Trojaner-Board
Seite 2 von 5 1 2 34 Letzte »
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Ich Glaube ich bin Infeziert... (https://www.trojaner-board.de/72528-glaube-infeziert.html)

Virusnub 28.04.2009 19:55
Bonjour find ich nicht rest gelöscht
Ich probiers dan mal jetzt

ich sag jetzt schonmal
arigatô gosaimasu
für deine nerven aus stahl

Virusnub 28.04.2009 20:17
So muss aber den log wieder in 2 aufteilen

1.teil
Code:
ComboFix 09-04-27.05 - Sebastian 28.04.2009 21:07.3 - NTFSx86
Microsoft® Windows Vista™ Home Premium  6.0.6001.1.1252.49.1031.18.3070.2397 [GMT 2:00]
ausgeführt von:: c:\users\Sebastian\Desktop\ComboFix.exe
Benutzte Befehlsschalter :: c:\users\Sebastian\Desktop\cfscript.txt
AV: ESET Smart Security 3.0 *On-access scanning disabled* (Updated)
FW: ESET Personal firewall *disabled*
 * Neuer Wiederherstellungspunkt wurde erstellt

FILE ::
c:\users\Sebastian\AppData\Local\GDIPFONTCACHEV1.DAT
c:\windows\system32\perfc007.dat
c:\windows\system32\perfh007.dat
c:\windows\Tasks\1-Click Maintenance.job
.
        /wow section - STAGE 41
Die Datei "temp4001" kann nicht gefunden werden.


((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\Sebastian\AppData\Local\GDIPFONTCACHEV1.DAT
c:\windows\system32\drivers\ovfsthxsbkretnp.sys
c:\windows\system32\ovfsthxbnmiirxq.dll
c:\windows\system32\ovfsthxcxyeropb.dat
c:\windows\system32\ovfsthxdssvimxu.dat
c:\windows\system32\ovfsthxfpnqieub.dll
c:\windows\system32\ovfsthxvnrtwmpx.dll
c:\windows\system32\perfc007.dat
c:\windows\system32\perfh007.dat

.
(((((((((((((((((((((((((((((((((((((((  Treiber/Dienste  )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_ovfsthxqpcdvede
-------\Legacy_XDVA190
-------\Legacy_XDVA208
-------\Service_EsetNod32Fix
-------\Service_npggsvc
-------\Service_XDva190
-------\Service_XDva208


(((((((((((((((((((((((  Dateien erstellt von 2009-05-28 bis 2009-4-28  ))))))))))))))))))))))))))))))
.

2009-04-28 17:27 . 2009-04-28 18:12        27648        ----a-w        c:\windows\system32\lmppcsetup.exe
2009-04-28 12:07 . 2009-04-28 12:07        --------        d-----w        c:\users\Sebastian\AppData\Roaming\Malwarebytes
2009-04-28 12:07 . 2009-04-06 13:32        15504        ----a-w        c:\windows\system32\drivers\mbam.sys
2009-04-28 12:07 . 2009-04-06 13:32        38496        ----a-w        c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-28 12:07 . 2009-04-28 12:07        --------        d-----w        c:\programdata\Malwarebytes
2009-04-28 12:07 . 2009-04-28 12:07        --------        d-----w        c:\users\All Users\Malwarebytes
2009-04-28 10:06 . 2009-04-28 12:06        28672        ----a-w        c:\windows\system32\loader49.exe
2009-04-27 17:50 . 2009-04-27 17:54        --------        d-----w        c:\users\Sebastian\AppData\Roaming\REAPER
2009-04-27 12:51 . 2009-04-27 12:51        --------        d-----w        c:\programdata\id Software
2009-04-27 12:51 . 2009-04-27 12:51        --------        d-----w        c:\users\All Users\id Software
2009-04-26 11:42 . 2009-04-26 11:42        --------        d-----w        c:\users\Sebastian\AppData\Roaming\My Battle for Middle-earth Files
2009-04-25 12:22 . 2008-11-18 08:50        330344        ----a-w        c:\windows\RCoUn.EXE
2009-04-25 12:22 . 2009-04-25 12:22        --------        d-----w        C:\RouterControl
2009-04-18 23:01 . 2009-04-24 19:34        --------        d-----w        c:\users\Sebastian\AppData\Roaming\Meine Die Schlacht um Mittelerde-Dateien
2009-04-18 21:08 . 2009-04-18 21:20        --------        d-----w        c:\users\Sebastian\AppData\Local\Oblivion
2009-04-17 22:33 . 2009-04-17 22:33        --------        d-----w        c:\users\Sebastian\AppData\Roaming\StepMania 4
2009-04-17 08:56 . 2009-02-13 08:49        1255936        ----a-w        c:\windows\system32\lsasrv.dll
2009-04-09 14:45 . 2009-04-09 14:45        --------        d-----w        c:\programdata\wanted
2009-04-09 14:45 . 2009-04-09 14:45        --------        d-----w        c:\users\All Users\wanted
2009-04-09 14:45 . 2009-04-10 22:24        --------        d-----w        c:\users\Sebastian\AppData\Local\wanted
2009-04-09 14:41 . 2008-10-10 02:52        2036576        ----a-w        c:\windows\system32\D3DCompiler_40.dll
2009-04-09 14:41 . 2008-10-10 02:52        452440        ----a-w        c:\windows\system32\d3dx10_40.dll
2009-04-09 14:41 . 2008-10-10 02:52        4379984        ----a-w        c:\windows\system32\D3DX9_40.dll
2009-04-09 14:41 . 2008-10-27 08:04        70992        ----a-w        c:\windows\system32\XAPOFX1_2.dll
2009-04-09 14:41 . 2008-10-27 08:04        514384        ----a-w        c:\windows\system32\XAudio2_3.dll
2009-04-09 14:41 . 2008-10-27 08:04        235856        ----a-w        c:\windows\system32\xactengine3_3.dll
2009-04-09 14:41 . 2008-10-27 08:04        23376        ----a-w        c:\windows\system32\X3DAudio1_5.dll
2009-04-07 18:58 . 2009-04-08 15:02        --------        d-----w        c:\users\Sebastian\AppData\Local\NFS Underground 2
2009-04-05 09:08 . 2009-04-05 09:08        --------        d-----w        c:\users\Sebastian\AppData\Local\Apple Computer
2009-04-05 09:05 . 2009-04-05 09:05        --------        d-----w        c:\programdata\Apple Computer
2009-04-05 09:05 . 2009-04-05 09:05        --------        d-----w        c:\users\All Users\Apple Computer
2009-04-05 09:05 . 2009-04-05 09:05        --------        d-----w        c:\users\Sebastian\AppData\Local\Apple
2009-04-02 19:06 . 2009-04-02 19:06        --------        d-----w        c:\program files\EA Games
2009-04-01 12:06 . 2009-04-01 12:12        --------        d-----w        c:\users\Sebastian\AppData\Local\ZattooPlayer
2009-04-01 12:06 . 2009-04-19 20:35        --------        d-----w        c:\users\Sebastian\AppData\Local\Zattoo

.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-28 19:11 . 2008-10-29 20:35        --------        d-----w        c:\program files\Steam
2009-04-28 17:05 . 2008-10-10 22:38        --------        d-----w        c:\program files\Java
2009-04-27 19:31 . 2008-10-09 13:34        138944        ----a-w        c:\windows\system32\drivers\PnkBstrK.sys
2009-04-27 19:31 . 2008-10-09 13:34        189784        ----a-w        c:\windows\system32\PnkBstrB.exe
2009-04-27 14:21 . 2008-10-09 13:34        75064        ----a-w        c:\windows\system32\PnkBstrA.exe
2009-04-27 12:51 . 2008-10-22 13:00        22328        ----a-w        c:\users\Sebastian\AppData\Roaming\PnkBstrK.sys
2009-04-27 12:51 . 2008-10-22 13:00        2246144        ----a-w        c:\windows\system32\pbsvc.exe
2009-04-19 01:45 . 2008-10-29 20:35        --------        d-----w        c:\program files\Common Files\Steam
2009-04-18 21:09 . 2008-10-09 13:10        --------        d--h--w        c:\program files\InstallShield Installation Information
2009-04-18 17:58 . 2006-11-02 11:18        --------        d-----w        c:\program files\Windows Mail
2009-04-09 14:42 . 2008-10-24 19:17        --------        d-----w        c:\program files\Common Files\Wise Installation Wizard
2009-04-09 14:42 . 2008-10-24 19:17        --------        d-----w        c:\program files\AGEIA Technologies
2009-04-09 14:40 . 2008-10-23 18:44        418480        ----a-w        c:\windows\system32\wrap_oal.dll
2009-04-09 14:40 . 2008-10-23 18:44        115432        ----a-w        c:\windows\system32\OpenAL32.dll
2009-04-05 09:06 . 2008-10-16 12:47        --------        d-----w        c:\program files\QuickTime
2009-03-25 16:21 . 2009-03-25 16:20        --------        d-----w        c:\program files\Common Files\DVDVideoSoft
2009-03-25 16:16 . 2008-10-21 19:43        --------        d-----w        c:\program files\Free YouTube Downloader Converter
2009-03-17 03:38 . 2009-04-17 08:56        40960        ----a-w        c:\windows\AppPatch\apihex86.dll
2009-03-17 03:38 . 2009-04-17 08:56        13824        ----a-w        c:\windows\system32\apilogen.dll
2009-03-17 03:38 . 2009-04-17 08:56        24064        ----a-w        c:\windows\system32\amxread.dll
2009-03-15 14:14 . 2009-01-30 23:57        --------        d-----w        c:\program files\ICQ6
2009-03-09 03:19 . 2008-12-25 21:39        410984        ----a-w        c:\windows\system32\deploytk.dll
2009-03-03 11:02 . 2008-11-21 14:51        680        ----a-w        c:\users\Sebastian\AppData\Local\d3d9caps.dat
2009-03-03 04:46 . 2009-04-17 08:57        3599328        ----a-w        c:\windows\system32\ntkrnlpa.exe
2009-03-03 04:46 . 2009-04-17 08:57        3547632        ----a-w        c:\windows\system32\ntoskrnl.exe
2009-03-03 04:40 . 2009-04-17 08:56        827392        ----a-w        c:\windows\system32\wininet.dll
2009-03-03 04:39 . 2009-04-17 08:57        183296        ----a-w        c:\windows\system32\sdohlp.dll
2009-03-03 04:39 . 2009-04-17 08:57        551424        ----a-w        c:\windows\system32\rpcss.dll
2009-03-03 04:39 . 2009-04-17 08:57        26112        ----a-w        c:\windows\system32\printfilterpipelineprxy.dll
2009-03-03 04:37 . 2009-04-17 08:56        78336        ----a-w        c:\windows\system32\ieencode.dll
2009-03-03 04:37 . 2009-04-17 08:57        98304        ----a-w        c:\windows\system32\iasrecst.dll
2009-03-03 04:37 . 2009-04-17 08:57        54784        ----a-w        c:\windows\system32\iasads.dll
2009-03-03 04:37 . 2009-04-17 08:57        44032        ----a-w        c:\windows\system32\iasdatastore.dll
2009-03-03 03:04 . 2009-04-17 08:57        666624        ----a-w        c:\windows\system32\printfilterpipelinesvc.exe
2009-03-03 02:38 . 2009-04-17 08:57        17408        ----a-w        c:\windows\system32\iashost.exe
2009-03-03 02:28 . 2009-04-17 08:56        26624        ----a-w        c:\windows\system32\ieUnatt.exe
2009-02-22 16:03 . 2009-02-22 15:15        81615        ----a-w        c:\windows\War3Unin.dat
2009-02-22 15:21 . 2009-02-22 15:15        2829        ----a-w        c:\windows\War3Unin.pif
2009-02-22 15:21 . 2009-02-22 15:15        139264        ----a-w        c:\windows\War3Unin.exe
2009-02-15 00:08 . 2009-02-15 00:08        56        ---ha-w        c:\users\All Users\ezsidmv.dat
2009-02-15 00:08 . 2009-02-15 00:08        56        ---ha-w        c:\programdata\ezsidmv.dat
2009-02-13 08:49 . 2009-04-17 08:56        72704        ----a-w        c:\windows\system32\secur32.dll
2009-02-09 03:10 . 2009-03-11 12:30        2033152        ----a-w        c:\windows\system32\win32k.sys
2009-02-05 13:47 . 2006-11-02 10:25        86016        ----a-w        c:\windows\inf\infstrng.dat
2009-02-05 13:47 . 2006-11-02 10:25        51200        ----a-w        c:\windows\inf\infpub.dat
2009-02-05 13:47 . 2006-11-02 10:25        86016        ----a-w        c:\windows\inf\infstor.dat
2009-02-03 03:09 . 2009-02-03 03:09        368640        ----a-w        c:\windows\system32\ReWire.dll
2008-01-21 02:43 . 2006-11-02 12:50        174        --sha-w        c:\program files\desktop.ini
2008-12-23 21:13 . 2008-10-27 21:27        67688        ----a-w        c:\program files\mozilla firefox\components\jar50.dll
2008-12-23 21:13 . 2008-10-27 21:27        54368        ----a-w        c:\program files\mozilla firefox\components\jsd3250.dll
2008-12-23 21:13 . 2008-10-27 21:27        34944        ----a-w        c:\program files\mozilla firefox\components\myspell.dll
2008-12-23 21:13 . 2008-10-27 21:27        46712        ----a-w        c:\program files\mozilla firefox\components\spellchk.dll
2008-12-23 21:13 . 2008-10-27 21:27        172136        ----a-w        c:\program files\mozilla firefox\components\xpinstal.dll
2008-12-09 17:36 . 2008-12-09 17:34        24        --sh--w        c:\windows\S2CC32CAF.tmp
2006-05-03 10:06 . 2009-01-13 20:39        163328        --sh--r        c:\windows\System32\flvDX.dll
2007-02-21 11:47 . 2009-01-13 20:39        31232        --sh--r        c:\windows\System32\msfDX.dll
2008-03-16 13:30 . 2009-01-13 20:39        216064        --sh--r        c:\windows\System32\nbDX.dll
.

(((((((((((((((((((((((((((((  SnapShot@2009-04-28_17.58.46  )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-01-21 01:58 . 2009-04-28 19:06        45520              c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2006-11-02 13:05 . 2009-04-28 19:06        98988              c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
- 2008-10-09 11:35 . 2009-04-28 17:57        16384              c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-10-09 11:35 . 2009-04-28 19:10        16384              c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2008-10-09 11:35 . 2009-04-28 17:57        32768              c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-10-09 11:35 . 2009-04-28 19:10        32768              c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-10-09 11:35 . 2009-04-28 17:57        32768              c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-10-09 11:35 . 2009-04-28 19:10        32768              c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-10-09 12:26 . 2009-04-28 19:06        8426              c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3622106172-2588214691-1172252104-1000_UserData.bin
- 2009-04-28 17:57 . 2009-04-28 17:57        2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2009-04-28 19:10 . 2009-04-28 19:10        2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2009-04-28 17:57 . 2009-04-28 17:57        2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2009-04-28 19:10 . 2009-04-28 19:10        2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2006-11-02 10:33 . 2009-04-28 18:04        586980              c:\windows\System32\perfh009.dat
- 2006-11-02 10:33 . 2009-04-28 17:55        586980              c:\windows\System32\perfh009.dat
+ 2006-11-02 10:33 . 2009-04-28 18:04        101052              c:\windows\System32\perfc009.dat
- 2006-11-02 10:33 . 2009-04-28 17:55        101052              c:\windows\System32\perfc009.dat
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="c:\program files\steam\steam.exe" [2009-01-13 1410296]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-12-10 216520]
"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"DeathAdder"="d:\program files\Razer\DeathAdder\razerhid.exe" [2007-05-07 159744]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2007-12-21 1443072]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"fsc-reg"="c:\programdata\fsc-reg\fscreg.exe" [2007-11-08 533264]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSetActiveDesktop"= 1 (0x1)
"NoActiveDesktopChanges"= 1 (0x1)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute        REG_MULTI_SZ          autocheck autochk *\0OODBS

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Acrobat - Schnellstart.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Acrobat - Schnellstart.lnk
backup=c:\windows\pss\Adobe Acrobat - Schnellstart.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=c:\windows\pss\Adobe Reader Synchronizer.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^Users^Sebastian^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^hamachi.lnk]
path=c:\users\Sebastian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hamachi.lnk
backup=c:\windows\pss\hamachi.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3622106172-2588214691-1172252104-1000]
"EnableNotificationsRef"=dword:00000004

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile\AuthorizedApplications\List]
"c:\\Program Files\\NCsoft\\Exteel (US)\\System\\Exteel.exe"= c:\program files\NCsoft\Exteel (US)\System\Exteel.exe:*:Enabled:Exteel

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{420CF7A8-6220-49F8-A14F-816A66C47A9F}"= UDP:d:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In)
"{9A260409-1E46-409B-945C-AE20225F18FB}"= TCP:d:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In)
"{69A619F8-3940-4B13-B8B4-ECAE5C2076EE}"= UDP:3703:Adobe Version Cue CS3 Server
"{3AF84910-B168-42AD-9B0D-804DBA7D39EE}"= UDP:3704:Adobe Version Cue CS3 Server
"{62610A79-1628-4B3D-9058-CBEBF56E00D7}"= UDP:50900:Adobe Version Cue CS3 Server
"{5D7A2548-E2D0-483C-8F72-0354B5863597}"= UDP:50901:Adobe Version Cue CS3 Server
"{F3535030-3F2F-483F-81F9-0FB155217638}"= UDP:c:\program files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe:Adobe Version Cue CS3 Server
"{A67BEA41-7D45-44B4-B944-EC1837FCA673}"= TCP:c:\program files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe:Adobe Version Cue CS3 Server
"{B1C950BD-8B2B-41F9-B006-10E0E108521D}"= UDP:d:\program files\Outspark\Blackshot\System\BlackShot.exe:BlackShot
"{8981CD66-B621-4780-8935-F9202B57B307}"= TCP:d:\program files\Outspark\Blackshot\System\BlackShot.exe:BlackShot
"{F1DAC8E7-EF5C-441B-A3C9-758EA6E9E3CE}"= UDP:c:\windows\System32\PnkBstrA.exe:PnkBstrA
"{F9CF04FD-22BF-41EC-9B31-65A8744723C1}"= TCP:c:\windows\System32\PnkBstrA.exe:PnkBstrA
"{4F85A7D0-F9A0-4DC8-978A-D3FB3591CB3B}"= UDP:c:\windows\System32\PnkBstrB.exe:PnkBstrB
"{D142E2F4-AE0C-4060-AFDE-8E2BE0D5B0C1}"= TCP:c:\windows\System32\PnkBstrB.exe:PnkBstrB
"{EDB0FA15-2789-4696-AC65-D021A23E1094}"= UDP:d:\program files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx9.exe:Assassin's Creed Dx9
"{86790AA2-1A7D-4642-953E-E3DADB56D2D6}"= TCP:d:\program files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx9.exe:Assassin's Creed Dx9
"{CDC03954-1BA3-49C8-94E0-D2FA75B1315F}"= UDP:d:\program files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx10.exe:Assassin's Creed Dx10
"{17BF99E0-CA1A-4D6C-B7C2-858D1C46A76E}"= TCP:d:\program files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx10.exe:Assassin's Creed Dx10
"{3577C7BF-E77B-4063-93DC-66CF5FFCE9C5}"= UDP:d:\program files\Ubisoft\Assassin's Creed\AssassinsCreed_Launcher.exe:Assassin's Creed Update
"{96D10A8D-0DC3-495D-A2B1-4D3CEECC670B}"= TCP:d:\program files\Ubisoft\Assassin's Creed\AssassinsCreed_Launcher.exe:Assassin's Creed Update
"{81EA2D64-AB42-4209-B2B0-129AFA2068FD}"= UDP:c:\programdata\NexonEU\NGM\NGM.exe:Nexon Game Manager
"{C675FF21-531D-4B3F-9750-543FC32817BC}"= TCP:c:\programdata\NexonEU\NGM\NGM.exe:Nexon Game Manager
"{95B92FB9-1C78-438D-A090-D51067200E78}"= UDP:c:\nexon\Combat Arms EU\NMService.exe:Nexon Messenger Core
"{73A643AC-E587-427B-ACD7-A205BE5A0882}"= TCP:c:\nexon\Combat Arms EU\NMService.exe:Nexon Messenger Core
"{976B6246-2E0D-4279-8E11-FB87BA1A6E13}"= UDP:d:\program files\Activision\Call of Duty - World at War\CoDWaWmp.exe:Call of Duty(R) - World at War(TM)
"{1FF639F2-C190-4157-A276-DF79C3272546}"= TCP:d:\program files\Activision\Call of Duty - World at War\CoDWaWmp.exe:Call of Duty(R) - World at War(TM)
"{53085A04-28E1-4A9E-BB96-5F78FBC5E880}"= UDP:d:\program files\Activision\Call of Duty - World at War\CoDWaW.exe:Call of Duty(R) - World at War(TM)
"{CD877B16-EE4B-4FD3-A666-E94CCD7F0F1B}"= TCP:d:\program files\Activision\Call of Duty - World at War\CoDWaW.exe:Call of Duty(R) - World at War(TM)
"{1F6AA9F3-F6C6-49E3-ADEA-5B56F3F92BB7}"= UDP:5353:Adobe CSI CS4
"{6557981E-A034-41AD-ADB8-598D51B03463}"= UDP:c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:Adobe CSI CS4
"{EE8532F0-14F7-4EB7-BC14-3FDA309F39FA}"= TCP:c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:Adobe CSI CS4
"{51C6C71C-CB6E-49D7-A14F-F06BEC8B4610}"= c:\program files\Skype\Phone\Skype.exe:Skype

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\NCsoft\\Exteel (US)\\System\\Exteel.exe"= c:\program files\NCsoft\Exteel (US)\System\Exteel.exe:*:Enabled:Exteel

S2 ekrn;Eset Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [2007-12-21 468224]
S2 TabletServicePen;TabletServicePen;c:\windows\system32\Pen_Tablet.exe [2008-05-01 3032360]
S2 TeamViewer4;TeamViewer 4;c:\program files\TeamViewer\Version4\TeamViewer_Service.exe [2009-01-28 185640]
S3 DAdderFltr;DeathAdder Mouse;c:\windows\system32\drivers\dadder.sys [2007-04-12 10880]
S3 wacmoumonitor;Wacom Mode Helper;c:\windows\system32\DRIVERS\wacmoumonitor.sys [2008-03-17 15144]

Virusnub 28.04.2009 20:18
2.teil
Code:
--- Andere Dienste/Treiber im Speicher ---

*Deregistered* - sptd
.
Inhalt des "geplante Tasks" Ordners

2009-04-28 c:\windows\Tasks\User_Feed_Synchronization-{333793A4-2076-4470-A6E5-F45FB962AD71}.job
- c:\windows\system32\msfeedssync.exe [2008-01-21 02:24]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.com/ig/redirectdomain?brand=FUJD&bmod=FUJD
mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=FUJD&bmod=FUJD
uInternet Settings,ProxyOverride = *.local
IE: An vorhandenes PDF anfügen - d:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - d:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - d:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Auswahl in Adobe PDF konvertieren - d:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Auswahl in vorhandene PDF-Datei konvertieren - d:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: In Adobe PDF konvertieren - d:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Verknüpfungsziel in Adobe PDF konvertieren - d:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - d:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
FF - ProfilePath - c:\users\Sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\d9syqjq2.default\
FF - prefs.js: browser.startup.homepage - hxxp://anime-freaks.org/
FF - prefs.js: network.proxy.type - 4
FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll
FF - component: c:\program files\Mozilla Firefox\extensions\talkback@mozilla.org\components\qfaservices.dll

---- FIREFOX Richtlinien ----
FF - user.js: yahoo.homepage.dontask - true
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.allow_platform_file_picker", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.cookie.p3plevel",            1); // 0=low, 1=medium, 2=high, 3=custom
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.enablePad",                  false); // Allow client to do proxy autodiscovery
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.hideGoButton", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.search.param.Google.1.default", "chrome://branding/content/searchconfig.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.search.param.Google.1.custom",  "chrome://branding/content/searchconfig.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("signon.prefillForms",                true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.safebrowsing.enabled", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.safebrowsing.remoteLookups", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.safebrowsing.provider.0.updateURL", "http://sb.google.com/safebrowsing/update?client={moz:client}&appver={moz:version}&");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.safebrowsing.provider.0.lookupURL", "http://sb.google.com/safebrowsing/lookup?sourceid=firefox-antiphish&features=TrustRank&client={moz:client}&appver={moz:version}&");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.safebrowsing.provider.0.reportURL", "http://sb.google.com/safebrowsing/report?");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-28 21:11
Windows 6.0.6001 Service Pack 1 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

Scanne versteckte Dateien...


c:\windows\system32\ovfsthxcxyeotbt.dll 18944 bytes executable
c:\windows\system32\ovfsthxdpqixkbr.dll 18432 bytes executable
c:\windows\system32\ovfsthxdvvsprdl.dat 1945 bytes
c:\windows\system32\ovfsthxrexomuyi.dll 60928 bytes executable
c:\windows\system32\ovfsthxxxixwmqr.dat 43 bytes

Scan erfolgreich abgeschlossen
versteckte Dateien: 5

**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_USERS\software\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"

[HKEY_USERS\software\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\Flash9f.ocx"
"ThreadingModel"="Apartment"

[HKEY_USERS\software\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"

[HKEY_USERS\software\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.9"

[HKEY_USERS\software\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\system32\\Macromed\\Flash\\Flash9f.ocx, 1"

[HKEY_USERS\software\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

[HKEY_USERS\software\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"

[HKEY_USERS\software\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"

[HKEY_USERS\software\Classes\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"

[HKEY_USERS\software\Classes\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\Flash9f.ocx"
"ThreadingModel"="Apartment"

[HKEY_USERS\software\Classes\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"

[HKEY_USERS\software\Classes\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\system32\\Macromed\\Flash\\Flash9f.ocx, 1"

[HKEY_USERS\software\Classes\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

[HKEY_USERS\software\Classes\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"

[HKEY_USERS\software\Classes\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"

[HKEY_USERS\software\Classes\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil9f.exe,-101"

[HKEY_USERS\software\Classes\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\Elevation]
"Enabled"=dword:00000001

[HKEY_USERS\software\Classes\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil9f.exe"

[HKEY_USERS\software\Classes\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_USERS\software\Classes\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}]
@Denied: (A 2) (Everyone)
@="IFlashBroker"

[HKEY_USERS\software\Classes\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_USERS\software\Classes\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"

[HKEY_USERS\software\Classes\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}]
@Denied: (A 2) (Everyone)

[HKEY_USERS\software\Classes\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0]
@="Shockwave Flash"

[HKEY_USERS\software\Classes\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}]
@Denied: (A 2) (Everyone)
@=""

[HKEY_USERS\software\Classes\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0]
@="FlashBroker"

[HKEY_USERS\system\ControlSet002\Services\ovfsthxqpcdvede]
@DACL=(02 0000)
"start"=dword:00000001
"type"=dword:00000001
"group"="file system"
"imagepath"=expand:"\\systemroot\\system32\\drivers\\ovfsthxsbkretnp.sys"
"inst"=dword:00000000

[HKEY_USERS\system\ControlSet004\Services\ovfsthxqpcdvede]
@DACL=(02 0000)
"start"=dword:00000001
"type"=dword:00000001
"group"="file system"
"imagepath"=expand:"\\systemroot\\system32\\drivers\\ovfsthxsbkretnp.sys"
"inst"=dword:00000000
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

- - - - - - - > 'Explorer.exe'(3828)
c:\program files\RocketDock\RocketDock.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\System32\Ati2evxx.exe
c:\windows\System32\audiodg.exe
c:\windows\System32\wisptis.exe
c:\program files\Common Files\microsoft shared\ink\TabTip.exe
c:\windows\System32\Ati2evxx.exe
c:\windows\System32\WUDFHost.exe
c:\windows\System32\wisptis.exe
c:\program files\Common Files\microsoft shared\ink\TabTip.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\System32\IoctlSvc.exe
c:\windows\System32\PnkBstrA.exe
c:\program files\Fujitsu Siemens Computers\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe
c:\windows\System32\WUDFHost.exe
c:\windows\System32\WTablet\Pen_TabletUser.exe
c:\windows\System32\rundll32.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\Common Files\Steam\SteamService.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
d:\program files\Razer\DeathAdder\razertra.exe
d:\program files\Razer\DeathAdder\razerofa.exe
c:\windows\System32\wbem\WMIADAP.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2009-04-28 21:15 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2009-04-28 19:15
ComboFix2.txt  2009-04-28 18:01

Vor Suchlauf: 29 Verzeichnis(se), 157.245.497.344 Bytes frei
Nach Suchlauf: 29 Verzeichnis(se), 156.810.317.824 Bytes frei

406        --- E O F ---        2009-04-28 09:41

john.doe 28.04.2009 20:24
GMER - Rootkit Detection

http://pic.leech.it/i/ab0bc/635985fgmer60.jpg
  • Lade Trallala von file-upload.net
  • Klick auf Download (rechts in der Mitte) und speichere es auf den Desktop
  • Doppelklick auf Trallala.exe
  • Drücke Scan, Der Vorgang kann je nach System 3 - 10min dauern
  • nach Beendigung des Scan, drücke "Copy"
  • nun kannst Du das Ergebnis hier einfügen. Sollte das Log zu lang sein, dann lade es bei einem Filehoster wie z.B. Materialordner hoch und poste den Link.
  • Sollte Gmer sagen "Gmer hasen´t found any System Modifikation", so hat Gmer keine Einträge gefunden.

ciao, andreas

Virusnub 28.04.2009 20:56
log
:)

john.doe 28.04.2009 21:07
1.) Anleitung Avenger (by swandog46)

Lade dir das Tool Hopsassa und speichere es auf dem Desktop:
  • Kopiere nun folgenden Text in das weiße Feld bei -> "input script here"
Code:
Drivers to delete:
ovfsthxqpcdvede

Registry keys to delete:
HKLM\SYSTEM\ControlSet001\Services\ovfsthxqpcdvede
HKLM\SYSTEM\ControlSet002\Services\ovfsthxqpcdvede 
HKLM\SYSTEM\ControlSet004\Services\ovfsthxqpcdvede 

Files to delete:
C:\Windows\system32\drivers\ovfsthxsbkretnp.sys
C:\Windows\system32\ovfsthxrexomuyi.dll
C:\Windows\system32\ovfsthxdvvsprdl.dat
C:\Windows\system32\ovfsthxcxyeotbt.dll
C:\Windows\system32\ovfsthxdpqixkbr.dll
C:\Windows\system32\ovfsthxxxixwmqr.dat
http://saved.im/mzi3ndg3nta0/aven.jpg
  • Schliesse nun alle Programme und Browser-Fenster
  • Um den Avenger zu starten klicke auf -> Execute
  • Dann bestätigen mit "Yes" das der Rechner neu startet
  • Nachdem das System neu gestartet ist, findest du einen Report vom Avenger unter -> C:\avenger.txt
  • Öffne die Datei mit dem Editor und kopiere den gesamten Text in deinen Beitrag hier am Trojaner-Board.

2.) Neues Gmer-Log posten.

ciao, andreas

Virusnub 28.04.2009 21:23
avenger log

Code:
Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform:  Windows Vista

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.

Hidden driver "ovfsthxqpcdvede" found!
ImagePath:  \systemroot\system32\drivers\ovfsthxsbkretnp.sys
Start Type:  4 (Disabled)

Rootkit scan completed.

Driver "ovfsthxqpcdvede" deleted successfully.

Error:  registry key "HKLM\SYSTEM\ControlSet001\Services\ovfsthxqpcdvede" not found!
Deletion of registry key "HKLM\SYSTEM\ControlSet001\Services\ovfsthxqpcdvede" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
  --> the object does not exist


Error:  registry key "HKLM\SYSTEM\ControlSet002\Services\ovfsthxqpcdvede" not found!
Deletion of registry key "HKLM\SYSTEM\ControlSet002\Services\ovfsthxqpcdvede" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
  --> the object does not exist

Registry key "HKLM\SYSTEM\ControlSet004\Services\ovfsthxqpcdvede" deleted successfully.
File "C:\Windows\system32\drivers\ovfsthxsbkretnp.sys" deleted successfully.
File "C:\Windows\system32\ovfsthxrexomuyi.dll" deleted successfully.
File "C:\Windows\system32\ovfsthxdvvsprdl.dat" deleted successfully.
File "C:\Windows\system32\ovfsthxcxyeotbt.dll" deleted successfully.
File "C:\Windows\system32\ovfsthxdpqixkbr.dll" deleted successfully.
File "C:\Windows\system32\ovfsthxxxixwmqr.dat" deleted successfully.

Completed script processing.

*******************

Finished!  Terminate.
tralala :D log kommt nach
apropo msb.dll kahm schon wieder ne virus meldung

btw hab grad ne meldung bekommen msb.dll quarantined

Virusnub 28.04.2009 21:41
log2hier hier bitte :)

john.doe 28.04.2009 21:44
1.) Start => Ausführen => combofix /u => OK

2.) Deinstalliere/lösche Gmer und Avenger.

3.) Lade dir ein neues ComboFix runter, lasse es laufen und poste das Log.

ciao, andreas

Virusnub 28.04.2009 21:54
combofix log

:)

john.doe 28.04.2009 22:08
Man, war der hartnäckig. :schmoll:

1.) Deinstalliere:
  • uTorrent
2.) Scripten mit Combofix
  • Öffne den Editor (Start => Zubehör => Editor ) kopiere nun folgenden Text in das weiße Feld:
Code:
KILLALL::

Driver::
nxkagakj

RegLock::
[HKEY_USERS\software\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
[HKEY_USERS\software\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
[HKEY_USERS\software\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
[HKEY_USERS\software\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
[HKEY_USERS\software\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
[HKEY_USERS\software\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
[HKEY_USERS\software\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
[HKEY_USERS\software\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
[HKEY_USERS\software\Classes\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
[HKEY_USERS\software\Classes\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
[HKEY_USERS\software\Classes\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
[HKEY_USERS\software\Classes\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
[HKEY_USERS\software\Classes\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
[HKEY_USERS\software\Classes\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
[HKEY_USERS\software\Classes\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
[HKEY_USERS\software\Classes\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}]
[HKEY_USERS\software\Classes\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\Elevation]
[HKEY_USERS\software\Classes\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\LocalServer32]
[HKEY_USERS\software\Classes\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\TypeLib]
[HKEY_USERS\software\Classes\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}]
[HKEY_USERS\software\Classes\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}\ProxyStubClsid32]
[HKEY_USERS\software\Classes\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}\TypeLib]
[HKEY_USERS\software\Classes\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}]
[HKEY_USERS\software\Classes\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0]
[HKEY_USERS\software\Classes\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}]
[HKEY_USERS\software\Classes\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0]

Registry::
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute        REG_MULTI_SZ          autocheck autochk *
[-HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Acrobat - Schnellstart.lnk]
[-HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3622106172-2588214691-1172252104-1000]
"EnableNotificationsRef"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3622106172-2588214691-1172252104-1000]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{420CF7A8-6220-49F8-A14F-816A66C47A9F}"=-
"{9A260409-1E46-409B-945C-AE20225F18FB}"=-

File::
c:\windows\S2CC32CAF.tmp
c:\users\Sebastian\AppData\Local\GDIPFONTCACHEV1.DAT

Folder::
d:\program files\uTorrent
Speichere diese Datei nun auf dem Desktop unter -> cfscript.txt
  • Nun die Datei cfscript.txt mit der rechten Maustaste auf das Sysmbol von Combofix ziehen!
http://users.pandora.be/bluepatchy/m...s/CFScript.gif
  • Danach das Combofix nochmal ausführen, das System neu starten und das Log von Combofix posten


Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann.

ciao, andreas

Virusnub 28.04.2009 22:12
Utorrent is nicht in meiner software lsite und bei hijack und ccleander is es au net drin ^^

john.doe 28.04.2009 22:14
Dann weiter.

ciao, andreas

Virusnub 28.04.2009 22:33
Log Die hunderste
^^

john.doe 28.04.2009 22:39
Zitat:
Neuste Version des Internet Explorers wird benötigt
Um Verbindung zu dieser Seite aufbauen zu können wird die aktuelle Version des
Internet Explorers benötigt. Bitte installieren Sie ihn jetzt um diesen Fehler zu vermeiden.
Bitte nimm einen anderen Filehoster. Nein, ich werde nicht mit dem MSIE auf eine mir unbekannte Seite gehen.

Und wieso erscheint, wenn ich auf MSIE runterladen klicke diese URL:
h**p://www.opendownload.de/anmelden.php?name=Internet%20Explorer&web=10006&code=sharebase

Und warum steht rechts auf der Seite dann:
Zitat:
Durch Drücken des Buttons "Anmelden" entstehen Ihnen Kosten von 96 Euro inkl. Mehrwertsteuer pro Jahr (12 Monate zu je 8 Euro). Vertragslaufzeit 2 Jahre.
ciao, andreas


Alle Zeitangaben in WEZ +1. Es ist jetzt 09:59 Uhr.
Seite 2 von 5 1 2 34 Letzte »
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131