Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Total Win 7 Security Tool Alert (https://www.trojaner-board.de/84477-total-win-7-security-tool-alert.html)

Discovery 03.04.2010 13:32
Total Win 7 Security Tool Alert
 
Hallo zusammen,
Total Win 7 Security Tool Alert hat sich von selbst installiert und hat zuerst mein normales AntiVir lahm gelegt.
Bei meinem Internet Explorer konnte ich gar keine Seite mehr öffnen, weil sich immer dieses Prgramm geöffnet hat und mir auf Englisch zuverstehen gab ein Update von 50-90$ zukaufen.
Dazu öffnete sich das Programm auch von alleine und wollte einen Suchlauf durchführen.

Allerdings funktionierte noch Firefox.
Habe mir dann Malwarebytes gedownloadet und damit einen Suchlauf gestartet und hier sind die Logs:
Hoffe jemand weiß damit was anzufangen

Malwarebytes' Anti-Malware 1.45
www.malwarebytes.org

Datenbank Version: 3948

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

03.04.2010 14:31:07
mbam-log-2010-04-03 (14-31-07).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 102913
Laufzeit: 2 Minute(n), 37 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 1
Infizierte Registrierungsschlüssel: 12
Infizierte Registrierungswerte: 13
Infizierte Dateiobjekte der Registrierung: 4
Infizierte Verzeichnisse: 34
Infizierte Dateien: 44

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
C:\Windows\System32\nmklo.dll (Worm.MarioFev) -> Delete on reboot.

Infizierte Registrierungsschlüssel:
HKEY_CLASSES_ROOT\AppID\{38061edc-40bb-4618-a8da-e56353347e6d} (Adware.EZlife) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a9ba40a1-74f1-52bd-f434-00b15a2c8953} (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{a9ba40a1-74f1-52bd-f434-00b15a2c8953} (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a9ba40a1-74f1-52bd-f434-00b15a2c8953} (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\YVIBBBHA8C (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Fci (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ezLife (Adware.EzLife) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\ezLife (Adware.EzLife) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\fci (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Handle (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\WEK9EMDHI9 (Trojan.Agent) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yvibbbha8c (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\canaveral (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ezlife (Adware.EZlife) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\userini (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\userini (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\userini (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\userini (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\idstrf (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\winid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\nofolderoptions (Hijack.FolderOptions) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hsa8ffushf83hoigjhs98jgijg9sd8e (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hsf87efjhdsf87f3jfsdi7fhsujfd (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ewrgetuj (Worm.Prolaco.M) -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Users\Zirpel\AppData\Local\ave.exe" /START "C:\Program Files (x86)\Mozilla Firefox\firefox.exe") Good: (firefox.exe) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Users\Zirpel\AppData\Local\ave.exe" /START "C:\Program Files (x86)\Internet Explorer\iexplore.exe") Good: (iexplore.exe) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Users\Zirpel\AppData\Local\ave.exe" /START "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -safe-mode) Good: (firefox.exe -safe-mode) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions (Hijack.FolderOptions) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Infizierte Verzeichnisse:
C:\ProgramData\92877437 (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AntiVirus Plus (Rogue.AntiVirusPlus) -> Quarantined and deleted successfully.
C:\Users\Zirpel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AntiVirus Plus (Rogue.AntiVirusPlus) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Internet Today (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Internet Today\1.2.0.1420 (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Web Search Operator (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Web Search Operator\4.2.0.2150 (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Web Search Operator\4.2.0.2150\Data (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Web Search Operator\4.2.0.2150\FF (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Web Search Operator\4.2.0.2150\FF\chrome (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Web Search Operator\4.2.0.2150\FF\chrome\content (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Web Search Operator\4.2.0.2150\FF\components (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Textual Content Provider (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Textual Content Provider\1.2.0.2040 (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Textual Content Provider\1.2.0.2040\data (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Automated Content Enhancer (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Automated Content Enhancer\4.2.0.5360 (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Automated Content Enhancer\4.2.0.5360\Data (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Automated Content Enhancer\4.2.0.5360\FF (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Automated Content Enhancer\4.2.0.5360\FF\chrome (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Automated Content Enhancer\4.2.0.5360\FF\chrome\content (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Automated Content Enhancer\4.2.0.5360\FF\components (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Customized Platform Advancer (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Customized Platform Advancer\4.2.0.2050 (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Customized Platform Advancer\4.2.0.2050\Data (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Customized Platform Advancer\4.2.0.2050\FF (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Customized Platform Advancer\4.2.0.2050\FF\chrome (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Customized Platform Advancer\4.2.0.2050\FF\chrome\content (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Customized Platform Advancer\4.2.0.2050\FF\components (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Content Management Wizard (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Content Management Wizard\1.2.0.2080 (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\ezLife (Adware.EzLife) -> Quarantined and deleted successfully.
C:\Program Files (x86)\ezLife\ezLife (Adware.EzLife) -> Quarantined and deleted successfully.
C:\Program Files (x86)\ezLife\ezLife\1.2.0.0 (Adware.EzLife) -> Quarantined and deleted successfully.

Infizierte Dateien:
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AntiVirus Plus\EULA.url (Rogue.AntiVirusPlus) -> Quarantined and deleted successfully.
C:\Users\Zirpel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AntiVirus Plus\EULA.url (Rogue.AntiVirusPlus) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Internet Today\1.2.0.1420\InternetToday.skf (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Internet Today\1.2.0.1420\unins000.dat (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Web Search Operator\4.2.0.2150\unins000.dat (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Web Search Operator\4.2.0.2150\Data\config.md (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Web Search Operator\4.2.0.2150\FF\install.rdf (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Web Search Operator\4.2.0.2150\FF\chrome\WSOAddOn.jar (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Web Search Operator\4.2.0.2150\FF\chrome\content\WSOAddOn.xul (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Web Search Operator\4.2.0.2150\FF\components\WSOFFAddOn.xpt (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Textual Content Provider\1.2.0.2040\unins000.dat (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Textual Content Provider\1.2.0.2040\data\pxtmpdata.mx (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Textual Content Provider\1.2.0.2040\data\TP_Config.mx (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Textual Content Provider\1.2.0.2040\data\TP_Data.mx (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Textual Content Provider\1.2.0.2040\data\TP_DomainExcludeList.mx (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Textual Content Provider\1.2.0.2040\data\TP_DomainInterval.mx (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Textual Content Provider\1.2.0.2040\data\TP_KeywordInterval.mx (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Automated Content Enhancer\4.2.0.5360\unins000.dat (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Automated Content Enhancer\4.2.0.5360\Data\config.md (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Automated Content Enhancer\4.2.0.5360\FF\install.rdf (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Automated Content Enhancer\4.2.0.5360\FF\chrome\ACEAddOn.jar (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Automated Content Enhancer\4.2.0.5360\FF\chrome\content\ACEAddOn.xul (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Automated Content Enhancer\4.2.0.5360\FF\components\ACEFFAddOn.xpt (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Customized Platform Advancer\4.2.0.2050\unins000.dat (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Customized Platform Advancer\4.2.0.2050\Data\config.md (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Customized Platform Advancer\4.2.0.2050\FF\install.rdf (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Customized Platform Advancer\4.2.0.2050\FF\chrome\CPAAddOn.jar (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Customized Platform Advancer\4.2.0.2050\FF\chrome\content\CPAAddOn.xul (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Customized Platform Advancer\4.2.0.2050\FF\components\CPAFFAddOn.xpt (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Content Management Wizard\1.2.0.2080\config.mx (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Content Management Wizard\1.2.0.2080\data.mx (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Content Management Wizard\1.2.0.2080\exclude.mx (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Content Management Wizard\1.2.0.2080\MatchingData.zd5 (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Content Management Wizard\1.2.0.2080\pxtmpdata.mx (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Content Management Wizard\1.2.0.2080\unins000.dat (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\ezLife\ezLife\1.2.0.0\uninstall.exe (Adware.EzLife) -> Quarantined and deleted successfully.
C:\Users\Zirpel\AppData\Local\Temp\Yzr.exe (Trojan.FakeAlert) -> Delete on reboot.
C:\ProgramData\sysReserve.ini (Malware.Trace) -> Quarantined and deleted successfully.
C:\Windows\System32\nmklo.dll (Worm.MarioFev) -> Delete on reboot.
C:\Windows\Tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Windows\System32\fci.exe.exe (Worm.Zhelatin) -> Quarantined and deleted successfully.
C:\Windows\mqcd.dbt (Malware.Trace) -> Quarantined and deleted successfully.
C:\Users\Zirpel\AppData\Roaming\avdrn.dat (Malware.Trace) -> Quarantined and deleted successfully.
C:\Users\Zirpel\AppData\Local\ave.exe (Rogue.MultipleAV) -> Quarantined and deleted successfully.

Discovery 03.04.2010 13:37
So der Schädling ist erstmal entfernt :)


Alle Zeitangaben in WEZ +1. Es ist jetzt 02:59 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131