| sebastian h. | 01.06.2010 15:40 |
Ebenfalls Probleme mit Beseitigung von Antimalware Doctor
Hallo,
Ich habe ebenfalls das Problem wie einige andere auch, dass sich der Malware Doctor als realtiv hartnäckig erweist. Anbei der Log vom ersten Scan, habe noch einen weiteren gemacht, jedoch ohne bewusste. Das stoppt den Antimalware Doctor jedoch nicht davon, bei jedem Neustart wieder aufzutauchen. Zitat:
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org
Datenbank Version: 4160
Windows 6.1.7600
Internet Explorer 8.0.7600.16385
01.06.2010 13:03:50
mbam-log-2010-06-01 (13-03-50).txt
Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|)
Durchsuchte Objekte: 283295
Laufzeit: 57 Minute(n), 41 Sekunde(n)
Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 9
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 1
Infizierte Dateien: 13
Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel:
HKEY_CLASSES_ROOT\AppID\{38061edc-40bb-4618-a8da-e56353347e6d} (Adware.EZlife) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{7b6a2552-e65b-4a9e-add4-c45577ffd8fd} (Adware.EZLife) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Antimalware Doctor Inc (Rogue.AntimalwareDoctor) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\avsoft (Trojan.Fraudpack) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\avsuite (Rogue.AntivirusSuite) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Antimalware Doctor (Rogue.AntimalwareDoctor) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Trymedia Systems (Adware.TryMedia) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\avsoft (Trojan.Fraudpack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\avsuite (Rogue.AntivirusSuite) -> Quarantined and deleted successfully.
Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)
Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse:
C:\cleansweep.exe (Trojan.Agent) -> Delete on reboot.
Infizierte Dateien:
C:\Poker\Titan Poker\_SetupPoker_79fe6a.exe (Adware.Casino) -> Quarantined and deleted successfully.
C:\Users\MastaP89\AppData\Local\Temp\~TM9EDF.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Users\MastaP89\Documents\ICQ\474344853\ReceivedFiles\303221604 Jojojoxx\Fr!tzBox Reconnect\nc.exe (PUP.KeyLogger) -> Quarantined and deleted successfully.
C:\Users\MastaP89\Downloads\SetupPoker_79fe6a.exe (Adware.Casino) -> Quarantined and deleted successfully.
C:\Windows\System32\spool\prtprocs\w32x86\39F6.tmp (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\spool\prtprocs\w32x86\B37E.tmp (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\Windows\Temp\632F.tmp (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\Users\MastaP89\Desktop\Antimalware Doctor.lnk (Rogue.AntimalwareDoctor) -> Quarantined and deleted successfully.
C:\Users\MastaP89\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Antimalware Doctor.lnk (Rogue.AntimalwareDoctor) -> Quarantined and deleted successfully.
C:\cleansweep.exe\cleansweep.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\MastaP89\AppData\Roaming\Microsoft\Windows\Start Menu\Antimalware Doctor.lnk (Rogue.AntimalwareDoctor) -> Quarantined and deleted successfully.
C:\Users\MastaP89\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antimalware Doctor.lnk (Rogue.AntiMalwareDoctor) -> Quarantined and deleted successfully.
| und noch der rkill log Zitat:
This log file is located at C:\rkill.log.
Please post this only if requested to by the person helping you.
Otherwise you can close this log when you wish.
Ran as MastaP89 on 01.06.2010 at 16:29:03.
Processes terminated by Rkill or while it was running:
C:\Windows\System32\rundll32.exe
C:\Users\MastaP89\AppData\Roaming\E8D5599E4454339C02C891795E98A4C3\gotnewupdate000.exe
C:\Users\MastaP89\Downloads\rkill.com
Rkill completed on 01.06.2010 at 16:29:11.
| und der cc-cleaner log (glaube ich zumindest) Zitat:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls]
"C:\\Program Files\\Common Files\\PX Storage Engine\\pxwma.dll"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls]
"C:\\Windows\\system32\\NvApps.xml"=dword:00000004
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls]
"C:\\Windows\\system32\\NvwsApps.xml"=dword:00000004
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls]
"C:\\Windows\\system32\\nvcpl.dll"=dword:00000004
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls]
"C:\\Windows\\system32\\nvmctray.dll"=dword:00000004
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls]
"C:\\Windows\\system32\\nvshext.dll"=dword:00000004
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls]
"C:\\Windows\\system32\\nvsvc.dll"=dword:00000004
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls]
"C:\\Windows\\system32\\nvsvcr.dll"=dword:00000004
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls]
"C:\\Windows\\system32\\nvvsvc.exe"=dword:00000004
[HKEY_CLASSES_ROOT\{80b8c23c-16e0-4cd8-bbc3-cecec9a78b79}]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.08]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.08\OpenWithList]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.blob]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.blob\OpenWithList]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.d2i]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.d2i\OpenWithList]
"a"="shadowmaster.exe"
"MRUList"="a"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.det]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.det\OpenWithList]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dfm]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dfm\OpenWithList]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dlc]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dlc\OpenWithList]
"a"="firefox.exe"
"MRUList"="a"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exec]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exec\OpenWithList]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.flmod]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.flmod\OpenWithList]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.grm]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.grm\OpenWithList]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.int]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.int\OpenWithList]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.item]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.item\OpenWithList]
"a"="shadowmaster.exe"
"MRUList"="a"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.orig]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.orig\OpenWithList]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.prefs]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.prefs\OpenWithList]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.srt]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.srt\OpenWithList]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tmp]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tmp\OpenWithList]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.u]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.u\OpenWithList]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ws/3/RaiSports]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ws/3/RaiSports\OpenWithList]
"a"="vlc.exe"
"MRUList"="a"
[HKEY_CLASSES_ROOT\AKN_AUTO\shell\open]
[HKEY_CLASSES_ROOT\AKN_AUTO\shell\open\command]
@"="\"C:\\Program Files\\UB\\SkinUpdate.exe\" \"%1\""
[HKEY_CLASSES_ROOT\CLSID\{9A516B97-E7C1-451B-9165-C5035994A3F5}]
@"="CNvViewObject Class"
[HKEY_CLASSES_ROOT\CLSID\{9A516B97-E7C1-451B-9165-C5035994A3F5}\InprocServer32]
@"="C:\\Windows\\system32\\nvapi.dll"
"ThreadingModel"="Apartment"
[HKEY_CLASSES_ROOT\CLSID\{9A516B97-E7C1-451B-9165-C5035994A3F5}\ProgID]
@"="NvViewHelperLib.CNvViewObject.1"
[HKEY_CLASSES_ROOT\CLSID\{9A516B97-E7C1-451B-9165-C5035994A3F5}\Programmable]
[HKEY_CLASSES_ROOT\CLSID\{9A516B97-E7C1-451B-9165-C5035994A3F5}\TypeLib]
@"="{9608287A-04b4-45A6-80AA-6B2D539F3AE1}"
[HKEY_CLASSES_ROOT\CLSID\{9A516B97-E7C1-451B-9165-C5035994A3F5}\VersionIndependentProgID]
@"="NvViewHelperLib.CNvViewObject"
[HKEY_CLASSES_ROOT\CLSID\{B63E31D0-87B5-477F-B224-4A35B6BECED6}]
@"="NVIDIA CUDA Video Encoder"
[HKEY_CLASSES_ROOT\CLSID\{B63E31D0-87B5-477F-B224-4A35B6BECED6}\InprocServer32]
@"="C:\\Windows\\system32\\nvcuvenc.dll"
"ThreadingModel"="Both"
[HKEY_CLASSES_ROOT\CLSID\{FFB699E0-306A-11d3-8BD1-00104B6F7516}]
@"="NVIDIA CPL Extension"
[HKEY_CLASSES_ROOT\CLSID\{FFB699E0-306A-11d3-8BD1-00104B6F7516}\InProcServer32]
@"="C:\\Windows\\system32\\nvcpl.dll"
"ThreadingModel"="Apartment"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Folders]
"c:\\Program Files\\Microsoft Silverlight\\3.0.40818.0\\"=""
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Folders]
"c:\\Program Files\\Microsoft Silverlight\\3.0.40818.0\\fr\\"=""
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Folders]
"c:\\Program Files\\Microsoft Silverlight\\3.0.40818.0\\it\\"=""
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Folders]
"c:\\Program Files\\Microsoft Silverlight\\3.0.40818.0\\de\\"=""
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Folders]
"c:\\Program Files\\Microsoft Silverlight\\3.0.40818.0\\es\\"=""
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Folders]
"c:\\Program Files\\Microsoft Silverlight\\3.0.40818.0\\zh-Hans\\"=""
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Folders]
"c:\\Program Files\\Microsoft Silverlight\\3.0.40818.0\\zh-Hant\\"=""
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Folders]
"c:\\Program Files\\Microsoft Silverlight\\3.0.40818.0\\ja\\"=""
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Folders]
"c:\\Program Files\\Microsoft Silverlight\\3.0.40818.0\\ko\\"=""
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\\Windows\\Help\\nvcpl\\"=""
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\\Program Files\\NVIDIA Corporation\\Control Panel Client\\"=""
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\\Program Files\\NVIDIA Corporation\\Display\\"=""
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Titan Poker]
"DisplayName"="Titan Poker"
"UninstallString"="\"C:\\Poker\\Titan Poker\\_SetupPoker_79fe6a.exe\" /uninstall"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SeveranceSetup.exe"="C:\\Users\\MastaP89\\DOWNLO~1\\SEVERA~1.EXE /r"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"cleansweep.exe"="C:\\cleansweep.exe\\cleansweep.exe"
|
mfg Sebi | 