| |
| |||||||
Log-Analyse und Auswertung: worm win32 netboosterWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
| |
16.07.2008, 13:26
| #1 |
 |  worm win32 netbooster Hallo Allerseits, seit heute vormittag um 10Uhr habe ich probleme mit dem worm win32netbooster. hab etliches im netz dazu gelesen, aber bis jetzt hat nichts geholfen. ich habe auch HijackThis installiert und hier erstmal der logfile: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 14:04: VIRUS ALERT!, on 16.07.2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Programme\Intel\Wireless\Bin\EvtEng.exe C:\Programme\Intel\Wireless\Bin\S24EvMon.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\system32\spoolsv.exe C:\Programme\AntiVir PersonalEdition Classic\sched.exe C:\Programme\AntiVir PersonalEdition Classic\avguard.exe C:\Programme\TOSHIBA\ConfigFree\CFSvcs.exe C:\Programme\Intel\Wireless\Bin\RegSrvc.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\Programme\Toshiba\TOSHIBA Applet\TAPPSRV.exe C:\WINDOWS\System32\alg.exe C:\Programme\ATI Technologies\ATI.ACE\cli.exe C:\Programme\Synaptics\SynTP\SynTPEnh.exe C:\Programme\Synaptics\SynTP\Toshiba.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\AGRSMMSG.exe C:\Programme\Toshiba\Toshiba Applet\thotkey.exe C:\Programme\TOSHIBA\ConfigFree\NDSTray.exe C:\Programme\TOSHIBA\TOSHIBA Zoom-Dienstprogramm\SmoothView.exe C:\Programme\TOSHIBA\TOSHIBA Controls\TFncKy.exe C:\WINDOWS\system32\TDispVol.exe C:\Programme\TOSHIBA\Tvs\TvsTray.exe C:\Programme\Intel\Wireless\bin\ZCfgSvc.exe C:\Programme\TOSHIBA\ConfigFree\CFSServ.exe C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe C:\WINDOWS\system32\TPSBattM.exe C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe C:\WINDOWS\system32\ctfmon.exe C:\Programme\TOSHIBA\TOSCDSPD\toscdspd.exe C:\Programme\TOSHIBA\Bluetooth Monitor\BtMon2.exe C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe C:\Programme\ATI Technologies\ATI.ACE\cli.exe C:\Programme\ATI Technologies\ATI.ACE\cli.exe C:\WINDOWS\system32\cmd.exe C:\WINDOWS\explorer.exe C:\Programme\AntiVir PersonalEdition Classic\avnotify.exe C:\Programme\Enigma Software Group\SpyHunter\SpyHunter3.exe C:\Programme\BASE&E-PLUS\UMTS Modem Manager\UMTS Modem Manager.exe C:\Programme\Internet Explorer\iexplore.exe C:\Programme\Malwarebytes' Anti-Malware\mbam.exe C:\Programme\Trend Micro\HijackThis\HijackThis.exe C:\WINDOWS\system32\wbem\wmiprvse.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: QXK Olive - {FFC5E582-35C2-4451-BCA1-52FB7E7FD8F3} - C:\WINDOWS\kgxmotapdox.dll O3 - Toolbar: qndsfmao - {3BB35E2E-9AE6-4FDE-A691-9E5BDBD93044} - C:\WINDOWS\qndsfmao.dll O4 - HKLM\..\Run: [ATICCC] "C:\Programme\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [THotkey] C:\Programme\Toshiba\Toshiba Applet\thotkey.exe O4 - HKLM\..\Run: [TPSMain] TPSMain.exe O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe O4 - HKLM\..\Run: [SmoothView] C:\Programme\TOSHIBA\TOSHIBA Zoom-Dienstprogramm\SmoothView.exe O4 - HKLM\..\Run: [TFncKy] TFncKy.exe O4 - HKLM\..\Run: [TDispVol] TDispVol.exe O4 - HKLM\..\Run: [Tvs] C:\Programme\TOSHIBA\Tvs\TvsTray.exe O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Programme\Intel\Wireless\bin\ZCfgSvc.exe" O4 - HKLM\..\Run: [CFSServ.exe] CFSServ.exe -NoClient O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [DLCGCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCGtime.dll,_RunDLLEntry@16 O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\isuspm.exe" -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [SpyHunter Security Suite] C:\Programme\Enigma Software Group\SpyHunter\SpyHunter3.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [TOSCDSPD] C:\Programme\TOSHIBA\TOSCDSPD\toscdspd.exe O4 - HKCU\..\Run: [AdobeUpdater] C:\Programme\Gemeinsame Dateien\Adobe\Updater5\AdobeUpdater.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Bluetooth Monitor.lnk = ? O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe (file missing) O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe (file missing) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra button: eBay - {2D941D56-1B19-44AE-8CF5-08331A3B4CCF} - C:\Programme\Internet Explorer\Signup\ToshibaGotoEbay.exe (HKCU) O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.de/scan_de/scan8/oscan8.cab O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1182973245156 O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.new2.foto.com/ImageUploader4.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{54756C9C-FA94-4C20-B941-E77CF63AAAC1}: NameServer = 212.23.97.2 212.23.97.3 O17 - HKLM\System\CS1\Services\Tcpip\..\{54756C9C-FA94-4C20-B941-E77CF63AAAC1}: NameServer = 212.23.97.2 212.23.97.3 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL O21 - SSODL: kvxqmtre - {C24FAD66-0CD1-46A7-8D77-04CE11CC11CB} - C:\WINDOWS\kvxqmtre.dll O21 - SSODL: evgratsm - {F8B5771D-872C-4042-A7F3-9987EA87FA13} - C:\WINDOWS\evgratsm.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Programme\TOSHIBA\ConfigFree\CFSvcs.exe O23 - Service: dlcg_device - - C:\WINDOWS\system32\dlcgcoms.exe O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Programme\Intel\Wireless\Bin\EvtEng.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Programme\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Programme\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Programme\Toshiba\TOSHIBA Applet\TAPPSRV.exe O23 - Service: TuneUp Drive Defrag-Dienst (Beta) (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe nun hab ich auch noch malwarebyte Anti-Malware laufen lassen und auch hier folgenden bericht gekommen: Malwarebytes' Anti-Malware 1.20 Datenbank Version: 957 Windows 5.1.2600 Service Pack 2 14:13:21 16.07.2008 mbam-log-7-16-2008 (14-13-14).txt Scan Art: Komplett Scan (C:\|) Objekte gescannt: 140191 Scan Dauer: 1 hour(s), 53 minute(s), 31 second(s) Infizierte Speicher Prozesse: 0 Infizierte Speicher Module: 4 Infizierte Registrierungsschlüssel: 17 Infizierte Registrierungswerte: 3 Infizierte Datei Objekte der Registrierung: 15 Infizierte Verzeichnisse: 1 Infizierte Dateien: 11 Infizierte Speicher Prozesse: (Keine Malware Objekte gefunden) Infizierte Speicher Module: C:\WINDOWS\qndsfmao.dll (Trojan.FakeAlert) -> No action taken. C:\WINDOWS\kvxqmtre.dll (Trojan.FakeAlert) -> No action taken. C:\WINDOWS\evgratsm.dll (Trojan.FakeAlert) -> No action taken. C:\WINDOWS\kgxmotapdox.dll (Trojan.FakeAlert) -> No action taken. Infizierte Registrierungsschlüssel: HKEY_CLASSES_ROOT\TypeLib\{cbb0d146-0262-4d6f-85b0-9d0da2b23907} (Trojan.FakeAlert) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{3bb35e2e-9ae6-4fde-a691-9e5bdbd93044} (Trojan.FakeAlert) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{7608bb3f-ee8f-4210-b1ad-a164ebc2d057} (Trojan.FakeAlert) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{860ede00-0826-49ad-bbba-7c621aa563cb} (Trojan.FakeAlert) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{c24fad66-0cd1-46a7-8d77-04ce11cc11cb} (Trojan.FakeAlert) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{d0a07808-e239-496e-91c5-65fb8bfdf596} (Trojan.FakeAlert) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{701dd106-fe5e-432c-b20e-7d12980c6caf} (Trojan.FakeAlert) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{7d09a305-0b5b-49c5-a994-3f8bdffc82c5} (Trojan.FakeAlert) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{a2879adb-d8e4-440c-93e7-395a1114d8d0} (Trojan.FakeAlert) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{f8b5771d-872c-4042-a7f3-9987ea87fa13} (Trojan.FakeAlert) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\webvideo (Trojan.FakeAlert) -> No action taken. HKEY_CLASSES_ROOT\TypeLib\{45872a5c-e44a-4f74-a584-851626be0ee4} (Trojan.FakeAlert) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{ffc5e582-35c2-4451-bca1-52fb7e7fd8f3} (Trojan.FakeAlert) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ffc5e582-35c2-4451-bca1-52fb7e7fd8f3} (Trojan.FakeAlert) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VSPlugin (Trojan.FakeAlert) -> No action taken. HKEY_CLASSES_ROOT\qndsfmao.bplt (Trojan.FakeAlert) -> No action taken. HKEY_CLASSES_ROOT\qndsfmao.toolbar.1 (Trojan.FakeAlert) -> No action taken. Infizierte Registrierungswerte: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{3bb35e2e-9ae6-4fde-a691-9e5bdbd93044} (Trojan.FakeAlert) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\kvxqmtre (Trojan.FakeAlert) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\evgratsm (Trojan.FakeAlert) -> No action taken. Infizierte Datei Objekte der Registrierung: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page (Hijack.Homepage) -> Bad: (http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2) Good: (http://www.google.com/) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductId (Trojan.FakeAlert) -> Bad: (VIRUS ALERT!) Good: (76416-OEM-0011903-00111) -> No action taken. HKEY_CURRENT_USER\Control Panel\International\sTimeFormat (Trojan.FakeAlert) -> Bad: (HH:mm: VIRUS ALERT!) Good: (HH:mm:ss) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowControlPanel (Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowRun (Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowSearch (Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowHelp (Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowMyDocs (Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowMyComputer (Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuMorePrograms (Hijack.StartMenu) -> Bad: (1) Good: (0) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\StartMenuLogOff (Hijack.StartMenu) -> Bad: (1) Good: (0) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives (Hijack.Drives) -> Bad: (12) Good: (0) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoToolbarCustomize (Hijack.Explorer) -> Bad: (1) Good: (0) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetFolders (Hijack.Explorer) -> Bad: (1) Good: (0) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispCPL (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> No action taken. Infizierte Verzeichnisse: C:\Programme\PCHealthCenter (Trojan.Fakealert) -> No action taken. Infizierte Dateien: C:\Dokumente und Einstellungen\Stephan Sens\Lokale Einstellungen\Temp\dssc32.exe (Rogue.Installer) -> No action taken. C:\Programme\PCHealthCenter\1.exe (Trojan.Fakealert) -> No action taken. C:\Programme\PCHealthCenter\2.exe (Trojan.Agent) -> No action taken. C:\Programme\PCHealthCenter\4.exe (Trojan.Agent) -> No action taken. C:\WINDOWS\evwd.exe (Trojan.FakeAlert) -> No action taken. C:\Programme\PCHealthCenter\0.exe (Trojan.Fakealert) -> No action taken. C:\WINDOWS\qndsfmao.dll (Trojan.FakeAlert) -> No action taken. C:\WINDOWS\kvxqmtre.dll (Trojan.FakeAlert) -> No action taken. C:\WINDOWS\evgratsm.dll (Trojan.FakeAlert) -> No action taken. C:\WINDOWS\agpqlrfm.exe (Trojan.FakeAlert) -> No action taken. C:\WINDOWS\kgxmotapdox.dll (Trojan.FakeAlert) -> No action taken. Bitte sagt mir wie ich weiter verfahren soll.ich kann mit dem programm HijackThis nicht wirklich was anfangen.ich weiss lediglich,dass damit dateien gefixt werden können (was das auch immer heisst?gelöscht?), jedoch bin ich mir nicht sicher, ob wirklich alle daten die dort angezeigt werden auch wirklich gelöscht werden sollten, da einige dabei wie systemdateien aussehen, die wichtig für den rechnerbetrieb sind. Wäre schön,wenn ihr mir da weiterhelfen könntet, da mein rechner schon voll rum spinnt. MfG, Stephan |
|
16.07.2008, 13:40
| #2 |
| /// AVZ-Toolkit Guru   | worm win32 netbooster Hallo flocky.
__________________Anleitung Avenger (by swandog46) Lade dir das Tool Avenger und speichere es auf dem Desktop:
Code:
ATTFilter Folders to delete:
C:\Programme\PCHealthCenter
Überprüfe dein System danach abermals mit Anti-Malware; lasse alle Funde bereinigen! Danach folge eine Überprüfung mit SuperAntiSpyware. Dann poste bitte die beiden logs sowie ein frisches HJT logfile.
__________________ |
|
16.07.2008, 13:48
| #3 |
| | worm win32 netbooster ich werde gleich mal deinen anweisungen folgen.
__________________ich hab noch vorher schnell ne frage zu dem Malwarebytes programm.ich hab es noch geöffnet und sollte ich "ausgewähltes entfernen" noch durchführen? weil es ja schon 2h bei mir gedauert hat und das wäre schade,wenn ich das schließe,aber vorher nichts gemacht habe.habe halt lediglich den bericht hier erstmal gepostet. danke |
|
16.07.2008, 13:55
| #4 | |
| /// AVZ-Toolkit Guru | worm win32 netboosterZitat:
__________________ - Sämtliche Hilfestellungen im Forum werden ohne Gewährleistung oder Haftung gegeben - |
|
16.07.2008, 14:22
| #5 |
| | worm win32 netbooster neues logfile: Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Programme\Intel\Wireless\Bin\EvtEng.exe C:\Programme\Intel\Wireless\Bin\S24EvMon.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\NOTEPAD.EXE C:\WINDOWS\system32\spoolsv.exe C:\Programme\AntiVir PersonalEdition Classic\sched.exe C:\Programme\AntiVir PersonalEdition Classic\avguard.exe C:\Programme\TOSHIBA\ConfigFree\CFSvcs.exe C:\Programme\Intel\Wireless\Bin\RegSrvc.exe C:\WINDOWS\system32\svchost.exe C:\Programme\Toshiba\TOSHIBA Applet\TAPPSRV.exe C:\Programme\ATI Technologies\ATI.ACE\cli.exe C:\Programme\Synaptics\SynTP\SynTPEnh.exe C:\WINDOWS\RTHDCPL.EXE C:\Programme\Synaptics\SynTP\Toshiba.exe C:\WINDOWS\AGRSMMSG.exe C:\Programme\Toshiba\Toshiba Applet\thotkey.exe C:\Programme\TOSHIBA\ConfigFree\NDSTray.exe C:\Programme\TOSHIBA\TOSHIBA Zoom-Dienstprogramm\SmoothView.exe C:\WINDOWS\system32\wuauclt.exe C:\Programme\TOSHIBA\TOSHIBA Controls\TFncKy.exe C:\WINDOWS\system32\TDispVol.exe C:\Programme\TOSHIBA\Tvs\TvsTray.exe C:\Programme\Intel\Wireless\bin\ZCfgSvc.exe C:\Programme\TOSHIBA\ConfigFree\CFSServ.exe C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe C:\WINDOWS\system32\ctfmon.exe C:\Programme\TOSHIBA\TOSCDSPD\toscdspd.exe C:\WINDOWS\system32\TPSBattM.exe C:\Programme\TOSHIBA\Bluetooth Monitor\BtMon2.exe C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe C:\Programme\ATI Technologies\ATI.ACE\cli.exe C:\Programme\ATI Technologies\ATI.ACE\cli.exe C:\Programme\BASE&E-PLUS\UMTS Modem Manager\UMTS Modem Manager.exe C:\Programme\Internet Explorer\iexplore.exe C:\WINDOWS\system32\wuauclt.exe C:\Programme\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O4 - HKLM\..\Run: [ATICCC] "C:\Programme\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [THotkey] C:\Programme\Toshiba\Toshiba Applet\thotkey.exe O4 - HKLM\..\Run: [TPSMain] TPSMain.exe O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe O4 - HKLM\..\Run: [SmoothView] C:\Programme\TOSHIBA\TOSHIBA Zoom-Dienstprogramm\SmoothView.exe O4 - HKLM\..\Run: [TFncKy] TFncKy.exe O4 - HKLM\..\Run: [TDispVol] TDispVol.exe O4 - HKLM\..\Run: [Tvs] C:\Programme\TOSHIBA\Tvs\TvsTray.exe O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Programme\Intel\Wireless\bin\ZCfgSvc.exe" O4 - HKLM\..\Run: [CFSServ.exe] CFSServ.exe -NoClient O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [DLCGCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCGtime.dll, _RunDLLEntry@16 O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\isuspm.exe" -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [TOSCDSPD] C:\Programme\TOSHIBA\TOSCDSPD\toscdspd.exe O4 - HKCU\..\Run: [AdobeUpdater] C:\Programme\Gemeinsame Dateien\Adobe\Updater5\AdobeUpdater.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Bluetooth Monitor.lnk = ? O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe (file missing) O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe (file missing) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra button: eBay - {2D941D56-1B19-44AE-8CF5-08331A3B4CCF} - C:\Programme\Internet Explorer\Signup\ToshibaGotoEbay.exe (HKCU) O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.de/scan_de/scan8/oscan8.cab O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Con trols/en/x86/client/muweb_site.cab?1182973245156 O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.new2.foto.com/ImageUploader4.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{54756C9C-FA94-4C20-B9 41-E77CF63AAAC1}: NameServer = 212.23.97.2 212.23.97.3 O17 - HKLM\System\CS1\Services\Tcpip\..\{54756C9C-FA94-4C20-B9 41-E77CF63AAAC1}: NameServer = 212.23.97.2 212.23.97.3 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL O23 - Service: Adobe LM Service - Adobe Systems - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Programme\TOSHIBA\ConfigFree\CFSvcs.exe O23 - Service: dlcg_device - - C:\WINDOWS\system32\dlcgcoms.exe O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Programme\Intel\Wireless\Bin\EvtEng.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Programme\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Programme\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Programme\Toshiba\TOSHIBA Applet\TAPPSRV.exe O23 - Service: TuneUp Drive Defrag-Dienst (Beta) (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe dazu die auswertung vom AVENGER: ogfile of The Avenger Version 2.0, (c) by Swandog46 http://swandog46.geekstogo.com Platform: Windows XP ******************* Script file opened successfully. Script file read successfully. Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: Rootkit scan active. No rootkits found! Error: folder "C:\Programme\PCHealthCenter" not found! Deletion of folder "C:\Programme\PCHealthCenter" failed! Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND) --> the object does not exist Completed script processing. ******************* Finished! Terminate. jetzt werde ich noch das von dir empfohlene SUPERAntiSpyware durchlaufen lassen und poste dann nochmal alles. |
|
16.07.2008, 14:23
| #6 |
| /// AVZ-Toolkit Guru | worm win32 netbooster Magst du das bitte nochmal editieren?! Da fehlt der Kopf und die komischen Leerzeilen sind äußerst störend beim Überblicken.. [EDIT] Und poste bitte auch das Anti-Malware und SUPERAntiSpyware log.
__________________ --> worm win32 netbooster |
|
17.07.2008, 13:31
| #7 |
| | worm win32 netbooster Hallo undoreal, hast du noch weitere anweisungen für mich? hab heute noch gut zeit, da ich krank bin und könnte heute nachmittag noch viel schaffen. mfg, flocky |
|
17.07.2008, 15:16
| #8 |
| /// AVZ-Toolkit Guru | worm win32 netbooster Führe bitte folgendes Skript mit AVZ aus (File -> Custom Skript): Code:
ATTFilter begin
RegKeyDel('HKLM','SOFTWARE\Microsoft\Code Store Database\Distribution Units\{6E5E167B-1566-4316-B27F-0DDAB3484CF7}');
RegKeyDel('HKLM','SOFTWARE\Microsoft\Code Store Database\Distribution Units\{67DABFBF-D0AB-41FA-9C46-CC0F21721616}');
QuarantineFile('C:\WINDOWS\system32\pdfcmnnt.dll','');
DelBHO('{2670000A-7350-4f3c-8081-5663EE0C6C49}');
BC_DeleteFile('C:\WINDOWS\System32\Drivers\a38m9wu7.SYS');
DeleteFile('C:\Programme\DivX\DivX Web Player\npdivx32.dll');
DeleteFile('C:\WINDOWS\Downloaded Program Files\ImageUploader4.ocx');
end.
__________________ - Sämtliche Hilfestellungen im Forum werden ohne Gewährleistung oder Haftung gegeben - |
|
17.07.2008, 15:53
| #9 |
| | worm win32 netbooster Durchgeführt! log: AVZ Antiviral Toolkit log; AVZ version is 4.30 Scanning started at 17.07.2008 16:50:36 Database loaded: signatures - 176618, NN profile(s) - 2, microprograms of healing - 56, signature database released 16.07.2008 18:11 Heuristic microprograms loaded: 370 SPV microprograms loaded: 9 Digital signatures of system files loaded: 71502 Heuristic analyzer mode: Medium heuristics level Healing mode: disabled Windows version: 5.1.2600, Service Pack 2 ; AVZ is launched with administrator rights System Restore: Disabled 1. Searching for Rootkits and programs intercepting API functions 1.1 Searching for user-mode API hooks Analysis: kernel32.dll, export table found in section .text Analysis: ntdll.dll, export table found in section .text Analysis: user32.dll, export table found in section .text Analysis: advapi32.dll, export table found in section .text Analysis: ws2_32.dll, export table found in section .text Analysis: wininet.dll, export table found in section .text Analysis: rasapi32.dll, export table found in section .text Analysis: urlmon.dll, export table found in section .text Analysis: netapi32.dll, export table found in section .text 1.2 Searching for kernel-mode API hooks Driver loaded successfully SDT found (RVA=08A500) Kernel ntoskrnl.exe found in memory at address 804D7000 SDT = 80561500 KiST = 804E48B0 (284) Function NtConnectPort (1F) intercepted (805A8C64->AA89AEB0), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted Function NtCreateFile (25) intercepted (8057E500->AA897870), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted Function NtCreateKey (29) intercepted (80576D63->AA8A2700), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted Function NtCreatePort (2E) intercepted (80594D80->AA89B270), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted Function NtCreateProcess (2F) intercepted (805C0020->AA8A1500), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted Function NtCreateProcessEx (30) intercepted (8058B3BC->AA8A1730), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted Function NtCreateSection (32) intercepted (8056CE25->AA8A5090), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted Function NtCreateThread (35) intercepted (8058559A->F7DC588C), hook not defined Function NtCreateWaitablePort (38) intercepted (805B9E48->AA89B350), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted Function NtDeleteFile (3E) intercepted (805E3EEA->AA897EF0), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted Function NtDeleteKey (3F) intercepted (80593B81->AA8A3720), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted Function NtDeleteValueKey (41) intercepted (805927D8->AA8A3360), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted Function NtDuplicateObject (44) intercepted (80580714->AA8A1270), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted Function NtEnumerateKey (47) intercepted (80577ED8->F75E484E), hook C:\WINDOWS\system32\Drivers\sptd.sys Function NtEnumerateValueKey (49) intercepted (80587881->F75E4BEE), hook C:\WINDOWS\system32\Drivers\sptd.sys Function NtLoadKey (62) intercepted (805DF2F6->AA8A3A60), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted Function NtOpenFile (74) intercepted (8057E674->AA897D40), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted Function NtOpenKey (77) intercepted (80571CBC->F75DF090), hook C:\WINDOWS\system32\Drivers\sptd.sys Function NtOpenProcess (7A) intercepted (80580BA8->F7DC5878), hook not defined Function NtOpenThread (80) intercepted (805AE1FD->F7DC587D), hook not defined Function NtQueryKey (A0) intercepted (80577AD8->F75E4CC6), hook C:\WINDOWS\system32\Drivers\sptd.sys Function NtQueryValueKey (B1) intercepted (80572100->F75E4B46), hook C:\WINDOWS\system32\Drivers\sptd.sys Function NtRenameKey (C0) intercepted (806543FF->AA8A41D0), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted Function NtReplaceKey (C1) intercepted (806548F2->AA8A3D50), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted Function NtRequestWaitReplyPort (C8) intercepted (805781A2->AA89AB50), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted Function NtRestoreKey (CC) intercepted (80653410->AA8A4000), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted Function NtSecureConnectPort (D2) intercepted (805887F1->AA89B060), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted Function NtSetInformationFile (E0) intercepted (805833C8->AA898060), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted Function NtSetValueKey (F7) intercepted (80581732->AA8A2ED7), hook C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted Function NtTerminateProcess (101) intercepted (8058E281->AA805F20), hook C:\Programme\SUPERAntiSpyware\SASKUTIL.sys Function NtWriteVirtualMemory (115) intercepted (805868D0->F7DC5882), hook not defined Functions checked: 284, intercepted: 31, restored: 0 1.3 Checking IDT and SYSENTER Analysis for CPU 1 Analysis for CPU 2 Checking IDT and SYSENTER - complete 1.4 Searching for masking processes and drivers Checking not performed: extended monitoring driver (AVZPM) is not installed Driver loaded successfully 1.5 Checking of IRP handlers \FileSystem\ntfs[IRP_MJ_CREATE] = 86FCF1D8 -> hook not defined \FileSystem\ntfs[IRP_MJ_CLOSE] = 86FCF1D8 -> hook not defined \FileSystem\ntfs[IRP_MJ_WRITE] = 86FCF1D8 -> hook not defined \FileSystem\ntfs[IRP_MJ_QUERY_INFORMATION] = 86FCF1D8 -> hook not defined \FileSystem\ntfs[IRP_MJ_SET_INFORMATION] = 86FCF1D8 -> hook not defined \FileSystem\ntfs[IRP_MJ_QUERY_EA] = 86FCF1D8 -> hook not defined \FileSystem\ntfs[IRP_MJ_SET_EA] = 86FCF1D8 -> hook not defined \FileSystem\ntfs[IRP_MJ_QUERY_VOLUME_INFORMATION] = 86FCF1D8 -> hook not defined \FileSystem\ntfs[IRP_MJ_SET_VOLUME_INFORMATION] = 86FCF1D8 -> hook not defined \FileSystem\ntfs[IRP_MJ_DIRECTORY_CONTROL] = 86FCF1D8 -> hook not defined \FileSystem\ntfs[IRP_MJ_FILE_SYSTEM_CONTROL] = 86FCF1D8 -> hook not defined \FileSystem\ntfs[IRP_MJ_DEVICE_CONTROL] = 86FCF1D8 -> hook not defined \FileSystem\ntfs[IRP_MJ_LOCK_CONTROL] = 86FCF1D8 -> hook not defined \FileSystem\ntfs[IRP_MJ_QUERY_SECURITY] = 86FCF1D8 -> hook not defined \FileSystem\ntfs[IRP_MJ_SET_SECURITY] = 86FCF1D8 -> hook not defined \FileSystem\ntfs[IRP_MJ_PNP] = 86FCF1D8 -> hook not defined \driver\tcpip[IRP_MJ_CREATE] = AA8ACC50 -> C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted \driver\tcpip[IRP_MJ_CLOSE] = AA8ACC50 -> C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted \driver\tcpip[IRP_MJ_DEVICE_CONTROL] = AA8ACC50 -> C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted \driver\tcpip[IRP_MJ_INTERNAL_DEVICE_CONTROL] = AA8ACC50 -> C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted \driver\tcpip[IRP_MJ_CLEANUP] = AA8ACC50 -> C:\WINDOWS\System32\vsdatant.sys, driver recognized as trusted Checking - complete 2. Scanning memory Number of processes found: 51 Number of modules loaded: 634 Scanning memory - complete 3. Scanning disks 4. Checking Winsock Layered Service Provider (SPI/LSP) LSP settings checked. No errors detected 5. Searching for keyboard/mouse/windows events hooks (Keyloggers, Trojan DLLs) C:\Programme\SUPERAntiSpyware\SASSEH.DLL --> Suspicion for Keylogger or Trojan DLL C:\Programme\SUPERAntiSpyware\SASSEH.DLL>>> Behavioural analysis Behaviour typical for keyloggers not detected Note: Do NOT delete suspicious files, send them for analysis (see FAQ for more details), because there are lots of useful hooking DLLs 6. Searching for opened TCP/UDP ports used by malicious programs Checking disabled by user 7. Heuristic system check Checking - complete 8. Searching for vulnerabilities >> Services: potentially dangerous service allowed: TermService (Terminaldienste) >> Services: potentially dangerous service allowed: SSDPSRV (SSDP-Suchdienst) >> Services: potentially dangerous service allowed: Schedule (Taskplaner) >> Services: potentially dangerous service allowed: mnmsrvc (NetMeeting-Remotedesktop-Freigabe) >> Services: potentially dangerous service allowed: RDSessMgr (Sitzungs-Manager für Remotedesktophilfe) > Services: please bear in mind that the set of services depends on the use of the PC (home PC, office PC connected to corporate network, etc)! >> Security: disk drives' autorun is enabled >> Security: administrative shares (C$, D$ ...) are enabled >> Security: anonymous user access is enabled >> Security: sending Remote Assistant queries is enabled Checking - complete 9. Troubleshooting wizard >> Abnormal SCR files association >> Abnormal REG files association >> HDD autorun are allowed >> Autorun from network drives are allowed >> Removable media autorun are allowed Checking - complete Files scanned: 685, extracted from archives: 0, malicious software found 0, suspicions - 0 Scanning finished at 17.07.2008 16:51:00 Time of scanning: 00:00:26 If you have a suspicion on presence of viruses or questions on the suspected objects, you can address http://virusinfo.info conference |
|
17.07.2008, 16:25
| #10 | |
| /// AVZ-Toolkit Guru | worm win32 netbooster Gut. Woher kommt das log? ^^ Zitat:
Dein Rechner sollte nun eigentlich wieder sauber sein. Wie sieht's bei dir aus?
__________________ - Sämtliche Hilfestellungen im Forum werden ohne Gewährleistung oder Haftung gegeben - |
|
17.07.2008, 17:06
| #11 |
| | worm win32 netbooster hehe ^^ also hab den text bei custom skript eingefügt,dann geladen. dann im hauptfenster den scan gestartet und anschließend über das kleine diskettenlogo, das log gespeichert. super,vielen dank schonmal.echt ne super hilfe von dir. kannst du mir tipps für die zukunft geben bzw. empfehlen die programme zu behalten,die ich jetzt alle habe? kannst ein gutes virenprogramm,was auch kosten kann empfehlen? handlungsempfehlungen für die zukunft? mfg, flocky |
|
| Themen zu worm win32 netbooster |
| 1.exe, antivir, application, avira, bho, browser, drivers, ebay, enigma, excel, hijack, hijack.displayproperties, hijack.drives, hijack.homepage, hijack.startmenu, hijackthis, hkus\s-1-5-18, internet, internet explorer, logfile, malwarebytes' anti-malware, netbooster, nicht sicher, nodrives, object, prozesse, registrierungsschlüssel, registry, rundll, security, security suite, senden, software, system, tuneup.defrag, virus, virus alert, virus alert!, windows, windows xp, wmid |
Hybrid-Darstellung
