| |
| |||||||
Log-Analyse und Auswertung: Outlook verschickt hunderte Mails, Trojaner und HeuristicmalwareWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
| |
21.05.2009, 10:35
| #1 |
 |  Outlook verschickt hunderte Mails, Trojaner und Heuristicmalware ...bin ich im falschen Thread gelandet oder ist mein Fall zu kompliziert... Habe leider noch keine Hilfe bekommen.  Vielleicht kann mir mal jemand rückmelden, ob ich was falsch gemacht habe...  Gruß, Guagua |
|
23.05.2009, 18:37
| #2 |
| /// AVZ-Toolkit Guru   | Outlook verschickt hunderte Mails, Trojaner und Heuristicmalware Hi Guagua und
__________________ Führe bitte einen Scan mit Avira durch und zwar nach dieser Anleitung: http://www.trojaner-board.de/54192-a...tellungen.html Poste das log. Prevx
__________________ |
|
27.05.2009, 15:25
| #3 |
| | Outlook verschickt hunderte Mails, Trojaner und Heuristicmalware Hallo!
__________________Erstmal Danke für die Hilfe. Habe den AviraAntivir Scan wie dargestellt durchgeführt. Hier der Report: Avira AntiVir Personal Report file date: Mittwoch, 27. Mai 2009 15:23 Scanning for 1284893 virus strains and unwanted programs. Licensee : Avira AntiVir Personal - FREE Antivirus Serial number : 0000149996-ADJIE-0000001 Platform : Windows XP Windows version : (Service Pack 3) [5.1.2600] Boot mode : Normally booted Username : SYSTEM Computer name : HNPC1 Version information: BUILD.DAT : 9.0.0.394 17962 Bytes 17.04.2009 11:20:00 AVSCAN.EXE : 9.0.3.5 466689 Bytes 17.04.2009 07:57:30 AVSCAN.DLL : 9.0.3.0 40705 Bytes 27.02.2009 09:58:24 LUKE.DLL : 9.0.3.2 209665 Bytes 20.02.2009 10:35:49 LUKERES.DLL : 9.0.2.0 12033 Bytes 27.02.2009 09:58:52 ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 27.10.2008 11:30:36 ANTIVIR1.VDF : 7.1.2.12 3336192 Bytes 11.02.2009 19:33:26 ANTIVIR2.VDF : 7.1.2.105 513536 Bytes 03.03.2009 06:41:14 ANTIVIR3.VDF : 7.1.2.127 110592 Bytes 05.03.2009 13:58:20 Engineversion : 8.2.0.100 AEVDF.DLL : 8.1.1.0 106868 Bytes 27.01.2009 16:36:42 AESCRIPT.DLL : 8.1.1.56 352634 Bytes 26.02.2009 19:01:56 AESCN.DLL : 8.1.1.7 127347 Bytes 12.02.2009 10:44:25 AERDL.DLL : 8.1.1.3 438645 Bytes 29.10.2008 17:24:41 AEPACK.DLL : 8.1.3.10 397686 Bytes 04.03.2009 12:06:10 AEOFFICE.DLL : 8.1.0.36 196987 Bytes 26.02.2009 19:01:56 AEHEUR.DLL : 8.1.0.100 1618295 Bytes 25.02.2009 14:49:16 AEHELP.DLL : 8.1.2.2 119158 Bytes 26.02.2009 19:01:56 AEGEN.DLL : 8.1.1.24 336244 Bytes 04.03.2009 12:06:10 AEEMU.DLL : 8.1.0.9 393588 Bytes 09.10.2008 13:32:40 AECORE.DLL : 8.1.6.6 176501 Bytes 17.02.2009 13:22:44 AEBB.DLL : 8.1.0.3 53618 Bytes 09.10.2008 13:32:40 AVWINLL.DLL : 9.0.0.3 18177 Bytes 12.12.2008 07:47:59 AVPREF.DLL : 9.0.0.1 43777 Bytes 05.12.2008 09:32:15 AVREP.DLL : 8.0.0.3 155905 Bytes 20.01.2009 13:34:28 AVREG.DLL : 9.0.0.0 36609 Bytes 05.12.2008 09:32:09 AVARKT.DLL : 9.0.0.3 292609 Bytes 24.03.2009 14:05:41 AVEVTLOG.DLL : 9.0.0.7 167169 Bytes 30.01.2009 09:37:08 SQLITE3.DLL : 3.6.1.0 326401 Bytes 28.01.2009 14:03:49 SMTPLIB.DLL : 9.2.0.25 28417 Bytes 02.02.2009 07:21:33 NETNT.DLL : 9.0.0.0 11521 Bytes 05.12.2008 09:32:10 RCIMAGE.DLL : 9.0.0.21 2438401 Bytes 09.02.2009 10:45:45 RCTEXT.DLL : 9.0.37.0 86785 Bytes 17.04.2009 09:19:48 Configuration settings for the scan: Jobname.............................: Complete system scan Configuration file..................: c:\programme\avira\antivir desktop\sysscan.avp Logging.............................: low Primary action......................: interactive Secondary action....................: ignore Scan master boot sector.............: on Scan boot sector....................: on Boot sectors........................: C:, D:, Process scan........................: on Scan registry.......................: on Search for rootkits.................: on Integrity checking of system files..: off Scan all files......................: All files Scan archives.......................: on Recursion depth.....................: 20 Smart extensions....................: on Macro heuristic.....................: on File heuristic......................: medium Deviating risk categories...........: +APPL,+GAME,+JOKE,+PCK,+SPR, Start of the scan: Mittwoch, 27. Mai 2009 15:23 Starting search for hidden objects. '57824' objects were checked, '0' hidden objects were found. The scan of running processes will be started Scan process 'avscan.exe' - '1' Module(s) have been scanned Scan process 'avcenter.exe' - '1' Module(s) have been scanned Scan process 'hpswp_clipbook.exe' - '1' Module(s) have been scanned Scan process 'iexplore.exe' - '1' Module(s) have been scanned Scan process 'avgnt.exe' - '1' Module(s) have been scanned Scan process 'sched.exe' - '1' Module(s) have been scanned Scan process 'avguard.exe' - '1' Module(s) have been scanned Scan process 'hpqgpc01.exe' - '1' Module(s) have been scanned Scan process 'hpqbam08.exe' - '1' Module(s) have been scanned Scan process 'hpqste08.exe' - '1' Module(s) have been scanned Scan process 'alg.exe' - '1' Module(s) have been scanned Scan process 'skypePM.exe' - '1' Module(s) have been scanned Scan process 'wdfmgr.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'jqs.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'Residence.exe' - '1' Module(s) have been scanned Scan process 'SonyTray.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'hpqtra08.exe' - '1' Module(s) have been scanned Scan process 'CLI.exe' - '1' Module(s) have been scanned Scan process 'SUPERAntiSpyware.exe' - '1' Module(s) have been scanned Scan process 'Skype.exe' - '1' Module(s) have been scanned Scan process 'wcescomm.exe' - '1' Module(s) have been scanned Scan process 'MESSENGR.EXE' - '1' Module(s) have been scanned Scan process 'GoogleToolbarNotifier.exe' - '1' Module(s) have been scanned Scan process 'jusched.exe' - '1' Module(s) have been scanned Scan process 'hpwuSchd2.exe' - '1' Module(s) have been scanned Scan process 'realplay.exe' - '1' Module(s) have been scanned Scan process 'NvMixerTray.exe' - '1' Module(s) have been scanned Scan process 'InCD.exe' - '1' Module(s) have been scanned Scan process 'CLI.exe' - '1' Module(s) have been scanned Scan process 'spoolsv.exe' - '1' Module(s) have been scanned Scan process 'ctfmon.exe' - '1' Module(s) have been scanned Scan process 'explorer.exe' - '1' Module(s) have been scanned Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned Scan process 'aawservice.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'InCDsrv.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned Scan process 'lsass.exe' - '1' Module(s) have been scanned Scan process 'services.exe' - '1' Module(s) have been scanned Scan process 'winlogon.exe' - '1' Module(s) have been scanned Scan process 'csrss.exe' - '1' Module(s) have been scanned Scan process 'smss.exe' - '1' Module(s) have been scanned 51 processes with 51 modules were scanned Starting master boot sector scan: Master boot sector HD0 [INFO] No virus was found! Master boot sector HD1 [INFO] No virus was found! Start scanning boot sectors: Boot sector 'C:\' [INFO] No virus was found! Boot sector 'D:\' [INFO] No virus was found! Starting to scan executable files (registry). The registry was scanned ( '78' files ). Starting the file scan: Begin scan in 'C:\' <System> C:\hiberfil.sys [WARNING] The file could not be opened! [NOTE] This file is a Windows system file. [NOTE] This file cannot be opened for scanning. C:\pagefile.sys [WARNING] The file could not be opened! [NOTE] This file is a Windows system file. [NOTE] This file cannot be opened for scanning. Begin scan in 'D:\' <Daten> D:\Programme\AdwareFilter\AdwareFilter.exe [DETECTION] Contains recognition pattern of the ADSPY/AdFilter.A.2 adware or spyware Beginning disinfection: D:\Programme\AdwareFilter\AdwareFilter.exe [DETECTION] Contains recognition pattern of the ADSPY/AdFilter.A.2 adware or spyware [NOTE] The file was moved to '4a944ca2.qua'! End of the scan: Mittwoch, 27. Mai 2009 16:20 Used time: 53:11 Minute(s) The scan has been done completely. 5301 Scanned directories 226596 Files were scanned 1 Viruses and/or unwanted programs were found 0 Files were classified as suspicious 0 files were deleted 0 Viruses and unwanted programs were repaired 1 Files were moved to quarantine 0 Files were renamed 2 Files cannot be scanned 226593 Files not concerned 4276 Archives were scanned 2 Warnings 3 Notes 57824 Objects were scanned with rootkit scan 0 Hidden objects were found Jetzt kümmere ich mich um den Prevx Scan. Grüße von Guagua |
|
27.05.2009, 16:06
| #4 |
| | Outlook verschickt hunderte Mails, Trojaner und Heuristicmalware Nach dem ersten Prevx Scan hat er einen GENDEL32.EXE entdeckt. Den kann Prevx nur entfernen, wenn ich das Programm kaufe. Gibt es da eine Alternative? Habe jetzt also erstmal nichts weiter als den Installationsscan mit Prevx gemacht. Prevx sagt mir Folgendes über den Wurm: GENDEL32.EXE Worm Your PC is infected. The file called GENDEL32.EXE is considered unsafe and there may be other infections on your PC. You should urgently check your PC and remove any malicious software including GENDEL32.EXE as soon as possible. The free version of Prevx 3.0 will scan your PC for millions of spyware and malware infections in less than 2 minutes. Don't put your confidential data, or your identity at risk, check your PC now with Prevx 3.0. Download Prevx 3.0 now » Associated Malware Groups The filename is associated with the malware group: Worm File Behavior GENDEL32.EXE has been seen to perform the following behavior: This Process Deletes Other Processes From Disk Found on infected systems and resists interrogation by security products GENDEL32.EXE has been the subject of the following behavior: Created as a process on disk Deleted as a process from disk Executed as a Process Terminated as a Process Country Of Origin The filename GENDEL32.EXE was first seen on May 15 2007 in the following geographical regions of the Prevx community: The UNITED STATES on May 15 2007 THAILAND on May 15 2007 File Name Aliases GENDEL32.EXE can also use the following file names: GENDEL32.EXE.BAK GENDEL32.EX_ SHARE/GENDEL32.EXE Filesizes This file has been seen with the following file size: 53,248 bytes |
|
27.05.2009, 16:57
| #5 |
| /// AVZ-Toolkit Guru | Outlook verschickt hunderte Mails, Trojaner und Heuristicmalware Poste bitte beide Prevx logs (Berichte) so wie in meiner kleinen Anleitung beschrieben.. Danach geht es so weiter: ESET SysInspector logfile
__________________ - Sämtliche Hilfestellungen im Forum werden ohne Gewährleistung oder Haftung gegeben - |
|
27.05.2009, 18:40
| #6 |
| | Outlook verschickt hunderte Mails, Trojaner und Heuristicmalware Hallo! Hier also die rapidshare-links: http://rapidshare.de/files/47320816/Scan_bei_Installation.log.html und http://rapidshare.de/files/47320850/Deep_scan.log.html Ich warte jetzt erstmal, was du dazu sagst, bevor ich mit dem näxten Schritt weitermache! Tausend Dank!  Guagua |
|
27.05.2009, 18:46
| #7 |
| | Outlook verschickt hunderte Mails, Trojaner und Heuristicmalware Habe gerade ESET SysInspector downgeloadet und kann es nicht öffnen, weil es keine zulässige Win32-Anwendung ist... Was soll ich nu machen? Guagua |
|
| Themen zu Outlook verschickt hunderte Mails, Trojaner und Heuristicmalware |
| ad-aware, add-on, adobe, adware.bho, avg, avira, browser, desktop, einstellungen, excel, explorer, google, helper, hijack, hijack this, hijackthis, hkus\s-1-5-18, hängen, internet, internet explorer, logfile, plug-in, registrierungsschlüssel, scan, software, studio, superantispyware, system, toolbars, trojaner, web.de, windows xp |
Hybrid-Darstellung
