Backdoor:Win32/Sharke.B + Virus.VBS.AutoRun.c

HoM3R

Hallo!

Ich bin mir definitiv sicher,dass die beiden genannten Viren auf dem Rechner aktiv sind.

Wie kann ich die beiden Viren löschen, ohne formatieren.

Antivirenscanner scheinen nicht mehr korrekt zu arbeiten. Escan stürzt sogar ab beim scan.

Scheinbar führt der Virus auch ein Prozess wscript.exe aus im Systemstart.Was bedeutet das wscript?

Mein Hijacklog


Logfile of HijackThis v1.99.1
Scan saved at 09:34:48, on 02.08.2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\WScript.exe
C:\Programme\Nokia\Nokia Software Launcher\NSLauncher.exe
C:\WINDOWS\config.com
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\config.com
C:\Programme\Xfire\xfire.exe
C:\Programme\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\Gemeinsame Dateien\PCSuite\Services\ServiceLayer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wscript.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\hijackthis\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Hacked by BLEIFREI-2302C7
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_06\bin\ssv.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [BLEIFREI-2302C7] C:\WINDOWS\SYSTEM32\BLEIFREI-2302C7.vbs
O4 - HKLM\..\Run: [NSLauncher] C:\Programme\Nokia\Nokia Software Launcher\NSLauncher.exe /startup
O4 - HKLM\..\Run: [MSSupport] "C:\WINDOWS\config.com"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSSupport] "C:\WINDOWS\config.com"
O4 - Startup: Xfire.lnk = C:\Programme\Xfire\xfire.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O11 - Options group: [TABS] Tabbed Browsing
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Programme\MAGIX\Common\Database\bin\fbserver.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Programme\Gemeinsame Dateien\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: MWAgent - Unknown owner - C:\Programme\Gemeinsame Dateien\MicroWorld\Agent\MWASER.EXE (file missing)
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Programme\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Programme\Gemeinsame Dateien\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Programme\Gemeinsame Dateien\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: ServiceLayer - Nokia. - C:\Programme\Gemeinsame Dateien\PCSuite\Services\ServiceLayer.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Programme\Gemeinsame Dateien\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Programme\Gemeinsame Dateien\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: TuneUp Drive Defrag-Dienst (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

Virustotal Logs:


config.com


Antivirus Version letzte aktualisierung Ergebnis
AhnLab-V3 2008.7.29.1 2008.08.01 Win-Trojan/Shark.153975
AntiVir 7.8.1.15 2008.08.01 BDS/Shark.B
Authentium 5.1.0.4 2008.08.01 W32/Shark.A.gen!Eldorado
Avast 4.8.1195.0 2008.08.01 Win32:Shark-CP
AVG 8.0.0.156 2008.08.01 BackDoor.Shark
BitDefender 7.2 2008.08.02 Backdoor.VB.BPS
CAT-QuickHeal 9.50 2008.08.01 Backdoor.Shark.axz
ClamAV 0.93.1 2008.08.02 Trojan.Karsh-252
DrWeb 4.44.0.09170 2008.08.01 BACKDOOR.Trojan
eSafe 7.0.17.0 2008.07.29 Suspicious File
eTrust-Vet 31.6.6002 2008.08.02 Win32/Shark!generic
Ewido 4.0 2008.08.01 Backdoor.Shark.axz
F-Prot 4.4.4.56 2008.08.01 W32/Shark.A.gen!Eldorado
F-Secure 7.60.13501.0 2008.08.02 Backdoor.Win32.Shark.bvg
Fortinet 3.14.0.0 2008.08.02 -
GData 2.0.7306.1023 2008.08.02 Backdoor.Win32.Shark.bvg
Ikarus T3.1.1.34.0 2008.08.02 Backdoor.Win32.Shark.axz
K7AntiVirus 7.10.402 2008.08.01 Backdoor.Win32.Shark.axz
Kaspersky 7.0.0.125 2008.08.02 Backdoor.Win32.Shark.bvg
McAfee 5352 2008.08.01 New Malware.y
Microsoft 1.3704 2008.07.28 Backdoor:Win32/Sharke.B
NOD32v2 3318 2008.08.01 Win32/Shark.AXZ
Norman 5.80.02 2008.08.01 W32/Smalldoor.BMEF
Panda 9.0.0.4 2008.08.02 Suspicious file
PCTools 4.4.2.0 2008.08.01 -
Prevx1 V2 2008.08.02 -
Rising 20.55.42.00 2008.08.02 -
Sophos 4.31.0 2008.08.02 Troj/Shark-E
Sunbelt 3.1.1537.1 2008.08.01 -
Symantec 10 2008.08.02 Backdoor.Colfusion
TheHacker 6.2.96.391 2008.07.31 Backdoor/Shark.axz
TrendMicro 8.700.0.1004 2008.08.01 BKDR_SHARK.BQ
VBA32 3.12.8.2 2008.08.01 Backdoor.Win32.Shark.bbz
ViRobot 2008.8.1.1321 2008.08.01 -
VirusBuster 4.5.11.0 2008.08.01 -
Webwasher-Gateway 6.6.2 2008.08.02 Trojan.Backdoor.Shark.B
weitere Informationen
File size: 303686 bytes
MD5...: a322f43ef2c5b43de79bd5522361af55
SHA1..: ee7d8fad9d5ed1a90413da46814117198841f447
SHA256: 146beee2d6a2a2fddd8b52516e73e0c22bb6a28923758be41efb7e2101f1d41a
SHA512: 85b19a20e94680fa16ad566c957139427fbb0418c44d2dc3a213ab8919633487
b469fa2fbc248a13b3d9047cfd8fb234a5e76ff0f32dec8f1b9162f82c764beb
PEiD..: UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x456cc0
timedatestamp.....: 0x47ed57c1 (Fri Mar 28 20:40:33 2008)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
UPX0 0x1000 0x31000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
UPX1 0x32000 0x25000 0x25000 7.84 1d45e0c545729302defa698b49c8cd18
.rsrc 0x57000 0x1000 0x200 3.38 cc75c6404e7303e6c1d4a9c2d0227f73

( 2 imports )
> KERNEL32.DLL: LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ExitProcess
> MSVBVM60.DLL: -

( 0 exports )
packers (Authentium): UPX
packers (F-Prot): UPX
packers (Avast): UPX


atei BLEIFREI-2302C7.vbs empfangen 2008.08.02 09:37:09 (CET)
Antivirus Version letzte aktualisierung Ergebnis
AhnLab-V3 2008.7.29.1 2008.08.01 VBS/Solow.Gen
AntiVir 7.8.1.15 2008.08.01 HEUR/HTML.Malware
Authentium 5.1.0.4 2008.08.01 VBS/Solow.A
Avast 4.8.1195.0 2008.08.01 VBS:Solow-C
AVG 8.0.0.156 2008.08.01 VBS/Small
BitDefender 7.2 2008.08.02 Worm.VBS.Solow.G
CAT-QuickHeal 9.50 2008.08.01 VBS/IETitle
ClamAV 0.93.1 2008.08.02 -
DrWeb 4.44.0.09170 2008.08.01 VBS.Generic.582
eSafe 7.0.17.0 2008.07.29 -
eTrust-Vet 31.6.6002 2008.08.02 VBS/Slogod
Ewido 4.0 2008.08.01 -
F-Prot 4.4.4.56 2008.08.01 VBS/Solow.A
F-Secure 7.60.13501.0 2008.08.02 Virus.VBS.AutoRun.au
Fortinet 3.14.0.0 2008.08.02 -
GData 2.0.7306.1023 2008.08.02 Virus.VBS.AutoRun.au
Ikarus T3.1.1.34.0 2008.08.02 Virus.VBS.AutoRun.c
K7AntiVirus 7.10.402 2008.08.01 -
Kaspersky 7.0.0.125 2008.08.02 Virus.VBS.AutoRun.au
McAfee 5352 2008.08.01 VBS/IE-Title
Microsoft 1.3704 2008.07.28 Worm:VBS/Slogod.F
NOD32v2 3318 2008.08.01 VBS/Butsur.E
Norman 5.80.02 2008.08.01 VBS/Solow.I
Panda 9.0.0.4 2008.08.02 VBS/Autorun.KU
PCTools 4.4.2.0 2008.08.01 VBS.Niric.B
Prevx1 V2 2008.08.02 -
Rising 20.55.42.00 2008.08.02 Worm.VBS.Sowel.a
Sophos 4.31.0 2008.08.02 VBS/Sasan-Fam
Sunbelt 3.1.1537.1 2008.08.01 -
Symantec 10 2008.08.02 VBS.Solow
TheHacker 6.2.96.391 2008.07.31 -
TrendMicro 8.700.0.1004 2008.08.01 VBS_SOLOW.AK
VBA32 3.12.8.2 2008.08.01 -
ViRobot 2008.8.1.1321 2008.08.01 VBS.Psyme.4308.B
VirusBuster 4.5.11.0 2008.08.01 VBS.Niric.B
Webwasher-Gateway 6.6.2 2008.08.02 Heuristic.HTML.Malware
weitere Informationen
File size: 379626 bytes
MD5...: 2695d2a03c7b4ccd17e8e6c0a885294c
SHA1..: 29147efd2298a70a26bd6c82553d610c8d7b1a17
SHA256: b163d92cb24ba5c9070a9f8f9d1c988c7b9de504c960ee3f8b9c8255df0750c0
SHA512: 8731d512b6f741f82158a97fc185287ea79a1b6bd8a1bd888478e4deab257837<br>789f0de536a97c0fc9cbe93648ce758a2e255b1bcd17b68fe566bdecf7c65ca7
PEiD..: -
PEInfo: -
packers (F-Prot): Unicode, ARJ
packers (Authentium): Unicode


Grüsse HoM3R