|
Log-Analyse und Auswertung: BKA-TrojanerWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
30.11.2013, 15:37 | #1 |
| BKA-Trojaner Hi habe nen Bka Trojaner die frst.txt datei habe ich schon erstellt =). Bitte um hilfe =). FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 30-11-2013 Ran by SYSTEM on MININT-05LMLAM on 30-11-2013 15:18:13 Running from G:\ Windows 7 Starter Service Pack 1 (X86) OS Language: German Standard Internet Explorer Version 10 Boot Mode: Recovery The current controlset is ControlSet001 ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log. ==================== Registry (Whitelisted) ================== HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [10025576 2011-02-10] (Realtek Semiconductor) HKLM\...\Run: [SuiteTray] - C:\Program Files\EgisTec MyWinLockerSuite\x86\SuiteTray.exe [340848 2011-04-02] (Egis Technology Inc.) HKLM\...\Run: [EgisTecPMMUpdate] - C:\Program Files\EgisTec IPS\PmmUpdate.exe [408432 2011-03-28] (Egis Technology Inc.) HKLM\...\Run: [EgisUpdate] - C:\Program Files\EgisTec IPS\EgisUpdate.exe [202608 2011-03-28] (Egis Technology Inc.) HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] () HKLM\...\Run: [LManager] - C:\Program Files\Launch Manager\LManager.exe [1103440 2011-06-30] (Dritek System Inc.) HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1934632 2010-10-08] (Synaptics Incorporated) HKLM\...\Run: [Power Management] - C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [715368 2011-05-10] (Acer Incorporated) HKLM\...\Run: [iSyncData] - C:\Program Files\Acer\Android Manager\iSync.exe [408128 2011-05-09] (Insyde Software Corp.) HKLM\...\Run: [AndroidManager] - C:\Program Files\Acer\Android Manager\AML.exe [508992 2011-05-09] () HKLM\...\Run: [iPatchData] - C:\Program Files\Acer\Updater\iUpdate.exe [492096 2011-05-09] (Insyde Software Corp.) HKLM\...\Run: [AVMWlanClient] - C:\Program Files\avmwlanstick\FRITZWLANMini.exe [283136 2007-02-02] (AVM Berlin) HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated) HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.) HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [681032 2013-10-07] (Avira Operations GmbH & Co. KG) HKU\Default\...\RunOnce: [ScrSav] - C:\Program Files\Acer\Screensaver\run_Acer.exe [ 2010-07-29] () HKU\Default User\...\RunOnce: [ScrSav] - C:\Program Files\Acer\Screensaver\run_Acer.exe [ 2010-07-29] () HKU\Katrin Brandes\...\Run: [Facebook Update] - C:\Users\Katrin Brandes\AppData\Local\Facebook\Update\FacebookUpdate.exe [ 2012-07-15] (Facebook Inc.) HKU\Katrin Brandes\...\Run: [IExplorer Util] - C:\Users\Katrin Brandes\AppData\Roaming\ie_util.exe AppInit_DLLs: c:\progra~2\browse~1\23796~1.11\{16cdf~1\browse~1.dll [ ] () Startup: C:\Users\Katrin Brandes\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b89o9e.lnk ShortcutTarget: b89o9e.lnk -> C:\ProgramData\e9o98b.dss (Корпорация Майкрософт) ========================== Services (Whitelisted) ================= S2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440392 2013-10-07] (Avira Operations GmbH & Co. KG) S2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440392 2013-10-07] (Avira Operations GmbH & Co. KG) S4 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1164360 2013-10-07] (Avira Operations GmbH & Co. KG) S3 EgisTec Ticket Service; C:\Program Files\Common Files\EgisTec\Services\EgisTicketService.exe [173424 2011-04-02] (Egis Technology Inc. ) S2 ePowerSvc; C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe [739944 2011-05-10] (Acer Incorporated) S2 GREGService; C:\Program Files\Acer\Registration\GREGsvc.exe [29696 2011-05-25] (Acer Incorporated) S2 IconMan_R; C:\Program Files\Realtek\Realtek PCIE Card Reader\RIconMan.exe [1755136 2011-03-07] (Realsil Microelectronics Inc.) S2 RS_Service; C:\Program Files\Acer\Acer VCM\RS_Service.exe [260640 2010-01-29] (Acer Incorporated) S2 SpyHunter 4 Service; C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe [770432 2013-10-18] (Enigma Software Group USA, LLC.) S2 Winmgmt; C:\ProgramData\e9o98b.dss [189952 2013-11-26] (Корпорация Майкрософт) S2 GFilterSvc; C:\Windows\System32\GFilterSvc.exe [x] S2 mounuvol; C:\Windows\system32\RtsPTtorIcon.exe [x] ==================== Drivers (Whitelisted) ==================== S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [89376 2013-10-07] (Avira Operations GmbH & Co. KG) S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [137208 2013-10-07] (Avira Operations GmbH & Co. KG) S1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-10-07] (Avira Operations GmbH & Co. KG) S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [4352 2007-01-25] (AVM Berlin) S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [19984 2012-06-22] () S3 FWLANUSB; C:\Windows\System32\DRIVERS\fwlanusb.sys [265088 2007-01-25] (AVM GmbH) S1 mwlPSDFilter; C:\Windows\System32\DRIVERS\mwlPSDFilter.sys [21600 2011-07-26] (Egis Technology Inc.) S1 mwlPSDNServ; C:\Windows\System32\DRIVERS\mwlPSDNServ.sys [16936 2011-07-26] (Egis Technology Inc.) S1 mwlPSDVDisk; C:\Windows\System32\DRIVERS\mwlPSDVDisk.sys [62240 2011-07-26] (Egis Technology Inc.) S3 NETwNs32; C:\Windows\System32\DRIVERS\NETwNs32.sys [7435264 2011-01-03] (Intel Corporation) S3 RSPCIESTOR; C:\Windows\System32\DRIVERS\RtsPStor.sys [252520 2011-03-06] (Realtek Semiconductor Corp.) S1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-08-05] (Avira GmbH) ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-11-30 15:18 - 2013-11-30 15:18 - 00000000 ____D C:\FRST 2013-11-30 05:49 - 2013-11-30 05:49 - 00000000 ____H C:\Windows\System32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf 2013-11-30 05:42 - 2013-11-30 05:42 - 00000000 ____D C:\Program Files\HitmanPro 2013-11-30 05:35 - 2013-11-30 05:35 - 00000000 ____D C:\ProgramData\HitmanPro 2013-11-30 05:15 - 2013-11-30 05:15 - 00000000 ____D C:\b3b12c690c765685a3a2fee9 2013-11-26 14:49 - 2013-11-26 14:49 - 00002268 _____ C:\Users\Katrin Brandes\Desktop\SpyHunter.lnk 2013-11-26 14:49 - 2013-11-26 14:49 - 00000000 ____D C:\sh4ldr 2013-11-26 14:49 - 2013-11-26 14:49 - 00000000 ____D C:\Program Files\Enigma Software Group 2013-11-26 14:48 - 2013-11-26 14:48 - 00000000 ____D C:\Program Files\Common Files\Wise Installation Wizard 2013-11-26 14:28 - 2013-11-30 05:11 - 00000273 _____ C:\ProgramData\b89o9e.reg 2013-11-26 14:27 - 2013-11-30 06:00 - 95025368 ____T C:\ProgramData\b89o9e.bxx 2013-11-26 14:27 - 2013-11-30 06:00 - 00000000 _____ C:\ProgramData\b89o9e.fvv 2013-11-26 14:27 - 2013-11-26 14:27 - 00189952 _____ (Корпорация Майкрософт) C:\ProgramData\e9o98b.dss 2013-11-26 14:13 - 2013-11-26 14:13 - 00000000 ____D C:\Users\Katrin Brandes\restore 2013-11-26 14:10 - 2013-11-26 14:24 - 00000000 ____D C:\ProgramData\tmp 2013-11-26 14:10 - 2013-11-26 14:10 - 00001151 _____ C:\Users\Public\Desktop\Pixum Fotobuch.lnk 2013-11-26 14:10 - 2013-11-26 14:10 - 00000000 ____D C:\ProgramData\hps 2013-11-26 14:03 - 2013-11-26 14:03 - 00000000 ____D C:\Program Files\Pixum ==================== One Month Modified Files and Folders ======= 2013-11-30 15:18 - 2013-11-30 15:18 - 00000000 ____D C:\FRST 2013-11-30 06:00 - 2013-11-26 14:27 - 95025368 ____T C:\ProgramData\b89o9e.bxx 2013-11-30 06:00 - 2013-11-26 14:27 - 00000000 _____ C:\ProgramData\b89o9e.fvv 2013-11-30 05:59 - 2009-07-13 20:39 - 00099222 _____ C:\Windows\setupact.log 2013-11-30 05:50 - 2011-10-29 20:53 - 01388725 _____ C:\Windows\WindowsUpdate.log 2013-11-30 05:50 - 2009-07-13 20:34 - 00016160 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-11-30 05:50 - 2009-07-13 20:34 - 00016160 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-11-30 05:49 - 2013-11-30 05:49 - 00000000 ____H C:\Windows\System32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf 2013-11-30 05:42 - 2013-11-30 05:42 - 00000000 ____D C:\Program Files\HitmanPro 2013-11-30 05:35 - 2013-11-30 05:35 - 00000000 ____D C:\ProgramData\HitmanPro 2013-11-30 05:18 - 2011-12-29 07:29 - 00000000 ____D C:\users\Katrin Brandes 2013-11-30 05:16 - 2013-09-14 14:20 - 00000000 ____D C:\Windows\System32\MRT 2013-11-30 05:15 - 2013-11-30 05:15 - 00000000 ____D C:\b3b12c690c765685a3a2fee9 2013-11-30 05:15 - 2012-01-04 12:14 - 80340640 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe 2013-11-30 05:11 - 2013-11-26 14:28 - 00000273 _____ C:\ProgramData\b89o9e.reg 2013-11-26 14:49 - 2013-11-26 14:49 - 00002268 _____ C:\Users\Katrin Brandes\Desktop\SpyHunter.lnk 2013-11-26 14:49 - 2013-11-26 14:49 - 00000000 ____D C:\sh4ldr 2013-11-26 14:49 - 2013-11-26 14:49 - 00000000 ____D C:\Program Files\Enigma Software Group 2013-11-26 14:48 - 2013-11-26 14:48 - 00000000 ____D C:\Program Files\Common Files\Wise Installation Wizard 2013-11-26 14:48 - 2010-11-20 13:01 - 01513970 _____ C:\Windows\System32\PerfStringBackup.INI 2013-11-26 14:27 - 2013-11-26 14:27 - 00189952 _____ (Корпорация Майкрософт) C:\ProgramData\e9o98b.dss 2013-11-26 14:24 - 2013-11-26 14:10 - 00000000 ____D C:\ProgramData\tmp 2013-11-26 14:13 - 2013-11-26 14:13 - 00000000 ____D C:\Users\Katrin Brandes\restore 2013-11-26 14:10 - 2013-11-26 14:10 - 00001151 _____ C:\Users\Public\Desktop\Pixum Fotobuch.lnk 2013-11-26 14:10 - 2013-11-26 14:10 - 00000000 ____D C:\ProgramData\hps 2013-11-26 14:03 - 2013-11-26 14:03 - 00000000 ____D C:\Program Files\Pixum 2013-11-10 20:50 - 2012-02-17 23:19 - 00230048 ____N (Microsoft Corporation) C:\Windows\System32\MpSigStub.exe Files to move or delete: ==================== C:\ProgramData\b89o9e.bxx C:\ProgramData\b89o9e.fvv C:\ProgramData\b89o9e.reg C:\ProgramData\e9o98b.dss Some content of TEMP: ==================== C:\Users\Katrin Brandes\AppData\Local\Temp\amrtomp3converter_setup.exe C:\Users\Katrin Brandes\AppData\Local\Temp\AskSLib.dll C:\Users\Katrin Brandes\AppData\Local\Temp\avgnt.exe C:\Users\Katrin Brandes\AppData\Local\Temp\jre-7u9-windows-i586-iftw.exe C:\Users\Katrin Brandes\AppData\Local\Temp\SHSetup.exe C:\Users\Katrin Brandes\AppData\Local\Temp\SkypeSetup.exe C:\Users\Katrin Brandes\AppData\Local\Temp\uninst1.exe C:\Users\Katrin Brandes\AppData\Local\Temp\~tmf6612087998965225447.dll ==================== Known DLLs (Whitelisted) ============ ==================== Bamital & volsnap Check ================= C:\Windows\explorer.exe => MD5 is legit C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit ==================== EXE ASSOCIATION ===================== HKLM\...\.exe: exefile => OK HKLM\...\exefile\DefaultIcon: %1 => OK HKLM\...\exefile\open\command: "%1" %* => OK ==================== Restore Points ========================= 21 Restore point made on: 2013-06-30 05:11:46 Restore point made on: 2013-07-17 09:18:58 Restore point made on: 2013-07-17 09:27:16 Restore point made on: 2013-07-17 09:32:33 Restore point made on: 2013-07-17 09:32:35 Restore point made on: 2013-07-17 09:32:40 Restore point made on: 2013-07-19 13:03:01 Restore point made on: 2013-07-19 13:48:57 Restore point made on: 2013-07-22 02:58:10 Restore point made on: 2013-08-04 03:07:03 Restore point made on: 2013-08-08 10:41:57 Restore point made on: 2013-09-14 14:05:28 Restore point made on: 2013-09-14 14:19:08 Restore point made on: 2013-09-24 08:16:44 Restore point made on: 2013-10-07 05:17:03 Restore point made on: 2013-10-17 09:34:08 Restore point made on: 2013-10-17 10:21:52 Restore point made on: 2013-10-26 01:38:23 Restore point made on: 2013-11-26 13:55:43 Restore point made on: 2013-11-30 05:15:34 Restore point made on: 2013-11-30 05:50:05 ==================== Memory info =========================== Percentage of memory in use: 49% Total physical RAM: 1011.87 MB Available physical RAM: 514.55 MB Total Pagefile: 1011.87 MB Available Pagefile: 518.25 MB Total Virtual: 2047.88 MB Available Virtual: 1941.96 MB ==================== Drives ================================ Drive c: (Acer) (Fixed) (Total:280.89 GB) (Free:239.53 GB) NTFS Drive e: () (Fixed) (Total:4.1 GB) (Free:2.59 GB) FAT32 Drive f: (PQSERVICE) (Fixed) (Total:13 GB) (Free:2.82 GB) NTFS Drive g: (HITMANPRO) (Removable) (Total:29.45 GB) (Free:29.45 GB) FAT32 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS Drive y: (SYSTEM RESERVED) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)] ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298 GB) (Disk ID: D3330E16) Partition 1: (Not Active) - (Size=13 GB) - (Type=27) Partition 2: (Not Active) - (Size=4 GB) - (Type=0C) Partition 3: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 4: (Not Active) - (Size=281 GB) - (Type=OF Extended) ======================================================== Disk: 1 (Size: 29 GB) (Disk ID: 34C741B1) Partition 1: (Active) - (Size=29 GB) - (Type=0C) LastRegBack: 2013-07-17 09:10 ==================== End Of Log ============================ Danke schonmal im voraus =). |
30.11.2013, 16:17 | #2 |
/// the machine /// TB-Ausbilder | BKA-Trojaner hi,
__________________Drücke bitte die + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter Startup: C:\Users\Katrin Brandes\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b89o9e.lnk ShortcutTarget: b89o9e.lnk -> C:\ProgramData\e9o98b.dss (Корпорация Майкрософт) S2 Winmgmt; C:\ProgramData\e9o98b.dss [189952 2013-11-26] (Корпорация Майкрософт) C:\ProgramData\b89o9e.bxx C:\ProgramData\b89o9e.fvv C:\ProgramData\b89o9e.reg C:\ProgramData\e9o98b.dss
Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier. Rechner normal starten.
__________________ |
30.11.2013, 16:43 | #3 |
| BKA-Trojaner Das ging ja fix =).
__________________Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 30-11-2013 Ran by SYSTEM at 2013-11-30 16:45:53 Run:1 Running from G:\ Boot Mode: Recovery ============================================== Content of fixlist: ***************** Startup: C:\Users\Katrin Brandes\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b89o9e.lnk ShortcutTarget: b89o9e.lnk -> C:\ProgramData\e9o98b.dss (?????????? ??????????) S2 Winmgmt; C:\ProgramData\e9o98b.dss [189952 2013-11-26] (?????????? ??????????) C:\ProgramData\b89o9e.bxx C:\ProgramData\b89o9e.fvv C:\ProgramData\b89o9e.reg C:\ProgramData\e9o98b.dss ***************** C:\Users\Katrin Brandes\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b89o9e.lnk => Moved successfully. C:\ProgramData\e9o98b.dss => Moved successfully. Winmgmt => Service restored successfully. C:\ProgramData\b89o9e.bxx => Moved successfully. C:\ProgramData\b89o9e.fvv => Moved successfully. C:\ProgramData\b89o9e.reg => Moved successfully. "C:\ProgramData\e9o98b.dss" => File/Directory not found. ==== End of Fixlog ==== |
01.12.2013, 10:17 | #4 |
/// the machine /// TB-Ausbilder | BKA-Trojaner Kontrollscans im normalen Modus: Downloade Dir bitte Malwarebytes Anti-Malware
Downloade Dir bitte AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit (Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
01.12.2013, 13:17 | #5 |
| BKA-Trojaner Ich hab jetzt die Daten die ich brauchte gesichert und wollte Win 7 drauf spielen. Geht das so in Ordnung oder soll ich trotzdem das von dir beschriebene weiter machen? |
02.12.2013, 10:25 | #6 |
/// the machine /// TB-Ausbilder | BKA-Trojaner Wenn Du Neuaufsetzen willst brauchste das nimmer machen
__________________ --> BKA-Trojaner |
Themen zu BKA-Trojaner |
.dll, acer, adobe, antivir, association, avg, avira, converter, desktop, esgscanner.sys, explorer, explorer.exe, installation, launch, microsoft, opera, pmmupdate.exe, realtek, registry, scan, services.exe, software, stick, svchost.exe, system, temp, trojaner, usb, winlogon.exe |