net Driver HPZ12) - "Hewlett-Packard" - C:\Windows\system32\HPZinw12.dll "Pml Driver HPZ12" (Pml Driver HPZ12) - "Hewlett-Packard" - C:\Windows\system32\HPZipm12.dll "Process Monitor" (LVPrcSrv) - "Logitech Inc." - C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcSrv.exe "TuneUp Designerweiterung" (UxTuneUp) - "TuneUp Software" - C:\Windows\System32\uxtuneup.dll "TuneUp Program Statistics Service" (TuneUp.ProgramStatisticsSvc) - "TuneUp Software" - C:\Windows\System32\TUProgSt.exe ===[ Logfile end ]=========================================[ Logfile end ]=== If You have questions or want to get some help, You can visit Online Solutions :: Index |
|
29.07.2011, 09:05
| #19 |
| | Habe auch den BKA Trojaner lass grad noch aswMBR durchlaufen. Log folgt sobald es durch ist muss mich nochmal bedanken,weil du mir so gut hilfst.Dankeeee Lg Antonia |
|
29.07.2011, 09:23
| #20 |
| | Habe auch den BKA Trojaner so aswMBR.exe ist auch durchgelaufen. hier ist der log: aswMBR version 0.9.8.977 Copyright(c) 2011 AVAST Software Run date: 2011-07-29 10:01:49 ----------------------------- 10:01:49.573 OS Version: Windows 6.0.6002 Service Pack 2 10:01:49.573 Number of processors: 1 586 0xF06 10:01:49.574 ComputerName: **********-PC UserName: ********** 10:02:00.839 Initialize success 10:03:29.300 AVAST engine defs: 11072801 10:04:22.711 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 10:04:22.715 Disk 0 Vendor: TOSHIBA_ DL25 Size: 76319MB BusType: 3 10:04:22.851 Disk 0 MBR read successfully 10:04:22.854 Disk 0 MBR scan 10:04:22.861 Disk 0 unknown MBR code 10:04:23.048 Disk 0 scanning sectors +156299264 10:04:23.399 Disk 0 scanning C:\Windows\system32\drivers 10:05:31.869 Service scanning 10:05:33.738 Modules scanning 10:06:57.038 Disk 0 trace - called modules: 10:06:57.143 ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll iaStor.sys HSX_CNXT.sys i8042prt.sys mouclass.sys 10:06:57.143 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x84f7c778] 10:06:57.143 3 CLASSPNP.SYS[875ab8b3] -> nt!IofCallDriver -> [0x844e3700] 10:06:57.143 5 acpi.sys[82a9d6bc] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-0[0x844e6030] 10:06:57.599 AVAST engine scan C:\Windows 10:07:33.063 AVAST engine scan C:\Windows\system32 10:12:51.573 AVAST engine scan C:\Windows\system32\drivers 10:13:10.309 AVAST engine scan C:\Users\********** 10:16:30.870 AVAST engine scan C:\ProgramData 10:17:29.663 Scan finished successfully 10:19:15.760 Disk 0 MBR has been saved successfully to "D:\Dokumente ********\***\Trojaner\MBR.dat" 10:19:15.766 The log file has been saved successfully to "D:\Dokumente ********\***\Trojaner\aswMBR.txt" |
|
29.07.2011, 09:43
| #21 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Habe auch den BKA TrojanerZitat:
Hast Du noch andere Betriebssysteme außer Vista installiert? Wenn nicht: Schau mal hier => Vista Notfall/Recovery-CD 32-Bit - Dr. Windows Lad das iso runter, brenn es zB mit ImgBurn per Imagebrennfunktion auf eine CD und starte damit den Rechner (von dieser CD booten) Falls Du eine normale Vista-Installations-DVD hast, brauchst Du das o.g. Image nicht sondern kannst einfach von der Vista-DVD booten. Klick auf Computerreparaturoptionen, weiter, Eingabeaufforderung - die Konsole öffnet sich. Da bitte bootrec.exe /fixboot eintippen (mit enter bestätigen), dann bootrec.exe /fixmbr eintippen (mit enter bestätigen) - Rechner neustarten, CD vorher rausnehmen. Erstell danach wieder neue Logs mit MBRCheck und wenn es geht GMER.
__________________ --> Habe auch den BKA Trojaner |
|
29.07.2011, 09:47
| #22 |
| | Habe auch den BKA Trojaner Ich werde es heute abend machen,muss jetzt leider zur Arbeit.Dank dir nochmal  |
|
31.07.2011, 08:51
| #23 |
| | Habe auch den BKA Trojaner Hallo, ich habe, so wie du mir beschrieben hast, das MBR manuell gefixt. Als ich bootrec.exe /fixboot eingegeben habe,erschien eine meldung, das nicht alle Treiber geladen wären. Bei bootrec.exe /fixmbr war der Vorgang erfolgreich. Hab jetzt schonmal mit MBR gescannt. Hier der Log: aswMBR version 0.9.8.977 Copyright(c) 2011 AVAST Software Run date: 2011-07-31 09:27:11 ----------------------------- 09:27:11.315 OS Version: Windows 6.0.6002 Service Pack 2 09:27:11.315 Number of processors: 1 586 0xF06 09:27:11.330 ComputerName: ***-PC UserName: *** 09:27:12.407 Initialize success 09:27:27.039 AVAST engine defs: 11073001 09:27:40.783 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 09:27:40.799 Disk 0 Vendor: TOSHIBA_ DL25 Size: 76319MB BusType: 3 09:27:40.845 Disk 0 MBR read successfully 09:27:40.845 Disk 0 MBR scan 09:27:41.594 Disk 0 Windows VISTA default MBR code 09:27:41.625 Disk 0 scanning sectors +156299264 09:27:43.887 Disk 0 scanning C:\Windows\system32\drivers 09:28:24.638 Service scanning 09:28:26.728 Modules scanning 09:28:43.904 Disk 0 trace - called modules: 09:28:43.920 ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll iaStor.sys 09:28:43.920 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x84f7c030] 09:28:43.920 3 CLASSPNP.SYS[875a68b3] -> nt!IofCallDriver -> [0x844ebf08] 09:28:43.920 5 acpi.sys[82a9e6bc] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-0[0x844ea030] 09:28:44.497 AVAST engine scan C:\Windows 09:28:53.404 AVAST engine scan C:\Windows\system32 09:34:26.774 File: C:\Windows\system32\jloadv54.dll **INFECTED** Win32:Sinowal-IP [Trj] 09:34:26.808 File: C:\Windows\system32\jloadv54.dll **HIDDEN** 09:34:27.667 AVAST engine scan C:\Windows\system32\drivers 09:34:50.520 AVAST engine scan C:\Users\*** 09:37:44.880 File: C:\Users\***\AppData\Local\temp\2792.tmp **INFECTED** Win32:Sinowal-IP [Trj] 09:37:45.028 File: C:\Users\***\AppData\Local\temp\408E.tmp **INFECTED** Win32:Sinowal-IP [Trj] 09:37:46.000 File: C:\Users\***\AppData\Local\temp\jar_cache13043.tmp **INFECTED** Win32:Sinowal-IP [Trj] 09:39:26.205 File: C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scanzdiskx58.dll **INFECTED** Win32:Sinowal-IP [Trj] 09:39:26.205 File: C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scanzdiskx58.dll **HIDDEN** 09:39:26.353 File: C:\Users\***\jloadv54.dll **INFECTED** Win32:Sinowal-IP [Trj] 09:39:26.353 File: C:\Users\***\jloadv54.dll **HIDDEN** 09:39:28.755 AVAST engine scan C:\ProgramData 09:41:11.179 Scan finished successfully 09:41:31.415 Disk 0 MBR has been saved successfully to "D:\Trojaner\MBR.dat" 09:41:31.429 The log file has been saved successfully to "D:\Trojaner\aswMBR.txt" |
|
31.07.2011, 10:41
| #24 |
| | Habe auch den BKA Trojaner und hier ist noch der das GMER log: GMER Logfile: Code:
ATTFilter GMER 1.0.15.15641 - GMER - Rootkit Detector and Remover
Rootkit scan 2011-07-31 11:30:32
Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 TOSHIBA_ rev.DL25
Running: 7vsxejmh.exe; Driver: C:\Users\***~1\AppData\Local\Temp\kwldiaod.sys
---- System - GMER 1.0.15 ----
SSDT 8D7A0514 ZwCreateThread
SSDT 8D7A0500 ZwOpenProcess
SSDT 8D7A0505 ZwOpenThread
SSDT 8D7A050F ZwTerminateProcess
---- Kernel code sections - GMER 1.0.15 ----
.text ntkrnlpa.exe!KeSetEvent + 221 824F09A4 4 Bytes [14, 05, 7A, 8D] {ADC AL, 0x5; JP 0xffffffffffffff91}
.text ntkrnlpa.exe!KeSetEvent + 3F1 824F0B74 4 Bytes [00, 05, 7A, 8D]
.text ntkrnlpa.exe!KeSetEvent + 40D 824F0B90 4 Bytes [05, 05, 7A, 8D]
.text ntkrnlpa.exe!KeSetEvent + 621 824F0DA4 4 Bytes [0F, 05, 7A, 8D] {SYSCALL ; JP 0xffffffffffffff91}
.text C:\Windows\system32\drivers\hardlock.sys section is writeable [0xAE607400, 0x82482, 0xE8000020]
.protectÿÿÿÿhardlockentry point in ".protectÿÿÿÿhardlockentry point in ".protectÿÿÿÿhardlockentry point in ".p" section [0xAE6A7420] C:\Windows\system32\drivers\hardlock.sys entry point in ".protectÿÿÿÿhardlockentry point in ".protectÿÿÿÿhardlockentry point in ".p" section [0xAE6A7420]
.protectÿÿÿÿhardlockunknown last code section [0xAE6A7200, 0x5105, 0xE0000020] C:\Windows\system32\drivers\hardlock.sys unknown last code section [0xAE6A7200, 0x5105, 0xE0000020]
? C:\Users\***~1\AppData\Local\Temp\aswMBR.sys Das System kann die angegebene Datei nicht finden. !
---- User code sections - GMER 1.0.15 ----
.text C:\Windows\Explorer.EXE[2288] kernel32.dll!TerminateProcess 775C18EF 6 Bytes PUSH 036B2680; RET C:\Windows\system32\jloadv54.dll
.text C:\Windows\Explorer.EXE[2288] kernel32.dll!FindNextFileA 775E3091 6 Bytes PUSH 036B24D0; RET C:\Windows\system32\jloadv54.dll
.text C:\Windows\Explorer.EXE[2288] kernel32.dll!FindNextFileW 775EB816 6 Bytes PUSH 036B2590; RET C:\Windows\system32\jloadv54.dll
.text C:\Windows\Explorer.EXE[2288] kernel32.dll!ExitProcess 776043F4 6 Bytes PUSH 036B2630; RET C:\Windows\system32\jloadv54.dll
.text C:\Windows\Explorer.EXE[2288] ADVAPI32.dll!RegDeleteValueA 76232F59 6 Bytes PUSH 036B2340; RET C:\Windows\system32\jloadv54.dll
.text C:\Windows\Explorer.EXE[2288] ADVAPI32.dll!RegDeleteValueW 76233FB6 6 Bytes PUSH 036B23D0; RET C:\Windows\system32\jloadv54.dll
.text C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe[2360] kernel32.dll!TerminateProcess 775C18EF 6 Bytes PUSH 01992680; RET C:\Windows\system32\jloadv54.dll
.text C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe[2360] kernel32.dll!FindNextFileA 775E3091 6 Bytes PUSH 019924D0; RET C:\Windows\system32\jloadv54.dll
.text C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe[2360] kernel32.dll!FindNextFileW 775EB816 6 Bytes PUSH 01992590; RET C:\Windows\system32\jloadv54.dll
.text C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe[2360] kernel32.dll!ExitProcess 776043F4 6 Bytes PUSH 01992630; RET C:\Windows\system32\jloadv54.dll
.text C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe[2360] ADVAPI32.dll!RegDeleteValueA 76232F59 6 Bytes PUSH 01992340; RET C:\Windows\system32\jloadv54.dll
.text C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe[2360] ADVAPI32.dll!RegDeleteValueW 76233FB6 6 Bytes PUSH 019923D0; RET C:\Windows\system32\jloadv54.dll
.text C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe[2360] WS2_32.dll!closesocket 75F0330C 5 Bytes JMP 02029E06
.text C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe[2360] WS2_32.dll!recv 75F0343A 5 Bytes JMP 02029A84
.text C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe[2360] WS2_32.dll!WSASend 75F04496 5 Bytes JMP 02029B57
.text C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe[2360] WS2_32.dll!send 75F0659B 5 Bytes JMP 020299A3
.text C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe[2360] WS2_32.dll!WSARecv 75F08400 5 Bytes JMP 02029CB8
.text C:\Windows\RtHDVCpl.exe[2368] kernel32.dll!TerminateProcess 775C18EF 6 Bytes PUSH 01D42680; RET C:\Windows\system32\jloadv54.dll
.text C:\Windows\RtHDVCpl.exe[2368] kernel32.dll!FindNextFileA 775E3091 6 Bytes PUSH 01D424D0; RET C:\Windows\system32\jloadv54.dll
.text C:\Windows\RtHDVCpl.exe[2368] kernel32.dll!FindNextFileW 775EB816 6 Bytes PUSH 01D42590; RET C:\Windows\system32\jloadv54.dll
.text C:\Windows\RtHDVCpl.exe[2368] kernel32.dll!ExitProcess 776043F4 6 Bytes PUSH 01D42630; RET C:\Windows\system32\jloadv54.dll
.text C:\Windows\RtHDVCpl.exe[2368] ADVAPI32.dll!RegDeleteValueA 76232F59 6 Bytes PUSH 01D42340; RET C:\Windows\system32\jloadv54.dll
.text C:\Windows\RtHDVCpl.exe[2368] ADVAPI32.dll!RegDeleteValueW 76233FB6 6 Bytes PUSH 01D423D0; RET C:\Windows\system32\jloadv54.dll
.text C:\Windows\RtHDVCpl.exe[2368] WS2_32.dll!closesocket 75F0330C 5 Bytes JMP 02939E06
.text C:\Windows\RtHDVCpl.exe[2368] WS2_32.dll!recv 75F0343A 5 Bytes JMP 02939A84
.text C:\Windows\RtHDVCpl.exe[2368] WS2_32.dll!WSASend 75F04496 5 Bytes JMP 02939B57
.text C:\Windows\RtHDVCpl.exe[2368] WS2_32.dll!send 75F0659B 5 Bytes JMP 029399A3
.text C:\Windows\RtHDVCpl.exe[2368] WS2_32.dll!WSARecv 75F08400 5 Bytes JMP 02939CB8
.text C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[2376] kernel32.dll!TerminateProcess 775C18EF 6 Bytes PUSH 02712680; RET C:\Windows\system32\jloadv54.dll
.text C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[2376] kernel32.dll!FindNextFileA 775E3091 6 Bytes PUSH 027124D0; RET C:\Windows\system32\jloadv54.dll
.text C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[2376] kernel32.dll!FindNextFileW 775EB816 6 Bytes PUSH 02712590; RET C:\Windows\system32\jloadv54.dll
.text C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[2376] kernel32.dll!ExitProcess 776043F4 6 Bytes PUSH 02712630; RET C:\Windows\system32\jloadv54.dll
.text C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[2376] ADVAPI32.dll!RegDeleteValueA 76232F59 6 Bytes PUSH 02712340; RET C:\Windows\system32\jloadv54.dll
.text C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[2376] ADVAPI32.dll!RegDeleteValueW 76233FB6 6 Bytes PUSH 027123D0; RET C:\Windows\system32\jloadv54.dll
.text C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[2376] WS2_32.dll!closesocket 75F0330C 5 Bytes JMP 02AE9E06
.text C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[2376] WS2_32.dll!recv 75F0343A 5 Bytes JMP 02AE9A84
.text C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[2376] WS2_32.dll!WSASend 75F04496 5 Bytes JMP 02AE9B57
.text C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[2376] WS2_32.dll!send 75F0659B 5 Bytes JMP 02AE99A3
.text C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[2376] WS2_32.dll!WSARecv 75F08400 5 Bytes JMP 02AE9CB8
.text C:\Windows\System32\rundll32.exe[2396] kernel32.dll!TerminateProcess 775C18EF 6 Bytes PUSH 00782680; RET C:\Windows\system32\jloadv54.dll
.text C:\Windows\System32\rundll32.exe[2396] kernel32.dll!FindNextFileA 775E3091 6 Bytes PUSH 007824D0; RET C:\Windows\system32\jloadv54.dll
.text C:\Windows\System32\rundll32.exe[2396] kernel32.dll!FindNextFileW 775EB816 6 Bytes PUSH 00782590; RET C:\Windows\system32\jloadv54.dll
.text C:\Windows\System32\rundll32.exe[2396] kernel32.dll!ExitProcess 776043F4 6 Bytes PUSH 00782630; RET C:\Windows\system32\jloadv54.dll
.text C:\Windows\System32\rundll32.exe[2396] ADVAPI32.dll!RegDeleteValueA 76232F59 6 Bytes PUSH 00782340; RET C:\Windows\system32\jloadv54.dll
.text C:\Windows\System32\rundll32.exe[2396] ADVAPI32.dll!RegDeleteValueW 76233FB6 6 Bytes PUSH 007823D0; RET C:\Windows\system32\jloadv54.dll
.text C:\Windows\System32\rundll32.exe[2396] WS2_32.dll!closesocket 75F0330C 5 Bytes JMP 00B79E06
.text C:\Windows\System32\rundll32.exe[2396] WS2_32.dll!recv 75F0343A 5 Bytes JMP 00B79A84
.text C:\Windows\System32\rundll32.exe[2396] WS2_32.dll!WSASend 75F04496 5 Bytes JMP 00B79B57
.text C:\Windows\System32\rundll32.exe[2396] WS2_32.dll!send 75F0659B 5 Bytes JMP 00B799A3
.text C:\Windows\System32\rundll32.exe[2396] WS2_32.dll!WSARecv 75F08400 5 Bytes JMP 00B79CB8
.text C:\Users\***\Downloads\7vsxejmh.exe[2552] kernel32.dll!TerminateProcess 775C18EF 6 Bytes PUSH 01942680; RET C:\Windows\system32\jloadv54.dll
.text C:\Users\***\Downloads\7vsxejmh.exe[2552] kernel32.dll!FindNextFileA 775E3091 6 Bytes PUSH 019424D0; RET C:\Windows\system32\jloadv54.dll
.text C:\Users\***\Downloads\7vsxejmh.exe[2552] kernel32.dll!FindNextFileW 775EB816 6 Bytes PUSH 01942590; RET C:\Windows\system32\jloadv54.dll
.text C:\Users\***\Downloads\7vsxejmh.exe[2552] kernel32.dll!ExitProcess 776043F4 6 Bytes PUSH 01942630; RET C:\Windows\system32\jloadv54.dll
.text C:\Users\***\Downloads\7vsxejmh.exe[2552] ADVAPI32.dll!RegDeleteValueA 76232F59 6 Bytes PUSH 01942340; RET C:\Windows\system32\jloadv54.dll
.text C:\Users\***\Downloads\7vsxejmh.exe[2552] ADVAPI32.dll!RegDeleteValueW 76233FB6 6 Bytes PUSH 019423D0; RET C:\Windows\system32\jloadv54.dll
.text C:\Users\***\Downloads\7vsxejmh.exe[2552] WS2_32.dll!closesocket 75F0330C 5 Bytes JMP 019C9E06
.text C:\Users\***\Downloads\7vsxejmh.exe[2552] WS2_32.dll!recv 75F0343A 5 Bytes JMP 019C9A84
.text C:\Users\***\Downloads\7vsxejmh.exe[2552] WS2_32.dll!WSASend 75F04496 5 Bytes JMP 019C9B57
.text C:\Users\***\Downloads\7vsxejmh.exe[2552] WS2_32.dll!send 75F0659B 5 Bytes JMP 019C99A3
.text C:\Users\***\Downloads\7vsxejmh.exe[2552] WS2_32.dll!WSARecv 75F08400 5 Bytes JMP 019C9CB8
.text C:\Windows\system32\taskeng.exe[2572] kernel32.dll!TerminateProcess 775C18EF 6 Bytes PUSH 02CE2680; RET C:\Windows\system32\jloadv54.dll
.text C:\Windows\system32\taskeng.exe[2572] kernel32.dll!FindNextFileA 775E3091 6 Bytes PUSH 02CE24D0; RET C:\Windows\system32\jloadv54.dll
.text C:\Windows\system32\taskeng.exe[2572] kernel32.dll!FindNextFileW 775EB816 6 Bytes PUSH 02CE2590; RET C:\Windows\system32\jloadv54.dll
.text C:\Windows\system32\taskeng.exe[2572] kernel32.dll!ExitProcess 776043F4 6 Bytes PUSH 02CE2630; RET C:\Windows\system32\jloadv54.dll
.text C:\Windows\system32\taskeng.exe[2572] ADVAPI32.dll!RegDeleteValueA 76232F59 6 Bytes PUSH 02CE2340; RET C:\Windows\system32\jloadv54.dll
.text C:\Windows\system32\taskeng.exe[2572] ADVAPI32.dll!RegDeleteValueW 76233FB6 6 Bytes PUSH 02CE23D0; RET C:\Windows\system32\jloadv54.dll
.text C:\Windows\system32\taskeng.exe[2572] WS2_32.dll!closesocket 75F0330C 5 Bytes JMP 02729E06
.text C:\Windows\system32\taskeng.exe[2572] WS2_32.dll!recv 75F0343A 5 Bytes JMP 02729A84
.text C:\Windows\system32\taskeng.exe[2572] WS2_32.dll!WSASend 75F04496 5 Bytes JMP 02729B57
.text C:\Windows\system32\taskeng.exe[2572] WS2_32.dll!send 75F0659B 5 Bytes JMP 027299A3
.text C:\Windows\system32\taskeng.exe[2572] WS2_32.dll!WSARecv 75F08400 5 Bytes JMP 02729CB8
.text C:\Program Files\Apoint2K\ApMsgFwd.exe[3256] kernel32.dll!TerminateProcess 775C18EF 6 Bytes PUSH 00382680; RET C:\Windows\system32\jloadv54.dll
.text C:\Program Files\Apoint2K\ApMsgFwd.exe[3256] kernel32.dll!FindNextFileA 775E3091 6 Bytes PUSH 003824D0; RET C:\Windows\system32\jloadv54.dll
.text C:\Program Files\Apoint2K\ApMsgFwd.exe[3256] kernel32.dll!FindNextFileW 775EB816 6 Bytes PUSH 00382590; RET C:\Windows\system32\jloadv54.dll
.text C:\Program Files\Apoint2K\ApMsgFwd.exe[3256] kernel32.dll!ExitProcess 776043F4 6 Bytes PUSH 00382630; RET C:\Windows\system32\jloadv54.dll
.text C:\Program Files\Apoint2K\ApMsgFwd.exe[3256] ADVAPI32.dll!RegDeleteValueA 76232F59 6 Bytes PUSH 00382340; RET C:\Windows\system32\jloadv54.dll
.text C:\Program Files\Apoint2K\ApMsgFwd.exe[3256] ADVAPI32.dll!RegDeleteValueW 76233FB6 6 Bytes PUSH 003823D0; RET C:\Windows\system32\jloadv54.dll
.text C:\Program Files\Apoint2K\ApMsgFwd.exe[3256] WS2_32.dll!closesocket 75F0330C 5 Bytes JMP 01C89E06
.text C:\Program Files\Apoint2K\ApMsgFwd.exe[3256] WS2_32.dll!recv 75F0343A 5 Bytes JMP 01C89A84
.text C:\Program Files\Apoint2K\ApMsgFwd.exe[3256] WS2_32.dll!WSASend 75F04496 5 Bytes JMP 01C89B57
.text C:\Program Files\Apoint2K\ApMsgFwd.exe[3256] WS2_32.dll!send 75F0659B 5 Bytes JMP 01C899A3
.text C:\Program Files\Apoint2K\ApMsgFwd.exe[3256] WS2_32.dll!WSARecv 75F08400 5 Bytes JMP 01C89CB8
---- User IAT/EAT - GMER 1.0.15 ----
IAT C:\Windows\Explorer.EXE[2288] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown] [74717817] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2288] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage] [7476A86D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2288] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI] [7471BB22] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2288] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode] [7470F695] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2288] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup] [747175E9] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2288] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC] [7470E7CA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2288] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStreamICM] [74748395] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2288] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStream] [7471DA60] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2288] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight] [7470FFFA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2288] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth] [7470FF61] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2288] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage] [747071CF] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2288] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFileICM] [7479CAE2] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2288] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFile] [7473C8D8] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2288] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics] [7470D968] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2288] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree] [74706853] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2288] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc] [7470687E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[2288] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode] [74712AD1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
---- Devices - GMER 1.0.15 ----
AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Dateisystem-Filter-Manager/Microsoft Corporation)
AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Dateisystem-Filter-Manager/Microsoft Corporation)
---- Files - GMER 1.0.15 ----
File C:\scandisk.lnk 479 bytes
File C:\scanzdiskx58.dll 516096 bytes executable
File C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scandisk.lnk 909 bytes
File C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scanzdiskx58.dll 516096 bytes executable
File C:\Users\***\jloadv54.dll 516096 bytes executable
File C:\Windows\System32\config\systemprofile\jloadv54.dll 516096 bytes executable
File C:\Windows\System32\jloadv54.dll 516096 bytes executable
---- EOF - GMER 1.0.15 ----
|
|
31.07.2011, 15:25
| #25 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Habe auch den BKA Trojaner Bitte mal den Avenger anwenden: 1.) Lade Dir von hier Avenger: Swandog46's Public Anti-Malware Tools (Download, linksseitig) 2.) Entpack das zip-Archiv, führe die Datei "avenger.exe" aus (unter Vista und Win7 per Rechtsklick => als Administrator ausführen). Die Haken unten wie abgebildet setzen:  3.) Kopiere Dir exakt die Zeilen aus dem folgenden Code-Feld: Die Sternchen wieder in den richtigen Namen VORHER zurückverwandeln!!! Code:
ATTFilter Files to delete:
C:\scandisk.lnk
C:\scanzdiskx58.dll
C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scandisk.lnk
C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scanzdiskx58.dll
C:\Users\***\jloadv54.dll
C:\Windows\System32\config\systemprofile\jloadv54.dll
C:\Windows\System32\jloadv54.dll
5.) Der Code-Text hier aus meinem Beitrag müsste nun unter "Input Script here" in "The Avenger" zu sehen sein. 6.) Falls dem so ist, klick unten rechts auf "Execute". Bestätige die nächste Abfrage mit "Ja", die Frage zu "Reboot now" (Neustart des Systems) ebenso. 7.) Nach dem Neustart erhältst Du ein LogFile von Avenger eingeblendet. Kopiere dessen Inhalt und poste ihn hier. 8.) Die Datei c:\avenger\backup.zip bei File-Upload.net - Ihr kostenloser File Hoster! hochladen und hier verlinken 9.) Nochmal GMER und aswmbr ausführen und Logs posten
__________________ Logfiles bitte immer in CODE-Tags posten |
|
| Themen zu Habe auch den BKA Trojaner |
| abgesicherten, autostart, downloader, einträge, eset, forum, found, gebrauchte, gelöscht, installer, jar_cache, konnte, laptop, malwarebytes, modus, online, onlinescan, problem, registry, remove, scan, scanner, service, sommerzeit, trojane, trojaner, version |
Linear-Darstellung
