Hallo habe seit 2 wochen schon auf mein Pc den Trojaner TR/Vundo.AH und TR/Vundo.Gen? könnt ihr mir sagen wie ich den entfernen kann?

Hallo.


Erstellung eines Hijacklog

Poste als erstes ein Hijacklog, wie es erstellt wird findest du im Anleitungsforum.
ACHTUNG:
Bitte durchsuche das Log-File nach persönlichen Informationen, wie z.B. deinen Realname, und editiere diese, bevor Du es postest.
Alle Links im Log-File sollten wie folgt editiert werden -> z.B. h**p://trojaner-board.de. Einfach, damit niemand auf die Idee kommt, auf die Links zu klicken.

Sunny

habe ein Hijacklog erstellt! was muss ich jetzt machen?

Logfile of HijackThis v1.99.1
Scan saved at 13:18:27, on 24.03.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Programme\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
C:\Programme\MSI\Bluetooth Software\bin\btwdins.exe
c:\programme\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Java\j2re1.4.2_03\bin\jusched.exe
C:\Programme\Outlook Express\MSIMN.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Analog Devices\SoundMAX\SMax4PNP.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Programme\Lexmark X1100 Series\lxbkbmgr.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\Programme\Lexmark X1100 Series\lxbkbmon.exe
C:\Programme\CyberLink\PowerDVD\DVDLauncher.exe
C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe
C:\Programme\iTunes\iTunesHelper.exe
C:\Programme\QuickTime\qttask.exe
C:\Programme\iPod\bin\iPodService.exe
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
C:\Programme\HP\HP Software Update\HPWuSchd2.exe
C:\Programme\Gemeinsame Dateien\PCSuite\DataLayer\DataLayer.exe
C:\PROGRA~1\GEMEIN~1\PCSuite\Services\SERVIC~1.EXE
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Programme\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Programme\BearFlix\BearFlix.exe
C:\Programme\AntiVir PersonalEdition Classic\avcenter.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Programme\MSN Messenger\msnmsgr.exe
C:\Programme\Skype\Phone\Skype.exe
C:\Programme\MSI\Bluetooth Software\BTTray.exe
C:\Programme\HP\Digital Imaging\bin\hpqtra08.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Palm\HOTSYNC.EXE
C:\Programme\Messenger\msmsgs.exe
c:\programme\mcafee.com\agent\mcagent.exe
C:\Programme\HP\Digital Imaging\bin\hpqimzone.exe
C:\Programme\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\msiexec.exe
C:\Dokumente und Einstellungen\Ursula\Desktop\FixVundo.exe
C:\Programme\Opera\Opera.exe
C:\Programme\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://www.euro.dell.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = h**p://search.bearshare.com/sidebar.html?src=ssb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = h**p://google.icq.com/search/search_frame.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://google.icq.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://google.bearshare.com/de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = h**p://de.rd.yahoo.com/customize/ie/defaults/sb/ymsgr6/us/*h**p://www.yahoo.com/ext/search/search.html
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = h**p://www.euro.dell.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Arcor AG & Co. KG
R3 - URLSearchHook: (no name) - {1CBF31FC-3C23-4BA6-AF16-2CEC501BD837} - (no file)
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll
O3 - Toolbar: &VSAdd-in - {74DD705D-6834-439C-A735-A6DBE2677452} - C:\Programme\VSAdd-in\VSAdd-in.dll (file missing)
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Programme\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Programme\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [Camera Detector] C:\PROGRA~1\ACDSYS~1\CAMDET~1.EXE
O4 - HKLM\..\Run: [ScanRegistry] C:\W
O4 - HKLM\..\Run: [AccG160] C:\PROGRA~1\WLANQU~1\AccG160.exe
O4 - HKLM\..\Run: [WLAN Quick-Starter] "C:\Programme\WLAN Quick-Starter\WLAN Quick-Starter.exe" -update
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Programme\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programme\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [HP Software Update] C:\Programme\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [DataLayer] C:\Programme\Gemeinsame Dateien\PCSuite\DataLayer\DataLayer.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Programme\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray
O4 - HKLM\..\Run: [BearFlix] "C:\Programme\BearFlix\BearFlix.exe" /pause
O4 - HKLM\..\Run: [ICQ Lite] "C:\Programme\ICQLite\ICQLite.exe" -minimize
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [CleanUp] C:\PROGRA~1\McAfee.com\Shared\mcappins.exe /v=3 /cleanup
O4 - HKLM\..\Run: [SoundService] rundll32.exe "C:\WINDOWS\system32\bdmhfyfe.dll",setvm
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Programme\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\PROGRA~1\MESSEN~1\Msmsgs.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Programme\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Programme\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Photosmart Premier – Schnellstart.lnk = C:\Programme\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Manager HotSync.lnk = C:\Palm\HOTSYNC.EXE
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: eBay Startseite - {8B69DB2E-015D-4c4f-B97E-95EF5326BDA8} - h**p://adfarm.mediaplex.com/ad/ck/707-1170-5704-51?RedirectEnter&partner=36420&loc=h**p://www.ebay.de (file missing)
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Organizzatore ricerche - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Encarta Researcher\EROPROJ.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\MSI\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\MSI\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra button: eBay - {C1514B92-E6E2-4be8-B93C-8A44D1F3011F} - C:\Programme\Supreme Auction\ebay.url (HKCU)
O9 - Extra button: Supreme Auction - {DFE4453A-65DF-47d5-BF37-3D0FD37FBDBB} - C:\Programme\Supreme Auction\SupremeAuction.exe (HKCU)
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - h**p://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - h**p://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - h**p://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - h**p://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/PhtPkMSN.cab
O16 - DPF: {A1F2F2CE-06AF-483C-9F12-D3BAA72477D6} (BatchDownloader Class) - h**p://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/DigWXMSN.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - h**p://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Boonty Games - BOONTY - C:\Programme\Gemeinsame Dateien\BOONTY Shared\Service\Boonty.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Programme\MSI\Bluetooth Software\bin\btwdins.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Programme\Kerio\Personal Firewall 4\kpf4ss.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\programme\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Programme\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

Arbeite das hier ab:

1.) Fixe mit HijackThis folgende Einträge:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = h**p://search.bearshare.com/sidebar.html?src=ssb
R3 - URLSearchHook: (no name) - {1CBF31FC-3C23-4BA6-AF16-2CEC501BD837} - (no file)
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: &VSAdd-in - {74DD705D-6834-439C-A735-A6DBE2677452} - C:\Programme\VSAdd-in\VSAdd-in.dll (file missing)
O9 - Extra button: eBay Startseite - {8B69DB2E-015D-4c4f-B97E-95EF5326BDA8} - h**p://adfarm.mediaplex.com/ad/ck/707-1170-5704-51?RedirectEnter&partner=36420&l oc=h**p://www.ebay.de (file missing)

2.) Dateien Online überprüfen lassen:

* Suche die Seite Virtustotal auf, klicke auf den Button „Durchsuchen“ und suche folgende Datei/Dateien:
(lass auch die versteckten Dateien anzeigen!)

C:\WINDOWS\system32\bdmhfyfe.dll

* Lade nun nacheinander jede/alle Datei/Dateien hoch, und warte bis der Scan vorbei ist. (kann bis zu 2 Minuten dauern.)
* Poste im Anschluss das Ergebnis der Auswertung, alles abkopieren und in einen Beitrag einfügen.
(Wichtig: Auch die Größenangabe sowie den HASH mit kopieren!)


3.) Arbeiten mit MWAV (eScan)

* Lies dir folgende Anleitung genau durch und arbeite sie ab:
-> Anleitung eScan
* Wichtig: Poste im Anschluss das Ergebnis mit Hilfe der “find.bat”.
(steht alles ganz genau in der Anleitung.)

Nach alledem nochmal ein neues Hijacklog posten.

Gruß
Sunny

Das ist die Auswertung von VirusTotal:

Complete scanning result of "bdmhfyfe.dll", received in VirusTotal at 03.24.2007, 14:25:33 (CET).
Antivirus Version Update Result
AhnLab-V3 2007.3.24.1 03.24.2007 Win-Trojan/Virtumod.123972
AntiVir 7.3.1.44 03.23.2007 TR/Vundo.Gen
Authentium 4.93.8 03.23.2007 no virus found
Avast 4.7.936.0 03.23.2007 no virus found
AVG 7.5.0.447 03.23.2007 no virus found
BitDefender 7.2 03.24.2007 no virus found
CAT-QuickHeal 9.00 03.23.2007 no virus found
ClamAV devel-20070312 03.24.2007 no virus found
DrWeb 4.33 03.24.2007 Trojan.Virtumod
eSafe 7.0.14.0 03.22.2007 no virus found
eTrust-Vet 30.6.3506 03.23.2007 no virus found
Ewido 4.0 03.24.2007 no virus found
FileAdvisor 1 03.24.2007 no virus found
Fortinet 2.85.0.0 03.24.2007 suspicious
F-Prot 4.3.1.45 03.23.2007 no virus found
F-Secure 6.70.13030.0 03.24.2007 no virus found
Ikarus T3.1.1.3 03.24.2007 no virus found
Kaspersky 4.0.2.24 03.24.2007 no virus found
McAfee 4991 03.23.2007 no virus found
Microsoft 1.2306 03.24.2007 no virus found
NOD32v2 2142 03.24.2007 no virus found
Norman 5.80.02 03.23.2007 no virus found
Panda 9.0.0.4 03.24.2007 Spyware/Virtumonde
Prevx1 V2 03.24.2007 no virus found
Sophos 4.15.0 03.23.2007 no virus found
Sunbelt 2.2.907.0 03.24.2007 no virus found
Symantec 10 03.24.2007 no virus found
TheHacker 6.1.6.080 03.23.2007 no virus found
UNA 1.83 03.16.2007 no virus found
VBA32 3.11.2 03.24.2007 no virus found
VirusBuster 4.3.7:9 03.23.2007 no virus found
Webwasher-Gateway 6.0.1 03.24.2007 Trojan.Vundo.Gen

Aditional Information
File size: 123972 bytes
MD5: 57577cb34e9e692ec55649da5ccc1780
SHA1: ca68a1e6daa9c4c11c13eb18d12d22affe0c2963

Hi,

versuche eine Bereinigung mit smitfraudfix oder mit vundofix. Scheint sich um eine recht neue Variante bei dir zu handeln, daher k. A. ob die tools anschlagen. Fahre dann fort, wie Sunny beschrieben hat, also escan, log der find.bat posten, neues HJT-log und berichte, was sich auf der Kiste tut. Gruß ordell

Auswertung von eScan:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Header
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Microsoft Windows XP [Version 5.1.2600]
Sat Mar 24 16:05:12 2007 => Version 9.1.7 (C:\DOKUME~1\Ursula\LOKALE~1\Temp\mexe.com)
Sat Mar 24 16:01:24 2007 => Virus Database Date: 3/23/2007
Sat Mar 24 16:04:25 2007 => Virus Database Date: 3/24/2007
Sat Mar 24 18:11:25 2007 => Virus Database Date: 3/24/2007
Sat Mar 24 18:18:25 2007 => Virus Database Date: 3/24/2007
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Infektionsmeldungen
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Sat Mar 24 16:07:05 2007 => System found infected with aureate/radiate Spyware/Adware (advert.dll)! Action taken: Entries Removed.
Sat Mar 24 16:07:26 2007 => System found infected with wareout Adware (1.dat)! Action taken: Entries Removed.
Sat Mar 24 16:07:26 2007 => System found infected with wareout Adware (2.dat)! Action taken: Entries Removed.
Sat Mar 24 16:07:26 2007 => System found infected with wareout Adware (3.dat)! Action taken: Entries Removed.
Sat Mar 24 16:07:26 2007 => System found infected with grokster Spyware/Adware (agentins.ui)! Action taken: Entries Removed.
Sat Mar 24 16:07:26 2007 => System found infected with grokster Spyware/Adware (agentver.ini)! Action taken: Entries Removed.
Sat Mar 24 16:07:26 2007 => System found infected with grokster Spyware/Adware (agnticfg.ini)! Action taken: Entries Removed.
Sat Mar 24 16:07:26 2007 => System found infected with grokster Spyware/Adware (agoemver.ini)! Action taken: Entries Removed.
~~~~~~~~~~~
Dateien
~~~~~~~~~~~
~~~~ Infected files
~~~~~~~~~~~
Sat Mar 24 16:15:04 2007 => File C:\Dokumente und Einstellungen\Ursula\Lokale Einstellungen\Anwendungsdaten\Identities\{C3F3B318-5797-41A3-A9F0-B0BC43C48550}\Microsoft\Outlook Express\Gelöschte Objekte.dbx/[From:"Bundeskriminalamt BKA" <Abteilung91542@bka.de>][Subject:Ermittlungsverfahre... infected by "Trojan-Downloader.Win32.Nurech.aa" Virus! Action Taken: No Action Taken.
Sat Mar 24 16:15:06 2007 => File C:\Dokumente und Einstellungen\Ursula\Lokale Einstellungen\Anwendungsdaten\Identities\{C3F3B318-5797-41A3-A9F0-B0BC43C48550}\Microsoft\Outlook Express\Gesendete Objekte.dbx/[From:"Ursula Stoll" <ustoll@arcor.de>][Subject:Fw: Ermittlungsverfahren Nr. 18491... infected by "Trojan-Downloader.Win32.Nurech.aa" Virus! Action Taken: No Action Taken.
Sat Mar 24 17:49:55 2007 => File C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP0\A0000015.exe infected by "Backdoor.Win32.Netbus.160.a" Virus! Action Taken: File Deleted.
Sat Mar 24 17:52:26 2007 => File C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP4\A0001284.dll infected by "Trojan.Win32.BHO.g" Virus! Action Taken: File Deleted.
Sat Mar 24 17:52:28 2007 => File C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP4\A0001291.dll infected by "Trojan-Spy.Win32.VBStat.h" Virus! Action Taken: File Deleted.
Sat Mar 24 18:05:04 2007 => File C:\WINDOWS\KeyHook.dll.vir infected by "Backdoor.Win32.Netbus.160.a" Virus! Action Taken: File Deleted.
~~~~~~~~~~~
~~~~ Tagged files
~~~~~~~~~~~
Sat Mar 24 17:52:25 2007 => File C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP4\A0001283.dll tagged as "not-a-virus:AdWare.Win32.Agent.at". Action Taken: File Deleted.
Sat Mar 24 17:52:27 2007 => File C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP4\A0001290.dll//Virtumonde//PE_Patch.UPX//UPX tagged as "not-a-virus:AdWare.Win32.Virtumonde.fl". Action Taken: File Deleted.
Sat Mar 24 17:53:48 2007 => File C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP4\A0003713.dll//Virtumonde//PE_Patch.UPX//UPX tagged as "not-a-virus:AdWare.Win32.Virtumonde.fl". Action Taken: File Deleted.
Sat Mar 24 17:53:49 2007 => File C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP4\A0003714.exe tagged as "not-a-virus:AdWare.Win32.Agent.at". Action Taken: File Deleted.
Sat Mar 24 17:53:49 2007 => File C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP4\A0003724.dll tagged as "not-a-virus:AdWare.Win32.Virtumonde.hl". Action Taken: File Deleted.
Sat Mar 24 17:53:51 2007 => File C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP4\A0005730.dll tagged as "not-a-virus:AdWare.Win32.Aureate.a". Action Taken: File Deleted.
Sat Mar 24 17:54:07 2007 => File C:\VundoFix Backups\efcdaxw.dll.bad tagged as "not-a-virus:AdWare.Win32.Virtumonde.hl". Action Taken: File Deleted.
Sat Mar 24 17:54:07 2007 => File C:\VundoFix Backups\mlljj.dll.bad//Virtumonde//PE_Patch.UPX//UPX tagged as "not-a-virus:AdWare.Win32.Virtumonde.fl". Action Taken: File Deleted.
Sat Mar 24 17:54:08 2007 => File C:\VundoFix Backups\ohedgrfj.exe.bad tagged as "not-a-virus:AdWare.Win32.Agent.at". Action Taken: File Deleted.
Sat Mar 24 18:08:53 2007 => File C:\WINDOWS\SYSTEM32\ebokvptv.dll tagged as "not-a-virus:AdWare.Win32.Virtumonde.hb". Action Taken: File Deleted.
~~~~~~~~~~~
~~~~ Offending files
~~~~~~~~~~~
Sat Mar 24 16:07:05 2007 => Offending file found: C:\WINDOWS\system32\advert.dll
Sat Mar 24 16:07:26 2007 => Offending file found: C:\DOKUME~1\Ursula\LOKALE~1\ANWEND~1\hp\DIGITA~1\cache\1.dat
Sat Mar 24 16:07:26 2007 => Offending file found: C:\DOKUME~1\Ursula\LOKALE~1\ANWEND~1\hp\DIGITA~1\cache\2.dat
Sat Mar 24 16:07:26 2007 => Offending file found: C:\DOKUME~1\Ursula\LOKALE~1\ANWEND~1\hp\DIGITA~1\cache\3.dat
Sat Mar 24 16:07:26 2007 => Offending file found: C:\DOKUME~1\Ursula\LOKALE~1\temp\DELLVS~1.TMP\agentins.ui
Sat Mar 24 16:07:26 2007 => Offending file found: C:\DOKUME~1\Ursula\LOKALE~1\temp\DELLVS~1.TMP\agentver.ini
Sat Mar 24 16:07:26 2007 => Offending file found: C:\DOKUME~1\Ursula\LOKALE~1\temp\DELLVS~1.TMP\agnticfg.ini
Sat Mar 24 16:07:26 2007 => Offending file found: C:\DOKUME~1\Ursula\LOKALE~1\temp\DELLVS~1.TMP\agoemver.ini
~~~~~~~~~~~
Ordner
~~~~~~~~~~~
Sat Mar 24 16:07:05 2007 => Offending Folder found: C:\Programme\password-finder
Sat Mar 24 16:07:45 2007 => Offending Folder found: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\password-finder
~~~~~~~~~~~
Registry
~~~~~~~~~~~
Sat Mar 24 16:07:00 2007 => Offending Key found: HKLM\Software\aureate !!!
Sat Mar 24 16:07:00 2007 => Offending Key found: HKLM\Software\magnet !!!
Sat Mar 24 16:07:00 2007 => Offending Key found: HKCU\Software\aureate !!!
Sat Mar 24 16:07:02 2007 => Offending Key found: HKCU\\magnet !!!
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Statistiken:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~