Trojaner-Board - Hilfe! Trojaner, was tun?

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - Hilfe! Trojaner, was tun? (https://www.trojaner-board.de/71840-hilfe-trojaner-tun.html)

ok alles klar danke

mfg

ich meld mich nochmal. und zwar habe ich meinen rechner heute gestartet und dann erschien ein fenster

Autolt Error
Line -1:
Error: The requested action with this object has failed.

hängt das wahrscheinlich mit dem virus zusammen? und wie kann ich den fehler beheben?
mfg

Nur der Vollständigkeit halber:

ThreatExpert Report: Mal/Generic-A, Win-Trojan/Xema.variant

Avira Antivirus Solutions

VT läuft auch wieder:

Code:

Datei DSC4338ed7.jpg___________.exe empfangen 2009.04.09 15:48:29 (CET)

Status:   Beendet 

Ergebnis: 19/40 (47.5%) 

 Filter 

Drucken der Ergebnisse  Antivirus        Version        letzte aktualisierung        Ergebnis

a-squared        4.0.0.101        2009.04.09        Backdoor.Win32.VB!IK

AhnLab-V3        5.0.0.2        2009.04.09        Win-Trojan/Xema.variant

AntiVir        7.9.0.138        2009.04.09        TR/VB.myl.1

Antiy-AVL        2.0.3.1        2009.04.09        Trojan/Win32.VB

Authentium        5.1.2.4        2009.04.08        -

Avast        4.8.1335.0        2009.04.08        -

AVG        8.5.0.285        2009.04.09        Dropper.Small.BFM

BitDefender        7.2        2009.04.09        -

CAT-QuickHeal        10.00        2009.04.09        Trojan.VB.myl

ClamAV        0.94.1        2009.04.09        -

Comodo        1107        2009.04.09        -

DrWeb        4.44.0.09170        2009.04.09        -

eSafe        7.0.17.0        2009.04.07        Win32.Injector.Lk

eTrust-Vet        31.6.6447        2009.04.09        -

F-Prot        4.4.4.56        2009.04.08        -

F-Secure        8.0.14470.0        2009.04.09        Trojan.Win32.VB.myl

Fortinet        3.117.0.0        2009.04.09        PossibleThreat

GData        19        2009.04.09        -

Ikarus        T3.1.1.49.0        2009.04.09        Backdoor.Win32.VB

K7AntiVirus        7.10.697        2009.04.08        -

Kaspersky        7.0.0.125        2009.04.09        Trojan.Win32.VB.myl

McAfee        5578        2009.04.08        Generic.dx

McAfee+Artemis        5578        2009.04.08        Generic.dx

McAfee-GW-Edition        6.7.6        2009.04.09        Trojan.VB.myl.1

Microsoft        1.4502        2009.04.09        -

NOD32        3997        2009.04.09        a variant of Win32/Injector.LK

Norman        6.00.06        2009.04.09        -

nProtect        2009.1.8.0        2009.04.09        -

Panda        10.0.0.14        2009.04.08        -

PCTools        4.4.2.0        2009.04.08        -

Prevx1        V2        2009.04.09        Medium Risk Malware

Rising        21.24.32.00        2009.04.09        -

Sophos        4.40.0        2009.04.09        Mal/Generic-A

Sunbelt        3.2.1858.2        2009.04.09        Trojan.Unclassified.gen

Symantec        1.4.4.12        2009.04.09        Trojan Horse

TheHacker        6.3.4.0.305        2009.04.09        -

TrendMicro        8.700.0.1004        2009.04.09        -

VBA32        3.12.10.2        2009.04.09        -

ViRobot        2009.4.7.1686        2009.04.09        -

VirusBuster        4.6.5.0        2009.04.09        -

weitere Informationen

File size: 921387 bytes

MD5...: 38ea5ca6c20c61943c0c08fa15945cac

SHA1..: 68e29561845f0970fea6513392383c063eb95c60

SHA256: db3323d0bebdc289ac0fa953a2dd563ade59d7a2414df73c91d0e081eacf5b36

SHA512: 62477ed571de5eac7cd9da2cffc7e9835c02d810f7ebdcefe6d1887bfda384e1

c46f3307fe9cc0851b1d993cf84a6fa4347152e1636c7e37278064b9d5574da5

ssdeep: 24576:Iiv1iUlOAizRL4hK9bna1tuP92QaMp354Zs2MM:Iiv11lOVLqK9bnay12Q

aMpJ6IM

PEiD..: -

TrID..: File type identification

Win32 Executable Microsoft Visual Basic 6 (86.2%)

Win32 Executable Generic (5.8%)

Win32 Dynamic Link Library (generic) (5.1%)

Generic Win/DOS Executable (1.3%)

DOS Executable Generic (1.3%)

PEInfo: PE Structure information
 

( base data )

entrypointaddress.: 0x263c

timedatestamp.....: 0x49c89dd1 (Tue Mar 24 08:46:09 2009)

machinetype.......: 0x14c (I386)
 

( 3 sections )

name viradd virsiz rawdsiz ntrpy md5

.text 0x1000 0xf110 0x10000 5.57 f9e25811d33b8abbc6d892544a7e9451

.data 0x11000 0x67c 0x1000 0.00 620f0b67a91f7f74151bc5be745b7110

.rsrc 0x12000 0xaf518 0xb0000 7.99 377137d3abd855b31935e7904713e5ee
 

( 1 imports ) 

> MSVBVM60.DLL: __vbaVarSub, __vbaStrI2, _CIcos, _adj_fptan, __vbaVarMove, __vbaVarVargNofree, __vbaAryMove, __vbaFreeVar, __vbaStrVarMove, __vbaLenBstr, __vbaEnd, __vbaFreeVarList, __vbaVarIdiv, _adj_fdiv_m64, -, _adj_fprem1, __vbaRecAnsiToUni, __vbaResume, __vbaStrCat, __vbaVarCmpNe, __vbaRecDestruct, __vbaSetSystemError, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaVarTstLe, __vbaAryVar, __vbaVarCmpGe, __vbaAryDestruct, __vbaVarForInit, -, __vbaVarPow, __vbaExitProc, -, __vbaStrLike, __vbaObjSet, __vbaOnError, _adj_fdiv_m16i, _adj_fdivr_m16i, __vbaVarIndexLoad, -, __vbaBoolVarNull, _CIsin, __vbaErase, -, -, __vbaVarZero, -, __vbaVarCmpGt, __vbaChkstk, -, __vbaFileClose, -, -, __vbaStrCmp, __vbaPutOwner3, __vbaVarTstEq, __vbaAryConstruct2, DllFunctionCall, -, __vbaVarOr, _adj_fpatan, __vbaRedim, __vbaRecUniToAnsi, -, -, _CIsqrt, __vbaVarAnd, __vbaVarMul, __vbaExceptHandler, -, __vbaPrintFile, __vbaStrToUnicode, _adj_fprem, _adj_fdivr_m64, -, __vbaVarDiv, -, __vbaVarCmpLe, __vbaFPException, -, __vbaStrVarVal, __vbaUbound, __vbaVarCat, -, -, _CIlog, __vbaFileOpen, __vbaVar2Vec, -, __vbaNew2, __vbaInStr, _adj_fdiv_m32i, -, _adj_fdivr_m32i, __vbaStrCopy, __vbaVarCmpLt, __vbaFreeStrList, _adj_fdivr_m32, __vbaPowerR8, _adj_fdiv_r, -, -, __vbaI4Var, __vbaVarCmpEq, __vbaAryLock, __vbaVarAdd, __vbaVarDup, __vbaStrToAnsi, __vbaFpI2, __vbaVarMod, -, __vbaFpI4, -, _CIatan, __vbaAryCopy, __vbaStrMove, __vbaStrVarCopy, -, _allmul, _CItan, __vbaAryUnlock, __vbaVarForNext, _CIexp, __vbaI4ErrVar, __vbaFreeObj, __vbaFreeStr, -
 

( 0 exports ) 

RDS...: NSRL Reference Data Set

-

ThreatExpert info: <a href='http://www.threatexpert.com/report.aspx?md5=38ea5ca6c20c61943c0c08fa15945cac' target='_blank'>http://www.threatexpert.com/report.aspx?md5=38ea5ca6c20c61943c0c08fa15945cac</a>

Prevx info: <a href='http://info.prevx.com/aboutprogramtext.asp?PX5=253D9A232B66EECC0F970E429ABF28005BF04A76' target='_blank'>http://info.prevx.com/aboutprogramtext.asp?PX5=253D9A232B66EECC0F970E429ABF28005BF04A76</a>

Zitat:

naja das macht mir jetzt schon ein wenig Sorgen.

:) Soso, nur ein wenig also. :D

ciao, andreas

Zitat:

Klicke anschliessend auf "Für alle Neuen" in meiner Signatur, lies alles aufmerksam und arbeite die Liste unter Punkt 2 ab.

ciao, andreas

Malwarebytes' Anti-Malware 1.36
Datenbank Version: 1963
Windows 6.0.6001 Service Pack 1

10.04.2009 23:33:22
mbam-log-2009-04-10 (23-33-22).txt

Scan-Methode: Vollständiger Scan (C:\|)
Durchsuchte Objekte: 161860
Laufzeit: 1 hour(s), 17 minute(s), 5 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 1
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 4

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winprox32_1 (Trojan.Proxy) -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\Users\knolle\AppData\Roaming\psvrr.exe (Trojan.Proxy) -> Quarantined and deleted successfully.
C:\Users\knolle\AppData\Roaming\psvr32.exe (Trojan.Proxy) -> Quarantined and deleted successfully.
C:\Users\knolle\AppData\Roaming\_41986ed99cf39a51e1c2841cf85fe567\down\nDler001.exe (Trojan.Agent.V) -> Quarantined and deleted successfully.
C:\Users\knolle\AppData\Roaming\_41986ed99cf39a51e1c2841cf85fe567\down\prox000.exe (Trojan.Proxy) -> Quarantined and deleted successfully.

Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 9 - Deutsch
Apple Mobile Device Support
Apple Software Update
Ashampoo Burning Studio 6 FREE
Ask Toolbar
Assassin's Creed
Avira AntiVir Personal - Free Antivirus
Battlefield 2(TM)
Bonjour
CCleaner (remove only)
DivX Codec
DivX Converter
DivX Player
DivX Plus DirectShow Filters
DivX Web Player
Free Audio Dub version 1.4
Free Video to iPod Converter version 3.1
Free Video to Mp3 Converter version 3.1
Free YouTube to Mp3 Converter version 3.1
Grand Theft Auto IV
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
ICQ6.5
IrfanView (remove only)
iTunes
Java(TM) 6 Update 13
LastChaosGER
Malwarebytes' Anti-Malware
McLoad Preinstaller
Microsoft .NET Framework 3.5 Language Pack SP1 - deu
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1
Microsoft Games for Windows - LIVE Redistributable
Microsoft Silverlight
Microsoft Visual C++ 2005 Redistributable
Mozilla Firefox (3.0.8)
MSN Toolbar
NVIDIA Drivers
QuickTime
Rockstar Games Social Club
Uninstall 1.0.0.1
VC80CRTRedist - 8.0.50727.762
Virtual DJ - Atomix Productions
VLC media player 0.9.8a
Windows Media Player Firefox Plugin
WinRAR

1.) Ich brauche den Inhalt des Ordners:

Code:

C:\Users\Knolle\AppData\Roaming\

2.) Lasse folgendes Avengerskript laufen:

Code:

Folders to delete:

C:\Users\Knolle\AppData\Roaming\_41986ed99cf39a51e1c2841cf85fe567
 

Files to delete:

C:\Users\Knolle\AppData\Roaming\svchost.exe

Poste das Log.

3.) Deinstalliere:
Apple Software Update
Ask Toolbar
Bonjour
MSN Toolbar
Uninstall 1.0.0.1

4.) Poste ein aktuelles HJT-Log.

ciao, andreas

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:49:10, on 10.04.2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.0744.0\msneshellx.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.0744.0\msneshellx.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O13 - Gopher Prefix:
O23 - Service: Avira AntiVir Personal - Free Antivirus Planer (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe

--
End of file - 4648 bytes

Bitte die Reihenfolge strikt einhalten. Ich habe mir schon etwa dabei gedacht. :)

ciao, andreas

Zitat:

Zitat von john.doe (Beitrag 427638)

1.) Ich brauche den Inhalt des Ordners:

Code:

C:\Users\Knolle\AppData\Roaming\

2.) Lasse folgendes Avengerskript laufen:

Code:

Folders to delete:

C:\Users\Knolle\AppData\Roaming\_41986ed99cf39a51e1c2841cf85fe567
 

Files to delete:

C:\Users\Knolle\AppData\Roaming\svchost.exe

Poste das Log.

wie zeige ich dir den inhalt des ordners und wie lasse ich den avangerskript laufen?
mfg

Zitat:

wie zeige ich dir den inhalt des ordners

Mit dem Windowsexplorer zu dem Ordner navigieren, Screenshot erstellen ([Druck]-Taste), Grafikprogramm starten, einfügen, speichern, beim Imagehoster (z.B. PiC.LEECH.iT - FREE iMAGE HOSTiNG) hochladen und hier den Link posten.

Zitat:

wie lasse ich den avangerskript laufen?

Genau wie du es hier schon einmal gemacht hast: http://www.trojaner-board.de/427081-post9.html

ciao, andreas

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows Vista

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

Error: could not open folder "C:\Users\Knolle\AppData\Roaming\_41986ed99cf39a51e1c2841cf85fe567"
Deletion of folder "C:\Users\Knolle\AppData\Roaming\_41986ed99cf39a51e1c2841cf85fe567" failed!
Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)
--> bad path / the parent directory does not exist

Error: could not open file "C:\Users\Knolle\AppData\Roaming\svchost.exe"
Deletion of file "C:\Users\Knolle\AppData\Roaming\svchost.exe" failed!
Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)
--> bad path / the parent directory does not exist

Completed script processing.

*******************

Finished! Terminate.

ich krieg das grad nit gebacken den screenshot hochzuladen:balla:
ist der wichtig? oder kann ich jetzt hiermit weitermachen?

Deinstalliere:
Apple Software Update
Ask Toolbar
Bonjour
MSN Toolbar
Uninstall 1.0.0.1

Poste ein aktuelles HJT-Log.

danke mfg knolle

Ja.

Gute Nacht, andreas