|
Log-Analyse und Auswertung: Backdoor:Win32/Cbot.B - Trojan:Win32/FakeSysdefWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
02.05.2011, 15:40 | #16 |
| Backdoor:Win32/Cbot.B - Trojan:Win32/FakeSysdef unhide abgeschlossen und Daten sind wieder sichtbar. soweit schonmal vielen, vielen Dank. gehts noch weiter? |
02.05.2011, 15:50 | #17 |
/// Winkelfunktion /// TB-Süch-Tiger™ | Backdoor:Win32/Cbot.B - Trojan:Win32/FakeSysdef Dann bitte jetzt CF ausführen:
__________________ComboFix Ein Leitfaden und Tutorium zur Nutzung von ComboFix
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
__________________ |
02.05.2011, 16:38 | #18 |
| Backdoor:Win32/Cbot.B - Trojan:Win32/FakeSysdef so ein Mist : habe alles augeführt und nach dem neustart ist mein Laptop( vielleicht zu heiß geworden?) ausgegangen, und zwar beim erstellen der text datei :
__________________ComboFix 11-05-01.04 - Basti 02.05.2011 17:09:45.1.2 - x86 Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.49.1031.18.3069.1750 [GMT 2:00] ausgeführt von:: C:\Users\Basti\Desktop\cofi.exe AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160} SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} soll ich die schritte nochmal durchgehen bzw combofix nochmal starten? Geändert von Basti7 (02.05.2011 um 17:07 Uhr) |
02.05.2011, 17:45 | #19 |
| Backdoor:Win32/Cbot.B - Trojan:Win32/FakeSysdef Combofix Logfile: Code:
ATTFilter ComboFix 11-05-01.04 - Basti 02.05.2011 18:25:46.3.2 - x86 Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.49.1031.18.3069.1887 [GMT 2:00] ausgeführt von:: c:\users\Basti\Desktop\cofi.exe AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160} SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((( Dateien erstellt von 2011-04-02 bis 2011-05-02 )))))))))))))))))))))))))))))) . . 2011-05-02 16:34 . 2011-05-02 16:34 -------- d-----w- c:\users\Basti\AppData\Local\temp 2011-05-02 16:34 . 2011-05-02 16:34 -------- d-----w- c:\users\Default\AppData\Local\temp 2011-05-02 15:41 . 2011-04-18 07:15 7071056 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{2B6ED82E-EE30-4BC3-83D2-3C9B06D0476D}\mpengine.dll 2011-05-02 12:51 . 2011-05-02 12:51 -------- d-----w- C:\_OTL 2011-04-29 20:56 . 2011-04-29 20:56 -------- d-----w- c:\users\Basti\AppData\Roaming\Malwarebytes 2011-04-29 20:55 . 2010-12-20 16:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2011-04-29 20:55 . 2011-04-29 20:55 -------- d-----w- c:\programdata\Malwarebytes 2011-04-29 20:55 . 2010-12-20 16:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys 2011-04-29 20:55 . 2011-04-29 20:55 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2011-04-29 01:01 . 2011-04-29 01:01 -------- d-----w- C:\864b01153e3fdf37d2b00c296bc673 2011-04-28 14:44 . 2011-03-03 14:56 28672 ----a-w- c:\windows\system32\Apphlpdm.dll 2011-04-28 14:44 . 2011-03-03 13:01 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll 2011-04-27 23:03 . 2011-04-27 23:03 -------- d-----w- c:\program files\CCleaner 2011-04-27 16:58 . 2011-04-27 16:58 -------- d-----w- c:\program files\Autorun Angel 2011-04-24 22:47 . 2011-04-24 22:47 -------- d-----w- c:\users\Basti\AppData\Local\Hewlett-Packard 2011-04-24 22:39 . 2011-04-18 07:15 7071056 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll 2011-04-23 11:43 . 2011-04-23 11:43 -------- d-----w- c:\users\Default\AppData\Roaming\Apple Computer 2011-04-23 11:43 . 2011-04-23 11:43 -------- d-----w- c:\users\Default\AppData\Local\Apple Computer 2011-04-23 09:33 . 2011-04-23 09:33 -------- d-----w- c:\users\Default\AppData\Local\Microsoft Help 2011-04-23 03:50 . 2010-11-30 09:43 439632 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{833E3C26-5181-43A0-B116-3A6D25999A37}\gapaengine.dll 2011-04-23 02:51 . 2011-04-23 02:53 -------- d-----w- c:\program files\Microsoft Security Client 2011-04-22 17:11 . 2011-05-01 15:16 -------- d-----w- c:\programdata\Kaspersky Lab Setup Files 2011-04-22 12:42 . 2011-04-11 07:04 7071056 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{DD666115-A1E9-4B59-BE2B-A1A96B8996FD}\mpengine.dll 2011-04-14 17:59 . 2011-02-16 15:29 34304 ----a-w- c:\windows\system32\atmlib.dll 2011-04-14 17:59 . 2011-02-16 13:24 292864 ----a-w- c:\windows\system32\atmfd.dll 2011-04-14 17:59 . 2011-02-22 12:52 213504 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys 2011-04-14 17:59 . 2011-02-22 12:52 79360 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys 2011-04-14 17:59 . 2011-02-22 12:51 105984 ----a-w- c:\windows\system32\drivers\mrxsmb.sys 2011-04-14 17:59 . 2011-02-22 12:51 69632 ----a-w- c:\windows\system32\drivers\bowser.sys 2011-04-14 17:59 . 2011-03-10 16:12 1161728 ----a-w- c:\windows\system32\mfc42u.dll 2011-04-14 17:59 . 2011-03-10 16:12 1136640 ----a-w- c:\windows\system32\mfc42.dll 2011-04-14 17:59 . 2011-02-18 13:31 304640 ----a-w- c:\windows\system32\drivers\srv.sys 2011-04-14 17:59 . 2011-02-18 13:31 146432 ----a-w- c:\windows\system32\drivers\srv2.sys 2011-04-14 17:59 . 2011-02-18 13:31 102400 ----a-w- c:\windows\system32\drivers\srvnet.sys 2011-04-14 17:57 . 2011-03-03 10:49 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat 2011-04-12 13:02 . 2011-04-12 13:02 -------- d-----w- c:\windows\system32\EventProviders 2011-04-07 23:50 . 2010-01-01 08:00 135168 ----a-w- c:\program files\Mozilla Firefox\components\browsercomps.dll 2011-04-07 23:50 . 2011-03-08 23:36 49152 ----a-w- c:\program files\Mozilla Firefox\distribution\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\components\XPATLCOM.dll 2011-04-07 23:50 . 2010-01-01 08:00 8704 ----a-w- c:\program files\Mozilla Firefox\mozalloc.dll 2011-04-07 23:50 . 2010-01-01 08:00 774144 ----a-w- c:\program files\Mozilla Firefox\mozsqlite3.dll 2011-04-07 23:50 . 2010-01-01 08:00 720896 ----a-w- c:\program files\Mozilla Firefox\libGLESv2.dll 2011-04-07 23:50 . 2010-01-01 08:00 1974616 ----a-w- c:\program files\Mozilla Firefox\D3DCompiler_42.dll 2011-04-07 23:50 . 2010-01-01 08:00 1892184 ----a-w- c:\program files\Mozilla Firefox\d3dx9_42.dll 2011-04-07 23:50 . 2010-01-01 08:00 1867776 ----a-w- c:\program files\Mozilla Firefox\mozjs.dll 2011-04-07 23:50 . 2010-01-01 08:00 135168 ----a-w- c:\program files\Mozilla Firefox\libEGL.dll . . . (((((((((((((((((((((((((((((((((((( Find3M Bericht )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-03-03 14:56 . 2011-04-28 14:44 173056 ----a-w- c:\windows\apppatch\AcXtrnal.dll 2011-03-03 14:56 . 2011-04-28 14:44 459776 ----a-w- c:\windows\apppatch\AcSpecfc.dll 2011-03-03 14:56 . 2011-04-28 14:44 2153984 ----a-w- c:\windows\apppatch\AcGenral.dll 2011-03-03 14:56 . 2011-04-28 14:44 541696 ----a-w- c:\windows\apppatch\AcLayers.dll 2011-02-02 20:40 . 2010-05-06 01:00 472808 ----a-w- c:\windows\system32\deployJava1.dll 2010-01-01 08:00 . 2011-04-07 23:50 135168 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll . . (((((((((((((((((((((((((((( Autostartpunkte der Registrierung )))))))))))))))))))))))))))))))))))))))) . . *Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920] "LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-02-26 2289664] "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-01-18 1033512] "UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2007-12-24 222504] "QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2008-03-14 202032] "OnScreenDisplay"="c:\program files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe" [2007-11-01 554288] "HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-04-15 70912] "HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840] "hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-11-20 488752] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-18 421888] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-06-15 141624] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064] "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2010-11-30 997408] "Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-12-20 963976] . c:\users\Basti\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-5-20 1195008] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ BTTray.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-1-16 727592] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] @="Service" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ] 2011-01-05 08:18 133432 ----a-w- c:\program files\ICQ7.1\ICQ.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr] 2007-01-19 10:55 5674352 ----a-w- c:\program files\MSN Messenger\msnmsgr.exe . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 . R1 MpKsl2aa47320;MpKsl2aa47320;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{CA4F610B-8554-4819-9F87-A07676D91B2E}\MpKsl2aa47320.sys [x] R1 MpKsl2bc25f13;MpKsl2bc25f13;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4C690F24-9248-496F-8A71-9857976DD880}\MpKsl2bc25f13.sys [x] R1 MpKsl605b82a4;MpKsl605b82a4;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4C690F24-9248-496F-8A71-9857976DD880}\MpKsl605b82a4.sys [x] R1 MpKsl91d2fe12;MpKsl91d2fe12;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{D6D0CB9E-5D18-428D-BFBB-395754A19FC4}\MpKsl91d2fe12.sys [x] R1 MpKslbbca455d;MpKslbbca455d;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{EACB07E9-977D-4BC1-8F99-AB480491753A}\MpKslbbca455d.sys [x] R1 MpKslf3bdd319;MpKslf3bdd319;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{EACB07E9-977D-4BC1-8F99-AB480491753A}\MpKslf3bdd319.sys [x] R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-07-20 136176] R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-07-20 136176] R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2010-10-24 43392] R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2010-10-24 54144] R3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2010-11-11 206360] R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504] S1 M9207;LifeView M9207 USB Digital TV BOX;c:\windows\system32\DRIVERS\M9207BDA.sys [2005-09-23 36096] S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt.inf_9a642328\aestsrv.exe [2008-02-12 73728] S2 ezSharedSvc;Easybits Shared Services for Windows;c:\windows\system32\svchost.exe [2008-01-21 21504] S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [2008-03-18 19456] S2 Recovery Service for Windows;Recovery Service for Windows;c:\windows\SMINST\BLService.exe [2008-03-26 341328] S3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2008-04-03 193840] S3 enecir;ENE CIR Receiver;c:\windows\system32\DRIVERS\enecir.sys [2008-01-24 52736] S3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys [2008-04-11 84240] S3 jumi;%Jumi%;c:\windows\system32\DRIVERS\jumi.sys [2010-06-03 13112] . . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] bthsvcs REG_MULTI_SZ BthServ . HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs ezSharedSvc . [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] 2008-02-26 12:06 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe . Inhalt des "geplante Tasks" Ordners . 2011-05-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-07-20 10:07] . 2011-05-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-07-20 10:07] . 2011-05-02 c:\windows\Tasks\User_Feed_Synchronization-{4AD6CB10-A3E1-46A1-808C-09598B52C3FE}.job - c:\windows\system32\msfeedssync.exe [2008-01-21 02:24] . . ------- Zusätzlicher Suchlauf ------- . uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=83&bd=Pavilion&pf=cnnb mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=83&bd=Pavilion&pf=cnnb IE: &AOL Toolbar-Suche - c:\programdata\AOL\ieToolbar\resources\de-DE\local\search.html IE: Bild an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm IE: Free YouTube Download - c:\users\Basti\AppData\Roaming\DVDVideoSoftIEHelpers\youtubedownload.htm IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000 IE: Seite an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm IE: {{71BFC818-0CED-42D6-9C87-5142918957EE} - c:\program files\ICQ7.1\ICQ.exe FF - ProfilePath - c:\users\Basti\AppData\Roaming\Mozilla\Firefox\Profiles\la5trnmw.default\ FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxp://de.yahoo.com/ . - - - - Entfernte verwaiste Registrierungseinträge - - - - . URLSearchHooks-{EEE6C35D-6118-11DC-9C72-001320C79847} - c:\program files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file) HKLM-Run-SysTrayApp - %ProgramFiles%\IDT\WDM\sttray.exe . . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover Rootkit scan 2011-05-02 18:34 Windows 6.0.6001 Service Pack 1 NTFS . Scanne versteckte Prozesse... . Scanne versteckte Autostarteinträge... . Scanne versteckte Dateien... . Scan erfolgreich abgeschlossen versteckte Dateien: 0 . ************************************************************************** . --------------------- Gesperrte Registrierungsschluessel --------------------- . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . --------------------- Durch laufende Prozesse gestartete DLLs --------------------- . - - - - - - - > 'Explorer.exe'(5064) c:\windows\system32\btmmhook.dll . Zeit der Fertigstellung: 2011-05-02 18:37:16 ComboFix-quarantined-files.txt 2011-05-02 16:37 . Vor Suchlauf: 1.535.115.264 Bytes frei Nach Suchlauf: 1.430.265.856 Bytes frei . - - End Of File - - 7386F274D42B0F53E6EF4EDBEC7533A1 |
02.05.2011, 19:32 | #20 |
/// Winkelfunktion /// TB-Süch-Tiger™ | Backdoor:Win32/Cbot.B - Trojan:Win32/FakeSysdef Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten. GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen. Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst. Downloade Dir danach bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.
__________________ Logfiles bitte immer in CODE-Tags posten |
02.05.2011, 20:02 | #22 |
| Backdoor:Win32/Cbot.B - Trojan:Win32/FakeSysdef Ich kann die OSAM RAR Datei irgendwie nicht entpacken. So als wenn ich kein geeignetes Programm dafür hätte. wie entpacke ich das hxxp://www2.online-solutions.ru/en/download_file.php?p=131115 ? Entschuldige, hab grade so gar keinen Durchblick. Geändert von Basti7 (02.05.2011 um 20:43 Uhr) |
02.05.2011, 20:44 | #23 |
/// Winkelfunktion /// TB-Süch-Tiger™ | Backdoor:Win32/Cbot.B - Trojan:Win32/FakeSysdef WinRAR oder 7zip nutzen!
__________________ Logfiles bitte immer in CODE-Tags posten |
02.05.2011, 21:41 | #24 |
| Backdoor:Win32/Cbot.B - Trojan:Win32/FakeSysdef danke. OSAM Logfile: Code:
ATTFilter Report of OSAM: Autorun Manager v5.0.11926.0 Online Solutions. Complex Protection for Information Systems Saved at 22:39:29 on 02.05.2011 OS: Windows Vista Home Premium Edition Service Pack 1 (Build 6001), 32-bit Default Browser: Mozilla Corporation Firefox 4.0 Scanner Settings [x] Rootkits detection (hidden registry) [x] Rootkits detection (hidden files) [x] Retrieve files information [x] Check Microsoft signatures Filters [ ] Trusted entries [ ] Empty entries [x] Hidden registry entries (rootkit activity) [x] Exclusively opened files [x] Not found files [x] Files without detailed information [x] Existing files [ ] Non-startable services [ ] Non-startable drivers [x] Active entries [x] Disabled entries [Common] -----( %SystemRoot%\Tasks )----- "GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe "GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe [Control Panel Objects] -----( %SystemRoot%\system32 )----- "hpaccelerometercp.CPL" - "Hewlett-Packard Corporation" - C:\Windows\system32\hpaccelerometercp.CPL -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )----- "ProtectSmart Hard Drive Protection" - "Hewlett-Packard Corporation" - C:\Windows\system32\hpaccelerometercp.CPL "QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl [Drivers] -----( HKLM\SYSTEM\CurrentControlSet\Services )----- "catchme" (catchme) - ? - C:\Users\Basti\AppData\Local\Temp\catchme.sys (File not found) "IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys (File not found) "IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys (File not found) "IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys (File not found) "MpKsl2aa47320" (MpKsl2aa47320) - ? - c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{CA4F610B-8554-4819-9F87-A07676D91B2E}\MpKsl2aa47320.sys (File not found) "MpKsl2bc25f13" (MpKsl2bc25f13) - ? - c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{4C690F24-9248-496F-8A71-9857976DD880}\MpKsl2bc25f13.sys (File not found) "MpKsl605b82a4" (MpKsl605b82a4) - ? - c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{4C690F24-9248-496F-8A71-9857976DD880}\MpKsl605b82a4.sys (File not found) "MpKsl91d2fe12" (MpKsl91d2fe12) - ? - c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{D6D0CB9E-5D18-428D-BFBB-395754A19FC4}\MpKsl91d2fe12.sys (File not found) "MpKslbbca455d" (MpKslbbca455d) - ? - c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{EACB07E9-977D-4BC1-8F99-AB480491753A}\MpKslbbca455d.sys (File not found) "MpKslf3bdd319" (MpKslf3bdd319) - ? - c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{EACB07E9-977D-4BC1-8F99-AB480491753A}\MpKslf3bdd319.sys (File not found) [Explorer] -----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )----- {10880D85-AAD9-4558-ABDC-2AB1552D831F} "LightScribe Control Panel" - "Hewlett-Packard Company" - "C:\Program Files\Common Files\LightScribe\LSRunOnce.exe" -----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )----- {C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll -----( HKLM\Software\Classes\Protocols\Filter )----- {807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL -----( HKLM\Software\Classes\Protocols\Handler )----- {314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL {828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL {0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll {828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )----- {AEB6717E-7E19-11d0-97EE-00C04FD91972} "{AEB6717E-7E19-11d0-97EE-00C04FD91972}" - ? - (File not found | COM-object registry key not found) -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )----- {911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? - (File not found | COM-object registry key not found) {23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Program Files\7-Zip\7-zip.dll {1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? - (File not found | COM-object registry key not found) {34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? - (File not found | COM-object registry key not found) {0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? - (File not found | COM-object registry key not found) {09A47860-11B0-4DA5-AFA5-26D86198A780} "EPP" - "Microsoft Corporation" - c:\PROGRA~1\MICROS~4\shellext.dll {2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? - (File not found | COM-object registry key not found) {B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Program Files\iTunes\iTunesMiniPlayer.dll {00020d75-0000-0000-c000-000000000046} "lnkfile" - ? - (File not found | COM-object registry key not found) {FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D} "Meine freigegebenen Ordner" - "Microsoft Corporation" - C:\Program Files\MSN Messenger\fsshext.8.1.0178.00.dll {42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\msohevi.dll {993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll {5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\ONFILTER.DLL {C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll {7842554E-6BED-11D2-8CDB-B05550C10000} "Monitor Class" - "Broadcom Corporation." - C:\Windows\system32\btncopy.dll {C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll {087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll {63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll {3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll {C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? - (File not found | COM-object registry key not found) {E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? - (File not found | COM-object registry key not found) {45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - ? - (File not found | COM-object registry key not found) {7F67036B-66F1-411A-AD85-759FB9C5B0DB} "ShellViewRTF" - "XSS" - C:\Windows\System32\ShellvRTF.dll {5E2121EE-0300-11D4-8D3B-444553540000} "SimpleShlExt Class" - ? - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll {da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? - (File not found | COM-object registry key not found) [Internet Explorer] -----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )----- <binary data> "AOL Toolbar" - "AOL LLC" - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll <binary data> "ITBar7Layout" - ? - (File not found | COM-object registry key not found) -----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )----- {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} "Java Plug-in 1.6.0_05" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} "Java Plug-in 1.6.0_20" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab {8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_24" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} "Java Plug-in 1.6.0_24" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_24" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_24.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab -----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )----- "@btrez.dll,-4015" - ? - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm {48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll "ICQ7.1" - "ICQ, LLC." - C:\Program Files\ICQ7.1\ICQ.exe {FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL -----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )----- {DE9C389F-3316-41A7-809B-AA305ED9D922} "AOL Toolbar" - "AOL LLC" - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )----- {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} "AOL Toolbar BHO" - "AOL LLC" - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll {DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll [Logon] -----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )----- "desktop.ini" - ? - C:\Users\Basti\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini "OpenOffice.org 3.2.lnk" - ? - C:\Program Files\OpenOffice.org 3\program\quickstart.exe (Shortcut exists | File found, but it contains no detailed information | File exists) -----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )----- "desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini "BTTray.lnk" - "Broadcom Corporation." - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Shortcut exists | File exists) -----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )----- "LightScribe Control Panel" - "Hewlett-Packard Company" - C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden -----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )----- "StartupPrograms" - ? - rdpclip (File not found) -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )----- "HP Health Check Scheduler" - "Hewlett-Packard" - c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe "HP Software Update" - "Hewlett-Packard" - C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe "hpWirelessAssistant" - "Hewlett-Packard Development Company, L.P." - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe "iTunesHelper" - "Apple Inc." - "C:\Program Files\iTunes\iTunesHelper.exe" "Malwarebytes' Anti-Malware (reboot)" - "Malwarebytes Corporation" - "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript "MSC" - "Microsoft Corporation" - "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey "OnScreenDisplay" - " Hewlett-Packard Development Company, L.P." - C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe "QlbCtrl.exe" - " Hewlett-Packard Development Company, L.P." - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start "QuickTime Task" - "Apple Inc." - "C:\Program Files\QuickTime\QTTask.exe" -atboottime "StartCCC" - "Advanced Micro Devices, Inc." - "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" "SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Common Files\Java\Java Update\jusched.exe" "UCam_Menu" - "CyberLink Corp." - "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\2.0" [Print Monitors] -----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )----- "Send To Microsoft OneNote Monitor" - "Microsoft Corporation" - C:\Windows\system32\msonpmon.dll [Services] -----( HKLM\SYSTEM\CurrentControlSet\Services )----- "@c:\Program Files\Microsoft Security Client\Antimalware\MpAsDesc.dll,-243" (NisSrv) - "Microsoft Corporation" - c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe "@c:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe "Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe "Com4QLBEx" (Com4QLBEx) - "Hewlett-Packard Development Company, L.P." - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe "Cyberlink RichVideo Service(CRVS)" (RichVideo) - ? - C:\Program Files\CyberLink\Shared Files\RichVideo.exe "Dienst "Bonjour"" (Bonjour Service) - "Apple Inc." - C:\Program Files\Bonjour\mDNSResponder.exe "Easybits Shared Services for Windows" (ezSharedSvc) - "EasyBits Sofware AS" - C:\Windows\System32\ezsvc7.dll "GameConsoleService" (GameConsoleService) - "WildTangent, Inc." - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe "Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe "Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe "HP Health Check Service" (HP Health Check Service) - "Hewlett-Packard" - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe "hpqwmiex" (hpqwmiex) - "Hewlett-Packard Development Company, L.P." - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe "InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe "iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Program Files\iPod\bin\iPodService.exe "LightScribeService Direct Disc Labeling Service" (LightScribeService) - "Hewlett-Packard Company" - C:\Program Files\Common Files\LightScribe\LSSrvc.exe "Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe "Microsoft Antimalware Service" (MsMpSvc) - "Microsoft Corporation" - c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe "Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE "Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE "Recovery Service for Windows" (Recovery Service for Windows) - ? - C:\Windows\SMINST\BLService.exe [Winsock Providers] -----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )----- "mdnsNSP" - "Apple Inc." - C:\Program Files\Bonjour\mdnsNSP.dll ===[ Logfile end ]=========================================[ Logfile end ]=== If You have questions or want to get some help, You can visit Online Solutions :: Index |
02.05.2011, 21:45 | #25 |
| Backdoor:Win32/Cbot.B - Trojan:Win32/FakeSysdef MBRCheck, version 1.2.3 (c) 2010, AD Command-line: Windows Version: Windows Vista Home Premium Edition Windows Information: Service Pack 1 (build 6001), 32-bit Base Board Manufacturer: Hewlett-Packard BIOS Manufacturer: Hewlett-Packard System Manufacturer: Hewlett-Packard System Product Name: HP Pavilion dv7 Notebook PC Logical Drives Mask: 0x0000001c Kernel Drivers (total 202): 0x82013000 \SystemRoot\system32\ntkrnlpa.exe 0x823CC000 \SystemRoot\system32\hal.dll 0x8040C000 \SystemRoot\system32\kdcom.dll 0x80414000 \SystemRoot\system32\PSHED.dll 0x80425000 \SystemRoot\system32\BOOTVID.dll 0x8042D000 \SystemRoot\system32\CLFS.SYS 0x8046E000 \SystemRoot\system32\CI.dll 0x8054E000 \SystemRoot\system32\drivers\Wdf01000.sys 0x805CA000 \SystemRoot\system32\drivers\WDFLDR.SYS 0x80608000 \SystemRoot\system32\drivers\acpi.sys 0x8064E000 \SystemRoot\system32\drivers\WMILIB.SYS 0x80657000 \SystemRoot\system32\drivers\msisadrv.sys 0x8065F000 \SystemRoot\system32\drivers\pci.sys 0x80686000 \SystemRoot\system32\drivers\isapnp.sys 0x80695000 \SystemRoot\system32\drivers\mpio.sys 0x806B1000 \SystemRoot\System32\drivers\partmgr.sys 0x806C0000 \SystemRoot\system32\DRIVERS\compbatt.sys 0x806C3000 \SystemRoot\system32\DRIVERS\BATTC.SYS 0x806CD000 \SystemRoot\system32\drivers\volmgr.sys 0x806DC000 \SystemRoot\System32\drivers\volmgrx.sys 0x80726000 \SystemRoot\system32\drivers\intelide.sys 0x8072D000 \SystemRoot\system32\drivers\PCIIDEX.SYS 0x8073B000 \SystemRoot\system32\drivers\pciide.sys 0x80742000 \SystemRoot\system32\drivers\aliide.sys 0x80749000 \SystemRoot\system32\drivers\amdide.sys 0x80750000 \SystemRoot\system32\drivers\cmdide.sys 0x80758000 \SystemRoot\System32\drivers\mountmgr.sys 0x80768000 \SystemRoot\system32\drivers\msdsm.sys 0x80782000 \SystemRoot\system32\drivers\nvraid.sys 0x8079D000 \SystemRoot\system32\drivers\CLASSPNP.SYS 0x807BE000 \SystemRoot\system32\drivers\viaide.sys 0x82601000 \SystemRoot\system32\drivers\iastorv.sys 0x826A2000 \SystemRoot\system32\drivers\atapi.sys 0x826AA000 \SystemRoot\system32\drivers\ataport.SYS 0x826C8000 \SystemRoot\system32\drivers\lsi_scsi.sys 0x826E2000 \SystemRoot\system32\drivers\storport.sys 0x82723000 \SystemRoot\system32\drivers\nvstor.sys 0x82730000 \SystemRoot\system32\drivers\msahci.sys 0x8273A000 \SystemRoot\system32\drivers\hpcisss.sys 0x82745000 \SystemRoot\system32\drivers\adp94xx.sys 0x827AF000 \SystemRoot\system32\drivers\adpahci.sys 0x807C6000 \SystemRoot\system32\drivers\adpu160m.sys 0x805D7000 \SystemRoot\system32\drivers\SCSIPORT.SYS 0x8A807000 \SystemRoot\system32\drivers\adpu320.sys 0x8A82D000 \SystemRoot\system32\drivers\djsvs.sys 0x8A841000 \SystemRoot\system32\drivers\arc.sys 0x8A857000 \SystemRoot\system32\drivers\arcsas.sys 0x8A86D000 \SystemRoot\system32\drivers\elxstor.sys 0x8A901000 \SystemRoot\system32\drivers\i2omp.sys 0x8A90B000 \SystemRoot\system32\drivers\iirsp.sys 0x8A91B000 \SystemRoot\system32\drivers\iteatapi.sys 0x8A927000 \SystemRoot\system32\drivers\iteraid.sys 0x8A933000 \SystemRoot\system32\drivers\lsi_fc.sys 0x8A94D000 \SystemRoot\system32\drivers\lsi_sas.sys 0x8A965000 \SystemRoot\system32\drivers\megasas.sys 0x8AA09000 \SystemRoot\system32\drivers\megasr.sys 0x8AAC0000 \SystemRoot\system32\drivers\mraid35x.sys 0x8AACB000 \SystemRoot\system32\drivers\nfrd960.sys 0x8AC07000 \SystemRoot\system32\drivers\ql2300.sys 0x8AD3F000 \SystemRoot\system32\drivers\ql40xx.sys 0x8AD94000 \SystemRoot\system32\drivers\sisraid2.sys 0x8ADA1000 \SystemRoot\system32\drivers\sisraid4.sys 0x8ADB6000 \SystemRoot\system32\drivers\symc8xx.sys 0x8ADC2000 \SystemRoot\system32\drivers\sym_hi.sys 0x8ADCD000 \SystemRoot\system32\drivers\sym_u3.sys 0x8AAD9000 \SystemRoot\system32\drivers\uliahci.sys 0x8ADD8000 \SystemRoot\system32\drivers\ulsata.sys 0x8AB15000 \SystemRoot\system32\drivers\ulsata2.sys 0x8AB41000 \SystemRoot\system32\drivers\vsmraid.sys 0x8AB62000 \SystemRoot\system32\drivers\fltmgr.sys 0x8AB94000 \SystemRoot\system32\drivers\fileinfo.sys 0x8A96F000 \SystemRoot\System32\Drivers\ksecdd.sys 0x8AE08000 \SystemRoot\system32\drivers\ndis.sys 0x8AF13000 \SystemRoot\system32\drivers\msrpc.sys 0x8AF3E000 \SystemRoot\system32\drivers\NETIO.SYS 0x8B00C000 \SystemRoot\System32\drivers\tcpip.sys 0x8B0F6000 \SystemRoot\System32\drivers\fwpkclnt.sys 0x8B209000 \SystemRoot\System32\Drivers\Ntfs.sys 0x8B318000 \SystemRoot\system32\drivers\wd.sys 0x8B320000 \SystemRoot\system32\drivers\volsnap.sys 0x8B359000 \SystemRoot\System32\Drivers\spldr.sys 0x8B361000 \SystemRoot\system32\drivers\sbp2port.sys 0x8B376000 \SystemRoot\System32\Drivers\mup.sys 0x8B385000 \SystemRoot\System32\drivers\ecache.sys 0x8B3AC000 \SystemRoot\system32\DRIVERS\hpdskflt.sys 0x8B3B5000 \SystemRoot\system32\drivers\disk.sys 0x8B3C6000 \SystemRoot\system32\DRIVERS\AtiPcie.sys 0x8B3CE000 \SystemRoot\system32\drivers\crcdisk.sys 0x8B111000 \SystemRoot\system32\DRIVERS\tunnel.sys 0x8B200000 \SystemRoot\system32\DRIVERS\tunmp.sys 0x8B11C000 \SystemRoot\system32\DRIVERS\processr.sys 0x9EC04000 \SystemRoot\system32\DRIVERS\atikmdag.sys 0x9F0D3000 \SystemRoot\System32\drivers\dxgkrnl.sys 0x9F172000 \SystemRoot\System32\drivers\watchdog.sys 0x9F17F000 \SystemRoot\system32\DRIVERS\HDAudBus.sys 0x9F191000 \SystemRoot\system32\DRIVERS\ohci1394.sys 0x9F1A1000 \SystemRoot\system32\DRIVERS\1394BUS.SYS 0x9F1AF000 \SystemRoot\system32\DRIVERS\jmcr.sys 0x9F809000 \SystemRoot\system32\DRIVERS\athr.sys 0x9F8ED000 \SystemRoot\system32\DRIVERS\Rtlh86.sys 0x9F90E000 \SystemRoot\system32\DRIVERS\cdrom.sys 0x9F926000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys 0x9F92C000 \SystemRoot\system32\DRIVERS\usbohci.sys 0x9F936000 \SystemRoot\system32\DRIVERS\USBPORT.SYS 0x9F974000 \SystemRoot\system32\DRIVERS\usbehci.sys 0x9F983000 \SystemRoot\system32\DRIVERS\i8042prt.sys 0x9F996000 \SystemRoot\system32\DRIVERS\HpqKbFiltr.sys 0x9F99B000 \SystemRoot\system32\DRIVERS\kbdclass.sys 0x9F9A6000 \SystemRoot\system32\DRIVERS\SynTP.sys 0x9F9D5000 \SystemRoot\system32\DRIVERS\USBD.SYS 0x9F9D7000 \SystemRoot\system32\DRIVERS\mouclass.sys 0x9F9E2000 \SystemRoot\system32\DRIVERS\CmBatt.sys 0x9F9E6000 \SystemRoot\system32\DRIVERS\enecir.sys 0x9F1C4000 \SystemRoot\system32\DRIVERS\Accelerometer.sys 0x9F800000 \SystemRoot\system32\DRIVERS\wmiacpi.sys 0x9F9FE000 \SystemRoot\system32\DRIVERS\jumi.sys 0x9F1CF000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS 0x9F1DF000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS 0x8B12B000 \SystemRoot\system32\DRIVERS\msiscsi.sys 0x9F1E6000 \SystemRoot\system32\DRIVERS\TDI.SYS 0x8B159000 \SystemRoot\system32\DRIVERS\rasl2tp.sys 0x9F1F1000 \SystemRoot\system32\DRIVERS\ndistapi.sys 0x8B170000 \SystemRoot\system32\DRIVERS\ndiswan.sys 0x8B193000 \SystemRoot\system32\DRIVERS\raspppoe.sys 0x8B1A2000 \SystemRoot\system32\DRIVERS\raspptp.sys 0x8B1B6000 \SystemRoot\system32\DRIVERS\rassstp.sys 0x8B1CB000 \SystemRoot\system32\DRIVERS\termdd.sys 0x9F1FC000 \SystemRoot\system32\DRIVERS\swenum.sys 0x8AF78000 \SystemRoot\system32\DRIVERS\ks.sys 0x8B1DB000 \SystemRoot\system32\DRIVERS\circlass.sys 0x8B1E9000 \SystemRoot\system32\DRIVERS\mssmbios.sys 0x8B1F3000 \SystemRoot\system32\DRIVERS\umbus.sys 0x8AFA2000 \SystemRoot\system32\DRIVERS\usbhub.sys 0x8B000000 \SystemRoot\system32\DRIVERS\mouhid.sys 0x8AFD6000 \SystemRoot\system32\DRIVERS\kbdhid.sys 0x8AFDF000 \SystemRoot\System32\Drivers\NDProxy.SYS 0x8ABA4000 \SystemRoot\system32\drivers\HdAudio.sys 0xA2405000 \SystemRoot\system32\drivers\portcls.sys 0xA2432000 \SystemRoot\system32\drivers\drmk.sys 0xA2457000 \SystemRoot\system32\DRIVERS\stwrt.sys 0xA24B8000 \SystemRoot\system32\DRIVERS\hidir.sys 0xA24C3000 \SystemRoot\system32\DRIVERS\MpFilter.sys 0xA24EA000 \SystemRoot\System32\Drivers\Fs_Rec.SYS 0xA24F3000 \SystemRoot\System32\Drivers\Null.SYS 0xA24FA000 \SystemRoot\System32\Drivers\Beep.SYS 0xA2501000 \SystemRoot\System32\drivers\vga.sys 0xA250D000 \SystemRoot\System32\drivers\VIDEOPRT.SYS 0xA252E000 \SystemRoot\System32\DRIVERS\RDPCDD.sys 0xA2536000 \SystemRoot\system32\drivers\rdpencdd.sys 0xA253E000 \SystemRoot\system32\DRIVERS\usbccgp.sys 0xA2555000 \SystemRoot\System32\Drivers\usbvideo.sys 0xA2576000 \SystemRoot\System32\Drivers\Msfs.SYS 0xA2581000 \SystemRoot\System32\Drivers\Npfs.SYS 0xA258F000 \SystemRoot\System32\DRIVERS\rasacd.sys 0xA2598000 \SystemRoot\system32\DRIVERS\tdx.sys 0xA25AE000 \SystemRoot\system32\DRIVERS\smb.sys 0xA260E000 \SystemRoot\system32\drivers\afd.sys 0xA2656000 \SystemRoot\System32\DRIVERS\netbt.sys 0xA2688000 \SystemRoot\system32\DRIVERS\pacer.sys 0xA269E000 \SystemRoot\system32\DRIVERS\netbios.sys 0xA26AC000 \SystemRoot\system32\DRIVERS\wanarp.sys 0xA26BF000 \SystemRoot\system32\DRIVERS\rdbss.sys 0xA26FB000 \SystemRoot\System32\Drivers\BTHUSB.sys 0xA2708000 \SystemRoot\System32\Drivers\bthport.sys 0xA2788000 \SystemRoot\system32\drivers\nsiproxy.sys 0xA279B000 \SystemRoot\system32\DRIVERS\BdaSup.SYS 0xA279E000 \SystemRoot\System32\Drivers\dfsc.sys 0xA27B5000 \SystemRoot\system32\DRIVERS\rfcomm.sys 0xA27DE000 \SystemRoot\system32\DRIVERS\BthEnum.sys 0xA25C2000 \SystemRoot\system32\DRIVERS\bthpan.sys 0xA2801000 \SystemRoot\system32\drivers\btwavdt.sys 0xA2868000 \SystemRoot\system32\drivers\btwaudio.sys 0xA28E8000 \SystemRoot\system32\DRIVERS\btwrchid.sys 0xA28EB000 \SystemRoot\System32\Drivers\crashdmp.sys 0xA28F8000 \SystemRoot\System32\Drivers\dump_dumpata.sys 0xA2903000 \SystemRoot\System32\Drivers\dump_msahci.sys 0xAA460000 \SystemRoot\System32\win32k.sys 0xA290D000 \SystemRoot\System32\drivers\Dxapi.sys 0xA2917000 \SystemRoot\system32\DRIVERS\monitor.sys 0xAA680000 \SystemRoot\System32\TSDDD.dll 0xAA6A0000 \SystemRoot\System32\cdd.dll 0xA2926000 \SystemRoot\system32\drivers\luafv.sys 0xA2941000 \SystemRoot\system32\drivers\spsys.sys 0xA29F0000 \SystemRoot\system32\DRIVERS\lltdio.sys 0xAC809000 \SystemRoot\system32\DRIVERS\nwifi.sys 0xAC833000 \SystemRoot\system32\DRIVERS\ndisuio.sys 0xAC83D000 \SystemRoot\system32\DRIVERS\rspndr.sys 0xAC850000 \SystemRoot\system32\drivers\HTTP.sys 0xAC8BD000 \SystemRoot\System32\DRIVERS\srvnet.sys 0xAC8DA000 \SystemRoot\system32\DRIVERS\bowser.sys 0xAC8F3000 \SystemRoot\System32\drivers\mpsdrv.sys 0xAC908000 \SystemRoot\system32\drivers\mrxdav.sys 0xAC928000 \SystemRoot\system32\DRIVERS\mrxsmb.sys 0xAC947000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys 0xAC980000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys 0xAC998000 \SystemRoot\System32\DRIVERS\srv2.sys 0xB0A0D000 \SystemRoot\System32\DRIVERS\srv.sys 0xB0A74000 \SystemRoot\system32\drivers\peauth.sys 0xB0B52000 \SystemRoot\System32\Drivers\secdrv.SYS 0xB0B5C000 \SystemRoot\System32\drivers\tcpipreg.sys 0xB0B68000 \SystemRoot\system32\DRIVERS\cdfs.sys 0x77480000 \WINDOWS\System32\ntdll.dll Processes (total 81): 0 System Idle Process 4 System 448 C:\WINDOWS\System32\smss.exe 580 csrss.exe 640 C:\WINDOWS\System32\wininit.exe 656 csrss.exe 688 C:\WINDOWS\System32\services.exe 700 C:\WINDOWS\System32\lsass.exe 708 C:\WINDOWS\System32\lsm.exe 852 C:\WINDOWS\System32\svchost.exe 888 C:\WINDOWS\System32\winlogon.exe 960 C:\WINDOWS\System32\svchost.exe 1000 C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe 1092 C:\WINDOWS\System32\Ati2evxx.exe 1116 C:\WINDOWS\System32\svchost.exe 1148 C:\WINDOWS\System32\svchost.exe 1192 C:\WINDOWS\System32\svchost.exe 1204 C:\WINDOWS\System32\DriverStore\FileRepository\stwrt.inf_9a642328\stacsv.exe 1292 C:\WINDOWS\System32\audiodg.exe 1500 C:\WINDOWS\System32\SLsvc.exe 1536 C:\WINDOWS\System32\svchost.exe 1616 C:\WINDOWS\System32\Ati2evxx.exe 1672 C:\WINDOWS\System32\hpservice.exe 1764 C:\WINDOWS\System32\svchost.exe 1972 C:\WINDOWS\System32\dwm.exe 2024 C:\WINDOWS\explorer.exe 2032 C:\WINDOWS\System32\wlanext.exe 384 C:\WINDOWS\System32\spoolsv.exe 12 C:\WINDOWS\System32\svchost.exe 568 C:\WINDOWS\System32\taskeng.exe 1796 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe 1560 C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe 2080 C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe 2148 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe 2172 C:\WINDOWS\System32\DriverStore\FileRepository\stwrt.inf_9a642328\AEstSrv.exe 2188 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe 2200 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe 2240 C:\Program Files\Bonjour\mDNSResponder.exe 2248 C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe 2260 C:\WINDOWS\System32\svchost.exe 2304 C:\Program Files\Common Files\LightScribe\LSSrvc.exe 2476 C:\WINDOWS\System32\svchost.exe 2544 C:\WINDOWS\SMINST\BLService.exe 2552 C:\Program Files\iTunes\iTunesHelper.exe 2612 C:\Program Files\Common Files\Java\Java Update\jusched.exe 2632 C:\WINDOWS\System32\taskeng.exe 2656 C:\Program Files\Microsoft Security Client\msseces.exe 2708 C:\Program Files\CyberLink\Shared Files\RichVideo.exe 2776 C:\Program Files\Windows Sidebar\sidebar.exe 2880 C:\WINDOWS\System32\svchost.exe 2904 C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe 2984 C:\WINDOWS\System32\svchost.exe 3036 C:\WINDOWS\System32\SearchIndexer.exe 3108 C:\WINDOWS\ehome\ehtray.exe 3228 C:\Program Files\Windows Media Player\wmpnscfg.exe 3332 C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe 3504 C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe 3624 WmiPrvSE.exe 3652 C:\Program Files\OpenOffice.org 3\program\soffice.exe 3780 C:\Program Files\OpenOffice.org 3\program\soffice.bin 3916 C:\WINDOWS\ehome\ehmsas.exe 3980 C:\Program Files\Windows Media Player\wmpnetwk.exe 4064 C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe 1440 C:\WINDOWS\ehome\ehsched.exe 2212 C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe 3100 C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe 2964 C:\Program Files\iPod\bin\iPodService.exe 3544 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe 2992 C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe 4216 C:\WINDOWS\ehome\ehrecvr.exe 4904 C:\Program Files\Synaptics\SynTP\SynTPHelper.exe 5672 C:\Users\Basti\Downloads\osam.exe 5688 C:\WINDOWS\System32\SearchProtocolHost.exe 6108 C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Service.exe 4716 C:\WINDOWS\System32\wuauclt.exe 5832 C:\WINDOWS\System32\notepad.exe 3720 C:\Program Files\Mozilla Firefox\firefox.exe 1660 C:\WINDOWS\System32\SearchFilterHost.exe 4856 C:\WINDOWS\explorer.exe 2960 C:\Users\Basti\Desktop\MBRCheck.exe 4896 C:\WINDOWS\System32\conime.exe \\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS) \\.\D: --> \\.\PhysicalDrive0 at offset 0x00000038`02700000 (NTFS) PhysicalDrive0 Model Number: WDCWD2500BEVS-60UST0, Rev: 01.01A01 Size Device Name MBR Status -------------------------------------------- 232 GB \\.\PhysicalDrive0 Unknown MBR code SHA1: 08F21ADD893776C287CC68A3558F8D095B50ED3C Found non-standard or infected MBR. Enter 'Y' and hit ENTER for more options, or 'N' to exit: Done! |
02.05.2011, 21:56 | #26 |
| Backdoor:Win32/Cbot.B - Trojan:Win32/FakeSysdef Entschuldige daß es so lang gedauert hat, mein Rechner geht neuerdings einfach aus zwischendurch... |
02.05.2011, 21:57 | #27 |
/// Winkelfunktion /// TB-Süch-Tiger™ | Backdoor:Win32/Cbot.B - Trojan:Win32/FakeSysdef Wir sollten den MBR manuell fixen. Sichere für den Fall der Fälle alle wichtigen Daten. Hast Du noch andere Betriebssysteme außer Vista installiert? Wenn nicht: Schau mal hier => Vista Notfall/Recovery-CD 32-Bit - Dr. Windows Lad das iso runter, brenn es zB mit ImgBurn per Imagebrennfunktion auf eine CD und starte damit den Rechner (von dieser CD booten). Falls Du eine normale Vista-Installations-DVD hast, brauchst Du das o.g. Image nicht sondern kannst einfach von der Vista-DVD booten. Klick auf Computerreparaturoptionen, weiter, Eingabeaufforderung - die Konsole öffnet sich. Da bitte bootrec.exe /fixboot eintippen (mit enter bestätigen), dann bootrec.exe /fixmbr eintippen (mit enter bestätigen) - Rechner neustarten, CD vorher rausnehmen. Erstell danach wieder neue Logs mit MBRCheck und wenn es geht GMER.
__________________ Logfiles bitte immer in CODE-Tags posten |
02.05.2011, 22:30 | #28 |
| Backdoor:Win32/Cbot.B - Trojan:Win32/FakeSysdef hm ja das wird ein weilchen dauern und ich hoffe mein laptop geht nicht wieder aus mittendrin.. |
04.05.2011, 15:52 | #29 |
| Backdoor:Win32/Cbot.B - Trojan:Win32/FakeSysdef Hi Arne, also bei mir hat so gut wie nix geklappt. Hab mir das Iso runtergeladen, aber mein computer war nicht fähig es zu brennen (weiß leider nicht genau warum, vermute es liegt am Laufwerk bzw Brenner). Eine Vista-Installations-Dvd hab ich ,glaube ich, nicht. Außer es geht auch mit den beiden Backup dvd, welche ich direkt nach der erstinstallation gebrannt habe. geht das? entschuldige meine Computerunfähigkeit... |
04.05.2011, 16:02 | #30 |
/// Winkelfunktion /// TB-Süch-Tiger™ | Backdoor:Win32/Cbot.B - Trojan:Win32/FakeSysdef Wenn du nicht weißt warum, wie kommst du auf den Brenner? Wie du ein Image brennst ist dir bekannt?
__________________ Logfiles bitte immer in CODE-Tags posten |
Themen zu Backdoor:Win32/Cbot.B - Trojan:Win32/FakeSysdef |
anti-malware, antimalware, avp, backdoor, computer, dateien, dateiordner, desktop, explorer, festplatte, firefox, infiziert, internet, kaspersky, log-datei, logdatei, microsoft, microsoft security, microsoft security essentials, mozilla, programm, security, software, speicherplatz, start menu, trojan, trojan:win32/fakesysdef, virus, win32/fakesysdef, windows, winlogon |