| |
| |||||||
Log-Analyse und Auswertung: Bitte um Hilfe. Logfile Analyse -2 Trojaner auf RechnerWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
23.09.2009, 12:45
| #1 |
| |  Bitte um Hilfe. Logfile Analyse -2 Trojaner auf Rechner Hallo liebe helfenden. Ich bräuchte dringend eure Hilfe. Habe heute mit AntiVir 2 Viren auf meinem Rechner gefunden die jetzt von dem Programm in Quarantäne geschoben worden. Würde aber gerne von euch wissen, ob die schon größeren Schaden verursacht haben und was ich unternehmen sollte. Die Funde: Die Datei 'C:\Windows\SysWOW64\xwr38547.dll' enthielt einen Virus oder unerwünschtes Programm 'TR/Dldr.Banload.ajed.1' [trojan]. Die Datei 'C:\Windows\SysWOW64\ctfmon_lu.exe' enthielt einen Virus oder unerwünschtes Programm 'TR/Agent.cwxz' [trojan]. Und hier der HijackThis Log: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 13:43:42, on 23.09.2009 Platform: Windows Vista SP2 (WinNT 6.00.1906) MSIE: Internet Explorer v8.00 (8.00.6001.18813) Boot mode: Normal Running processes: C:\Program Files (x86)\DAEMON Tools Lite\daemon.exe C:\Program Files (x86)\Common Files\Nero\Lib\NMBgMonitor.exe C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe C:\Program Files (x86)\Java\jre6\bin\jusched.exe C:\Program Files\Logitech\SetPoint\x86\SetPoint32.exe C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexStoreSvr.exe C:\Program Files (x86)\Mozilla Firefox\firefox.exe C:\Program Files (x86)\Trend Micro\HijackThis\HijackThis.exe C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe C:\Windows\SysWOW64\notepad.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = F2 - REG:system.ini: UserInit=userinit.exe O1 - Hosts: ::1 localhost O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: D - {BC2471D2-B720-38D6-9A61-C780EFC93A81} - C:\Windows\SysWow64\xwr38547.dll (file missing) O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll O4 - HKLM\..\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe" O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\daemon.exe" -autorun O4 - HKCU\..\Run: [EPSON Stylus SX400 Series] C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIEGE.EXE /FU "C:\Windows\TEMP\E_SA65D.tmp" /EF "HKCU" O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files (x86)\Common Files\Nero\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files (x86)\NVIDIA Corporation\nTune\nTuneCmd.exe" clear O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST') O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe O8 - Extra context menu item: add to &BOM - C:\\PROGRA~2\\BIET-O~1\\\\AddToBOM.hta O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL O13 - Gopher Prefix: O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Acronis OS Selector Reinstall Service (AcronisOSSReinstallSvc) - Unknown owner - C:\Program Files (x86)\Common Files\Acronis\Acronis Disk Director\oss_reinstall_svc.exe O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing) O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing) O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: NMIndexingService - Nero AG - C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files (x86)\NVIDIA Corporation\nTune\nTuneService.exe O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing) O23 - Service: O&O Defrag - Unknown owner - C:\Windows\system32\oodag.exe (file missing) O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe O23 - Service: PnkBstrB - Unknown owner - C:\Windows\system32\PnkBstrB.exe O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing) O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing) O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing) O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing) O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing) O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing) O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing) O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing) O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing) -- End of file - 7826 bytes Danke euch schonmal sehr über Hilfe! gruß |
|
23.09.2009, 13:25
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   |  Bitte um Hilfe. Logfile Analyse -2 Trojaner auf Rechner Hallo,
__________________Eins vorweg: viele "Standardprogramme" die wir hier als Hilfsmittel zum Bereinigen einsetzen, sind mit nem 64 Bit Windows NICHT kompatibel - das macht eine Bereinigung schwerer als sie ohnehin schon ist. Stelle die beiden Dateien aus der Quräntäne bitte wieder her und werte sie bei Virustotal aus.Poste alle Ergebnisse inkl. Angaben zu Dateigrößen und Prüfsummen. Notfalls musst Du dazu AntiVir deaktivieren, damit der Zugriff auf die virulenten Dateien reibungslos klappt wenn Du sie zu Virustotal hochlädst. Alternativ kannst Du auch beide Dateien hier im TB hochladen => http://upload.trojaner-board.de Mach auch bitte einen Durchlauf mit MalwareBytes Anti-Malware sowie mit OTL: Systemscan mit OTL Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
__________________ |
|
23.09.2009, 13:42
| #3 |
| | Bitte um Hilfe. Logfile Analyse -2 Trojaner auf Rechner Hi Arne. Thx für die Hilfe!!!
__________________hier sind schonmal die Virustotal Scans: Antivirus Version letzte aktualisierung Ergebnis a-squared 4.5.0.24 2009.09.23 Trojan.Win32.Chepdu!IK AhnLab-V3 5.0.0.2 2009.09.23 - AntiVir 7.9.1.23 2009.09.23 TR/Dldr.Banload.ajed.1 Antiy-AVL 2.0.3.7 2009.09.23 Trojan/Win32.Banload.gen Authentium 5.1.2.4 2009.09.23 - Avast 4.8.1351.0 2009.09.21 - AVG 8.5.0.412 2009.09.23 - BitDefender 7.2 2009.09.23 - CAT-QuickHeal 10.00 2009.09.23 TrojanDownloader.Banload.ajed ClamAV 0.94.1 2009.09.23 - Comodo 2413 2009.09.23 - DrWeb 5.0.0.12182 2009.09.23 - eSafe 7.0.17.0 2009.09.23 - eTrust-Vet 31.6.6756 2009.09.23 - F-Prot 4.5.1.85 2009.09.22 - F-Secure 8.0.14470.0 2009.09.23 Trojan-Downloader.Win32.Banload.ajed Fortinet 3.120.0.0 2009.09.23 W32/Banload.AJED!tr.dldr GData 19 2009.09.23 - Ikarus T3.1.1.72.0 2009.09.23 Trojan.Win32.Chepdu Jiangmin 11.0.800 2009.09.23 - K7AntiVirus 7.10.851 2009.09.22 - Kaspersky 7.0.0.125 2009.09.23 Trojan-Downloader.Win32.Banload.ajed McAfee 5749 2009.09.22 - McAfee+Artemis 5749 2009.09.22 - McAfee-GW-Edition 6.8.5 2009.09.23 Trojan.Dldr.Banload.ajed.1 Microsoft 1.5005 2009.09.23 - NOD32 4449 2009.09.23 - Norman 6.01.09 2009.09.23 - nProtect 2009.1.8.0 2009.09.23 - Panda 10.0.2.2 2009.09.23 Trj/CI.A PCTools 4.4.2.0 2009.09.23 - Prevx 3.0 2009.09.23 - Rising 21.48.23.00 2009.09.23 Trojan.Clicker.Win32.Agent.eye Sophos 4.45.0 2009.09.23 - Sunbelt 3.2.1858.2 2009.09.23 - Symantec 1.4.4.12 2009.09.23 - TheHacker 6.5.0.2.015 2009.09.22 - TrendMicro 8.950.0.1094 2009.09.23 - VBA32 3.12.10.10 2009.09.23 Trojan-Downloader.Win32.Banload.ajed ViRobot 2009.9.23.1950 2009.09.23 - VirusBuster 4.6.5.0 2009.09.22 - weitere Informationen File size: 217088 bytes MD5...: d427e6f7aa3ee777cdfed2c7c3d5cb10 SHA1..: fd702ce445149f299602aeafbce508297b996ccf SHA256: 1b2710991a0e4adbc9e9f61e06638ef14b4d561d98dbca843c959d3dbafa9f16 ssdeep: 6144:P59LGb+G98J3Sl7BEb1Zozy3d1EGQ7cm7Rqw1T:PbKbJYErJ/p PEiD..: - PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x1a4fb timedatestamp.....: 0x4a9fd03d (Thu Sep 03 14:18:37 2009) machinetype.......: 0x14c (I386) ( 5 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x1000 0x20f60 0x21000 6.38 fbe1842fe2b743beb7253edc6e1d2de7 .rdata 0x22000 0x92b0 0xa000 5.28 a00b767c5d7fbd0f3c9da9f864aea73e .data 0x2c000 0x4990dc 0x2000 4.64 dfa62d0b01350557955fb54552301c4e .rsrc 0x4c6000 0xa60 0x1000 2.50 e8f53c0abb1996be2e72c84c75552f9c .reloc 0x4c7000 0x53ca 0x6000 2.71 cc7b7db4ac7c2710c926f8fa54cd3f71 ( 10 imports ) > urlmon.dll: UrlMkSetSessionOption, CoInternetCompareUrl, IsValidURL > KERNEL32.dll: DeleteCriticalSection, LeaveCriticalSection, InterlockedIncrement, EnterCriticalSection, InterlockedDecrement, MultiByteToWideChar, GetModuleFileNameA, GetLastError, WideCharToMultiByte, lstrlenW, SizeofResource, LoadResource, FindResourceA, LoadLibraryExA, lstrcmpiA, lstrcpynA, IsDBCSLeadByte, GetModuleHandleA, lstrcatA, lstrcmpiW, ExitProcess, FreeResource, lstrcatW, lstrcpyW, GetVolumeInformationA, CreateProcessA, CloseHandle, TerminateThread, WaitForSingleObject, CreateThread, SetFileTime, WriteFile, GetFileTime, CreateFileA, InitializeCriticalSection, Module32First, FlushFileBuffers, SetStdHandle, VirtualQuery, GetLocaleInfoA, VirtualProtect, LCMapStringW, LCMapStringA, SetFilePointer, GetStringTypeW, GetStringTypeA, IsBadCodePtr, IsBadReadPtr, GetCPInfo, GetOEMCP, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetEnvironmentStrings, FreeEnvironmentStringsA, GetStartupInfoA, GetFileType, GetStdHandle, SetHandleCount, IsBadWritePtr, VirtualAlloc, VirtualFree, HeapCreate, HeapDestroy, SetUnhandledExceptionFilter, Process32Next, GetThreadLocale, GetACP, GetVersionExA, InterlockedExchange, HeapAlloc, Sleep, LoadLibraryA, GetProcAddress, FreeLibrary, lstrlenA, lstrcpyA, DisableThreadLibraryCalls, GetSystemTimeAsFileTime, GetCurrentThreadId, TlsAlloc, TlsGetValue, SetLastError, TlsFree, HeapSize, GetCurrentProcess, TerminateProcess, GetCurrentProcessId, HeapReAlloc, HeapFree, RaiseException, RtlUnwind, LocalFree, TlsSetValue, GetSystemInfo, QueryPerformanceCounter, GetTickCount, GetCommandLineA > USER32.dll: GetMenuItemCount, GetDoubleClickTime, IsZoomed, GetDlgCtrlID, LoadStringA, GetLastActivePopup, GetKeyboardType, GetDC, CreateMenu, EnumWindows, ReplyMessage, GetKBCodePage, GetMessagePos, DeleteMenu, wsprintfA, SetCaretBlinkTime, EnableWindow, GetInputState, IsWindowEnabled, EndDialog, GetCapture, GetMenu, KillTimer, GetFocus, DestroyMenu, wsprintfW, GetSubMenu, CallMsgFilterA, GetMenuCheckMarkDimensions, IsWindowVisible, CharNextA, InSendMessage, SetTimer, OpenIcon > GDI32.dll: GetBkColor > ADVAPI32.dll: RegCloseKey, RegSetValueExA, RegOpenKeyA, RegQueryInfoKeyA, RegEnumKeyExA, RegCreateKeyExA, RegDeleteValueA, RegCreateKeyA, RegEnumKeyA, RegOpenKeyExA, RegDeleteKeyA, RegQueryValueExA > SHELL32.dll: SHGetSpecialFolderPathA, ShellExecuteA > ole32.dll: CoCreateInstance, CoTaskMemFree, CoTaskMemAlloc, CoTaskMemRealloc, StringFromCLSID, StringFromGUID2 > OLEAUT32.dll: -, -, -, -, -, -, -, -, -, -, -, -, -, -, - > SHLWAPI.dll: PathFindExtensionA > COMCTL32.dll: InitCommonControlsEx ( 4 exports ) DllCanUnloadNow, DllGetClassObject, DllRegisterServer, DllUnregisterServer RDS...: NSRL Reference Data Set - pdfid.: - trid..: DirectShow filter (52.6%) Windows OCX File (32.2%) Win32 Executable MS Visual C++ (generic) (9.8%) Win32 Executable Generic (2.2%) Win32 Dynamic Link Library (generic) (1.9%) ThreatExpert info: <a href='http://www.threatexpert.com/report.aspx?md5=d427e6f7aa3ee777cdfed2c7c3d5cb10' target='_blank'>http://www.threatexpert.com/report.aspx?md5=d427e6f7aa3ee777cdfed2c7c3d5cb10</a> sigcheck: publisher....: Microsoft Corporation copyright....: Copyright 2008 product......: XML parser library description..: XML parser library original name: xml2w32.dll internal name: libxml2 file version.: 1.0.352.7 comments.....: n/a signers......: - signing date.: - verified.....: Unsigned 2. Datei: Antivirus Version letzte aktualisierung Ergebnis a-squared 4.5.0.24 2009.09.23 - AhnLab-V3 5.0.0.2 2009.09.23 - AntiVir 7.9.1.23 2009.09.23 TR/Agent.cwxz Antiy-AVL 2.0.3.7 2009.09.23 Trojan/Win32.Agent Authentium 5.1.2.4 2009.09.23 - Avast 4.8.1351.0 2009.09.21 - AVG 8.5.0.412 2009.09.23 - BitDefender 7.2 2009.09.23 - CAT-QuickHeal 10.00 2009.09.23 Trojan.Agent.cwxz ClamAV 0.94.1 2009.09.23 - Comodo 2413 2009.09.23 - DrWeb 5.0.0.12182 2009.09.23 - eSafe 7.0.17.0 2009.09.23 - eTrust-Vet 31.6.6756 2009.09.23 - F-Prot 4.5.1.85 2009.09.22 - F-Secure 8.0.14470.0 2009.09.23 Trojan.Win32.Agent.cwxz Fortinet 3.120.0.0 2009.09.23 W32/Agent.CWXZ!tr GData 19 2009.09.23 - Ikarus T3.1.1.72.0 2009.09.23 - Jiangmin 11.0.800 2009.09.23 - K7AntiVirus 7.10.851 2009.09.22 - Kaspersky 7.0.0.125 2009.09.23 Trojan.Win32.Agent.cwxz McAfee 5749 2009.09.22 - McAfee+Artemis 5749 2009.09.22 Artemis!25491363BD50 McAfee-GW-Edition 6.8.5 2009.09.23 Trojan.Agent.cwxz Microsoft 1.5005 2009.09.23 - NOD32 4449 2009.09.23 - Norman 6.01.09 2009.09.23 W32/Agent.QUPQ nProtect 2009.1.8.0 2009.09.23 - Panda 10.0.2.2 2009.09.23 Suspicious file PCTools 4.4.2.0 2009.09.23 - Prevx 3.0 2009.09.23 - Rising 21.48.23.00 2009.09.23 - Sophos 4.45.0 2009.09.23 - Sunbelt 3.2.1858.2 2009.09.23 - Symantec 1.4.4.12 2009.09.23 - TheHacker 6.5.0.2.015 2009.09.22 - TrendMicro 8.950.0.1094 2009.09.23 - VBA32 3.12.10.10 2009.09.23 - ViRobot 2009.9.23.1950 2009.09.23 - VirusBuster 4.6.5.0 2009.09.22 - weitere Informationen File size: 9728 bytes MD5...: 25491363bd509bdc0872a320cad16eae SHA1..: b0d33f778bf66f72972af8da862cca15038ec2a3 SHA256: bdd6affc2b0f2a5e61b3ee8de5fcdcdd0002c9290e53a456622e5e4bb56f18e5 ssdeep: 192:AbmposR8h6+lPRHOIA6HNpvthMaqZcFRHIUk7fqqIm:F23RHIUjqIm PEiD..: - PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x1000 timedatestamp.....: 0x4a9fd024 (Thu Sep 03 14:18:12 2009) machinetype.......: 0x14c (I386) ( 4 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x1000 0xd50 0xe00 4.62 2c6b39e5086d9d49af6a180a1f94ec8b .rdata 0x2000 0x24c 0x400 2.96 0fbeaa5908a0c002ba985b389c546fc9 .data 0x3000 0xb5c 0xc00 1.73 1bef8be4cf801368ff9b6749c59037bb .rsrc 0x4000 0x228 0x400 3.36 60b0a21f5e72a84ec19fa1c166110087 ( 4 imports ) > shell32.dll: ShellExecuteA > shlwapi.dll: StrStrIA > kernel32.dll: CloseHandle, ExitProcess, GetCommandLineA, GetModuleFileNameA, GetModuleHandleA, GetTickCount, GetVersion, Sleep, lstrcatA, lstrcpyA, lstrlenA > advapi32.dll: RegSetValueExA, RegOpenKeyExA, RegCreateKeyExA, RegCloseKey ( 0 exports ) RDS...: NSRL Reference Data Set - pdfid.: - trid..: Win32 Executable Generic (42.3%) Win32 Dynamic Link Library (generic) (37.6%) Generic Win/DOS Executable (9.9%) DOS Executable Generic (9.9%) Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%) ThreatExpert info: <a href='http://www.threatexpert.com/report.aspx?md5=25491363bd509bdc0872a320cad16eae' target='_blank'>http://www.threatexpert.com/report.aspx?md5=25491363bd509bdc0872a320cad16eae</a> sigcheck: publisher....: n/a copyright....: n/a product......: n/a description..: n/a original name: n/a internal name: n/a file version.: n/a comments.....: n/a signers......: - signing date.: - verified.....: Unsigned So, bei OTL Scan ist irgendwie nichts passiert. bzw kein Ergebnis angezeigt. Werd gleich noch auf Malware Suche gehen und posten was das Programm sagt. Thx nochmal! |
|
23.09.2009, 13:48
| #4 |
| | Bitte um Hilfe. Logfile Analyse -2 Trojaner auf Rechner Oh, Sry auf dem Desktop sind doch 2 OTL Dateien enstanden . Hier der Post: Allerdings sind die Logs zu lang zum posten, werde Sie anhängen. |
|
23.09.2009, 14:08
| #5 |
| /// Winkelfunktion /// TB-Süch-Tiger™ |  Bitte um Hilfe. Logfile Analyse -2 Trojaner auf Rechner Sehr gut - lade die beiden Dateien bitte bei upload.trojaner-board.de hoch! Die Logs schau ich mir gleich mal an! //edit: Denk noch an Malwarebytes oder läuft das schon?
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
23.09.2009, 14:17
| #6 |
| | Bitte um Hilfe. Logfile Analyse -2 Trojaner auf Rechner ja mach ich. Malwarebytes hat 89 Infektionen angezeigt!!!! Habe die Einträge löschen lassen, direkt danach hat der Rechner einen Neustart gemacht. Scheint aber bis jetzt alles gut gelaufen zu sein. Rechner ist sogar ein klein wenig schneller hochgefahren. |
|
23.09.2009, 14:18
| #7 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Bitte um Hilfe. Logfile Analyse -2 Trojaner auf Rechner Wichtig: Poste bitte das Log von Malwarebytes!!
__________________ Logfiles bitte immer in CODE-Tags posten |
|
23.09.2009, 14:20
| #8 |
| | Bitte um Hilfe. Logfile Analyse -2 Trojaner auf Rechner Hier der Malwarbytes Log: Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: HKEY_CLASSES_ROOT\D (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\D.1 (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{bc2471d2-b720-38d6-9a61-c780efc93a81} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{bc2471d2-b720-38d6-9a61-c780efc93a81} (Trojan.BHO) -> Quarantined and deleted successfully. Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. Infizierte Verzeichnisse: C:\ProgramData\MPK (Refog.Keylogger) -> Quarantined and deleted successfully. C:\ProgramData\MPK\1 (Refog.Keylogger) -> Quarantined and deleted successfully. C:\ProgramData\MPK\1 (Refog.Keylogger) -> Files: 655 -> Quarantined and deleted successfully. C:\ProgramData\MPK\CPDA (Refog.Keylogger) -> Quarantined and deleted successfully. C:\ProgramData\MPK\CPDM (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Help (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Help\English (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Help\German (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Help\Spanish (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Images (Refog.Keylogger) -> Quarantined and deleted successfully. Infizierte Dateien: C:\ProgramData\MPK\M0000 (Refog.Keylogger) -> Quarantined and deleted successfully. C:\ProgramData\MPK\S0000 (Refog.Keylogger) -> Quarantined and deleted successfully. C:\ProgramData\MPK\CPDM\cpfm.bin (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\French.lng (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\German.lng (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\icon_1.ico (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Mpk.dll (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Mpk64.dll (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\MPK64.exe (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Romanian.lng (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Spanish.lng (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\sqlite3.dll (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\unins000.dat (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\unins000.exe (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Help\English\alarms.htm (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Help\English\clipboard.htm (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Help\English\computer.htm (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Help\English\delivery.htm (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Help\English\file.htm (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Help\English\filters.htm (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Help\English\imhelp.htm (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Help\English\internet.htm (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Help\English\invisible.htm (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Help\English\keyboard.htm (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Help\English\logging.htm (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Help\English\log_size.htm (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Help\English\need_update_net.htm (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Help\English\password.htm (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Help\English\programs.htm (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Help\English\screenshot.htm (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Help\English\settings_node.htm (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Help\English\update.htm (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Help\English\users_node.htm (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Help\German\alarms.htm (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Help\German\clipboard.htm (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Help\German\computer.htm (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Help\German\delivery.htm (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Help\German\file.htm (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Help\German\filters.htm (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Help\German\imhelp.htm (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Help\German\internet.htm (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Help\German\invisible.htm (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Help\German\keyboard.htm (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Help\German\logging.htm (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Help\German\log_size.htm (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Help\German\need_update_net.htm (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Help\German\password.htm (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Help\German\programs.htm (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Help\German\screenshot.htm (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Help\German\settings_node.htm (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Help\German\users_node.htm (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Help\Spanish\alarms.htm (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Help\Spanish\clipboard.htm (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Help\Spanish\computer.htm (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Help\Spanish\delivery.htm (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Help\Spanish\filters.htm (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Help\Spanish\internet.htm (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Help\Spanish\invisible.htm (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Help\Spanish\keyboard.htm (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Help\Spanish\logging.htm (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Help\Spanish\log_size.htm (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Help\Spanish\password.htm (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Help\Spanish\programs.htm (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Help\Spanish\screenshot.htm (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Help\Spanish\settings_node.htm (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Help\Spanish\users_node.htm (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Images\english.gif (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Images\german.gif (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Images\russian.gif (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Images\vista_hide.bmp (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Windows\System32\MPK\Images\xp_hide.bmp (Refog.Keylogger) -> Quarantined and deleted successfully. C:\Users\SOAR\AppData\Local\Temp\bot.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. |
|
23.09.2009, 14:21
| #9 |
| | Bitte um Hilfe. Logfile Analyse -2 Trojaner auf Rechner Die meisten Infektionen sind vom Refog Keylogger den ich mal installiert hatte und nicht wusste wie ich den wieder deinstalliere. |
|
| Themen zu Bitte um Hilfe. Logfile Analyse -2 Trojaner auf Rechner |
| adobe, antivir, antivir guard, avg, avira, bho, c:\windows\temp, desktop, disk director, dringend, firefox, gservice, hijack, hijackthis, hijackthis log, internet, internet explorer, logfile, mozilla, plug-in, programm, rundll, software, syswow64, temp, trojan, trojaner, viren, virus, vista, windows, windows\temp |
Linear-Darstellung
