| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Avira Antivir meldet trojanisches Pferd TR Vilsel.aejmWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
14.07.2010, 14:38
| #16 |
 |  Avira Antivir meldet trojanisches Pferd TR Vilsel.aejm Ich hoffe, ich habe es richtig gemacht: Combofix Logfile: Code:
ATTFilter ComboFix 10-07-13.08 - Sushila 14.07.2010 15:20:49.2.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.41.1031.18.1012.617 [GMT 2:00]
ausgeführt von:: c:\dokumente und einstellungen\Sushila\Desktop\cofi.exe.exe
Benutzte Befehlsschalter :: c:\dokumente und einstellungen\Sushila\Desktop\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((((((((( Treiber/Dienste )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_QOY2UYAYDCCN01
-------\Service_qoy2uyaydccn01
((((((((((((((((((((((( Dateien erstellt von 2010-06-14 bis 2010-07-14 ))))))))))))))))))))))))))))))
.
2010-07-14 11:33 . 2008-04-14 12:00 39424 -c--a-w- c:\windows\system32\dllcache\grpconv.exe
2010-07-14 11:33 . 2008-04-14 12:00 39424 ----a-w- c:\windows\system32\grpconv.exe
2010-07-13 19:48 . 2009-10-03 17:06 499712 ----a-w- c:\windows\system32\remover.exe
2010-07-12 16:24 . 2010-02-12 10:03 293376 ------w- c:\windows\system32\browserchoice.exe
2010-06-21 07:47 . 2008-04-13 22:15 60032 -c--a-w- c:\windows\system32\dllcache\usbaudio.sys
2010-06-21 07:47 . 2008-04-13 22:15 60032 ----a-w- c:\windows\system32\drivers\USBAUDIO.sys
2010-06-17 15:41 . 2010-06-17 15:41 -------- d-----w- c:\programme\ICQ6Toolbar
2010-06-17 15:41 . 2010-06-17 15:41 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\ICQ
2010-06-17 15:40 . 2010-06-17 15:40 -------- d-----w- c:\dokumente und einstellungen\Sushila\Lokale Einstellungen\Anwendungsdaten\AOL
2010-06-17 15:40 . 2010-06-17 15:42 -------- d-----w- c:\programme\ICQ7.2
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-14 11:19 . 2010-04-27 14:34 -------- d-----w- c:\programme\CCleaner
2010-07-14 10:50 . 2009-02-28 04:49 82194 ----a-w- c:\windows\system32\perfc007.dat
2010-07-14 10:50 . 2009-02-28 04:49 454060 ----a-w- c:\windows\system32\perfh007.dat
2010-07-13 10:57 . 2010-04-27 15:02 -------- d-----w- c:\programme\Malwarebytes' Anti-Malware
2010-07-12 17:20 . 2009-09-12 16:04 -------- d-----w- c:\programme\Mozilla Thunderbird
2010-07-09 13:04 . 2009-09-15 20:19 -------- d-----w- c:\dokumente und einstellungen\Sushila\Anwendungsdaten\vlc
2010-07-09 08:00 . 2009-02-28 04:49 1036800 ----a-w- c:\windows\explorer.exe
2010-07-09 06:15 . 2009-09-12 16:02 -------- d-----w- c:\dokumente und einstellungen\Sushila\Anwendungsdaten\Skype
2010-07-09 06:13 . 2009-09-12 16:03 -------- d-----w- c:\dokumente und einstellungen\Sushila\Anwendungsdaten\skypePM
2010-07-08 11:15 . 2009-12-26 14:53 -------- d-----w- c:\dokumente und einstellungen\Sushila\Anwendungsdaten\ICQ
2010-07-03 09:29 . 2010-04-29 04:59 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
2010-06-17 15:41 . 2009-02-27 20:56 -------- d--h--w- c:\programme\InstallShield Installation Information
2010-06-17 00:52 . 2009-02-27 21:07 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Microsoft Help
2010-05-30 05:41 . 2010-05-30 05:41 -------- d-----w- c:\programme\IrfanView
2010-05-27 05:33 . 2010-05-27 05:33 50354 ----a-w- c:\dokumente und einstellungen\Sushila\Anwendungsdaten\Facebook\uninstall.exe
2010-05-27 05:33 . 2010-05-27 05:33 -------- d-----w- c:\dokumente und einstellungen\Sushila\Anwendungsdaten\Facebook
2010-05-23 13:51 . 2009-09-06 00:59 67368 ----a-w- c:\dokumente und einstellungen\Sushila\Lokale Einstellungen\Anwendungsdaten\GDIPFONTCACHEV1.DAT
2010-05-22 05:18 . 2009-02-27 21:14 -------- d-----w- c:\programme\Google
2010-05-04 17:14 . 2009-02-28 04:49 832512 ----a-w- c:\windows\system32\wininet.dll
2010-05-04 17:14 . 2009-02-28 04:49 78336 ----a-w- c:\windows\system32\ieencode.dll
2010-05-04 17:14 . 2009-02-28 04:49 17408 ----a-w- c:\windows\system32\corpol.dll
2010-05-02 08:05 . 2009-02-28 04:49 1851392 ----a-w- c:\windows\system32\win32k.sys
2010-04-29 13:39 . 2010-04-27 15:02 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-29 13:39 . 2010-04-27 15:02 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-04-27 10:45 . 2010-04-27 10:45 552 ----a-w- c:\windows\system32\d3d8caps.dat
2010-04-20 05:29 . 2009-02-28 04:49 285696 ----a-w- c:\windows\system32\atmfd.dll
2010-04-17 17:02 . 2010-04-17 17:02 411368 ----a-w- c:\windows\system32\deploytk.dll
.
Gruss Savitri |
|
14.07.2010, 15:36
| #17 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Avira Antivir meldet trojanisches Pferd TR Vilsel.aejm Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten. GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus
__________________
__________________ |
|
14.07.2010, 18:32
| #18 |
| | Avira Antivir meldet trojanisches Pferd TR Vilsel.aejm Gmer verursachte einen Totalabsturz.
__________________Hier die Meldung von osam: Report of OSAM: Autorun Manager v5.0.11926.0 hxxp://www.online-solutions.ru/en/ Saved at 19:27:20 on 14.07.2010 OS: Windows XP Home Edition Service Pack 3 (Build 2600) Default Browser: Microsoft Corporation Internet Explorer 7.00.6000.17055 Scanner Settings Rootkits detection (hidden registry) Rootkits detection (hidden files) Retrieve files information Check Microsoft signatures Filters Trusted entries Empty entries Hidden registry entries (rootkit activity) Exclusively opened files Not found files Files without detailed information Existing files Non-startable services Non-startable drivers Active entries Disabled entries Risk Name Publisher Full Path Status Common %SystemRoot%\Tasks |||| "GoogleUpdateTaskMachineCore.job" "Google Inc." C:\Programme\Google\Update\GoogleUpdate.exe File exists |||| "GoogleUpdateTaskMachineUA.job" "Google Inc." C:\Programme\Google\Update\GoogleUpdate.exe File exists Control Panel Objects %SystemRoot%\system32 |||||| "btcpl.cpl" "Broadcom Corporation." C:\WINDOWS\system32\btcpl.cpl File exists |||||| "infocardcpl.cpl" "Microsoft Corporation" C:\WINDOWS\system32\infocardcpl.cpl File exists |||||| "javacpl.cpl" "Sun Microsystems, Inc." C:\WINDOWS\system32\javacpl.cpl File exists HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls |||||| "Avira AntiVir Personal - Free Antivirus " "Avira GmbH" C:\PROGRA~1\Avira\ANTIVI~1\avconfig.cpl File exists |||||| "mlcfg32.cpl" "Microsoft Corporation" C:\PROGRA~1\MICROS~2\Office12\MLCFG32.CPL File exists Drivers HKLM\SYSTEM\CurrentControlSet\Services |||||| "avgio" (avgio) "Avira GmbH" C:\Programme\Avira\AntiVir Desktop\avgio.sys File exists |||||| "avgntflt" (avgntflt) "Avira GmbH" C:\WINDOWS\System32\DRIVERS\avgntflt.sys File exists |||||| "avipbb" (avipbb) "Avira GmbH" C:\WINDOWS\System32\DRIVERS\avipbb.sys File exists "Bluetooth-Audiogerät" (btaudio) C:\WINDOWS\System32\drivers\btaudio.sys File not found "catchme" (catchme) C:\cofi.exe\catchme.sys File not found "FNETURPX" (FNETURPX) "FNet Co., Ltd." C:\WINDOWS\System32\drivers\FNETURPX.SYS File exists "int15.sys" (int15.sys) c:\acernb\int15.sys File not found "PCIDump" (PCIDump) C:\WINDOWS\system32\drivers\PCIDump.sys File not found "PDCOMP" (PDCOMP) C:\WINDOWS\system32\drivers\PDCOMP.sys File not found "PDFRAME" (PDFRAME) C:\WINDOWS\system32\drivers\PDFRAME.sys File not found "PDRELI" (PDRELI) C:\WINDOWS\system32\drivers\PDRELI.sys File not found "PDRFRAME" (PDRFRAME) C:\WINDOWS\system32\drivers\PDRFRAME.sys File not found "Realtek IR Driver" (Rts516xIR) C:\WINDOWS\System32\DRIVERS\Rts516xIR.sys File not found "Realtek Smartcard Reader Driver" (USBCCID) C:\WINDOWS\System32\DRIVERS\Rts5161ccid.sys File not found |||||| "ssmdrv" (ssmdrv) "Avira GmbH" C:\WINDOWS\System32\DRIVERS\ssmdrv.sys File exists "WDICA" (WDICA) C:\WINDOWS\system32\drivers\WDICA.sys File not found "WIDCOMM USB Bluetooth Driver" (BTWUSB) C:\WINDOWS\System32\Drivers\btwusb.sys File not found Explorer HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components |||||| {89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" "Microsoft Corporation" c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install File exists HKLM\Software\Classes\Folder\shellex\ColumnHandlers |||||| {F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" "Adobe Systems, Inc." C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll File exists HKLM\Software\Classes\Protocols\Filter |||||| {1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" "Microsoft Corporation" C:\WINDOWS\system32\mscoree.dll File exists |||||| {1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" "Microsoft Corporation" C:\WINDOWS\system32\mscoree.dll File exists |||||| {1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" "Microsoft Corporation" C:\WINDOWS\system32\mscoree.dll File exists |||||| {807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" "Microsoft Corporation" C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\MSOXMLMF.DLL File exists HKLM\Software\Classes\Protocols\Handler |||||| {314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" "Microsoft Corporation" C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll File exists |||||| {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" "Skype Technologies" C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL File exists |||| {828030A1-22C1-4009-854F-8E305202313F} "livecall" "Microsoft Corporation" C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL File exists |||||| {88FED34C-F0CA-4636-A375-3CB6248B04CD} "Local Groove Web Services Protocol" "Microsoft Corporation" C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll File exists |||||| {0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" "Microsoft Corporation" C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\msitss.dll File exists |||| {828030A1-22C1-4009-854F-8E305202313F} "msnim" "Microsoft Corporation" C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL File exists |||||| {03C514A3-1EFB-4856-9F99-10D7BE1653C0} "Windows Live Mail HTML Asynchronous Pluggable Protocol Handler" "Microsoft Corporation" C:\Programme\Windows Live\Mail\mailcomm.dll File exists HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks |||||| {B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" "Microsoft Corporation" C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll File exists HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved |||||| {6af09ec9-b429-11d4-a1fb-0090960218cb} "Bluetooth-Umgebung" "Broadcom Corporation." C:\WINDOWS\system32\BTNEIG~1.DLL File exists |||||| {0563DB41-F538-4B37-A92D-4659049B7766} "CLSID_WLMCMimeFilter" "Microsoft Corporation" C:\Programme\Windows Live\Mail\mailcomm.dll File exists {42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" deskpan.dll File not found |||||| {99FD978C-D287-4F50-827F-B2C658EDA8E7} "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" "Microsoft Corporation" C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll File exists |||||| {AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} "Groove Explorer Icon Overlay 2 (GFS Stub)" "Microsoft Corporation" C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll File exists |||||| {920E6DB1-9907-4370-B3A0-BAFC03D81399} "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" "Microsoft Corporation" C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll File exists |||||| {16F3DD56-1AF5-4347-846D-7C10C4192619} "Groove Explorer Icon Overlay 3 (GFS Folder)" "Microsoft Corporation" C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll File exists |||||| {2916C86E-86A6-43FE-8112-43ABE6BF8DCC} "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" "Microsoft Corporation" C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll File exists |||||| {2A541AE1-5BF6-4665-A8A3-CFA9672E4291} "Groove Folder Synchronization" "Microsoft Corporation" C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll File exists |||||| {72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" "Microsoft Corporation" C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll File exists |||||| {6C467336-8281-4E60-8204-430CED96822D} "Groove GFS Context Menu Handler" "Microsoft Corporation" C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll File exists |||||| {B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" "Microsoft Corporation" C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll File exists |||||| {A449600E-1DC6-4232-B948-9BD794D62056} "Groove GFS Stub Icon Handler" "Microsoft Corporation" C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll File exists |||||| {387E725D-DC16-4D76-B310-2C93ED4752A0} "Groove XML Icon Handler" "Microsoft Corporation" C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll File exists {853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" File not found | COM-object registry key not found |||||| {42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" "Microsoft Corporation" C:\Programme\Microsoft Office\Office12\msohevi.dll File exists |||||| {993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" "Microsoft Corporation" C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll File exists |||||| {5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" "Microsoft Corporation" C:\PROGRA~1\MICROS~2\Office12\ONFILTER.DLL File exists |||||| {00020D75-0000-0000-C000-000000000046} "Microsoft Office Outlook" "Microsoft Corporation" C:\PROGRA~1\MICROS~2\Office12\MLSHEXT.DLL File exists |||||| {C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" "Microsoft Corporation" C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll File exists |||||| {7842554E-6BED-11D2-8CDB-B05550C10000} "Monitor Class" "Broadcom Corporation." C:\WINDOWS\system32\btncopy.dll File exists |||||| {0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" "Microsoft Corporation" C:\PROGRA~1\MICROS~2\Office12\OLKFSTUB.DLL File exists |||||| {1530F7EE-5128-43BD-9977-84A4B0FAD7DF} "PhotoToys" "Microsoft Corporation" C:\WINDOWS\system32\phototoys.dll File exists |||||| {45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" "Avira GmbH" C:\Programme\Avira\AntiVir Desktop\shlext.dll File exists |||||| {E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" "Microsoft Corporation" c:\WINDOWS\system32\dfshim.dll File exists {764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" File not found | COM-object registry key not found |||||| {e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" "Microsoft Corporation" c:\WINDOWS\system32\dfshim.dll File exists |||||| {BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Web Folders" "Microsoft Corporation" C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\MSONSEXT.DLL File exists |||||| {2BE99FD4-A181-4996-BFA9-58C5FFD11F6C} "Windows Live Photo Gallery Autoplay Drop Target" "Microsoft Corporation" C:\Programme\Windows Live\Photo Gallery\WLXPhotoGallery.exe File exists |||||| {00F30F64-AC33-42F5-8FD1-5DC2D3FDE06C} "Windows Live Photo Gallery Editor Drop Target" "Microsoft Corporation" C:\Programme\Windows Live\Photo Gallery\WLXPhotoGallery.exe File exists |||||| {00F3712A-CA79-45B4-9E4D-D7891E7F8B9D} "Windows Live Photo Gallery Editor Shim" "Microsoft Corporation" C:\Programme\Windows Live\Photo Gallery\PhotoViewerShim.dll File exists |||||| {00F30F90-3E96-453B-AFCD-D71989ECC2C7} "Windows Live Photo Gallery Viewer Autoplay Shim" "Microsoft Corporation" C:\Programme\Windows Live\Photo Gallery\PhotoViewerShim.dll File exists |||||| {00F33137-EE26-412F-8D71-F84E4C2C6625} "Windows Live Photo Gallery Viewer Autoplay Shim" "Microsoft Corporation" C:\Programme\Windows Live\Photo Gallery\PhotoViewerShim.dll File exists |||||| {00F374B7-B390-4884-B372-2FC349F2172B} "Windows Live Photo Gallery Viewer Drop Target" "Microsoft Corporation" C:\Programme\Windows Live\Photo Gallery\WLXPhotoGallery.exe File exists |||||| {00F346CB-35A4-465B-8B8F-65A29DBAB1F6} "Windows Live Photo Gallery Viewer Shim" "Microsoft Corporation" C:\Programme\Windows Live\Photo Gallery\PhotoViewerShim.dll File exists |||||| {B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" "Alexander Roshal" C:\Programme\WinRAR\rarext.dll File exists |||||| {06A2568A-CED6-4187-BB20-400B8C02BE5A} "{06A2568A-CED6-4187-BB20-400B8C02BE5A}" "Microsoft Corporation" C:\Programme\Windows Live\Photo Gallery\WLXPhotoAcquireWizard.exe File exists Internet Explorer HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser |||| "Google Toolbar" "Google Inc." C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll File exists "ITBar7Layout" File not found | COM-object registry key not found HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks {855F3B16-6D32-4fe6-8A56-BBB695989046} "ICQToolBar" "ICQ" C:\Programme\ICQ6Toolbar\ICQToolBar.dll File exists "{855F3B16-6D32-4fe6-8A56-BBB695989046}" File not found | COM-object registry key not found HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units |||| {8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_18" hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab "Sun Microsystems, Inc." C:\Programme\Java\jre6\bin\npjpi160_18.dll File exists |||| {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} "Java Plug-in 1.6.0_18" hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab "Sun Microsystems, Inc." C:\Programme\Java\jre6\bin\npjpi160_18.dll File exists |||| {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_18" hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab "Sun Microsystems, Inc." C:\Programme\Java\jre6\bin\npjpi160_18.dll File exists HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions |||||| "@btrez.dll,-4015" C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm File exists |||| {48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" "Microsoft Corporation" C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll File exists |||| "ICQ7.2" "ICQ, LLC." C:\Programme\ICQ7.2\ICQ.exe File exists |||| {5F7B1267-94A9-47F5-98DB-E99415F33AEC} "In Blog veröffentlichen" "Microsoft Corporation" C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll File exists || "PokerStars" "PokerStars" C:\Programme\PokerStars\PokerStarsUpdate.exe File exists |||| {FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" "Microsoft Corporation" C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL File exists HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar |||| "Google Toolbar" "Google Inc." C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll File exists {855F3B16-6D32-4FE6-8A56-BBB695989046} "ICQToolBar" "ICQ" C:\Programme\ICQ6Toolbar\ICQToolBar.dll File exists HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects |||||| {18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" "Adobe Systems Incorporated" C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll File exists |||| {AA58ED58-01DD-4d91-8333-CF10577473F7} "Google Toolbar Helper" "Google Inc." C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll File exists || {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} "Google Toolbar Notifier BHO" "Google Inc." C:\Programme\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll File exists |||||| {72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" "Microsoft Corporation" C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll File exists |||| {DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" "Sun Microsystems, Inc." C:\Programme\Java\jre6\bin\jp2ssv.dll File exists |||| {E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class" "Sun Microsystems, Inc." C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll File exists |||||| {9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live Anmelde-Hilfsprogramm" "Microsoft Corporation" C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll File exists {5C255C8A-E604-49b4-9D64-90988571CECB} "{5C255C8A-E604-49b4-9D64-90988571CECB}" File not found | COM-object registry key not found Logon %AllUsersProfile%\Startmenü\Programme\Autostart |||| "Acer VCM.lnk" "Acer Incorporated" C:\Programme\Acer\Acer VCM\AcerVCM.exe Shortcut exists | File exists |||||| "desktop.ini" C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini File exists |||| "BTTray.lnk" "Broadcom Corporation." C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe Shortcut exists | File exists %UserProfile%\Startmenü\Programme\Autostart |||| "OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk" "Microsoft Corporation" C:\Programme\Microsoft Office\Office12\ONENOTEM.EXE Shortcut exists | File exists |||||| "desktop.ini" C:\Dokumente und Einstellungen\Sushila\Startmenü\Programme\Autostart\desktop.ini File exists HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run |||| "swg" "Google Inc." "C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" File exists HKLM\Software\Microsoft\Windows\CurrentVersion\Run |||||| "avgnt" "Avira GmbH" "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min File exists |||| "MSPY2002" C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC File signed by Microsoft | File found, but it contains no detailed information Print Monitors HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors |||||| "Bluetooth-Druckeranschluss" "Broadcom Corporation." C:\WINDOWS\system32\bthcrp.dll File exists |||||| "Send To Microsoft OneNote Monitor" "Microsoft Corporation" C:\WINDOWS\system32\msonpmon.dll File exists Services HKLM\SYSTEM\CurrentControlSet\Services |||||| ".NET Runtime Optimization Service v2.0.50727_X86" (clr_optimization_v2.0.50727_32) "Microsoft Corporation" C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe File exists "Anwendungsverwaltung" (AppMgmt) C:\WINDOWS\System32\appmgmts.dll File not found |||||| "ASP.NET State Service" (aspnet_state) "Microsoft Corporation" C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe File exists |||||| "Avira AntiVir Guard" (AntiVirService) "Avira GmbH" C:\Programme\Avira\AntiVir Desktop\avguard.exe File exists |||||| "Avira AntiVir Planer" (AntiVirSchedulerService) "Avira GmbH" C:\Programme\Avira\AntiVir Desktop\sched.exe File exists |||||| "Bluetooth Service" (btwdins) "Broadcom Corporation." C:\Programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe File exists |||| "Google Software Updater" (gusvc) "Google" C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe File exists |||| "Google Update Service (gupdate)" (gupdate) "Google Inc." C:\Programme\Google\Update\GoogleUpdate.exe File exists "ICQ Service" (ICQ Service) C:\Programme\ICQ6Toolbar\ICQ Service.exe File exists |||||| "Intel(R) Matrix Storage Event Monitor" (IAANTMON) "Intel Corporation" C:\Programme\Intel\Intel Matrix Storage Manager\IAANTMon.exe File exists |||||| "Java Quick Starter" (JavaQuickStarterService) "Sun Microsystems, Inc." C:\Programme\Java\jre6\bin\jqs.exe File exists |||||| "Microsoft Office Diagnostics Service" (odserv) "Microsoft Corporation" C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE File exists |||||| "Microsoft Office Groove Audit Service" (Microsoft Office Groove Audit Service) "Microsoft Corporation" C:\Programme\Microsoft Office\Office12\GrooveAuditService.exe File exists |||||| "Office Source Engine" (ose) "Microsoft Corporation" C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE File exists |||||| "Raw Socket Service" (RS_Service) "Acer Incorporated" C:\Programme\Acer\Acer VCM\RS_Service.exe File exists |||||| "Windows CardSpace" (idsvc) "Microsoft Corporation" c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe File exists |||||| "Windows Presentation Foundation Font Cache 3.0.0.0" (FontCache3.0.0.0) "Microsoft Corporation" c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe File exists Winlogon HKCU\Control Panel\IOProcs "MVB" mvfs32.dll File not found HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions {c6dc5466-785a-11d2-84d0-00c04fb169f7} "Softwareinstallation" appmgmts.dll File not found If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru Gruss Savitri |
|
14.07.2010, 18:48
| #19 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Avira Antivir meldet trojanisches Pferd TR Vilsel.aejm Ok - Rechner wieder besser? Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SUPERAntiSpyware und poste die Logs. Denk dran beide Tools zu updaten vor dem Scan!!
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
15.07.2010, 02:16
| #20 |
| | Avira Antivir meldet trojanisches Pferd TR Vilsel.aejm Hier die zwei Logs: Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Datenbank Version: 4313 Windows 5.1.2600 Service Pack 3 Internet Explorer 7.0.5730.13 14.07.2010 22:08:56 mbam-log-2010-07-14 (22-08-56).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|) Durchsuchte Objekte: 205373 Laufzeit: 1 Stunde(n), 14 Minute(n), 53 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 2 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: C:\Qoobox\Quarantine\C\System Volume Information\_restore{d5fffa500b1b}\smss.exe.vir (Trojan.Unruy) -> Quarantined and deleted successfully. C:\Qoobox\Quarantine\C\System Volume Information\_restore{d5fffa500b1b}\svchost.exe.vir (Trojan.Unruy) -> Quarantined and deleted successfully. SUPERAntiSpyware Scan Log hxxp://www.superantispyware.com Generated 07/15/2010 at 00:50 AM Application Version : 4.40.1002 Core Rules Database Version : 5200 Trace Rules Database Version: 3012 Scan type : Complete Scan Total Scan Time : 02:20:31 Memory items scanned : 483 Memory threats detected : 0 Registry items scanned : 7384 Registry threats detected : 4 File items scanned : 73732 File threats detected : 0 Rogue.AntivirusSoft HKU\.DEFAULT\Software\avsoft HKU\S-1-5-18\Software\avsoft Malware.Trace HKU\.DEFAULT\SOFTWARE\AVSUITE HKU\S-1-5-18\SOFTWARE\AVSUITE Gruss Savitri |
|
15.07.2010, 09:27
| #21 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Avira Antivir meldet trojanisches Pferd TR Vilsel.aejm Sieht ok aus, da wurden nur noch Überreste gefunden. Rechner wieder ok?
__________________ --> Avira Antivir meldet trojanisches Pferd TR Vilsel.aejm |
|
15.07.2010, 12:07
| #22 |
| | Avira Antivir meldet trojanisches Pferd TR Vilsel.aejm Hi Cosinus Super, bis jetzt kam keine Virus-Nachricht. Vielen Dank für Deine Hilfe. Gruss Savitri |
|
15.07.2010, 12:13
| #23 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Avira Antivir meldet trojanisches Pferd TR Vilsel.aejm Gut, wenn jetzt wieder alles ok ist, bitte abschließend die Updates prüfen, nimm meinen Leitaden dazu als Hilfe: Microsoftupdate Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren. Windows Vista/7: Anleitung Windows-Update PDF-Reader aktualisieren Dein Adobe Reader ist nicht aktuell, was ein großes Sicherheitsrisiko darstellt. Du solltest daher besser die alte Version über Systemsteuerung => Software deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. Ich empfehle einen alternativen PDF-Reader wie SumatraPDF oder Foxit PDF Reader, beide sind sehr viel schlanker und flotter als der AdobeReader. Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers, hier der direkte Downloadlink => http://filepony.de/?q=Flash+Player Java-Update Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
| Themen zu Avira Antivir meldet trojanisches Pferd TR Vilsel.aejm |
| antivir, antivir meldet, avira, avira antivir, gen, laptop, melde, meldet, meldungen, pferd, tr vilsel.aejm, troja, trojan.unruy, trojaner auf der festplatte, trojanische, trojanisches, trojanisches pferd, virenmeldungen |
Linear-Darstellung
