Hallo,
vor kurzem ist mir aufgefallen, dass sich antivir nicht mehr updaten läßt.
Ich habe dann u.a. eine antivir-rescue-disk gebootet und den spyeyes-trojaner gefunden und deleted. Alle caches (Java, Temp, Temporäre Internetdateien sind geleert).
Danach habe ich
Malwarebytes laufen lassen (2.Log) und noch einen Adware-agent gefunden.
Antivir kann ich immer noch nicht updaten. Wenn ich
GMER laufen lassen möchte, stürzt der Rechner ab. Über eure Hilfe würde ich mich sehr freuen.
Der antivir - Log:
Zitat:
Avira / Linux Version 1.9.152.0
Copyright (c) 2010 by Avira GmbH
All rights reserved.
engine set: 8.2.4.242
VDF Version: 7.11.8.107
Scan start time: Mon May 23 23:16:35 2011
configuration file: /etc/avira/scancl.conf
ALERT: [Java/Dldr.Arch.A] /media/Devices/sda1/Documents and Settings/Martin/Application Data/Sun/Java/Deployment/cache/6.0/12/3cc664c-6c7ae634 <<< Contains signature of the Java virus JAVA/Dldr.Arch.A [renamed]
ALERT: [TR/Spy.SpyEyes.gwd] /media/Devices/sda1/Documents and Settings/Martin/Application Data/Sun/Java/Deployment/cache/6.0/56/30b8cfb8-638ae732 <<< Is the Trojan horse TR/Spy.SpyEyes.gwd [renamed]
ALERT: [TR/Spy.SpyEyes.gwd] /media/Devices/sda1/Documents and Settings/Martin/Local Settings/Temp/0.501756909366432.exe <<< Is the Trojan horse TR/Spy.SpyEyes.gwd [renamed]
WARNING: [Unexpected end of file] /media/Devices/sda1/Documents and Settings/Martin/Local Settings/Temporary Internet Files/Content.IE5/0B0LGVCJ/profile_data_1[1].zip
WARNING: [Unexpected end of file] /media/Devices/sda1/Documents and Settings/Martin/Local Settings/Temporary Internet Files/Content.IE5/0B0LGVCJ/theme[2].zip
WARNING: [Unexpected end of file] /media/Devices/sda1/Documents and Settings/Martin/Local Settings/Temporary Internet Files/Content.IE5/8167CPO7/images[1].zip
WARNING: [Unexpected end of file] /media/Devices/sda1/Documents and Settings/Martin/Local Settings/Temporary Internet Files/Content.IE5/Q54PEJS1/theme[1].zip
WARNING: [Unexpected end of file] /media/Devices/sda1/Documents and Settings/Martin/Local Settings/Temporary Internet Files/Content.IE5/Q54PEJS1/theme[2].zip
WARNING: [Unexpected end of file] /media/Devices/sda1/Documents and Settings/Martin/Local Settings/Temporary Internet Files/Content.IE5/Q54PEJS1/theme[3].zip
WARNING: [Unexpected end of file] /media/Devices/sda1/Documents and Settings/Martin/Local Settings/Temporary Internet Files/Content.IE5/Q54PEJS1/theme[4].zip
WARNING: [Unexpected end of file] /media/Devices/sda1/Documents and Settings/Martin/Local Settings/Temporary Internet Files/Content.IE5/Q54PEJS1/profile_data_1[1].zip
WARNING: [Unexpected end of file] /media/Devices/sda1/Documents and Settings/Martin/Local Settings/Temporary Internet Files/Content.IE5/Q54PEJS1/forms_data_1[1].zip
WARNING: [Unexpected end of file] /media/Devices/sda1/Documents and Settings/Martin/Local Settings/Temporary Internet Files/Content.IE5/Q54PEJS1/forms_data_1[2].zip
WARNING: [The files in archive are multiple volume] /media/Devices/sda1/Documents and Settings/Martin/My Documents/Downloads/UnitySetup-3.0.0.exe --> ProgramFilesDir/ICSharpCode.SharpZipLib.dll
WARNING: [The files in archive are multiple volume] /media/Devices/sda1/Documents and Settings/Martin/My Documents/Downloads/UnitySetup-3.0.0.exe --> ProgramFilesDir/ICSharpCode.SharpZipLib.dll
WARNING: [The files in archive are multiple volume] /media/Devices/sda1/Documents and Settings/Martin/My Documents/Downloads/UnitySetup-3.0.0.exe --> ProgramFilesDir/ICSharpCode.SharpZipLib.dll
WARNING: [Unexpected end of file] /media/Devices/sda1/Documents and Settings/Martin/My Documents/Downloads/ct1013.zip.001
WARNING: [A malformed archive header was detected] /media/Devices/sda1/Documents and Settings/Martin/My Documents/Downloads/ct1013.zip.002
WARNING: [Unexpected end of file] /media/Devices/sda1/Program Files/SpeedFan/uninstall.exe
WARNING: [Unexpected end of file] /media/Devices/sda1/WINDOWS/system32/Macromed/Flash/uninstall_activeX.exe
WARNING: [File is encrypted] /media/Devices/sda5/Downloads/34d7dea57db8e5cca607c8b636a2ec82.rar
WARNING: [The files in archive are multiple volume] /media/Devices/sda5/Downloads/UnitySetup-2.6.1.exe --> ProgramFilesDir/ICSharpCode.SharpZipLib.dll
WARNING: [The files in archive are multiple volume] /media/Devices/sda5/Downloads/fbnames/facebook-names-unique.txt.bz2
WARNING: [Bad compressed data] /media/Devices/sda5/WinLite.iso --> Programme_zum_installieren/LibO_3.3.0_Win_x86_install_multi.exe --> ProgramFilesDir/libreoffice1.cab --> standard4.bau
WARNING: [Bad compressed data] /media/Devices/sda5/WinLite.iso --> Programme_zum_installieren/LibO_3.3.0_Win_x86_install_multi.exe --> ProgramFilesDir/libreoffice1.cab --> template4.bau
Statistics :
Directories............... : 37776
Archives.................. : 9137
Files..................... : 2823426
Infected.............. : 3
Renamed........... : 3
Warnings.............. : 31
Suspicious............ : 0
Infections................ : 3
|
Dann habe ich
Malwarebytes laufen lassen:
Folgender Log:
Zitat:
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org
Datenbank Version: 6658
Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512
24.05.2011 10:19:53
mbam-log-2011-05-24 (10-19-53).txt
Art des Suchlaufs: Vollständiger Suchlauf (C:\|F:\|G:\|)
Durchsuchte Objekte: 350156
Laufzeit: 48 Minute(n), 42 Sekunde(n)
Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1
Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)
Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)
Infizierte Dateien:
f:\system volume information\_restore{b83da741-c247-48bc-b6d4-9fbfead0d7f8}\RP242\A0127966.exe (Adware.Agent) -> Quarantined and deleted successfully.
|
24.05.2011, 17:59
Baum-Darstellung