Trojaner-Board
Seite 2 von 5 1 2 34 Letzte »
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   trojanisches Programm Exploit.Java.Agent.bb etc (https://www.trojaner-board.de/89988-trojanisches-programm-exploit-java-agent-bb-etc.html)

cosinus 26.08.2010 21:04
Viele mussten wegen TuneUp ihr System neu aufsetzen, weil es irgendwelche Einstellungen durchgeführt hat (keiner wusste was) und dann das System kaputt war oder in Zeitlupe lief. Das Tool ist reine Geldverschwendung.
Du kannst in so kurzer Zeit nicht den kompletten Artikel von derfisch gelesen haben, lies ihn!!

Außerdem dem Fund in TuneUp noch was anderes?

Hicke 26.08.2010 21:07
26.08.2010 21:43:23 Gefunden trojanisches Programm Exploit.Java.Agent.be c:\users\asus\anwendungsdaten\tuneup software\tuneup utilities\backups\00000021.rcb Hoch


nE ist auch tune up, aber zumindest frisch gefunden. wie bekomme ich das weg?

Hicke 26.08.2010 21:08
25.08.2010 00:16:27 Infiziert trojanisches Programm Packed.Win32.Krap.ar C:\Users\Asus\AppData\Roaming\Heicbe\opzew.exe Hoch

Hicke 26.08.2010 21:15
hab es nun gelesen. macht mich stutzig und nachdenklich.. was räumt denn dann gut den rechner auf?

cosinus 26.08.2010 21:16
Führ erstmal CF aus:


ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Lade dir ComboFix hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.
http://saved.im/mtm0nzyzmzd5/cofi.jpg
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Hicke 26.08.2010 22:07
Combofix Logfile:
Code:
ComboFix 10-08-26.02 - Asus 26.08.2010  22:44:11.1.2 - x86
Microsoft® Windows Vista™ Home Premium  6.0.6001.1.1252.49.1031.18.2047.1113 [GMT 2:00]
ausgeführt von:: c:\users\Asus\Desktop\cofi.exe\ComboFix.exe
FW: McAfee Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
SP: McAfee Anti-Virus und Anti-Spyware *disabled* (Updated) {C78B3C70-4777-4742-BB91-9D615CC575E6}
SP: Windows-Defender *enabled* (Outdated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\pdfforge Toolbar\WiDGitoolbarie.dll
c:\users\Asus\AppData\Local\abvpkwql.dat
c:\users\Asus\AppData\Local\abvpkwql_nav.dat
c:\users\Asus\AppData\Local\abvpkwql_navps.dat
c:\users\Asus\AppData\Roaming\MSA

.
(((((((((((((((((((((((  Dateien erstellt von 2010-07-26 bis 2010-08-26  ))))))))))))))))))))))))))))))
.

2010-08-26 20:56 . 2010-08-26 20:56        --------        d-----w-        c:\users\Default\AppData\Local\temp
2010-08-26 20:34 . 2010-08-26 20:34        --------        d-----w-        c:\program files\CCleaner
2010-08-25 18:52 . 2009-11-08 08:55        99176        ----a-w-        c:\windows\system32\PresentationHostProxy.dll
2010-08-25 18:52 . 2009-11-08 08:55        49472        ----a-w-        c:\windows\system32\netfxperf.dll
2010-08-25 18:52 . 2009-11-08 08:55        297808        ----a-w-        c:\windows\system32\mscoree.dll
2010-08-25 18:52 . 2009-11-08 08:55        295264        ----a-w-        c:\windows\system32\PresentationHost.exe
2010-08-25 18:52 . 2009-11-08 08:55        1130824        ----a-w-        c:\windows\system32\dfshim.dll
2010-08-24 21:55 . 2010-08-24 21:55        404152        ----a-w-        c:\programdata\Kaspersky Lab\AVP11\Data\Updater\Temporary Files\rollback\patch\AutoPatches\kav11\11.0.1.400\mcouas.dll
2010-08-24 21:55 . 2010-08-24 21:55        166584        ----a-w-        c:\programdata\Kaspersky Lab\AVP11\Data\Updater\Temporary Files\rollback\patch\AutoPatches\kav11\11.0.1.400\klwtblc.dll
2010-08-24 21:55 . 2010-08-24 21:55        125624        ----a-w-        c:\programdata\Kaspersky Lab\AVP11\Data\Updater\Temporary Files\rollback\patch\AutoPatches\kav11\11.0.1.400\shellex.dll
2010-08-24 21:55 . 2010-08-24 21:55        113336        ----a-w-        c:\programdata\Kaspersky Lab\AVP11\Data\Updater\Temporary Files\rollback\patch\AutoPatches\kav11\11.0.1.400\sbstart.exe
2010-08-24 21:55 . 2010-08-24 21:55        129720        ----a-w-        c:\programdata\Kaspersky Lab\AVP11\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav11\11.0.1.400\shellex.dll
2010-08-24 21:55 . 2010-08-24 21:55        113336        ----a-w-        c:\programdata\Kaspersky Lab\AVP11\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav11\11.0.1.400\sbstart.exe
2010-08-24 21:55 . 2010-08-24 21:55        404152        ----a-w-        c:\programdata\Kaspersky Lab\AVP11\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav11\11.0.1.400\mcouas.dll
2010-08-24 21:55 . 2010-08-24 21:55        170680        ----a-w-        c:\programdata\Kaspersky Lab\AVP11\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav11\11.0.1.400\klwtblc.dll
2010-08-24 21:37 . 2010-08-24 21:37        283984        ----a-w-        c:\programdata\Kaspersky Lab\AVP11\Data\Updater\Temporary Files\temporaryFolder\bases\av\kdb\i386\win\avengine.dll
2010-08-24 21:31 . 2010-08-24 21:55        97549        ----a-w-        c:\windows\system32\drivers\klick.dat
2010-08-24 21:31 . 2010-08-24 21:55        113933        ----a-w-        c:\windows\system32\drivers\klin.dat
2010-08-24 21:28 . 2010-08-24 21:28        --------        d-----w-        c:\program files\Kaspersky Lab
2010-08-24 20:14 . 2010-08-24 20:14        --------        d-----w-        C:\PerfLogs
2010-08-24 19:47 . 2010-08-24 19:47        --------        d-----w-        c:\programdata\Kaspersky Lab Setup Files
2010-08-24 18:36 . 2010-08-26 19:43        --------        d-----w-        c:\programdata\Kaspersky Lab
2010-08-24 18:35 . 2010-08-24 18:35        --------        d-----w-        c:\windows\system32\Kaspersky Lab
2010-08-16 18:08 . 2010-08-16 18:08        --------        d-----w-        c:\program files\Common Files\Skype
2010-08-16 18:08 . 2010-08-16 18:08        --------        d-----r-        c:\program files\Skype
2010-08-12 17:40 . 2010-01-25 12:48        472576        ----a-w-        c:\windows\system32\secproc_isv.dll
2010-08-12 17:40 . 2010-01-25 12:48        472064        ----a-w-        c:\windows\system32\secproc.dll
2010-08-12 17:40 . 2010-01-25 08:35        523776        ----a-w-        c:\windows\system32\RMActivate_isv.exe
2010-08-12 17:40 . 2010-01-25 08:34        511488        ----a-w-        c:\windows\system32\RMActivate.exe
2010-08-12 17:40 . 2010-01-25 12:45        329216        ----a-w-        c:\windows\system32\msdrm.dll
2010-08-12 17:40 . 2010-01-25 08:35        346624        ----a-w-        c:\windows\system32\RMActivate_ssp_isv.exe
2010-08-12 17:40 . 2010-01-25 08:34        347136        ----a-w-        c:\windows\system32\RMActivate_ssp.exe
2010-08-12 17:40 . 2010-01-25 12:48        151040        ----a-w-        c:\windows\system32\secproc_ssp_isv.dll
2010-08-12 17:40 . 2010-01-25 12:48        151040        ----a-w-        c:\windows\system32\secproc_ssp.dll
2010-08-12 17:40 . 2009-08-28 12:39        28672        ----a-w-        c:\windows\system32\Apphlpdm.dll
2010-08-12 17:40 . 2009-08-28 10:15        4240384        ----a-w-        c:\windows\system32\GameUXLegacyGDFs.dll
2010-08-12 17:39 . 2009-08-31 13:55        293376        ----a-w-        c:\windows\system32\psisdecd.dll
2010-08-12 17:39 . 2009-08-31 13:55        428544        ----a-w-        c:\windows\system32\EncDec.dll
2010-08-12 17:38 . 2009-09-10 15:21        310784        ----a-w-        c:\windows\system32\unregmp2.exe
2010-08-12 17:38 . 2009-09-10 15:21        8147456        ----a-w-        c:\windows\system32\wmploc.DLL
2010-08-11 20:14 . 2010-08-11 20:14        --------        d-----w-        c:\users\Asus\AppData\Local\WindowsUpdate
2010-08-11 19:24 . 2010-07-26 20:30        705208        ----a-w-        c:\users\Asus\AppData\Roaming\Mozilla\Firefox\Profiles\id7gz4la.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
2010-08-11 19:24 . 2010-07-26 20:30        978664        ----a-w-        c:\users\Asus\AppData\Roaming\Mozilla\Firefox\Profiles\id7gz4la.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
2010-08-11 18:29 . 2009-08-24 12:16        378368        ----a-w-        c:\windows\system32\winhttp.dll
2010-08-11 17:10 . 2008-06-20 01:17        97800        ----a-w-        c:\windows\system32\infocardapi.dll
2010-08-11 17:10 . 2008-06-20 01:18        105016        ----a-w-        c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2010-08-11 17:10 . 2008-06-20 01:17        622080        ----a-w-        c:\windows\system32\icardagt.exe
2010-08-11 17:10 . 2008-06-20 01:17        11264        ----a-w-        c:\windows\system32\icardres.dll
2010-08-11 17:10 . 2008-06-20 01:18        781344        ----a-w-        c:\windows\system32\PresentationNative_v0300.dll
2010-08-11 16:50 . 2008-07-27 18:00        158720        ----a-w-        c:\windows\system32\mscorier.dll
2010-08-11 16:50 . 2008-07-27 18:00        83968        ----a-w-        c:\windows\system32\mscories.dll
2010-08-11 16:16 . 2010-08-11 16:16        --------        d-----w-        c:\users\Asus\AppData\Roaming\Malwarebytes
2010-08-11 16:14 . 2010-04-29 13:39        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys
2010-08-11 16:14 . 2010-08-11 16:15        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware
2010-08-11 16:14 . 2010-08-11 16:14        --------        d-----w-        c:\programdata\Malwarebytes
2010-08-11 16:14 . 2010-04-29 13:39        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys
2010-08-11 03:58 . 2010-02-12 10:49        293376        ----a-w-        c:\windows\system32\browserchoice.exe
2010-08-11 03:56 . 2010-02-20 23:39        24064        ----a-w-        c:\windows\system32\nshhttp.dll
2010-08-11 03:55 . 2010-02-20 23:37        31232        ----a-w-        c:\windows\system32\httpapi.dll
2010-08-11 03:55 . 2010-02-20 21:18        411136        ----a-w-        c:\windows\system32\drivers\http.sys
2010-08-10 22:31 . 2009-03-03 03:04        666624        ----a-w-        c:\windows\system32\printfilterpipelinesvc.exe
2010-08-10 22:31 . 2009-03-03 02:38        17408        ----a-w-        c:\windows\system32\iashost.exe
2010-08-10 22:31 . 2009-03-03 04:39        183296        ----a-w-        c:\windows\system32\sdohlp.dll
2010-08-10 22:31 . 2009-03-03 04:40        499200        ----a-w-        c:\windows\system32\wbem\WmiPrvSD.dll
2010-08-10 22:31 . 2009-03-03 04:39        551424        ----a-w-        c:\windows\system32\rpcss.dll
2010-08-10 22:31 . 2009-03-03 04:36        615424        ----a-w-        c:\windows\system32\wbem\fastprox.dll
2010-08-10 22:31 . 2009-03-03 04:40        129024        ----a-w-        c:\windows\system32\wbem\WmiDcPrv.dll
2010-08-10 22:31 . 2009-03-03 02:16        247296        ----a-w-        c:\windows\system32\wbem\WmiPrvSE.exe
2010-08-10 22:31 . 2009-03-03 04:37        98304        ----a-w-        c:\windows\system32\iasrecst.dll
2010-08-10 22:31 . 2009-03-03 04:37        44032        ----a-w-        c:\windows\system32\iasdatastore.dll
2010-08-10 22:29 . 2009-08-14 16:29        104960        ----a-w-        c:\windows\system32\netiohlp.dll
2010-08-10 22:29 . 2009-08-14 16:29        17920        ----a-w-        c:\windows\system32\netevent.dll
2010-08-10 22:29 . 2009-08-14 14:16        9728        ----a-w-        c:\windows\system32\TCPSVCS.EXE
2010-08-10 22:29 . 2009-08-14 14:16        17920        ----a-w-        c:\windows\system32\ROUTE.EXE
2010-08-10 22:29 . 2009-08-14 14:16        27136        ----a-w-        c:\windows\system32\NETSTAT.EXE
2010-08-10 22:29 . 2009-08-14 14:16        19968        ----a-w-        c:\windows\system32\ARP.EXE
2010-08-10 22:29 . 2009-08-14 14:16        10240        ----a-w-        c:\windows\system32\finger.exe
2010-08-10 22:29 . 2009-08-14 14:16        11264        ----a-w-        c:\windows\system32\MRINFO.EXE
2010-08-10 22:29 . 2009-08-14 14:16        8704        ----a-w-        c:\windows\system32\HOSTNAME.EXE
2010-08-10 22:25 . 2009-09-10 17:30        213504        ----a-w-        c:\windows\system32\msv1_0.dll
2010-08-10 22:24 . 2010-01-23 09:44        2048        ----a-w-        c:\windows\system32\tzres.dll
2010-08-10 22:21 . 2009-03-17 03:38        13824        ----a-w-        c:\windows\system32\apilogen.dll
2010-08-10 22:21 . 2009-03-17 03:38        24064        ----a-w-        c:\windows\system32\amxread.dll
2010-08-10 22:21 . 2009-07-17 14:35        71680        ----a-w-        c:\windows\system32\atl.dll
2010-08-10 22:19 . 2009-08-10 11:01        1399296        ----a-w-        c:\windows\system32\msxml6.dll
2010-08-10 22:18 . 2009-04-23 12:43        784896        ----a-w-        c:\windows\system32\rpcrt4.dll
2010-08-10 22:18 . 2009-12-11 12:07        301568        ----a-w-        c:\windows\system32\drivers\srv.sys
2010-08-10 22:18 . 2009-12-11 12:07        98304        ----a-w-        c:\windows\system32\drivers\srvnet.sys
2010-08-10 22:18 . 2008-06-06 03:27        38912        ----a-w-        c:\windows\system32\xolehlp.dll
2010-08-10 22:18 . 2008-06-06 03:27        562176        ----a-w-        c:\windows\system32\msdtcprx.dll
2010-08-10 22:18 . 2010-03-05 14:01        420352        ----a-w-        c:\windows\system32\vbscript.dll
2010-08-10 22:18 . 2009-09-14 09:44        144896        ----a-w-        c:\windows\system32\drivers\srv2.sys
2010-08-10 22:18 . 2010-02-23 11:32        78848        ----a-w-        c:\windows\system32\drivers\mrxsmb20.sys
2010-08-10 22:18 . 2010-02-23 11:32        105984        ----a-w-        c:\windows\system32\drivers\mrxsmb.sys
2010-08-10 22:18 . 2010-02-23 11:32        212992        ----a-w-        c:\windows\system32\drivers\mrxsmb10.sys
2010-08-10 22:17 . 2009-06-10 12:12        160256        ----a-w-        c:\windows\system32\wkssvc.dll
2010-08-10 22:17 . 2009-12-23 12:43        171520        ----a-w-        c:\windows\system32\wintrust.dll
2010-08-10 22:17 . 2010-01-15 00:04        98304        ----a-w-        c:\windows\system32\cabview.dll
2010-08-10 22:08 . 2009-09-04 12:24        61440        ----a-w-        c:\windows\system32\msasn1.dll
2010-08-10 22:07 . 2009-10-07 12:41        244224        ----a-w-        c:\windows\system32\rastls.dll
2010-08-10 22:07 . 2009-10-07 12:41        281600        ----a-w-        c:\windows\system32\raschap.dll
2010-08-10 22:06 . 2009-08-10 13:05        351232        ----a-w-        c:\windows\system32\WSDApi.dll
2010-08-10 21:56 . 2009-12-28 12:28        91136        ----a-w-        c:\windows\system32\avifil32.dll
2010-08-10 21:56 . 2009-12-28 12:35        1314816        ----a-w-        c:\windows\system32\quartz.dll
2010-08-10 21:56 . 2009-12-28 12:35        11776        ----a-w-        c:\windows\system32\tsbyuv.dll
2010-08-10 21:56 . 2009-12-28 12:32        22528        ----a-w-        c:\windows\system32\msyuv.dll
2010-08-10 21:56 . 2009-12-28 12:32        31744        ----a-w-        c:\windows\system32\msvidc32.dll
2010-08-10 21:56 . 2009-12-28 12:32        13312        ----a-w-        c:\windows\system32\msrle32.dll
2010-08-10 21:56 . 2009-12-28 12:31        50176        ----a-w-        c:\windows\system32\iyuv_32.dll
2010-08-10 21:56 . 2009-12-28 12:32        123904        ----a-w-        c:\windows\system32\msvfw32.dll
2010-08-10 21:56 . 2009-12-28 12:31        82944        ----a-w-        c:\windows\system32\mciavi32.dll
2010-08-10 21:56 . 2009-12-28 12:28        65024        ----a-w-        c:\windows\system32\avicap32.dll
2010-08-10 21:56 . 2009-04-02 12:37        604672        ----a-w-        c:\windows\system32\WMSPDMOD.DLL
2010-08-10 21:26 . 2009-08-07 02:24        44768        ----a-w-        c:\windows\system32\wups2.dll
2010-08-10 21:26 . 2009-08-07 02:24        53472        ----a-w-        c:\windows\system32\wuauclt.exe
2010-08-10 21:26 . 2009-08-07 01:45        2421760        ----a-w-        c:\windows\system32\wucltux.dll
2010-08-10 21:15 . 2009-08-07 02:23        1929952        ----a-w-        c:\windows\system32\wuaueng.dll
2010-08-10 21:13 . 2009-08-07 02:24        35552        ----a-w-        c:\windows\system32\wups.dll
2010-08-10 21:13 . 2009-08-07 02:23        575704        ----a-w-        c:\windows\system32\wuapi.dll
2010-08-10 21:13 . 2009-08-07 01:44        87552        ----a-w-        c:\windows\system32\wudriver.dll
2010-08-10 21:12 . 2009-08-06 17:23        171608        ----a-w-        c:\windows\system32\wuwebv.dll
2010-08-10 21:12 . 2009-08-06 16:44        33792        ----a-w-        c:\windows\system32\wuapp.exe
2010-08-10 20:34 . 2010-08-10 20:34        --------        d-sh--w-        c:\programdata\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
2010-08-10 20:11 . 2010-05-31 18:32        64304        ----a-w-        c:\windows\system32\drivers\mfenlfk.sys
2010-08-10 15:40 . 2010-08-24 20:22        --------        d-----w-        c:\programdata\McAfee

.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-26 20:57 . 2009-05-30 10:56        --------        d-----w-        c:\users\Asus\AppData\Roaming\Skype
2010-08-26 20:54 . 2009-03-25 13:11        --------        d-----w-        c:\program files\pdfforge Toolbar
2010-08-26 20:36 . 2009-03-12 14:45        --------        d-----w-        c:\users\Asus\AppData\Roaming\Media Player Classic
2010-08-26 20:02 . 2009-03-26 16:02        --------        d-----w-        c:\programdata\Google Updater
2010-08-26 14:47 . 2009-03-22 18:22        --------        d-----w-        c:\users\Asus\AppData\Roaming\skypePM
2010-08-25 19:19 . 2007-04-18 09:14        628436        ----a-w-        c:\windows\system32\perfh007.dat
2010-08-25 19:19 . 2007-04-18 09:14        127056        ----a-w-        c:\windows\system32\perfc007.dat
2010-08-25 19:07 . 2007-04-18 08:33        12        ----a-w-        c:\windows\bthservsdp.dat
2010-08-25 19:05 . 2009-03-22 17:31        --------        d-----w-        c:\programdata\TuneUp Software
2010-08-25 18:56 . 2009-03-12 14:49        45056        ----a-w-        c:\windows\system32\acovcnt.exe
2010-08-24 22:23 . 2009-08-27 04:12        --------        d-----w-        c:\users\Asus\AppData\Roaming\Byypz
2010-08-24 22:16 . 2010-02-04 01:27        --------        d-----w-        c:\users\Asus\AppData\Roaming\Heicbe
2010-08-24 21:56 . 2010-06-28 17:47        283984        ----a-w-        c:\programdata\Kaspersky Lab\AVP11\Bases\avengine.dll
2010-08-24 20:15 . 2006-11-02 12:37        --------        d-----w-        c:\program files\Windows Calendar
2010-08-24 20:15 . 2006-11-02 12:37        --------        d-----w-        c:\program files\Windows Sidebar
2010-08-24 20:15 . 2006-11-02 12:37        --------        d-----w-        c:\program files\Windows Journal
2010-08-24 20:15 . 2006-11-02 12:37        --------        d-----w-        c:\program files\Windows Collaboration
2010-08-24 20:15 . 2006-11-02 11:18        --------        d-----w-        c:\program files\Windows Mail
2010-08-24 20:15 . 2006-11-02 12:37        --------        d-----w-        c:\program files\Windows Photo Gallery
2010-08-24 20:15 . 2006-11-02 12:37        --------        d-----w-        c:\program files\Windows Defender
2010-08-24 20:13 . 2006-11-02 10:25        665600        ----a-w-        c:\windows\inf\drvindex.dat
2010-08-24 19:39 . 2006-11-02 10:32        101888        ----a-w-        c:\windows\system32\ifxcardm.dll
2010-08-24 19:39 . 2006-11-02 10:32        82432        ----a-w-        c:\windows\system32\axaltocm.dll
2010-08-16 18:08 . 2009-03-19 14:44        --------        d-----w-        c:\programdata\Skype
2010-08-14 06:00 . 2010-06-21 07:55        56168        ----a-w-        c:\users\Asus\AppData\Local\GDIPFONTCACHEV1.DAT
2010-08-11 16:01 . 2010-06-19 13:00        90        ----a-w-        c:\users\Asus\AppData\Local\atvicwjc.bat
2010-08-10 10:14 . 2010-01-04 15:48        --------        d-----w-        c:\users\Asus\AppData\Roaming\Foela
2010-08-10 10:14 . 2009-07-31 22:09        --------        d-----w-        c:\program files\Live-Player
2010-08-10 09:57 . 2009-05-02 06:25        --------        d-----w-        c:\users\Asus\AppData\Roaming\Sysat
2010-08-10 09:29 . 2009-03-26 18:30        --------        d-----w-        c:\program files\PDFCreator
2010-07-22 18:05 . 2009-10-13 18:28        --------        d-----w-        c:\program files\Ask.com
2010-07-16 10:28 . 2009-01-13 21:37        --------        d-----w-        c:\program files\Common Files\Adobe
2010-07-14 18:37 . 2010-07-14 18:34        --------        d-----w-        c:\users\Asus\AppData\Roaming\QuickScan
2010-07-13 15:54 . 2010-07-13 15:54        2944904        ----a-w-        c:\users\Asus\AppData\Roaming\Mozilla\Firefox\Profiles\id7gz4la.default\extensions\toolbar@ask.com\chrome\temp\askToolbar.exe
2010-07-06 13:53 . 2010-07-06 13:53        5080112        ----a-w-        c:\programdata\T-Online\T-Online_Software_6\Basis-Software\update\filedistribution\netzmanager_setup.exe
2010-07-01 19:35 . 2010-07-01 19:35        228024        ----a-w-        c:\windows\system32\klogon.dll
2010-07-01 19:14 . 2010-07-01 19:14        92816        ----a-w-        c:\programdata\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 2011 11.0.1.400\German\setup.exe
2010-07-01 06:06 . 2010-07-01 06:06        1037648        ----a-w-        c:\programdata\Kaspersky Lab\AVP11\Bases\klavasyswatch.dll
2010-06-30 05:06 . 2010-06-30 05:06        271696        ----a-w-        c:\programdata\Kaspersky Lab\AVP11\Bases\sys_critical_obj.dll
2010-06-23 18:40 . 2010-06-23 18:40        501936        ----a-w-        c:\programdata\Google\Google Toolbar\Update\gtb430B.tmp.exe
2010-06-09 15:43 . 2010-06-09 15:43        11352        ----a-w-        c:\windows\system32\drivers\kl2.sys
2010-06-09 15:43 . 2010-06-09 15:43        132184        ----a-w-        c:\windows\system32\drivers\kl1.sys
2010-05-31 14:34 . 2010-07-14 18:34        702120        ----a-w-        c:\users\Asus\AppData\Roaming\Mozilla\Firefox\Profiles\id7gz4la.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}-trash\components\qscanff.dll
.

((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-05-26 1385864]

[HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2010-05-26 13:23        1385864        ----a-w-        c:\program files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-05-26 1385864]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-05-26 1385864]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-02-20 4363504]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2009-06-25 1414144]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-03-26 39408]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-05-13 26192168]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SMSERIAL"="c:\program files\Motorola\SMSERIAL\sm56hlpr.exe" [2006-10-09 729088]
"ATKMEDIA"="c:\program files\ASUS\ATK Media\DMEDIA.EXE" [2006-11-02 61440]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-11-22 815104]
"ToADiMon.exe"="c:\program files\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToADiMon.exe" [2007-02-15 282624]
"Easy-PrintToolBox"="c:\program files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE" [2004-01-14 409600]
"SearchSettings"="c:\program files\pdfforge Toolbar\SearchSettings.exe" [2009-01-30 992256]
"FreePDF Assistant"="c:\program files\FreePDF_XP\fpassist.exe" [2008-07-22 357376]
"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 583048]
"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-23 57344]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 2011\avp.exe" [2010-07-01 357096]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"InfoCockpit"="c:\program files\T-Online\T-Online_Software_6\Info-Cockpit\IC_START.EXE" [2007-01-16 176128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"tfguxxawqkggqamzerpsTaskMgr"= 0 (0x0)
"xmihsndpubondhlclybtTaskMgr"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\KASPER~1\KASPER~1\mzvkbd3.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe"
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-4186507801-287623148-3281869339-1000]
"EnableNotificationsRef"=dword:00000001

R2 gupdate1c9ae2c6a87a6aa;Google Update Service (gupdate1c9ae2c6a87a6aa);c:\program files\Google\Update\GoogleUpdate.exe [2009-03-26 133104]
R3 ipswuio;ipswuio;c:\windows\system32\DRIVERS\ipswuio.sys [x]
R3 MIINPazX;MIINPazX NDIS Protocol Driver;c:\progra~1\COMMON~1\MARMIK~1\MInfraIS\MIINPazX.SYS [2006-10-09 17152]
R3 MTOnlPktAlyX;MTOnlPktAlyX NDIS Protocol Driver;c:\progra~1\T-Online\T-ONLI~1\BASIS-~1\Basis1\MTOnlPktAlyX.SYS [2006-10-09 17536]
R3 SIVDRIVER;SIV Kernel Driver;c:\windows\system32\Drivers\SIVX32.sys [2007-02-24 19944]
S0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2009-06-30 28552]
S1 kl2;kl2;c:\windows\system32\DRIVERS\kl2.sys [2010-06-09 11352]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [2010-04-22 22104]
S1 mfenlfk;McAfee NDIS Light Filter;c:\windows\system32\DRIVERS\mfenlfk.sys [2010-05-31 64304]
S2 StkSSrv;Syntek AVStream USB2.0 WebCam Service;c:\windows\System32\StkCSrv.exe [2006-12-10 24576]
S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys [2009-11-02 19984]
S3 StkCMini;Syntek AVStream USB2.0 1.3M WebCam;c:\windows\system32\Drivers\StkCMini.sys [2006-12-21 1132544]
S3 WCPU;WCPU;c:\program files\P4G\WCPU.sys [2007-01-02 11120]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs        REG_MULTI_SZ          BthServ
.
Inhalt des "geplante Tasks" Ordners

2010-08-26 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-03-22 17:03]

2010-08-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-26 16:03]

2010-08-26 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-26 16:03]

2009-08-01 c:\windows\Tasks\NSSstub.job
- c:\windows\System32\Adobe\Shockwave 11\nssstub.exe [2009-07-30 08:58]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.scroogle.org/cgi-bin/scraper.htm
IE: Easy-WebPrint - Drucken - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
IE: Easy-WebPrint - Schnelldruck - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
IE: Easy-WebPrint - Vorschau - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
IE: Easy-WebPrint - Zu Druckliste hinzufügen - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
FF - ProfilePath - c:\users\Asus\AppData\Roaming\Mozilla\Firefox\Profiles\id7gz4la.default\
FF - prefs.js: browser.search.selectedEngine - Ask.com
FF - prefs.js: browser.startup.homepage - hxxp://de.ask.com?o=15015&l=dis
FF - prefs.js: keyword.URL - hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=DVSV5&o=15012&locale=de_DE&apn_uid=184A4C6C-CC3F-4CFE-9488-78D483844C68&apn_ptnrs=U9&apn_sauid=7886F2F4-9FD9-4828-B529-C565E83992E8&apn_dtid=&q=
FF - component: c:\program files\Mozilla Firefox\extensions\linkfilter@kaspersky.ru\components\kavlinkfilter.dll
FF - component: c:\users\Asus\AppData\Roaming\Mozilla\Firefox\Profiles\id7gz4la.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.27\npGoogleOneClick8.dll
FF - plugin: c:\users\Asus\AppData\Roaming\Mozilla\Firefox\Profiles\id7gz4la.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX Richtlinien ----
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation",  false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2010-08-26 22:56
Windows 6.0.6001 Service Pack 1 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Zeit der Fertigstellung: 2010-08-26  23:03:18
ComboFix-quarantined-files.txt  2010-08-26 21:03

Vor Suchlauf: 9.454.903.296 Bytes frei
Nach Suchlauf: 9.981.177.856 Bytes frei

Current=1 Default=1 Failed=0 LastKnownGood=1 Sets=1,2,3,4,5
- - End Of File - - 4AF8A57DBC1BCCB85C17143C39ECEB6E
--- --- ---

Hicke 26.08.2010 22:17
was sagt es aus?

cosinus 27.08.2010 09:22
Combofix - Scripten

1. Starte das Notepad (Start / Ausführen / notepad[Enter])

2. Jetzt füge mit copy/paste den ganzen Inhalt der untenstehenden Codebox in das Notepad Fenster ein.

Code:
Registry::
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"tfguxxawqkggqamzerpsTaskMgr"=-
"xmihsndpubondhlclybtTaskMgr"=-

Dirlook::
c:\programdata\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}

Filelook::
c:\windows\system32\acovcnt.exe

Folder::
c:\users\Asus\AppData\Roaming\Byypz
c:\users\Asus\AppData\Roaming\Heicbe
c:\users\Asus\AppData\Roaming\Foela

File::
c:\users\Asus\AppData\Local\atvicwjc.bat
3. Speichere im Notepad als CFScript.txt auf dem Desktop.

4. Deaktivere den Guard Deines Antivirenprogramms und eine eventuell vorhandene Software Firewall.
(Auch Guards von Ad-, Spyware Programmen und den Tea Timer (wenn vorhanden) !)

5. Dann ziehe die CFScript.txt auf die cofi.exe, so wie es im unteren Bild zu sehen ist. Damit wird Combofix neu gestartet.

http://users.pandora.be/bluepatchy/m...s/CFScript.gif

6. Nach dem Neustart (es wird gefragt ob Du neustarten willst), poste bitte die folgenden Log Dateien:
Combofix.txt

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Hicke 30.08.2010 23:08
Hi Arne,
nach dem ich das Programm durchlaufen lassen habe, gab es keine Probleme mehr. Ich hab den letzten Schritt jetzt gar nicht mehr gemacht, ist der noch erforderlich. Der Virenscanner und auch malwarebyte hat keine probleme mehr gesehen, ich hab den Rechner als Virenfrei nun eingestuft. War der Schritt zu früh?

cosinus 31.08.2010 08:21
Ja, Du sollst es bitte so ausführen, da muss noch einiges wegescriptet werden!!

Hicke 31.08.2010 08:57
mist nicht ganz einfach hab laptop wieder dem Besitzer übergeben:( Den muss ich jetzt irgendwie erst noch mal zurück holen. Scheisse, dachte der Vorgang wäre abgeschlossen. Aber kein Virenscanner ist drauf angesprungen, der Rechner lief einwandfrei. Shit, muss schauen wie ich es hinbekomme..

cosinus 31.08.2010 09:04
Der Vorgang ist erst abgeschlossen wenn ich das sage! Stand doch dick und fett as Hinweis da! :stirn:

Zitat:
Hinweis: Ich kann Dir niemals eine Garantie geben, dass ich auch alles finde. Eine Formatierung ist meist der Schnellere und immer der sicherste Weg.
Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis dir jemand vom Team sagt, dass Du clean bist.

Hicke 31.08.2010 09:09
werde den Rechner wieder ranholen und dann geht es weiter:)

Hicke 02.09.2010 19:00
Hi Arne,
so Rechner wieder da. ich weiß jetzt nicht ab welchen SChritt ich weitermachen muss hab das Programm combofix wieder runtergeschmissen damals. Wo muss ich jetzt wieder einsteigen? Viele Grüße und Danke für Deine unerschütterliche Hilfe, irgendwie bis Du stets online:)

cosinus 02.09.2010 19:02
Mit Combofix - Scripten


Alle Zeitangaben in WEZ +1. Es ist jetzt 07:38 Uhr.
Seite 2 von 5 1 2 34 Letzte »
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19