Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung

Log-Analyse und Auswertung: fumoei.exe

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML.

Antwort
Alt 11.01.2009, 20:25   #1
Skyfire2
 
fumoei.exe - Standard

fumoei.exe



Hallo,

Habe bereits mit Virus Total überprüft,Logfile u Screenshot liegen bei.Hilfe bitte!

Virus Total.com Scan:
a-squared 4.0.0.73 2009.01.11 -
AhnLab-V3 2009.1.10.0 2009.01.11 -
AntiVir 7.9.0.54 2009.01.10 -
Authentium 5.1.0.4 2009.01.10 W32/Heuristic-KPP!Eldorado
Avast 4.8.1281.0 2009.01.11 -
AVG 8.0.0.229 2009.01.10 -
BitDefender 7.2 2009.01.11 -
CAT-QuickHeal 10.00 2009.01.09 -
ClamAV 0.94.1 2009.01.11 -
Comodo 915 2009.01.11 -
DrWeb 4.44.0.09170 2009.01.11 -
eSafe 7.0.17.0 2009.01.11 -
eTrust-Vet 31.6.6301 2009.01.10 -
F-Prot 4.4.4.56 2009.01.11 W32/Heuristic-KPP!Eldorado
Fortinet 3.117.0.0 2009.01.11 -
GData 19 2009.01.11 -
Ikarus T3.1.1.45.0 2009.01.11 -
K7AntiVirus 7.10.584 2009.01.09 Trojan.Win32.Malware.New
Kaspersky 7.0.0.125 2009.01.11 -
McAfee 5492 2009.01.11 -
McAfee+Artemis 5492 2009.01.11 -
Microsoft 1.4205 2009.01.11 -
NOD32 3757 2009.01.11 -
Norman 5.99.02 2009.01.09 -
Panda 9.4.3.3 2009.01.11 -
PCTools 4.4.2.0 2009.01.11 -
Prevx1 V2 2009.01.11 -
Rising 21.11.62.00 2009.01.11 Trojan.Win32.Mnless.zjy
SecureWeb-Gateway 6.7.6 2009.01.11 -
Sophos 4.37.0 2009.01.11 -
Sunbelt 3.2.1831.2 2009.01.09 -
Symantec 10 2009.01.11 -
TheHacker 6.3.1.4.217 2009.01.10 -
TrendMicro 8.700.0.1004 2009.01.09 -
VBA32 3.12.8.10 2009.01.10 -
ViRobot 2009.1.10.1553 2009.01.10 Spyware.Mnless.40960
VirusBuster 4.5.11.0 2009.01.11 -
weitere Informationen
File size: 40960 bytes
MD5...: 99528ac475755a70f130e4f5b956a395
SHA1..: e9beed2696499e0a31ff55489b4e5f1306742f90
SHA256: 5101e1c1b2f584883ac907adb5d8a69f57505d257c102f8716dfe3938cde424f
SHA512: ede97be6c033e22f3975328ddbc96140cac642024e2000736822bba7f5a3eef3
6467e7b41954ce65c25cb7ce37dfaa09f518e9db370e6030bc4bba6281e1762e
ssdeep: 384:mpTDzSSVHMC5sCdi9tJzTW7O9ta4SzyCSt8MzCENlU:m1eSVs2gtYfCt86Nl
U
PEiD..: Armadillo v1.71
TrID..: File type identification
Win32 Executable MS Visual C++ (generic) (62.7%)
Win32 Executable Generic (14.1%)
Win32 Dynamic Link Library (generic) (12.6%)
Win32 Executable MS Visual FoxPro 7 (3.7%)
Generic Win/DOS Executable (3.3%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x401287
timedatestamp.....: 0x466c128f (Sun Jun 10 15:02:39 2007)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x39a7 0x4000 6.22 a2917cb335e0833a5ccf23c8aa9837ee
.rdata 0x5000 0x90e 0x1000 3.63 e4952c60023d3b8531744242316f93bf
.data 0x6000 0x2a3c 0x3000 0.42 9bcb9d4b2e3ea54c08face85649f2d1f
.rsrc 0x9000 0xc0 0x1000 0.13 940ebea066af615877151972a5e130fe

( 1 imports )
> KERNEL32.dll: CloseHandle, Process32Next, OpenProcess, Process32First, CreateToolhelp32Snapshot, VirtualFreeEx, GetExitCodeThread, WaitForSingleObject, CreateRemoteThread, GetProcAddress, WriteProcessMemory, VirtualAllocEx, GetModuleHandleA, GetModuleFileNameA, lstrcpyA, GetLastError, CreateEventA, GetStartupInfoA, GetCommandLineA, GetVersion, ExitProcess, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, FreeEnvironmentStringsA, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStrings, GetEnvironmentStringsW, SetHandleCount, GetStdHandle, GetFileType, GetEnvironmentVariableA, GetVersionExA, HeapDestroy, HeapCreate, VirtualFree, HeapFree, RtlUnwind, WriteFile, GetCPInfo, GetACP, GetOEMCP, HeapAlloc, VirtualAlloc, HeapReAlloc, LoadLibraryA, MultiByteToWideChar, LCMapStringA, LCMapStringW, GetStringTypeA, GetStringTypeW

( 0 exports )
ThreatExpert info: <a href='http://www.threatexpert.com/report.aspx?md5=99528ac475755a70f130e4f5b
956a395' target='_blank'>http://www.threatexpert.com/report.aspx?...130e4f5b956a395 </a>
CWSandbox info: <a href='http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=995
28ac475755a70f130e4f5b956a395' target='_blank'>http://research.sunbelt-software.com/par...130e4f5b956a395 </a>
f Service &


LOGFILE:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:47:43, on 09.01.2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Free Download Manager\FUM\fumoei.exe
C:\Program Files (x86)\Java\jre6\bin\jusched.exe
C:\Program Files (x86)\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\PROGRA~2\FREEDO~1\fdm.exe
C:\Program Files (x86)\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files (x86)\Free Download Manager\iefdm2.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [Free Uploader Oe Integration] C:\Program Files (x86)\Free Download Manager\FUM\fumoei.exe
O4 - HKCU\..\Run: [RGSC] C:\Program Files (x86)\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe /silent
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O8 - Extra context menu item: Alles mit FDM herunterladen - file://C:\Program Files (x86)\Free Download Manager\dlall.htm
O8 - Extra context menu item: Auswahl mit FDM herunterladen - file://C:\Program Files (x86)\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Datei mit FDM herunterladen - file://C:\Program Files (x86)\Free Download Manager\dllink.htm
O8 - Extra context menu item: Videos mit FDM herunterladen - file://C:\Program Files (x86)\Free Download Manager\dlfvideo.htm
O9 - Extra button: Upload - {FD4E2FF8-973C-4A19-89BD-8E86B3CFCFE1} - C:\Program Files (x86)\Free Download Manager\FUM\fumiebtn.dll
O13 - Gopher Prefix:
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Avira AntiVir Personal - Free Antivirus Planer (AntiVirScheduler) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: ASP.NET-Zustandsdienst (aspnet_state) - Unknown owner - C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: Nalpeiron Licensing Service (ASTSRV) - Nalpeiron Ltd. - C:\Windows\system32\ASTSRV.EXE
O23 - Service: Ati External Event Utility - Unknown owner - C:\Windows\system32\Ati2evxx.exe (file missing)
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe
O23 - Service: AVM FRITZ!web Routing Service (de_serv) - AVM Berlin - C:\Program Files (x86)\Common Files\AVM\de_serv.exe
O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GEST Service for program management. (GEST Service) - Unknown owner - C:\Program Files (x86)\GIGABYTE\EnergySaver\GSvr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 8011 bytes
Miniaturansicht angehängter Grafiken
fumoei.exe-aufzeichnen.jpg  

Alt 11.01.2009, 21:23   #2
Skyfire2
 
fumoei.exe - Standard

fumoei.exe



Super Support hier Vielen Dank!!
__________________


Alt 11.01.2009, 21:26   #3
RipmaV
 
fumoei.exe - Standard

fumoei.exe



Nu beruhig dich und abwarten, die Leute die dass hier supporten haben auch ein Privatleben und sind nicht Daueronline. Also bitte Gedulde dich bis sich jemand deiner annimmt.
__________________

Alt 11.01.2009, 21:38   #4
Skyfire2
 
fumoei.exe - Standard

fumoei.exe



Das weiss ich auch aber mein Thread in dem es um das gleiche geht ist bereits 2 Tage alt....Whatever..

Alt 12.01.2009, 13:08   #5
Skyfire2
 
fumoei.exe - Standard

fumoei.exe



Jaaaaaaaaa noch mehr Support bitte wuhaaaaa


Antwort

Themen zu fumoei.exe
.dll, adobe, antivirus, artemis, avira, bho, bonjour, computer, defender, download, error, explorer, free download, generic, gigabyte, hijack, hijackthis, internet, internet explorer, logfile, lsass.exe, nvidia, plug-in, rundll, scan, virus, virus total, vista, windows, windows sidebar, wmp




Zum Thema fumoei.exe - Hallo, Habe bereits mit Virus Total überprüft,Logfile u Screenshot liegen bei.Hilfe bitte! Virus Total.com Scan: a-squared 4.0.0.73 2009.01.11 - AhnLab-V3 2009.1.10.0 2009.01.11 - AntiVir 7.9.0.54 2009.01.10 - Authentium 5.1.0.4 2009.01.10 - fumoei.exe...
Archiv
Du betrachtest: fumoei.exe auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.