Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung
2 Viren gefunden (Exploit) - EXP/CVE-2011-3544.E und EXP/CVE-2011-3544.J

2 Viren gefunden (Exploit) - EXP/CVE-2011-3544.E und EXP/CVE-2011-3544.J


Plagegeister aller Art und deren Bekämpfung: 2 Viren gefunden (Exploit) - EXP/CVE-2011-3544.E und EXP/CVE-2011-3544.J

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

 
Vorheriger Beitrag Vorheriger Beitrag   Nächster Beitrag Nächster Beitrag
Alt 12.02.2012, 21:53   #7
AfricanKing
 
2 Viren gefunden (Exploit) - EXP/CVE-2011-3544.E und EXP/CVE-2011-3544.J - Standard

2 Viren gefunden (Exploit) - EXP/CVE-2011-3544.E und EXP/CVE-2011-3544.J


Hi.

Habe die Anweisungen befolgt:
Nach dem Neustart hat sich das log geöffnet:
Code:
ATTFilter
All processes killed
========== OTL ==========
No active process named Program Files was found!
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Default_Page_URL| /E : value set successfully!
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Default_Page_URL| /E : value set successfully!
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Local Page| /E : value set successfully!
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
HKU\S-1-5-21-2039289562-3748197240-2934368891-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\Default_Page_URL| /E : value set successfully!
HKU\S-1-5-21-2039289562-3748197240-2934368891-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\Search Bar| /E : value set successfully!
HKU\S-1-5-21-2039289562-3748197240-2934368891-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\Search Page| /E : value set successfully!
HKU\S-1-5-21-2039289562-3748197240-2934368891-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
Prefs.js: "Facemoods Search" removed from browser.search.defaultenginename
Prefs.js: "Web Search..." removed from browser.search.selectedEngine
Prefs.js: true removed from browser.search.useDBForOrder
Prefs.js: "hxxp://www.google.de/" removed from browser.startup.homepage
Prefs.js: "hxxp://startsear.ch/?q=" removed from keyword.URL
C:\Users\African King\AppData\Roaming\mozilla\Firefox\Profiles\clkfbum0.default\extensions\toolbar@ask.com\searchplugins folder moved successfully.
C:\Users\African King\AppData\Roaming\mozilla\Firefox\Profiles\clkfbum0.default\extensions\toolbar@ask.com\logs folder moved successfully.
C:\Users\African King\AppData\Roaming\mozilla\Firefox\Profiles\clkfbum0.default\extensions\toolbar@ask.com\defaults\preferences folder moved successfully.
C:\Users\African King\AppData\Roaming\mozilla\Firefox\Profiles\clkfbum0.default\extensions\toolbar@ask.com\defaults folder moved successfully.
C:\Users\African King\AppData\Roaming\mozilla\Firefox\Profiles\clkfbum0.default\extensions\toolbar@ask.com\datastore folder moved successfully.
C:\Users\African King\AppData\Roaming\mozilla\Firefox\Profiles\clkfbum0.default\extensions\toolbar@ask.com\chrome\temp\ff-config.Wed-21-Sep-2011-20-31-51-GMT folder moved successfully.
C:\Users\African King\AppData\Roaming\mozilla\Firefox\Profiles\clkfbum0.default\extensions\toolbar@ask.com\chrome\temp\ff-config.Wed-21-Sep-2011-17-43-58-GMT folder moved successfully.
C:\Users\African King\AppData\Roaming\mozilla\Firefox\Profiles\clkfbum0.default\extensions\toolbar@ask.com\chrome\temp\ff-config.Wed-14-Dec-2011-17-25-19-GMT folder moved successfully.
C:\Users\African King\AppData\Roaming\mozilla\Firefox\Profiles\clkfbum0.default\extensions\toolbar@ask.com\chrome\temp\ff-config.Wed-09-Nov-2011-18-31-39-GMT folder moved successfully.
C:\Users\African King\AppData\Roaming\mozilla\Firefox\Profiles\clkfbum0.default\extensions\toolbar@ask.com\chrome\temp\ff-config.Tue-08-Nov-2011-15-49-45-GMT folder moved successfully.
C:\Users\African King\AppData\Roaming\mozilla\Firefox\Profiles\clkfbum0.default\extensions\toolbar@ask.com\chrome\temp\ff-config.Thu-24-Nov-2011-06-06-12-GMT folder moved successfully.
C:\Users\African King\AppData\Roaming\mozilla\Firefox\Profiles\clkfbum0.default\extensions\toolbar@ask.com\chrome\temp\ff-config.Thu-12-Jan-2012-15-45-55-GMT folder moved successfully.
C:\Users\African King\AppData\Roaming\mozilla\Firefox\Profiles\clkfbum0.default\extensions\toolbar@ask.com\chrome\temp\ff-config.Thu-09-Feb-2012-18-25-07-GMT folder moved successfully.
C:\Users\African King\AppData\Roaming\mozilla\Firefox\Profiles\clkfbum0.default\extensions\toolbar@ask.com\chrome\temp\ff-config.Sat-15-Oct-2011-21-06-13-GMT folder moved successfully.
C:\Users\African King\AppData\Roaming\mozilla\Firefox\Profiles\clkfbum0.default\extensions\toolbar@ask.com\chrome\temp\ff-config.Sat-07-Jan-2012-08-45-53-GMT folder moved successfully.
C:\Users\African King\AppData\Roaming\mozilla\Firefox\Profiles\clkfbum0.default\extensions\toolbar@ask.com\chrome\temp\ff-config.Mon-05-Sep-2011-21-07-55-GMT folder moved successfully.
C:\Users\African King\AppData\Roaming\mozilla\Firefox\Profiles\clkfbum0.default\extensions\toolbar@ask.com\chrome\temp\ff-config.Fri-28-Oct-2011-17-19-08-GMT folder moved successfully.
C:\Users\African King\AppData\Roaming\mozilla\Firefox\Profiles\clkfbum0.default\extensions\toolbar@ask.com\chrome\temp\ff-config.Fri-14-Oct-2011-18-15-20-GMT folder moved successfully.
C:\Users\African King\AppData\Roaming\mozilla\Firefox\Profiles\clkfbum0.default\extensions\toolbar@ask.com\chrome\temp\ff-config.Fri-06-Jan-2012-06-02-28-GMT folder moved successfully.
C:\Users\African King\AppData\Roaming\mozilla\Firefox\Profiles\clkfbum0.default\extensions\toolbar@ask.com\chrome\temp folder moved successfully.
C:\Users\African King\AppData\Roaming\mozilla\Firefox\Profiles\clkfbum0.default\extensions\toolbar@ask.com\chrome\skin folder moved successfully.
C:\Users\African King\AppData\Roaming\mozilla\Firefox\Profiles\clkfbum0.default\extensions\toolbar@ask.com\chrome\content folder moved successfully.
C:\Users\African King\AppData\Roaming\mozilla\Firefox\Profiles\clkfbum0.default\extensions\toolbar@ask.com\chrome folder moved successfully.
C:\Users\African King\AppData\Roaming\mozilla\Firefox\Profiles\clkfbum0.default\extensions\toolbar@ask.com folder moved successfully.
C:\Users\African King\AppData\Roaming\Mozilla\Firefox\Profiles\clkfbum0.default\searchplugins\sweetim.xml moved successfully.
C:\Users\African King\AppData\Roaming\Mozilla\Firefox\Profiles\clkfbum0.default\searchplugins\web-search.xml moved successfully.
C:\Program Files (x86)\mozilla firefox\searchplugins\fcmdSrch.xml moved successfully.
Unable to fix default_search_provider items.
Unable to fix default_search_provider items.
Unable to fix default_search_provider items.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully.
C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll moved successfully.
64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
File C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry value HKEY_USERS\S-1-5-21-2039289562-3748197240-2934368891-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
File C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ApnUpdater deleted successfully.
C:\Program Files (x86)\Ask.com\Updater\Updater.exe moved successfully.
Registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{B7FE5D70-9AA2-40F1-9C6B-12A255F085E1}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B7FE5D70-9AA2-40F1-9C6B-12A255F085E1}\ not found.
C:\Users\African King\Desktop\PartyPoker.lnk moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{B7FE5D70-9AA2-40F1-9C6B-12A255F085E1}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B7FE5D70-9AA2-40F1-9C6B-12A255F085E1}\ not found.
File C:\Users\African King\Desktop\PartyPoker.lnk not found.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a86d8e6a-b35f-11e0-8d10-206a8a27102f}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a86d8e6a-b35f-11e0-8d10-206a8a27102f}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a86d8e6a-b35f-11e0-8d10-206a8a27102f}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a86d8e6a-b35f-11e0-8d10-206a8a27102f}\ not found.
File D:\LaunchU3.exe -a not found.
ADS C:\ProgramData\Temp:5D7E5A8F deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: Name
->Temp folder emptied: 280482599 bytes
->Temporary Internet Files folder emptied: 113049334 bytes
->Java cache emptied: 351908 bytes
->FireFox cache emptied: 110810886 bytes
->Google Chrome cache emptied: 6418412 bytes
->Flash cache emptied: 50957 bytes
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 143891156 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 68023 bytes
RecycleBin emptied: 22163376830 bytes
 
Total Files Cleaned = 21.761,00 mb
 
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.31.0 log created on 02122012_224131

Files\Folders moved on Reboot...
C:\Users\African King\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
File move failed. C:\Windows\temp\dsiwmis.log scheduled to be moved on reboot.

Registry entries deleted on Reboot...

 

Themen zu 2 Viren gefunden (Exploit) - EXP/CVE-2011-3544.E und EXP/CVE-2011-3544.J
acer, anhang, appdata, apple, archiv, cache, enthält, erstell, exploit, gefunde, local, log, logfiles, malwarebytes, manuel, quarantäne, retten, schonmal, suche, tagen, temp, users, verschoben, viren, würde


« Trojanische Pferd TR/Swizzor.A.175 | Gema Virus auf Laptop Vista 32-bit »


Ähnliche Themen: 2 Viren gefunden (Exploit) - EXP/CVE-2011-3544.E und EXP/CVE-2011-3544.J


  1. Exploit.Java.CVE-2011-3544.jy + Weitere Viren?
    Log-Analyse und Auswertung - 20.12.2012 (34)
  2. Java/Exploit.CVE-2011-3544.BR trojan
    Log-Analyse und Auswertung - 28.11.2012 (14)
  3. Exp/cve-2011-3544
    Log-Analyse und Auswertung - 15.10.2012 (1)
  4. AVSCAN hat mehrere Java-Viren JAVA/Agent.M* und Exploits EXP/CVE-2011-3544 gefunden
    Log-Analyse und Auswertung - 15.10.2012 (24)
  5. Exploits EXP/CVE-2011-3544.BU von Avira gefunden
    Plagegeister aller Art und deren Bekämpfung - 30.08.2012 (37)
  6. Laptop befallen von: Exploit.Java.cve-2011-3544.ji, Was tun?
    Plagegeister aller Art und deren Bekämpfung - 09.08.2012 (12)
  7. Desinfec't 2012/Kaspersky findet Exploit.Java.CVE-2011-3544.** und Exploit.Java.CVE-2012-0507.**
    Plagegeister aller Art und deren Bekämpfung - 22.06.2012 (21)
  8. Panda Cloud AntiVirus PRo findet zwei Exploit CVE-2011-3544 Trojaner
    Log-Analyse und Auswertung - 17.05.2012 (20)
  9. Java-Script Virus: Exploit: Java/CVE-2011-3544.gen!E
    Plagegeister aller Art und deren Bekämpfung - 04.05.2012 (13)
  10. Exp/2011-3544.hh
    Log-Analyse und Auswertung - 26.04.2012 (1)
  11. EXP/CVE-2011-3544.BY, EXP/JAVA.Ternub.Gen Wie bekomm ich die Viren weg/ Hab ich die noch?
    Plagegeister aller Art und deren Bekämpfung - 08.04.2012 (4)
  12. 3 Viren: EXP/2011-3544.CZ und EXP/JAVA.Loader.Gen und EXP/CVE-2012-0507
    Plagegeister aller Art und deren Bekämpfung - 06.04.2012 (2)
  13. Trojaner Exploit.Java.CVE-2011-3544.jh & Virus P2P-Worm.Win23.Palevo.nzl
    Plagegeister aller Art und deren Bekämpfung - 04.04.2012 (5)
  14. EXP/2011-3544.BU.1 mittels Avira AntiVir gefunden
    Log-Analyse und Auswertung - 19.03.2012 (8)
  15. Avira hat TR/Maljava.A.43 und Exploits EXP/CVE-2011-3544.AZ gefunden - und nun?
    Plagegeister aller Art und deren Bekämpfung - 02.03.2012 (33)
  16. exploit.java.cve-2011-3544 irreparabel
    Plagegeister aller Art und deren Bekämpfung - 07.02.2012 (23)
  17. "BKA EXPLOIT" EXP/CVE-2011-3544.AM' Desktop nicht mehr zugänglich.
    Plagegeister aller Art und deren Bekämpfung - 06.01.2012 (13)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema 2 Viren gefunden (Exploit) - EXP/CVE-2011-3544.E und EXP/CVE-2011-3544.J - Hi. Habe die Anweisungen befolgt: Nach dem Neustart hat sich das log geöffnet: Code: Alles auswählen Aufklappen ATTFilter All processes killed ========== OTL ========== No active process named Program Files - 2 Viren gefunden (Exploit) - EXP/CVE-2011-3544.E und EXP/CVE-2011-3544.J...
Archiv
Du betrachtest: 2 Viren gefunden (Exploit) - EXP/CVE-2011-3544.E und EXP/CVE-2011-3544.J auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55