![]() |
|
Log-Analyse und Auswertung: Hatte (habe?) VIRUS ALERT! Sind alle Schädlinge weg?Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
![]() | #1 |
| ![]() Hatte (habe?) VIRUS ALERT! Sind alle Schädlinge weg? Hi, habe mir gestern nen virus zugezogen (Windows 2000). Neben der Uhr in der Taskleiste stand VIRUS ALERT!, auf die Festplatte konnte ich nicht mehr zugreifen. So wie in einigen threads dazu beschrieben, habe ich jetzt erst den CCleaner, dann Anti-Malware/Malwarebytes und HJT drüber laufen lassen. Jetzt ist VIRUS ALERT! verschwunden, Festplatte etc. alles wieder da. Da ich mich aber nicht auskenne im Lesen von logfiles bitte ich drum, das mal anzusehen. Ist jetzt wirklich alles von meinem Comp. Weg? Oder sollte ich noch was machen? Bei HJT habe ich jetzt noch nichts gefixt, nur gescant und hier gepostet. Wär nett wenn sichs jemand anschaut! Danke Logfile von Anti-Malware Code:
ATTFilter Malwarebytes' Anti-Malware 1.25 Datenbank Version: 1076 Windows 5.0.2195 Service Pack 4 14:49:23 22.08.2008 mbam-log-08-22-2008 (14-49-23).txt Scan-Methode: Vollständiger Scan (C:\|D:\|E:\|F:\|) Durchsuchte Objekte: 76313 Laufzeit: 1 hour(s), 42 minute(s), 59 second(s) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 2 Infizierte Registrierungsschlüssel: 16 Infizierte Registrierungswerte: 3 Infizierte Dateiobjekte der Registrierung: 16 Infizierte Verzeichnisse: 7 Infizierte Dateien: 32 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: C:\WINNT\vtqnxfko.dll (Trojan.Zlob) -> Delete on reboot. C:\WINNT\tsxngabr.dll (Trojan.FakeAlert) -> Delete on reboot. Infizierte Registrierungsschlüssel: HKEY_CLASSES_ROOT\CLSID\{5f47fbeb-76df-4dca-a296-3db19eb75bec} (Trojan.Zlob) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{086f3adf-92ea-4415-877e-c7dd7dd64f14} (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{46a4e9d9-b30e-452a-8157-dbbec8573b03} (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7da39570-5fd2-4f18-94b4-20730cb3f727} (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{74dd705d-6834-439c-a735-a6dbe2677452} (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c0083180 (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Juan (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{7e381d33-7a51-4322-901c-0053def986ac} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\webvideo (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\TypeLib\{fe004307-5611-4b28-a8d3-20897e8a045d} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{092ff302-89cb-45eb-8869-80c9c20503ac} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{ad13e85e-fd93-44df-9e30-99a2172ce453} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{0a0ac612-42c3-4e93-981d-54ba756bc15e} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0a0ac612-42c3-4e93-981d-54ba756bc15e} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VSPlugin (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt (Trojan.Downloader) -> Quarantined and deleted successfully. Infizierte Registrierungswerte: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\vtqnxfko (Trojan.Zlob) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\0\source (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\tsxngabr (Trojan.FakeAlert) -> Delete on reboot. Infizierte Dateiobjekte der Registrierung: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page (Hijack.Homepage) -> Bad: (h**p://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2) Good: (h**p://www.google.com/) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductId (Trojan.FakeAlert) -> Bad: (VIRUS ALERT!) Good: (52200-270-2761005-09840) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\Control Panel\International\sTimeFormat (Trojan.FakeAlert) -> Bad: (HH:mm: VIRUS ALERT!) Good: (HH:mm:ss) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowControlPanel (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowRun (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowSearch (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowHelp (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowMyDocs (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowMyComputer (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuMorePrograms (Hijack.StartMenu) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\StartMenuLogOff (Hijack.StartMenu) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives (Hijack.Drives) -> Bad: (12) Good: (0) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoToolbarCustomize (Hijack.Explorer) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetFolders (Hijack.Explorer) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispCPL (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. Infizierte Verzeichnisse: C:\WINNT\privacy_danger (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\WINNT\privacy_danger\images (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Programme\PCHealthCenter (Trojan.Fakealert) -> Quarantined and deleted successfully. C:\Programme\VSAdd-in (Adware.Agent) -> Quarantined and deleted successfully. C:\Programme\VAV (Rogue.VistaAntivirus2008) -> Quarantined and deleted successfully. C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\searchtoolbarcorp (Adware.Agent) -> Quarantined and deleted successfully. C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\searchtoolbarcorp\Toolbar Vision (Adware.Agent) -> Quarantined and deleted successfully. Infizierte Dateien: C:\WINNT\vtqnxfko.dll (Trojan.Zlob) -> Delete on reboot. C:\WINNT\emtb.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Programme\PCHealthCenter\0.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Programme\PCHealthCenter\1.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Programme\PCHealthCenter\2.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\WINNT\privacy_danger\index.htm (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\WINNT\privacy_danger\images\capt.gif (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\WINNT\privacy_danger\images\danger.jpg (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\WINNT\privacy_danger\images\down.gif (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\WINNT\privacy_danger\images\spacer.gif (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Programme\PCHealthCenter\0.gif (Trojan.Fakealert) -> Quarantined and deleted successfully. C:\Programme\PCHealthCenter\1.gif (Trojan.Fakealert) -> Quarantined and deleted successfully. C:\Programme\PCHealthCenter\2.gif (Trojan.Fakealert) -> Quarantined and deleted successfully. C:\Programme\PCHealthCenter\3.gif (Trojan.Fakealert) -> Quarantined and deleted successfully. C:\Programme\PCHealthCenter\sc.html (Trojan.Fakealert) -> Quarantined and deleted successfully. C:\Programme\PCHealthCenter\sex1.ico (Trojan.Fakealert) -> Quarantined and deleted successfully. C:\Programme\PCHealthCenter\sex2.ico (Trojan.Fakealert) -> Quarantined and deleted successfully. C:\Programme\VAV\vav1.dat (Rogue.VistaAntivirus2008) -> Quarantined and deleted successfully. C:\Programme\VAV\vav.cpl (Rogue.VistaAntivirus2008) -> Quarantined and deleted successfully. C:\Programme\VAV\vav0.dat (Rogue.VistaAntivirus2008) -> Quarantined and deleted successfully. C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\searchtoolbarcorp\Toolbar Vision\WebHistory.txt (Adware.Agent) -> Quarantined and deleted successfully. C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\searchtoolbarcorp\Toolbar Vision\PageHistory.txt (Adware.Agent) -> Quarantined and deleted successfully. C:\WINNT\system32\sex1.ico (Malware.Trace) -> Quarantined and deleted successfully. C:\WINNT\system32\sex2.ico (Malware.Trace) -> Quarantined and deleted successfully. C:\WINNT\system32\vav.cpl (Rogue.VistaAntivirus2008) -> Quarantined and deleted successfully. C:\WINNT\system32\__c00AD2A2.dat (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINNT\tsxngabr.dll (Trojan.FakeAlert) -> Delete on reboot. C:\WINNT\tqwolser.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\WINNT\rafbsvnx.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\WINNT\twmxbsqrsqm.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\TmpRecentIcons\Vista Antivirus 2008.lnk (Rogue.Link) -> Quarantined and deleted successfully. C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Temp\dat68.tmp (Trojan.Agent) -> Quarantined and deleted successfully. Logfile von HJT Code:
ATTFilter Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 14:57:23, on 22.08.2008 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Boot mode: Normal Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\Programme\AntiVir PersonalEdition Classic\sched.exe C:\Programme\AntiVir PersonalEdition Classic\avguard.exe C:\Programme\avmwlanstick\WlanNetService.exe C:\WINNT\System32\svchost.exe C:\WINNT\system32\MSTask.exe C:\WINNT\system32\stisvc.exe C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\system32\svchost.exe C:\WINNT\Explorer.EXE C:\Programme\Gemeinsame Dateien\Ulead Systems\AutoDetector\monitor.exe C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe C:\Programme\avmwlanstick\wlangui.exe C:\Programme\QuickTime\qttask.exe C:\Programme\WinampAlt\Winampa.exe C:\Programme\FreePDF_XP\fpassist.exe C:\Programme\ICQLite\ICQLite.exe C:\PROGRA~1\TEXTBR~1.0\Bin\INSTAN~1.EXE C:\WINNT\system32\internat.exe C:\Programme\Microsoft Office\Office\OSA.EXE C:\Programme\TextBridge Classic 2.0\Ereg\REMIND32.EXE C:\Dokumente und Einstellungen\Administrator\Desktop\HiJackthis\HiJackThis.exe O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {81929DD6-FEEB-47E0-96F2-CB3350453149} - (no file) O3 - Toolbar: (no name) - {74DD705D-6834-439C-A735-A6DBE2677452} - (no file) O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx O3 - Toolbar: (no name) - {1B27DC3F-A487-486D-BBA8-CA45373B1457} - (no file) O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\\NeroCheck.exe O4 - HKLM\..\Run: [Ulead AutoDetector v2] C:\Programme\Gemeinsame Dateien\Ulead Systems\AutoDetector\monitor.exe O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [AVMWlanClient] C:\Programme\avmwlanstick\wlangui.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [WinampAgent] "C:\Programme\WinampAlt\Winampa.exe" O4 - HKLM\..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe O4 - HKLM\..\Run: [ICQ Lite] "C:\Programme\ICQLite\ICQLite.exe" -minimize O4 - HKLM\..\Run: [InstantAccess] C:\PROGRA~1\TEXTBR~1.0\Bin\INSTAN~1.EXE /h O4 - HKLM\..\Run: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE O4 - HKLM\..\Run: [³] e O4 - HKLM\..\RunServices: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE O4 - HKCU\..\Run: [internat.exe] internat.exe O4 - HKCU\..\Run: [³] e O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -trayboot O4 - HKUS\.DEFAULT\..\Run: [internat.exe] internat.exe (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Programme\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user') O4 - Startup: Office-Start.lnk = C:\Programme\Microsoft Office\Office\OSA.EXE O4 - Startup: reminder-ScanSoft Produkt Registrierung.lnk = C:\Programme\TextBridge Classic 2.0\Ereg\REMIND32.EXE O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm O10 - Unknown file in Winsock LSP: c:\winnt\system32\nwprovau.dll O12 - Plugin for .spop: C:\Programme\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - h**p://software-dl.real.com/261ee5f358a781b22d06/netzip/RdxIE601_de.cab O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - h**p://static.ak.studivz.net/photouploader/ImageUploader4.cab O16 - DPF: {F5078F32-C551-11D3-89B9-0000F81FE221} (XML DOM Document 3.0) - file://C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Temp\SFX2.tmp\msxml3.cab O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: AVM WLAN Connection Service - AVM Berlin - C:\Programme\avmwlanstick\WlanNetService.exe O23 - Service: Verwaltungsdienst für die Verwaltung logischer Datenträger (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe O23 - Service: Windows NT Session Manager (SMSS) - Unknown owner - C:\WINNT\system\smss.exe (file missing) O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe O24 - Desktop Component 0: Privacy Protection - (no file) -- End of file - 5366 bytes |
Themen zu Hatte (habe?) VIRUS ALERT! Sind alle Schädlinge weg? |
1.exe, 8.tmp, administrator, adobe, adware.agent, alert, avira, bho, browser, components, desktop, disabletaskmgr, document, einstellungen, explorer, festplatte, helper, hijack.displayproperties, hijack.drives, hijack.homepage, hijack.startmenu, hijack.taskmanager, hijackthis, internet, internet explorer, malware.trace, malwarebytes' anti-malware, nodrives, privacy protection, programme, quara, registrierungsschlüssel, rogue.link, software, stick, system, taskleiste, temp, trojan.downloader, uleadburninghelper, virus, virus alert, virus alert!, vista antivirus, windows, wmid |