|
Log-Analyse und Auswertung: AW: Trojaner TR/Kazy.mekml.1Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
10.05.2011, 18:33 | #1 |
| AW: Trojaner TR/Kazy.mekml.1 OTL Schritt 1 All processes killed Error: Unable to interpret <O33 - MountPoints2\{6ddba7fa-4dbb-11de-ae2d-001d72dad057}\Shell\AutoRun\command - "" = G:\USBAutoRun.exe> in the current context! Error: Unable to interpret <O33 - MountPoints2\{81e1ee52-d920-11df-a4a6-001d72dad057}\Shell - "" = AutoRun> in the current context! Error: Unable to interpret <O33 - MountPoints2\{81e1ee52-d920-11df-a4a6-001d72dad057}\Shell\AutoRun\command - "" = G:\autorun.exe> in the current context! Error: Unable to interpret <O33 - MountPoints2\{985a066c-b9ba-11df-be34-001d72dad057}\Shell - "" = AutoRun> in the current context! Error: Unable to interpret <O33 - MountPoints2\{985a066c-b9ba-11df-be34-001d72dad057}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL G:\Start.hta> in the current context! Error: Unable to interpret <O33 - MountPoints2\{b07d2a78-b7ee-11df-adeb-001d72dad057}\Shell - "" = AutoRun> in the current context! Error: Unable to interpret <O33 - MountPoints2\{b07d2a78-b7ee-11df-adeb-001d72dad057}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL G:\Start.hta> in the current context! Error: Unable to interpret <O33 - MountPoints2\{b1907d8b-9611-11de-b779-00215d55fee6}\Shell - "" = AutoRun> in the current context! Error: Unable to interpret <O33 - MountPoints2\{b1907d8b-9611-11de-b779-00215d55fee6}\Shell\AutoRun\command - "" = G:\setup_vmc_lite.exe /checkApplicationPresence> in the current context! Error: Unable to interpret <O33 - MountPoints2\{b1907da6-9611-11de-b779-00215d55fee6}\Shell - "" = AutoRun> in the current context! Error: Unable to interpret <O33 - MountPoints2\{b1907da6-9611-11de-b779-00215d55fee6}\Shell\AutoRun\command - "" = G:\setup_vmc_lite.exe /checkApplicationPresence> in the current context! Error: Unable to interpret <O33 - MountPoints2\{bae4b491-8e77-11de-b9bb-001d72dad057}\Shell\AutoRun\command - "" = G:\InstallTomTomHOME.exe> in the current context! Error: Unable to interpret <O33 - MountPoints2\{e6007649-9613-11de-9354-00215d55fee6}\Shell - "" = AutoRun> in the current context! Error: Unable to interpret <O33 - MountPoints2\{e6007649-9613-11de-9354-00215d55fee6}\Shell\AutoRun\command - "" = G:\setup_vmc_lite.exe /checkApplicationPresence> in the current context! Error: Unable to interpret <O33 - MountPoints2\{e600764b-9613-11de-9354-00215d55fee6}\Shell - "" = AutoRun> in the current context! Error: Unable to interpret <O33 - MountPoints2\{e600764b-9613-11de-9354-00215d55fee6}\Shell\AutoRun\command - "" = G:\setup_vmc_lite.exe /checkApplicationPresence> in the current context! Error: Unable to interpret <@Alternate Data Stream - 98 bytes -> C:\ProgramData\TEMP:F3176E45> in the current context! Error: Unable to interpret <@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:A696643D> in the current context! Error: Unable to interpret <@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:FEBEC560> in the current context! Error: Unable to interpret <@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:580E04D8> in the current context! Error: Unable to interpret <@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:5711EF65> in the current context! Error: Unable to interpret <@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:8AB6C1D7> in the current context! Error: Unable to interpret <@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:193426B4> in the current context! Error: Unable to interpret <@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP88D995C> in the current context! Error: Unable to interpret <@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:5D10517E> in the current context! Error: Unable to interpret <@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:B623B5B8> in the current context! Error: Unable to interpret <@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:C95B63DA> in the current context! Error: Unable to interpret <@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:4CF61E54> in the current context! Error: Unable to interpret <@Alternate Data Stream - 109 bytes -> C:\ProgramData\TEMP:861A898F> in the current context! Error: Unable to interpret <@Alternate Data Stream - 109 bytes -> C:\ProgramData\TEMP:4BB26BE9> in the current context! Error: Unable to interpret <@Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:4F636E25> in the current context! Error: Unable to interpret <@Alternate Data Stream - 104 bytes -> C:\ProgramData\TEMP:2B99FE60> in the current context! Error: Unable to interpret <[2011.04.27 07:52:22 | 000,573,440 | -H-- | C] (WinTrust) -- C:\ProgramData\qSsBwhAkulOsDNp.exe> in the current context! Error: Unable to interpret <[2011.04.27 07:52:20 | 000,573,440 | -H-- | C] (WinTrust) -- C:\Users\Toni\Desktop\null0.7396047803483226.exe> in the current context! ========== COMMANDS ========== [EMPTYTEMP] User: Administrator ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 55673 bytes User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33728 bytes User: Gast ->Temp folder emptied: 519499177 bytes ->Temporary Internet Files folder emptied: 2049131 bytes ->Java cache emptied: 658967 bytes ->FireFox cache emptied: 19596065 bytes ->Google Chrome cache emptied: 91067547 bytes ->Flash cache emptied: 14812 bytes User: LocalService ->Temp folder emptied: 65984 bytes ->Temporary Internet Files folder emptied: 33962 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 194347 bytes User: User ->Temp folder emptied: 7036626647 bytes ->Temporary Internet Files folder emptied: 5392735 bytes ->Java cache emptied: 2533556 bytes ->Google Chrome cache emptied: 5837168 bytes ->Flash cache emptied: 3357 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 1139177 bytes %systemroot%\System32 .tmp files removed: 15267239 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 40383047 bytes RecycleBin emptied: 27709509 bytes Total Files Cleaned = 7.408,00 mb OTL by OldTimer - Version 3.2.22.3 log created on 07076624_004156 Files\Folders moved on Reboot... Registry entries deleted on Reboot... OTL Schritt 2 OTL logfile created on: 07.07.6624 00:23:06 - Run 2 OTL by OldTimer - Version 3.2.22.3 Folder = C:\Dokumente und Einstellungen\User\Eigene Dateien\Downloads Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.5512) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 67,00% Memory free 2,00 Gb Paging File | 1,00 Gb Available in Paging File | 75,00% Paging File free Paging file location(s): C:\pagefile.sys 336 672 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 37,26 Gb Total Space | 2,23 Gb Free Space | 5,97% Space Free | Partition Type: NTFS Computer Name: PC-UTHAV8ECYBLP | User Name: User | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [6624.07.07 00:17:31 | 000,302,080 | ---- | M] () -- C:\Dokumente und Einstellungen\User\Eigene Dateien\Downloads\63201fup.exe PRC - [6624.07.06 23:38:42 | 000,580,608 | -H-- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\User\Eigene Dateien\Downloads\OTL.exe PRC - [2011.05.10 09:58:42 | 000,510,976 | -H-- | M] (QNP) -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\FEuLFLOIGw.exe PRC - [2011.05.06 21:50:10 | 001,010,232 | -H-- | M] (Google Inc.) -- C:\Programme\Google\Chrome\Application\chrome.exe PRC - [2011.04.27 12:41:27 | 000,136,360 | -H-- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe PRC - [2011.03.04 14:36:11 | 000,281,768 | -H-- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe PRC - [2011.03.04 14:36:11 | 000,269,480 | -H-- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe PRC - [2010.08.13 10:28:56 | 000,345,600 | ---- | M] () -- C:\WINDOWS\tsnp325.exe PRC - [2010.08.05 22:10:06 | 000,411,648 | -H-- | M] (Visicom Media Inc.) -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\magentictb\incredimail1_0dn.exe PRC - [2010.01.14 21:10:53 | 000,076,968 | -H-- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe PRC - [2008.04.14 04:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2007.09.02 13:58:52 | 000,495,616 | ---- | M] () -- C:\Programme\RocketDock\RocketDock.exe ========== Modules (SafeList) ========== MOD - [6624.07.06 23:38:42 | 000,580,608 | -H-- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\User\Eigene Dateien\Downloads\OTL.exe MOD - [2010.08.23 18:11:46 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll MOD - [2010.08.05 18:13:28 | 000,356,864 | -H-- | M] (Visicom Media Inc.) -- C:\Dokumente und Einstellungen\User\Anwendungsdaten\magentictb\incredimail1_0dn.dll MOD - [2007.09.02 13:57:36 | 000,069,632 | ---- | M] () -- C:\Programme\RocketDock\RocketDock.dll ========== Win32 Services (SafeList) ========== SRV - File not found [Auto | Stopped] -- -- (StarWindServiceAE) SRV - File not found [Auto | Stopped] -- -- (Soda PDF Service) SRV - File not found [On_Demand | Stopped] -- -- (Soda PDF Helper Service) SRV - [2011.04.27 12:41:27 | 000,136,360 | -H-- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2011.03.30 19:48:00 | 001,523,008 | ---- | M] (TuneUp Software) [Auto | Stopped] -- C:\Programme\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe -- (TuneUp.UtilitiesSvc) SRV - [2011.03.30 19:45:32 | 000,029,504 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\WINDOWS\system32\uxtuneup.dll -- (UxTuneUp) SRV - [2011.03.04 14:36:11 | 000,269,480 | -H-- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2010.12.20 19:08:58 | 000,363,344 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService) ========== Driver Services (SafeList) ========== DRV - [2011.05.09 21:49:13 | 000,722,416 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd) DRV - [2011.04.01 10:23:02 | 000,037,920 | ---- | M] (RapidSolution Software AG) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\tbhsd.sys -- (tbhsd) DRV - [2011.04.01 10:23:02 | 000,035,944 | ---- | M] (RapidSolution Software AG) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\rsvcdwdr.sys -- (rsvcdwdr) DRV - [2011.03.04 16:11:12 | 000,137,656 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb) DRV - [2011.03.04 14:36:34 | 000,061,960 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt) DRV - [2011.02.10 10:22:58 | 000,010,064 | ---- | M] (TuneUp Software) [Kernel | On_Demand | Running] -- C:\Programme\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys -- (TuneUpUtilitiesDrv) DRV - [2010.06.17 14:27:02 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2010.06.17 14:26:52 | 000,011,608 | -H-- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Programme\Avira\AntiVir Desktop\avgio.sys -- (avgio) DRV - [2010.04.28 07:44:02 | 000,054,760 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\fssfltr_tdi.sys -- (fssfltr) DRV - [2005.12.01 11:49:22 | 000,023,600 | ---- | M] (Licensed for Gebhard Software) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\drhard.sys -- (drhard) DRV - [2005.04.12 10:41:20 | 000,004,608 | ---- | M] (Elaborate Bytes AG) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ElbyDelay.sys -- (ElbyDelay) DRV - [2004.08.04 07:29:51 | 000,166,912 | ---- | M] (S3 Graphics, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\s3gnbm.sys -- (S3SavageNB) DRV - [2003.02.26 16:04:00 | 000,370,048 | R--- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\viaudios.sys -- (VIAudio) VIA AC'97 Audio Controller (WDM) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://mystart.incredimail.com/mb74?a=1eynciyssro IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie IE - HKCU\..\URLSearchHook: {d40b90b4-d3b1-4d6b-a5d7-dc041c1b76c0} - C:\Programme\IncrediMail_MediaBar_2\prxtbInc0.dll (Conduit Ltd.) IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 O1 HOSTS File: ([2002.08.29 15:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Magentic Toolbar) - {07C92F45-3193-4FD9-AF54-B1925707C872} - C:\Programme\magentictb\magenticDx.dll () O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) O2 - BHO: (CescrtHlpr Object) - {2EECD738-5844-4a99-B4B6-146BF802613B} - File not found O2 - BHO: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.) O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O2 - BHO: (Soda PDF Helper) - {5CFCAFF6-5BB0-4864-B626-021C99ED82E5} - File not found O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - File not found O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.6.6209.1142\swg.dll (Google Inc.) O2 - BHO: (Updater For Magentic Toolbar) - {B3312915-9368-4FE4-8D4E-B60E5B36D0FF} - C:\Programme\magentictb\auxi\magenticAu.dll (Visicom Media) O2 - BHO: (IncrediMail MediaBar 2 Toolbar) - {d40b90b4-d3b1-4d6b-a5d7-dc041c1b76c0} - C:\Programme\IncrediMail_MediaBar_2\prxtbInc0.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (Magentic Toolbar) - {07C92F45-3193-4FD9-AF54-B1925707C872} - C:\Programme\magentictb\magenticDx.dll () O3 - HKLM\..\Toolbar: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (Soda PDF Toolbar) - {980EB9EC-6EB5-4258-BDDB-EFE25C5F99EF} - File not found O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - File not found O3 - HKLM\..\Toolbar: (IncrediMail MediaBar 2 Toolbar) - {d40b90b4-d3b1-4d6b-a5d7-dc041c1b76c0} - C:\Programme\IncrediMail_MediaBar_2\prxtbInc0.dll (Conduit Ltd.) O3 - HKCU\..\Toolbar\WebBrowser: (IncrediMail MediaBar 2 Toolbar) - {D40B90B4-D3B1-4D6B-A5D7-DC041C1B76C0} - C:\Programme\IncrediMail_MediaBar_2\prxtbInc0.dll (Conduit Ltd.) O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Programme\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [BabylonToolbar] File not found O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh) O4 - HKLM..\Run: [Network Error Advisor] C:\Programme\magentictb\ExeRunner.exe (Visicom Media Inc.) O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.) O4 - HKLM..\Run: [tsnp325] C:\WINDOWS\tsnp325.exe () O4 - HKCU..\Run: [AlcoholAutomount] File not found O4 - HKCU..\Run: [FEuLFLOIGw] C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\FEuLFLOIGw.exe (QNP) O4 - HKCU..\Run: [RocketDock] C:\Programme\RocketDock\RocketDock.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1 O8 - Extra context menu item: Google Sidewiki... - C:\Programme\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll (Google Inc.) O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - File not found O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - File not found O15 - HKCU\..Trusted Domains: ([]msn in Arbeitsplatz) O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://go.microsoft.com/fwlink/?linkid=39204 (Reg Error: Key error.) O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab (Reg Error: Key error.) O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1189081534625 (WUWebControl Class) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.) O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - File not found O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O24 - Desktop Components:0 () - hxxp://static.werkenntwen.de/images/layout/banner_normal.png O24 - Desktop Components:1 () - hxxp://img9.werkenntwen.de/photo12/ef43c62a71ac78f41244f9840369420a/5/2/52sf7wr5wflvz8gk7n3ux15bp2w_thumb.jpg O24 - Desktop Components:2 () - hxxp://img638.imageshack.us/img638/8905/dscn2024ec51.jpg O24 - Desktop Components:3 (Die derzeitige Homepage) - About:Home O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2007.09.06 13:52:35 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [6898.09.09 07:43:34 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\NtmsData [6624.07.07 00:10:17 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\User\Recent [6624.07.06 21:34:16 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\PDF Software [2011.05.10 09:58:43 | 000,510,976 | -H-- | C] (QNP) -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\FEuLFLOIGw.exe [2011.05.05 18:14:10 | 000,053,248 | ---- | C] ( ) -- C:\WINDOWS\System32\csnp325.dll [2011.05.05 18:14:09 | 000,163,840 | ---- | C] ( ) -- C:\WINDOWS\System32\rsnp325.dll [4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [11 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [6624.07.06 23:41:56 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [6624.07.06 21:34:23 | 000,576,664 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat [6624.07.06 21:34:23 | 000,549,682 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [6624.07.06 21:34:23 | 000,111,296 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat [6624.07.06 21:34:23 | 000,094,650 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [6624.07.06 21:22:07 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [11 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] ========== Files Created - No Company Name ========== [2011.05.10 11:31:46 | 000,000,160 | -H-- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\~15327012r [2011.05.10 11:31:46 | 000,000,152 | -H-- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\~15327012 [201 |
10.05.2011, 19:07 | #2 |
/// Malware-holic | AW: Trojaner TR/Kazy.mekml.1 log ist unvollständig, und führe keine fixes mehr aus,
__________________1. hast du es eh falsch eingegeben. 2. sind die immer angepasst
__________________ |
Themen zu AW: Trojaner TR/Kazy.mekml.1 |
.dll, 0x00000001, adobe, alternate, antivir, autorun, avg, avgntflt.sys, avira, babylon, babylon toolbar, babylontoolbar, bho, bytes, c:\windows, c:\windows\system32\rundll32.exe, cache, conduit, data, dateien, desktop, disabletaskmgr, dll, dllcache, einstellungen, error, explorer, firefox, format, google, google chrome, helper, homepage, install, internet, java, location, log, logfile, malwarebytes, mbamservice.exe, microsoft, msn, object, oldtimer, pdf, plug-in, registry, rundll, rundll32.exe, scan, setup, shell, shell32.dll, software, sptd.sys, stream, system, system32, temp, trojaner, windows, winlogon |