|
Log-Analyse und Auswertung: System verseucht mit Trojan.Win32.Jorik1456291289Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
25.08.2012, 17:02 | #1 |
| System verseucht mit Trojan.Win32.Jorik1456291289 Hallo, ich habe hier den Computer einer Freundin vorliegen, welcher Virusverseucht ist. Sie hatte auf Facebook eine Datei gedownloadet, die ihr als Bild deklariert wurde und hat diese Datei geöffnet. Sie hat Windows 7 Home Premium. Im Anhang befinden sich otl.txt und extras.txt |
25.08.2012, 18:02 | #2 |
/// Helfer-Team | System verseucht mit Trojan.Win32.Jorik1456291289Fixen mit OTL Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).
Code:
ATTFilter :OTL IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&form=SMSTDF&pc=MASM&src=IE-SearchBox IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://de.ask.com/?l=dis&o=14672 IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKCU\..\SearchScopes\{A1D5327E-0719-43CE-BC12-07727B6BDAF1}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=ATU2&o=14670&src=crm&q={searchTerms}&locale=&apn_ptnrs=T8&apn_dtid=YYYYYYYYDE&apn_uid=93e9389e-2d2f-4744-9d42-e070bc22de96&apn_sauid=5714B45C-382B-4EEE-A9BF-AE7579134803 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local FF - prefs.js..browser.search.defaultengine: "Ask.com" FF - prefs.js..browser.search.defaultenginename: "Ask.com" FF - prefs.js..browser.search.order.1: "Ask.com" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.startup.homepage: "http://www.google.de/" FF - prefs.js..network.proxy.type: 0 FF - user.js - File not found FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF64_11_3_300_271.dll File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [ApnUpdater] C:\Program Files (x86)\Ask.com\Updater\Updater.exe (Ask) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8:64bit: - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 [2012/02/27 21:06:34 | 000,000,000 | ---D | M] -- C:\Users\abc\AppData\Roaming\OpenCandy [2012/08/19 20:33:26 | 000,000,804 | ---- | C] () -- C:\windows\Installer\{e98f47b8-6818-7ee8-758e-57d62ed72e4a}\L\00000004.@ [2012/02/28 19:14:00 | 000,002,048 | -HS- | C] () -- C:\windows\Installer\{e98f47b8-6818-7ee8-758e-57d62ed72e4a}\@ [2012/02/28 19:14:00 | 000,002,048 | -HS- | C] () -- C:\Users\abc\AppData\Local\{e98f47b8-6818-7ee8-758e-57d62ed72e4a}\@ :Files C:\windows\Installer\{e98f47b8-6818-7ee8-758e-57d62ed72e4a}\ C:\Users\abc\AppData\Local\{e98f47b8-6818-7ee8-758e-57d62ed72e4a}\ C:\Users\abc\AppData\Local\{*} C:\ProgramData\*.exe C:\ProgramData\TEMP C:\Users\abc\AppData\Local\Temp\*.exe C:\Users\abc\AppData\LocalLow\Sun\Java\Deployment\cache ipconfig /flushdns /c :Commands [purity] [emptytemp]
Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden. Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!
__________________ |
25.08.2012, 18:44 | #3 |
| System verseucht mit Trojan.Win32.Jorik1456291289Code:
ATTFilter All processes killed ========== OTL ========== HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerSearchScopes\DefaultScope| /E : value set successfully! 64bit-Registry key HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerSearchScopes{0633EE93-D776-472f-A0FF-E1416B8B2E3A} deleted successfully. 64bit-Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{0633EE93-D776-472f-A0FF-E1416B8B2E3A} not found. HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerSearchScopes\DefaultScope| /E : value set successfully! Registry key HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerSearchScopes{0633EE93-D776-472f-A0FF-E1416B8B2E3A} deleted successfully. Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{0633EE93-D776-472f-A0FF-E1416B8B2E3A} not found. HKCUSOFTWAREMicrosoftInternet ExplorerMain\Start Page| /E : value set successfully! Registry value HKEY_CURRENT_USERSOFTWAREMicrosoftInternet ExplorerURLSearchHooks\{00000000-6E41-4FD3-8538-502F5495E5FC} deleted successfully. Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{00000000-6E41-4FD3-8538-502F5495E5FC} deleted successfully. C:Program Files (x86)Ask.comGenericAskToolbar.dll moved successfully. HKEY_CURRENT_USERSOFTWAREMicrosoftInternet ExplorerSearchScopes\DefaultScope| /E : value set successfully! Registry key HKEY_CURRENT_USERSOFTWAREMicrosoftInternet ExplorerSearchScopes{A1D5327E-0719-43CE-BC12-07727B6BDAF1} deleted successfully. Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{A1D5327E-0719-43CE-BC12-07727B6BDAF1} not found. HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings\ProxyEnable|dword:0 /E : value set successfully! HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings\ProxyOverride| /E : value set successfully! Prefs.js: "Ask.com" removed from browser.search.defaultengine Prefs.js: "Ask.com" removed from browser.search.defaultenginename Prefs.js: "Ask.com" removed from browser.search.order.1 Prefs.js: "Google" removed from browser.search.selectedEngine Prefs.js: "hxxp://www.google.de/" removed from browser.startup.homepage Prefs.js: 0 removed from network.proxy.type 64bit-Registry key HKEY_LOCAL_MACHINESoftwareMozillaPlugins@adobe.com/FlashPlayer deleted successfully. Registry key HKEY_LOCAL_MACHINESoftwareMozillaPlugins@Apple.com/iTunes,version= deleted successfully. 64bit-Registry value HKEY_LOCAL_MACHINESoftwareMicrosoftInternet ExplorerToolbar\Locked deleted successfully. Registry value HKEY_LOCAL_MACHINESoftwareMicrosoftInternet ExplorerToolbar\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully. Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully. File C:Program Files (x86)Ask.comGenericAskToolbar.dll not found. Registry value HKEY_LOCAL_MACHINESoftwareMicrosoftInternet ExplorerToolbar\Locked deleted successfully. Registry value HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun\ deleted successfully. Registry value HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun\ApnUpdater deleted successfully. C:Program Files (x86)Ask.comUpdaterUpdater.exe moved successfully. Registry value HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer\NoActiveDesktop deleted successfully. Registry value HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer\NoActiveDesktopChanges deleted successfully. Registry value HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionpoliciesSystem\ConsentPromptBehaviorAdmin deleted successfully. Registry value HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionpoliciesSystem\ConsentPromptBehaviorUser deleted successfully. Registry value HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionpoliciesSystem\EnableLUA deleted successfully. Registry value HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionpoliciesSystem\PromptOnSecureDesktop deleted successfully. Registry value HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer\NoDriveTypeAutoRun deleted successfully. 64bit-Registry key HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerMenuExtAn OneNote s&enden deleted successfully. 64bit-Registry key HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerMenuExtNach Microsoft E&xcel exportieren deleted successfully. Registry key HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerMenuExtAn OneNote s&enden not found. Registry key HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerMenuExtNach Microsoft E&xcel exportieren not found. 64bit-Registry value HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogon\VMApplet:/pagefile deleted successfully. Registry value HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogon\VMApplet:/pagefile deleted successfully. 64bit-Registry value HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad\WebCheck deleted successfully. 64bit-Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{E6FB5E20-DE35-11CF-9C87-00AA005127ED} not found. Registry value HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad\WebCheck deleted successfully. Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{E6FB5E20-DE35-11CF-9C87-00AA005127ED} not found. HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesCdrom\AutoRun|DWORD:1 /E : value set successfully! Folder C:UsersabcAppDataRoamingOpenCandy not found. C:WindowsInstaller{e98f47b8-6818-7ee8-758e-57d62ed72e4a}L0000004.@ moved successfully. C:WindowsInstaller{e98f47b8-6818-7ee8-758e-57d62ed72e4a}@ moved successfully. File C:UsersabcAppDataLocal{e98f47b8-6818-7ee8-758e-57d62ed72e4a}@ not found. ========== FILES ========== C:windowsInstaller{e98f47b8-6818-7ee8-758e-57d62ed72e4a}U folder moved successfully. C:windowsInstaller{e98f47b8-6818-7ee8-758e-57d62ed72e4a}L folder moved successfully. C:windowsInstaller{e98f47b8-6818-7ee8-758e-57d62ed72e4a} folder moved successfully. Folder C:UsersabcAppDataLocal{e98f47b8-6818-7ee8-758e-57d62ed72e4a} not found. FileFolder C:UsersabcAppDataLocal{*} not found. C:ProgramDataFullRemove.exe moved successfully. C:ProgramDataTemp{CB099890-1D5F-11D5-9EA9-0050BAE317E1} folder moved successfully. C:ProgramDataTemp{C59C179C-668D-49A9-B6EA-0121CCFC1243} folder moved successfully. C:ProgramDataTemp{B7A0CE06-068E-11D6-97FD-0050BACBF861} folder moved successfully. C:ProgramDataTemp{5DB1DF0C-AABC-4362-8A6D-CEFDFB036E41} folder moved successfully. C:ProgramDataTemp{40BF1E83-20EB-11D8-97C5-0009C5020658} folder moved successfully. C:ProgramDataTemp{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47} folder moved successfully. C:ProgramDataTemp{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79} folder moved successfully. C:ProgramDataTemp{01FB4998-33C4-4431-85ED-079E3EEFE75D} folder moved successfully. C:ProgramDataTemp folder moved successfully. FileFolder C:UsersabcAppDataLocalTemp*.exe not found. FileFolder C:UsersabcAppDataLocalLowSunJavaDeploymentcache not found. < ipconfig /flushdns /c > Windows-IP-Konfiguration Der DNS-Aufl”sungscache wurde geleert. C:UsersasaDesktopcmd.bat deleted successfully. C:UsersasaDesktopcmd.txt deleted successfully. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: asa ->Temp folder emptied: 17599883 bytes ->Temporary Internet Files folder emptied: 1809508 bytes ->FireFox cache emptied: 86956200 bytes ->Google Chrome cache emptied: 0 bytes ->Flash cache emptied: 859 bytes User: Public %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%System32 .tmp files removed: 0 bytes %systemroot%System32 (64bit) .tmp files removed: 0 bytes %systemroot%System32drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 209076 bytes %systemroot%sysnativeconfigsystemprofileAppDataLocalMicrosoftWindowsTemporary Internet Files folder emptied: 36030261 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 136.00 mb OTL by OldTimer - Version 3.2.58.1 log created on 08252012_192741 FilesFolders moved on Reboot... C:UsersasaAppDataLocalTempFXSAPIDebugLogFile.txt moved successfully. PendingFileRenameOperations files... Registry entries deleted on Reboot... |
26.08.2012, 01:12 | #4 |
/// Helfer-Team | System verseucht mit Trojan.Win32.Jorik1456291289 Sehr gut! Wie laeuft der Rechner? 1. Schritt Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.danach: 2. Schritt Downloade Dir bitte AdwCleaner auf deinen Desktop.
|
26.08.2012, 11:56 | #5 |
| System verseucht mit Trojan.Win32.Jorik1456291289 Der Rechner läuft gut. Schnell wie immer. Code:
ATTFilter # AdwCleaner v1.801 - Logfile created 08/26/2012 at 12:53:12 # Updated 14/08/2012 by Xplode # Operating system : Windows 7 Home Premium Service Pack 1 (64 bits) # User : asa - asa-PC # Boot Mode : Normal # Running from : C:UsersasaDownloadsadwcleaner.exe # Option [Search] ***** [Services] ***** ***** [Files / Folders] ***** Folder Found : C:UsersasaAppDataLocalLowAskToolbar Folder Found : C:UsersasaAppDataRoamingOpenCandy Folder Found : C:UsersasaAppDataRoamingMozillaFirefoxProfilesbnwkr520.defaultextensionstoolbar@ask.com Folder Found : C:ProgramDataAsk Folder Found : C:Program Files (x86)Ask.com Folder Found : C:windowsInstaller{86D4B82A-ABED-442A-BE86-96357B70F4FE} File Found : C:UsersasaAppDataRoamingMozillaFirefoxProfilesbnwkr520.defaultsearchpluginsAskcom.xml ***** [Registry] ***** Key Found : HKCUSoftwareAPN Key Found : HKCUSoftwareAppDataLowSoftwareAskToolbar Key Found : HKCUSoftwareAsk.com Key Found : HKCUSoftwareMicrosoftWindowsCurrentVersionUninstall{79A765E1-C399-405B-85AF-466F52E918B0} Key Found : HKLMSOFTWAREAPN Key Found : HKLMSOFTWAREAskToolbar Key Found : HKLMSOFTWAREClassesAppIDGenericAskToolbar.DLL Key Found : HKLMSOFTWAREClassesGenericAskToolbar.ToolbarWnd Key Found : HKLMSOFTWAREClassesGenericAskToolbar.ToolbarWnd.1 Key Found : HKLMSOFTWAREClassesInstallerFeaturesA28B4D68DEBAA244EB686953B7074FEF Key Found : HKLMSOFTWAREClassesInstallerProductsA28B4D68DEBAA244EB686953B7074FEF Key Found : HKLMSOFTWAREMicrosoftWindowsCurrentVersionUninstall{86D4B82A-ABED-442A-BE86-96357B70F4FE} [x64] Key Found : HKCUSoftwareAPN [x64] Key Found : HKCUSoftwareAppDataLowSoftwareAskToolbar [x64] Key Found : HKCUSoftwareAsk.com [x64] Key Found : HKCUSoftwareMicrosoftWindowsCurrentVersionUninstall{79A765E1-C399-405B-85AF-466F52E918B0} [x64] Key Found : HKLMSOFTWAREClassesAppIDGenericAskToolbar.DLL [x64] Key Found : HKLMSOFTWAREClassesGenericAskToolbar.ToolbarWnd [x64] Key Found : HKLMSOFTWAREClassesGenericAskToolbar.ToolbarWnd.1 [x64] Key Found : HKLMSOFTWAREClassesInstallerFeaturesA28B4D68DEBAA244EB686953B7074FEF [x64] Key Found : HKLMSOFTWAREClassesInstallerProductsA28B4D68DEBAA244EB686953B7074FEF [x64] Key Found : HKLMSOFTWAREMicrosoftWindows NTCurrentVersionScheduleTaskCacheTreeScheduled Update for Ask Toolbar [x64] Key Found : HKLMSOFTWAREMicrosoftWindowsCurrentVersionInstallerUserDataS-1-5-18ProductsA28B4D68DEBAA244EB686953B7074FEF ***** [Registre - GUID] ***** Key Found : HKLMSOFTWAREClassesAppID{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874} Key Found : HKLMSOFTWAREClassesInterface{6C434537-053E-486D-B62A-160059D9D456} Key Found : HKLMSOFTWAREClassesInterface{91CF619A-4686-4CA4-9232-3B2E6B63AA92} Key Found : HKLMSOFTWAREClassesInterface{AC71B60E-94C9-4EDE-BA46-E146747BB67E} Key Found : HKLMSOFTWAREClassesTypeLib{2996F0E7-292B-4CAE-893F-47B8B1C05B56} Key Found : HKCUSoftwareMicrosoftInternet ExplorerLow RightsElevationPolicy{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A} Key Found : HKLMSOFTWAREMicrosoftInternet ExplorerLow RightsElevationPolicy{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A} Key Found : HKCUSoftwareMicrosoftWindowsCurrentVersionExtSettings{D4027C7F-154A-4066-A1AD-4243D8127440} Key Found : HKCUSoftwareMicrosoftWindowsCurrentVersionExtStats{D4027C7F-154A-4066-A1AD-4243D8127440} [x64] Key Found : HKLMSOFTWAREClassesAppID{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874} [x64] Key Found : HKLMSOFTWAREClassesInterface{6C434537-053E-486D-B62A-160059D9D456} [x64] Key Found : HKLMSOFTWAREClassesInterface{91CF619A-4686-4CA4-9232-3B2E6B63AA92} [x64] Key Found : HKLMSOFTWAREClassesInterface{AC71B60E-94C9-4EDE-BA46-E146747BB67E} [x64] Key Found : HKLMSOFTWAREClassesTypeLib{2996F0E7-292B-4CAE-893F-47B8B1C05B56} [x64] Key Found : HKCUSoftwareMicrosoftInternet ExplorerLow RightsElevationPolicy{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A} [x64] Key Found : HKCUSoftwareMicrosoftWindowsCurrentVersionExtSettings{D4027C7F-154A-4066-A1AD-4243D8127440} [x64] Key Found : HKCUSoftwareMicrosoftWindowsCurrentVersionExtStats{D4027C7F-154A-4066-A1AD-4243D8127440} ***** [Internet Browsers] ***** -\ Internet Explorer v9.0.8112.16421 [OK] Registry is clean. -\ Mozilla Firefox v14.0.1 (de) Profile name : default File : C:UsersasaAppDataRoamingMozillaFirefoxProfilesbnwkr520.defaultprefs.js Found : user_pref("extensions.asktb.ff-original-keyword-url", ""); -\ Google Chrome v17.0.963.79 File : C:UsersasaAppDataLocalGoogleChromeUser DataDefaultPreferences [OK] File is clean. ************************* AdwCleaner[R1].txt - [4830 octets] - [26/08/2012 12:53:12] ########## EOF - C:AdwCleaner[R1].txt - [4958 octets] ########## Code:
ATTFilter Malwarebytes Anti-Malware 1.62.0.1300 www.malwarebytes.org Datenbank Version: v2012.08.26.01 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 asa :: asa-PC [Administrator] 26.08.2012 11:44:09 mbam-log-2012-08-26 (11-44-09).txt Art des Suchlaufs: Vollständiger Suchlauf (C:|D:|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 317460 Laufzeit: 55 Minute(n), 8 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 2 C:UsersasaDocumentsmspassmspass.exe (PUP.PSW.MessenPass) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:UsersasaDownloadsIMG00593829405-JPG.scr (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) Geändert von Ruper (26.08.2012 um 12:17 Uhr) |
27.08.2012, 02:24 | #6 |
/// Helfer-Team | System verseucht mit Trojan.Win32.Jorik1456291289 Sehr gut!
danach: Malware-Scan mit Emsisoft Anti-Malware Lade die Gratisversion von => Emsisoft Anti-Malware herunter und installiere das Programm. Lade über Jetzt Updaten die aktuellen Signaturen herunter. Wähle den Freeware-Modus aus. Wähle Detail Scan und starte über den Button Scan die Überprüfung des Computers. Am Ende des Scans nichts loeschen lassen!. Mit Klick auf Bericht speichern das Logfile auf dem Desktop speichern und hier in den Thread posten. Anleitung: http://www.trojaner-board.de/103809-...i-malware.html
__________________ --> System verseucht mit Trojan.Win32.Jorik1456291289 |
27.08.2012, 17:18 | #7 |
| System verseucht mit Trojan.Win32.Jorik1456291289Code:
ATTFilter Emsisoft Anti-Malware - Version 6.6 Letztes Update: 8/27/2012 5:34:11 PM Scan Einstellungen: Scan Methode: Detail Scan Objekte: Rootkits, Speicher, Traces, C:, D: Archiv Scan: An ADS Scan: An Scan Beginn: 8/27/2012 5:35:43 PM c:usersasdappdataroamingwindrvconfig.txt gefunden: Trace.File.agent!E1 Gescannt 574144 Gefunden 1 Scan Ende: 8/27/2012 6:07:15 PM Scan Zeit: 0:31:32 c:usersasdappdataroamingwindrvconfig.txt Quarantäne Trace.File.agent!E1 Quarantäne 1 Code:
ATTFilter AdwCleaner v1.801 - Logfile created 08/27/2012 at 17:22:49 # Updated 14/08/2012 by Xplode # Operating system : Windows 7 Home Premium Service Pack 1 (64 bits) # User : ask - ask-PC # Boot Mode : Normal # Running from : C:UsersaskDesktopadwcleaner.exe # Option [Delete] ***** [Services] ***** ***** [Files / Folders] ***** Folder Deleted : C:UsersaskAppDataLocalLowAskToolbar Folder Deleted : C:UsersaskAppDataRoamingOpenCandy Folder Deleted : C:UsersaskAppDataRoamingMozillaFirefoxProfilesbnwkr520.defaultextensionstoolbar@ask.com Folder Deleted : C:ProgramDataAsk Folder Deleted : C:Program Files (x86)Ask.com Folder Deleted : C:windowsInstaller{86D4B82A-ABED-442A-BE86-96357B70F4FE} File Deleted : C:UsersaskAppDataRoamingMozillaFirefoxProfilesbnwkr520.defaultsearchpluginsAskcom.xml ***** [Registry] ***** Key Deleted : HKCUSoftwareAPN Key Deleted : HKCUSoftwareAppDataLowSoftwareAskToolbar Key Deleted : HKCUSoftwareAsk.com Key Deleted : HKCUSoftwareMicrosoftWindowsCurrentVersionUninstall{79A765E1-C399-405B-85AF-466F52E918B0} Key Deleted : HKLMSOFTWAREAPN Key Deleted : HKLMSOFTWAREAskToolbar Key Deleted : HKLMSOFTWAREClassesAppIDGenericAskToolbar.DLL Key Deleted : HKLMSOFTWAREClassesGenericAskToolbar.ToolbarWnd Key Deleted : HKLMSOFTWAREClassesGenericAskToolbar.ToolbarWnd.1 Key Deleted : HKLMSOFTWAREClassesInstallerFeaturesA28B4D68DEBAA244EB686953B7074FEF Key Deleted : HKLMSOFTWAREClassesInstallerProductsA28B4D68DEBAA244EB686953B7074FEF Key Deleted : HKLMSOFTWAREMicrosoftWindowsCurrentVersionUninstall{86D4B82A-ABED-442A-BE86-96357B70F4FE} [x64] Key Deleted : HKLMSOFTWAREMicrosoftWindowsCurrentVersionInstallerUserDataS-1-5-18ProductsA28B4D68DEBAA244EB686953B7074FEF ***** [Registre - GUID] ***** Key Deleted : HKLMSOFTWAREClassesAppID{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874} Key Deleted : HKLMSOFTWAREClassesInterface{6C434537-053E-486D-B62A-160059D9D456} Key Deleted : HKLMSOFTWAREClassesInterface{91CF619A-4686-4CA4-9232-3B2E6B63AA92} Key Deleted : HKLMSOFTWAREClassesInterface{AC71B60E-94C9-4EDE-BA46-E146747BB67E} Key Deleted : HKLMSOFTWAREClassesTypeLib{2996F0E7-292B-4CAE-893F-47B8B1C05B56} Key Deleted : HKCUSoftwareMicrosoftInternet ExplorerLow RightsElevationPolicy{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A} Key Deleted : HKLMSOFTWAREMicrosoftInternet ExplorerLow RightsElevationPolicy{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A} Key Deleted : HKCUSoftwareMicrosoftWindowsCurrentVersionExtSettings{D4027C7F-154A-4066-A1AD-4243D8127440} Key Deleted : HKCUSoftwareMicrosoftWindowsCurrentVersionExtStats{D4027C7F-154A-4066-A1AD-4243D8127440} [x64] Key Deleted : HKLMSOFTWAREClassesInterface{6C434537-053E-486D-B62A-160059D9D456} [x64] Key Deleted : HKLMSOFTWAREClassesInterface{91CF619A-4686-4CA4-9232-3B2E6B63AA92} [x64] Key Deleted : HKLMSOFTWAREClassesInterface{AC71B60E-94C9-4EDE-BA46-E146747BB67E} ***** [Internet Browsers] ***** -\ Internet Explorer v9.0.8112.16421 [OK] Registry is clean. -\ Mozilla Firefox v14.0.1 (de) Profile name : default File : C:UsersaskAppDataRoamingMozillaFirefoxProfilesbnwkr520.defaultprefs.js Deleted : user_pref("extensions.asktb.ff-original-keyword-url", ""); -\ Google Chrome v17.0.963.79 File : C:UsersaskAppDataLocalGoogleChromeUser DataDefaultPreferences [OK] File is clean. ************************* AdwCleaner[R1].txt - [4921 octets] - [26/08/2012 12:53:12] AdwCleaner[S1].txt - [3610 octets] - [27/08/2012 17:22:49] ########## EOF - C:AdwCleaner[S1].txt - [3738 octets] ########## submitter » gnopaster | imprint « imprint » Terms of use « © 2004-201 |
27.08.2012, 20:05 | #8 |
/// Helfer-Team | System verseucht mit Trojan.Win32.Jorik1456291289 Sehr gut! Deinstalliere: Emsisoft Anti-Malware ESET Online Scanner Vorbereitung
|
27.08.2012, 22:17 | #9 |
| System verseucht mit Trojan.Win32.Jorik1456291289Code:
ATTFilter ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6583 # api_version=3.0.2 # EOSSerial=67c5f05bcc2d284197c072a0a34b90f6 # end=finished # remove_checked=true # archives_checked=true # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2012-08-27 09:09:54 # local_time=2012-08-27 11:09:54 (+0100, Mitteleuropäische Sommerzeit) # country="Germany" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=5121 16777213 100 75 3634574 11320385 0 0 # compatibility_mode=5893 16776574 66 94 2860329 97724739 0 0 # compatibility_mode=8192 67108863 100 0 204 204 0 0 # scanned=133579 # found=1 # cleaned=1 # scan_time=6905 D:ask-PCBackup Set 2012-06-24 190006Backup Files 2012-07-08 190003Backup files 3.zip Win32/InstallCore.K application (deleted - quarantined) 00000000000000000000000000000000 C |
28.08.2012, 18:54 | #10 |
/// Helfer-Team | System verseucht mit Trojan.Win32.Jorik1456291289 Java aktualisieren Dein Java ist nicht mehr aktuell. Älter Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.
Dann so einstellen: http://www.trojaner-board.de/105213-...tellungen.html Danach poste (kopieren und einfuegen) mir, was du hier angezeigt bekommst: PluginCheck |
28.08.2012, 19:57 | #11 |
| System verseucht mit Trojan.Win32.Jorik1456291289Code:
ATTFilter Firefox 14.0.1 ist aktuell Flash (11,4,402,265) ist aktuell. Java (1,7,0,6) ist aktuell. Adobe Reader 10,1,4,38 ist aktuell. |
29.08.2012, 03:04 | #12 |
/// Helfer-Team | System verseucht mit Trojan.Win32.Jorik1456291289 Sehr gut! damit bist Du sauber und entlassen! adwCleaner entfernen
Tool-Bereinigung mit OTL Wir werden nun die CleanUp!-Funktion von OTL nutzen, um die meisten Programme, die wir zur Bereinigung installiert haben, wieder von Deinem System zu löschen.
Zurücksetzen der Sicherheitszonen Lasse die Sicherheitszonen wieder zurücksetzen, da diese manipuliert wurden um den Browser für weitere Angriffe zu öffnen. Gehe dabei so vor: http://www.trojaner-board.de/111805-...ecksetzen.html Systemwiederherstellungen leeren Damit der Rechner nicht mit einer infizierten Systemwiederherstellung erneut infiziert werden kann, muessen wir diese leeren. Dazu schalten wir sie einmal aus und dann wieder ein: Systemwiederherstellung deaktivieren Tutorial fuer Windows XP, Windows Vista, Windows 7 Danach wieder aktivieren. Aufräumen mit CCleaner Lasse mit CCleaner (Download) (Anleitung) Fehler in der
Lektuere zum abarbeiten: http://www.trojaner-board.de/90880-d...tallation.html http://www.trojaner-board.de/105213-...tellungen.html PluginCheck http://www.trojaner-board.de/96344-a...-rechners.html Secunia Online Software Inspector http://www.trojaner-board.de/71715-k...iendungen.html http://www.trojaner-board.de/83238-a...sschalten.html PC wird immer langsamer - was tun? |
29.08.2012, 12:16 | #13 |
| System verseucht mit Trojan.Win32.Jorik1456291289 Danke für die Hilfe. |
Themen zu System verseucht mit Trojan.Win32.Jorik1456291289 |
anhang, befinden, bild, compu, computer, datei, extras.txt, facebook, freundin, home, otl.txt, system, troja, verseucht, windows, windows 7, windows 7 home |