|
Naja was soll man machen =/ Hier ist 4)^^ Blacklight: 11/29/08 00:19:10 [Info]: BlackLight Engine 2.2.1092 initialized 11/29/08 00:19:10 [Info]: OS: 5.1 build 2600 (Service Pack 2) 11/29/08 00:19:10 [Note]: 7019 4 11/29/08 00:19:10 [Note]: 7005 0 11/29/08 00:19:17 [Note]: 7006 0 11/29/08 00:19:17 [Note]: 7011 1664 11/29/08 00:19:17 [Note]: 7035 0 11/29/08 00:19:17 [Note]: 7026 0 11/29/08 00:19:17 [Note]: 7026 0 11/29/08 00:19:19 [Note]: FSRAW library version 1.7.1024 11/29/08 00:22:13 [Note]: 7007 0 Und Malwarebytes Anti-Malware Malwarebytes' Anti-Malware 1.30 Datenbank Version: 1433 Windows 5.1.2600 Service Pack 2 29.11.2008 01:00:10 mbam-log-2008-11-29 (01-00-10).txt Scan-Methode: Vollständiger Scan (C:\|D:\|) Durchsuchte Objekte: 118935 Laufzeit: 26 minute(s), 34 second(s) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 5 Infizierte Registrierungsschlüssel: 12 Infizierte Registrierungswerte: 5 Infizierte Dateiobjekte der Registrierung: 5 Infizierte Verzeichnisse: 5 Infizierte Dateien: 47 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: C:\WINDOWS\system32\gafuyowo.dll (Trojan.Vundo.H) -> Delete on reboot. C:\WINDOWS\system32\tosokevo.dll (Trojan.Vundo) -> Delete on reboot. C:\WINDOWS\system32\nukatojo.dll (Trojan.Vundo) -> Delete on reboot. C:\WINDOWS\system32\wogutopa.dll (Trojan.Vundo) -> Delete on reboot. c:\WINDOWS\system32\dakegopu.dll (Trojan.BHO) -> Delete on reboot. Infizierte Registrierungsschlüssel: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c8ab6c4f-30b5-4251-9062-e9a242f3ab09} (Trojan.BHO.H) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{c8ab6c4f-30b5-4251-9062-e9a242f3ab09} (Trojan.BHO.H) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c8ab6c4f-30b5-4251-9062-e9a242f3ab09} (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.BHO) -> Delete on reboot. HKEY_CLASSES_ROOT\CLSID\{9afb8248-617f-460d-9366-d71cdeda3179} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{037c7b8a-151a-49e6-baed-cc05fcb50328} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1a93c934-025b-4c3a-b38e-9654a7003239} (Adware.Gamesbar) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6f282b65-56bf-4bd1-a8b2-a4449a05863d} (Adware.Gamesbar) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\tdss (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully. Infizierte Registrierungswerte: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\447d57b9 (Trojan.Vundo.H) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\muwadayupu (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.BHO) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ssodl (Trojan.BHO) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpm474e6425 (Trojan.Agent) -> Delete on reboot. Infizierte Dateiobjekte der Registrierung: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo) -> Data: c:\windows\system32\tosokevo.dll -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo) -> Data: c:\windows\system32\tosokevo.dll -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo) -> Data: system32\tosokevo.dll -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.BHO) -> Data: c:\windows\system32\dakegopu.dll -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.BHO) -> Data: system32\dakegopu.dll -> Delete on reboot. Infizierte Verzeichnisse: C:\Programme\Antivirus 2009 (Rogue.Antivirus 2009) -> Quarantined and deleted successfully. C:\Programme\InternetGameBox (Adware.EGDAccess) -> Quarantined and deleted successfully. C:\Programme\InternetGameBox\ressources (Adware.EGDAccess) -> Quarantined and deleted successfully. C:\Programme\InternetGameBox\ressources\favoris (Adware.EGDAccess) -> Quarantined and deleted successfully. C:\Programme\InternetGameBox\skins (Adware.EGDAccess) -> Quarantined and deleted successfully. Infizierte Dateien: C:\WINDOWS\system32\gafuyowo.dll (Trojan.Vundo.H) -> Delete on reboot. C:\WINDOWS\system32\owoyufag.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\jisagoyi.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\iyogasij.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\laroriwa.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\awiroral.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\tayanage.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\eganayat.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\zuyisuro.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\orusiyuz.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\nukatojo.dll (Trojan.BHO.H) -> Delete on reboot. C:\WINDOWS\system32\tosokevo.dll (Trojan.Vundo) -> Delete on reboot. C:\WINDOWS\system32\wogutopa.dll (Trojan.Vundo) -> Delete on reboot. c:\WINDOWS\system32\dakegopu.dll (Trojan.BHO) -> Delete on reboot. C:\WINDOWS\system32\deluguba.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\pikumivu.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\TDSSbrsr.dll (Trojan.TDSS) -> Quarantined and deleted successfully. C:\WINDOWS\system32\TDSSoiqh.dll (Trojan.TDSS) -> Quarantined and deleted successfully. C:\WINDOWS\system32\TDSSriqp.dll (Trojan.TDSS) -> Quarantined and deleted successfully. C:\WINDOWS\system32\tehunevo.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\bisomasu.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\jibuvuna.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\cmdow.exe (Malware.Tool) -> Quarantined and deleted successfully. C:\WINDOWS\system32\drivers\TDSSpqlt.sys (Trojan.TDSS) -> Quarantined and deleted successfully. C:\WINDOWS\Temp\TDSS2a85.tmp (Trojan.TDSS) -> Quarantined and deleted successfully. C:\WINDOWS\Temp\TDSS2ce7.tmp (Trojan.TDSS) -> Quarantined and deleted successfully. C:\WINDOWS\Temp\TDSS2de1.tmp (Trojan.TDSS) -> Quarantined and deleted successfully. C:\WINDOWS\Temp\TDSS2edb.tmp (Trojan.TDSS) -> Quarantined and deleted successfully. C:\WINDOWS\Temp\TDSS31c9.tmp (Trojan.TDSS) -> Quarantined and deleted successfully. C:\WINDOWS\Temp\TDSScb78.tmp (Trojan.TDSS) -> Quarantined and deleted successfully. C:\Programme\InternetGameBox\InternetGameBox.exe (Adware.EGDAccess) -> Quarantined and deleted successfully. C:\Programme\InternetGameBox\language (Adware.EGDAccess) -> Quarantined and deleted successfully. C:\Programme\InternetGameBox\ressources\AttenteOff.html (Adware.EGDAccess) -> Quarantined and deleted successfully. C:\Programme\InternetGameBox\ressources\AttenteOn.html (Adware.EGDAccess) -> Quarantined and deleted successfully. C:\Programme\InternetGameBox\ressources\configv2_en.xml (Adware.EGDAccess) -> Quarantined and deleted successfully. C:\Programme\InternetGameBox\ressources\configv2_es.xml (Adware.EGDAccess) -> Quarantined and deleted successfully. C:\Programme\InternetGameBox\ressources\configv2_fr.xml (Adware.EGDAccess) -> Quarantined and deleted successfully. C:\Programme\InternetGameBox\ressources\favoris\defaultv2.swf (Adware.EGDAccess) -> Quarantined and deleted successfully. C:\Programme\InternetGameBox\skins\skinv2.skn (Adware.EGDAccess) -> Quarantined and deleted successfully. C:\WINDOWS\system32\TDSSlxwp.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\Temp\TDSS272a.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\WINDOWS\Temp\TDSSc723.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Dokumente und Einstellungen\Besitzer\Lokale Einstellungen\Temp\TDSSa6a1.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Dokumente und Einstellungen\Besitzer\Lokale Einstellungen\Temp\TDSSb8ea.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Dokumente und Einstellungen\Besitzer\Lokale Einstellungen\Temp\TDSSb8fa.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Dokumente und Einstellungen\Besitzer\Lokale Einstellungen\Temp\TDSSbb3c.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\WINDOWS\system32\TDSStkdu.log (Trojan.TDSS) -> Quarantined and deleted successfully. |
|
:daumenhoc |
Und 6. Und 7. und letztends :Boogie: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 01:33:25, on 29.11.2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\RTHDCPL.EXE C:\Programme\Adobe\Acrobat 7.0\Distillr\Acrotray.exe C:\Programme\CyberLink\PowerDVD\PDVDServ.exe C:\Programme\Winamp\winampa.exe C:\Programme\Java\jre1.6.0_07\bin\jusched.exe C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE C:\WINDOWS\vsnpstd3.exe C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\WINDOWS\system32\ctfmon.exe C:\Programme\Nokia\Nokia PC Suite 6\PcSync2.exe C:\Programme\Windows Live\Messenger\MsnMsgr.Exe C:\Programme\Internet Explorer\iexplore.exe C:\Programme\Ulead Systems\Ulead Photo Express 2 SE\CalCheck.exe C:\PROGRA~1\GEMEIN~1\Nokia\MPAPI\MPAPI3s.exe C:\Programme\Internet Explorer\iexplore.exe C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\Programme\Gemeinsame Dateien\PCSuite\Services\ServiceLayer.exe C:\Programme\Skype\Phone\Skype.exe C:\Programme\Skype\Plugin Manager\skypePM.exe C:\Programme\TeamViewer3\TeamViewer.exe C:\Programme\Mozilla Firefox\firefox.exe C:\Dokumente und Einstellungen\Besitzer\Desktop\qlketzd.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mystart.magentic.com/english/ O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar2.dll O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programme\Windows Live Toolbar\msntb.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programme\Windows Live Toolbar\msntb.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar2.dll O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Programme\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" O4 - HKLM\..\Run: [RemoteControl] C:\Programme\CyberLink\PowerDVD\PDVDServ.exe O4 - HKLM\..\Run: [WinampAgent] C:\Programme\Winamp\winampa.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [PE2CKFNT SE] C:\Programme\Ulead Systems\Ulead Photo Express 2 SE\ChkFont.exe O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [PcSync] C:\Programme\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog O4 - HKCU\..\Run: [MsnMsgr] "C:\Programme\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [swg] C:\Programme\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [idle 01] C:\DOKUME~1\Besitzer\ANWEND~1\PLANIN~1\bold logo mode.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST') O4 - HKUS\S-1-5-19\..\Run: [muwadayupu] Rundll32.exe "C:\WINDOWS\system32\wogutopa.dll",s (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Acrobat - Schnellstart.lnk = ? O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Photo Express Calendar Checker SE.lnk = C:\Programme\Ulead Systems\Ulead Photo Express 2 SE\CalCheck.exe O8 - Extra context menu item: &Windows Live Search - res://C:\Programme\Windows Live Toolbar\msntb.dll/search.htm O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: In Adobe PDF konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: In vorhandene PDF-Datei konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/DE-DE/a-UNO1/GAME_UNO1.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1223386906142 O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL O23 - Service: Adobe LM Service - Adobe Systems - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Avira AntiVir Personal - Free Antivirus Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: ServiceLayer - Nokia. - C:\Programme\Gemeinsame Dateien\PCSuite\Services\ServiceLayer.exe O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Programme\TuneUpUtilities2004\WinStylerThemeSvc.exe -- End of file - 9725 bytes So,ich hoffe das wars jetzt xD (Und ich hoff,ich hab richtig geschaut wegen Links und privaten Infos) |
Wir sind noch nicht fertig :( 1.) Folgende Dateien bei Virustotal.com auswerten lassen und alle Ergebnisse posten, und zwar so, daß man die der einzelnen Virenscanner sehen kann. Bitte mit Dateigrößen und Prüfsummen: Code: C:\Dokumente und Einstellungen\Besitzer\Desktop\qlketzd.com |
qlketzd.com Antivirus Version letzte aktualisierung Ergebnis AhnLab-V3 2008.11.28.2 2008.11.28 - AntiVir 7.9.0.36 2008.11.28 - Authentium 5.1.0.4 2008.11.28 - Avast 4.8.1281.0 2008.11.28 - AVG 8.0.0.199 2008.11.29 - BitDefender 7.2 2008.11.29 - CAT-QuickHeal 10.00 2008.11.28 - ClamAV 0.94.1 2008.11.28 - DrWeb 4.44.0.09170 2008.11.29 - eSafe 7.0.17.0 2008.11.27 Suspicious File eTrust-Vet 31.6.6234 2008.11.28 - Ewido 4.0 2008.11.28 - F-Prot 4.4.4.56 2008.11.28 - F-Secure 8.0.14332.0 2008.11.29 - Fortinet 3.117.0.0 2008.11.29 - GData 19 2008.11.29 - Ikarus T3.1.1.45.0 2008.11.28 - K7AntiVirus 7.10.537 2008.11.28 - Kaspersky 7.0.0.125 2008.11.29 - McAfee 5448 2008.11.28 - McAfee+Artemis 5448 2008.11.28 - Microsoft 1.4104 2008.11.29 - NOD32 3650 2008.11.28 - Norman 5.80.02 2008.11.28 - Panda 9.0.0.4 2008.11.29 Suspicious file PCTools 4.4.2.0 2008.11.28 - Prevx1 V2 2008.11.29 - Rising 21.05.42.00 2008.11.28 - SecureWeb-Gateway 6.7.6 2008.11.28 - Sophos 4.36.0 2008.11.29 - Sunbelt 3.1.1832.2 2008.11.27 - Symantec 10 2008.11.28 - TheHacker 6.3.1.1.166 2008.11.28 - TrendMicro 8.700.0.1004 2008.11.28 - VBA32 3.12.8.9 2008.11.28 - ViRobot 2008.11.28.1491 2008.11.28 - VirusBuster 4.5.11.0 2008.11.28 - weitere Informationen File size: 401720 bytes MD5...: e8269245566be948f6a219135b434160 SHA1..: 1ac255b76ef692ea6c09d4840dcd28c67c5d6bfe SHA256: 3c253bfd385c7f245f3c6131e58cbe22c0d03073a828b9938f923f00562d7c2d SHA512: bed5aa905b0b940e99489c19835c1c199878ab7455bff84748b94a0577db8d8e ebd66c96a3fc6db110bb6fde95947837860eb701c01cb65cb73488c7a464bae8 ssdeep: 6144:KCjUfQ7DbE66sVHdkyUkEYn+nVewn+ob/xIytqi20dcUSGreicGGSzMZY:K CjUSbEAVG95YnNsr2ytL2cc3Gr1 PEiD..: UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser TrID..: File type identification UPX compressed Win32 Executable (39.5%) Win32 EXE Yoda's Crypter (34.3%) Win32 Executable Generic (11.0%) Win32 Dynamic Link Library (generic) (9.8%) Generic Win/DOS Executable (2.5%) PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x542830 timedatestamp.....: 0x466838c1 (Thu Jun 07 16:56:33 2007) machinetype.......: 0x14c (I386) ( 3 sections ) name viradd virsiz rawdsiz ntrpy md5 UPX0 0x1000 0xfc000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e UPX1 0xfd000 0x46000 0x45a00 7.93 8764d7eac0301131e6c79e4aa30317bf .rsrc 0x143000 0x1b000 0x1ae00 4.69 5f1a0873640fcdb4a281dbf91049814f ( 2 imports ) > KERNEL32.DLL: LoadLibraryA, GetProcAddress, VirtualProtect, ExitProcess > MSVBVM60.DLL: - ( 0 exports ) ThreatExpert info: <a href='http://www.threatexpert.com/report.aspx?md5=e8269245566be948f6a219135b434160' target='_blank'>http://www.threatexpert.com/report.aspx?md5=e8269245566be948f6a219135b434160</a> packers (Kaspersky): PE_Patch.UPX, UPX packers (F-Prot): UPX |
Und last but not least ;) bold_logo_mode.exe Antivirus Version letzte aktualisierung Ergebnis AhnLab-V3 2008.11.28.2 2008.11.28 - AntiVir 7.9.0.36 2008.11.28 - Authentium 5.1.0.4 2008.11.28 W32/Swizzor-based.2!Maximus Avast 4.8.1281.0 2008.11.28 Win32:Swizzor-N AVG 8.0.0.199 2008.11.28 - BitDefender 7.2 2008.11.29 Trojan.Swizzor.2 CAT-QuickHeal 10.00 2008.11.28 - ClamAV 0.94.1 2008.11.28 - DrWeb 4.44.0.09170 2008.11.29 Trojan.Swizzor.based eSafe 7.0.17.0 2008.11.27 - eTrust-Vet 31.6.6234 2008.11.28 - Ewido 4.0 2008.11.28 - F-Prot 4.4.4.56 2008.11.28 W32/Swizzor-based.2!Maximus F-Secure 8.0.14332.0 2008.11.29 Trojan.Win32.Obfuscated.gen Fortinet 3.117.0.0 2008.11.29 W32/Obfuscated!tr GData 19 2008.11.28 Trojan.Swizzor.2 Ikarus T3.1.1.45.0 2008.11.28 Trojan.Swizzor.1 K7AntiVirus 7.10.537 2008.11.28 - Kaspersky 7.0.0.125 2008.11.29 Trojan.Win32.Obfuscated.gen McAfee 5448 2008.11.28 - McAfee+Artemis 5448 2008.11.28 - Microsoft 1.4104 2008.11.29 - NOD32 3650 2008.11.28 - Norman 5.80.02 2008.11.28 - Panda 9.0.0.4 2008.11.29 Adware/Lop PCTools 4.4.2.0 2008.11.28 - Prevx1 V2 2008.11.29 - Rising 21.05.42.00 2008.11.28 Trojan.DL.Win32.Swizzor.cx SecureWeb-Gateway 6.7.6 2008.11.28 - Sophos 4.36.0 2008.11.29 - Sunbelt 3.1.1832.2 2008.11.27 - Symantec 10 2008.11.28 - TheHacker 6.3.1.1.166 2008.11.28 - TrendMicro 8.700.0.1004 2008.11.28 - VBA32 3.12.8.9 2008.11.28 OScope.Trojan.BagsWay.C ViRobot 2008.11.28.1491 2008.11.28 - VirusBuster 4.5.11.0 2008.11.28 - weitere Informationen File size: 509440 bytes MD5...: 671f32380554fb0f97ef09278c56b63b SHA1..: 954616c926df2aef357a70eb91f8960c18ff7f01 SHA256: be49356f56407e61559bda6dcc5a7f6f2f3bbf13c4c671576847d169e12d33c6 SHA512: b0e0e6a41ec01c060d6939762dd097c1e9905e86a8a09fbe1c455e501070b9b4 8ab78115f7ad43f1332a5d803828a5358c80a8b35b9f3369452cdac151de7dde ssdeep: 12288:PlS+3zM5M2o9IDdYXvgDUtUN+O+ct+NzXXV6na/tDpUFbm:NBM5pBrDUtU LyBnknapEK PEiD..: Armadillo v1.71 TrID..: File type identification Win32 Executable MS Visual C++ (generic) (65.2%) Win32 Executable Generic (14.7%) Win32 Dynamic Link Library (generic) (13.1%) Generic Win/DOS Executable (3.4%) DOS Executable Generic (3.4%) PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x412b98 timedatestamp.....: 0x473f8813 (Sun Nov 18 00:32:19 2007) machinetype.......: 0x14c (I386) ( 4 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x1000 0x27a52 0x27c00 6.37 6c8eed0d23f6f098f86bcca05b2d6f3c .rdata 0x29000 0x36954 0x33c00 8.00 c7148b0ed75cbb47596771c9a0ec846c .data 0x60000 0x1b7dd 0x1b800 7.36 25d57300a252d7516f5b87f85effe61b .rsrc 0x7c000 0x51bb 0x5200 4.30 77191f4cc426764b75535bded9eb7019 ( 5 imports ) > KERNEL32.dll: GetProcAddress, SetEnvironmentVariableA, GetModuleHandleA, GetTimeZoneInformation, GetFileType, CompareStringA, GetCurrentProcess, GetOEMCP, SetFilePointer, InitializeCriticalSection, CompareStringW, EnterCriticalSection, EnumResourceNamesW, LCMapStringA, LeaveCriticalSection, FlushFileBuffers, SetStdHandle, GetModuleFileNameA, GetLocalTime, GetEnvironmentVariableW, GetCurrentProcessId, SetLastError, CreateMutexA, GetLogicalDrives, GetStartupInfoA, MultiByteToWideChar, OpenWaitableTimerW, GetPrivateProfileSectionNamesA, InterlockedExchange, TerminateProcess, GetTickCount, IsBadWritePtr, GetCommandLineA, CompareFileTime, GlobalFlags, OpenMutexA, GetACP, QueryPerformanceCounter, ExitProcess, CloseHandle, HeapAlloc, HeapCreate, WriteFile, GetConsoleTitleW, DeleteCriticalSection, VirtualFree, LoadLibraryA, GetCPInfo, VirtualAlloc, GetVersion, TlsGetValue, HeapReAlloc, GetCurrentThreadId, LCMapStringW, GetAtomNameA, HeapFree, SetCriticalSectionSpinCount, SetWaitableTimer, TlsSetValue, GetLastError, GetEnvironmentStringsW, GetStringTypeA, WideCharToMultiByte, HeapDestroy, WaitForDebugEvent, GetStringTypeW, GetCurrentThread, FreeEnvironmentStringsW, FreeEnvironmentStringsA, GetSystemTime, ReadFile, GetEnvironmentStrings, VirtualQuery, TlsFree, InterlockedDecrement, SetHandleCount, GetStdHandle, GetSystemTimeAsFileTime, UnhandledExceptionFilter, GetSystemDefaultLCID, TlsAlloc, RtlUnwind, InterlockedIncrement > USER32.dll: SendIMEMessageExW, DefWindowProcW, MessageBoxW, SetPropW, RegisterClassA, SetForegroundWindow, SetUserObjectInformationA, GrayStringW, ShowWindow, DestroyWindow, DdeQueryNextServer, DdeKeepStringHandle, RegisterClassExA, FindWindowExW, CreateWindowExW, VkKeyScanA > comdlg32.dll: ChooseFontA, LoadAlterBitmap, ChooseFontW > comctl32.dll: ImageList_LoadImageA, InitCommonControlsEx, ImageList_SetFlags, ImageList_GetImageCount, ImageList_SetDragCursorImage, DrawInsert, ImageList_GetIcon, ImageList_BeginDrag, ImageList_AddIcon, ImageList_Add, ImageList_Destroy, ImageList_Write, ImageList_DragShowNolock, DestroyPropertySheetPage, ImageList_GetFlags, CreateMappedBitmap, ImageList_DragMove, ImageList_SetBkColor, ImageList_Create, DrawStatusText > ADVAPI32.dll: CryptSignHashW, RegEnumValueW, RegEnumKeyExA, RegEnumKeyExW, RegQueryValueW ( 0 exports ) voll viele böse Viren :( |
1. Starte Hijackthis, Do a system scan only, markiere Code: O4 - HKCU\..\Run: [idle 01] C:\DOKUME~1\Besitzer\ANWEND~1\PLANIN~1\bold logo mode.exe2. Starte im abgesicherten Modus (F8) und löschen den Ordner Code: c:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\plan inside |
So beim Löschen des Ordners kam jetzt die Fehlermeldung: Die Datei "0" ist eine Systemdatei. Das System oder bestimmte Anwendungen können möglicherweise nicht fehlerfrei ausgeführt werden,wenn sie gelöscht wird.Möchten Sie den Löschvorgang durchführen? Auf ja klicken? Bevor noch was anderes kommt hab ich noch ne Frage ö.ö Und zwar:Wie siehts jetzt mit Avira und so aus,Avira ist noch drauf,am besten Deinstallieren oder? Und voll danke für die Hilfe,ich könnt dich abknutschen :):):) |
1. Deaktiviere zeitweilig dein Antivirenscanner 2. Download LOP-uninstall zum Desktop 3. Führe bei Uninstall verification die siebenstellige Zahl ein und klicke Uninstall 4. Klicke bei Legal notice ok 5. Schließe alle Fenster und klicke ok 6. Warte…..und klicke bei Uninstall complete for all users ok |
Zu früh gefreut,siehe oben xD |
1. Download Deljob.exe zum Desktop 2. Doppelklick auf Deljob.exe 3. Ein logfile wird sich öffnen (logit.txt) 4. Kopiere den Inhalt des Berichts logit.txt in diesen Thread. Sry, das ich nicht antworten konnte, habe mit 4 Fenstern gekämpft. |
Ach macht nichts :) Hilfst mir ja schon genug,dass du überhaupt antwortest^^ Und hier der Log -------------------------------------------------------- Backups created in C:\deljob AE220942918D8066.job -------------------------------------------------------- Files in Windows Tasks folder Auf Updates fr Windows Live Toolbar prfen.job -------------------------------------------------------- Export App Data folders -------------------------------------------------------- Volume in Laufwerk C: hat keine Bezeichnung. Volumeseriennummer: 447D-5716 Verzeichnis von C:\ProgramData 24.11.2008 07:32 <DIR> . 24.11.2008 07:32 <DIR> .. 24.11.2008 07:32 <DIR> RDPLAT~1.0 RD Platinum v5.0 0 Datei(en) 0 Bytes 3 Verzeichnis(se), 19.158.147.072 Bytes frei -------------------------------------------------------- All User Accounts -------------------------------------------------------- Administrator All Users Besitzer -------------------------------------------------------- Auch wenns nicht meine Frage wegen dem Ordner c:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\plan inside beantwortet,wegen der Fehlermeldung^^ |
Kontrolliere nochmal, ob der noch da ist, falls ja, löschen, egal wie Windows warnt und mault. Anschliessend rede ein ernstes Wort mit deiner Freundin und lasse dabei die Begriffe InternetGameBox und RD Platinum fallen. ;) |
wars das denn jetzt?^^ Und ernstes Wort red ich wohl eher mit ihrer Mama xD Und wie siehts nun am besten,wie schon gefragt mit Avira aus? Deinstallieren? Wenn ja,könntest du ein besseres Virenschutzprogramm empfehlen,also Freeware^^ Und nochmals voll fett Danke für die Hilfe =) |
| Alle Zeitangaben in WEZ +1. Es ist jetzt 21:58 Uhr. |
Copyright ©2000-2025, Trojaner-Board