![]() |
|
Log-Analyse und Auswertung: TR/Rootkit.Gen3 lässt sich nicht entfernenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
![]() | #1 |
| ![]() Kein zugriff auf bestimmte Seiten Hallo, mein erster Virus aus dem ich nicht schlau werde.^^ ICh hab hin und wieder Malwe im Firefox gefunden, nach nem Scann wurde ich aber über andere Trojaner etc. nicht fündig. Also wollte ich dann den Spybot search and destroy anschmeißen, was nicht ging. Antivir ging auch nicht mehr und ich kam nicht mehr auf die offiziellen seiten der Hersteller. Hab dann über Chip Antivir geladen und es funktioniert wieder alles. Das problem ich, dass ich auf die anderen Seiten, unter anderem auch Malwarebytes, keinen Zugriff habe. Bei der installation kommen meistens Error (konnte nicht auf derver zugreifen) Deswegen kann ich mit Ad aware auch keine updates mehr machen. (ad aware hat aber ein paar Trojaner gefunden, wenn auch ein paar sehr alte exe Dateien von meinem alten Rechner. Ich bin dann mal aufs Trojaner Board gegangen und habe den Anweisungen folge geleistet. Und hier nun die logs: defogger_disable by jpshortstuff (23.02.10.1) Log created at 21:09 on 20/09/2010 (Thorwaler) Checking for autostart values... HKCU\~\Run values retrieved. HKLM\~\Run values retrieved. Checking for services/drivers... Unable to read sptd.sys SPTD -> Disabled (Service running -> reboot required) -=E.O.F=- Code:
ATTFilter Internet Explorer (Version = 8.0.7600.16385) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 55,00% Memory free 4,00 Gb Paging File | 3,00 Gb Available in Paging File | 68,00% Paging File free Paging file location(s): c:\pagefile.sys 1000 2000 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 465,66 Gb Total Space | 50,51 Gb Free Space | 10,85% Space Free | Partition Type: NTFS D: Drive not present or media not loaded Drive E: | 465,76 Gb Total Space | 392,87 Gb Free Space | 84,35% Space Free | Partition Type: NTFS F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: HORAS Current User Name: Thorwaler Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: On Skip Microsoft Files: On File Age = 90 Days Output = Standard Quick Scan ========== Extra Registry (SafeList) ========== ========== File Associations ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation) .hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation) .html [@ = ChromeHTML] -- Reg Error: Key error. File not found [HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>] .html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) ========== Shell Spawning ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation) exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation) htmlfile [edit] -- "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation) htmlfile [print] -- "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" /p %1 (Microsoft Corporation) http [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" File not found https [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" File not found inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation) scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [explore] -- Reg Error: Value error. Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) ========== Security Center Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "cval" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] "VistaSp1" = Reg Error: Unknown registry data type -- File not found "AntiVirusOverride" = 0 "AntiSpywareOverride" = 0 "FirewallOverride" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol] ========== Firewall Settings ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 ========== Authorized Applications List ========== ========== HKEY_LOCAL_MACHINE Uninstall List ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{0125D081-30D0-4A97-82A8-C28D444B6256}" = Microsoft SQL Server Compact 3.5 SP2 DEU "{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended "{1596098A-FCEC-48F0-B7C7-08A31B771031}" = Nero 7 Essentials "{192A107E-C6B9-41B9-BDBF-38E3AA226054}" = OpenOffice.org 3.2 "{1D328E11-3B0C-388C-835D-C9C20E8C7734}" = Microsoft Help Viewer 1.0 Language Pack - DEU "{1E2FDD18-E514-4631-AF4A-0CC58FD93DCB}" = Quake Live Mozilla Plugin "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 "{1F61E0B1-1AB8-F15E-07C4-46D100A1D3F7}" = Borderlands "{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = DVD Suite "{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform "{23C3F5C0-566B-478B-AAB6-197ADAD0C945}" = Uniblue SpeedUpMyPC 2009 "{26A24AE4-039D-4CA4-87B4-2F83216018FF}" = Java(TM) 6 Update 18 "{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.(R) AR8121/AR8113/AR8114 Gigabit/Fast Ethernet Driver "{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile "{47C39E4A-28F2-33B1-B9B7-97F24E52D917}" = Microsoft Help Viewer 1.0 "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater "{56B83336-FBC1-4C46-8613-90A9E3B440D6}" = EPU-6 Engine "{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml "{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053 "{60147180-8370-44BC-9BBD-E554D86F0BA3}" = Livestream Procaster "{6179550A-3E7C-499E-BCC9-9E8113E0A285}" = LG ODD Auto Firmware Update "{66D6F3BD-CA23-41A4-9FA3-96B26B32528D}" = Command & Conquer Die ersten 10 Jahre "{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD "{71BFC818-0CED-42D6-9C87-5142918957EE}" = ICQ7.1 "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable "{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 "{77E57197-30EC-444F-B1B8-A99AA2A45794}" = SteelSeries Xai Laser Mouse "{7F3AD00A-1819-4B15-BB7D-08B3586336D7}" = 3DMark06 "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight "{8A74DEFD-A224-49CC-AB80-4E88BC730125}" = LogMeIn Hamachi "{8A809006-C25A-4A3A-9DAB-94659BCDB107}" = NVIDIA PhysX "{90120000-001C-0407-0000-0000000FF1CE}" = Microsoft Office Access Runtime (German) 2007 "{91120407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Standard Edition 2003 "{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting "{97BBECCF-B1FD-4010-8D4B-EFC9E3CCEECF}" = Driver Whiz "{9E78C42C-4FF9-4F41-BBC4-BF872606E79D}_is1" = Driver Robot 1.1.0.13 "{A31951C5-DCD8-4DFE-A525-CFC701F54792}" = TurboV "{A64ECAEE-51FE-4AC7-ABE8-EBBCDA7E3EDC}" = SteelSeries Ikari Laser "{AC76BA86-7AD7-1031-7B44-A93000000001}" = Adobe Reader 9.3.4 - Deutsch "{B194272D-1F92-46DF-99EB-8D5CE91CB4EC}" = Adobe AIR "{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = PowerProducer "{B7E38540-E355-3503-AFD7-635B2F2F76E1}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4974 "{B83F7FA5-3191-4E39-A1F2-8A9038BD0B04}" = Turbo Key "{BE90CE58-41DE-4708-9291-A9D1D49B1031}" = SecurDisc Viewer "{BEE64C14-BEF1-4610-8A68-A16EAA47B882}" = Futuremark SystemInfo "{C2F8CA82-2BD9-4513-B2D1-08A47914C1DA}_is1" = Uniblue DriverScanner "{C911A0C2-2236-3164-AA47-F2566C01AE5E}" = Microsoft .NET Framework 4 Extended DEU Language Pack "{CBCF859F-04BE-4A07-B6FA-F4FAD69EF1ED}" = LightScribe System Software 1.10.27.1 "{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}" = Microsoft .NET Framework 4 Multi-Targeting Pack "{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2 "{D75814C1-5AA5-4198-BFF6-093A226D9F0D}" = O&O Defrag Professional "{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware "{DEEB5FE3-40F5-3C5B-8F85-5306EF3C08F4}" = Microsoft Visual C++ 2010 Express - DEU "{E503B4BF-F7BB-3D5F-8BC8-F694B1CFF942}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022.218 "{E63E34A7-E552-412B-9E40-FD6FC5227ABA}_is1" = Uniblue RegistryBooster "{F2835483-37F2-4123-B4FE-0E77D58447F2}" = Far Cry 2 "{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729) "{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01 "{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack "Active@ KillDisk FREE Suite" = Active@ KillDisk FREE Suite "Ad-Aware" = Ad-Aware "Adobe AIR" = Adobe AIR "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin "ATITool" = ATITool Overclocking Utility "Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus "BLASC 2.0" = BLASC 2.0 "C-Media CM108 Like Sound Driver" = SteelSeries USB Sound Card Win7 v1.10 "CPUCooL" = CPUCooL (remove only) "Diablo II" = Diablo II "DivX Setup.divx.com" = DivX-Setup "DotAlicious Gaming Client" = DotAlicious Gaming Client "ERUNT_is1" = ERUNT 1.1j "GOM Player" = GOM Player "Guitar Pro 5_is1" = Guitar Pro 5.2 "HD Tune Pro_is1" = HD Tune Pro 4.50 "HeidiSQL_is1" = HeidiSQL 5.1 "InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Plattform-Geräte-Manager "IrfanView" = IrfanView (remove only) "JDownloader" = JDownloader "KLiteCodecPack_is1" = K-Lite Codec Pack 5.7.0 (Full) "League of Legends_is1" = League of Legends "LogMeIn Hamachi" = LogMeIn Hamachi "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware "Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile "Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack "Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended "Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack "Microsoft Help Viewer 1.0" = Microsoft Help Viewer 1.0 "Microsoft Help Viewer 1.0 Language Pack - DEU" = Microsoft Help Viewer 1.0 Language Pack - DEU "Microsoft Visual C++ 2010 Express - DEU" = Microsoft Visual C++ 2010 Express - DEU "mIRC" = mIRC "MobMap_is1" = MobMap 3.46 "NVIDIA Display Control Panel" = NVIDIA Display Control Panel "NVIDIA Drivers" = NVIDIA Drivers "NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver "OpenAL" = OpenAL "Orb" = Winamp Remote "PokerStars.net" = PokerStars.net "PunkBusterSvc" = PunkBuster Services "RealAlt_is1" = Real Alternative 2.0.2 "SpeedFan" = SpeedFan (remove only) "Starcraft" = Starcraft "StarCraft II" = StarCraft II "Sweet Home 3D_is1" = Sweet Home 3D version 2.3 "Teamspeak 2 RC2_is1" = TeamSpeak 2 RC2 "TeamSpeak 3 Client" = TeamSpeak 3 Client "TeamViewer 5" = TeamViewer 5 "uTorrent" = µTorrent "Veoh Web Player Beta" = Veoh Web Player "Vtune_is1" = Vtune 7.6 "Warkeys" = Warkeys 1.16.0.0b "Winamp" = Winamp "WinGimp-2.0_is1" = GIMP 2.6.8 "WinRAR archiver" = WinRAR "Ziegel Wärmebrücken Version 3.1" = Ziegel Wärmebrücken Version 3.1 ========== HKEY_CURRENT_USER Uninstall List ========== [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "090215de958f1060" = Curse Client "Octoshape add-in for Adobe Flash Player" = Octoshape add-in for Adobe Flash Player "Octoshape Streaming Services" = Octoshape Streaming Services "Winamp Detect" = Winamp Erkennungs-Plug-in ========== Last 10 Event Log Errors ========== Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt! < End of report > Hier noch der Malwe von Antivir: Die Datei 'C:\Users\Thorwaler\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\40\31343c68-4ab08da7' enthielt einen Virus oder unerwünschtes Programm 'JAVA/Agent.BH' [virus]. Durchgeführte Aktion(en): Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4f923602.qua' verschoben! Ich lad sie jetzt einfach per Zip hoch: (ist schon ihrgent wie schlecht, dass Winrar nicht hochgeladen werden kann) So. Alle daten sind da. Nun hoffe ich auf eure Antworten. Den log von Malwarebytes hab ich leider nicht, da ich das Programm nicht starten kann. Ach ja und auf die Firewall von Windows kann ich auch nicht zugreifen -.- Im abgesicherten Modus hab ich allerdings Zugriff auf die Firewall und Malwarebytes. Kann mir jemand sagen was ich da habe? |
Themen zu TR/Rootkit.Gen3 lässt sich nicht entfernen |
.dll, ad aware, antivir, autostart, bestimmte seiten, chip, curse, dateien, desktop, entfernen, error, exe, exe dateien, explorer.exe, fehler, firefox, firefox.exe, folge, funktioniert, gelöscht, install.exe, installation, java/agent.bh, jdownloader, kein zugriff, keine updates, league of legends, location, lsass.exe, löschen, malwarebytes, modul, neustart, nicht mehr, nicht starten, problem, programm, prozesse, reboot, registry, required, robot, rojaner gefunden, saver, scan, seite, seiten, server, services.exe, shell32.dll, speedupmypc, spybot, svchost.exe, system32, tr/rootkit.gen, treiber, trojaner, trojaner board, trojaner gefunden, updates, usb sound, virus, warnung, windows, winlogon.exe, wuauclt.exe, zugriff |