|
Tr/riern.a.27 Hallo zusammen, ich habe gestern ne Virenmeldung von Antivir bekommenn. Ich soll den Virus Tr/riern.a.27 habe. Hab dann nen Scan mit Antivirs Luke FIlewalker gemacht und danach versucht den Trojaner zu löschen und jetzt scheint oberflächlich wieder alles gut. Trotzdem hab ich gegoogelt und bin auf dieses Board gekommen...Hab jetzt Sysprot durch laufen lassen und RootRepeal läuft gerad. Wäre für Beistand sehr dankbar. Hier schon mal der Inhalt der Sysprotlog.txt : SysProt AntiRootkit v1.0.1.0 by swatkat ****************************************************************************************** ****************************************************************************************** ****************************************************************************************** ****************************************************************************************** Kernel Modules: Module Name: \SystemRoot\System32\Drivers\dump_atapi.sys Service Name: --- Module Base: B807F000 Module End: B8097000 Hidden: Yes Module Name: \SystemRoot\System32\Drivers\dump_WMILIB.SYS Service Name: --- Module Base: F79C5000 Module End: F79C7000 Hidden: Yes ****************************************************************************************** ****************************************************************************************** Kernel Hooks: Hooked Function: ObReferenceObjectByPointer At Address: 804EA8D0 Jump To: 7CCF0990 Module Name: _unknown_ ****************************************************************************************** ****************************************************************************************** Hidden files/folders: Object: G:\movie.xvid Status: Hidden Object: G:\movie2.xvix Status: Hidden Object: G:\movie3.xvix Status: Hidden Object: G:\System Volume Information\MountPointManagerRemoteDatabase Status: Access denied Object: G:\System Volume Information\tracking.log Status: Access denied Object: G:\System Volume Information\_restore{60B3FCAA-4131-422D-87CA-196D8BD18027} Status: Access denied Object: F:\System Volume Information\MountPointManagerRemoteDatabase Status: Access denied Object: F:\System Volume Information\tracking.log Status: Access denied Object: F:\System Volume Information\_restore{60B3FCAA-4131-422D-87CA-196D8BD18027} Status: Access denied Object: E:\System Volume Information\MountPointManagerRemoteDatabase Status: Access denied Object: E:\System Volume Information\tracking.log Status: Access denied Object: E:\System Volume Information\_restore{60B3FCAA-4131-422D-87CA-196D8BD18027} Status: Access denied Object: D:\System Volume Information\MountPointManagerRemoteDatabase Status: Access denied Object: D:\System Volume Information\tracking.log Status: Access denied Object: D:\System Volume Information\_restore{60B3FCAA-4131-422D-87CA-196D8BD18027} Status: Access denied Object: C:\Programme\PokerStars\HandHistory\Hans1234\HH20080406 Status: Hidden Object: C:\System Volume Information\MountPointManagerRemoteDatabase Status: Access denied Object: C:\System Volume Information\tracking.log Status: Access denied Object: C:\System Volume Information\_restore{60B3FCAA-4131-422D-87CA-196D8BD18027} Status: Access denied |
ROOTREPEAL (c) AD, 2007-2009 ================================================== Scan Start Time: 2009/09/23 14:26 Program Version: Version 1.3.5.0 Windows Version: Windows XP SP2 ================================================== Drivers ------------------- Name: dump_atapi.sys Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys Address: 0xB807F000 Size: 98304 File Visible: No Signed: - Status: - Name: dump_WMILIB.SYS Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS Address: 0xF79C5000 Size: 8192 File Visible: No Signed: - Status: - Name: rootrepeal.sys Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys Address: 0xB659C000 Size: 49152 File Visible: No Signed: - Status: - Hidden/Locked Files ------------------- Path: c:\dokumente und einstellungen\all users\anwendungsdaten\avira\antivir desktop\temp\avguard.tmp Status: Allocation size mismatch (API: 30466048, Raw: 0) SSDT ------------------- #: 041 Function Name: NtCreateKey Status: Hooked by "<unknown>" at address 0xf7a8bf2e #: 053 Function Name: NtCreateThread Status: Hooked by "<unknown>" at address 0xf7a8bf24 #: 063 Function Name: NtDeleteKey Status: Hooked by "<unknown>" at address 0xf7a8bf33 #: 065 Function Name: NtDeleteValueKey Status: Hooked by "<unknown>" at address 0xf7a8bf3d #: 098 Function Name: NtLoadKey Status: Hooked by "<unknown>" at address 0xf7a8bf42 #: 122 Function Name: NtOpenProcess Status: Hooked by "<unknown>" at address 0xf7a8bf10 #: 128 Function Name: NtOpenThread Status: Hooked by "<unknown>" at address 0xf7a8bf15 #: 193 Function Name: NtReplaceKey Status: Hooked by "<unknown>" at address 0xf7a8bf4c #: 204 Function Name: NtRestoreKey Status: Hooked by "<unknown>" at address 0xf7a8bf47 #: 247 Function Name: NtSetValueKey Status: Hooked by "<unknown>" at address 0xf7a8bf38 #: 257 Function Name: NtTerminateProcess Status: Hooked by "<unknown>" at address 0xf7a8bf1f ==EOF== Antivir hab ich nochmal durchlaufen lassen, und es findet nichts mehr. Also laut Antivir is wieder alles in Ordnung. |
Hier auch noch die HijackThis Log...BITTE BITTE helft mir Logfile of HijackThis v1.99.1 Scan saved at 5:59:46 PM, on 09/23/2009 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Programme\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\System32\brsvc01a.exe C:\WINDOWS\System32\brss01a.exe C:\WINDOWS\system32\spoolsv.exe C:\Programme\Avira\AntiVir Desktop\sched.exe C:\Programme\Avira\AntiVir Desktop\avguard.exe C:\WINDOWS\System32\CTsvcCDA.EXE C:\WINDOWS\system32\FsUsbExService.Exe C:\Programme\ICQ6Toolbar\ICQ Service.exe C:\Programme\Microsoft LifeCam\MSCamS32.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\HPZipm12.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\Explorer.EXE C:\Programme\Creative\Shared Files\Module Loader\DLLML.exe C:\WINDOWS\CTHELPER.EXE C:\Programme\HP\HP Software Update\HPWuSchd2.exe C:\Programme\Java\jre1.5.0_10\bin\jusched.exe C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe C:\Programme\ScanSoft\PaperPort\pptd40nt.exe C:\WINDOWS\vVX3000.exe C:\Programme\Avira\AntiVir Desktop\avgnt.exe C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe C:\Programme\PTBSyncKalender\PTBSync.exe C:\Programme\Skype\Phone\Skype.exe C:\Programme\Spybot - Search & Destroy\TeaTimer.exe C:\Programme\phonostar\ps_timer.exe C:\Programme\Samsung\Samsung New PC Studio\NPSAgent.exe C:\WINDOWS\system32\ctfmon.exe C:\Programme\ICQ6.5\ICQ.exe C:\Programme\Siemens\Gigaset USB Stick 108\Gcc.exe C:\Programme\NETGEAR\WG311v3\wlancfg5.exe C:\Programme\Siemens\Gigaset USB Stick 108\OdHost.exe C:\Programme\Skype\Plugin Manager\skypePM.exe C:\WINDOWS\System32\wbem\wmiapsrv.exe C:\Programme\Mozilla Firefox\firefox.exe C:\Programme\Combined Community Codec Pack\MPC\mplayerc.exe C:\Dokumente und Einstellungen\StaneZ\Desktop\abc.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.icq.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedirect?o=13165&gct=&gc=1&q= R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedirect?o=13165&gct=&gc=1&q= R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://toolbar.ask.com/toolbarv/askRedirect?o=13165&gct=&gc=1&q=%s R3 - URLSearchHook: DefaultSearchHook Class - {C94E154B-1459-4A47-966B-4B843BEFC7DB} - C:\Programme\AskSearch\bin\DefaultSearch.dll R3 - URLSearchHook: (no name) - - (no file) R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Programme\AskBarDis\bar\bin\askBar.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.5.0_10\bin\ssv.dll O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Programme\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Programme\AskBarDis\bar\bin\askBar.dll O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll O4 - HKLM\..\Run: [AudioDrvEmulator] "C:\Programme\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "C:\Programme\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll" O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [HP Software Update] "C:\Programme\HP\HP Software Update\HPWuSchd2.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre1.5.0_10\bin\jusched.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Programme\Gemeinsame Dateien\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot O4 - HKLM\..\Run: [PaperPort PTD] C:\Programme\ScanSoft\PaperPort\pptd40nt.exe O4 - HKLM\..\Run: [IndexSearch] C:\Programme\ScanSoft\PaperPort\IndexSearch.exe O4 - HKLM\..\Run: [SetDefPrt] C:\Programme\Brother\Brmfl05a\BrStDvPt.exe O4 - HKLM\..\Run: [ControlCenter2.0] C:\Programme\Brother\ControlCenter2\brctrcen.exe /autorun O4 - HKLM\..\Run: [ICQ Lite] "C:\Programme\ICQLite\ICQLite.exe" -minimize O4 - HKLM\..\Run: [LifeCam] "C:\Programme\Microsoft LifeCam\LifeExp.exe" O4 - HKLM\..\Run: [VX3000] C:\WINDOWS\vVX3000.exe O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min O4 - HKLM\..\Run: [GrooveMonitor] "C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [PTBSync] C:\Programme\PTBSyncKalender\PTBSync.exe /Start O4 - HKLM\..\Run: [MsgCenterExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\RealOneMessageCenter.exe" -osboot O4 - HKCU\..\Run: [Skype] "C:\Programme\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\Run: [PhonostarTimer] C:\Programme\phonostar\ps_timer.exe O4 - HKCU\..\Run: [AutoStartNPSAgent] C:\Programme\Samsung\Samsung New PC Studio\NPSAgent.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [WAB] C:\Dokumente und Einstellungen\StaneZ\Anwendungsdaten\Macromedia\Common\69e4801a19.exe O4 - HKCU\..\Run: [ICQ] "C:\Programme\ICQ6.5\ICQ.exe" silent O4 - Global Startup: Gigaset WLAN Adapter Monitor.lnk = C:\Programme\Siemens\Gigaset USB Stick 108\Gcc.exe O4 - Global Startup: NETGEAR WG311v3 Wireless Assistant.lnk = ? O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programme\PartyGaming\PartyPoker\RunApp.exe O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programme\PartyGaming\PartyPoker\RunApp.exe O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe (file missing) O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe (file missing) O9 - Extra button: Unibet Poker - {C53BFCFC-7A54-4627-AEBA-2CD4871FCA97} - C:\Microgaming\Poker\UnibetpokerMPP\MPPoker.exe O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://static.pe.studivz.net/photouploader/ImageUploader4.cab?nocache=1203254965 O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) - http://drmlicense.one.microsoft.com/crlupdate/en/crlocx.ocx O17 - HKLM\System\CCS\Services\Tcpip\..\{41770D7B-0BE2-4979-B077-C4EBE6105B36}: NameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\..\{F8878058-35F1-46AB-B6B4-EA84EE75CCE3}: NameServer = 192.168.2.1 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\MSOXMLMF.DLL O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Programme\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\sched.exe O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\avguard.exe O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\System32\brsvc01a.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Programme\MAGIX\Common\Database\bin\fbserver.exe O23 - Service: FsUsbExService - Teruten - C:\WINDOWS\system32\FsUsbExService.Exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: ICQ Service - Unknown owner - C:\Programme\ICQ6Toolbar\ICQ Service.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: PostgreSQL Database Server 8.3 (pgsql-8.3) - PostgreSQL Global Development Group - C:\Programme\PostgreSQL\8.3\bin\pg_ctl.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe |
Hallo Jayston und :hallo: Code: O4 - HKCU\..\Run: [WAB] C:\Dokumente und Einstellungen\StaneZ\Anwendungsdaten\Macromedia\Co mmon\69e4801a19.exeSilent Banker: Leiser Trojaner spezialisiert auf Online-Bankraub - Man-in-the-Middle-Angrife leichtgemacht | TecChannel.de Das Ding hatsin Sich. Betreibst du Online-Banking? Wenn ja, wurdest du in letzter Zeit von deiner "Online-Banking-Seite" zur Eingabe von TAN's aufgefordert? Wenn ja, hast du welche eingegeben? Wenn ja, informiere deine Bank so schnell wie möglich! Ich würde dir ein Neuaufsetzen ans Herz legen. Es ist die sichertste und schnellste Methode. http://www.trojaner-board.de/51262-a...sicherung.html Viel Erfolg! Gruß Handball10 |
Zitat:
Also ich betreibe Online Banking, nach TANs wurde ich allerdings nicht befragt. Zur Neuinstallation: Was muss ich da beachten, gibs da vielleicht nen Hilfreichen link zu? Ich bin echt kein Experte in der Richtung. Was muss und wie kann ich vorher alles sichern? Fotos, Filme und andere Dateien etc. auf anderen Festplattenpartitionen (also nicht auf C)? Wie schauts mit Favoriten im Firefox und anderen wichtigen sachen wie Treiber etc. aus? Gibts da vielleicht nen gutes Programm? Wäre echt dankbar wenn mir hierbei jemand meine Fragen beantworten kann.... |
| Alle Zeitangaben in WEZ +1. Es ist jetzt 17:32 Uhr. |
Copyright ©2000-2025, Trojaner-Board