| |
| |||||||
Log-Analyse und Auswertung: bekomme virtumonde nicht entferntWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
| |
07.11.2008, 08:20
| #1 |
| |  bekomme virtumonde nicht entfernt Hallo liebe Leute, laut Spybot habe ich mir das Biest Virtumonde eingefangen. Jedesmal wenn ich Ihn entfernen will ist er beim Neustart wieder da. Desweiteren komme ich zwar in mein Windows Sicherheitscenter rein aber ich kann die automatischen Updates nicht aktivieren. Scheint blockiert zu sein. Die WIndows Vorschläge habe ich schon abgearbeitet. Hat aber nichts genutzt. Dankle für Eure Hilfe. Anbei das Logfile. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 21:08:12, on 06.11.2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16735) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\SYSTEM32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe c:\APPS\HIDSERVICE\HIDSERVICE.exe C:\WINDOWS\System32\svchost.exe C:\Programme\Microsoft SQL Server\MSSQL$DATEV_CL_DE01\Binn\sqlservr.exe C:\WINDOWS\system32\slserv.exe C:\WINDOWS\system32\svchost.exe C:\Programme\TwonkyMedia\TwonkyMedia.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\WINDOWS\Explorer.EXE C:\Programme\TwonkyMedia\TwonkyMediaServer.exe C:\WINDOWS\system32\wscntfy.exe C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Programme\Java\jre1.6.0_07\bin\jusched.exe C:\WINDOWS\system32\RunDll32.exe C:\Programme\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\svchost.exe C:\Programme\ATI Technologies\ATI.ACE\Core-Static\ccc.exe C:\Programme\Internet Explorer\iexplore.exe C:\Programme\Internet Explorer\iexplore.exe C:\Programme\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.packardbell.de/services/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Programme\Gemeinsame Dateien\Symantec Shared\AdBlocking\NISShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programme\Norton Internet Security\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar2.dll O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [SbUsb AudCtrl] RunDll32 sbusbdll.dll,RCMonitor O4 - HKLM\..\Run: [StartCCC] "C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [updateMgr] C:\Programme\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9 O4 - HKCU\..\Policies\Explorer\Run: [NT Printing Services] ftps.exe O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: (no name) - {dfb852a3-47f8-48c4-a200-58cab36fd2a2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {dfb852a3-47f8-48c4-a200-58cab36fd2a2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: bmnet.dll O10 - Unknown file in Winsock LSP: bmnet.dll O10 - Unknown file in Winsock LSP: bmnet.dll O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\ger.htm O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab O16 - DPF: {3B36B017-7E49-426B-95B0-B5CECD83C2E2} (IfolorUploader Control) - http://chkr-web.ifolor.net/ORDERINGGENERAL/LowRes/app_support/ActiveX/IfolorUploader_chkr.cab O18 - Filter hijack: text/html - (no CLSID) - (no file) O20 - AppInit_DLLs: luptms.dll O21 - SSODL: SKOEfobjU - {48F32FD0-E259-857A-11BC-D8A06E0F9ABA} - C:\WINDOWS\system32\qdlply.dll O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: IS Service (ISSVC) - Symantec Corporation - C:\Programme\Norton Internet Security\ISSVC.exe O23 - Service: SAVScan - Symantec Corporation - C:\Programme\Norton Internet Security\Norton AntiVirus\SAVScan.exe O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe O23 - Service: TwonkyVision MediaServer (TwonkyVision_Media_Server) - PacketVideo - C:\Programme\TwonkyMedia\TwonkyMedia.exe -- End of file - 5871 bytes |
|
07.11.2008, 08:34
| #2 |
  | bekomme virtumonde nicht entfernt Hi,
__________________Bitte folgende Files prüfen: Dateien Online überprüfen lassen:
Code:
ATTFilter C:\WINDOWS\system32\qdlply.dll
Achtung, die nachfolgenden Dateien können auch unter C:\windows-liegen (prüfen!)
C:\WINDOWS\system32\luptms.dll
C:\WINDOWS\system32\ftps.exe
Also: Anleitung Avenger (by swandog46) 1.) Lade dir das Tool Avenger und speichere es auf dem Desktop:  2.) Das Programm so einstellen wie es auf dem Bild zu sehen ist. Kopiere nun folgenden Text in das weiße Feld: (bei -> "input script here") Code:
ATTFilter Registry values to replace with dummy:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows|AppInit_DLLs
Files to delete:
C:\WINDOWS\system32\qdlply.dll
C:\WINDOWS\system32\luptms.dll
C:\WINDOWS\system32\ftps.exe
Folders to delete:
C:\Programme\Save
C:\Programme\BearShare
4.) Um den Avenger zu starten klicke auf -> Execute Dann bestätigen mit "Yes" das der Rechner neu startet! 5.) Nachdem das System neu gestartet ist, findest du hier einen Report vom Avenger -> C:\avenger.txt Öffne die Datei mit dem Editor und kopiere den gesamten Text in deinen Beitrag hier am Trojaner-Board. Hijackthis, fixen: öffne das HijackThis -- Button "scan" -- vor den nachfolgenden Einträge Häkchen setzen -- Button "Fix checked" -- PC neustarten Beim fixen müssen alle Programme geschlossen sein! Code:
ATTFilter O20 - AppInit_DLLs: luptms.dll
O21 - SSODL: SKOEfobjU - {48F32FD0-E259-857A-11BC-D8A06E0F9ABA} - C:\WINDOWS\system32\qdlply.dll
O4 - HKCU\..\Policies\Explorer\Run: [NT Printing Services] ftps.exe
Malwarebytes Antimalware (MAM). Anleitung&Download hier: http://www.trojaner-board.de/51187-malwarebytes-anti-malware.html Fullscan und alles bereinigen lassen! Log posten. Chris
__________________ |
|
07.11.2008, 09:37
| #3 |
| | bekomme virtumonde nicht entfernt Danke für die schnelle Antwort.
__________________Virusscan sagt bei Datei C:\WINDOWS\system32\ftps.exe 0 bytes size received Bei dieser Datei hat Virusscan nach 30 Min immer noch nicht übertragen C:\WINDOWS\system32\qdlply.dll Mit dieser Datei geht es C:\WINDOWS\system32\luptms.dll Ergebnis: Datei luptms.dll empfangen 2008.11.07 09:04:44 (CET) Status: Beendet Ergebnis: 4/36 (11.11%) Filter Filter Drucken der Ergebnisse Drucken der Ergebnisse Antivirus Version letzte aktualisierung Ergebnis AhnLab-V3 2008.11.7.1 2008.11.06 - AntiVir 7.9.0.26 2008.11.07 - Authentium 5.1.0.4 2008.11.06 - Avast 4.8.1248.0 2008.11.06 - AVG 8.0.0.161 2008.11.07 - BitDefender 7.2 2008.11.07 - CAT-QuickHeal 9.50 2008.11.07 - ClamAV 0.94.1 2008.11.07 - DrWeb 4.44.0.09170 2008.11.07 - eSafe 7.0.17.0 2008.11.06 Suspicious File eTrust-Vet 31.6.6195 2008.11.06 - Ewido 4.0 2008.11.06 - F-Prot 4.4.4.56 2008.11.06 - F-Secure 8.0.14332.0 2008.11.07 - Fortinet 3.117.0.0 2008.11.07 - GData 19 2008.11.07 - Ikarus T3.1.1.45.0 2008.11.07 - K7AntiVirus 7.10.518 2008.11.06 - Kaspersky 7.0.0.125 2008.11.07 - McAfee 5426 2008.11.06 - Microsoft 1.4104 2008.11.07 Trojan:Win32/Conhook.D NOD32 3593 2008.11.07 - Norman 5.80.02 2008.11.06 - Panda 9.0.0.4 2008.11.06 - PCTools 4.4.2.0 2008.11.06 - Prevx1 V2 2008.11.07 Cloaked Malware Rising 21.02.41.00 2008.11.07 - SecureWeb-Gateway 6.7.6 2008.11.06 - Sophos 4.35.0 2008.11.07 - Sunbelt 3.1.1783.2 2008.11.05 - Symantec 10 2008.11.07 Trojan.Vundo TheHacker 6.3.1.1.143 2008.11.07 - TrendMicro 8.700.0.1004 2008.11.07 - VBA32 3.12.8.9 2008.11.06 - ViRobot 2008.11.6.1456 2008.11.07 - VirusBuster 4.5.11.0 2008.11.06 - weitere Informationen File size: 113664 bytes MD5...: a2c392888077453983ad673d8339aa78 SHA1..: b6776d459feb3cc3a5ad89cef99b5fbc73093bb7 SHA256: 1cad949fb51d7b04155d3e747de0e78129108d83d82713f1d612d0543025a270 SHA512: 6f3e47747258d399551e6732ee61080fa366e6a080ffd061ab6b7d98ca63736e f9b96f55a71bce38615fb33430fc7993ed3372c07457d641e41b3fc8b357e0fc PEiD..: - TrID..: File type identification Win32 Executable Generic (58.6%) Clipper DOS Executable (13.8%) Generic Win/DOS Executable (13.7%) DOS Executable Generic (13.7%) PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x10001cb0 timedatestamp.....: 0x491288a7 (Thu Nov 06 06:03:19 2008) machinetype.......: 0x14c (I386) ( 7 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x1000 0x2e53 0x2800 6.09 0af7bafa4c1740e0a41d9079ef139a63 .data 0x4000 0x15a74 0x1200 5.63 f8913069c7af35cf9ab3b86630bef2ca .bdata 0x1a000 0x20d 0x400 3.28 7a9323c9e13b7a72c9c04228a4419e42 .jdata 0x1b000 0xb825 0x1400 7.71 b9cce4047139f8d0b71ca1067d3e4ef5 .edata 0x27000 0x1fcfa 0x15a00 7.99 c2b20169e18616b53ded68439122836f .rsrc 0x47000 0x314 0x400 2.93 f412b105e3760a88e523a13ceb056f56 .reloc 0x48000 0x71c 0x800 5.43 851a8e724354ffdcdd4c94ce3f1540a0 ( 5 imports ) > kernel32.dll: CallNamedPipeW, CancelWaitableTimer, ContinueDebugEvent, CreateEventW, CreateToolhelp32Snapshot, CreateWaitableTimerW, DebugActiveProcess, ExitProcess, FoldStringW, GetCPInfoExA, GetCPInfoExW, GetCommMask, GetCommState, GetCommandLineW, GetConsoleFontSize, GetConsoleTitleA, GetCurrentProcess, GetFileSize, GetMailslotInfo, GetModuleFileNameA, GetModuleHandleW, GetProcessPriorityBoost, GetProfileSectionA, GetStringTypeW, GetTempPathA, GetUserDefaultLCID, GlobalLock, Heap32ListFirst, InitializeCriticalSectionAndSpinCount, InterlockedExchange, IsBadWritePtr, LoadResource, OpenEventA, QueryDosDeviceA, RemoveDirectoryA, RtlFillMemory, RtlMoveMemory, RtlZeroMemory, SetFileAttributesA, SetHandleCount, SetLocaleInfoW, SetThreadAffinityMask, Sleep, SwitchToThread, VDMOperationStarted, VirtualProtect, WriteConsoleOutputW, _lclose, _lread, lstrcmpA, lstrcmpiA > user32.dll: AnimateWindow, CloseWindow, DdeCreateDataHandle, DialogBoxIndirectParamW, DlgDirSelectExW, DrawIconEx, EndPaint, EnumClipboardFormats, EnumDisplaySettingsA, ExitWindowsEx, FrameRect, GetCaretBlinkTime, GetClassInfoW, GetClassWord, GetClientRect, GetMenuInfo, GetMenuStringA, GetMenuStringW, GetParent, GetSystemMenu, IsCharLowerA, LoadAcceleratorsA, LoadCursorFromFileW, MonitorFromPoint, OemKeyScan, RealGetWindowClassW, SetLastErrorEx, SetMenu, SetWindowLongA, SetWindowPlacement, ShowWindow, UnregisterClassA, WinHelpW, mouse_event > gdi32.dll: CreateDIBPatternBrush, CreateRectRgn, CreateSolidBrush, EnumFontsW, GdiComment, GetBrushOrgEx, GetClipBox, GetClipRgn, GetColorSpace, GetDIBits, GetEnhMetaFileDescriptionA, GetMetaFileBitsEx, GetPath, GetPixelFormat, GetTextColor, GetTextFaceA, GetTextFaceW, GetTextMetricsW, GetWindowExtEx, PaintRgn, PathToRegion, PolyTextOutW, SetFontEnumeration, SetGraphicsMode, UpdateColors > comdlg32.dll: FindTextW, GetOpenFileNameW > msvcrt.dll: _execlp, _execvpe, _expand, _snwprintf, _strlwr, _strnicmp, _wcsicmp, _wexecve, fgetws, mblen, pow, remove, strlen, towupper ( 22 exports ) BdtqCyfMymA, BjrpynpdNnX, GMcErqlqbhy, Hrnbqjlmxejt, IkvhexzmgsLjuo, MkfegevrtGsqle, NmthpyjpszRK, QflGqgaVdKhz, QqXansevufx, RhgdhhBZzqnkyp, RyqxgxGgwKu, SAcxbvafi, SHsiMz, SZikflq, TdSsWucmgxvju, UcsrxWuphK, UwnmRka, ViysZpqdxq, VlfxzvizIPoO, VxdylbRa, YSGnWun, ZghjqgACih Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=0C1D4EA6007EBBCFBCCB01E7236AE400E76A60B2 |
|
07.11.2008, 09:47
| #4 |
| | bekomme virtumonde nicht entfernt Hier das Ergebnis vom Avenger: Logfile of The Avenger Version 2.0, (c) by Swandog46 http://swandog46.geekstogo.com Platform: Windows XP ******************* Script file opened successfully. Script file read successfully. Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: Rootkit scan active. No rootkits found! File "C:\WINDOWS\system32\qdlply.dll" deleted successfully. File "C:\WINDOWS\system32\luptms.dll" deleted successfully. File "C:\WINDOWS\system32\ftps.exe" deleted successfully. Error: folder "C:\Programme\Save" not found! Deletion of folder "C:\Programme\Save" failed! Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND) --> the object does not exist Error: folder "C:\Programme\BearShare" not found! Deletion of folder "C:\Programme\BearShare" failed! Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND) --> the object does not exist Registry value "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows|AppInit_DLLs" replaced with dummy successfully. Completed script processing. ******************* Finished! Terminate. |
|
07.11.2008, 10:02
| #5 |
| | bekomme virtumonde nicht entfernt Hi, bitte noch HJ-fixen und dann MAM und als letztes ein neues HJ-Log... Es sieht so aus (bei der Erkennungsrate), dass da eine neue Welle noch nicht bekannter Varianten anrollt... chris
__________________  Don't bring me downVor dem posten beachten! Spenden (Wer spenden will, kann sich gerne melden  ) |
|
07.11.2008, 11:00
| #6 |
| | bekomme virtumonde nicht entfernt Vielen Dank das scheint geholfen zu haben. Hier meine Hausaufgaben :-) Sieht glaube ich ganz gut aus oder versteckt sich da noch etwas? Gruß Jan Malwarebytes' Anti-Malware 1.30 Datenbank Version: 1371 Windows 5.1.2600 Service Pack 3 07.11.2008 10:49:20 mbam-log-2008-11-07 (10-49-20).txt Scan-Methode: Vollständiger Scan (C:\|D:\|) Durchsuchte Objekte: 94771 Laufzeit: 42 minute(s), 8 second(s) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 2 Infizierte Registrierungsschlüssel: 17 Infizierte Registrierungswerte: 2 Infizierte Dateiobjekte der Registrierung: 2 Infizierte Verzeichnisse: 3 Infizierte Dateien: 29 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: C:\WINDOWS\system32\ilaqlton.dll (Trojan.Vundo.H) -> Delete on reboot. C:\WINDOWS\system32\khfgETKc.dll (Trojan.Vundo.H) -> Delete on reboot. Infizierte Registrierungsschlüssel: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{40e94113-4007-4d40-bed7-ee18399c57bf} (Trojan.Vundo.H) -> Delete on reboot. HKEY_CLASSES_ROOT\CLSID\{40e94113-4007-4d40-bed7-ee18399c57bf} (Trojan.Vundo.H) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0a25cb9d-24b5-4147-995d-4ce85ed0cbb0} (Trojan.BHO.H) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{0a25cb9d-24b5-4147-995d-4ce85ed0cbb0} (Trojan.BHO.H) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{28972e74-24b5-4147-995d-4ce85ed0cbb0} (Trojan.BHO.H) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{28972e74-24b5-4147-995d-4ce85ed0cbb0} (Trojan.BHO.H) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{75abcf92-9764-4dfa-a83f-5142c3905052} (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{9afb8248-617f-460d-9366-d71cdeda3179} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{4d1c4e81-a32a-416b-bcdb-33b3ef3617d3} (Adware.Need2Find) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{75abcf92-9764-4dfa-a83f-5142c3905052} (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\antiviruspro2009 (Rogue.Antivirus2008) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully. Infizierte Registrierungswerte: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\48f32f60 (Trojan.Vundo.H) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{75abcf92-9764-4dfa-a83f-5142c3905052} (Trojan.Vundo) -> Quarantined and deleted successfully. Infizierte Dateiobjekte der Registrierung: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\khfgetkc -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\khfgetkc -> Delete on reboot. Infizierte Verzeichnisse: C:\Programme\AntivirusPro2009 (Rogue.Antivirus2008) -> Quarantined and deleted successfully. C:\Programme\AntivirusPro2009\data (Rogue.Antivirus2008) -> Quarantined and deleted successfully. C:\Programme\AntivirusPro2009\Microsoft.VC80.CRT (Rogue.Antivirus2008) -> Quarantined and deleted successfully. Infizierte Dateien: C:\WINDOWS\system32\khfgETKc.dll (Trojan.Vundo.H) -> Delete on reboot. C:\WINDOWS\system32\cKTEgfhk.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\cKTEgfhk.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\ilaqlton.dll (Trojan.Vundo.H) -> Delete on reboot. C:\WINDOWS\system32\notlqali.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\jwmjqfhi.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\ihfqjmwj.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\nonjuxht.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\thxujnon.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\xbvtpecq.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\qceptvbx.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\qinhjxkh.dll (Trojan.BHO.H) -> Quarantined and deleted successfully. C:\Dokumente und Einstellungen\Guenter\Lokale Einstellungen\Temporary Internet Files\Content.IE5\UFXA8BB8\upd105320[2] (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\Programme\AntivirusPro2009\AntivirusPro2009.cfg (Rogue.Antivirus2008) -> Quarantined and deleted successfully. C:\Programme\AntivirusPro2009\AntivirusPro2009.exe (Rogue.Antivirus2008) -> Quarantined and deleted successfully. C:\Programme\AntivirusPro2009\AVEngn.dll (Rogue.Antivirus2008) -> Quarantined and deleted successfully. C:\Programme\AntivirusPro2009\htmlayout.dll (Rogue.Antivirus2008) -> Quarantined and deleted successfully. C:\Programme\AntivirusPro2009\pthreadVC2.dll (Rogue.Antivirus2008) -> Quarantined and deleted successfully. C:\Programme\AntivirusPro2009\wscui.cpl (Rogue.Antivirus2008) -> Quarantined and deleted successfully. C:\Programme\AntivirusPro2009\data\daily.cvd (Rogue.Antivirus2008) -> Quarantined and deleted successfully. C:\Programme\AntivirusPro2009\Microsoft.VC80.CRT\Microsoft.VC80.CRT.manifest (Rogue.Antivirus2008) -> Quarantined and deleted successfully. C:\Programme\AntivirusPro2009\Microsoft.VC80.CRT\msvcm80.dll (Rogue.Antivirus2008) -> Quarantined and deleted successfully. C:\Programme\AntivirusPro2009\Microsoft.VC80.CRT\msvcp80.dll (Rogue.Antivirus2008) -> Quarantined and deleted successfully. C:\Programme\AntivirusPro2009\Microsoft.VC80.CRT\msvcr80.dll (Rogue.Antivirus2008) -> Quarantined and deleted successfully. C:\WINDOWS\system32\winpfz33.sys (Malware.Trace) -> Quarantined and deleted successfully. C:\WINDOWS\system32\drivers\services.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\U.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Dokumente und Einstellungen\Guenter\Anwendungsdaten\Microsoft\Internet Explorer\Quick Launch\AntivirusPro2009.lnk (Rogue.Antivirus2008) -> Quarantined and deleted successfully. C:\Dokumente und Einstellungen\Guenter\delself.bat (Malware.Trace) -> Quarantined and deleted successfully. ______________________________________________________________ Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:53:53, on 07.11.2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16735) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\SYSTEM32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe c:\APPS\HIDSERVICE\HIDSERVICE.exe C:\WINDOWS\System32\svchost.exe C:\Programme\Microsoft SQL Server\MSSQL$DATEV_CL_DE01\Binn\sqlservr.exe C:\WINDOWS\system32\slserv.exe C:\WINDOWS\system32\svchost.exe C:\Programme\TwonkyMedia\TwonkyMedia.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\WINDOWS\Explorer.EXE C:\Programme\TwonkyMedia\TwonkyMediaServer.exe C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Programme\Java\jre1.6.0_07\bin\jusched.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\RunDll32.exe C:\Programme\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\WINDOWS\system32\ctfmon.exe C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe C:\Programme\ATI Technologies\ATI.ACE\Core-Static\ccc.exe C:\Programme\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.packardbell.de/services/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell O2 - BHO: {25fc5c79-bccc-66ba-b334-8bc49fa1f91e} - {e19f1af9-4cb8-433b-ab66-cccb97c5cf52} - C:\WINDOWS\system32\vqxsmf.dll O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Programme\Gemeinsame Dateien\Symantec Shared\AdBlocking\NISShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programme\Norton Internet Security\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar2.dll O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [SbUsb AudCtrl] RunDll32 sbusbdll.dll,RCMonitor O4 - HKLM\..\Run: [StartCCC] "C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [updateMgr] C:\Programme\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9 O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: (no name) - {dfb852a3-47f8-48c4-a200-58cab36fd2a2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {dfb852a3-47f8-48c4-a200-58cab36fd2a2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: bmnet.dll O10 - Unknown file in Winsock LSP: bmnet.dll O10 - Unknown file in Winsock LSP: bmnet.dll O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\ger.htm O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab O16 - DPF: {3B36B017-7E49-426B-95B0-B5CECD83C2E2} (IfolorUploader Control) - http://chkr-web.ifolor.net/ORDERINGGENERAL/LowRes/app_support/ActiveX/IfolorUploader_chkr.cab O18 - Filter hijack: text/html - (no CLSID) - (no file) O20 - Winlogon Notify: qoMfeBTm - qoMfeBTm.dll (file missing) O20 - Winlogon Notify: reset5e - C:\WINDOWS\SYSTEM32\reset5e.dll O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: IS Service (ISSVC) - Symantec Corporation - C:\Programme\Norton Internet Security\ISSVC.exe O23 - Service: SAVScan - Symantec Corporation - C:\Programme\Norton Internet Security\Norton AntiVirus\SAVScan.exe O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe O23 - Service: Twonky Vision MediaServer (TwonkyVision_Media_Server) - PacketVideo - C:\Programme\TwonkyMedia\TwonkyMedia.exe -- End of file - 5855 bytes |
|
| Themen zu bekomme virtumonde nicht entfernt |
| adobe, antivirus, blockiert, dll, entfernen, explorer, generic, google, hijack, hijackthis, hkus\s-1-5-18, internet, internet explorer, internet security, microsoft, mssql, neustart, programme, rundll, security, server, software, symantec, system, updates, virtumonde, windows, windows xp, windows xp sp3, xp sp3 |
Hybrid-Darstellung
