| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Hilfe zum Löschen der Trojaner TR/Crypt.ZPACK.Gen & CoWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
16.08.2009, 05:35
| #1 |
| Gast |  Hilfe zum Löschen der Trojaner TR/Crypt.ZPACK.Gen & Co Tach, hab mir den Trojaner TR/Crypt.ZPACK.Gen eingefangen neben anderen. Deshalb habe ich diesen Post geöffnet, weil soweit ich das jetzt verstanden habe auf jeden Fall eine individuelle Auswertung durch Kenner durchgeführt werden muss. Dank an mögliche Helfer und Experten schonmal vorab, great service! Habe mir bereits die Programme ccfix, combocleaner und HijackThis runtergeladen. Die Hijack Log + Antivir Log habe ich unten schonmal aufgeführt. Habe dazu sämtliche externen Speichermedien angeschlossen (ausgenommen USB Stick, nur 3 usb ports verfügbar, muss separat gemacht werden). Was ist passiert: - Bitdefender Internetsecurity 2008 hat sich nicht mehr updaten lassen. - nachdem ich auf Avira Antivir umgestiegen bin hat er dann TR/Crypt.ZPACK.Gen erkannt und auch einen Worm WORM/Kido.IX entdeckt (siehe Log). Sowie auf diversen Laufwerken unerwünschte Programmen gefunden, die andere Virenscanner nicht entdeckt haben (Kaspersky [schon ne weile her], Bitdefender). Da ich mittlerweile vermute, dass diese Programme schon seit geraumer Zeit sich auf den Disks befinden, tut sich die Frage auf, wie akut die Bedrohung ist? - Es scheint, als ob jedes Laufwerk das ich anschließe gleich mit einem Worm bombardiert wird bzw. schon vorhanden ist, weil Antivir sofort eine Meldung beim Anschliesen lossendet (inkl. Ipod Laufwerk) – nach dem Scan findet er dann TR/Crypt.ZPACK.Gen (Ipod). - Es ist nicht mehr möglich die Option „Versteckte Ordner und Dateien anzeigen“ zu aktivieren. Es lässt sich zwar auswählen über ÜbernehmenOK jedoch wird die Einstellung nicht übernommen!!. Welche weiteren Massnahmen sind ratsam? Habe davon gehört, dass dieser Trojaner die Sicherheit der Passwörter (Kreditkarteninformationen) beeinträchtigt. Welche Massnahmen empfehlt ihr? Brauche ich weitere Programme oder ihr weitere Informationen? Hier die Logfile mit Avira Antivir: Avira AntiVir Personal Report file date: Saturday, 15 August 2009 18:36 Scanning for 1639416 virus strains and unwanted programs. Licensee : Avira AntiVir Personal - FREE Antivirus Serial number : 0000149996-ADJIE-0000001 Platform : Windows Vista Windows version : (plain) [6.0.6000] Boot mode : Normally booted Username : SYSTEM Computer name : PC Version information: BUILD.DAT : 9.0.0.407 17961 Bytes 29/07/2009 10:34:00 AVSCAN.EXE : 9.0.3.7 466689 Bytes 21/07/2009 04:36:14 AVSCAN.DLL : 9.0.3.0 40705 Bytes 27/02/2009 01:58:24 LUKE.DLL : 9.0.3.2 209665 Bytes 20/02/2009 02:35:49 LUKERES.DLL : 9.0.2.0 12033 Bytes 27/02/2009 01:58:52 ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 27/10/2008 03:30:36 ANTIVIR1.VDF : 7.1.4.132 5707264 Bytes 24/06/2009 00:21:42 ANTIVIR2.VDF : 7.1.5.88 2668032 Bytes 10/08/2009 03:39:12 ANTIVIR3.VDF : 7.1.5.117 290304 Bytes 14/08/2009 03:39:14 Engineversion : 8.2.1.1 AEVDF.DLL : 8.1.1.1 106868 Bytes 28/07/2009 04:31:50 AESCRIPT.DLL : 8.1.2.25 459130 Bytes 15/08/2009 03:39:21 AESCN.DLL : 8.1.2.4 127348 Bytes 23/07/2009 00:59:39 AERDL.DLL : 8.1.2.4 430452 Bytes 23/07/2009 00:59:39 AEPACK.DLL : 8.1.3.18 401783 Bytes 28/07/2009 04:31:50 AEOFFICE.DLL : 8.1.0.38 196987 Bytes 23/07/2009 00:59:39 AEHEUR.DLL : 8.1.0.154 1917302 Bytes 15/08/2009 03:39:20 AEHELP.DLL : 8.1.5.3 233846 Bytes 23/07/2009 00:59:39 AEGEN.DLL : 8.1.1.56 356725 Bytes 15/08/2009 03:39:15 AEEMU.DLL : 8.1.0.9 393588 Bytes 9/10/2008 05:32:40 AECORE.DLL : 8.1.7.6 184694 Bytes 23/07/2009 00:59:39 AEBB.DLL : 8.1.0.3 53618 Bytes 9/10/2008 05:32:40 AVWINLL.DLL : 9.0.0.3 18177 Bytes 11/12/2008 23:47:59 AVPREF.DLL : 9.0.0.1 43777 Bytes 5/12/2008 01:32:15 AVREP.DLL : 8.0.0.3 155905 Bytes 20/01/2009 05:34:28 AVREG.DLL : 9.0.0.0 36609 Bytes 5/12/2008 01:32:09 AVARKT.DLL : 9.0.0.3 292609 Bytes 24/03/2009 06:05:41 AVEVTLOG.DLL : 9.0.0.7 167169 Bytes 30/01/2009 01:37:08 SQLITE3.DLL : 3.6.1.0 326401 Bytes 28/01/2009 06:03:49 SMTPLIB.DLL : 9.2.0.25 28417 Bytes 1/02/2009 23:21:33 NETNT.DLL : 9.0.0.0 11521 Bytes 5/12/2008 01:32:10 RCIMAGE.DLL : 9.0.0.25 2438913 Bytes 15/05/2009 06:39:58 RCTEXT.DLL : 9.0.37.0 86785 Bytes 17/04/2009 01:19:48 Configuration settings for the scan: Jobname.............................: Complete system scan Configuration file..................: c:\program files\avira\antivir desktop\sysscan.avp Logging.............................: low Primary action......................: interactive Secondary action....................: ignore Scan master boot sector.............: on Scan boot sector....................: on Boot sectors........................: C:, D:, I:, J:, K:, X:, Z:, Process scan........................: on Scan registry.......................: on Search for rootkits.................: on Integrity checking of system files..: off Scan all files......................: All files Scan archives.......................: on Recursion depth.....................: 20 Smart extensions....................: on Macro heuristic.....................: on File heuristic......................: medium Deviating risk categories...........: +APPL,+SPR, Start of the scan: Saturday, 15 August 2009 18:36 Starting search for hidden objects. '79968' objects were checked, '0' hidden objects were found. The scan of running processes will be started Scan process 'avscan.exe' - '1' Module(s) have been scanned Scan process 'avscan.exe' - '1' Module(s) have been scanned Scan process 'WMIADAP.exe' - '1' Module(s) have been scanned Scan process 'TrustedInstaller.exe' - '1' Module(s) have been scanned Scan process 'conime.exe' - '1' Module(s) have been scanned Scan process 'WCScheduler.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'EasyBatteryMgr3.exe' - '1' Module(s) have been scanned Scan process 'iPodService.exe' - '1' Module(s) have been scanned Scan process 'EasySpeedUpManager.exe' - '1' Module(s) have been scanned Scan process 'dmhkcore.exe' - '1' Module(s) have been scanned Scan process 'MagicDoctorKbdHk.exe' - '1' Module(s) have been scanned Scan process 'WmiPrvSE.exe' - '1' Module(s) have been scanned Scan process 'taskeng.exe' - '1' Module(s) have been scanned Scan process 'livesrv.exe' - '1' Module(s) have been scanned Scan process 'xcommsvr.exe' - '1' Module(s) have been scanned Scan process 'SearchIndexer.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'RichVideo.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'LSSrvc.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'mDNSResponder.exe' - '1' Module(s) have been scanned Scan process 'avguard.exe' - '1' Module(s) have been scanned Scan process 'agrsmsvc.exe' - '1' Module(s) have been scanned Scan process 'ehmsas.exe' - '1' Module(s) have been scanned Scan process 'wmpnscfg.exe' - '1' Module(s) have been scanned Scan process 'ehtray.exe' - '1' Module(s) have been scanned Scan process 'avgnt.exe' - '1' Module(s) have been scanned Scan process 'iTunesHelper.exe' - '1' Module(s) have been scanned Scan process 'realsched.exe' - '1' Module(s) have been scanned Scan process 'bdagent.exe' - '1' Module(s) have been scanned Scan process 'jusched.exe' - '1' Module(s) have been scanned Scan process 'rundll32.exe' - '1' Module(s) have been scanned Scan process 'rundll32.exe' - '1' Module(s) have been scanned Scan process 'SynTPEnh.exe' - '1' Module(s) have been scanned Scan process 'RtHDVCpl.exe' - '1' Module(s) have been scanned Scan process 'explorer.exe' - '1' Module(s) have been scanned Scan process 'dwm.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'sched.exe' - '1' Module(s) have been scanned Scan process 'spoolsv.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'SLsvc.exe' - '1' Module(s) have been scanned Scan process 'audiodg.exe' - '0' Module(s) have been scanned Scan process 'winlogon.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'lsm.exe' - '1' Module(s) have been scanned Scan process 'lsass.exe' - '1' Module(s) have been scanned Scan process 'services.exe' - '1' Module(s) have been scanned Scan process 'csrss.exe' - '1' Module(s) have been scanned Scan process 'wininit.exe' - '1' Module(s) have been scanned Scan process 'csrss.exe' - '1' Module(s) have been scanned Scan process 'smss.exe' - '1' Module(s) have been scanned 58 processes with 58 modules were scanned Starting master boot sector scan: Master boot sector HD0 [INFO] No virus was found! Master boot sector HD1 [INFO] No virus was found! Start scanning boot sectors: Boot sector 'C:\' [INFO] No virus was found! Boot sector 'D:\' [INFO] No virus was found! Boot sector 'I:\' [INFO] No virus was found! Boot sector 'J:\' [INFO] No virus was found! Boot sector 'K:\' [INFO] No virus was found! Boot sector 'X:\' [INFO] No virus was found! Boot sector 'Z:\' [INFO] No virus was found! Starting to scan executable files (registry). The registry was scanned ( '49' files ). Starting the file scan: Begin scan in 'C:\' <basics> C:\hiberfil.sys [WARNING] The file could not be opened! [NOTE] This file is a Windows system file. [NOTE] This file cannot be opened for scanning. C:\pagefile.sys [WARNING] The file could not be opened! [NOTE] This file is a Windows system file. [NOTE] This file cannot be opened for scanning. C:\Users\***\AppData\Local\Opera\Opera\profile\cache4\opr0FMOC [0] Archive type: NSIS --> ProgramFilesDir/unicows.dll [WARNING] No further files can be extracted from this archive. The archive will be closed [WARNING] No further files can be extracted from this archive. The archive will be closed C:\Windows\System32\xthybn.dll [DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan [WARNING] The file could not be opened! C:\Windows\System32\drivers\sptd.sys [WARNING] The file could not be opened! Begin scan in 'D:\' <elephant> Begin scan in 'I:\' <base> I:\anwendungen\BitDefender Internet Security 2008 V11.0.15+Keygen(Patch)-HeartBug\Keygen.exe [DETECTION] Is the TR/Agent.134192.A Trojan I:\anwendungen\programs vista\ppmate net tv.exe [DETECTION] Is the TR/Agent.3329812 Trojan --> Settings/ppmnet.exe [DETECTION] Is the TR/Agent.317064 Trojan Begin scan in 'J:\' <media> Begin scan in 'K:\' <spiele> Begin scan in 'X:\' <Miss Ori> X:\autorun.inf [DETECTION] Contains recognition pattern of the WORM/Kido.IX worm X:\data\programs\anwendungen\BitDefender Internet Security 2008 V11.0.15+Keygen(Patch)-HeartBug\Keygen.exe [DETECTION] Is the TR/Agent.134192.A Trojan X:\data\programs\anwendungen\programs vista\ppmate net tv.exe [DETECTION] Is the TR/Agent.3329812 Trojan --> Settings/ppmnet.exe [DETECTION] Is the TR/Agent.317064 Trojan X:\data\programs\programme gesichert\brenntools\easyburn_dvd.zip [0] Archive type: ZIP --> setup.exe --> setup.exe [1] Archive type: NSIS --> [ProgramFilesDir]/EasyBurning/compare.exe [DETECTION] Is the TR/Meredrop.A.662 Trojan X:\data\programs\programme gesichert\diverse anwendungen\atom.time.pro.v3.1a.-snd.rar [0] Archive type: RAR --> Atom Time pro v3.1a -SND-[LinkoManija.Net]\snd-atomtimepro3.1a.patch.zip [1] Archive type: ZIP --> patch.exe [DETECTION] Is the TR/Dropper.Gen Trojan X:\data\programs\programme gesichert\grafik\acdsee\acdsee 6\2 ACDSee 6.02 PowerPack + All Plugins + KeyGen + Cracks.zip [0] Archive type: ZIP --> ACDSee 6.02 PowerPack + All Plugins + KeyGen + Cracks/ACDSee 6.0 KeyGen by ROR.exe [DETECTION] Is the TR/Agent.31856.B Trojan --> ACDSee 6.02 PowerPack + All Plugins + KeyGen + Cracks/LuraDoc/keygen/CR-LD10K.EXE [DETECTION] Is the TR/Crypt.FSPM.Gen Trojan --> ACDSee 6.02 PowerPack + All Plugins + KeyGen + Cracks/LuraWave/keygen/CR-LW10K.EXE [DETECTION] Is the TR/Crypt.FSPM.Gen Trojan --> ACDSee 6.02 PowerPack + All Plugins + KeyGen + Cracks/Web Cracks Desktop/ACDSee 6.0 PowerPack Patch (Bidjan).exe [DETECTION] Contains recognition pattern of the WORM/Rbot.95941 worm --> ACDSee 6.02 PowerPack + All Plugins + KeyGen + Cracks/Web Cracks Desktop/ACDSee 6.0 PowerPack Serial (Kalbar - EFC87).exe [DETECTION] Is the TR/Small.20992.N Trojan X:\data\programs\programme gesichert\grafik\quark\Quark - Quarkxpress Passport 6.5 Multilanguage - Valkan Groupâ„¢.rar [0] Archive type: RAR --> Patch\Patch2.exe [DETECTION] Contains recognition pattern of the APPL/Tool.TPE.CC application X:\data\programs\programme gesichert\player - mp3 - video\player\musicmatch\Musicmatch.Jukebox.Plus.10.Upgrade.Keygen.exe [DETECTION] Is the TR/Dropper.Gen Trojan X:\data\programs\programme gesichert\sicherheit\firewalls\BitDefender Total Security 2008 V11.0.15+Keygen(Patch)-HeartBug\Keygen.exe [DETECTION] Is the TR/Agent.134192.A Trojan X:\data\programs\programme gesichert\sicherheit\firewalls\sygate\Sygate_Personal_Firewall_Pro_5.6_unreleased.rar [0] Archive type: RAR --> Sygate Personal Firewall Pro_unreleased.exe [1] Archive type: RSRC [DETECTION] Is the TR/Crypt.TPM.Gen Trojan X:\data\programs\programme gesichert\wissen\Reference.Manager.Pro.Network.Edition.v11.0.rar [0] Archive type: RAR --> Reference.Manager.Pro.Network.Edition.v11.0\ISI ResearchSoft Reference Manager Pro Network Edition v11.0.rar [1] Archive type: RAR --> crack.exe [DETECTION] Is the TR/Small.30720 Trojan X:\data\programs\programme gesichert\wissen\sprachen\Langenscheidt.Spanisch.Vokabeltrainer.2_0_CCD.rar [0] Archive type: RAR --> IMAGE.img [WARNING] The file could not be written! [WARNING] The file could not be written! X:\data\programs\programme gesichert\wissen\sprachen\babylon\Babylon Pro 5.0 Translator Corporate + Crack (By RegMinisteR).rar [0] Archive type: RAR --> Babylon Pro 5.0 Translator Corporate + Crack (By RegMinisteR)\Babylon Pro 5.0 Corporate\babylon.pro.5.0.0.r78.crack-tsrh.zip [1] Archive type: ZIP --> crack.exe [DETECTION] Contains recognition pattern of the SPR/Tpatch.B program X:\data\programs\programs vista +++new+++\Avid Xpress Pro 5.7.2\Avid Xpress Pro v5.7.2.rar [0] Archive type: RAR --> Avid Xpress Pro v5.7.2\EQX\Avid_Xpress_Pro_patch.exe [DETECTION] Is the TR/Agent.14336.Q Trojan X:\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx [DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan Begin scan in 'Z:\' <Ma'm Ori> Z:\autorun.inf [DETECTION] Contains recognition pattern of the WORM/Kido.IX worm Z:\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx [DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan Beginning disinfection: C:\Windows\System32\xthybn.dll [DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan [WARNING] An error has occurred and the file was not deleted. ErrorID: 26004 [WARNING] The source file could not be found. [NOTE] Attempting to perform action using the ARK library. [WARNING] Error in ARK library [WARNING] The file could not be marked for deleting after reboot. Error description: Zugriff verweigert I:\anwendungen\BitDefender Internet Security 2008 V11.0.15+Keygen(Patch)-HeartBug\Keygen.exe [DETECTION] Is the TR/Agent.134192.A Trojan [NOTE] The file was moved to '4aff8b19.qua'! I:\anwendungen\programs vista\ppmate net tv.exe [DETECTION] Is the TR/Agent.3329812 Trojan [NOTE] The file was moved to '4af38b24.qua'! X:\autorun.inf [DETECTION] Contains recognition pattern of the WORM/Kido.IX worm [WARNING] An error has occurred and the file was not deleted. ErrorID: 26003 [WARNING] The file could not be deleted! [NOTE] Attempting to perform action using the ARK library. [NOTE] The file was moved to '4f80ff02.qua'! X:\data\programs\anwendungen\BitDefender Internet Security 2008 V11.0.15+Keygen(Patch)-HeartBug\Keygen.exe [DETECTION] Is the TR/Agent.134192.A Trojan [NOTE] The file was moved to '4aff8b1d.qua'! X:\data\programs\anwendungen\programs vista\ppmate net tv.exe [DETECTION] Is the TR/Agent.3329812 Trojan [NOTE] The file was moved to '4af38b28.qua'! X:\data\programs\programme gesichert\brenntools\easyburn_dvd.zip [NOTE] The file was moved to '4af98b19.qua'! X:\data\programs\programme gesichert\diverse anwendungen\atom.time.pro.v3.1a.-snd.rar [NOTE] The file was moved to '4af58b2c.qua'! X:\data\programs\programme gesichert\grafik\acdsee\acdsee 6\2 ACDSee 6.02 PowerPack + All Plugins + KeyGen + Cracks.zip [NOTE] The file was moved to '4ac78ad8.qua'! X:\data\programs\programme gesichert\grafik\quark\Quark - Quarkxpress Passport 6.5 Multilanguage - Valkan Groupâ„¢.rar [WARNING] An error has occurred and the file was not deleted. ErrorID: 26001 [WARNING] Failed! [NOTE] Attempting to perform action using the ARK library. [NOTE] The file was moved to '4ae78b63.qua'! X:\data\programs\programme gesichert\player - mp3 - video\player\musicmatch\Musicmatch.Jukebox.Plus.10.Upgrade.Keygen.exe [DETECTION] Is the TR/Dropper.Gen Trojan [WARNING] An error has occurred and the file was not deleted. ErrorID: 26001 [WARNING] Failed! [NOTE] Attempting to perform action using the ARK library. [NOTE] The file was moved to '4af98ba8.qua'! X:\data\programs\programme gesichert\sicherheit\firewalls\BitDefender Total Security 2008 V11.0.15+Keygen(Patch)-HeartBug\Keygen.exe [DETECTION] Is the TR/Agent.134192.A Trojan [NOTE] The file was moved to '4aff8b9a.qua'! X:\data\programs\programme gesichert\sicherheit\firewalls\sygate\Sygate_Personal_Firewall_Pro_5.6_unreleased.rar [WARNING] An error has occurred and the file was not deleted. ErrorID: 26001 [WARNING] Failed! [NOTE] Attempting to perform action using the ARK library. [NOTE] The file was moved to '4aed8bae.qua'! X:\data\programs\programme gesichert\wissen\Reference.Manager.Pro.Network.Edition.v11.0.rar [WARNING] An error has occurred and the file was not deleted. ErrorID: 26001 [WARNING] Failed! [NOTE] Attempting to perform action using the ARK library. [NOTE] The file was moved to '4aec8b9d.qua'! X:\data\programs\programme gesichert\wissen\sprachen\babylon\Babylon Pro 5.0 Translator Corporate + Crack (By RegMinisteR).rar [WARNING] An error has occurred and the file was not deleted. ErrorID: 26001 [WARNING] Failed! [NOTE] Attempting to perform action using the ARK library. [NOTE] The file was moved to '4ae88b9f.qua'! X:\data\programs\programs vista +++new+++\Avid Xpress Pro 5.7.2\Avid Xpress Pro v5.7.2.rar [WARNING] An error has occurred and the file was not deleted. ErrorID: 26001 [WARNING] Failed! [NOTE] Attempting to perform action using the ARK library. [NOTE] The file was moved to '4aef8bbb.qua'! X:\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx [DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan [WARNING] An error has occurred and the file was not deleted. ErrorID: 26001 [WARNING] Failed! [NOTE] Attempting to perform action using the ARK library. [WARNING] Error in ARK library [WARNING] The file could not be marked for deleting after reboot. Error description: Zugriff verweigert Z:\autorun.inf [DETECTION] Contains recognition pattern of the WORM/Kido.IX worm [WARNING] An error has occurred and the file was not deleted. ErrorID: 26001 [WARNING] Failed! [NOTE] Attempting to perform action using the ARK library. [NOTE] The file was moved to '4afa8bed.qua'! Z:\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx [DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan [WARNING] An error has occurred and the file was not deleted. ErrorID: 26001 [WARNING] Failed! [NOTE] Attempting to perform action using the ARK library. [WARNING] Error in ARK library End of the scan: Saturday, 15 August 2009 20:18 Used time: 1:28:00 Hour(s) The scan has been done completely. 21389 Scanned directories 477693 Files were scanned 25 Viruses and/or unwanted programs were found 0 Files were classified as suspicious 0 files were deleted 0 Viruses and unwanted programs were repaired 16 Files were moved to quarantine 0 Files were renamed 4 Files cannot be scanned 477664 Files not concerned 7336 Archives were scanned 18 Warnings 21 Notes 79968 Objects were scanned with rootkit scan 0 Hidden objects were found Vielen Dank!!! |
|
16.08.2009, 05:41
| #2 |
| Gast |  Hilfe zum Löschen der Trojaner TR/Crypt.ZPACK.Gen & Co Hier die Logfile mit Hijackthis:
__________________Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 8:34:27 p.m., on 15/08/2009 Platform: Windows Vista (WinNT 6.00.1904) MSIE: Internet Explorer v7.00 (7.00.6000.16643) Boot mode: Normal Running processes: C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\RtHDVCpl.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Program Files\Java\jre6\bin\jusched.exe D:\games\bitdefender\bdagent.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe D:\games\iTunes\iTunesHelper.exe C:\Program Files\Avira\AntiVir Desktop\avgnt.exe C:\Windows\ehome\ehtray.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Windows\ehome\ehmsas.exe C:\Windows\system32\taskeng.exe C:\Program Files\Samsung\Samsung Magic Doctor\MagicDoctorKbdHk.exe C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe C:\Program Files\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe C:\Program Files\Samsung\EBM\EasyBatteryMgr3.exe C:\Windows\system32\conime.exe D:\games\VLC\vlc.exe C:\Program Files\Opera\opera.exe D:\games\hijackthis\HijackThis.exe C:\Windows\system32\SearchFilterHost.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = h++p://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h++p://www.google.de/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h++p:\\www.samsungcomputer.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h++p://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = h++p://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = h++p://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - D:\games\BitComet\tools\BitCometBHO_1.2.2.28.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: CmjBrowserHelperObject Object - {AC41D38F-B56D-40AD-94E0-B493D130C959} - C:\Program Files\Mindjet\MindManager 6\Mm6InternetExplorer.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - D:\games\bitdefender\IEToolbar.dll O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "D:\games\bitdefender\IEShow.exe" O4 - HKLM\..\Run: [BDAgent] "D:\games\bitdefender\bdagent.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "D:\games\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST') O8 - Extra context menu item: &Alles mit BitComet downloaden - res://D:\games\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Alle &Videos mit BitComet &d&ownloaden - res://D:\games\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: Mit BitComet &downloaden - res://D:\games\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\Programme\Microsoft Office\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: Send to Mindjet MindManager - {531B9DC0-D8EE-4c76-A6EE-6C1E50569655} - C:\Program Files\Mindjet\MindManager 6\Mm6InternetExplorer.dll O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://D:\games\BitComet\tools\BitCometBHO_1.2.2.28.dll/206 (file missing) O13 - Gopher Prefix: O17 - HKLM\System\CCS\Services\Tcpip\..\{E728EDD3-30DC-442A-B35A-1C0772D63C1F}: NameServer = 139.130.4.4,162.126.63.1 O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender S.R.L. - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S.R.L. - D:\games\bitdefender\vsserv.exe O23 - Service: BitDefender Communicator (XCOMM) - Softwin - C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe -- End of file - 7690 bytes Zusätzliche Seperate Logfile des Ipods (hatte IPod bei obigen scans auch aktiv; der USB Stick fehlt in den Scans!!) Avira AntiVir Personal Report file date: Saturday, 15 August 2009 17:32 Scanning for 1639416 virus strains and unwanted programs. Licensee : Avira AntiVir Personal - FREE Antivirus Serial number : 0000149996-ADJIE-0000001 Platform : Windows Vista Windows version : (plain) [6.0.6000] Boot mode : Normally booted Username : xxx Computer name : xxx Version information: BUILD.DAT : 9.0.0.407 17961 Bytes 29/07/2009 10:34:00 AVSCAN.EXE : 9.0.3.7 466689 Bytes 21/07/2009 04:36:14 AVSCAN.DLL : 9.0.3.0 40705 Bytes 27/02/2009 01:58:24 LUKE.DLL : 9.0.3.2 209665 Bytes 20/02/2009 02:35:49 LUKERES.DLL : 9.0.2.0 12033 Bytes 27/02/2009 01:58:52 ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 27/10/2008 03:30:36 ANTIVIR1.VDF : 7.1.4.132 5707264 Bytes 24/06/2009 00:21:42 ANTIVIR2.VDF : 7.1.5.88 2668032 Bytes 10/08/2009 03:39:12 ANTIVIR3.VDF : 7.1.5.117 290304 Bytes 14/08/2009 03:39:14 Engineversion : 8.2.1.1 AEVDF.DLL : 8.1.1.1 106868 Bytes 28/07/2009 04:31:50 AESCRIPT.DLL : 8.1.2.25 459130 Bytes 15/08/2009 03:39:21 AESCN.DLL : 8.1.2.4 127348 Bytes 23/07/2009 00:59:39 AERDL.DLL : 8.1.2.4 430452 Bytes 23/07/2009 00:59:39 AEPACK.DLL : 8.1.3.18 401783 Bytes 28/07/2009 04:31:50 AEOFFICE.DLL : 8.1.0.38 196987 Bytes 23/07/2009 00:59:39 AEHEUR.DLL : 8.1.0.154 1917302 Bytes 15/08/2009 03:39:20 AEHELP.DLL : 8.1.5.3 233846 Bytes 23/07/2009 00:59:39 AEGEN.DLL : 8.1.1.56 356725 Bytes 15/08/2009 03:39:15 AEEMU.DLL : 8.1.0.9 393588 Bytes 9/10/2008 05:32:40 AECORE.DLL : 8.1.7.6 184694 Bytes 23/07/2009 00:59:39 AEBB.DLL : 8.1.0.3 53618 Bytes 9/10/2008 05:32:40 AVWINLL.DLL : 9.0.0.3 18177 Bytes 11/12/2008 23:47:59 AVPREF.DLL : 9.0.0.1 43777 Bytes 5/12/2008 01:32:15 AVREP.DLL : 8.0.0.3 155905 Bytes 20/01/2009 05:34:28 AVREG.DLL : 9.0.0.0 36609 Bytes 5/12/2008 01:32:09 AVARKT.DLL : 9.0.0.3 292609 Bytes 24/03/2009 06:05:41 AVEVTLOG.DLL : 9.0.0.7 167169 Bytes 30/01/2009 01:37:08 SQLITE3.DLL : 3.6.1.0 326401 Bytes 28/01/2009 06:03:49 SMTPLIB.DLL : 9.2.0.25 28417 Bytes 1/02/2009 23:21:33 NETNT.DLL : 9.0.0.0 11521 Bytes 5/12/2008 01:32:10 RCIMAGE.DLL : 9.0.0.25 2438913 Bytes 15/05/2009 06:39:58 RCTEXT.DLL : 9.0.37.0 86785 Bytes 17/04/2009 01:19:48 Configuration settings for the scan: Jobname.............................: ShlExt Configuration file..................: C:\Users\CHIEFL~1\AppData\Local\Temp\0a030373.avp Logging.............................: low Primary action......................: interactive Secondary action....................: ignore Scan master boot sector.............: on Scan boot sector....................: on Boot sectors........................: H:, Process scan........................: off Scan registry.......................: off Search for rootkits.................: off Integrity checking of system files..: off Scan all files......................: Intelligent file selection Scan archives.......................: on Recursion depth.....................: 20 Smart extensions....................: on Macro heuristic.....................: on File heuristic......................: medium Deviating risk categories...........: +APPL,+SPR, Start of the scan: Saturday, 15 August 2009 17:32 Starting the file scan: Begin scan in 'H:\' <***> H:\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx [DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan Beginning disinfection: H:\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx [DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan [NOTE] The file was moved to '4aed68c1.qua'! End of the scan: Saturday, 15 August 2009 17:48 Used time: 15:00 Minute(s) The scan has been done completely. 82 Scanned directories 15706 Files were scanned 1 Viruses and/or unwanted programs were found 0 Files were classified as suspicious 0 files were deleted 0 Viruses and unwanted programs were repaired 1 Files were moved to quarantine 0 Files were renamed 0 Files cannot be scanned 15705 Files not concerned 0 Archives were scanned 0 Warnings 1 Notes Vielen Dank!!! |
|
16.08.2009, 10:13
| #3 | ||
  | Hilfe zum Löschen der Trojaner TR/Crypt.ZPACK.Gen & Co Hallo,
__________________Also ich glaube bei diesen Funden wird dir kein Kompetenzler helfen. Zitat:
Zitat:
Geh mal auf die Boardsuche und suche nach Crack/Keygen,und du wirst sehen das diese Teile eigentlich immer nette Mitbringsel an Bord haben. In diesem Sinne WW |
|
16.08.2009, 11:50
| #4 |
| | Hilfe zum Löschen der Trojaner TR/Crypt.ZPACK.Gen & Co |
|
| Themen zu Hilfe zum Löschen der Trojaner TR/Crypt.ZPACK.Gen & Co |
| 0 bytes, antivir, audiodg.exe, avgnt.exe, avira, babylon, desktop, dwm.exe, einstellung, error, failed, frage, hijack, hijackthis, internet security, jusched.exe, karte, kaspersky, keygen, kreditkarte, logfile, logon.exe, moved, mp3, nt.dll, rundll, scan, security, sicherheit, speichermedien, stick, svchost.exe, tr/crypt.fspm.gen, trojaner, usb, versteckte ordner, virus, windows, windows system |
Linear-Darstellung
