| Pfauchen | 17.04.2014 22:18 |
Mail-Anhang wurde geöffnet 11-suche.xml (Win.Trojan.Agent-516645, Win.Trojan.Delf-12000)
Hallo,
wie im Titel beschrieben, wurde ein Mail-Anhang "11-suche.xml" geöffnet.
Leider wurden schon einige Versuche unternommen Schadsoftware von diesem infizierten Rechner zu entfernen, mein Halbwissen lässt vermuten dass sich noch andere unbeliebten Gäste auf diesem Rechner breit gemacht haben.
Ich habe versucht die log-Dateien der unterschiedlichen Entfernungssoftware zusammenzutragen.
Vielleicht lässt sich noch etwas retten, nach Möglichkeit möchte ich eine Neuinstallation umgehen.
Folgende Log-Dateien wurden chronologisch (älteste zuerst) sortiert.
clamav 13.04.2014 11:49 (auf FOUNDS gekürzt) Code:
/mnt/sda2/Users/steffen/AppData/Roaming/Thunderbird/Profiles/yeiq49ps.default/Mail/pop3.web.de/Inbox: Heuristics.Phishing.Email.SpoofedDomainFOUND
/mnt/sda2/Users/steffen/AppData/Roaming/Thunderbird/Profiles/yeiq49ps.default/Mail/pop3.web.de/Trash: Heuristics.Phishing.Email.SpoofedDomain FOUND
/mnt/sda2/Program Files (x86)/InstallShield Installation Information/{F193FC0E-9E18-40FC-A974-509A1BDD240A}/ISSetup.dll: Win.Trojan.Agent-516645 FOUND
/mnt/sda2/Program Files (x86)/InstallShield Installation Information/{F193FC0E-9E18-40FC-A974-509A1BDD240A}/setup.exe: Win.Trojan.Agent-516645 FOUND
/mnt/sda2/Program Files (x86)/Samsung/Samsung New PC Studio/NPSCDRipper.exe: Win.Trojan.Delf-12000 FOUND
TDSSKiller 14.04.2014 08:55 Code:
20:39:50.0520 0x0b4c TDSS rootkit removing tool 3.0.0.31 Apr 11 2014 08:55:10
20:39:57.0540 0x0b4c ============================================================
20:39:57.0540 0x0b4c Current date / time: 2014/04/14 20:39:57.0540
20:39:57.0540 0x0b4c SystemInfo:
20:39:57.0540 0x0b4c
20:39:57.0540 0x0b4c OS Version: 6.1.7601 ServicePack: 1.0
20:39:57.0540 0x0b4c Product type: Workstation
20:39:57.0540 0x0b4c ComputerName: STEFFEN-HP
20:39:57.0540 0x0b4c UserName: steffen
20:39:57.0540 0x0b4c Windows directory: C:\Windows
20:39:57.0540 0x0b4c System windows directory: C:\Windows
20:39:57.0540 0x0b4c Running under WOW64
20:39:57.0540 0x0b4c Processor architecture: Intel x64
20:39:57.0540 0x0b4c Number of processors: 2
20:39:57.0540 0x0b4c Page size: 0x1000
20:39:57.0540 0x0b4c Boot type: Normal boot
20:39:57.0540 0x0b4c ============================================================
20:40:07.0306 0x0b4c KLMD registered as C:\Windows\system32\drivers\87199212.sys
20:40:29.0504 0x0b4c System UUID: {749449C3-4E9F-E536-ECE5-26B29C0EAF45}
20:40:39.0800 0x0b4c Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
20:40:45.0260 0x0b4c Drive \Device\Harddisk1\DR1 - Size: 0x1D1A00000 (7.28 Gb), SectorSize: 0x200, Cylinders: 0x3B5, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
20:40:45.0276 0x0b4c ============================================================
20:40:45.0276 0x0b4c \Device\Harddisk0\DR0:
20:40:45.0292 0x0b4c MBR partitions:
20:40:45.0292 0x0b4c \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x63800
20:40:45.0292 0x0b4c \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x64000, BlocksNum 0x234EB800
20:40:45.0292 0x0b4c \Device\Harddisk0\DR0\Partition3: MBR, Type 0x7, StartLBA 0x2354F800, BlocksNum 0x1EAB000
20:40:45.0292 0x0b4c \Device\Harddisk0\DR0\Partition4: MBR, Type 0xC, StartLBA 0x253FA800, BlocksNum 0x33AB0
20:40:45.0292 0x0b4c \Device\Harddisk1\DR1:
20:40:45.0292 0x0b4c MBR partitions:
20:40:45.0292 0x0b4c \Device\Harddisk1\DR1\Partition1: MBR, Type 0xB, StartLBA 0x800, BlocksNum 0xE8C800
20:40:45.0292 0x0b4c ============================================================
20:40:45.0463 0x0b4c C: <-> \Device\Harddisk0\DR0\Partition2
20:40:45.0526 0x0b4c D: <-> \Device\Harddisk0\DR0\Partition3
20:40:45.0572 0x0b4c H: <-> \Device\Harddisk0\DR0\Partition4
20:40:45.0572 0x0b4c ============================================================
20:40:45.0572 0x0b4c Initialize success
20:40:45.0572 0x0b4c ============================================================
20:40:50.0954 0x0f98 Deinitialize success
AdwCleaner 14.04.2014 20:45 Code:
# AdwCleaner v3.023 - Bericht erstellt am 14/04/2014 um 20:45:11
# Aktualisiert 01/04/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : steffen - STEFFEN-HP
# Gestartet von : C:\___\Anti\AdwCleaner.exe
# Option : Suchen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Datei Gefunden : C:\Users\steffen\AppData\Roaming\Mozilla\Firefox\Profiles\9smjhw2i.default\searchplugins\11-suche.xml
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.16521
-\\ Mozilla Firefox v28.0 (de)
[ Datei : C:\Users\steffen\AppData\Roaming\Mozilla\Firefox\Profiles\9smjhw2i.default\prefs.js ]
*************************
AdwCleaner[R0].txt - [1105 octets] - [14/04/2014 20:45:11]
########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [1165 octets] ##########
ComboFix 14.04.2014 00:38 Code:
ComboFix 14-04-12.01 - steffen 15.04.2014 0:38:54.2.2 - x64 MINIMAL
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.1643.865 [GMT 2:00]
ausgeführt von:: C:\___\Anti\ComboFix.exe
* Neuer Wiederherstellungspunkt wurde erstellt
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
C:\ProgramData\TEMP
C:\Windows\SysWow64\sfcfiles.dll . . . fehlt!!
C:\Windows\SysWow64\sfcfiles.dll . . . fehlt!!
C:\Windows\system32\drivers\ipsec.sys . . . fehlt!!
C:\Windows\system32\drivers\psched.sys . . . fehlt!!
HijackThis 16.04.2014 19:40 Code:
Logfile of Trend Micro HijackThis v2.0.5
Scan saved at 19:40:37, on 16.04.2014
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.16521)
FIREFOX: 28.0 (de)
Boot mode: Normal
Running processes:
C:\Program Files (x86)\G Data\TotalProtection\Firewall\GDFirewallTray.exe
C:\Program Files (x86)\G Data\TotalProtection\AVKTray\AVKTray.exe
C:\Program Files (x86)\1&1 Surf-Stick\UIExec.exe
C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
C:\Program Files (x86)\G Data\TotalProtection\Firewall\GDFwAdmin.exe
C:\___\Anti\HiJackThis2\hijackthis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.1und1.de/starthp?src=s_startpage
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
O2 - BHO: IESpeakDoc - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [GDFirewallTray] C:\Program Files (x86)\G Data\TotalProtection\Firewall\GDFirewallTray.exe
O4 - HKLM\..\Run: [G Data AntiVirus Tray] C:\Program Files (x86)\G Data\TotalProtection\AVKTray\AVKTray.exe
O4 - HKLM\..\Run: [UIExec] "C:\Program Files (x86)\1&1 Surf-Stick\UIExec.exe"
O9 - Extra button: (no name) - {7815BE26-237D-41A8-A98F-F7BD75F71086} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll
O9 - Extra 'Tools' menuitem: Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O17 - HKLM\System\CCS\Services\Tcpip\..\{5A42A7C1-9B3B-4788-8E49-EAE37F0362D3}: NameServer = 139.7.30.126 139.7.30.125
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Andrea RT Filters Service (AERTFilters) - Andrea Electronics Corporation - C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: AMD FUEL Service - Advanced Micro Devices, Inc. - C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
O23 - Service: G Data AntiVirus Proxy (AVKProxy) - G Data Software AG - C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe
O23 - Service: G Data Scheduler (AVKService) - G Data Software AG - C:\Program Files (x86)\G Data\TotalProtection\AVK\AVKService.exe
O23 - Service: G Data Dateisystem Wächter (AVKWCtl) - G Data Software AG - C:\Program Files (x86)\G Data\TotalProtection\AVK\AVKWCtlX64.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: G Data Backup Service (GDBackupSvc) - G Data Software AG - C:\Program Files (x86)\G Data\TotalProtection\AVKBackup\AVKBackupService.exe
O23 - Service: G Data Personal Firewall (GDFwSvc) - G Data Software AG - C:\Program Files (x86)\G Data\TotalProtection\Firewall\GDFwSvcx64.exe
O23 - Service: G Data Scanner (GDScan) - G Data Software AG - C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe
O23 - Service: G Data Tuner Service (GDTunerSvc) - G Data Software AG - C:\Program Files (x86)\G Data\TotalProtection\AVKTuner\AVKTunerService.exe
O23 - Service: HP Support Assistant Service - Hewlett-Packard Company - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
O23 - Service: HP Wireless Assistant Service - Hewlett-Packard Company - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe
O23 - Service: HP Software Framework Service (hpqwmiex) - Hewlett-Packard Company - C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
O23 - Service: HPWMISVC - Hewlett-Packard Development Company, L.P. - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
O23 - Service: IconMan_R - Realsil Microelectronics Inc. - C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: G Data Datensafe Service (TSNxGService) - G Data Software - C:\Program Files (x86)\G Data\TotalProtection\TSNxG\TSNxGService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
--
End of file - 7682 bytes
GMER 17.04.2014 21:59 Code:
GMER 2.1.19355 - hxxp://www.gmer.net
Rootkit scan 2014-04-17 21:59:58
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\0000006d SAMSUNG_ rev.2AJ1 298,09GB
Running: gmer.exe; Driver: C:\Users\steffen\AppData\Local\Temp\FreeCommanderPortableTemp\kwdiqkob.sys
---- User code sections - GMER 2.1 ----
.text C:\___\fc\App\FreeCommanderXE\FreeCommander.exe[1456] C:\Windows\syswow64\kernel32.dll!CreateThread + 28 0000000076c934b1 4 bytes {CALL 0xffffffff8983d5b8}
---- Processes - GMER 2.1 ----
Library C:\Users\steffen\AppData\Local\Temp\nsy2740.tmp\System.dll (*** suspicious ***) @ C:\___\fc\FreeCommanderPortable.exe [1380](2014-04-17 0000000075580000
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\74de2b95290b
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\74de2b95290b@606bbd0ca228 0x15 0x58 0xB1 0xF0 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\74de2b95290b@34c3acea6b15 0x73 0xC0 0x8D 0x9C ...
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\74de2b95290b (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\74de2b95290b@606bbd0ca228 0x15 0x58 0xB1 0xF0 ...
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\74de2b95290b@34c3acea6b15 0x73 0xC0 0x8D 0x9C ...
---- EOF - GMER 2.1 ----
|
FRST 32-Bit | FRST 64-Bit
WARNUNG an die MITLESER: