| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Hilfe ich habe ein Problem mit Virtumonde und wie bekomm ich es wegWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
16.07.2008, 12:04
| #1 |
| |  Hilfe ich habe ein Problem mit Virtumonde und wie bekomm ich es weg Hallo, ich hoffe mir kann hier bitte jemand ausführlich erklären wie ich virtumonde von meinen PC entfernen kann. Hab schon bei google etwas nachgelesen aber das hat mich nicht wirklich weiter geholfen. Also ich habe spybot und er findet virtumonde (virtumonde.dll, auch aber wenn ich mein PC neu starte kommt virtumonde sofort wieder. Auch wenn ich 2x hintereinander denn Suchlauf von spybot aktiviere ist es schon wieder da. Aber wenn ich denn suchlauf nicht starte und das Problem virtumonde nicht behebe und so ins Internet gehe kann ich einige Internetseiten nicht mehr öffnen auf denen ich öfter bin. Außerdem hab ich wahrscheinlich auch durch virtumonde das Problem dass mein Explorer wenn ich mein PC starte total viel Arbeitspeicher beansprucht und der pc voll langsam wirt. Mein Betriebssytem ist Windows XP, aber von Pfadangaben hab ich leider keine Ahnung wie bekomm ich die heraus?!? Bitte helft mir ausführlich bei diesem Problem da ich mich auch nicht 100% mit dem PC auskenne!!! MfG Znake |
|
16.07.2008, 12:07
| #2 |
  |  Hilfe ich habe ein Problem mit Virtumonde und wie bekomm ich es weg Hi Znake und
__________________ Bitte erstelle als erstes ein HijackThis Logfile  Bitte lass Malwarebytes laufen, lass alles löschen was er findet und poste das Log
__________________ |
|
18.07.2008, 18:18
| #3 |
| | Hilfe ich habe ein Problem mit Virtumonde und wie bekomm ich es weg Hallo trojan-death,
__________________hier sind einmal die HijackThis Logfile und Malwarebytes Anti-Malware Daten HiJackThis Logfile Code:
ATTFilter Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 17:20:26, on 18.07.2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Programme\Alwil Software\Avast4\aswUpdSv.exe C:\Programme\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\svchost.exe C:\Programme\Alwil Software\Avast4\ashMaiSv.exe C:\Programme\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\SOUNDMAN.EXE C:\Programme\Java\jre1.6.0_05\bin\jusched.exe D:\Programme\Winamp\winampa.exe C:\Programme\SyncroSoft\Pos\H2O\cledx.exe C:\Programme\ScanSoft\OmniPageSE4.0\OpwareSE4.exe D:\Programme\iTunes\iTunesHelper.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Programme\RocketDock\RocketDock.exe C:\Programme\Google\Google Desktop Search\GoogleDesktop.exe D:\Programme\Veoh Networks\Veoh\VeohClient.exe C:\Programme\Windows Media Player\WMPNSCFG.exe C:\Programme\Google\Google Desktop Search\GoogleDesktop.exe C:\Programme\iPod\bin\iPodService.exe C:\WINDOWS\system32\rundll32.exe C:\Programme\ICQ6\ICQ.exe C:\WINDOWS\system32\rundll32.exe D:\Programme\Spybot - Search & Destroy\SpybotSD.exe C:\Programme\Mozilla Firefox\firefox.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\taskmgr.exe C:\Dokumente und Einstellungen\Björn\Desktop\Virtumonde - Bekämpfung\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://google.icq.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.prosieben.de/index.php?icqpath=icq R3 - URLSearchHook: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file) O3 - Toolbar: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file) O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Programme\Canon\Easy-WebPrint\Toolband.dll O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - D:\Programme\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [SpywareTerminator] "D:\Programme\Spyware Terminator\SpywareTerminatorShield.exe" O4 - HKLM\..\Run: [WinampAgent] D:\Programme\Winamp\winampa.exe O4 - HKLM\..\Run: [H2O] C:\Programme\SyncroSoft\Pos\H2O\cledx.exe O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Programme\Gemeinsame Dateien\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot O4 - HKLM\..\Run: [OpwareSE4] "C:\Programme\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "D:\Programme\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [BMd70b72b6] Rundll32.exe "C:\WINDOWS\system32\paoqdrey.dll",s O4 - HKLM\..\Run: [d438412a] rundll32.exe "C:\WINDOWS\system32\fycxcvrh.dll",b O4 - HKLM\..\RunOnce: [Spybot - Search & Destroy] "D:\Programme\Spybot - Search & Destroy\SpybotSD.exe" /autocheck O4 - HKLM\..\RunOnce: [SpybotDeletingA8753] command /c del "C:\WINDOWS\system32\awtutuSl.dll" O4 - HKLM\..\RunOnce: [SpybotDeletingC6811] cmd /c del "C:\WINDOWS\system32\awtutuSl.dll" O4 - HKCU\..\Run: [RocketDock] "C:\Programme\RocketDock\RocketDock.exe" O4 - HKCU\..\Run: [Google Desktop Search] "C:\Programme\Google\Google Desktop Search\GoogleDesktop.exe" /startup O4 - HKCU\..\Run: [Veoh] "D:\Programme\Veoh Networks\Veoh\VeohClient.exe" /VeohHide O4 - HKCU\..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\WMPNSCFG.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: &ICQ Toolbar Search - res://D:\Programme\ICQToolbar\toolbaru.dll/SEARCH.HTML O8 - Extra context menu item: Easy-WebPrint - Drucken - res://C:\Programme\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html O8 - Extra context menu item: Easy-WebPrint - Schnelldruck - res://C:\Programme\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html O8 - Extra context menu item: Easy-WebPrint - Vorschau - res://C:\Programme\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html O8 - Extra context menu item: Easy-WebPrint - Zu Druckliste hinzufügen - res://C:\Programme\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\Programme\ICQLite\ICQLite.exe (file missing) O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\Programme\ICQLite\ICQLite.exe (file missing) O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programme\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Programme\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Programme\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Programme\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - D:\Music\MAGIX\Common\Database\bin\fbserver.exe O23 - Service: GoogleDesktopManager - Google - C:\Programme\Google\Google Desktop Search\GoogleDesktop.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Programme\iPod\bin\iPodService.exe O23 - Service: NMIndexingService - Nero AG - C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: Spyware Terminator Clam Service (sp_clamsrv) - Crawler.com - C:\Programme\WinClamAVShield\sp_clamsrv.exe O23 - Service: UPnPService - Magix AG - C:\Programme\Gemeinsame Dateien\MAGIX Shared\UPnPService\UPnPService.exe -- End of file - 8925 bytes Malwarebytes Anti-Malware Code:
ATTFilter Malwarebytes' Anti-Malware 1.20
Datenbank Version: 964
Windows 5.1.2600 Service Pack 2
19:05:00 18.07.2008
mbam-log-7-18-2008 (19-05-00).txt
Scan Art: Komplett Scan (C:\|D:\|E:\|K:\|)
Objekte gescannt: 163003
Scan Dauer: 1 hour(s), 2 minute(s), 5 second(s)
Infizierte Speicher Prozesse: 0
Infizierte Speicher Module: 2
Infizierte Registrierungsschlüssel: 10
Infizierte Registrierungswerte: 21
Infizierte Datei Objekte der Registrierung: 2
Infizierte Verzeichnisse: 0
Infizierte Dateien: 71
Infizierte Speicher Prozesse:
(Keine Malware Objekte gefunden)
Infizierte Speicher Module:
C:\WINDOWS\system32\fycxcvrh.dll (Trojan.Vundo) -> Unloaded module successfully.
C:\WINDOWS\system32\awtutuSl.dll (Trojan.Vundo) -> Unloaded module successfully.
Infizierte Registrierungsschlüssel:
HKEY_CLASSES_ROOT\CLSID\{9a50b2af-3b2b-47dd-aecd-5d80a886f504} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9a50b2af-3b2b-47dd-aecd-5d80a886f504} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\awtutusl (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\syncrosoft emu (Adware.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{e3f6657a-57aa-46ef-b08c-74e60be0d363} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{6fc95eaf-4eab-473a-9c16-24162a7c56b5} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Trojan.Vundo) -> Quarantined and deleted successfully.
Infizierte Registrierungswerte:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d438412a (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingb147 (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingd4649 (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletinga5759 (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingc1129 (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{9a50b2af-3b2b-47dd-aecd-5d80a886f504} (Trojan.Vundo) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingb7831 (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingd2834 (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletinga8753 (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingc6811 (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletinga3078 (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingc8770 (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingb5140 (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingd785 (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletinga2763 (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingc6631 (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bmd70b72b6 (Trojan.Agent) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bf (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bk (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\iu (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\mu (Trojan.Agent) -> Quarantined and deleted successfully.
Infizierte Datei Objekte der Registrierung:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\yayywmmc -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowMyDocs (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
Infizierte Verzeichnisse:
(Keine Malware Objekte gefunden)
Infizierte Dateien:
C:\WINDOWS\system32\dacslxem.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mexlscad.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\datelbkv.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\vkbletad.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\elqgpsvq.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\qvspgqle.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\fycxcvrh.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\hrvcxcyf.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\lgclfhfa.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\afhflcgl.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mkxojegf.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\fgejoxkm.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\naqvclqq.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\qqlcvqan.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\nmspdjeb.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\bejdpsmn.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\qkkcfdna.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\andfckkq.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\xjlgbldy.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ydlbgljx.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\yayyWmMC.dll_old (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\CMmWyyay.ini (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\CMmWyyay.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\yhybnvcx.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\xcvnbyhy.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\yppcdaem.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\meadcppy.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\yscivibd.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\dbivicsy.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\awtutuSl.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\paoqdrey.dll_old (Trojan.Vundo) -> Delete on reboot.
C:\Dokumente und Einstellungen\Björn\Eigene Dateien\Daten\Neuer Ordner\MMHIPHOP2\addon\Firebird\setup.exe (Adware.Agent) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\Björn\Eigene Dateien\Daten\Neuer Ordner\MMHIPHOP2\addon\ods\setup.exe (Adware.Agent) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\Björn\Lokale Einstellungen\Temporary Internet Files\Content.IE5\GJ5PUVPX\CAHMQXGE (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\Björn\Lokale Einstellungen\Temporary Internet Files\Content.IE5\GPUNWTYV\kb671231[2] (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\Björn\Lokale Einstellungen\Temporary Internet Files\Content.IE5\ZWRDN1X6\CAUDMBM3 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\Björn\Lokale Einstellungen\Temporary Internet Files\Content.IE5\ZWRDN1X6\kb456456[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Programme\Syncrosoft\POS\H2O\Uninst.exe (Adware.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{7788FD14-876F-47C9-A850-9BDEAB400FCE}\RP311\A0068563.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{7788FD14-876F-47C9-A850-9BDEAB400FCE}\RP311\A0068566.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{7788FD14-876F-47C9-A850-9BDEAB400FCE}\RP311\A0068582.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{7788FD14-876F-47C9-A850-9BDEAB400FCE}\RP311\A0068603.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{7788FD14-876F-47C9-A850-9BDEAB400FCE}\RP311\A0068619.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{7788FD14-876F-47C9-A850-9BDEAB400FCE}\RP311\A0068621.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{7788FD14-876F-47C9-A850-9BDEAB400FCE}\RP311\A0068685.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{7788FD14-876F-47C9-A850-9BDEAB400FCE}\RP311\A0068687.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{7788FD14-876F-47C9-A850-9BDEAB400FCE}\RP312\A0068774.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{7788FD14-876F-47C9-A850-9BDEAB400FCE}\RP312\A0068776.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{7788FD14-876F-47C9-A850-9BDEAB400FCE}\RP314\A0069914.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{7788FD14-876F-47C9-A850-9BDEAB400FCE}\RP314\A0069928.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\eqqixsmk.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\jyopct.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\okbgmh.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\vfewcfsw.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
D:\Mai 2007\4 Internet\IE7\Update\Update_IE7_x86.exe (Rogue.Installer) -> Quarantined and deleted successfully.
D:\Mai 2007\5 Programme\Ahead.Nero.Premium.Edition.v7.8.5.0\nero_keygen.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
D:\Music\MAGIX\Common\Database\addoninstall.exe (Adware.Agent) -> Quarantined and deleted successfully.
D:\Music\MAGIX\Foto_Manager_2007\addoninstall.exe (Adware.Agent) -> Quarantined and deleted successfully.
D:\Music\MAGIX\MusicMakerHipHopEdition2\addoninstall.exe (Adware.Agent) -> Quarantined and deleted successfully.
D:\Music\MAGIX\Music_Manager_2007\addoninstall.exe (Adware.Agent) -> Quarantined and deleted successfully.
D:\Music\Steinberg\Cubase SX 3\open_cubasesx3_application_data_folder.exe (Adware.Agent) -> Quarantined and deleted successfully.
D:\Programme\Music\MAGIX\Goya_burnR\addoninstall.exe (Adware.Agent) -> Quarantined and deleted successfully.
D:\Programme\Music\MAGIX\Goya_burnR_mxcdr\addoninstall.exe (Adware.Agent) -> Quarantined and deleted successfully.
D:\Programme\Music\MAGIX\Online_Druck_Service\addoninstall.exe (Adware.Agent) -> Quarantined and deleted successfully.
D:\Programme\Musik\MAGIX\MusicStudio12deluxe\addoninstall.exe (Adware.Agent) -> Quarantined and deleted successfully.
D:\Programme\Musik\MAGIX\Music_Manager_2006\addoninstall.exe (Adware.Agent) -> Quarantined and deleted successfully.
D:\Programme\Musik\MAGIX\SamplitudeMusicStudio2008\addoninstall.exe (Adware.Agent) -> Quarantined and deleted successfully.
D:\Programme\Musik\MAGIX\Samplitude_SE_No9\addoninstall.exe (Adware.Agent) -> Quarantined and deleted successfully.
K:\Programme\Musik\MAGiX.Music.Studio.Deluxe.v12.DVD.ISO-TBE\MS12DLXE\addon\Firebird\setup.exe (Adware.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\BMd70b72b6.xml (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\BMd70b72b6.txt (Trojan.Vundo) -> Quarantined and deleted successfully.
MfG Znake |
|
19.07.2008, 10:55
| #4 | |||
| | Hilfe ich habe ein Problem mit Virtumonde und wie bekomm ich es weg Ok Hast du HijackThis vor Malwarebytes laufen lassen oder??? Bitte poste ein frisches Nun holst du dir The Avenger (Link ist in meiner Signatur) -Doppelklick auf The Avenger -im weissen Feld gibst du folgenden Text ein: Zitat:
-du wirst gefragt ob du das Script ausführen möchtest--->Ja -dann fragt er blablabla "do you want to reboot now?" --->Ja -Zum Schluss postest du den Inhalt der C:\Avenger text datei Nun fixt du bitte folgenden Einträge mit Hijackthis: Zitat:
Dasselbe mit RunScanner Bitte alle Logs immer mitposten.
__________________ Kein Support per PN Zitat:
|
|
| Themen zu Hilfe ich habe ein Problem mit Virtumonde und wie bekomm ich es weg |
| 100%, ahnung, entfernen, explorer, google, helft, internet, internetseite, keine ahnung, langsam, neu, nicht mehr, nicht mehr öffnen, problem, seite, seiten, speicher, spybot, suchlauf, total, virtumonde, virtumonde.dll, voll, windows, windows xp, wirklich, öffnen |
Linear-Darstellung
