Rechner mit XP-Antivirus 2011 infiziert

Santelmo

Hallo Arne,

die Programme habe ich laufen lassen und die log files erstellt siehe weiter unten. Dann wollte ich den Dienst Automatisches Update prüfen, allerdings ist dieser Dienst gar nicht mehr auf dem Rechner vorhanden. Bin die Liste der Dienste zweimal durchgegangen und ist definitiv nicht mit dabei.

Super Antispyware Log:
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 04/07/2011 at 06:07 PM

Application Version : 4.50.1002

Core Rules Database Version : 6771
Trace Rules Database Version: 4583

Scan type : Complete Scan
Total Scan Time : 03:28:46

Memory items scanned : 487
Memory threats detected : 0
Registry items scanned : 5783
Registry threats detected : 0
File items scanned : 185221
File threats detected : 9

Adware.Tracking Cookie
C:\Documents and Settings\Administrator.DDT\Cookies\administrator@doubleclick[1].txt
cdn4.specificclick.net [ C:\Documents and Settings\NicoleJ\Application Data\Macromedia\Flash Player\#SharedObjects\HMGH7FWE ]
ia.media-imdb.com [ C:\Documents and Settings\NicoleJ\Application Data\Macromedia\Flash Player\#SharedObjects\HMGH7FWE ]
media.adslzone.net [ C:\Documents and Settings\NicoleJ\Application Data\Macromedia\Flash Player\#SharedObjects\HMGH7FWE ]
media.scanscout.com [ C:\Documents and Settings\NicoleJ\Application Data\Macromedia\Flash Player\#SharedObjects\HMGH7FWE ]
objects.tremormedia.com [ C:\Documents and Settings\NicoleJ\Application Data\Macromedia\Flash Player\#SharedObjects\HMGH7FWE ]
secure-us.imrworldwide.com [ C:\Documents and Settings\NicoleJ\Application Data\Macromedia\Flash Player\#SharedObjects\HMGH7FWE ]
stat.easydate.biz [ C:\Documents and Settings\NicoleJ\Application Data\Macromedia\Flash Player\#SharedObjects\HMGH7FWE ]
www.kindercountry.de [ C:\Documents and Settings\NicoleJ\Application Data\Macromedia\Flash Player\#SharedObjects\HMGH7FWE ]

Antimlaware Log:

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 6308

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

4/8/2011 10:04:05 AM
mbam-log-2011-04-08 (10-03-57).txt

Scan type: Quick scan
Objects scanned: 278034
Time elapsed: 1 hour(s), 29 minute(s), 54 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Documents and Settings\NicoleJ\Local Settings\Application Data\bmj.exe" -a "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode) Good: (firefox.exe -safe-mode) -> No action taken.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Schönen Gruss