| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Thunderbird Emailkonten ausgehebelt - Trojaner?Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
20.10.2010, 15:53
| #1 |
| |  Thunderbird Emailkonten ausgehebelt - Trojaner? Hallo, Meine Google Mail Konten (inges. 2), die in Thunderbird gespeichert waren, wurden ausgehebelt (Deutsche u. französische (Handy) IP hat sich eingeloggt). Hab die PWs beider Konten geändert und Thunderbird die neuen Passwörter nicht "gegeben". Deshalb habe ich die Vermutung, dass ich infiziert wurde. HijackthisLog: HiJackthis Logfile: Code:
ATTFilter Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 16:51:10, on 20.10.2010 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Programme\AVG\AVG9\avgchsvx.exe C:\Programme\AVG\AVG9\avgrsx.exe C:\WINDOWS\system32\spoolsv.exe C:\Programme\AVG\AVG9\avgcsrvx.exe C:\WINDOWS\Explorer.EXE C:\Programme\Google\Update\GoogleUpdate.exe D:\PE7\PhotoshopElementsFileAgent.exe C:\Programme\AVG\AVG9\avgwdsvc.exe C:\Programme\Java\jre6\bin\jqs.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\PnkBstrB.exe C:\WINDOWS\system32\svchost.exe D:\3DataManager\WTGService.exe C:\Programme\AVG\AVG9\avgnsx.exe C:\Programme\AVG\AVG9\avgemc.exe C:\Programme\AVG\AVG9\avgcsrvx.exe C:\Programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe D:\ASUS\ATKOSD2\ATKOSD2.exe D:\ASUS\ATK Hotkey\MsgTranAgt.exe D:\ASUS\ATK Hotkey\HControlUser.exe D:\ASUS\ATK Hotkey\HControl.exe C:\Programme\Synaptics\SynTP\SynTPEnh.exe C:\PROGRA~1\AVG\AVG9\avgtray.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\system32\ctfmon.exe D:\TrueCrypt\TrueCrypt.exe C:\Programme\DAEMON Tools Pro\DTProAgent.exe C:\WINDOWS\System32\svchost.exe C:\Programme\Mozilla Thunderbird\thunderbird.exe D:\ASUS\ATK Hotkey\ATKOSD.exe C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe C:\Programme\LCDHype\lcdhype.exe C:\Programme\Lavalys\EVEREST Ultimate Edition\everest.exe D:\ASUS\ATK Hotkey\WDC.exe C:\Programme\Fraps\fraps.exe C:\Programme\Logitech\SetPoint II\SetPointII.exe C:\Programme\Gemeinsame Dateien\Logishrd\KHAL2\KHALMNPR.EXE C:\WINDOWS\system32\wuauclt.exe C:\Programme\Opera\opera.exe E:\SA-MP\GTA San Andreas\samp.exe D:\mIRC\mirc.exe D:\FileZilla FTP Client\filezilla.exe C:\Programme\AVG\AVG9\avgui.exe C:\Programme\AVG\AVG9\avgscanx.exe C:\Programme\AVG\AVG9\avgcsrvx.exe C:\Programme\Malwarebytes' Anti-Malware\mbam.exe C:\Dokumente und Einstellungen\[Username]\Desktop\HiJackThis204.exe O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll O4 - HKLM\..\Run: [ATKOSD2] D:\ASUS\ATKOSD2\ATKOSD2.exe O4 - HKLM\..\Run: [MsgTranAgt] D:\ASUS\ATK Hotkey\MsgTranAgt.exe O4 - HKLM\..\Run: [HControlUser] D:\ASUS\ATK Hotkey\HControlUser.exe O4 - HKLM\..\Run: [ATKHOTKEY] D:\ASUS\ATK Hotkey\HControl.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [TrueCrypt] "D:\TrueCrypt\TrueCrypt.exe" /q preferences O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Programme\DAEMON Tools Pro\DTProAgent.exe" -autorun O4 - HKCU\..\Run: [Thunderbird] "C:\Programme\Mozilla Thunderbird\thunderbird" -turbo O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: LCD1.lnk = C:\Programme\LCDHype\lcdhype.exe O4 - Startup: LCD2.lnk = C:\Programme\Lavalys\EVEREST Ultimate Edition\everest.exe O4 - Startup: LCD3.lnk = C:\Programme\Fraps\fraps.exe O4 - Startup: SetPointII.lnk = ? O4 - Global Startup: BTTray.lnk = ? O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://D:\Office\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Senden an &Bluetooth-Gerät... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm O8 - Extra context menu item: Senden an Bluetooth - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Office\OFFICE11\REFIEBAR.DLL O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{78E8BD2F-8163-4868-94E0-B6F6BDC30CE5}: NameServer = 208.67.222.222,208.67.222.220 O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Programme\AVG\AVG9\avgpp.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing) O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll O23 - Service: Adobe Active File Monitor V7 (AdobeActiveFileMonitor7.0) - Adobe Systems Incorporated - D:\PE7\PhotoshopElementsFileAgent.exe O23 - Service: AVG Free E-mail Scanner (avg9emc) - AVG Technologies CZ, s.r.o. - C:\Programme\AVG\AVG9\avgemc.exe O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Programme\AVG\AVG9\avgwdsvc.exe O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe O23 - Service: NMIndexingService - Unknown owner - C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Programme\Alcohol 120\StarWind\StarWindServiceAE.exe O23 - Service: WTGService - Unknown owner - D:\3DataManager\WTGService.exe -- End of file - 7837 bytes Führe gerade mit AVG und danach mit Malwarebytes einen Scan durch, ich werde die Ergebnisse dann hier posten. Danke im Voraus für alle Antworten! |
|
20.10.2010, 16:01
| #2 |
| /// Malware-holic   | Thunderbird Emailkonten ausgehebelt - Trojaner?__________________ |
|
21.10.2010, 14:11
| #3 | |
 | Thunderbird Emailkonten ausgehebelt - Trojaner? Nein, beide Konten hatten unterschiedliche PWs (Außerdem waren diese einzigartig und nur bei den Mailkonten verwendet, gottseidank
__________________ )Malwarebytes hat nichts gefunden, aber AVG hat mir eine Infektion angezeigt; siehe Anhang Zitat:
Combofix Logfile: Code:
ATTFilter ComboFix 10-10-20.04 - [username] 21.10.2010 14:54:43.1.2 - x86
ausgeführt von:: c:\dokumente und einstellungen\[username]\Desktop\ComboFix.exe
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\programme\HypreCam Toolbar\tbHElper.dll
c:\windows\system32\5583FF0D7A.dll
Y:\start.bat
.
((((((((((((((((((((((( Dateien erstellt von 2010-09-21 bis 2010-10-21 ))))))))))))))))))))))))))))))
.
2010-10-20 14:42 . 2010-10-20 14:42 -------- d-----w- c:\dokumente und einstellungen\[username]\Anwendungsdaten\Malwarebytes
2010-10-20 14:40 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-10-20 14:40 . 2010-10-20 14:40 -------- d-----w- c:\programme\Malwarebytes' Anti-Malware
2010-10-20 14:40 . 2010-10-20 14:40 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes
2010-10-20 14:40 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-10-17 22:10 . 2008-08-25 14:17 528384 ----a-w- c:\windows\RtlExUpd.dll
2010-10-17 08:59 . 2010-10-17 08:59 -------- d-----w- c:\windows\system32\wbem\Repository
2010-10-14 04:55 . 2010-09-18 06:52 974848 -c----w- c:\windows\system32\dllcache\mfc42.dll
2010-10-14 04:55 . 2010-09-18 06:52 953856 -c----w- c:\windows\system32\dllcache\mfc40u.dll
2010-10-14 04:55 . 2010-08-23 16:11 617472 -c----w- c:\windows\system32\dllcache\comctl32.dll
2010-10-13 20:25 . 2010-10-15 19:24 -------- d-----w- c:\programme\jDownloader
2010-10-07 18:29 . 2010-02-25 15:51 25216 ----a-w- c:\windows\system32\drivers\tap0901.sys
2010-10-06 04:57 . 2009-08-06 17:23 274288 ----a-w- c:\windows\system32\mucltui.dll
2010-10-06 04:57 . 2009-08-06 17:23 215920 ----a-w- c:\windows\system32\muweb.dll
2010-10-05 18:55 . 2010-10-06 04:56 -------- d-----w- c:\dokumente und einstellungen\[username]\Tracing
2010-10-05 18:54 . 2010-10-05 18:54 -------- d-----w- c:\programme\Microsoft
2010-10-05 18:54 . 2010-10-05 18:54 -------- d-----w- c:\programme\Windows Live SkyDrive
2010-10-05 18:54 . 2010-10-05 18:54 -------- d-----w- c:\programme\Windows Live
2010-10-05 18:52 . 2010-10-05 18:52 -------- d-----w- c:\programme\Gemeinsame Dateien\Windows Live
2010-09-29 21:45 . 2010-09-29 21:45 -------- d-----w- c:\dokumente und einstellungen\[username]\Anwendungsdaten\DJJava
2010-09-29 21:45 . 2010-09-29 21:45 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Protexis
2010-09-22 16:10 . 2010-09-22 16:10 103864 ----a-w- c:\programme\Mozilla Firefox\plugins\nppdf32.dll
2010-09-22 16:10 . 2010-09-22 16:10 103864 ----a-w- c:\programme\Internet Explorer\PLUGINS\nppdf32.dll
2010-09-21 17:42 . 2010-09-21 17:42 -------- d-----w- c:\dokumente und einstellungen\[username]\Bluetooth Software
2010-09-21 17:40 . 2008-06-11 12:14 89896 ----a-w- c:\windows\system32\drivers\btwsecfl.sys
2010-09-21 17:40 . 2008-08-19 20:16 991656 ----a-w- c:\windows\system32\drivers\btkrnl.sys
2010-09-21 17:40 . 2008-07-24 15:37 156816 ----a-w- c:\windows\system32\drivers\btwdndis.sys
2010-09-21 17:40 . 2008-05-30 09:46 534568 ----a-w- c:\windows\system32\drivers\btaudio.sys
2010-09-21 17:40 . 2008-03-10 16:18 57384 ----a-w- c:\windows\system32\drivers\btwhid.sys
2010-09-21 17:40 . 2008-02-04 15:57 37160 ----a-w- c:\windows\system32\drivers\btport.sys
2010-09-21 17:40 . 2010-09-21 17:40 -------- d-----w- c:\programme\WIDCOMM
2010-09-21 17:11 . 2010-09-21 17:11 -------- d-----w- c:\programme\Wireless Console 2
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2006-05-03 10:06 163328 --sh--r- c:\windows\system32\flvDX.dll
2007-02-21 11:47 31232 --sh--r- c:\windows\system32\msfDX.dll
2008-03-16 13:30 216064 --sh--r- c:\windows\system32\nbDX.dll
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Thunderbird"="c:\programme\Mozilla Thunderbird\thunderbird -turbo" [X]
"TrueCrypt"="d:\truecrypt\TrueCrypt.exe" [2009-11-17 1412552]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATKOSD2"="d:\asus\ATKOSD2\ATKOSD2.exe" [2008-09-02 8105984]
"MsgTranAgt"="d:\asus\ATK Hotkey\MsgTranAgt.exe" [2008-08-18 117304]
"HControlUser"="d:\asus\ATK Hotkey\HControlUser.exe" [2008-08-18 98304]
"ATKHOTKEY"="d:\asus\ATK Hotkey\HControl.exe" [2008-08-29 223800]
"SynTPEnh"="c:\programme\Synaptics\SynTP\SynTPEnh.exe" [2008-08-13 1343488]
"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2010-10-05 2067808]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-10-10 69632]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-08-19 13762560]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-08-19 86016]
"TkBellExe"="c:\programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" [2010-09-09 202256]
"RTHDCPL"="RTHDCPL.EXE" [2008-12-23 18077696]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\dokumente und einstellungen\[username]\Startmen�\Programme\Autostart\
LCD1.lnk - c:\programme\LCDHype\lcdhype.exe [2009-11-19 1671168]
LCD2.lnk - c:\programme\Lavalys\EVEREST Ultimate Edition\everest.exe [2009-11-20 2430048]
LCD3.lnk - c:\programme\Fraps\fraps.exe [2009-11-8 2377648]
SetPointII.lnk - c:\programme\Logitech\SetPoint II\SetPointII.exe [2008-11-13 323584]
c:\dokumente und einstellungen\All Users\Startmen�\Programme\Autostart\
BTTray.lnk - c:\programme\WIDCOMM\Bluetooth Software\BTTray.exe [2008-9-2 604776]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-07-17 07:10 12536 ----a-w- c:\windows\system32\avgrsstx.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programme\\AVG\\AVG9\\avgemc.exe"=
"c:\\Programme\\AVG\\AVG9\\avgupd.exe"=
"c:\\Programme\\AVG\\AVG9\\avgnsx.exe"=
"d:\\mIRC\\mirc.exe"=
"c:\\Programme\\Opera\\opera.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programme\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"e:\\Edge of Chaos - Indepedence War 2\\bin\\release\\loader.exe"=
"e:\\BF2142\\BF2142.exe"=
"c:\\Programme\\uTorrent\\uTorrent.exe"=
"e:\\CoD4\\iw3mp.exe"=
"d:\\RobotC\\ROBOTC for MINDSTORMS\\RobotC.exe"=
"c:\\Programme\\Robotics Academy\\ROBOTC for Mindstorms\\RobotC.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"e:\\CoD5\\CoDWaWmp.exe"=
"e:\\CoD5\\CoDWaW.exe"=
"e:\\Enemy Territory - QUAKE Wars\\etqw.exe"=
"e:\\Enemy Territory - QUAKE Wars\\etqwded.exe"=
"d:\\Steam\\Steam.exe"=
"d:\\Steam\\steamapps\\arrow_73\\team fortress classic\\hl.exe"=
"e:\\BF2\\BF2.exe"=
"e:\\BFBC2Demo\\BFBC2BetaUpdater.exe"=
"c:\\Programme\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Programme\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Programme\\Skype\\Phone\\Skype.exe"=
R0 hotcore3;hotcore3;c:\windows\system32\drivers\hotcore3.sys [25.01.2010 18:58 39472]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [17.11.2009 19:11 216400]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [17.11.2009 19:11 243024]
R2 AdobeActiveFileMonitor7.0;Adobe Active File Monitor V7;d:\pe7\PhotoshopElementsFileAgent.exe [16.09.2008 12:03 169312]
R2 avg9emc;AVG Free E-mail Scanner;c:\programme\AVG\AVG9\avgemc.exe [17.07.2010 09:09 921952]
R2 avg9wd;AVG Free WatchDog;c:\programme\AVG\AVG9\avgwdsvc.exe [17.07.2010 09:10 308136]
R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [19.11.2009 21:21 10384]
R2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [20.10.2009 20:19 50704]
R2 WTGService;WTGService;d:\3datamanager\WTGService.exe [04.12.2009 19:11 259528]
R3 EverestDriver;Lavalys EVEREST Kernel Driver;c:\programme\Lavalys\EVEREST Ultimate Edition\kerneld.wnt [20.11.2009 15:46 27248]
R3 ITECIR;ITE EC CIR Driver (RTC);c:\windows\system32\drivers\ITECIR.sys [06.04.2009 02:51 9728]
R3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\drivers\ManyCam.sys [14.01.2008 12:06 21632]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32.sys [06.04.2009 02:52 56480]
S2 gupdate;Google Update Service (gupdate);c:\programme\Google\Update\GoogleUpdate.exe [06.03.2010 09:16 135664]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [18.10.2010 00:11 1684736]
S3 FANTOM;LEGO MINDSTORMS NXT Driver;c:\windows\system32\drivers\fantom.sys [29.07.2008 15:09 39424]
S3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [19.11.2009 21:17 7680]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [19.11.2009 21:21 691696]
--- Andere Dienste/Treiber im Speicher ---
*NewlyCreated* - EVERESTDRIVER
.
Inhalt des "geplante Tasks" Ordners
2010-10-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programme\Google\Update\GoogleUpdate.exe [2010-03-06 07:16]
2010-10-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programme\Google\Update\GoogleUpdate.exe [2010-03-06 07:16]
2010-10-21 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-448539723-2049760794-839522115-1003.job
- c:\programme\Real\RealUpgrade\realupgrade.exe [2010-06-03 01:02]
2010-10-20 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-448539723-2049760794-839522115-1003.job
- c:\programme\Real\RealUpgrade\realupgrade.exe [2010-06-03 01:02]
.
.
------- Zusätzlicher Suchlauf -------
.
IE: Nach Microsoft &Excel exportieren - d:\office\OFFICE11\EXCEL.EXE/3000
IE: Senden an &Bluetooth-Gerät... - c:\programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Senden an Bluetooth - c:\programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm
TCP: {78E8BD2F-8163-4868-94E0-B6F6BDC30CE5} = 208.67.222.222,208.67.222.220
FF - ProfilePath - c:\dokumente und einstellungen\[username]\Anwendungsdaten\Mozilla\Firefox\Profiles\abn2ko25.default\
FF - prefs.js: browser.search.selectedEngine - ICQ Search
FF - prefs.js: browser.startup.homepage - hxxp://start.icq.com/
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=2.0.0.4&q=
FF - plugin: c:\dokumente und einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
FF - plugin: c:\programme\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\programme\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\programme\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\programme\Opera\program\plugins\nppl3260.dll
FF - plugin: c:\programme\Opera\program\plugins\nprjplug.dll
FF - plugin: c:\programme\Opera\program\plugins\nprpjplug.dll
FF - plugin: d:\adobe reader 9.0\Reader\browser\nppdf32.dll
FF - plugin: d:\realplayer\Netscape6\nppl3260.dll
FF - plugin: d:\realplayer\Netscape6\nprjplug.dll
FF - plugin: d:\realplayer\Netscape6\nprpjplug.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\EverestDriver]
"ImagePath"="\??\c:\programme\Lavalys\EVEREST Ultimate Edition\kerneld.wnt"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
[HKEY_USERS\S-1-5-21-448539723-2049760794-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{1BCE6354-45B7-1D11-BB2F-24D3E2FCFF7E}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"ialdkfhkecddlmphmi"=hex:6b,61,68,69,6e,63,67,6f,62,68,62,65,6c,6b,61,64,63,66,
68,6f,68,6b,00,00
"habdebidhdhbmaid"=hex:6b,61,68,69,6e,63,67,6f,62,68,62,65,6c,6b,61,64,63,66,
68,6f,68,6b,00,00
"gakcndolpgnfpf"=hex:61,63,68,66,6d,6d,6a,6b,62,63,68,6c,68,67,6f,6f,62,6f,68,
68,67,6c,6c,61,6f,6a,6e,64,67,6d,62,70,67,62,68,62,62,61,61,6e,62,64,66,62,\
[HKEY_USERS\S-1-5-21-448539723-2049760794-839522115-1003\Software\mIRC\LastRun]
@Denied: (Full) (Administrators)
@Denied: (Full) (LocalSystem)
@="1258660043,175"
[HKEY_USERS\S-1-5-21-448539723-2049760794-839522115-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:b6,ad,97,1f,e9,6d,27,9e,5a,0d,c7,6a,45,fa,90,09,45,8b,6f,8d,2e,7f,f6,
da,23,15,cf,ea,b4,f1,c0,be,9f,aa,dd,48,32,6f,d8,68,84,60,65,53,f6,be,d0,34,\
"??"=hex:34,35,13,8c,d4,12,8b,33,f2,be,b0,88,e7,45,2f,15
[HKEY_USERS\S-1-5-21-448539723-2049760794-839522115-1003\Software\SecuROM\License information*]
"datasecu"=hex:aa,01,a2,f1,d0,93,57,d0,5c,ca,3d,aa,51,57,c0,93,90,0e,99,db,06,
3a,07,45,37,ad,a7,54,2a,05,f9,e2,54,01,c8,b0,85,27,4d,4a,34,4a,09,ce,ab,8d,\
"rkeysecu"=hex:d8,69,a7,8b,b9,91,11,e5,20,36,d2,d3,03,c8,a8,eb
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\€–€|ÿÿÿÿÀ•€|ù•6~*]
"7040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
Zeit der Fertigstellung: 2010-10-21 15:07:31
ComboFix-quarantined-files.txt 2010-10-21 13:07
Vor Suchlauf: 6.551.900.160 Bytes frei
Nach Suchlauf: 7.966.232.576 Bytes frei
WindowsXP-KB310994-SP2-Home-BootDisk-DEU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
- - End Of File - - E6650999D693C7F1184C3837C7A129D5
PS: Hab mich hier schon mal registriert gehabt und das erst jetzt bemerkt xD Sry mfg |
|
28.10.2010, 13:28
| #4 |
| /// Malware-holic | Thunderbird Emailkonten ausgehebelt - Trojaner? mein computer war kaputt, sorry. http://www.trojaner-board.de/74908-a...t-scanner.html poste das GMER log |
|
28.10.2010, 17:26
| #5 |
| | Thunderbird Emailkonten ausgehebelt - Trojaner? Kein Problem xD Hier bitte GMER Logfile: Code:
ATTFilter GMER 1.0.15.15477 - hxxp://www.gmer.net
Rootkit scan 2010-10-28 18:24:31
Windows 5.1.2600 Service Pack 3
Running: 9ij2ibgz.exe; Driver: C:\DOKUME~1\[....]\LOKALE~1\Temp\pgtdqpod.sys
---- Kernel code sections - GMER 1.0.15 ----
.text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xB755F380, 0x3CDF45, 0xE8000020]
---- Devices - GMER 1.0.15 ----
AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
Device \Driver\prodrv06 \Device\ProDrv06 E1D97708
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume1 hotcore3.sys (Hotbackup helper driver/Paragon Software Group)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume2 hotcore3.sys (Hotbackup helper driver/Paragon Software Group)
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\atapi \Device\Ide\IdePort0 prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\atapi \Device\Ide\IdePort1 prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\atapi \Device\Ide\IdePort2 prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\atapi \Device\Ide\IdePort3 prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\atapi \Device\Ide\IdeDeviceP2T0L0-19 prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-e prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume3 hotcore3.sys (Hotbackup helper driver/Paragon Software Group)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume4 hotcore3.sys (Hotbackup helper driver/Paragon Software Group)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume5 hotcore3.sys (Hotbackup helper driver/Paragon Software Group)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume6 hotcore3.sys (Hotbackup helper driver/Paragon Software Group)
Device \Driver\prohlp02 \Device\ProHlp02 E100F700
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume7 hotcore3.sys (Hotbackup helper driver/Paragon Software Group)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume8 hotcore3.sys (Hotbackup helper driver/Paragon Software Group)
AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
---- Registry - GMER 1.0.15 ----
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0x49 0x92 0xA6 0x41 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@p0 C:\Programme\Alcohol 120\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xA4 0x7D 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x07 0xBC 0x43 0x7B ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Programme\DAEMON Tools Pro\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x9B 0xF2 0xF2 0x43 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xFC 0xF5 0xD0 0x33 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x38 0x0F 0x98 0x02 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Programme\DAEMON Tools Pro\
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x6F 0x83 0xFB 0x99 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0xD8 0x5E 0x7E 0x16 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x11 0x06 0x94 0x14 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 1
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0x49 0x92 0xA6 0x41 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@p0 C:\Programme\Alcohol 120\
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xA4 0x7D 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x07 0xBC 0x43 0x7B ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Programme\DAEMON Tools Pro\
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x9B 0xF2 0xF2 0x43 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xFC 0xF5 0xD0 0x33 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@cd042efbbd7f7af1647644e76e06692b 0xC8 0x28 0x51 0xAF ...
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@bca643cdc5c2726b20d2ecedcc62c59b 0x6A 0x9C 0xD6 0x61 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@2c81e34222e8052573023a60d06dd016 0xFF 0x7C 0x85 0xE0 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@2582ae41fb52324423be06337561aa48 0x86 0x8C 0x21 0x01 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@caaeda5fd7a9ed7697d9686d4b818472 0xCD 0x44 0xCD 0xB9 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@a4a1bcf2cc2b8bc3716b74b2b4522f5d 0xB0 0x18 0xED 0xA7 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@4d370831d2c43cd13623e232fed27b7b 0x31 0x77 0xE1 0xBA ...
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@1d68fe701cdea33e477eb204b76f993d 0x01 0x3A 0x48 0xFC ...
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@1fac81b91d8e3c5aa4b0a51804d844a3 0x51 0xFA 0x6E 0x91 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@f5f62a6129303efb32fbe080bb27835b 0x3D 0xCE 0xEA 0x26 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@fd4e2e1a3940b94dceb5a6a021f2e3c6 0xF8 0x31 0x0F 0xA9 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@8a8aec57dd6508a385616fbc86791ec2 0xFA 0xEA 0x66 0x7F ...
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{1BCE6354-45B7-1D11-BB2F-24D3E2FCFF7E}
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{1BCE6354-45B7-1D11-BB2F-24D3E2FCFF7E}@ialdkfhkecddlmphmi 0x6B 0x61 0x68 0x69 ...
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{1BCE6354-45B7-1D11-BB2F-24D3E2FCFF7E}@habdebidhdhbmaid 0x6B 0x61 0x68 0x69 ...
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{1BCE6354-45B7-1D11-BB2F-24D3E2FCFF7E}@gakcndolpgnfpf 0x61 0x63 0x68 0x66 ...
---- EOF - GMER 1.0.15 ----
|
|
28.10.2010, 17:41
| #6 |
| /// Malware-holic | Thunderbird Emailkonten ausgehebelt - Trojaner? läuft denn das mit den e-mails jetzt wieder? |
|
28.10.2010, 17:59
| #7 | |
| | Thunderbird Emailkonten ausgehebelt - Trojaner? Nja ich hab mein PW nicht mehr im "Passwort-Manager" eingegeben, sondern nur per Hand. Zitat:
|
|
28.10.2010, 18:01
| #8 |
| /// Malware-holic | Thunderbird Emailkonten ausgehebelt - Trojaner? ich sehe kein log von malwarebytes |
|
| Themen zu Thunderbird Emailkonten ausgehebelt - Trojaner? |
| adobe, avg, avg free, bho, desktop, e-mail, einstellungen, excel, explorer, ftp, google, helper, hkus\s-1-5-18, internet, internet explorer, logfile, monitor, mozilla, mozilla thunderbird, nvidia, plug-in, rundll, senden, software, system, trojaner, trojaner?, windows, windows xp |
Linear-Darstellung
