|
Plagegeister aller Art und deren Bekämpfung: Trojaner Vundo und andere SchädlingeWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
26.07.2008, 11:45 | #1 |
| Trojaner Vundo und andere Schädlinge Ich habe folgendes Problem. Seit ein paar Tagen spinnt mein Rechner rum. Ich habe AntiVir durchlaufen lassen. Dabei wurde der Trojaner TR/Vundo.Gen gefunden, der immer wieder von Antivir gemeldet wird. Desweiteren fand AntiVir TR/Crypt.XPACK.Gen, TR/BHM.ffl und BAT/Fake.Privdanger (diese habe ich Smitfraudfix laut Anleitung entfernt, und jetzt kann ich meinen alten Hintergrund aich wieder sehen.) Mein PC spinnt folgendermaßen rum: Es wurde eine zweites Admin konto erstellt, mit dem ich mich nur im abgesicherten Modus anmelden kann. Somit kann ich z.B. den Hintergrund nicht ändern, da lt. windows die Option Anzeige in der Systemsteuerung deaktiviert wurde. TR Vundo und R/Crypt.XPACK.Gen verbreiten sich immer weiter auf dem PC laut AntiVir Es öffnet sich immer die Werbeseite von AntiVirus 2008. Ich kann im Arbeitsplatz nicht direkt auf die Festplatte zugreifen. Unten Links rechts neben der Uhr steht Virus Alert der Taskmanager läßt sich nicht öffnen. Ich habe schon ein tool zum entfernen von vundo ausprobiert, es hat aber den Trojaner nicht gefunden. Ich bitte euch: Helft mir mit meinen Problemtrojanern. Betriebssystem: Windows XP Profewssionel Ort von TR/Vundo C:\WINDOWS\system32\geBsQHXo.dll C:\WINDOWS\system32\hgGyXnOH.dll mfG Hier habe ich noch ein Hijacklog gemacht: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 23:24: VIRUS ALERT!, on 25.07.2008 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\Programme\AntiVir PersonalEdition Classic\sched.exe C:\Programme\AntiVir PersonalEdition Classic\avguard.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\ezSP_Px.exe C:\WINDOWS\SOUNDMAN.EXE C:\WINDOWS\atiptaxx.exe C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe C:\WINDOWS\System32\ctfmon.exe C:\Programme\Mousometer\mousometer.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\System32\WgaTray.exe C:\Programme\Mozilla Firefox\firefox.exe C:\WINDOWS\explorer.exe C:\Programme\AntiVir PersonalEdition Classic\avscan.exe C:\Programme\Alles\HiJackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = h**p://google.icq.**m/search/search_frame.php R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://google.icq.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://h**p://softwarereferral.**m/j...MjI6Ojg5&lid=2 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = h**p://search.qsrch.com/ O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar2.dll (file missing) O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Programme\eBay\eBay Toolbar2\eBayTB.dll (file missing) O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: qndsfmao - {3FCAEB7D-F8AE-4A67-AE6C-57EE1416BB6D} - C:\DOKUME~1\alle\LOKALE~1\Temp\ac8zt2\qndsfmao.dll (file missing) O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [Desksite CMA] C:\Programme\desksite\bin\cma.exe O4 - HKLM\..\Run: [EUSBSTORC] C:\Program Files\EUSBSTORC.exe O4 - HKLM\..\Run: [ATIPTA] C:\WINDOWS\atiptaxx.exe O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [Antivirus] C:\Programme\VAV\vav.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [ATnotes.exe] C:\Programme\ATnotes\ATnotes.exe O4 - HKCU\..\Run: [antivirus-2008pro.exe] C:\Programme\Antivirus 2008 PRO\antivirus-2008pro.exe O4 - HKCU\..\Run: [Antivirus] C:\Programme\VAV\vav.exe O4 - HKCU\..\Run: [AntispywareBot] C:\Programme\AntispywareBot\AntispywareBot.exe -boot O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKALER DIENST') O4 - HKUS\S-1-5-19\..\Run: [InfoCockpit] C:\Programme\T-Online\T-Online_Software_6\Info-Cockpit\INFOCOCKPIT.EXE /nosplash (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETZWERKDIENST') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Startup: Mousometer.lnk = C:\Programme\Mousometer\mousometer.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Pol icies\System, DisableRegedit=1 O8 - Extra context menu item: &eBay Search - res://C:\Programme\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html O8 - Extra context menu item: &Google Search - res://c:\programme\google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Programme\ICQToolbar\toolbaru.dll/SEARCH.HTML O8 - Extra context menu item: Im Cache gespeicherte Seite - res://c:\programme\google\GoogleToolbar2.dll/cmcache.html O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Verweisseiten - res://c:\programme\google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Ähnliche Seiten - res://c:\programme\google\GoogleToolbar2.dll/cmsimilar.html O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe O9 - Extra button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Programme\PokerStars.NET\PokerStarsUpdate.exe O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - h**p://***.cult3d.com/download/cult.cab O16 - DPF: {402EE96E-2CE8-482D-ADA5-CECEEA07E16D} (TurnTool Scene) - h**p://**.turntool.com/ViewerInstall.exe O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - h**p://h**p://captainbarut.spaces.li...d/MsnPUpld.cab O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - h**p://h**p://a1540.g.akamai.n*t/7/1...eInstaller.exe O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - h**p://h**p://v5.windowsupdate.micro...?1095694166515 O16 - DPF: {7545D8C8-F53C-4E2F-8FA0-D248EF4A6E61} - h**p://scanner.vav-x-scanner.**m/setup/setup.cab O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - h**p://h**p://www.sibelius.**m/downl...iveXPlugin.cab O16 - DPF: {DF6504AC-3EFE-4287-B259-FB299B069C95} (WEBDE Fotoalbum Upload Control) - h**p://h**ps://img.web.de/v/fotoalbu...load_11110.cab O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - h**p://h**p://pdl.stream.aol.com/dow...ampx_en_dl.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: PanelSvc - Unknown owner - C:\Programme\Meinungsstudie\PanelApp\PanelSvc.exe (file missing) O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe -- End of file - 7173 bytes Geändert von Nordie (26.07.2008 um 12:36 Uhr) |
26.07.2008, 14:01 | #2 |
| Trojaner Vundo und andere Schädlinge Ich bitte um dringende Hilfe.
__________________Lasse gerade Malware durchlaufen, da dies anscheinend eine gute Lösung laut dieser Seite hier ist. Log reiche ich dann ein, wenn das Programm fertig ist. Soll ich auch schon nach dem Suchlauf was löschen????????? was kann ich noch tun??? Bitte bitte helft mir!!!!!!!! Geändert von Nordie (26.07.2008 um 14:25 Uhr) |
26.07.2008, 15:16 | #3 |
| Trojaner Vundo und andere Schädlinge Ich habe im Netz gerade noch VundoFix gefunden. Diese Programm läuft gerade durch.
__________________Was soll ich nun nach beendetem Malwarescan machen??? Die Datein löschen????? KANN SICH MAL BITTE JEMAND MEINES FALLS ANNEHMEN??? |
26.07.2008, 15:19 | #4 |
| Trojaner Vundo und andere Schädlinge Hier der Malwarebericht: Malwarebytes' Anti-Malware 1.23 Datenbank Version: 993 Windows 5.1.2600 16:17:56 26.07.2008 mbam-log-7-26-2008 (16-17-51).txt Scan-Methode: Vollständiger Scan (C:\|) Durchsuchte Objekte: 157027 Laufzeit: 2 hour(s), 44 minute(s), 17 second(s) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 2 Infizierte Registrierungsschlüssel: 56 Infizierte Registrierungswerte: 5 Infizierte Dateiobjekte der Registrierung: 17 Infizierte Verzeichnisse: 11 Infizierte Dateien: 30 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: C:\WINDOWS\system32\geBsQHXo.dll (Trojan.Vundo) -> No action taken. C:\WINDOWS\system32\hgGyXnOH.dll (Trojan.Vundo) -> No action taken. Infizierte Registrierungsschlüssel: HKEY_CLASSES_ROOT\CLSID\{0ac49246-419b-4ee0-8917-8818daad6a4e} (Adware.180Solutions) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{337689b2-d188-4bb7-a4e4-a64c9dd5bb2e} (Trojan.Vundo) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{51cf80dc-a309-4735-bb11-ef18bf4e3ad9} (Adware.180Solutions) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{6230596f-3a44-4cdf-815b-372fa03c75d6} (Trojan.Vundo) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{7545d8c8-f53c-4e2f-8fa0-d248ef4a6e61} (Rogue.Installer) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{9809bde2-013f-48e2-9c99-df9a0bed116d} (Trojan.Vundo) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{99410cde-6f16-42ce-9d49-3807f78f0287} (Adware.180Solutions) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{f31a5d11-bf0b-4a4e-90af-274f2090aaa6} (Adware.180Solutions) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{fbe58cc0-d14b-45fe-a717-57bb8247f652} (Trojan.FakeAlert) -> No action taken. HKEY_CLASSES_ROOT\Installer\UpgradeCodes\2dda3201767c34b46a72671d26d39178 (Rogue.AntiSpywareBot) -> No action taken. HKEY_CLASSES_ROOT\Interface\{031cbf6a-c70e-4177-a0d4-c5268ee311fb} (Adware.180Solutions) -> No action taken. HKEY_CLASSES_ROOT\Interface\{2b0eceac-f597-4858-a542-d966b49055b9} (Adware.180Solutions) -> No action taken. HKEY_CLASSES_ROOT\Interface\{4937d5d1-2039-409a-bd83-fec9b39b2356} (Trojan.BHO) -> No action taken. HKEY_CLASSES_ROOT\Interface\{6c092742-10fe-4db2-988d-fc71948de70c} (Adware.180Solutions) -> No action taken. HKEY_CLASSES_ROOT\Interface\{7fa8976f-d00c-4e98-8729-a66569233fb5} (Adware.180Solutions) -> No action taken. HKEY_CLASSES_ROOT\Interface\{a16650a9-b065-40ec-bbd1-f8d370d17fb1} (Adware.180Solutions) -> No action taken. HKEY_CLASSES_ROOT\Interface\{bdddf1a5-51a9-4f51-b38d-4cd0ad831b31} (Adware.180Solutions) -> No action taken. HKEY_CLASSES_ROOT\Interface\{caf9d798-c659-4b9b-8e19-ee27c3d04ee7} (Trojan.BHO) -> No action taken. HKEY_CLASSES_ROOT\Interface\{ddea2e1d-8555-45e5-af09-ec9aa4ea27ad} (Adware.180Solutions) -> No action taken. HKEY_CLASSES_ROOT\Interface\{e43dfaa6-8c16-4519-b022-8792408505a4} (Adware.180Solutions) -> No action taken. HKEY_CLASSES_ROOT\Interface\{f1f1e775-1b21-454d-8d38-7c16519969e5} (Adware.180Solutions) -> No action taken. HKEY_CLASSES_ROOT\TypeLib\{5b6689b5-c2d4-4dc7-bfd1-24ac17e5fcda} (Adware.180Solutions) -> No action taken. HKEY_CLASSES_ROOT\Typelib\{15c7d7ad-a87a-4c0d-9d8b-637fcd3488ef} (Trojan.BHO) -> No action taken. HKEY_CLASSES_ROOT\bhonew.bho (Trojan.FakeAlert) -> No action taken. HKEY_CLASSES_ROOT\bhonew.bho.1 (Trojan.FakeAlert) -> No action taken. HKEY_CLASSES_ROOT\clientax.clientinstaller (Adware.180Solutions) -> No action taken. HKEY_CLASSES_ROOT\clientax.clientinstaller.1 (Adware.180Solutions) -> No action taken. HKEY_CLASSES_ROOT\clientax.requiredcomponent (Adware.180Solutions) -> No action taken. HKEY_CLASSES_ROOT\clientax.requiredcomponent.1 (Adware.180Solutions) -> No action taken. HKEY_CLASSES_ROOT\clientax.zangoclientax (Adware.180Solutions) -> No action taken. HKEY_CLASSES_ROOT\clientax.zangoclientax.1 (Adware.180Solutions) -> No action taken. HKEY_CLASSES_ROOT\lmgr180.wmdrmax (Adware.180Solutions) -> No action taken. HKEY_CLASSES_ROOT\lmgr180.wmdrmax.1 (Adware.180Solutions) -> No action taken. HKEY_CLASSES_ROOT\qndsfmao.bvqe (Trojan.FakeAlert) -> No action taken. HKEY_CLASSES_ROOT\qndsfmao.toolbar.1 (Trojan.FakeAlert) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\AntispywareBot (Rogue.AntiSpywareBot) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\VAV (Rogue.VistaAntivirus2008) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Zango (Adware.Zango) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\antivirus 2008 pro (Rogue.Antivirus2008) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{7545d8c8-f53c-4e2f-8fa0-d248ef4a6e61} (Rogue.Installer) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VSPlugin (Trojan.FakeAlert) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\hggyxnoh (Trojan.Vundo) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{337689b2-d188-4bb7-a4e4-a64c9dd5bb2e} (Trojan.Vundo) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6230596f-3a44-4cdf-815b-372fa03c75d6} (Trojan.Vundo) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9809bde2-013f-48e2-9c99-df9a0bed116d} (Trojan.Vundo) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{fbe58cc0-d14b-45fe-a717-57bb8247f652} (Trojan.FakeAlert) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\2dda3201767c34b46a72671d26d39178 (Rogue.AntiSpywareBot) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\c:/windows/downloaded program files/setup.dll (Rogue.Installer) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\webvideo (Trojan.FakeAlert) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Trojan.Vundo) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\MyGlobalSearch (Adware.BookedSpace) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\zango (Adware.180Solutions) -> No action taken. Infizierte Registrierungswerte: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiSpywareBot (Rogue.AntiSpywareBot) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{6230596f-3a44-4cdf-815b-372fa03c75d6} (Trojan.Vundo) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\c:\dokumente und einstellungen\all users\startmenü\programme\antispywarebot\ (Rogue.AntiSpywareBot) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\c:\programme\antispywarebot\ (Rogue.AntiSpywareBot) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\WINDOWS\Downloaded Program Files\setup.dll (Rogue.Installer) -> No action taken. Infizierte Dateiobjekte der Registrierung: HKEY_CURRENT_USER\Control Panel\International\sTimeFormat (Trojan.FakeAlert) -> Bad: (HH:mm: VIRUS ALERT!) Good: (HH:mm:ss) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page (Hijack.Homepage) -> Bad: (http://softwarereferral.com/jump.php...MjI6Ojg5&lid=2) Good: (http://www.google.com/) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowControlPanel (Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowHelp (Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowMyComputer (Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowMyDocs (Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowRun (Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowSearch (Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives (Hijack.Drives) -> Bad: (12) Good: (0) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetFolders (Hijack.Explorer) -> Bad: (1) Good: (0) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuMorePrograms (Hijack.StartMenu) -> Bad: (1) Good: (0) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoToolbarCustomize (Hijack.Explorer) -> Bad: (1) Good: (0) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\StartMenuLogOff (Hijack.StartMenu) -> Bad: (1) Good: (0) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispCPL (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> No action taken. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\gebsqhxo -> No action taken. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo) -> Data: c:\windows\system32\gebsqhxo -> No action taken. Infizierte Verzeichnisse: C:\Dokumente und Einstellungen\alle\Anwendungsdaten\AntispywareBot (Rogue.AntiSpywareBot) -> No action taken. C:\Dokumente und Einstellungen\alle\Anwendungsdaten\AntispywareBot\Log (Rogue.AntiSpywareBot) -> No action taken. C:\Dokumente und Einstellungen\alle\Anwendungsdaten\AntispywareBot\Settings (Rogue.AntiSpywareBot) -> No action taken. C:\Programme\Antivirus 2008 PRO (Rogue.Antivirus2008) -> No action taken. C:\Programme\Antivirus 2008 PRO\Infected (Rogue.Antivirus2008) -> No action taken. C:\Programme\Antivirus 2008 PRO\Suspicious (Rogue.Antivirus2008) -> No action taken. C:\Programme\MyGlobalSearch (Adware.MyWebSearch) -> No action taken. C:\Programme\MyGlobalSearch\bar (Adware.MyWebSearch) -> No action taken. C:\Programme\MyGlobalSearch\bar\History (Adware.MyWebSearch) -> No action taken. C:\Programme\MyGlobalSearch\bar\Settings (Adware.MyWebSearch) -> No action taken. C:\Programme\VAV (Rogue.VistaAntivirus2008) -> No action taken. Infizierte Dateien: C:\Dokumente und Einstellungen\Gast\Lokale Einstellungen\Temp\CmdLineExt03.dll (Trojan.Agent) -> No action taken. C:\Dokumente und Einstellungen\alle\Anwendungsdaten\AntispywareBot\Log\2008 Jul 25 - 11_02_47 PM_984.log (Rogue.AntiSpywareBot) -> No action taken. C:\Dokumente und Einstellungen\alle\Anwendungsdaten\AntispywareBot\Settings\ScanResults.pie (Rogue.AntiSpywareBot) -> No action taken. C:\Dokumente und Einstellungen\alle\Anwendungsdaten\AntispywareBot\rs.dat (Rogue.AntiSpywareBot) -> No action taken. C:\Dokumente und Einstellungen\alle\Anwendungsdaten\TmpRecentIcons\Vista Antivirus 2008.lnk (Rogue.Link) -> No action taken. C:\Dokumente und Einstellungen\alle\Anwendungsdaten\TmpRecentIcons\antivirus-2008pro.lnk (Rogue.Link) -> No action taken. C:\Dokumente und Einstellungen\alle\Favoriten\Error Cleaner.url (Rogue.Link) -> No action taken. C:\Dokumente und Einstellungen\alle\Favoriten\Privacy Protector.url (Rogue.Link) -> No action taken. C:\Dokumente und Einstellungen\alle\Favoriten\Spyware&Malware Protection.url (Rogue.Link) -> No action taken. C:\Dokumente und Einstellungen\alle\Lokale Einstellungen\Temp\CmdLineExt02.dll (Trojan.Agent) -> No action taken. C:\Dokumente und Einstellungen\alle\Lokale Einstellungen\Temp\oprghdlr.sys.av (Heuristics.Malware) -> No action taken. C:\Programme\Alles\Downloads\Software\ALPluginIE-1.0.1.6-setup.exe (Trojan.Downloader) -> No action taken. C:\Programme\Antivirus 2008 PRO\vscan.tsi (Rogue.Antivirus2008) -> No action taken. C:\Programme\Antivirus 2008 PRO\zlib.dll (Rogue.Antivirus2008) -> No action taken. C:\Programme\MyGlobalSearch\bar\History\search (Adware.MyWebSearch) -> No action taken. C:\Programme\VAV\vav.ooo (Rogue.VistaAntivirus2008) -> No action taken. C:\Programme\VAV\vav0.dat (Rogue.VistaAntivirus2008) -> No action taken. C:\Programme\VAV\vav1.dat (Rogue.VistaAntivirus2008) -> No action taken. C:\WINDOWS\Downloaded Program Files\ClientAX.dll (Adware.180Solutions) -> No action taken. C:\WINDOWS\Downloaded Program Files\setup.dll (Rogue.Installer) -> No action taken. C:\WINDOWS\System32\knvdnw.dll (Trojan.Vundo) -> No action taken. C:\WINDOWS\Tasks\AntispywareBot Scheduled Scan.job (Rogue.AntiSpywareBot) -> No action taken. C:\WINDOWS\agpqlrfm.exe (Trojan.FakeAlert) -> No action taken. C:\WINDOWS\erms.exe (Trojan.FakeAlert) -> No action taken. C:\WINDOWS\qndsfmao.dll (Trojan.FakeAlert) -> No action taken. C:\WINDOWS\system32\byXPffEt.dll (Trojan.Vundo) -> No action taken. C:\WINDOWS\system32\geBsQHXo.dll (Trojan.Vundo) -> No action taken. C:\WINDOWS\system32\hgGyXnOH.dll (Trojan.Vundo) -> No action taken. C:\WINDOWS\system32\oXHQsBeg.ini (Trojan.Vundo) -> No action taken. C:\WINDOWS\system32\oXHQsBeg.ini2 (Trojan.Vundo) -> No action taken. was soll ich tun???? alles löschen???????? |
26.07.2008, 15:23 | #5 |
| Trojaner Vundo und andere Schädlinge Hier noch der zweite Malwarebericht: Malwarebytes' Anti-Malware 1.23 Datenbank Version: 993 Windows 5.1.2600 16:21:51 26.07.2008 mbam-log-7-26-2008 (16-21-51).txt Scan-Methode: Vollständiger Scan (C:\|) Durchsuchte Objekte: 157027 Laufzeit: 2 hour(s), 44 minute(s), 17 second(s) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 2 Infizierte Registrierungsschlüssel: 56 Infizierte Registrierungswerte: 5 Infizierte Dateiobjekte der Registrierung: 17 Infizierte Verzeichnisse: 11 Infizierte Dateien: 30 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: C:\WINDOWS\system32\geBsQHXo.dll (Trojan.Vundo) -> Delete on reboot. C:\WINDOWS\system32\hgGyXnOH.dll (Trojan.Vundo) -> Delete on reboot. Infizierte Registrierungsschlüssel: HKEY_CLASSES_ROOT\CLSID\{0ac49246-419b-4ee0-8917-8818daad6a4e} (Adware.180Solutions) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{337689b2-d188-4bb7-a4e4-a64c9dd5bb2e} (Trojan.Vundo) -> Delete on reboot. HKEY_CLASSES_ROOT\CLSID\{51cf80dc-a309-4735-bb11-ef18bf4e3ad9} (Adware.180Solutions) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{6230596f-3a44-4cdf-815b-372fa03c75d6} (Trojan.Vundo) -> Delete on reboot. HKEY_CLASSES_ROOT\CLSID\{7545d8c8-f53c-4e2f-8fa0-d248ef4a6e61} (Rogue.Installer) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{9809bde2-013f-48e2-9c99-df9a0bed116d} (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{99410cde-6f16-42ce-9d49-3807f78f0287} (Adware.180Solutions) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{f31a5d11-bf0b-4a4e-90af-274f2090aaa6} (Adware.180Solutions) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{fbe58cc0-d14b-45fe-a717-57bb8247f652} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Installer\UpgradeCodes\2dda3201767c34b46a72671d26d39178 (Rogue.AntiSpywareBot) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{031cbf6a-c70e-4177-a0d4-c5268ee311fb} (Adware.180Solutions) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{2b0eceac-f597-4858-a542-d966b49055b9} (Adware.180Solutions) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{4937d5d1-2039-409a-bd83-fec9b39b2356} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{6c092742-10fe-4db2-988d-fc71948de70c} (Adware.180Solutions) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{7fa8976f-d00c-4e98-8729-a66569233fb5} (Adware.180Solutions) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{a16650a9-b065-40ec-bbd1-f8d370d17fb1} (Adware.180Solutions) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{bdddf1a5-51a9-4f51-b38d-4cd0ad831b31} (Adware.180Solutions) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{caf9d798-c659-4b9b-8e19-ee27c3d04ee7} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{ddea2e1d-8555-45e5-af09-ec9aa4ea27ad} (Adware.180Solutions) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{e43dfaa6-8c16-4519-b022-8792408505a4} (Adware.180Solutions) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{f1f1e775-1b21-454d-8d38-7c16519969e5} (Adware.180Solutions) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\TypeLib\{5b6689b5-c2d4-4dc7-bfd1-24ac17e5fcda} (Adware.180Solutions) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Typelib\{15c7d7ad-a87a-4c0d-9d8b-637fcd3488ef} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\bhonew.bho (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\bhonew.bho.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\clientax.clientinstaller (Adware.180Solutions) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\clientax.clientinstaller.1 (Adware.180Solutions) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\clientax.requiredcomponent (Adware.180Solutions) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\clientax.requiredcomponent.1 (Adware.180Solutions) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\clientax.zangoclientax (Adware.180Solutions) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\clientax.zangoclientax.1 (Adware.180Solutions) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\lmgr180.wmdrmax (Adware.180Solutions) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\lmgr180.wmdrmax.1 (Adware.180Solutions) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\qndsfmao.bvqe (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\qndsfmao.toolbar.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\AntispywareBot (Rogue.AntiSpywareBot) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\VAV (Rogue.VistaAntivirus2008) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Zango (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\antivirus 2008 pro (Rogue.Antivirus2008) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{7545d8c8-f53c-4e2f-8fa0-d248ef4a6e61} (Rogue.Installer) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VSPlugin (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\hggyxnoh (Trojan.Vundo) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{337689b2-d188-4bb7-a4e4-a64c9dd5bb2e} (Trojan.Vundo) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6230596f-3a44-4cdf-815b-372fa03c75d6} (Trojan.Vundo) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9809bde2-013f-48e2-9c99-df9a0bed116d} (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{fbe58cc0-d14b-45fe-a717-57bb8247f652} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\2dda3201767c34b46a72671d26d39178 (Rogue.AntiSpywareBot) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\c:/windows/downloaded program files/setup.dll (Rogue.Installer) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\webvideo (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\MyGlobalSearch (Adware.BookedSpace) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\zango (Adware.180Solutions) -> Quarantined and deleted successfully. Infizierte Registrierungswerte: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiSpywareBot (Rogue.AntiSpywareBot) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{6230596f-3a44-4cdf-815b-372fa03c75d6} (Trojan.Vundo) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\c:\dokumente und einstellungen\all users\startmenü\programme\antispywarebot\ (Rogue.AntiSpywareBot) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\c:\programme\antispywarebot\ (Rogue.AntiSpywareBot) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\WINDOWS\Downloaded Program Files\setup.dll (Rogue.Installer) -> Quarantined and deleted successfully. Infizierte Dateiobjekte der Registrierung: HKEY_CURRENT_USER\Control Panel\International\sTimeFormat (Trojan.FakeAlert) -> Bad: (HH:mm: VIRUS ALERT!) Good: (HH:mm:ss) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page (Hijack.Homepage) -> Bad: (http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2) Good: (http://www.google.com/) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowControlPanel (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowHelp (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowMyComputer (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowMyDocs (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowRun (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowSearch (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives (Hijack.Drives) -> Bad: (12) Good: (0) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetFolders (Hijack.Explorer) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuMorePrograms (Hijack.StartMenu) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoToolbarCustomize (Hijack.Explorer) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\StartMenuLogOff (Hijack.StartMenu) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispCPL (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\gebsqhxo -> Delete on reboot. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo) -> Data: c:\windows\system32\gebsqhxo -> Quarantined and deleted successfully. Infizierte Verzeichnisse: C:\Dokumente und Einstellungen\alle\Anwendungsdaten\AntispywareBot (Rogue.AntiSpywareBot) -> Quarantined and deleted successfully. C:\Dokumente und Einstellungen\alle\Anwendungsdaten\AntispywareBot\Log (Rogue.AntiSpywareBot) -> Quarantined and deleted successfully. C:\Dokumente und Einstellungen\alle\Anwendungsdaten\AntispywareBot\Settings (Rogue.AntiSpywareBot) -> Quarantined and deleted successfully. C:\Programme\Antivirus 2008 PRO (Rogue.Antivirus2008) -> Quarantined and deleted successfully. C:\Programme\Antivirus 2008 PRO\Infected (Rogue.Antivirus2008) -> Quarantined and deleted successfully. C:\Programme\Antivirus 2008 PRO\Suspicious (Rogue.Antivirus2008) -> Quarantined and deleted successfully. C:\Programme\MyGlobalSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Programme\MyGlobalSearch\bar (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Programme\MyGlobalSearch\bar\History (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Programme\MyGlobalSearch\bar\Settings (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Programme\VAV (Rogue.VistaAntivirus2008) -> Quarantined and deleted successfully. Infizierte Dateien: C:\Dokumente und Einstellungen\Gast\Lokale Einstellungen\Temp\CmdLineExt03.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\Dokumente und Einstellungen\alle\Anwendungsdaten\AntispywareBot\Log\2008 Jul 25 - 11_02_47 PM_984.log (Rogue.AntiSpywareBot) -> Quarantined and deleted successfully. C:\Dokumente und Einstellungen\alle\Anwendungsdaten\AntispywareBot\Settings\ScanResults.pie (Rogue.AntiSpywareBot) -> Quarantined and deleted successfully. C:\Dokumente und Einstellungen\alle\Anwendungsdaten\AntispywareBot\rs.dat (Rogue.AntiSpywareBot) -> Quarantined and deleted successfully. C:\Dokumente und Einstellungen\alle\Anwendungsdaten\TmpRecentIcons\Vista Antivirus 2008.lnk (Rogue.Link) -> Quarantined and deleted successfully. C:\Dokumente und Einstellungen\alle\Anwendungsdaten\TmpRecentIcons\antivirus-2008pro.lnk (Rogue.Link) -> Quarantined and deleted successfully. C:\Dokumente und Einstellungen\alle\Favoriten\Error Cleaner.url (Rogue.Link) -> Quarantined and deleted successfully. C:\Dokumente und Einstellungen\alle\Favoriten\Privacy Protector.url (Rogue.Link) -> Quarantined and deleted successfully. C:\Dokumente und Einstellungen\alle\Favoriten\Spyware&Malware Protection.url (Rogue.Link) -> Quarantined and deleted successfully. C:\Dokumente und Einstellungen\alle\Lokale Einstellungen\Temp\CmdLineExt02.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\Dokumente und Einstellungen\alle\Lokale Einstellungen\Temp\oprghdlr.sys.av (Heuristics.Malware) -> Quarantined and deleted successfully. C:\Programme\Alles\Downloads\Software\ALPluginIE-1.0.1.6-setup.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Programme\Antivirus 2008 PRO\vscan.tsi (Rogue.Antivirus2008) -> Quarantined and deleted successfully. C:\Programme\Antivirus 2008 PRO\zlib.dll (Rogue.Antivirus2008) -> Quarantined and deleted successfully. C:\Programme\MyGlobalSearch\bar\History\search (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Programme\VAV\vav.ooo (Rogue.VistaAntivirus2008) -> Quarantined and deleted successfully. C:\Programme\VAV\vav0.dat (Rogue.VistaAntivirus2008) -> Quarantined and deleted successfully. C:\Programme\VAV\vav1.dat (Rogue.VistaAntivirus2008) -> Quarantined and deleted successfully. C:\WINDOWS\Downloaded Program Files\ClientAX.dll (Adware.180Solutions) -> Quarantined and deleted successfully. C:\WINDOWS\Downloaded Program Files\setup.dll (Rogue.Installer) -> Quarantined and deleted successfully. C:\WINDOWS\System32\knvdnw.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\Tasks\AntispywareBot Scheduled Scan.job (Rogue.AntiSpywareBot) -> Quarantined and deleted successfully. C:\WINDOWS\agpqlrfm.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\WINDOWS\erms.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\WINDOWS\qndsfmao.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\WINDOWS\system32\byXPffEt.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\geBsQHXo.dll (Trojan.Vundo) -> Delete on reboot. C:\WINDOWS\system32\hgGyXnOH.dll (Trojan.Vundo) -> Delete on reboot. C:\WINDOWS\system32\oXHQsBeg.ini (Trojan.Vundo) -> Delete on reboot. C:\WINDOWS\system32\oXHQsBeg.ini2 (Trojan.Vundo) -> Delete on reboot. |
26.07.2008, 15:34 | #6 |
| Trojaner Vundo und andere Schädlinge und nochmal Hijack: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:30:17, on 26.07.2008 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\ezSP_Px.exe C:\WINDOWS\SOUNDMAN.EXE C:\WINDOWS\atiptaxx.exe C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe C:\WINDOWS\System32\ctfmon.exe C:\Programme\Mousometer\mousometer.exe C:\Programme\AntiVir PersonalEdition Classic\sched.exe C:\Programme\AntiVir PersonalEdition Classic\avguard.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\System32\WgaTray.exe C:\Programme\Malwarebytes' Anti-Malware\mbam.exe C:\Programme\Mozilla Firefox\firefox.exe C:\Programme\Hijack\HiJackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = h**p://google.icq.com/search/search_frame.php R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://google.icq.com R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = h**p://search.qsrch.com/ O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Programme\eBay\eBay Toolbar2\eBayTB.dll (file missing) O2 - BHO: QXK Olive - {812AE34E-162C-4C94-BAA1-A2C0431AEC84} - C:\WINDOWS\kgxmotapktx.dll (file missing) O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar2.dll (file missing) O2 - BHO: Bho Class - {AB37CD3D-DC1D-46b2-ADCA-3CDC80FD2AD6} - C:\Dokumente und Einstellungen\alle\Lokale Einstellungen\Anwendungsdaten\Meinungsstudie\PanelApp\PanelApp_0600.2007.0517.1434.dll (file missing) O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar2.dll (file missing) O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Programme\eBay\eBay Toolbar2\eBayTB.dll (file missing) O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: qndsfmao - {3FCAEB7D-F8AE-4A67-AE6C-57EE1416BB6D} - C:\DOKUME~1\alle\LOKALE~1\Temp\ac8zt2\qndsfmao.dll (file missing) O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [Desksite CMA] C:\Programme\desksite\bin\cma.exe O4 - HKLM\..\Run: [EUSBSTORC] C:\Program Files\EUSBSTORC.exe O4 - HKLM\..\Run: [ATIPTA] C:\WINDOWS\atiptaxx.exe O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [Antivirus] C:\Programme\VAV\vav.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [ATnotes.exe] C:\Programme\ATnotes\ATnotes.exe O4 - HKCU\..\Run: [antivirus-2008pro.exe] C:\Programme\Antivirus 2008 PRO\antivirus-2008pro.exe O4 - HKCU\..\Run: [Antivirus] C:\Programme\VAV\vav.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKALER DIENST') O4 - HKUS\S-1-5-19\..\Run: [InfoCockpit] C:\Programme\T-Online\T-Online_Software_6\Info-Cockpit\INFOCOCKPIT.EXE /nosplash (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETZWERKDIENST') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Startup: Mousometer.lnk = C:\Programme\Mousometer\mousometer.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O8 - Extra context menu item: &eBay Search - res://C:\Programme\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html O8 - Extra context menu item: &Google Search - res://c:\programme\google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Programme\ICQToolbar\toolbaru.dll/SEARCH.HTML O8 - Extra context menu item: Im Cache gespeicherte Seite - res://c:\programme\google\GoogleToolbar2.dll/cmcache.html O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Verweisseiten - res://c:\programme\google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Ähnliche Seiten - res://c:\programme\google\GoogleToolbar2.dll/cmsimilar.html O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe O9 - Extra button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Programme\PokerStars.NET\PokerStarsUpdate.exe O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - h**p://www.cult3d.com/download/cult.cab O16 - DPF: {402EE96E-2CE8-482D-ADA5-CECEEA07E16D} (TurnTool Scene) - h**p://www.turntool.com/ViewerInstall.exe O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://captainbarut.spaces.live.com//PhotoUpload/MsnPUpld.cab O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - h**p://a1540.g.akamai.net/7/1540/52/20040428/qtinstall.info.apple.com/saba/de/win/QuickTimeInstaller.exe O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - h**p://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1095694166515 O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - h**p://www.sibelius.com/download/software/win/ActiveXPlugin.cab O16 - DPF: {DF6504AC-3EFE-4287-B259-FB299B069C95} (WEBDE Fotoalbum Upload Control) - h**ps://img.web.de/v/fotoalbum/activex/upload_11110.cab O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - h**p://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: PanelSvc - Unknown owner - C:\Programme\Meinungsstudie\PanelApp\PanelSvc.exe (file missing) O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe -- End of file - 7323 bytes IOst alles wieder Trojanerfrei??? Diese Programme sind mir fremd und wurden eig von Malware gelöscht: O4 - HKLM\..\Run: [Antivirus] C:\Programme\VAV\vav.exe O4 - HKCU\..\Run: [antivirus-2008pro.exe] C:\Programme\Antivirus 2008 PRO\antivirus-2008pro.exe |
26.07.2008, 18:50 | #7 |
| Trojaner Vundo und andere Schädlinge alles weitere bitte hierein: http://www.trojaner-board.de/56781-uberwachung-botnetzmitglied.html#post357425 |
Themen zu Trojaner Vundo und andere Schädlinge |
abgesicherten modus, antivir, antivirus, avira, ebay, entfernen, excel, explorer, festplatte, firefox, hijackthis, hkus\s-1-5-18, immer wieder, internet, internet explorer, monitor, mozilla, mozilla firefox, schädling, software, t-online, taskmanager, temp, tr/crypt.xpack.ge, tr/crypt.xpack.gen, tr/vundo.gen, trojaner, unknown file in winsock lsp, virus alert!, vundo, windows, windows xp, ändern, öffnet |