Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   GVU-Trojaner schon wieder... (https://www.trojaner-board.de/135014-gvu-trojaner-schon.html)

markusg 03.06.2013 18:31

ersten Link angepasst

Cypher00 04.06.2013 10:55

Hier der Logfile nach dem Fix

Code:

All processes killed
========== OTL ==========
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{072E35EC-1E3A-F4EA-65B0-0D7D63EAC49F}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{072E35EC-1E3A-F4EA-65B0-0D7D63EAC49F}\ not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{cd90bf73-20f6-44ef-993d-bb920303bd2e} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cd90bf73-20f6-44ef-993d-bb920303bd2e}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{072E35EC-1E3A-F4EA-65B0-0D7D63EAC49F}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{072E35EC-1E3A-F4EA-65B0-0D7D63EAC49F}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D7A5C187-ED99-4C30-8795-5CAD44133D98}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D7A5C187-ED99-4C30-8795-5CAD44133D98}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{CD90BF73-20F6-44EF-993D-BB920303BD2E} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CD90BF73-20F6-44EF-993D-BB920303BD2E}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Ahytovl deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\ctfmon32.exe deleted successfully.
========== FILES ==========
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: FH
->Temp folder emptied: 33990 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 0 bytes
 
User: Manuel
->Temp folder emptied: 0 bytes
 
User: Public
->Temp folder emptied: 0 bytes
 
User: Sabine
->Temp folder emptied: 10268181 bytes
->Temporary Internet Files folder emptied: 254718427 bytes
->Java cache emptied: 275801 bytes
->Google Chrome cache emptied: 15608557 bytes
->Flash cache emptied: 13840 bytes
 
User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 14292 bytes
RecycleBin emptied: 12215108 bytes
 
Total Files Cleaned = 280,00 mb
 
 
OTL by OldTimer - Version 3.2.69.0 log created on 06042013_114304

Files\Folders moved on Reboot...

PendingFileRenameOperations files...

Registry entries deleted on Reboot...


markusg 05.06.2013 11:34

der Test fehlt noch :-)

Cypher00 05.06.2013 21:15

läuft alles in Ordnung,Toolbars finde ich keine aber java hat anscheinend manchmal Probleme Bilder im Browser zu laden,liegt aber vielleicht an der Seite da es nur dort passiert.
Malware reagiert auch immer wenn ich den IE starte,bekomme da immer eine Meldung.

Konte den Malware jetzt auf deutsch stellen,kann man nach der Installation einfach unter Einstellungen machen.

Andere Programme machen keine Probleme oder ich habe bis jetzt einfach keine gefunden.

markusg 05.06.2013 21:22

verstehe ich nich, in wie fern reagiert was?


Alle Zeitangaben in WEZ +1. Es ist jetzt 08:13 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131