Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung
GVU TROJANER UNTER WINDOWS 7 (32 bit Version)

GVU TROJANER UNTER WINDOWS 7 (32 bit Version)


Log-Analyse und Auswertung: GVU TROJANER UNTER WINDOWS 7 (32 bit Version)

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML.

Antwort
Alt 24.07.2012, 03:04   #1
senoraiaiai
 
GVU TROJANER UNTER WINDOWS 7 (32 bit Version) - Standard

GVU TROJANER UNTER WINDOWS 7 (32 bit Version)


Hallo,

leider habe auch ich mir kürzlich (am 23.07.12) den GVU Virus eingefangen und bin auf der Suche nach einer Lösung für das Ärgerniß auf Euer wunderbares Board gestoßen.

Defogger, OTL und GMER habe ich wie beschrieben ausgeführt.

Vielen lieben Dank im Voraus für euer engagement.

Manolo

Code:
ATTFilter
OTL logfile created on: 24.07.2012 02:58:09 - Run 4
OTL by OldTimer - Version 3.2.54.1     Folder = C:\Users\manolo\Desktop
 Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,46 Gb Available Physical Memory | 72,89% Memory free
4,00 Gb Paging File | 3,29 Gb Available in Paging File | 82,36% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 55,88 Gb Total Space | 27,41 Gb Free Space | 49,06% Space Free | Partition Type: NTFS
Drive D: | 47,98 Gb Total Space | 44,66 Gb Free Space | 93,08% Space Free | Partition Type: NTFS
 
Computer Name: C3PO | User Name: manolo | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\manolo\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
PRC - C:\Program Files\Common Files\Apple\Internet Services\ubd.exe (Apple Inc.)
PRC - C:\Windows\System32\conhost.exe (Microsoft Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)
PRC - C:\Program Files\AccessManager\PMAC\sp_SWIns.exe (Smartpipes, Inc.)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Users\manolo\AppData\Local\Temp\fe0_zip.exe ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\Program Files\FileZilla FTP Client\fzshellext.dll ()
MOD - C:\Program Files\WinRAR\RarExt.dll ()
MOD - C:\Program Files\Ashampoo\Ashampoo WinOptimizer 5\ContextHandler.dll ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (MBAMService) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (MozillaMaintenance) -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (avast! Antivirus) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (WatAdminSvc) -- C:\Windows\System32\Wat\WatAdminSvc.exe (Microsoft Corporation)
SRV - (CVPND) -- C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)
SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (sp_spi_da) -- C:\Program Files\AccessManager\SMOC\spi_da.exe (Smartpipes, Inc.)
SRV - (SP Software Installer) -- C:\Program Files\AccessManager\PMAC\sp_SWIns.exe (Smartpipes, Inc.)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (tcpipBM) --  File not found
DRV - (hwdatacard) -- system32\DRIVERS\ewusbmdm.sys File not found
DRV - (BMLoad) -- system32\drivers\BMLoad.sys File not found
DRV - (MBAMProtector) -- C:\Windows\System32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (aswSnx) -- C:\Windows\System32\drivers\aswSnx.sys (AVAST Software)
DRV - (aswSP) -- C:\Windows\System32\drivers\aswSP.sys (AVAST Software)
DRV - (aswRdr) -- C:\Windows\System32\drivers\aswRdr2.sys (AVAST Software)
DRV - (aswTdi) -- C:\Windows\System32\drivers\aswTdi.sys (AVAST Software)
DRV - (aswMonFlt) -- C:\Windows\System32\drivers\aswMonFlt.sys (AVAST Software)
DRV - (aswFsBlk) -- C:\Windows\System32\drivers\aswFsBlk.sys (AVAST Software)
DRV - (TsUsbFlt) -- C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV - (WinUsb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (SNC) -- C:\Windows\System32\drivers\SonyNC.sys (Sony Corporation)
DRV - (HSF_DPV) -- C:\Windows\System32\drivers\HSF_DPV.sys (Conexant Systems, Inc.)
DRV - (winachsf) -- C:\Windows\System32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.)
DRV - (HSFHWAZL) -- C:\Windows\System32\drivers\HSFHWAZL.sys (Conexant Systems, Inc.)
DRV - (netw5v32) -- C:\Windows\System32\drivers\NETw5v32.sys (Intel Corporation)
DRV - (CVPNDRVA) -- C:\Windows\System32\drivers\CVPNDRVA.sys (Cisco Systems, Inc.)
DRV - (tifm21) -- C:\Windows\System32\drivers\tifm21.sys (Texas Instruments)
DRV - (DNE) -- C:\Windows\System32\drivers\dne2000.sys (Deterministic Networks, Inc.)
DRV - (STHDA) -- C:\Windows\System32\drivers\stwrt.sys (IDT, Inc.)
DRV - (SFEP) -- C:\Windows\System32\drivers\SFEP.sys (Sony Corporation)
DRV - (ti21sony) -- C:\Windows\System32\drivers\ti21sony.sys (Texas Instruments)
DRV - (CVirtA) -- C:\Windows\System32\drivers\CVirtA.sys (Cisco Systems, Inc.)
DRV - (usbvm321) -- C:\Windows\System32\drivers\usbvm321.sys (Vimicro Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 4E F7 92 62 18 69 CD 01  [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{B6CAB236-426B-41D4-AF92-F68D99EEF6C6}: "URL" = hxxp://www.google.de/search?q={searchTerms}
IE - HKCU\..\SearchScopes\{B8E20CD7-BAC2-4820-9AA6-1060B3AF25E2}: "URL" = hxxp://www.baidu.com/s?wd={searchTerms}&ie={inputEncoding}&oe={outputEncoding}&abar=2&tn=synacast_adr
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.suggest.enabled: false
FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.startup.homepage: "www.google.de"
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: wrc@avast.com:7.0.1426
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}:6.0.31
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.17: C:\Program Files\Veetle\plugins\npVeetle.dll File not found
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program Files\Alwil Software\Avast5\WebRep\FF [2012.04.15 15:47:17 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.07.02 09:32:06 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.07.24 00:23:44 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 10.0.2\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2012.07.02 09:32:06 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 10.0.2\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins [2012.07.24 00:23:44 | 000,000,000 | ---D | M]
 
[2010.09.14 11:59:31 | 000,000,000 | ---D | M] (No name found) -- C:\Users\manolo\AppData\Roaming\mozilla\Extensions
[2010.09.14 11:59:31 | 000,000,000 | ---D | M] (No name found) -- C:\Users\manolo\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2012.07.24 00:39:34 | 000,000,000 | ---D | M] (No name found) -- C:\Users\manolo\AppData\Roaming\mozilla\Firefox\Profiles\k5q9580r.default\extensions
[2012.07.02 09:16:34 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
File not found (No name found) -- C:\USERS\MANOLO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\K5Q9580R.DEFAULT\EXTENSIONS\{ACAA314B-EEBA-48E4-AD47-84E31C44796C}
[2012.06.29 13:35:16 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.04.22 20:04:57 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2012.06.29 13:35:13 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.06.29 13:35:13 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.06.29 13:35:13 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.06.29 13:35:13 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.06.29 13:35:13 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.06.29 13:35:13 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - default_search_provider: Google ()
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}
CHR - homepage: hxxp://www.google.com/
 
O1 HOSTS File: ([2010.09.22 23:35:45 | 000,419,557 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1	www.007guard.com
O1 - Hosts: 127.0.0.1	007guard.com
O1 - Hosts: 127.0.0.1	008i.com
O1 - Hosts: 127.0.0.1	www.008k.com
O1 - Hosts: 127.0.0.1	008k.com
O1 - Hosts: 127.0.0.1	www.00hq.com
O1 - Hosts: 127.0.0.1	00hq.com
O1 - Hosts: 127.0.0.1	010402.com
O1 - Hosts: 127.0.0.1	www.032439.com
O1 - Hosts: 127.0.0.1	032439.com
O1 - Hosts: 127.0.0.1	www.0scan.com
O1 - Hosts: 127.0.0.1	0scan.com
O1 - Hosts: 127.0.0.1	1000gratisproben.com
O1 - Hosts: 127.0.0.1	www.1000gratisproben.com
O1 - Hosts: 127.0.0.1	1001namen.com
O1 - Hosts: 127.0.0.1	www.1001namen.com
O1 - Hosts: 127.0.0.1	100888290cs.com
O1 - Hosts: 127.0.0.1	www.100888290cs.com
O1 - Hosts: 127.0.0.1	www.100sexlinks.com
O1 - Hosts: 127.0.0.1	100sexlinks.com
O1 - Hosts: 127.0.0.1	10sek.com
O1 - Hosts: 127.0.0.1	www.10sek.com
O1 - Hosts: 127.0.0.1	www.1-2005-search.com
O1 - Hosts: 127.0.0.1	1-2005-search.com
O1 - Hosts: 127.0.0.1	www.123fporn.info
O1 - Hosts: 14475 more lines...
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [ISBMgr.exe] C:\Program Files\Sony\ISB Utility\ISBMgr.exe (Sony Corporation)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [Mouse Suite 98 Daemon] ICO.EXE File not found
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [SigmaTel Audio] C:\Program Files\SigmaTel\C-Major Audio\setup.exe (InstallShield Software Corporation)
O4 - HKCU..\Run: [MobileDocuments] C:\Program Files\Common Files\Apple\Internet Services\ubd.exe (Apple Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {DAF7E6E6-D53A-439A-B28D-12271406B8A9} hxxp://mobileapps.blackberry.com/devicesoftware/AxLoader.cab (RIM AxLoader)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A597BFDC-64E7-49DB-8A9F-9F5D111FE551}: DhcpNameServer = 192.168.2.1
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{7549be9f-4b01-11df-9774-c0d3c2619830}\Shell - "" = AutoRun
O33 - MountPoints2\{7549be9f-4b01-11df-9774-c0d3c2619830}\Shell\AutoRun\command - "" = I:\LaunchU3.exe
O33 - MountPoints2\{ca2c0d20-665a-11df-a2fb-e8ba12b63503}\Shell - "" = AutoRun
O33 - MountPoints2\{ca2c0d20-665a-11df-a2fb-e8ba12b63503}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{ca2c0d28-665a-11df-a2fb-e8ba12b63503}\Shell - "" = AutoRun
O33 - MountPoints2\{ca2c0d28-665a-11df-a2fb-e8ba12b63503}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\I\Shell - "" = AutoRun
O33 - MountPoints2\I\Shell\AutoRun\command - "" = I:\LaunchU3.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.07.24 01:22:10 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Users\manolo\Desktop\OTL.exe
[2012.07.24 00:44:08 | 000,000,000 | ---D | C] -- C:\Users\manolo\AppData\Roaming\Malwarebytes
[2012.07.24 00:43:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.07.24 00:43:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.07.24 00:43:41 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.07.24 00:43:41 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.07.24 00:43:12 | 002,136,152 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\manolo\Desktop\tdsskiller.exe
[2012.07.24 00:43:08 | 010,652,120 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\manolo\Desktop\mbam-setup-1.62.0.1300.exe
[2012.07.24 00:23:31 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2012.07.11 12:27:15 | 000,000,000 | --SD | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice.org 3.4
[2012.07.10 20:42:40 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2012.07.10 20:42:38 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2012.07.10 20:42:38 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2012.07.10 20:42:37 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2012.07.10 20:42:36 | 001,800,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2012.07.10 20:42:35 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2012.07.10 20:42:33 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2012.07.10 20:40:17 | 002,345,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2012.07.10 19:59:29 | 000,219,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ncrypt.dll
[2012.07.10 19:59:19 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msxml3r.dll
[2012.07.10 19:59:11 | 000,805,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\cdosys.dll
[2012.07.02 09:31:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2012.06.29 13:35:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla
[2012.06.29 13:35:24 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Maintenance Service
[2012.06.27 11:52:09 | 002,422,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wucltux.dll
[2012.06.27 11:52:09 | 000,045,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wups2.dll
[2012.06.27 11:51:40 | 000,577,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wuapi.dll
[2012.06.27 11:51:40 | 000,088,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wudriver.dll
[2012.06.27 11:51:40 | 000,035,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wups.dll
[2012.06.27 11:51:08 | 000,171,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wuwebv.dll
[2012.06.27 11:51:08 | 000,033,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wuapp.exe
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.07.24 03:04:11 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.07.24 02:59:42 | 000,013,760 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.07.24 02:59:42 | 000,013,760 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.07.24 02:52:35 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.07.24 02:52:18 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.07.24 02:52:09 | 1609,179,136 | -HS- | M] () -- C:\hiberfil.sys
[2012.07.24 02:04:01 | 000,000,000 | ---- | M] () -- C:\Users\manolo\defogger_reenable
[2012.07.24 01:57:40 | 000,302,592 | ---- | M] () -- C:\Users\manolo\Desktop\mh760tl7.exe
[2012.07.24 01:52:46 | 000,050,477 | ---- | M] () -- C:\Users\manolo\Desktop\Defogger.exe
[2012.07.24 00:56:48 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\manolo\Desktop\OTL.exe
[2012.07.24 00:44:24 | 000,654,166 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.07.24 00:44:24 | 000,616,008 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.07.24 00:44:24 | 000,130,006 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.07.24 00:44:24 | 000,106,388 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.07.24 00:43:44 | 000,001,031 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.07.24 00:36:16 | 010,652,120 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\manolo\Desktop\mbam-setup-1.62.0.1300.exe
[2012.07.24 00:17:24 | 002,136,152 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\manolo\Desktop\tdsskiller.exe
[2012.07.23 23:20:12 | 004,503,728 | ---- | M] () -- C:\ProgramData\piz_0ef.pad
[2012.07.23 23:16:05 | 000,001,885 | ---- | M] () -- C:\Users\manolo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
[2012.07.18 18:35:25 | 016,754,934 | ---- | M] () -- C:\ProgramData\SMRBackup300.dat
[2012.07.15 20:42:19 | 000,066,997 | ---- | M] () -- C:\Users\manolo\Desktop\LinkedinFootballGroups.JPG
[2012.07.14 23:19:06 | 000,049,400 | ---- | M] () -- C:\Users\manolo\Desktop\colombia.jpg
[2012.07.11 12:40:57 | 002,240,352 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012.07.10 10:26:56 | 000,011,870 | ---- | M] () -- C:\Users\manolo\Desktop\Cas.pdf
[2012.07.09 22:26:09 | 000,027,549 | ---- | M] () -- C:\Users\manolo\Desktop\International Distributor.odt
[2012.07.03 18:04:46 | 000,014,094 | ---- | M] () -- C:\Users\manolo\Desktop\img033.jpeg
[2012.07.03 13:46:44 | 000,022,344 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.07.02 20:41:05 | 015,622,082 | ---- | M] () -- C:\Users\manolo\Desktop\ThesisArabEshop.pdf
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.07.24 02:04:01 | 000,000,000 | ---- | C] () -- C:\Users\manolo\defogger_reenable
[2012.07.24 02:03:16 | 000,302,592 | ---- | C] () -- C:\Users\manolo\Desktop\mh760tl7.exe
[2012.07.24 02:03:07 | 000,050,477 | ---- | C] () -- C:\Users\manolo\Desktop\Defogger.exe
[2012.07.24 00:43:44 | 000,001,031 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.07.23 23:55:09 | 210,292,736 | ---- | C] () -- C:\Users\manolo\Desktop\KWU_1.0.3.upd.iso
[2012.07.23 23:16:05 | 004,503,728 | ---- | C] () -- C:\ProgramData\piz_0ef.pad
[2012.07.23 23:16:05 | 000,001,885 | ---- | C] () -- C:\Users\manolo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
[2012.07.15 20:42:19 | 000,066,997 | ---- | C] () -- C:\Users\manolo\Desktop\LinkedinFootballGroups.JPG
[2012.07.14 22:52:33 | 000,049,400 | ---- | C] () -- C:\Users\manolo\Desktop\colombia.jpg
[2012.07.10 10:26:56 | 000,011,870 | ---- | C] () -- C:\Users\manolo\Desktop\Cas.pdf
[2012.07.09 22:26:07 | 000,027,549 | ---- | C] () -- C:\Users\manolo\Desktop\International Distributor.odt
[2012.07.06 18:16:31 | 016,754,934 | ---- | C] () -- C:\ProgramData\SMRBackup300.dat
[2012.07.03 18:04:42 | 000,014,094 | ---- | C] () -- C:\Users\manolo\Desktop\img033.jpeg
[2012.07.02 20:41:05 | 015,622,082 | ---- | C] () -- C:\Users\manolo\Desktop\ThesisArabEshop.pdf
[2012.06.29 13:35:21 | 000,001,064 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2010.01.01 19:26:44 | 000,007,607 | ---- | C] () -- C:\Users\manolo\AppData\Local\Resmon.ResmonCfg
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:573A02A1

< End of report >

Alt 25.07.2012, 02:33   #2
t'john
/// Helfer-Team
 
GVU TROJANER UNTER WINDOWS 7 (32 bit Version) - Standard

GVU TROJANER UNTER WINDOWS 7 (32 bit Version)




Fixen mit OTL

Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).

  • Deaktiviere etwaige Virenscanner wie Avira, Kaspersky etc.
  • Starte die OTL.exe.
    Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
  • Kopiere folgendes Skript in das Textfeld unterhalb von Benuterdefinierte Scans/Fixes:


Code:
ATTFilter
:OTL
MOD - C:\Users\manolo\AppData\Local\Temp\fe0_zip.exe () 
DRV - (tcpipBM) -- File not found 
DRV - (hwdatacard) -- system32\DRIVERS\ewusbmdm.sys File not found 
DRV - (BMLoad) -- system32\drivers\BMLoad.sys File not found 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} 
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC 
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} 
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC 
IE - HKCU\..\SearchScopes\{B6CAB236-426B-41D4-AF92-F68D99EEF6C6}: "URL" = http://www.google.de/search?q={searchTerms} 
IE - HKCU\..\SearchScopes\{B8E20CD7-BAC2-4820-9AA6-1060B3AF25E2}: "URL" = http://www.baidu.com/s?wd={searchTerms}&ie={inputEncoding}&oe={outputEncoding}&abar=2&tn=synacast_adr 
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local 
FF - prefs.js..browser.search.suggest.enabled: false 
FF - prefs.js..browser.search.update: false 
FF - prefs.js..browser.startup.homepage: "www.google.de" 
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1 
FF - prefs.js..extensions.enabledItems: wrc@avast.com:7.0.1426 
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}:6.0.31 
FF - user.js - File not found 
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found 
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found 
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) 
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) 
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.17: C:\Program Files\Veetle\plugins\npVeetle.dll File not found 
File not found (No name found) -- C:\USERS\MANOLO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\K5Q9580R.DEFAULT\EXTENSIONS\{ACAA314B-EEBA-48E4-AD47-84E31C44796C} 
O4 - HKLM..\Run: [Mouse Suite 98 Daemon] ICO.EXE File not found 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found 
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. 
O32 - HKLM CDRom: AutoRun - 1 
O33 - MountPoints2\{7549be9f-4b01-11df-9774-c0d3c2619830}\Shell - "" = AutoRun 
O33 - MountPoints2\{7549be9f-4b01-11df-9774-c0d3c2619830}\Shell\AutoRun\command - "" = I:\LaunchU3.exe 
O33 - MountPoints2\{ca2c0d20-665a-11df-a2fb-e8ba12b63503}\Shell - "" = AutoRun 
O33 - MountPoints2\{ca2c0d20-665a-11df-a2fb-e8ba12b63503}\Shell\AutoRun\command - "" = F:\AutoRun.exe 
O33 - MountPoints2\{ca2c0d28-665a-11df-a2fb-e8ba12b63503}\Shell - "" = AutoRun 
O33 - MountPoints2\{ca2c0d28-665a-11df-a2fb-e8ba12b63503}\Shell\AutoRun\command - "" = F:\AutoRun.exe 
O33 - MountPoints2\I\Shell - "" = AutoRun 
O33 - MountPoints2\I\Shell\AutoRun\command - "" = I:\LaunchU3.exe 

[2012.07.24 01:57:40 | 000,302,592 | ---- | M] () -- C:\Users\manolo\Desktop\mh760tl7.exe 
[2012.07.23 23:16:05 | 004,503,728 | ---- | C] () -- C:\ProgramData\piz_0ef.pad 

@Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:573A02A1 
 
[2012.07.24 03:04:11 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job 
[2012.07.24 02:52:35 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job 

[2012.07.23 23:20:12 | 004,503,728 | ---- | M] () -- C:\ProgramData\piz_0ef.pad 
[2012.07.23 23:16:05 | 000,001,885 | ---- | M] () -- C:\Users\manolo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk 


:Files
C:\Users\manolo\AppData\Local\Temp\fe0_zip.exe

I:\LaunchU3.exe
F:\AutoRun.exe

ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
[emptyflash]
  • Schließe alle Programme.
  • Klicke auf den Fix Button.
  • Wenn OTL einen Neustart verlangt, bitte zulassen.
  • Kopiere den Inhalt des Logfiles hier in Code-Tags in Deinen Thread.
    Nachträglich kannst Du das Logfile hier einsehen => C:\_OTL\MovedFiles\

Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!
__________________

__________________
Alt 25.07.2012, 10:58   #3
senoraiaiai
 
GVU TROJANER UNTER WINDOWS 7 (32 bit Version) - Standard

GVU TROJANER UNTER WINDOWS 7 (32 bit Version)


Vielen lieben Dank fuer Eure freundliche und kompetente Hilfe!!!!!!
Der Trojaner scheint entfernt worden zu sein. Der Task Manager funktioniert wieder und die GVU Site erscheint nicht mehr.
Anbei noch die OTL Logdaten vom Fix.

MfG

Manolo


Code:
ATTFilter
All processes killed
========== OTL ==========
Service tcpipBM stopped successfully!
Service tcpipBM deleted successfully!
File  File not found not found.
Service hwdatacard stopped successfully!
Service hwdatacard deleted successfully!
File  system32\DRIVERS\ewusbmdm.sys File not found not found.
Error: No service named BMLoad was found to stop!
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BMLoad deleted successfully.
File  system32\drivers\BMLoad.sys File not found not found.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B6CAB236-426B-41D4-AF92-F68D99EEF6C6}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B6CAB236-426B-41D4-AF92-F68D99EEF6C6}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B8E20CD7-BAC2-4820-9AA6-1060B3AF25E2}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B8E20CD7-BAC2-4820-9AA6-1060B3AF25E2}\ not found.
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
Prefs.js: false removed from browser.search.suggest.enabled
Prefs.js: false removed from browser.search.update
Prefs.js: "www.google.de" removed from browser.startup.homepage
Prefs.js: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1 removed from extensions.enabledItems
Prefs.js: wrc@avast.com:7.0.1426 removed from extensions.enabledItems
Prefs.js: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}:6.0.31 removed from extensions.enabledItems
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@Apple.com/iTunes,version=\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@microsoft.com/GENUINE\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@tools.google.com/Google Update;version=3\ deleted successfully.
C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@tools.google.com/Google Update;version=9\ deleted successfully.
File C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll not found.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.17\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Mouse Suite 98 Daemon deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7549be9f-4b01-11df-9774-c0d3c2619830}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7549be9f-4b01-11df-9774-c0d3c2619830}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7549be9f-4b01-11df-9774-c0d3c2619830}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7549be9f-4b01-11df-9774-c0d3c2619830}\ not found.
File I:\LaunchU3.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ca2c0d20-665a-11df-a2fb-e8ba12b63503}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ca2c0d20-665a-11df-a2fb-e8ba12b63503}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ca2c0d20-665a-11df-a2fb-e8ba12b63503}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ca2c0d20-665a-11df-a2fb-e8ba12b63503}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ca2c0d28-665a-11df-a2fb-e8ba12b63503}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ca2c0d28-665a-11df-a2fb-e8ba12b63503}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ca2c0d28-665a-11df-a2fb-e8ba12b63503}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ca2c0d28-665a-11df-a2fb-e8ba12b63503}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\I\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\I\ not found.
File I:\LaunchU3.exe not found.
C:\Users\manolo\Desktop\mh760tl7.exe moved successfully.
C:\ProgramData\piz_0ef.pad moved successfully.
ADS C:\ProgramData\TEMP:573A02A1 deleted successfully.
C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job moved successfully.
C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job moved successfully.
File C:\ProgramData\piz_0ef.pad not found.
C:\Users\manolo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk moved successfully.
========== FILES ==========
C:\Users\manolo\AppData\Local\Temp\fe0_zip.exe moved successfully.
File\Folder I:\LaunchU3.exe not found.
File\Folder F:\AutoRun.exe not found.
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Aufl”sungscache wurde geleert.
C:\Users\manolo\Desktop\cmd.bat deleted successfully.
C:\Users\manolo\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: manolo
->Temp folder emptied: 1080925 bytes
->Temporary Internet Files folder emptied: 671077 bytes
->Java cache emptied: 13608089 bytes
->FireFox cache emptied: 65166832 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 523 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 992592 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 78,00 mb
 
 
[EMPTYFLASH]
 
User: All Users
 
User: Default
 
User: Default User
 
User: manolo
->Flash cache emptied: 0 bytes
 
User: Public
 
Total Flash Files Cleaned = 0,00 mb
 
 
OTL by OldTimer - Version 3.2.54.1 log created on 07252012_113728

Files\Folders moved on Reboot...
C:\Users\manolo\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\ED8654D5-B9F0-4DD9-B3E8-F8F560086FDF.dat moved successfully.
File\Folder C:\Windows\temp\TMP0000002AA084474C5C285174 not found!

PendingFileRenameOperations files...
File C:\Users\manolo\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\ED8654D5-B9F0-4DD9-B3E8-F8F560086FDF.dat not found!
File C:\Windows\temp\TMP0000002AA084474C5C285174 not found!

Registry entries deleted on Reboot...
__________________
Alt 25.07.2012, 13:59   #4
t'john
/// Helfer-Team
 
GVU TROJANER UNTER WINDOWS 7 (32 bit Version) - Standard

GVU TROJANER UNTER WINDOWS 7 (32 bit Version)


Sehr gut!


1. Schritt
Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Malwarebytes Anti-Malware
- Anwendbar auf Windows 2000, XP, Vista und 7.
- Installiere das Programm in den vorgegebenen Pfad.
- Aktiviere "Komplett Scan durchführen" => Scan.
- Wähle alle verfügbaren Laufwerke (ausser CD/DVD) aus und starte den Scan.
- Funde bitte löschen lassen oder in Quarantäne.
- Wenn der Scan beendet ist, klicke auf "Zeige Resultate".
danach:

2. Schritt

Downloade Dir bitte AdwCleaner auf deinen Desktop.

  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Search.
  • Nach Ende des Suchlaufs öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.
__________________
Mfg, t'john
Das TB unterstützen

Alt 08.08.2012, 03:21   #5
t'john
/// Helfer-Team
 
GVU TROJANER UNTER WINDOWS 7 (32 bit Version) - Standard

GVU TROJANER UNTER WINDOWS 7 (32 bit Version)


Fehlende Rückmeldung

Gibt es Probleme beim Abarbeiten obiger Anleitung?

Um Kapazitäten für andere Hilfesuchende freizumachen, lösche ich dieses Thema aus meinen Benachrichtigungen.

Solltest Du weitermachen wollen, schreibe mir eine PN oder eröffne ein neues Thema.
http://www.trojaner-board.de/69886-a...-beachten.html


Hinweis: Das Verschwinden der Symptome bedeutet nicht, dass Dein Rechner sauber ist.

__________________
Mfg, t'john
Das TB unterstützen

Antwort

Themen zu GVU TROJANER UNTER WINDOWS 7 (32 bit Version)
.dll, 32 bit, antivirus, avast, bho, cftmon.lnk, defender, explorer, format, ftp, google earth, go_0molg.pad, gvu trojaner, gvu trojaner 2.07, gvu trojaner entfernen, gvu trojaner mit webcam, home, langs, nvidia, plug-in, reveton.c, scan, searchscopes, taskhost.exe, temp, webcam gvu trojaner, webcamfenster, windows


« GVU Trojaner 2.07 | GVU Ransom/Trojaner v2.07 (Win7 64) »


Ähnliche Themen: GVU TROJANER UNTER WINDOWS 7 (32 bit Version)


  1. Begrenzte Internetverbindung unter Windows 10; keinerlei Probleme unter Ubuntu
    Netzwerk und Hardware - 05.09.2015 (13)
  2. Internet verlangsamt unter Safari - Mac OS X Version 10.8.5
    Alles rund um Mac OSX & Linux - 07.11.2014 (1)
  3. TROJAN.Dropper unter Windows 7,64bit Version im "Datev-Verzeichnis"
    Log-Analyse und Auswertung - 30.12.2013 (31)
  4. GVU Trojaner unter Windows 8
    Log-Analyse und Auswertung - 31.05.2013 (28)
  5. hallo habe den gvu Trojaner auf windows 7 leider englische version was soll ich tun?
    Plagegeister aller Art und deren Bekämpfung - 24.05.2013 (2)
  6. GVU Trojaner unter Windows 7
    Plagegeister aller Art und deren Bekämpfung - 14.01.2013 (14)
  7. GVU Trojaner Version 2.10 Windows 7
    Log-Analyse und Auswertung - 27.12.2012 (7)
  8. GVU/Bundespolizei Trojaner - Windows Vista Home Version
    Log-Analyse und Auswertung - 15.10.2012 (3)
  9. BKA-Trojaner (neueste Version) auf Windows XP
    Plagegeister aller Art und deren Bekämpfung - 30.07.2012 (15)
  10. GVU Trojaner unter Windows 7
    Plagegeister aller Art und deren Bekämpfung - 17.07.2012 (17)
  11. BKA-Trojaner unter Windows XP
    Plagegeister aller Art und deren Bekämpfung - 11.07.2012 (1)
  12. Windows-Verschlüsselungs-Trojaner unter Windows 7 auf einem MAC
    Log-Analyse und Auswertung - 14.06.2012 (3)
  13. Verschlüsselungstrojaner (neue Version?) unter Windows 7
    Plagegeister aller Art und deren Bekämpfung - 11.06.2012 (1)
  14. Windows Verschlüsselungs Trojaner neue Version nur Buchstabensalat
    Log-Analyse und Auswertung - 05.06.2012 (1)
  15. BKA Trojaner unter Windows 7 64
    Plagegeister aller Art und deren Bekämpfung - 21.03.2012 (9)
  16. Trojaner: Aus Sicherheitsgründen wurde Ihre Windows Version gesperrt - 50 euro zahlen!
    Plagegeister aller Art und deren Bekämpfung - 12.03.2012 (21)
  17. Trojaner , Trojan:Win32/Ransom.EJ auf dem Netbook. Windows Version blockiert.
    Plagegeister aller Art und deren Bekämpfung - 18.12.2011 (1)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema GVU TROJANER UNTER WINDOWS 7 (32 bit Version) - Hallo, leider habe auch ich mir kürzlich (am 23.07.12) den GVU Virus eingefangen und bin auf der Suche nach einer Lösung für das Ärgerniß auf Euer wunderbares Board gestoßen. Defogger, - GVU TROJANER UNTER WINDOWS 7 (32 bit Version)...
Archiv
Du betrachtest: GVU TROJANER UNTER WINDOWS 7 (32 bit Version) auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19