| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Trojaner in mehreren Dateien - TR/SMALL.cjd TR/Dldr.Agent.dmrq TR/Ertfor.B.Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
30.04.2010, 19:47
| #16 |
 |  Trojaner in mehreren Dateien - TR/SMALL.cjd TR/Dldr.Agent.dmrq TR/Ertfor.B. fertig Code:
ATTFilter All processes killed
========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\KMCONFIG deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\Prefixes\\gopher|:gopher:// /E : value set successfully!
File 504-8834-11D5-AC75-0008C73FD642} file:///C:/Program%20Files/proeWildfire%203.0/i486_nt/obj/pvx_install.exe not found.
Starting removal of ActiveX control {1ED48504-8834-11D5-AC75-0008C73FD642}
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{1ED48504-8834-11D5-AC75-0008C73FD642}\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{1ED48504-8834-11D5-AC75-0008C73FD642}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1ED48504-8834-11D5-AC75-0008C73FD642}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{1ED48504-8834-11D5-AC75-0008C73FD642}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1ED48504-8834-11D5-AC75-0008C73FD642}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{32a5e8a0-ad06-11de-910d-00238b0b7982}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{32a5e8a0-ad06-11de-910d-00238b0b7982}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{32a5e8a0-ad06-11de-910d-00238b0b7982}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{32a5e8a0-ad06-11de-910d-00238b0b7982}\ not found.
File F:\Autorun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{680b5944-630d-11de-ab8f-00238b0b7982}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{680b5944-630d-11de-ab8f-00238b0b7982}\ not found.
File H:\APOTEKA\\\\\\BRENINA.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{680b5944-630d-11de-ab8f-00238b0b7982}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{680b5944-630d-11de-ab8f-00238b0b7982}\ not found.
File H:\APOTEKA\\\\\\BRENINA.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{680b5944-630d-11de-ab8f-00238b0b7982}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{680b5944-630d-11de-ab8f-00238b0b7982}\ not found.
File H:\APOTEKA\\\\\\BRENINA.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{af4f3379-3ef0-11df-b683-00238b0b7982}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{af4f3379-3ef0-11df-b683-00238b0b7982}\ not found.
File I:\BOMBOM\dokazehehe.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{af4f3379-3ef0-11df-b683-00238b0b7982}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{af4f3379-3ef0-11df-b683-00238b0b7982}\ not found.
File I:\BOMBOM\dokazehehe.exe not found.
C:\Users\mts\AppData\Roaming\lowsec folder moved successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
File\Folder C:\Windows\System32\drivers\yviityx.sys not found.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
[EMPTYTEMP]
User: All Users
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 41 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: mts
->Temp folder emptied: 1653813825 bytes
->Temporary Internet Files folder emptied: 854897224 bytes
->Java cache emptied: 78170954 bytes
->FireFox cache emptied: 35915082 bytes
->Google Chrome cache emptied: 55951095 bytes
->Flash cache emptied: 2465 bytes
User: Public
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 123139937 bytes
RecycleBin emptied: 0 bytes
Total Files Cleaned = 2.672,00 mb
OTL by OldTimer - Version 3.2.3.0 log created on 04302010_201248
Files\Folders moved on Reboot...
C:\Users\mts\AppData\Local\Temp\ehmsas.txt moved successfully.
File move failed. C:\Windows\temp\hlktmp scheduled to be moved on reboot.
|
|
30.04.2010, 19:52
| #17 |
| /// Helfer-Team  | Trojaner in mehreren Dateien - TR/SMALL.cjd TR/Dldr.Agent.dmrq TR/Ertfor.B. Ok, jetzt bitte einen Scan mit SUPERAntiSpyware machen.
__________________
__________________ |
|
01.05.2010, 10:44
| #18 |
| | Trojaner in mehreren Dateien - TR/SMALL.cjd TR/Dldr.Agent.dmrq TR/Ertfor.B. ok, hier der superanzispyware log. scheint einiges gefunden zu haben...
__________________Code:
ATTFilter SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com
Generated 04/30/2010 at 10:24 PM
Application Version : 4.35.1000
Core Rules Database Version : 4872
Trace Rules Database Version: 2684
Scan type : Complete Scan
Total Scan Time : 01:29:23
Memory items scanned : 620
Memory threats detected : 0
Registry items scanned : 8722
Registry threats detected : 0
File items scanned : 64271
File threats detected : 72
Adware.Tracking Cookie
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\mts@atwola[3].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\mts@apmebf[2].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\mts@tradedoubler[3].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\mts@mediaplex[3].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\mts@doubleclick[3].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\mts@ptc.112.2o7[2].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\Low\mts@advertising[2].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\Low\mts@serving-sys[2].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\Low\mts@ad.yieldmanager[1].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\Low\mts@ww251.smartadserver[2].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\Low\mts@2o7[1].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\Low\mts@ad.71i[1].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\Low\mts@adserver.71i[1].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\Low\mts@adtech[1].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\Low\mts@aolde.122.2o7[1].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\Low\mts@de.at.atwola[1].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\Low\mts@at.atwola[2].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\Low\mts@atdmt[1].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\Low\mts@bs.serving-sys[2].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\Low\mts@content.yieldmanager[3].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\Low\mts@doubleclick[2].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\Low\mts@im.banner.t-online[1].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\Low\mts@kontera[2].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\Low\mts@pro-market[2].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\Low\mts@questionmarket[1].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\Low\mts@teltarifdeonlineverlaggmbh.112.2o7[1].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\Low\mts@sevenoneintermedia.112.2o7[1].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\Low\mts@smartadserver[1].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\Low\mts@stats.bmw[1].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\Low\mts@statse.webtrendslive[1].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\Low\mts@tacoda[2].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\Low\mts@tradedoubler[1].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\Low\mts@traffictrack[2].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\Low\mts@xiti[1].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\mts@advertising[1].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\mts@www.zanox-affiliate[1].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\mts@www.etracker[2].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\mts@ad.yieldmanager[2].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\mts@ad.zanox[1].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\mts@traffictrack[2].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\mts@2o7[2].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\mts@track.adform[2].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\mts@adfarm1.adition[1].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\mts@ad.71i[1].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\mts@adserver.71i[1].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\mts@apmebf[1].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\mts@ar.atwola[2].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\mts@atdmt[2].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\mts@atwola[1].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\mts@atwola[2].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\mts@bs.serving-sys[1].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\mts@content.yieldmanager[1].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\mts@content.yieldmanager[3].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\mts@doubleclick[1].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\mts@doubleclick[2].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\mts@mediaplex[1].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\mts@overture[1].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\mts@ptc.112.2o7[1].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\mts@serving-sys[2].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\mts@sevenoneintermedia.112.2o7[1].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\mts@tacoda[1].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\mts@tracking.mindshare[1].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\mts@tracking.quisma[1].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\mts@tradedoubler[1].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\mts@tradedoubler[2].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\mts@tto2.traffictrack[2].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\mts@unitymedia[1].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\mts@webmasterplan[1].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\mts@zanox-affiliate[1].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\mts@zanox[2].txt
C:\Users\mts\AppData\Roaming\Microsoft\Windows\Cookies\mts@zbox.zanox[2].txt
Application.Agent/Gen-TempZ
|
|
01.05.2010, 21:03
| #19 |
| /// Helfer-Team | Trojaner in mehreren Dateien - TR/SMALL.cjd TR/Dldr.Agent.dmrq TR/Ertfor.B. Die Funde von SUPERAntiSpyware sind nur Cookies, also ungefährlich. Damit sollten wir durch sein  Abschließende Maßnahmen: 1. OTL Cleanup:
2. Updates prüfen:
3. Infizierte Systemwiederherstellungspunkte löschen: Lösche alle Systemwiederherstellungspunkte, sie könnten infiziert sein:
|
|
Linear-Darstellung
