Trojaner-Board
Seite 4 von 5 « Erste 23 4 5
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   trojanisches Programm Exploit.Java.Agent.bb etc (https://www.trojaner-board.de/89988-trojanisches-programm-exploit-java-agent-bb-etc.html)

Hicke 04.09.2010 12:45
komme auch mit osam nicht weiter... wie geht es jetzt generell weiter..

cosinus 04.09.2010 16:08
Die Datenbank musst Du nicht abfragen! Überspring den Punkt!

Hicke 04.09.2010 16:12
Hi Arne,
dann gibt es aber kein Punkt mehr. DAs Programm OSAM läuft nicht warum auch immer und das andere Programm gibt keine logfile datei raus

cosinus 04.09.2010 16:29
Führ es doch einfach mal nach Anleitung aus. Hunderte andere User haben es doch auch hinbekommen :balla:

Hicke 04.09.2010 16:33
ich führe alles hier nach Anleitung aus. Wie sollte ich es denn sonst tun? Das verstehe ich jetzt nicht wirklich, aber ich mach den ganzen vorgang nun nochmal. keine ahnung warum es bei 100 anderen immer klappt. mal schauen

Hicke 04.09.2010 18:05
OSAM Logfile:
Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 19:04:29 on 04.09.2010

OS: Windows Vista Home Premium Edition Service Pack 2 (Build 6002), 32-bit
Default Browser: Microsoft Corporation Internet Explorer 8.00.6001.18702

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Common]
-----( %SystemRoot%\Tasks )-----
"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"Google Software Updater.job" - "Google" - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

[Control Panel Objects]
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"Nero BurnRights" - "Nero AG" - C:\Program Files\Nero\Nero 7\Nero Toolkit\NeroBurnRights.cpl
"NokiaConnectionManager" - "Nokia" - C:\PROGRA~1\Nokia\NOKIAP~1\CONNEC~1.CPL
"QuickTime" - "Apple Computer, Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl
"ToSysCnf" - "Deutsche Telekom AG, Marmiko IT-Solutions GmbH" - C:\Program Files\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToSysCnf.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"catchme" (catchme) - ? - C:\Users\Asus\AppData\Local\Temp\catchme.sys  (File not found)
"ghaio" (ghaio) - ? - C:\Program Files\ASUS\NB Probe\SPM\ghaio.sys  (File found, but it contains no detailed information)
"IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys  (File not found)
"ipswuio" (ipswuio) - ? - C:\Windows\System32\DRIVERS\ipswuio.sys  (File not found)
"IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys  (File not found)
"IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys  (File not found)
"kwldrpoc" (kwldrpoc) - ? - C:\Users\Asus\AppData\Local\Temp\kwldrpoc.sys  (Hidden registry entry, rootkit activity | File not found)
"MIINPazX NDIS Protocol Driver" (MIINPazX) - "Deutsche Telekom AG, Marmiko IT-Solutions GmbH" - C:\PROGRA~1\COMMON~1\MARMIK~1\MInfraIS\MIINPazX.SYS
"MTOnlPktAlyX NDIS Protocol Driver" (MTOnlPktAlyX) - "Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH" - C:\PROGRA~1\T-Online\T-ONLI~1\BASIS-~1\Basis1\MTOnlPktAlyX.SYS
"pavboot" (pavboot) - "Panda Security, S.L." - C:\Windows\System32\drivers\pavboot.sys
"PCCS Mode Change Filter Driver" (pccsmcfd) - ? - C:\Windows\System32\DRIVERS\pccsmcfd.sys  (File not found)
"Service for Realtek HD Audio (WDM)" (IntcAzAudAddService) - ? - C:\Windows\System32\drivers\RTKVHDA.sys  (File not found)
"SIV Kernel Driver" (SIVDRIVER) - "Ray Hinchliffe" - C:\Windows\system32\Drivers\SIVX32.sys
"WCPU" (WCPU) - "Windows (R) Codename Longhorn DDK provider" - C:\Program Files\P4G\WCPU.sys

[Explorer]
-----( HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{BDEADF00-C265-11d0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
-----( HKLM\Software\Classes\Protocols\Handler )-----
{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----
{AEB6717E-7E19-11d0-97EE-00C04FD91972} "{AEB6717E-7E19-11d0-97EE-00C04FD91972}" - ? -  (File not found | COM-object registry key not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? -  (File not found | COM-object registry key not found)
{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? -  (File not found | COM-object registry key not found)
{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? -  (File not found | COM-object registry key not found)
{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? -  (File not found | COM-object registry key not found)
{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? -  (File not found | COM-object registry key not found)
{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? -  (File not found | COM-object registry key not found)
{00020d75-0000-0000-c000-000000000046} "Microsoft Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office\MLSHEXT.DLL
{416651E4-9C3C-11D9-8BDE-F66BAD1E3F3A} "Nokia Phone Browser" - "Nokia" - C:\Program Files\Nokia\Nokia PC Suite 7\PhoneBrowser.dll
{0006F045-0000-0000-C000-000000000046} "Outlook-Dateisymbolerweiterung" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office\OLKFSTUB.DLL
{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? -  (File not found | COM-object registry key not found)
{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? -  (File not found | COM-object registry key not found)
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - ? -  (File not found | COM-object registry key not found)
{5E2121EE-0300-11D4-8D3B-444553540000} "SimpleShlExt Class" - ? - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll
{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -  (File not found | COM-object registry key not found)
{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - "Alexander Roshal" - C:\Program Files\WinRAR\rarext.dll

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "Ask Toolbar" - "Ask" - C:\Program Files\Ask.com\GenericAskToolbar.dll
<binary data> "Google Toolbar" - "Google Inc." - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
ITBar7Height "ITBar7Height" - ? -  (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? -  (File not found | COM-object registry key not found)
<binary data> "ITBarLayout" - ? -  (File not found | COM-object registry key not found)
-----( HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks )-----
{00000000-6E41-4FD3-8538-502F5495E5FC} "UrlSearchHook Class" - "Ask" - C:\Program Files\Ask.com\GenericAskToolbar.dll
{EF99BD32-C1FB-11D2-892F-0090271D4F88} "Yahoo! Toolbar" - "Yahoo! Inc." - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
{E312764E-7706-43F1-8DAB-FCDD2B1E416D} "{E312764E-7706-43F1-8DAB-FCDD2B1E416D}" - ? -  (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{9191F686-7F0A-441D-8A98-2FE3AC1BD913} "ActiveScan 2.0 Installer Class" - "Panda Security" - C:\Windows\Downloaded Program Files\as2stubie.dll / hxxp://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
{5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} "BDSCANONLINE Control" - "BitDefender" - C:\Windows\DOWNLO~1\oscan82.ocx / hxxp://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_13" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://dl8-cdn-09.sun.com/s/ESD7/JSCDL/jdk/6u13-b03/jinstall-6u13-windows-i586-jc.cab?e=1239646001457&h=866862cb450b898fe00bc7775d0b2ba9/&filename=jinstall-6u13-windows-i586-jc.cab
{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} "Java Plug-in 1.6.0_13" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_13" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_13.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
{166B1BCA-3F9C-11CF-8075-444553540000} "Shockwave ActiveX Control" - "Adobe Systems, Inc." - C:\Windows\system32\Adobe\Director\SwDir.dll / hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
"Exec" - ? - C:\Windows\bdoscandel.exe  (File found, but it contains no detailed information)
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
<binary data> "Ask Toolbar" - "Ask" - C:\Program Files\Ask.com\GenericAskToolbar.dll
{327C2873-E90D-4c37-AA9D-10AC9BABA46C} "Easy-WebPrint" - ? - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
<binary data> "Google Toolbar" - "Google Inc." - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
<binary data> "Yahoo! Toolbar" - "Yahoo! Inc." - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{02478D38-C3F9-4efb-9B51-7695ECA05670} "&Yahoo! Toolbar Helper" - "Yahoo! Inc." - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
{D4027C7F-154A-4066-A1AD-4243D8127440} "Ask Toolbar" - "Ask" - C:\Program Files\Ask.com\GenericAskToolbar.dll
{68F9551E-0411-48E4-9AAF-4BC42A6A46BE} "EWPBrowseObject Class" - ? - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
{AA58ED58-01DD-4d91-8333-CF10577473F7} "Google Toolbar Helper" - "Google Inc." - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} "Google Toolbar Notifier BHO" - "Google Inc." - C:\Program Files\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll
{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} "SingleInstance Class" - "Yahoo! Inc" - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\Users\Asus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"Messenger (Yahoo!)" - "Yahoo! Inc." - "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
"PC Suite Tray" - "Nokia" - "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
"Skype" - "Skype Technologies S.A." - "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
"swg" - "Google Inc." - "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----
"StartupPrograms" - ? - rdpclip  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"Adobe Photo Downloader" - "Adobe Systems Incorporated" - "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
"ATKMEDIA" - "ASUSTeK Computer INC." - C:\Program Files\ASUS\ATK Media\DMEDIA.EXE
"Easy-PrintToolBox" - "CANON INC." - C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
"FreePDF Assistant" - "shbox.de" - C:\Program Files\FreePDF_XP\fpassist.exe
"NeroFilterCheck" - "Nero AG" - C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
"SearchSettings" - "GreenTree Applications, Inc." - C:\Program Files\pdfforge Toolbar\SearchSettings.exe
"Symantec PIF AlertEng" - "Symantec Corporation" - "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
"ToADiMon.exe" - "Deutsche Telekom AG, Marmiko IT-Solutions GmbH" - C:\Program Files\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToADiMon.exe -TOnlineAutodialStart

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"PDFCreator" - ? - C:\Windows\system32\pdfcmnnt.dll  (File found, but it contains no detailed information)
"Redirected Port" - ? - C:\Windows\system32\redmonnt.dll  (File found, but it contains no detailed information)

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"ASLDR Service" (ASLDRService) - ? - C:\Program Files\ATK Hotkey\ASLDRSrv.exe
"Automatic LiveUpdate Scheduler" (Automatic LiveUpdate Scheduler) - "Symantec Corporation" - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
"Google Software Updater" (gusvc) - "Google" - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
"Google Update Service (gupdate1c9ae2c6a87a6aa)" (gupdate1c9ae2c6a87a6aa) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
"LightScribeService Direct Disc Labeling Service" (LightScribeService) - "Hewlett-Packard Company" - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
"LiveUpdate" (LiveUpdate) - "Symantec Corporation" - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
"LiveUpdate Notice Service" (LiveUpdate Notice Service) - "Symantec Corporation" - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
"LiveUpdate Notice Service Ex" (LiveUpdate Notice Ex) - ? - "C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon  (File not found)
"NBService" (NBService) - "Nero AG" - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
"NMIndexingService" (NMIndexingService) - "Nero AG" - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
"spmgr" (spmgr) - ? - C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
"Symantec Lic NetConnect service" (CLTNetCnService) - ? - "C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon  (File not found)

===[ Logfile end ]=========================================[ Logfile end ]===
--- --- ---

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

cosinus 05.09.2010 15:17
Siehste es geht doch :D
Das vom Bootkit Remover brauch ich noch. Probier bitte auch noch einmal GMER aus.

Hicke 05.09.2010 16:57
GMER Logfile:
Code:
GMER 1.0.15.15281 - hxxp://www.gmer.net
Rootkit scan 2010-09-05 17:55:59
Windows 6.0.6002 Service Pack 2
Running: jgt8hyxm.exe; Driver: C:\Users\Asus\AppData\Local\Temp\kwldrpoc.sys


---- System - GMER 1.0.15 ----

INT 0x1F        \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)                                827D0CD0
INT 0x37        \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)                                827D00E8
INT 0xC1        \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)                                827D03D8
INT 0xD1        \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)                                827BBD64
INT 0xD2        \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)                                827BC01C
INT 0xDF        \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)                                827D01C0
INT 0xE1        \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)                                827D0B40
INT 0xE3        \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)                                827D06D4
INT 0xFD        \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)                                827D1100
INT 0xFE        \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)                                827D136C

---- User IAT/EAT - GMER 1.0.15 ----

IAT            C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[1440] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!LoadLibraryExW]    [6113A40D] C:\Program Files\Yahoo!\Messenger\yui.dll
IAT            C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[1440] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!LoadLibraryA]      [6113A33F] C:\Program Files\Yahoo!\Messenger\yui.dll
IAT            C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[1440] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!GetProcAddress]    [61139C3F] C:\Program Files\Yahoo!\Messenger\yui.dll
IAT            C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[1440] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!LoadLibraryW]      [6113A37F] C:\Program Files\Yahoo!\Messenger\yui.dll
IAT            C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[1440] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW]  [6113A40D] C:\Program Files\Yahoo!\Messenger\yui.dll
IAT            C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[1440] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryA]    [6113A33F] C:\Program Files\Yahoo!\Messenger\yui.dll
IAT            C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[1440] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryW]    [6113A37F] C:\Program Files\Yahoo!\Messenger\yui.dll
IAT            C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[1440] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!GetProcAddress]  [61139C3F] C:\Program Files\Yahoo!\Messenger\yui.dll
IAT            C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[1440] @ C:\Windows\system32\USER32.dll [GDI32.dll!GetStockObject]      [6113909F] C:\Program Files\Yahoo!\Messenger\yui.dll
IAT            C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[1440] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryW]    [6113A37F] C:\Program Files\Yahoo!\Messenger\yui.dll
IAT            C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[1440] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExW]  [6113A40D] C:\Program Files\Yahoo!\Messenger\yui.dll
IAT            C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[1440] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryA]    [6113A33F] C:\Program Files\Yahoo!\Messenger\yui.dll
IAT            C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[1440] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress]  [61139C3F] C:\Program Files\Yahoo!\Messenger\yui.dll
IAT            C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[1440] @ C:\Windows\system32\SHLWAPI.dll [GDI32.dll!GetStockObject]    [6113909F] C:\Program Files\Yahoo!\Messenger\yui.dll
IAT            C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[1440] @ C:\Windows\system32\SHLWAPI.dll [USER32.dll!GetSysColor]      [61138FE2] C:\Program Files\Yahoo!\Messenger\yui.dll
IAT            C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[1440] @ C:\Windows\system32\SHLWAPI.dll [USER32.dll!DefWindowProcW]    [61139856] C:\Program Files\Yahoo!\Messenger\yui.dll
IAT            C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[1440] @ C:\Windows\system32\SHLWAPI.dll [USER32.dll!DefWindowProcA]    [61139856] C:\Program Files\Yahoo!\Messenger\yui.dll
IAT            C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[1440] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExW]  [6113A40D] C:\Program Files\Yahoo!\Messenger\yui.dll
IAT            C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[1440] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetProcAddress]  [61139C3F] C:\Program Files\Yahoo!\Messenger\yui.dll
IAT            C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[1440] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryW]    [6113A37F] C:\Program Files\Yahoo!\Messenger\yui.dll
IAT            C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[1440] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA]    [6113A33F] C:\Program Files\Yahoo!\Messenger\yui.dll
IAT            C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[1440] @ C:\Windows\system32\SHELL32.dll [GDI32.dll!GetStockObject]    [6113909F] C:\Program Files\Yahoo!\Messenger\yui.dll
IAT            C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[1440] @ C:\Windows\system32\SHELL32.dll [USER32.dll!TrackPopupMenuEx]  [61138FA4] C:\Program Files\Yahoo!\Messenger\yui.dll
IAT            C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[1440] @ C:\Windows\system32\SHELL32.dll [USER32.dll!TrackPopupMenu]    [61138F66] C:\Program Files\Yahoo!\Messenger\yui.dll
IAT            C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[1440] @ C:\Windows\system32\SHELL32.dll [USER32.dll!GetSysColorBrush]  [611390A5] C:\Program Files\Yahoo!\Messenger\yui.dll
IAT            C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[1440] @ C:\Windows\system32\SHELL32.dll [USER32.dll!GetSysColor]      [61138FE2] C:\Program Files\Yahoo!\Messenger\yui.dll
IAT            C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[1440] @ C:\Windows\system32\SHELL32.dll [USER32.dll!DefWindowProcW]    [61139856] C:\Program Files\Yahoo!\Messenger\yui.dll
IAT            C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe[1440] @ C:\Windows\system32\SHELL32.dll [USER32.dll!AnimateWindow]    [611390DD] C:\Program Files\Yahoo!\Messenger\yui.dll

---- Devices - GMER 1.0.15 ----

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                                                                                Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice  \Driver\kbdclass \Device\KeyboardClass1                                                                                Wdf01000.sys (WDF Dynamic/Microsoft Corporation)

Device          \Driver\ACPI_HAL \Device\00000042                                                                                      halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)

AttachedDevice  \Driver\tdx \Device\Tcp                                                                                                mfewfpk.sys (Anti-Virus Mini-Firewall Driver/McAfee, Inc.)
AttachedDevice  \Driver\tdx \Device\Udp                                                                                                mfewfpk.sys (Anti-Virus Mini-Firewall Driver/McAfee, Inc.)
AttachedDevice  \FileSystem\fastfat \Fat                                                                                                fltmgr.sys (Microsoft Dateisystem-Filter-Manager/Microsoft Corporation)

---- Registry - GMER 1.0.15 ----

Reg            HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\0018f337f16b                                           
Reg            HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\0018f337f16b (not active ControlSet)                       

---- EOF - GMER 1.0.15 ----
--- --- ---

Hicke 05.09.2010 17:04
wie startet das boot kit irgendwie ist schwarzer bildschirm da aber es ändert sich nichts...

Hicke 05.09.2010 17:19
kann das fester auch leider nicht kopieren.

Hicke 05.09.2010 17:23
mbr status ok alles grün 1 Zeile. bekomm das was dort steht hier nicht als text rein.

Hicke 05.09.2010 17:30
bootkit remover
mbr status ok dos win32 boot code found

cosinus 05.09.2010 17:55
Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

Hicke 05.09.2010 18:04
ok malewarebyte läuft gleich an.

Hicke 05.09.2010 19:32
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4550

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18943

05.09.2010 20:30:51
mbam-log-2010-09-05 (20-30-51).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Durchsuchte Objekte: 256007
Laufzeit: 1 Stunde(n), 23 Minute(n), 54 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)


Alle Zeitangaben in WEZ +1. Es ist jetzt 18:04 Uhr.
Seite 4 von 5 « Erste 23 4 5
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55