| |
| |||||||
Log-Analyse und Auswertung: Crypt.ULPM.Gen2 Virus auf Vista Rechner mit 4 Benutzern / ein Benutzer blockiertWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
| |
24.08.2013, 16:37
| #1 |
 |  Crypt.ULPM.Gen2 Virus auf Vista Rechner mit 4 Benutzern / ein Benutzer blockiert Hallo Leo, anbei die Log files. Von dem Adwcleaner gibts zwei log files. Code:
ATTFilter
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 24-08-2013 01
Ran by Vera at 2013-08-24 17:18:20 Run:1
Running from C:\Users\Vera\Desktop
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
2013-08-21 16:40 - 2013-08-21 16:40 - 00163175 _____ C:\Users\Vera\AppData\Local\2433f433
C:\Users\Vera\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\runctf.lnk
HKCU\...\Run: [qcgce2mrvjq91kk1e7pnbb19m52fx] - C:\Users\Vera\AppData\Local\Temp\mgixfmgmdcxogorpr.exe [x] <===== ATTENTION
HKCU\...\Command Processor: "C:\Users\Vera\AppData\Local\Temp\mgixfmgmdcxogorpr.exe" <======= ATTENTION
*****************
C:\Users\Vera\AppData\Local\2433f433 => Moved successfully.
C:\Users\Vera\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\runctf.lnk => Moved successfully.
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\qcgce2mrvjq91kk1e7pnbb19m52fx => Value deleted successfully.
HKCU\Software\Microsoft\Command Processor\\AutoRun => Value deleted successfully.
==== End of Fixlog ====
Code:
ATTFilter # AdwCleaner v3.000 - Report created 24/08/2013 at 17:19:20
# Updated 20/08/2013 by Xplode
# Operating System : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# Username : admin - FOXEL01
# Running from : C:\Users\Vera\Desktop\adwcleaner.exe
# Option : Scan
***** [ Services ] *****
***** [ Files / Folders ] *****
Folder Found C:\Users\Karsten\Documents\Inbox
***** [ Shortcuts ] *****
***** [ Registry ] *****
Key Found : HKCU\Software\Conduit
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{35B8892D-C3FB-4D88-990D-31DB2EBD72BD}
Key Found : HKLM\SOFTWARE\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C}
Key Found : HKLM\SOFTWARE\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{93E3D79C-0786-48FF-9329-93BC9F6DC2B3}
Key Found : HKLM\Software\Conduit
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
***** [ Browsers ] *****
-\\ Internet Explorer v9.0.8112.16502
Setting Found : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page] - hxxp://search.conduit.com?SearchSource=10&ctid=CT2536373
-\\ Mozilla Firefox v5.0 (de)
[ File : C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\lra50n2l.default\prefs.js ]
[ File : C:\Users\Karsten\AppData\Roaming\Mozilla\Firefox\Profiles\qvovhlid.default\prefs.js ]
[ File : C:\Users\Vera\AppData\Roaming\Mozilla\Firefox\Profiles\y3wr0dwu.default\prefs.js ]
[ File : C:\Users\Vera_Luis\AppData\Roaming\Mozilla\Firefox\Profiles\r0hvvxp0.default\prefs.js ]
*************************
AdwCleaner[R0].txt - [1731 octets] - [24/08/2013 17:19:20]
########## EOF - \AdwCleaner\AdwCleaner[R0].txt - [1791 octets] ##########
--- --- --- AdwCleaner Logfile: Code:
ATTFilter # AdwCleaner v3.000 - Report created 24/08/2013 at 17:23:05
# Updated 20/08/2013 by Xplode
# Operating System : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# Username : admin - FOXEL01
# Running from : C:\Users\Vera\Desktop\adwcleaner.exe
# Option : Clean
***** [ Services ] *****
***** [ Files / Folders ] *****
Folder Deleted : C:\Users\Karsten\Documents\Inbox
***** [ Shortcuts ] *****
***** [ Registry ] *****
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{35B8892D-C3FB-4D88-990D-31DB2EBD72BD}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{93E3D79C-0786-48FF-9329-93BC9F6DC2B3}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKLM\Software\Conduit
***** [ Browsers ] *****
-\\ Internet Explorer v9.0.8112.16502
Setting Restored : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
-\\ Mozilla Firefox v5.0 (de)
[ File : C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\lra50n2l.default\prefs.js ]
[ File : C:\Users\Karsten\AppData\Roaming\Mozilla\Firefox\Profiles\qvovhlid.default\prefs.js ]
[ File : C:\Users\Vera\AppData\Roaming\Mozilla\Firefox\Profiles\y3wr0dwu.default\prefs.js ]
[ File : C:\Users\Vera_Luis\AppData\Roaming\Mozilla\Firefox\Profiles\r0hvvxp0.default\prefs.js ]
*************************
AdwCleaner[R0].txt - [1869 octets] - [24/08/2013 17:19:20]
AdwCleaner[S0].txt - [1756 octets] - [24/08/2013 17:23:05]
########## EOF - \AdwCleaner\AdwCleaner[S0].txt - [1816 octets] ##########
--- --- --- Code:
ATTFilter
SystemLook 30.07.11 by jpshortstuff
Log created at 17:29 on 24/08/2013 by admin
Administrator - Elevation successful
========== reg ==========
[HKEY_LOCAL_MACHINE\Software\Classes\*\shellex\ContextMenuHandlers]
(No values found)
[HKEY_LOCAL_MACHINE\Software\Classes\*\shellex\ContextMenuHandlers\7-Zip]
@="{23170F69-40C1-278A-1000-000100020000}"
[HKEY_LOCAL_MACHINE\Software\Classes\*\shellex\ContextMenuHandlers\BriefcaseMenu]
@="{85BBD920-42A0-1069-A2E4-08002B30309D}"
[HKEY_LOCAL_MACHINE\Software\Classes\*\shellex\ContextMenuHandlers\Cover Designer]
@="{73FCA462-9BD5-4065-A73F-A8E5F6904EF7}"
[HKEY_LOCAL_MACHINE\Software\Classes\*\shellex\ContextMenuHandlers\Open With]
@="{09799AFB-AD67-11d1-ABCD-00C04FC30936}"
[HKEY_LOCAL_MACHINE\Software\Classes\*\shellex\ContextMenuHandlers\Open With EncryptionMenu]
@="{A470F8CF-A1E8-4f65-8335-227475AA5C46}"
[HKEY_LOCAL_MACHINE\Software\Classes\*\shellex\ContextMenuHandlers\Sharing]
@="{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"
[HKEY_LOCAL_MACHINE\Software\Classes\*\shellex\ContextMenuHandlers\Shell Extension for Malware scanning]
@="{45AC2688-0253-4ED8-97DE-B5370FA7D48A}"
[HKEY_LOCAL_MACHINE\Software\Classes\*\shellex\ContextMenuHandlers\ShellExtension]
(No values found)
[HKEY_LOCAL_MACHINE\Software\Classes\*\shellex\ContextMenuHandlers\{100BD527-7304-4b7f-BEE2-26D97B04EBA4}]
(No values found)
[HKEY_LOCAL_MACHINE\Software\Classes\*\shellex\ContextMenuHandlers\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8}]
@="Start Menu Pin"
[HKEY_CURRENT_USER\Software\Classes\*\shellex\ContextMenuHandlers]
(Unable to open key - key not found)
========== regfind ==========
Searching for "mgixfmgmdcxogorpr"
[HKEY_USERS\S-1-5-21-2885789966-2947821499-3673554299-1006\Software\Classes\CLSID\{47288149-6742-9681-8167-807446041741}\InProcServer32]
@="C:\Users\Vera\AppData\Local\Temp\mgixfmgmdcxogorpr.dll"
[HKEY_USERS\S-1-5-21-2885789966-2947821499-3673554299-1006\Software\Classes\CLSID\{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}\InProcServer32]
@="C:\Users\Vera\AppData\Local\Temp\mgixfmgmdcxogorpr.dll"
[HKEY_USERS\S-1-5-21-2885789966-2947821499-3673554299-1006_Classes\CLSID\{47288149-6742-9681-8167-807446041741}\InProcServer32]
@="C:\Users\Vera\AppData\Local\Temp\mgixfmgmdcxogorpr.dll"
[HKEY_USERS\S-1-5-21-2885789966-2947821499-3673554299-1006_Classes\CLSID\{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}\InProcServer32]
@="C:\Users\Vera\AppData\Local\Temp\mgixfmgmdcxogorpr.dll"
Searching for " "
[HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache]
"C:\downloads\Tax2011Update187575.exe"="InstallScript Setup Launcher "
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\Plugin\Microsoft.PowerShell]
"ConfigXML"=" <PlugInConfiguration xmlns="hxxp://schemas.microsoft.com/wbem/wsman/1/config/PluginConfiguration" Name="microsoft.powershell" Filename="%windir%\system32\pwrshplugin.dll" SDKVersion="1" XmlRenderingType="text" > <InitializationParameters> <Param Name="PSVersion" Value="2.0"/> </InitializationParameters> <Resources> <Resource ResourceUri="hxxp://schemas.microsoft.com/powershell/microsoft.powershell" SupportsOptions="true" ExactMatch="true"> <Security xmlns="hxxp://schemas.microsoft.com/wbem/wsman/1/config/PluginConfiguration" Uri="hxxp://schemas.microsoft.com/powershell/microsoft.powershell" ExactMatch="true" Sddl="O:NSG:BAD:P(A;;GA;;;BA)S:P(AU;FA;GA;;;WD)(AU;SA;GXGW;;;WD)"/> <Capability Type="Shell"/> </Resource> </Res
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\WpdBusEnumRoot\UMB\2&37c186b&11&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_APPLE&PROD_IPOD&REV_1.62#000A27001B9240B3&0#]
"DeviceDesc"="iPod "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\WpdBusEnumRoot\UMB\2&37c186b&11&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_ROCKCHIP&PROD_USB_MP3&REV_1.00#USBV1.00&0#]
"DeviceDesc"="USB MP3 "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\WpdBusEnumRoot\UMB\2&37c186b&11&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_ROCKCHIP&PROD_USB__SD&REV_1.00#USBV1.00&1#]
"DeviceDesc"="USB SD "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\WpdBusEnumRoot\UMB\2&37c186b&11&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_SANDISK&PROD_CRUZER&REV_7.01#22046318D4C28694&0#]
"DeviceDesc"="Cruzer "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\WpdBusEnumRoot\UMB\2&37c186b&11&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_SANDISK&PROD_CRUZER&REV_8.01#2243701DDC4260B4&0#]
"DeviceDesc"="Cruzer "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\WpdBusEnumRoot\UMB\2&37c186b&11&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_TDK_LOR&PROD_TF10&REV_PMAP#07032CBC37208223&0#]
"DeviceDesc"="TF10 "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\WpdBusEnumRoot\UMB\2&37c186b&11&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_TDK_LOR&PROD_TF10&REV_PMAP#07032CBD1B511377&0#]
"DeviceDesc"="TF10 "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\WpdBusEnumRoot\UMB\2&37c186b&11&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_APPLE&PROD_IPOD&REV_1.62#000A27001B9240B3&0#]
"DeviceDesc"="iPod "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\WpdBusEnumRoot\UMB\2&37c186b&11&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_ROCKCHIP&PROD_USB_MP3&REV_1.00#USBV1.00&0#]
"DeviceDesc"="USB MP3 "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\WpdBusEnumRoot\UMB\2&37c186b&11&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_ROCKCHIP&PROD_USB__SD&REV_1.00#USBV1.00&1#]
"DeviceDesc"="USB SD "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\WpdBusEnumRoot\UMB\2&37c186b&11&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_SANDISK&PROD_CRUZER&REV_7.01#22046318D4C28694&0#]
"DeviceDesc"="Cruzer "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\WpdBusEnumRoot\UMB\2&37c186b&11&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_SANDISK&PROD_CRUZER&REV_8.01#2243701DDC4260B4&0#]
"DeviceDesc"="Cruzer "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\WpdBusEnumRoot\UMB\2&37c186b&11&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_TDK_LOR&PROD_TF10&REV_PMAP#07032CBC37208223&0#]
"DeviceDesc"="TF10 "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\WpdBusEnumRoot\UMB\2&37c186b&11&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_TDK_LOR&PROD_TF10&REV_PMAP#07032CBD1B511377&0#]
"DeviceDesc"="TF10 "
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&11&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_APPLE&PROD_IPOD&REV_1.62#000A27001B9240B3&0#]
"DeviceDesc"="iPod "
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&11&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_ROCKCHIP&PROD_USB_MP3&REV_1.00#USBV1.00&0#]
"DeviceDesc"="USB MP3 "
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&11&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_ROCKCHIP&PROD_USB__SD&REV_1.00#USBV1.00&1#]
"DeviceDesc"="USB SD "
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&11&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_SANDISK&PROD_CRUZER&REV_7.01#22046318D4C28694&0#]
"DeviceDesc"="Cruzer "
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&11&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_SANDISK&PROD_CRUZER&REV_8.01#2243701DDC4260B4&0#]
"DeviceDesc"="Cruzer "
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&11&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_TDK_LOR&PROD_TF10&REV_PMAP#07032CBC37208223&0#]
"DeviceDesc"="TF10 "
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\2&37c186b&11&STORAGE#VOLUME#1&19F7E59C&0&_??_USBSTOR#DISK&VEN_TDK_LOR&PROD_TF10&REV_PMAP#07032CBD1B511377&0#]
"DeviceDesc"="TF10 "
[HKEY_USERS\S-1-5-21-2885789966-2947821499-3673554299-1004\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache]
"C:\downloads\Tax2011Update187575.exe"="InstallScript Setup Launcher "
[HKEY_USERS\S-1-5-21-2885789966-2947821499-3673554299-1004_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache]
"C:\downloads\Tax2011Update187575.exe"="InstallScript Setup Launcher "
-= EOF =-
|
|
| Themen zu Crypt.ULPM.Gen2 Virus auf Vista Rechner mit 4 Benutzern / ein Benutzer blockiert |
| anwaltschaft, exp/cve-2012-1723.a.3818, farbar, farbar recovery scan tool, js/agent.480412, plug-in, tr/crypt.ulpm.gen2, tr/injector.lr.2, tr/injector.vg, tr/kazy.169263.1, tr/matsnu.eb.142, tr/spy.abvier.a, tr/spy.zbot.akt, tr/spy.zbot.alw |
Hybrid-Darstellung
