|
Ich bin am Hertunterladen; Antwort folgt gleich. |
Erstes Egebnis: - Das andere Programm ist noch beim Herunterladen. Virus total: a-squared 4.0.0.93 2009.02.16 - AhnLab-V3 2009.2.16.2 2009.02.16 - AntiVir 7.9.0.79 2009.02.16 - Authentium 5.1.0.4 2009.02.16 - Avast 4.8.1335.0 2009.02.16 - AVG 8.0.0.237 2009.02.16 - BitDefender 7.2 2009.02.16 - CAT-QuickHeal 10.00 2009.02.16 - ClamAV 0.94.1 2009.02.16 - Comodo 978 2009.02.16 - DrWeb 4.44.0.09170 2009.02.16 - eSafe 7.0.17.0 2009.02.15 - eTrust-Vet 31.6.6360 2009.02.16 - F-Prot 4.4.4.56 2009.02.16 - F-Secure 8.0.14470.0 2009.02.16 - Fortinet 3.117.0.0 2009.02.16 - GData 19 2009.02.16 - Ikarus T3.1.1.45.0 2009.02.16 - K7AntiVirus 7.10.582 2009.01.09 - Kaspersky 7.0.0.125 2009.02.16 - McAfee 5528 2009.02.16 - McAfee+Artemis 5528 2009.02.16 - Microsoft 1.4306 2009.02.16 - NOD32 3857 2009.02.16 - Norman 6.00.06 2009.02.16 - nProtect 2009.1.8.0 2009.02.16 - Panda 9.4.3.20 2009.02.16 - PCTools 4.4.2.0 2009.02.16 - Prevx1 V2 2009.02.16 Fraudulent Security Program Rising 21.17.02.00 2009.02.16 - SecureWeb-Gateway 6.7.6 2009.02.16 Trojan.LooksLike.Dropper Sophos 4.38.0 2009.02.16 - Sunbelt 3.2.1851.2 2009.02.12 - Symantec 10 2009.02.16 - TheHacker 6.3.2.2.258 2009.02.16 - TrendMicro 8.700.0.1004 2009.02.16 - VBA32 3.12.8.12 2009.02.16 - ViRobot 2009.2.16.1609 2009.02.16 - VirusBuster 4.5.11.0 2009.02.16 - weitere Informationen File size: 311296 bytes MD5...: 2545eb197127181d70903caf07e68a0a SHA1..: 30e84d55abb4a02bd29276914ce5f90575027881 SHA256: 123352efe532ce8f1a1d50b4499d47e624bedc612d051465bff455ef9bef4d53 SHA512: b2fa0adb7b2e8a6031092acb82545d991124a34988d0c52ff6253c6ade3d15b2 ae95a0a80cd958cd0b5f41f97f96e9885d11cdb2504b32e9d4b8a2549d153a4d ssdeep: 6144:zyNswXMRx/ov98dc5K1iwJVbce+yBiYRpZW/Ezc3Ay:ONfMH/ovyFFpcYRH 9 PEiD..: Armadillo v1.71 TrID..: File type identification Win32 Executable MS Visual C++ (generic) (53.1%) Windows Screen Saver (18.4%) Win32 Executable Generic (12.0%) Win32 Dynamic Link Library (generic) (10.6%) Generic Win/DOS Executable (2.8%) PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x431df6 timedatestamp.....: 0x46bd6293 (Sat Aug 11 07:17:39 2007) machinetype.......: 0x14c (I386) ( 3 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x1000 0x30f8c 0x31000 7.43 d687c52ddd84fa2c6f6895e78fbf4aa9 .rdata 0x32000 0x1450 0x2000 4.11 1f1cacebaa4fc81be59a0857da7be1e7 .data 0x34000 0x1774c 0x18000 5.56 ca0c43d043b997b06ddbb58b24e09782 ( 11 imports ) > COMCTL32.dll: ImageList_DragEnter, ImageList_BeginDrag > WS2_32.dll: -, WSAGetServiceClassInfoW, WSASendDisconnect, WSAAddressToStringW, -, -, -, -, -, WSADuplicateSocketA, WSARecv > KERNEL32.dll: GetFileAttributesExA, IsBadWritePtr, FindCloseChangeNotification, SetCommTimeouts, SetEndOfFile, ReadDirectoryChangesW, CompareStringW, EnumSystemCodePagesA, EraseTape, LocalLock, IsDBCSLeadByteEx, SetEnvironmentVariableW, SetVolumeLabelA, GetThreadContext, IsBadStringPtrA, DuplicateHandle, GetSystemTime, _hread, SetConsoleTitleA, EnumCalendarInfoW, GlobalAddAtomA, GetPrivateProfileStringW, GetShortPathNameW, GetDiskFreeSpaceW, GetVersion, GetEnvironmentVariableW, FindNextChangeNotification, GetVolumeInformationW, VirtualAlloc, PeekConsoleInputW, SetConsoleCursorPosition, GetModuleHandleA, GetShortPathNameA, GetStartupInfoA > ole32.dll: OleBuildVersion, OleSetContainedObject, MkParseDisplayName, CreateOleAdviseHolder, CoGetClassObject, OleCreate, ProgIDFromCLSID, CoTreatAsClass, GetClassFile > OLEAUT32.dll: - > VERSION.dll: VerFindFileA > ADVAPI32.dll: InitiateSystemShutdownW, RegLoadKeyA, GetTokenInformation, CreateServiceA, SetFileSecurityW, GetFileSecurityW, FreeSid, CryptCreateHash, InitializeAcl, LookupAccountNameW, AbortSystemShutdownW, IsValidAcl, RegQueryValueExA, RegisterServiceCtrlHandlerW, AccessCheckAndAuditAlarmW, AccessCheckAndAuditAlarmA, GetSidIdentifierAuthority, OpenSCManagerA, RegSetValueW, SetKernelObjectSecurity, SetSecurityDescriptorDacl, RegReplaceKeyW, ImpersonateLoggedOnUser, RegCreateKeyExW, GetSidSubAuthorityCount, RegOpenKeyW, InitializeSid, NotifyChangeEventLog, RegNotifyChangeKeyValue, MakeSelfRelativeSD, QueryServiceConfigA, ClearEventLogW, CloseEventLog, RegQueryValueA, CreatePrivateObjectSecurity, QueryServiceLockStatusW, ChangeServiceConfigA, RegEnumKeyExA, QueryServiceConfigW, AllocateLocallyUniqueId, GetSecurityDescriptorOwner, GetExplicitEntriesFromAclW, IsValidSid > USER32.dll: CharLowerA, TranslateAcceleratorW, DrawTextExA, SendDlgItemMessageA > SHELL32.dll: DragQueryPoint, SHGetSpecialFolderPathA, ExtractIconA, FindExecutableW, FindExecutableA, SHChangeNotify, ExtractIconExW > GDI32.dll: ExtCreateRegion, SetDIBColorTable, SetTextColor, WidenPath, ResizePalette, CreateDIBitmap, GetPaletteEntries, GetBkColor, CreateDiscardableBitmap, EqualRgn, RestoreDC, GdiComment, EnumFontFamiliesA, SelectObject, PolyBezier, SetPixelV, GetWindowExtEx > MSVCRT.dll: _controlfp, _except_handler3, __set_app_type, __p__fmode, __p__commode, _adjust_fdiv, __setusermatherr, _initterm, __getmainargs, _acmdln, exit, _XcptFilter, _exit, vsprintf, isxdigit, strspn, strrchr, _umask, vprintf, _ecvt, _wstrdate, fputs, _strnicmp, _wcslwr, atoi, wcscoll, fread, _wcsnset, _wtoi, _strrev, strtoul, _vsnprintf, __p___argc, fputwc, realloc, mbstowcs, towupper, _mbsnbicmp, _popen, wcscpy, swprintf, fwrite, wcscat, _setmode, _ismbcspace, setvbuf, free, _wcsrev, mbtowc, wcstombs, sprintf, gmtime, _ltow, _mbsrchr, floor, memmove, asctime, _mbscmp, longjmp, _wputenv, iswxdigit, iswdigit, __doserrno, _wsplitpath, memchr ( 0 exports ) Prevx info: <a href='http://info.prevx.com/aboutprogramtext.asp?PX5=B09B395D00C7E43DC033040599FBF000A585DCA9' target='_blank'>http://info.prevx.com/aboutprogramtext.asp?PX5=B09B395D00C7E43DC033040599FBF000A585DCA9</a> |
Hallo Anna, ich spring mal kurz ein: Bitte lade Dir Navilog1 von IL-MAFIOSO herunter.
Hinweis: Navilog1.exe wir von einigen Antivirenprogrammen als bösartig erkannt. Dies ist ein Fehlalarm. Die Nachricht bitte ignorieren. ciao, andreas |
danke john.doe :aplaus: |
Hallo! Navilog1: Fehlermeldung von Vista: Gets.Path.exe nicht findbar Fehlermeldung vom Programm: Gets.Path.bat nicht gefunden; mehrfach erschien auch die Meldung "Zugriff verweigert" In dem ZIP war allerdings auch nur eine Datei. |
Start => Ausführen => msconfig (eintippeln) => OK => Karte: Tools => Benutzerkontoschutz deaktivieren => OK => Nochmal starten Vista :pfui: ciao, andreas |
Wird gmacht |
Hallo, Mal kurzer Zwischenbericht. Mein Nachbar ist wieder weg. Super Anti spyware läuft noch. Es ist schon fündig geworden Zwischen Ergebiss Trojan. Dropper/Gen 3 :eek: Adware. Tracking Cookie 128 :eek: Trojan. DNSChanger-Codec 1:eek: Adware. Vundo/Variant- MSFalke 1 :eek: |
Hattest Du schon Navilog1 laufen lassen? Wenn nicht, warte jetzt aber bis SuperAntiSpyware durch ist, ansonsten Logfile posten. |
Poste bitte alle Logs. Die Cookies sind völlig harmlos. Keine Angst. ciao, andreas |
SUPERAntiSpayware ist durch SUPERAntiSpyware Scan Log http://www.superantispyware.com Generated 02/16/2009 at 11:08 PM Application Version : 4.25.1012 Core Rules Database Version : 3761 Trace Rules Database Version: 1723 Scan type : Complete Scan Total Scan Time : 00:29:20 Memory items scanned : 757 Memory threats detected : 1 Registry items scanned : 7371 Registry threats detected : 2 File items scanned : 24240 File threats detected : 130 Trojan.Dropper/Gen C:\USERS\ANNA\APPDATA\LOCAL\AAESC.EXE C:\USERS\ANNA\APPDATA\LOCAL\AAESC.EXE [aaesc] C:\USERS\ANNA\APPDATA\LOCAL\AAESC.EXE Adware.Tracking Cookie C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\anna@realmedia[1].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\anna@partypoker[1].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\anna@doubleclick[1].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@e-2dj6wmlikpc5sgp.stats.esomniture[1].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@adsrv.admediate[1].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@e-2dj6wmlosmazwlo.stats.esomniture[1].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@zanox[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@adrevolver[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@www.sexpartnerclub[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@e-2dj6wgkyepdpghp.stats.esomniture[1].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@www.affiliclicks[1].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@www.etracker[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@advertentie[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@sevenoneintermedia.112.2o7[1].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@ads.planetactive[1].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@zanox-affiliate[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@trunitybe2.122.2o7[1].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@specificclick[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@adopt.euroclick[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@ad.adition[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@werbeartikel-discount[1].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@tto2.traffictrack[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@deutschepostag.112.2o7[1].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@revsci[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@de2.komtrack[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@ads.heias[1].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@adserver.nordprovider[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@rotator.adjuggler[1].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@e-2dj6wjlialajalo.stats.esomniture[1].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@ad.71i[1].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@ads.quartermedia[1].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@serving-sys[1].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@overture[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@e-2dj6wfmycmc5ceo.stats.esomniture[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@roitracking[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@euros4click[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@e-2dj6wfmiakdzwfp.stats.esomniture[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@adserver.71i[1].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@e-2dj6wdmyqodzwdp.stats.esomniture[1].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@tradedoubler[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@auktionclick[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@content.yieldmanager[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@content.yieldmanager[3].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@www.googleadservices[11].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@www.googleadservices[10].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@www.googleadservices[4].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@e-2dj6wck4qhdjwbp.stats.esomniture[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@www.googleadservices[9].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@e-2dj6wjk4siczkap.stats.esomniture[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@www.googleadservices[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@atdmt[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@e-2dj6wglygpazcbq.stats.esomniture[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@zedo[1].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@cms.trafficmp[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@e-2dj6wcl4klc5ihp.stats.esomniture[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@www.googleadservices[3].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@e-2dj6wdk4aldzclp.stats.esomniture[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@webmasterplan[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@e-2dj6wfkyghajccp.stats.esomniture[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@e-2dj6wakywiajskq.stats.esomniture[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@advertising[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@www.zanox-affiliate[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@komtrack[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@bluestreak[1].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@adbrite[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@imrworldwide[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@weborama[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@mediaplex[1].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@e-2dj6wfkyandpagp.stats.esomniture[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@ads.horse2buy[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@im.banner.t-online[1].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@e-2dj6wjmiqicjmcp.stats.esomniture[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@doubleclick[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@atwola[1].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@media6degrees[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@www.active-tracking[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@adtech[1].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@ads.partnerbridge[1].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@ad1.elcuban[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@hasenet.122.2o7[1].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@adultfriendfinder[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@adviva[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@realmedia[1].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@ad.zanox[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@ad.yieldmanager[1].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@statse.webtrendslive[1].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@cetelemgroupgermany.solution.weborama[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@e-2dj6wdliwldzslp.stats.esomniture[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@e-2dj6wgmyugd5glq.stats.esomniture[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@ad.salebroker[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@e-2dj6wbl4oldpkco.stats.esomniture[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@fastclick[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@tracking.mlsat02[1].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@nacamar.adbureau[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@content.yieldmanager.edgesuite[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@tracking.11880[3].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@track.webtrekk[1].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@a7.adserver01[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@tracking.quisma[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@bs.serving-sys[1].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@ads.glispa[1].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@snapfish.112.2o7[1].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@ad.ad-srv[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@e-2dj6wjmiupdjico.stats.esomniture[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@rm.yieldmanager[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@media.adrevolver[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@adfarm1.adition[1].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@e-2dj6wclouhdpegp.stats.esomniture[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@e-2dj6wmk4wicpgep.stats.esomniture[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@e-2dj6wjlieldjmfo.stats.esomniture[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@eas.apm.emediate[1].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@partypoker[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@2o7[1].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@ad.beepworld[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@allesklarcomag.112.2o7[1].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@apmebf[1].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@cpx.mediascale[1].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@electronicarts.112.2o7[1].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@eas4.emediate[1].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@hamburgerabendblatt.122.2o7[1].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@indextools[1].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@lokalportal24de.112.2o7[1].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@paypal.112.2o7[1].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@statcounter[1].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@tracking.11880[1].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@traffictrack[2].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@xiti[1].txt C:\Users\ANNA\AppData\Roaming\Microsoft\Windows\Cookies\Low\anna@zbox.zanox[1].txt Trojan.DNSChanger-Codec HKU\S-1-5-21-393450356-1960325762-854292540-1000\Software\fcn Adware.Vundo/Variant-MSFake C:\PROGRAM FILES\NAVILOG1\REG.EXE |
Bis auf den Dropper ist da nichts schlimmes, die letzte Meldung ist eine Falschmeldung. Es kann sein, dass du navilog nocheinmal laden musst. ciao, andreas |
Was muß ich jetzt mit Navilog machen, Es ist jetzt alles so eingestellt das es läuft, aber wie und wo muss ich dieses dokument öffnen ? (Grade Riesen Brett vorm Kopf) Wähle E für Englisch im Sprachenmenü - Fertisch Wähle 1 im nächsten Menü um "Suche" auszuwählen. Bestätige mit Enter. Die Dauer des Scans kann variieren, bitte abwarten. Wenn du aufgefordert wirst, eine Taste zu drücken, tue dies bitte. 1 Finde ich nicht , bellige taste und weiter - fertig Ein neues Dokument sollte erstellt und geöffnet werden: fixnavi.txt. ??? Bitte füge den Inhalt dieser Datei in deine nächste Antwort ein. Der Bericht wird außerdem im Hauptverzeichnis (z.B.: "C:\") erstellt. |
Start => Ausführen => notepad c:\fixnavi.txt (eintippeln) => OK => [Strg]a (alles wird markiert) => [Strg]c => Hier beim Trojanerboard => Antworten => in den großen weißen Kasten klicken => [Strg]v ciao, andreas |
Danke, Brett ist weg:aplaus: Search Navipromo version 3.7.4 began on 16.02.2009 at 23:59:06,50 !!! Warning, this report may include legitimate files/programs !!! !!! Post this report on the forum you are being helped !!! !!! Don't continue with removal unless instructed by an authorized helper !!! Fix running from C:\Program Files\navilog1 Updated on 16.02.2009 at 18h00 by IL-MAFIOSO Microsoft® Windows Vista™ Home Premium ( v6.0.6000 ) X86-based PC ( Multiprocessor Free : AMD Athlon(tm) 64 X2 Dual Core Processor 5000+ ) BIOS : )Phoenix - Award WorkstationBIOS v6.00PG USER : ANNA ( Administrator ) BOOT : Normal boot Antivirus : Norton Internet Security 2007 (Activated) Firewall : Norton Internet Security 2007 (Activated) C:\ (Local Disk) - NTFS - Total:216 Go (Free:149 Go) D:\ (Local Disk) - NTFS - Total:107 Go (Free:107 Go) E:\ (CD or DVD) - UDF - Total:4 Go (Free:3 Go) F:\ (USB) G:\ (USB) H:\ (USB) I:\ (USB) J:\ (USB) Search done in normal mode *** Searching for installed Software *** *** Search folders in "C:\Windows" *** *** Search folders in "C:\Program Files" *** *** Search folders in "c:\progra~2\micros~1\windows\startm~1\programs" *** *** Search folders in "c:\progra~2\micros~1\windows\startm~1" *** *** Search folders in "C:\ProgramData" *** *** Search folders in "c:\users\anna\appdata\roaming\micros~1\windows\startm~1\programs" *** *** Search folders in "C:\Users\ANNA\AppData\Local\virtualstore\Program Files" *** *** Search folders in "C:\Users\ANNA\AppData\Local" *** *** Search folders in "C:\Users\ANNA\AppData\Roaming" *** *** Search with GenericNaviSearch *** !!! Possibility of legitimate files in the result !!! !!! Must always be checked before manually deleting !!! * Scan in "C:\Windows\system32" * * Scan in "C:\Users\ANNA\AppData\Local\Microsoft" * * Scan in "C:\Users\ANNA\AppData\Local\virtualstore\windows\system32" * * Scan in "C:\Users\ANNA\AppData\Local" * Suspicious Files : rbgnyvab.exe found ! *** Search files *** *** Search specific Registry keys *** !! Following keys are not certainly all infected !! [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "aaesc"="\"c:\\users\\anna\\appdata\\local\\aaesc.exe\" aaesc" *** Complementary Search *** (Search specific files) 1)Search new Instant Access files : 2)Heuristic Search : * In "C:\Windows\system32" : * In "C:\Users\ANNA\AppData\Local\Microsoft" : * In "C:\Users\ANNA\AppData\Local\virtualstore\windows\system32" : * In "C:\Users\ANNA\AppData\Local" : aaesc.dat found ! aaesc_nav.dat found ! aaesc_navps.dat found ! 3)Certificates Search : Egroup certificate found ! Electronic-Group certificate found ! Montorgueil certificate not found ! OOO-Favorit certificate found ! Sunny-Day-Design-Ltd certificate not found ! 4)Search others known folders and files : *** Search completed on 17.02.2009 at 0:00:03,49 *** |
| Alle Zeitangaben in WEZ +1. Es ist jetzt 00:59 Uhr. |
Copyright ©2000-2025, Trojaner-Board