| |
| |||||||
Log-Analyse und Auswertung: Vermutete SpyEyeoder Zeus Infektion...Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
24.08.2012, 02:13
| #2 |
| /// Helfer-Team  |  Vermutete SpyEyeoder Zeus Infektion... Fixen mit OTL Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).
Code:
ATTFilter :OTL
DRV - (WDICA) -- File not found
DRV - (PDRFRAME) -- File not found
DRV - (PDRELI) -- File not found
DRV - (PDFRAME) -- File not found
DRV - (PDCOMP) -- File not found
DRV - (PCIDump) -- File not found
DRV - (lbrtfdc) -- File not found
DRV - (i2omgmt) -- File not found
DRV - (Changer) -- File not found
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-776561741-1035525444-725345543-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource=10&ctid=CT2431245
IE - HKU\S-1-5-21-776561741-1035525444-725345543-1003\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\prxtbsof2.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-776561741-1035525444-725345543-1003\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b}
IE - HKU\S-1-5-21-776561741-1035525444-725345543-1003\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC
IE - HKU\S-1-5-21-776561741-1035525444-725345543-1003\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=
IE - HKU\S-1-5-21-776561741-1035525444-725345543-1003\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2431245
IE - HKU\S-1-5-21-776561741-1035525444-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.search.defaultthis.engineName: "softonic-de3 Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2431245&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "www.google.de"
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {8f8fe09b-0bd3-4470-bc1b-8cad42b8203a}:0.16
FF - prefs.js..extensions.enabledItems: bkmrksync@nokia.com:1.0.0.736
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:5.0.0.6906
FF - prefs.js..extensions.enabledItems: {bee6eb20-01e0-ebd1-da83-080329fb9a3a}:0.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
O2 - BHO: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\prxtbsof2.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\prxtbsof2.dll (Conduit Ltd.)
O3 - HKU\S-1-5-21-776561741-1035525444-725345543-1003\..\Toolbar\WebBrowser: (softonic-de3 Toolbar) - {CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} - C:\Programme\softonic-de3\prxtbsof2.dll (Conduit Ltd.)
O4 - HKLM..\Run: [] File not found
O4 - HKU\S-1-5-21-776561741-1035525444-725345543-1003..\Run: [{6A56C644-8405-AD7D-E7F5-EED9C51FCDCB}] C:\Dokumente und Einstellungen\Nadin\Anwendungsdaten\Latau\edaq.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-776561741-1035525444-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O20 - Winlogon\Notify\ATFUS: DllName - (C:\WINDOWS\system32\FpWinLogonNp.dll) - C:\WINDOWS\system32\FpWinlogonNp.dll (AuthenTec,Inc)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008.12.23 21:29:04 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{2029cc86-15b3-11df-a126-001dd9ede8a6}\Shell - "" = AutoRun
O33 - MountPoints2\{2029cc86-15b3-11df-a126-001dd9ede8a6}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{2029cc86-15b3-11df-a126-001dd9ede8a6}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{2029cc89-15b3-11df-a126-001dd9ede8a6}\Shell - "" = AutoRun
O33 - MountPoints2\{2029cc89-15b3-11df-a126-001dd9ede8a6}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{2029cc89-15b3-11df-a126-001dd9ede8a6}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{38ec4030-8a09-11df-a268-001dd9ede8a6}\Shell - "" = AutoRun
O33 - MountPoints2\{38ec4030-8a09-11df-a268-001dd9ede8a6}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{38ec4030-8a09-11df-a268-001dd9ede8a6}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{6d17dac6-1d8b-11df-a133-001dd9ede8a6}\Shell - "" = AutoRun
O33 - MountPoints2\{6d17dac6-1d8b-11df-a133-001dd9ede8a6}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{6d17dac6-1d8b-11df-a133-001dd9ede8a6}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{6d17dac7-1d8b-11df-a133-001dd9ede8a6}\Shell - "" = AutoRun
O33 - MountPoints2\{6d17dac7-1d8b-11df-a133-001dd9ede8a6}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{6d17dac7-1d8b-11df-a133-001dd9ede8a6}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{751d063a-8b57-11df-a26a-001dd9ede8a6}\Shell - "" = AutoRun
O33 - MountPoints2\{751d063a-8b57-11df-a26a-001dd9ede8a6}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{751d063a-8b57-11df-a26a-001dd9ede8a6}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{dd8921e4-1fe7-11df-a136-001dd9ede8a6}\Shell - "" = AutoRun
O33 - MountPoints2\{dd8921e4-1fe7-11df-a136-001dd9ede8a6}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{dd8921e4-1fe7-11df-a136-001dd9ede8a6}\Shell\AutoRun\command - "" = E:\AutoRun.exe
[4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2012.08.23 11:50:09 | 000,302,592 | ---- | M] () -- C:\Dokumente und Einstellungen\Nadin\Desktop\j41do9qw.exe
[2012.08.07 16:03:51 | 000,726,528 | ---- | C] () -- C:\Dokumente und Einstellungen\Nadin\Desktop\jd-gui.exe
[2010.10.19 21:28:08 | 000,000,927 | ---- | M] () -- C:\Dokumente und Einstellungen\Nadin\Anwendungsdaten\Mozilla\Firefox\Profiles\kpg2gled.default\searchplugins\conduit.xml
[2010.05.14 17:29:34 | 000,002,064 | ---- | M] () -- C:\Dokumente und Einstellungen\Nadin\Anwendungsdaten\Mozilla\Firefox\Profiles\kpg2gled.default\searchplugins\youtube-videosuche.xml
:Files
ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden. Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!
__________________ |
| Themen zu Vermutete SpyEyeoder Zeus Infektion... |
| check, ebanking, eingabe, einloggen, hardware, heute, html, ide, kis, komplett, malwarebytes, neuinstallation, onlinebanking, scan, security, seite, sekunden, spyeye, spyware.zbot, tan, treiber, verbindung, verseucht, virus, win, win xp, win xp pro, überhaupt, zeus_v2 |
Baum-Darstellung