| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: [Trojan:Win32/Vundo.gen!H] Wie entferne ich ihn?Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
11.07.2008, 22:06
| #1 |
| | ![[Trojan:Win32/Vundo.gen!H] Wie entferne ich ihn? - Standard](images/icons/icon1.gif){kind=icon} [Trojan:Win32/Vundo.gen!H] Wie entferne ich ihn? Guten Abend, ich habe folgendes Problem: Seit etwa zwei Tagen habe ich einen Trojaner auf dem Computer. Gemeldet wird mir das durch Windows Defender von Windows Vista (mein GDATA TotalCare meldet nix, Bild im Anhang). Außerdem will der Windows Explorer seit diesem Virus bei jedem Systemstart die Registrierungsdatenbank zwei mal ändern: Code:
ATTFilter Die Anwendung "Windows-Explorer" versucht
die Registrierungsdatenbank zu ändern.
Möchten Sie die Änderung zulassen?
Eintrag: \REGISTRY\USER\S-1-5-21-2902914837-3246739430-1013117945-1007\Software\Microsoft\Windows\CurrentVersion\Run
Schlüssel: MSServer
Information:
Dieser Eintrag bindet eine neue Anwendung ein, die beim Start des Systems ausgeführt wird.
[] Auf alle anwenden
[ Ja ] [ Nein ]
Ich habe erfolglos versucht mit den Methoden dieser Seite den Virus zu entfernen. Bei Methode 1: Bin ich nicht zurecht gekommen weil ich Begriffe wie Schirm und Instanz nicht verstanden habe. Bei Methode 2: Wird nichts gefunden Code:
ATTFilter [07/11/2008, 22:19:46] - VirtumundoBeGone v1.5 ( "C:\Users\*****\Desktop\vundo\VirtumundoBeGone.exe" )
[07/11/2008, 22:19:56] - Detected System Information:
[07/11/2008, 22:19:56] - Windows Version: 6.0.6000,
[07/11/2008, 22:19:56] - Current Username: ***** (Admin)
[07/11/2008, 22:19:56] - Windows is in SAFE mode with Networking.
[07/11/2008, 22:19:56] - Searching for Browser Helper Objects:
[07/11/2008, 22:19:56] - BHO 1: {0124123D-61B4-456f-AF86-78C53A0790C5} (G DATA WebFilter)
[07/11/2008, 22:19:56] - BHO 2: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader)
[07/11/2008, 22:19:56] - BHO 3: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[07/11/2008, 22:19:56] - Finished Searching Browser Helper Objects
[07/11/2008, 22:19:56] - Finishing up...
[07/11/2008, 22:19:56] - Nothing found! Exiting...
Das Programm findet ebenfalls nichts. Bei Methode 4: Das Programm findet viele Dateien (über 600 warens..), hab auch alles behoben. Windows Defender meldet sich nach dem Neustart immernoch mit dem selben Virus. Bei Methode 5: Zu viel Aufwand Bei Methode 6: Das Programm findet drei *.dll Dateien. Wenn ich sie aber löschen will, sagt mir das Programm dass diese nicht gelöscht werden konnten. Ich soll sie nach dem neustart löschen. Wenn ich das aber mache, kommt immer wieder das selbe. Falls es hilft hab ich noch ein Logfile von HiJackThis: Code:
ATTFilter Logfile of HijackThis v1.99.1 Scan saved at 23:01:27, on 11.07.2008 Platform: Unknown Windows (WinNT 6.00.1904) MSIE: Internet Explorer v7.00 (7.00.6000.16681) Running processes: C:\Windows\system32\Dwm.exe C:\Windows\system32\taskeng.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe C:\Windows\RtHDVCpl.exe C:\Program Files\Sceneo\Bonavista\Services\ODSBC\ODSBCApp.exe C:\Program Files\Home Cinema\TV Enhance\TVEService.exe C:\Program Files\G DATA InternetSecurity TotalCare\AVKTray\AVKTray.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Windows\System32\rundll32.exe C:\Program Files\Razer\Lachesis\razerhid.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Windows\System32\rundll32.exe C:\Program Files\ICQ6\ICQ.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Razer\Lachesis\OSD.exe C:\Program Files\Ashampoo\Ashampoo Magical Defrag\bin\aDefragCtrl.exe C:\Program Files\G DATA InternetSecurity TotalCare\Firewall\GDFirewallTray.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\Razer\Lachesis\razertra.exe C:\Program Files\Razer\Lachesis\razerofa.exe C:\Windows\explorer.exe C:\Users\niko2\Desktop\vundo\HJT\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.msn.de R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = F2 - REG:system.ini: UserInit=C:\Windows\system32\userinit.exe,c:\program files\g data internetsecurity totalcare\avkkid\avkcks.exe O1 - Hosts: ::1 localhost O2 - BHO: G DATA WebFilter Class - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files\G DATA InternetSecurity TotalCare\Webfilter\AVKWebIE.dll O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O3 - Toolbar: G DATA WebFilter - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files\G DATA InternetSecurity TotalCare\Webfilter\AVKWebIE.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [TVBroadcast] C:\Program Files\Sceneo\Bonavista\SERVICES\ODSBC\ODSBCApp.exe O4 - HKLM\..\Run: [TVEService] "C:\Program Files\Home Cinema\TV Enhance\TVEService.exe" O4 - HKLM\..\Run: [AVKTray] "C:\Program Files\G DATA InternetSecurity TotalCare\AVKTray\AVKTray.exe" O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [Lachesis] C:\Program Files\Razer\Lachesis\razerhid.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\iiffDTLe.dll,#1 O4 - HKLM\..\Run: [MSConfig] "C:\Windows\system32\msconfig.exe" /auto O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKCU\..\Run: [Fraps] C:\FRAPS\FRAPS.EXE O4 - HKCU\..\Run: [ICQ] "C:\Program Files\ICQ6\ICQ.exe" silent O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [Windows Update] C:\Windows\system32\antivirus.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Ashampoo Magical Defrag.lnk = C:\Program Files\Ashampoo\Ashampoo Magical Defrag\bin\aDefragCtrl.exe O4 - Global Startup: G DATA Firewall Tray.lnk = ? O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O11 - Options group: [INTERNATIONAL] International* O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O13 - Gopher Prefix: O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ashampoo Defrag Service (AshampooDefragService) - - C:\Program Files\Ashampoo\Ashampoo Magical Defrag\bin\aDefragService.exe O23 - Service: AVK Tuner Service - G DATA Software AG - C:\Program Files\G DATA InternetSecurity TotalCare\AVKTuner\AVKTunerService.exe O23 - Service: AVKProxy - G DATA Software AG - C:\Program Files\Common Files\G DATA\AVKProxy\AVKProxy.exe O23 - Service: AVK Service (AVKService) - G DATA Software AG - C:\Program Files\G DATA InternetSecurity TotalCare\AVK\AVKService.exe O23 - Service: AVK Wächter (AVKWCtl) - G DATA Software AG - C:\Program Files\G DATA InternetSecurity TotalCare\AVK\AVKWCtl.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: C-DillaCdaC11BA - Macrovision - C:\Windows\system32\drivers\CDAC11BA.EXE O23 - Service: AVM FRITZ!web Routing Service (de_serv) - Unknown owner - C:\Program Files\Common Files\AVM\de_serv.exe (file missing) O23 - Service: @%SystemRoot%\ehome\ehstart.dll,-101 (ehstart) - Unknown owner - %windir%\system32\svchost.exe (file missing) O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - The Firebird Project - C:\MAGIX\Common\Database\bin\fbserver.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: G DATA Personal Firewall (GDFwSvc) - G DATA Software AG - C:\Program Files\G DATA InternetSecurity TotalCare\Firewall\GDFwSvc.exe O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing) O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing) O23 - Service: SF FrontLine Drivers Auto Removal (v1) (sfrem01) - Protection Technology (StarForce) - C:\Windows\system32\sfrem01.exe O23 - Service: Sceneo PVR Service (srvcPVR) - Buhl Data Service GmbH - C:\Program Files\Sceneo\Bonavista\Services\PVR\PVRService.exe O23 - Service: TVEnhance Background Capture Service (TBCS) (TVECapSvc) - Unknown owner - C:\Program Files\Home Cinema\TV Enhance\Kernel\TV\TVECapSvc.exe O23 - Service: TVEnhance Task Scheduler (TTS)) (TVESched) - Unknown owner - C:\Program Files\Home Cinema\TV Enhance\Kernel\TV\TVESched.exe O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing) O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe Kann mir jemand helfen? Wäre sehr dankbar!! |
|
12.07.2008, 11:16
| #2 |
  | [Trojan:Win32/Vundo.gen!H] Wie entferne ich ihn? Hi und
__________________ Bitte erstelle als erstes ein HijackThis Logfile (mit der neuesten Version  )Vorher lässt du aber Malwarebytes laufen, lässt alles gefunde löschen und postest das Logfile Weiter erstellst du bitte ein Logfile mit RunScanner und postest es ebenfalls 
__________________ |
|
12.07.2008, 14:12
| #3 |
| | [Trojan:Win32/Vundo.gen!H] Wie entferne ich ihn? Okay. Hier das von Malwarebytes:
__________________Code:
ATTFilter Malwarebytes' Anti-Malware 1.20
Datenbank Version: 941
Windows 6.0.6000
15:04:18 12.07.2008
mbam-log-7-12-2008 (15-04-18).txt
Scan Art: Komplett Scan (C:\|D:\|)
Objekte gescannt: 335293
Scan Dauer: 2 hour(s), 20 minute(s), 19 second(s)
Infizierte Speicher Prozesse: 0
Infizierte Speicher Module: 0
Infizierte Registrierungsschlüssel: 7
Infizierte Registrierungswerte: 3
Infizierte Datei Objekte der Registrierung: 0
Infizierte Verzeichnisse: 1
Infizierte Dateien: 32
Infizierte Speicher Prozesse:
(Keine Malware Objekte gefunden)
Infizierte Speicher Module:
(Keine Malware Objekte gefunden)
Infizierte Registrierungsschlüssel:
HKEY_CLASSES_ROOT\CLSID\{81ea3f36-357a-435a-8741-52c27ccc9f21} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{f6d24bea-4078-4218-a917-f9aefa905462} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{ff9ec787-86c2-4f83-967e-da1a680fdde5} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{5a5db8e7-2b26-4b0a-ab00-a42dd0899d11} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{60849e3f-4118-4f36-9590-c15d882c41ad} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{f4cc6aa2-4546-45cf-abd8-37a9436e7e1a} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\videoaccesscodec (Trojan.FakeAlert) -> Quarantined and deleted successfully.
Infizierte Registrierungswerte:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{81ea3f36-357a-435a-8741-52c27ccc9f21} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msserver (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update (Backdoor.Bot) -> Quarantined and deleted successfully.
Infizierte Datei Objekte der Registrierung:
(Keine Malware Objekte gefunden)
Infizierte Verzeichnisse:
C:\Program Files\VideoAccessCodec (Trojan.FakeAlert) -> Quarantined and deleted successfully.
Infizierte Dateien:
C:\Windows\System32\iiffDTLe.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\niko2\AppData\Local\Temp\byXPJCSm.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\niko2\AppData\Local\Temp\byXQIYSi.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\niko2\AppData\Local\Temp\efcAQIbX.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\niko2\AppData\Local\Temp\fccbYrqO.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\niko2\AppData\Local\Temp\geBssrPi.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\niko2\AppData\Local\Temp\khfCrQIa.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\niko2\AppData\Local\Temp\mlJBUMDu.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\niko2\AppData\Local\Temp\pmnoNHXO.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\niko2\AppData\Local\Temp\qoMcbxUo.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\niko2\AppData\Local\Temp\ssqNGVoP.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\niko2\AppData\Local\Temp\tmp00011f52 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\niko2\AppData\Local\Temp\tmp00013062 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\niko2\AppData\Local\Temp\tmp00013458 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\niko2\AppData\Local\Temp\tmp00013e56 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\niko2\AppData\Local\Temp\tmp0001446e (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\niko2\AppData\Local\Temp\tmp00015530 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\niko2\AppData\Local\Temp\tmp000155ec (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\niko2\AppData\Local\Temp\tmp0001c4b5 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\niko2\AppData\Local\Temp\tmp00020702 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\niko2\AppData\Local\Temp\tuvWqQkl.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\niko2\AppData\Local\Temp\urqPfCSK.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\niko2\AppData\Local\Temp\yayxwUlm.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\niko2\GAMES & PROGGIS\Battlefield 2\Battlefield.2.Keygen-ViTALiTY\vtl-bf2k.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\VundoFix Backups\iiffDTLe.dll.bad (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\VundoFix Backups\ljJDTNEV.dll.bad (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\VundoFix Backups\rqRHwULb.dll.bad (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Windows\System32\ljJDTNEV.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Windows\System32\rqRHwULb.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Program Files\VideoAccessCodec\install.ico (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Program Files\VideoAccessCodec\Uninstall.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Windows\System32\h@tkeysh@@k.dll (Trojan.Agent) -> Quarantined and deleted successfully.
Code:
ATTFilter Runscanner logfile http://www.runscanner.net * = signed file - = file not found 000 General info ---------------- Computer name : NIKO-PC Creation time : 12.07.2008 15:07:27 Hosts <> 127.0.0.1 : 0 Hosts file location : %SystemRoot%\System32\drivers\etc IE version : 7.0.6000.16681 OS : Windows Vista (TM) Home Premium OS Build : 6000 OS SP : RunScanner Version : 1.6.3.0 User Language : Deutsch (Deutschland) User rights : Administrator Windows folder : C:\Windows 001 Running processes --------------------- * c:\windows\system32\services.exe (Microsoft Corporation) c:\program files\common files\apple\mobile device support\bin\applemobiledeviceservice.exe (Apple, Inc.) * c:\program files\ashampoo\ashampoo magical defrag\bin\adefragctrl.exe * c:\windows\system32\taskeng.exe (Microsoft Corporation) * c:\windows\system32\taskeng.exe (Microsoft Corporation) * c:\program files\g data internetsecurity totalcare\avk\avkwctl.exe (G DATA Software AG) c:\program files\bonjour\mdnsresponder.exe (Apple Computer, Inc.) c:\program files\home cinema\tv enhance\kernel\tv\tvecapsvc.exe * c:\windows\system32\csrss.exe (Microsoft Corporation) * c:\windows\system32\csrss.exe (Microsoft Corporation) c:\program files\home cinema\tv enhance\kernel\tv\tvesched.exe c:\program files\home cinema\tv enhance\tveservice.exe (CyberLink Corp.) * c:\windows\system32\dwm.exe (Microsoft Corporation) * c:\windows\system32\notepad.exe (Microsoft Corporation) c:\program files\intel\intel matrix storage manager\iaanotif.exe (Intel Corporation) * c:\program files\mozilla firefox 3 beta 3\firefox.exe (Mozilla Corporation) * c:\program files\common files\g data\avkproxy\avkproxy.exe (G DATA Software AG) * c:\program files\g data internetsecurity totalcare\avk\avkservice.exe (G DATA Software AG) * c:\program files\g data internetsecurity totalcare\avktray\avktray.exe (G DATA Software AG) * c:\program files\g data internetsecurity totalcare\firewall\gdfwsvc.exe (G DATA Software AG) * c:\program files\g data internetsecurity totalcare\firewall\gdfirewalltray.exe (G DATA Software AG) * c:\windows\system32\alg.exe (Microsoft Corporation) * c:\windows\rthdvcpl.exe (Realtek Semiconductor) * c:\windows\system32\svchost.exe (Microsoft Corporation) * c:\windows\system32\svchost.exe (Microsoft Corporation) * c:\windows\system32\svchost.exe (Microsoft Corporation) * c:\windows\system32\svchost.exe (Microsoft Corporation) * c:\windows\system32\svchost.exe (Microsoft Corporation) * c:\windows\system32\svchost.exe (Microsoft Corporation) * c:\windows\system32\svchost.exe (Microsoft Corporation) * c:\windows\system32\svchost.exe (Microsoft Corporation) * c:\windows\system32\svchost.exe (Microsoft Corporation) * c:\windows\system32\svchost.exe (Microsoft Corporation) * c:\windows\system32\svchost.exe (Microsoft Corporation) * c:\windows\system32\svchost.exe (Microsoft Corporation) * c:\windows\system32\svchost.exe (Microsoft Corporation) * c:\program files\icq6\icq.exe (ICQ, Inc.) * c:\program files\java\jre1.6.0_05\bin\jusched.exe (Sun Microsystems, Inc.) * c:\windows\system32\lsass.exe (Microsoft Corporation) * c:\windows\system32\lsm.exe (Microsoft Corporation) c:\program files\common files\lightscribe\lssrvc.exe (Hewlett-Packard Company) c:\windows\system32\drivers\cdac11ba.exe (Macrovision) * c:\windows\system32\searchfilterhost.exe (Microsoft Corporation) * c:\windows\system32\searchindexer.exe (Microsoft Corporation) * c:\windows\system32\searchprotocolhost.exe (Microsoft Corporation) * c:\windows\system32\vssvc.exe (Microsoft Corporation) * c:\windows\system32\slsvc.exe (Microsoft Corporation) c:\program files\common files\ahead\lib\nmbgmonitor.exe (Nero AG) c:\program files\common files\ahead\lib\nmindexingservice.exe (Nero AG) c:\program files\common files\ahead\lib\NMIndexStoreSvr.exe (Nero AG) c:\program files\razer\lachesis\osd.exe (razercfg MFC Application) * c:\windows\system32\pnkbstra.exe c:\program files\intel\intel matrix storage manager\iaantmon.exe (Intel Corporation) c:\program files\razer\lachesis\razerofa.exe (Razer Inc.) c:\program files\razer\lachesis\razerhid.exe c:\program files\razer\lachesis\razertra.exe c:\program files\cyberlink\shared files\richvideo.exe * c:\runscanner.exe (Runscanner.net) c:\program files\sceneo\bonavista\services\pvr\pvrservice.exe (Buhl Data Service GmbH) * c:\windows\system32\spoolsv.exe (Microsoft Corporation) * c:\program files\daemon tools\daemon.exe (DT Soft Ltd.) * c:\program files\windows defender\msascui.exe (Microsoft Corporation) * c:\windows\system32\wudfhost.exe (Microsoft Corporation) * C:\Windows\system32\audiodg.exe (Microsoft Corporation) * c:\program files\windows media player\wmpnscfg.exe (Microsoft Corporation) * c:\program files\windows media player\wmpnetwk.exe (Microsoft Corporation) * c:\windows\system32\smss.exe (Microsoft Corporation) * c:\windows\system32\winlogon.exe (Microsoft Corporation) * c:\windows\explorer.exe (Microsoft Corporation) * c:\windows\system32\rundll32.exe (Microsoft Corporation) * c:\windows\system32\wininit.exe (Microsoft Corporation) c:\progra~1\common~1\x10\common\x10nets.exe (X10) 002 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run (+subkeys) ----------------------------------------------------------------- * c:\program files\g data internetsecurity totalcare\avktray\avktray.exe (G DATA Software AG) * c:\program files\daemon tools\daemon.exe (DT Soft Ltd.) c:\program files\intel\intel matrix storage manager\iaanotif.exe (Intel Corporation) c:\program files\common files\installshield\updateservice\issch.exe (InstallShield Software Corporation) c:\program files\razer\lachesis\razerhid.exe c:\program files\common files\ahead\lib\nerocheck.exe (Nero AG) c:\program files\quicktime\qttask.exe (Apple Inc.) c:\program files\sceneo\bonavista\services\odsbc\odsbcapp.exe (ODSoft multimedia) c:\program files\home cinema\tv enhance\tveservice.exe (CyberLink Corp.) 003 HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run (+subkeys) ----------------------------------------------------------------- c:\program files\common files\ahead\lib\nmbgmonitor.exe (Nero AG) c:\fraps\fraps.exe (Beepa P/L) * c:\program files\icq6\icq.exe (ICQ, Inc.) 005 C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup ---------------------------------------------------------------- c:\progra~1\common~1\adobe\calibr~1\adobeg~1.exe (Adobe Systems, Inc.) * c:\progra~1\ashampoo\ashamp~1\bin\adefra~1.exe * c:\progra~1\gdatai~1\firewall\gdfire~1.exe (G DATA Software AG) 006 %ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup ------------------------------------------------------------------- c:\progra~1\common~1\adobe\calibr~1\adobeg~1.exe (Adobe Systems, Inc.) * c:\progra~1\ashampoo\ashamp~1\bin\adefra~1.exe * c:\progra~1\gdatai~1\firewall\gdfire~1.exe (G DATA Software AG) 010 HKLM\SYSTEM\CurrentControlSet\Services (Services) ----------------------------------------------------- c:\program files\bonjour\mdnsresponder.exe (##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##) * c:\program files\common files\aol\acs\aolacsd.exe (AOL Connectivity Service) c:\program files\common files\apple\mobile device support\bin\applemobiledeviceservice.exe (Apple Mobile Device) * c:\program files\ashampoo\ashampoo magical defrag\bin\adefragservice.exe (Ashampoo Defrag Service) * c:\program files\g data internetsecurity totalcare\avk\avkservice.exe (AVK Service) * c:\program files\g data internetsecurity totalcare\avktuner\avktunerservice.exe (AVK Tuner Service) * c:\program files\g data internetsecurity totalcare\avk\avkwctl.exe (AVK Wächter) * c:\program files\common files\g data\avkproxy\avkproxy.exe (AVKProxy) - c:\program files\common files\avm\de_serv.exe (AVM FRITZ!web Routing Service) c:\windows\system32\drivers\cdac11ba.exe (C-DillaCdaC11BA) c:\program files\cyberlink\shared files\richvideo.exe (Cyberlink RichVideo Service(CRVS)) c:\magix\common\database\bin\fbserver.exe (Firebird Server - MAGIX Instance) c:\program files\common files\macrovision shared\flexnet publisher\fnplicensingservice.exe (FLEXnet Licensing Service) * c:\program files\g data internetsecurity totalcare\firewall\gdfwsvc.exe (G DATA Personal Firewall) c:\program files\common files\installshield\driver\11\intel 32\idrivert.exe (InstallDriver Table Manager) c:\program files\intel\intel matrix storage manager\iaantmon.exe (Intel(R) Matrix Storage Event Monitor) * c:\program files\ipod\bin\ipodservice.exe (iPod-Dienst) c:\program files\common files\lightscribe\lssrvc.exe (LightScribeService Direct Disc Labeling Service) c:\program files\nero\nero 7\nero backitup\nbservice.exe (NBService) c:\program files\common files\ahead\lib\nmindexingservice.exe (NMIndexingService) * c:\windows\system32\pnkbstra.exe (PnkBstrA) c:\program files\sceneo\bonavista\services\pvr\pvrservice.exe (Sceneo PVR Service) * C:\Windows\system32\sfrem01.exe (SF FrontLine Drivers Auto Removal (v1)) c:\program files\home cinema\tv enhance\kernel\tv\tvecapsvc.exe (TVEnhance Background Capture Service (TBCS)) c:\program files\home cinema\tv enhance\kernel\tv\tvesched.exe (TVEnhance Task Scheduler (TTS))) c:\progra~1\common~1\x10\common\x10nets.exe (X10 Device Network Service) 011 HKLM\SYSTEM\CurrentControlSet\Services (drivers) ---------------------------------------------------- - c:\windows\system32\drivers\ab37erb4.sys (ab37erb4) - c:\windows\system32\drivers\asinshelp32.sys (ASInsHelp) C:\Windows\system32\drivers\atksgt.sys (atksgt) - c:\windows\system32\drivers\netfwdsl.sys (AVM FRITZ!web DSL PPP) c:\windows\system32\drivers\cdac15ba.sys (CdaC15BA) * C:\Windows\system32\drivers\gdwfpcd32.sys (G DATA WFP CD) * c:\windows\system32\drivers\miniicpt.sys (GDMnIcpt) * c:\windows\system32\drivers\pkticpt.sys (GDPkIcpt) * c:\windows\system32\drivers\gdtdiicpt.sys (GDTdiInterceptor) * C:\Windows\system32\drivers\gearaspiwdm.sys (GEARAspiWDM) * C:\Windows\system32\drivers\hamachi.sys (Hamachi Network Interface) * c:\windows\system32\drivers\hookcentre.sys (HookCentre) - c:\windows\system32\drivers\ipinip.sys (IP in IP Tunnel Driver) - c:\windows\system32\drivers\nwlnkflt.sys (IPX Traffic Filter Driver) - c:\windows\system32\drivers\nwlnkfwd.sys (IPX Traffic Forwarder Driver) C:\Windows\system32\drivers\lirsgt.sys (lirsgt) C:\Windows\system32\drivers\usbsermpt.sys (Motorola USB Modem Driver for MPT) * C:\Windows\system32\drivers\npf.sys (Netgroup Packet Filter) C:\Windows\system32\drivers\se27bus.sys (Sony Ericsson Device 039 Driver driver (WDM)) C:\Windows\system32\drivers\se27nd5.sys (Sony Ericsson Device 039 USB Ethernet Emulation SEMC39 (NDIS)) C:\Windows\system32\drivers\se27unic.sys (Sony Ericsson Device 039 USB Ethernet Emulation SEMC39 (WDM)) C:\Windows\system32\drivers\se27mgmt.sys (Sony Ericsson Device 039 USB WMC Device Management Drivers (WDM)) C:\Windows\system32\drivers\se27mdm.sys (Sony Ericsson Device 039 USB WMC Modem Driver) C:\Windows\system32\drivers\se27mdfl.sys (Sony Ericsson Device 039 USB WMC Modem Filter) C:\Windows\system32\drivers\se27obex.sys (Sony Ericsson Device 039 USB WMC OBEX Interface) C:\Windows\system32\drivers\sptd.sys (sptd) * C:\Windows\system32\drivers\sfdrv01.sys (StarForce Protection Environment Driver (version 1.x)) c:\windows\system32\drivers\prodrv06.sys (StarForce Protection Environment Driver v6) C:\Windows\system32\drivers\sfhlp01.sys (StarForce Protection Helper Driver) * C:\Windows\system32\drivers\sfhlp02.sys (StarForce Protection Helper Driver (version 2.x)) C:\Windows\system32\drivers\prohlp02.sys (StarForce Protection Helper Driver v2) * C:\Windows\system32\drivers\sfsync02.sys (StarForce Protection Synchronization Driver (version 2.x)) C:\Windows\system32\drivers\prosync1.sys (StarForce Protection Synchronization Driver v1) * C:\Windows\system32\drivers\sfvfs02.sys (StarForce Protection VFS Driver (version 2.x)) * c:\windows\system32\drivers\vaxscsi.sys (vaxscsi) * C:\Windows\system32\drivers\x10hid.sys (X10 Hid Device) 031 HKLM\SOFTWARE\Classes\PROTOCOLS\Handler ------------------------------------------- c:\program files\common files\microsoft shared\information retrieval\msitss.dll (Microsoft Corporation) {0A9007C0-4076-11D3-8789-0000F8105754} 032 HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd\StartupPrograms ----------------------------------------------------------------------------------- - rdpclip 033 HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit ----------------------------------------------------------------------- * c:\program files\g data internetsecurity totalcare\avkkid\avkcks.exe 035 HKLM-HKCU\SOFTWARE\Microsoft\Active Setup\Installed Components ------------------------------------------------------------------ - c:\windows\system32\antivirus.exe {FF7637BD-AF04-D060-AF28-E08C500AB9AD} 041 HKLM-HKCU\Software\Microsoft\Internet Explorer\Toolbar ---------------------------------------------------------- * c:\program files\g data internetsecurity totalcare\webfilter\avkwebie.dll (G DATA Software AG) {0124123D-61B4-456f-AF86-78C53A0790C5} 042 HKLM\Software\Microsoft\Internet Explorer\Extensions -------------------------------------------------------- GUID / CLSID not found {08B0E5C0-4FCB-11CF-AAA5-00401C608501} GUID / CLSID not found {2670000A-7350-4f3c-8081-5663EE0C6C49} * c:\program files\icq6\icq.exe (ICQ, Inc.) {E59EB121-F339-4851-A3BA-FE49C35617C2} GUID / CLSID not found {92780B25-18CC-41C8-B9BE-3C9C571A8263} 052 HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects ---------------------------------------------------------------------------------- * c:\program files\g data internetsecurity totalcare\webfilter\avkwebie.dll (G DATA Software AG) {0124123D-61B4-456f-AF86-78C53A0790C5} 061 HKLM-HCKU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved --------------------------------------------------------------------------------- c:\windows\system32\shellext\cryptext.dll {990a81a0-b289-11cf-a800-00a0c903a2a6} * c:\program files\itunes\itunesminiplayer.dll (Apple Inc.) {B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} c:\program files\winrar\rarext.dll {B41DB860-8EE4-11D2-9906-E49FADC173CA} 062 HKLM-HKCU\Software\Classes\Folder\Shellex\ColumnHandlers ------------------------------------------------------------ GUID / CLSID not found {C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} c:\program files\common files\adobe\acrobat\activex\pdfshell.dll (Adobe Systems, Inc.) {F9DB5320-233E-11D1-9F84-707F02C10627} 069 HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors -------------------------------------------------------- C:\Windows\system32\avmprmon.dll (AVM Berlin GmbH) C:\Windows\system32\hpzlnt03.dll (HP) 100 Internet Explorer settings ------------------------------ Default_Page_URL HKLM : www.msn.de Start Page HKCU : http://www.google.de/ 105 HKCU\Software\Microsoft\Internet Explorer\MenuExt ----------------------------------------------------- Nach Microsoft E&xel exportieren : res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000 107 HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5 --------------------------------------------------------------------------------- c:\program files\bonjour\mdnsnsp.dll (Apple Computer, Inc.) 170 HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2 ------------------------------------------------------------------------ {5a79367f-669c-11dc-a5ce-00038a000015} : E:\autorun.exe {5a793685-669c-11dc-a5ce-00038a000015} : H:\RunGame.exe {f398f161-ddf8-11db-bb20-806e6f6e6963} : J:\Start.exe 173 HKCR\*\shellex\ContextMenuHandlers -------------------------------------- c:\program files\g data internetsecurity totalcare\avk\shellext.dll (G DATA Software AG) {CAF4C320-32F5-11D3-A222-004095200FF2} c:\windows\system32\shellext\cryptext.dll {990a81a0-b289-11cf-a800-00a0c903a2a6} c:\program files\nero\nero 7\nero backitup\nbshell.dll (Nero AG) c:\program files\winrar\rarext.dll {B41DB860-8EE4-11D2-9906-E49FADC173CA} 221 HKLM\Software\Classes\*\ShellEx\ContextMenuHandlers ------------------------------------------------------- c:\program files\g data internetsecurity totalcare\avk\shellext.dll (G DATA Software AG) {CAF4C320-32F5-11D3-A222-004095200FF2} c:\windows\system32\shellext\cryptext.dll {990a81a0-b289-11cf-a800-00a0c903a2a6} c:\program files\nero\nero 7\nero backitup\nbshell.dll (Nero AG) c:\program files\winrar\rarext.dll {B41DB860-8EE4-11D2-9906-E49FADC173CA} 223 HKLM\Software\Classes\AllFileSystemObjects\ShellEx\ContextMenuHandlers -------------------------------------------------------------------------- * c:\program files\malwarebytes' anti-malware\mbamext.dll (Malwarebytes) {57CE581A-0CB6-4266-9CA0-19364C90A0B3} 225 HKCU\Software\Classes\Folder\ShellEx\ContextMenuHandlers ------------------------------------------------------------ GUID / CLSID not found GUID / CLSID not found c:\program files\g data internetsecurity totalcare\avk\shellext.dll (G DATA Software AG) {CAF4C320-32F5-11D3-A222-004095200FF2} c:\program files\g data internetsecurity totalcare\avk\shellext.dll (G DATA Software AG) {CAF4C320-32F5-11D3-A222-004095200FF2} c:\windows\system32\shellext\cryptext.dll {990a81a0-b289-11cf-a800-00a0c903a2a6} c:\windows\system32\shellext\cryptext.dll {990a81a0-b289-11cf-a800-00a0c903a2a6} * c:\program files\malwarebytes' anti-malware\mbamext.dll (Malwarebytes) {57CE581A-0CB6-4266-9CA0-19364C90A0B3} * c:\program files\malwarebytes' anti-malware\mbamext.dll (Malwarebytes) {57CE581A-0CB6-4266-9CA0-19364C90A0B3} c:\program files\nero\nero 7\nero backitup\nbshell.dll (Nero AG) c:\program files\nero\nero 7\nero backitup\nbshell.dll (Nero AG) c:\program files\winrar\rarext.dll {B41DB860-8EE4-11D2-9906-E49FADC173CA} c:\program files\winrar\rarext.dll {B41DB860-8EE4-11D2-9906-E49FADC173CA} 227 HKLM\Software\Classes\Directory\ShellEx\ContextMenuHandlers --------------------------------------------------------------- GUID / CLSID not found {73B24247-042E-4EF5-ADC2-42F62E6FD654} c:\windows\system32\shellext\cryptext.dll {990a81a0-b289-11cf-a800-00a0c903a2a6} c:\program files\winrar\rarext.dll {B41DB860-8EE4-11D2-9906-E49FADC173CA} 230 HKCU\Software\Classes\Folder\Shellex\ColumnHandlers ------------------------------------------------------- GUID / CLSID not found OpenOffice.org Column Handler 231 HKLM\Software\Classes\Folder\Shellex\ColumnHandlers ------------------------------------------------------- c:\program files\common files\adobe\acrobat\activex\pdfshell.dll (Adobe Systems, Inc.) PDF Column Info |
|
12.07.2008, 14:13
| #4 |
| | [Trojan:Win32/Vundo.gen!H] Wie entferne ich ihn? Und das von HiJackThis: Code:
ATTFilter Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:11:07, on 12.07.2008 Platform: Windows Vista (WinNT 6.00.1904) MSIE: Internet Explorer v7.00 (7.00.6000.16681) Boot mode: Normal Running processes: C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe C:\Windows\RtHDVCpl.exe C:\Program Files\Home Cinema\TV Enhance\TVEService.exe C:\Program Files\G DATA InternetSecurity TotalCare\AVKTray\AVKTray.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\Razer\Lachesis\razerhid.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files\ICQ6\ICQ.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Razer\Lachesis\OSD.exe C:\Program Files\Ashampoo\Ashampoo Magical Defrag\bin\aDefragCtrl.exe C:\Program Files\G DATA InternetSecurity TotalCare\Firewall\GDFirewallTray.exe C:\Windows\System32\rundll32.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\Razer\Lachesis\razertra.exe C:\Program Files\Razer\Lachesis\razerofa.exe C:\Windows\explorer.exe C:\Program Files\Mozilla Firefox 3 Beta 3\firefox.exe C:\Users\niko2\Desktop\hijackthis+\HiJackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.msn.de R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = F2 - REG:system.ini: UserInit=C:\Windows\system32\userinit.exe,c:\program files\g data internetsecurity totalcare\avkkid\avkcks.exe, O1 - Hosts: ::1 localhost O2 - BHO: G DATA WebFilter Class - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files\G DATA InternetSecurity TotalCare\Webfilter\AVKWebIE.dll O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O3 - Toolbar: G DATA WebFilter - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files\G DATA InternetSecurity TotalCare\Webfilter\AVKWebIE.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [TVBroadcast] C:\Program Files\Sceneo\Bonavista\SERVICES\ODSBC\ODSBCApp.exe O4 - HKLM\..\Run: [TVEService] "C:\Program Files\Home Cinema\TV Enhance\TVEService.exe" O4 - HKLM\..\Run: [AVKTray] "C:\Program Files\G DATA InternetSecurity TotalCare\AVKTray\AVKTray.exe" O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [Lachesis] C:\Program Files\Razer\Lachesis\razerhid.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [MSConfig] "C:\Windows\system32\msconfig.exe" /auto O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKCU\..\Run: [Fraps] C:\FRAPS\FRAPS.EXE O4 - HKCU\..\Run: [ICQ] "C:\Program Files\ICQ6\ICQ.exe" silent O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST') O4 - HKUS\S-1-5-18\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe (User 'Default user') O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Ashampoo Magical Defrag.lnk = C:\Program Files\Ashampoo\Ashampoo Magical Defrag\bin\aDefragCtrl.exe O4 - Global Startup: G DATA Firewall Tray.lnk = ? O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O13 - Gopher Prefix: O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ashampoo Defrag Service (AshampooDefragService) - - C:\Program Files\Ashampoo\Ashampoo Magical Defrag\bin\aDefragService.exe O23 - Service: AVK Tuner Service - G DATA Software AG - C:\Program Files\G DATA InternetSecurity TotalCare\AVKTuner\AVKTunerService.exe O23 - Service: AVKProxy - G DATA Software AG - C:\Program Files\Common Files\G DATA\AVKProxy\AVKProxy.exe O23 - Service: AVK Service (AVKService) - G DATA Software AG - C:\Program Files\G DATA InternetSecurity TotalCare\AVK\AVKService.exe O23 - Service: AVK Wächter (AVKWCtl) - G DATA Software AG - C:\Program Files\G DATA InternetSecurity TotalCare\AVK\AVKWCtl.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: C-DillaCdaC11BA - Macrovision - C:\Windows\system32\drivers\CDAC11BA.EXE O23 - Service: AVM FRITZ!web Routing Service (de_serv) - Unknown owner - C:\Program Files\Common Files\AVM\de_serv.exe (file missing) O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - The Firebird Project - C:\MAGIX\Common\Database\bin\fbserver.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: G DATA Personal Firewall (GDFwSvc) - G DATA Software AG - C:\Program Files\G DATA InternetSecurity TotalCare\Firewall\GDFwSvc.exe O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe O23 - Service: SF FrontLine Drivers Auto Removal (v1) (sfrem01) - Protection Technology (StarForce) - C:\Windows\system32\sfrem01.exe O23 - Service: Sceneo PVR Service (srvcPVR) - Buhl Data Service GmbH - C:\Program Files\Sceneo\Bonavista\Services\PVR\PVRService.exe O23 - Service: TVEnhance Background Capture Service (TBCS) (TVECapSvc) - Unknown owner - C:\Program Files\Home Cinema\TV Enhance\Kernel\TV\TVECapSvc.exe O23 - Service: TVEnhance Task Scheduler (TTS)) (TVESched) - Unknown owner - C:\Program Files\Home Cinema\TV Enhance\Kernel\TV\TVESched.exe O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe -- End of file - 10549 bytes |
|
12.07.2008, 19:23
| #5 | |
| | [Trojan:Win32/Vundo.gen!H] Wie entferne ich ihn? Ok Bitte lade folgende Dateien bei VirusTotal hoch und poste das Ergebnis c:\program files\home cinema\tv enhance\kernel\tv\tvecapsvc.exe C:\Windows\system32\sfrem01.exe c:\windows\system32\drivers\netfwdsl.sys Lass bitte auch mal CCleaner laufen Auch die Funktion um die Registry zu cleanen benutzen Mach dies bis keine Fehler mehr gefunden werden.
__________________ Kein Support per PN Zitat:
|
|
13.07.2008, 12:07
| #6 |
| | [Trojan:Win32/Vundo.gen!H] Wie entferne ich ihn? tvecapsvc.exe Im ersten Teil steht bei Ergenis immer ein - Hier das andere: Code:
ATTFilter weitere Informationen
File size: 290908 bytes
MD5...: b5a12fe3da880d2c5e1bb35942d64f06
SHA1..: cfef0f73efebde7e5b036bf43262177fadcf55c3
SHA256: a448cec82fd9ea926526b7b43f060ea5369d0a2eebe460bd2670f196f76cd711
SHA512: 7c340339e1c31b0d5bfcb8e6cbc2b2025209cd96e9c4a1c2e0b88b6a0dadd359
b8eae1f00f170531910fb1da55ce232e6cff0e86aaebc851dd13b204f172fb9a
PEiD..: Armadillo v1.71
PEInfo: PE Structure information
( base data )
entrypointaddress.: 0x41e8b1
timedatestamp.....: 0x45a25761 (Mon Jan 08 14:38:25 2007)
machinetype.......: 0x14c (I386)
( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x28056 0x29000 6.47 2d28f7d4688bf045d96340571dc7f7bc
.rdata 0x2a000 0x6438 0x7000 4.15 022a49fd74bbfccc96df4bad03ea36ae
.data 0x31000 0xa11c 0x7000 3.92 298b752c796c444caed8c7b87f10b9c1
.rsrc 0x3c000 0xe500 0xf000 4.82 285bd7ad90d7274b4f5e0a62f8499f7b
( 9 imports )
> SHLWAPI.dll: PathFileExistsW
> PSAPI.DLL: GetProcessImageFileNameA, EnumProcesses
> SHELL32.dll: ShellExecuteA, ShellExecuteExW
> KERNEL32.dll: lstrlenW, GetShortPathNameA, WideCharToMultiByte, SizeofResource, LoadResource, FindResourceA, LoadLibraryExA, lstrcpynA, IsDBCSLeadByte, lstrcpyA, lstrcatA, GetCurrentThread, GetSystemTime, OutputDebugStringW, GetModuleFileNameW, ReadFile, SetEndOfFile, CreateFileA, FlushFileBuffers, SetStdHandle, GetStringTypeW, GetStringTypeA, LCMapStringW, LCMapStringA, SetFilePointer, IsBadCodePtr, IsBadReadPtr, SetUnhandledExceptionFilter, GetFileType, GetModuleFileNameA, SetHandleCount, GetEnvironmentStringsW, GetEnvironmentStrings, FreeEnvironmentStringsW, FreeEnvironmentStringsA, WriteFile, HeapSize, IsBadWritePtr, VirtualAlloc, lstrlenA, GetCommandLineA, lstrcmpiA, GetCurrentThreadId, InterlockedDecrement, CreateMutexA, GetLastError, OutputDebugStringA, DeleteFileW, CopyFileW, ExpandEnvironmentStringsA, GetVersionExA, CloseHandle, OpenProcess, GetExitCodeProcess, TerminateProcess, MultiByteToWideChar, Sleep, GetDiskFreeSpaceExW, GetDriveTypeW, WaitForSingleObject, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSection, LoadLibraryA, GetProcAddress, FreeLibrary, GetModuleHandleA, GetCurrentProcess, GetPrivateProfileSectionW, MoveFileW, WritePrivateProfileStringW, InterlockedIncrement, VirtualFree, HeapCreate, HeapDestroy, GetOEMCP, GetACP, GetCPInfo, UnhandledExceptionFilter, TlsGetValue, SetLastError, TlsAlloc, RaiseException, ExitProcess, GetVersion, GetStartupInfoA, HeapAlloc, HeapReAlloc, HeapFree, ExitThread, TlsSetValue, CreateThread, CompareStringA, CompareStringW, SetEnvironmentVariableA, GetStdHandle, InterlockedExchange, RtlUnwind, GetTimeZoneInformation, GetLocalTime
> USER32.dll: GetWindowLongA, SetTimer, SetWindowLongA, PostQuitMessage, GetClassInfoA, RegisterClassExA, ShowWindow, MessageBoxA, IsWindow, GetMessageA, DispatchMessageA, PostThreadMessageA, CharNextA, FindWindowA, IsWindowVisible, PostMessageA, LoadStringA, DefWindowProcA, KillTimer, DestroyWindow, UnregisterClassA, LoadCursorA, RegisterClassA, CreateWindowExA
> ADVAPI32.dll: StartServiceCtrlDispatcherA, RegQueryValueExA, RegOpenKeyExA, RegSetValueExA, RegQueryValueExW, RegOpenKeyExW, RegCreateKeyExA, GetTokenInformation, OpenThreadToken, OpenProcessToken, SetSecurityDescriptorGroup, SetSecurityDescriptorOwner, GetLengthSid, CopySid, InitializeSecurityDescriptor, SetSecurityDescriptorDacl, RegEnumValueA, RegQueryInfoKeyA, RegEnumKeyExA, RegDeleteKeyA, DeleteService, CreateServiceA, RegDeleteValueA, SetServiceStatus, RegisterServiceCtrlHandlerA, RegisterEventSourceA, ReportEventA, DeregisterEventSource, OpenSCManagerA, CloseServiceHandle, OpenServiceA, ControlService, RegCloseKey
> ole32.dll: CoInitialize, CoCreateInstance, CoInitializeSecurity, CoDisconnectObject, CoTaskMemFree, CoTaskMemAlloc, CoTaskMemRealloc, CoRegisterClassObject, CoRevokeClassObject, CoUninitialize
> OLEAUT32.dll: -, -, -, -, -, -, -, -, -, -
> CLSchRecordMonitor.dll: _SetCallback@CSchRecordMonitor@@QAEHPAUICallback@@@Z, __0CSchRecordMonitor@@QAE@XZ, _StopMonitorPath@CSchRecordMonitor@@QAEHXZ, _FindConflictSchedule@CSchRecordMonitor@@QAEHJJ@Z, _IsTunerAvailable@CSchRecordMonitor@@QAEHXZ, _StartMonitorPath@CSchRecordMonitor@@QAEHPBDK@Z, __1CSchRecordMonitor@@QAE@XZ
( 0 exports )
sfrem01.exe Im ersten Teil steht bei Ergebnis immer ein - Hier das andere: Code:
ATTFilter weitere Informationen
File size: 353912 bytes
MD5...: 7b1197a1a684c3fa8bea75fe4ef54443
SHA1..: d6a96926c5111f44b54beae9fea9a753fe5534fe
SHA256: da4392e4311fea99206881febe383e71154c4a451f4bec7c323702330b4fa488
SHA512: 1b139d2c0079fa0a77f9c4d26b46d1bde6d0c67a34adea02a3bda2a7217b14af
54334c93e894b7adde856a453ce596c4b5067857a6e1daefd6897924a3064e5b
PEiD..: -
PEInfo: PE Structure information
( base data )
entrypointaddress.: 0x416fc3
timedatestamp.....: 0x4461b963 (Wed May 10 09:58:59 2006)
machinetype.......: 0x14c (I386)
( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x3578c 0x36000 6.60 156e5f7f0cfb6e39f65c54946a844685
.rdata 0x37000 0x17470 0x18000 4.71 09b879ede26eb503cb6b3559279c0aa8
.data 0x4f000 0x6898 0x5000 4.63 c0068cd204334df37e032782061f0b4d
.rsrc 0x56000 0x434 0x1000 3.76 70c8912f2a452398137f3f95ff4b4646
( 4 imports )
> KERNEL32.dll: CreateFileW, GetModuleFileNameA, CreateFileMappingA, CreateFileMappingW, CreateMutexA, CreateMutexW, GetSystemDirectoryA, GetSystemDirectoryW, GetWindowsDirectoryA, GetWindowsDirectoryW, GetDriveTypeW, FindFirstFileA, FindFirstFileW, GetEnvironmentVariableW, GetModuleHandleW, WriteConsoleW, CreateProcessA, CreateProcessW, GetFileAttributesA, GetFileAttributesW, CreateFileA, SetFileAttributesW, DeleteFileA, DeleteFileW, CloseHandle, SystemTimeToFileTime, GetSystemTime, GetCurrentProcess, AreFileApisANSI, GetOEMCP, GetACP, FreeLibrary, GetFileSize, ReadFile, WriteFile, SetFileTime, MapViewOfFile, UnmapViewOfFile, FindClose, DeviceIoControl, GetExitCodeProcess, WaitForSingleObject, GetCommandLineA, LoadLibraryW, LoadLibraryA, GetVersionExW, GetVersionExA, ReleaseMutex, WaitForMultipleObjectsEx, QueryDosDeviceW, GetFullPathNameW, SetLastError, WideCharToMultiByte, GetCPInfo, GetModuleHandleA, GetProcAddress, LCMapStringW, MultiByteToWideChar, InterlockedDecrement, InterlockedIncrement, GetTickCount, LeaveCriticalSection, EnterCriticalSection, DeleteCriticalSection, InitializeCriticalSection, GetEnvironmentVariableA, GetStdHandle, WriteConsoleA, VirtualFree, VirtualAlloc, GetLastError, SetFileAttributesA, SetEndOfFile, RtlUnwind, RaiseException, HeapFree, HeapAlloc, GetProcessHeap, GetStartupInfoA, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, GetCurrentThreadId, TerminateProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, ExitProcess, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, SetHandleCount, GetFileType, HeapDestroy, HeapCreate, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, GetConsoleCP, GetConsoleMode, FlushFileBuffers, Sleep, HeapSize, LCMapStringA, GetLocaleInfoA, HeapReAlloc, GetConsoleOutputCP, SetFilePointer, SetStdHandle, GetStringTypeA, GetStringTypeW
> USER32.dll: MessageBoxA, MessageBoxW
> ADVAPI32.dll: RegCloseKey, SetSecurityDescriptorDacl, InitializeSecurityDescriptor, RegQueryValueExW, RegQueryValueExA, RegDeleteValueW, RegSetValueExW, RegSetValueExA, RegEnumKeyExW, RegDeleteKeyW, RegOpenKeyExW, RegOpenKeyExA, RegCreateKeyExW, RegisterServiceCtrlHandlerW, StartServiceCtrlDispatcherW, StartServiceW, ChangeServiceConfigW, QueryServiceConfigW, CreateServiceW, OpenServiceW, OpenSCManagerW, SetServiceStatus, CloseServiceHandle, DeleteService, ControlService
> VERSION.dll: GetFileVersionInfoA, GetFileVersionInfoSizeA, VerQueryValueA
( 0 exports )
Und mal so nebenbei: Der Windows Defender meldet sich beim Systemstart nicht mehr, und der Windows Explorer will die Registrierungsdatenbank auch nicht mehr ändern. Ist der Virus jetzt weg? eXecutor |
|
13.07.2008, 12:54
| #7 | ||
| | [Trojan:Win32/Vundo.gen!H] Wie entferne ich ihn?Zitat:
Bitte poste noch ein HijackThis Logfile Aber eigentlich sollte es das gewesen sein 
__________________ Kein Support per PN Zitat:
|
|
13.07.2008, 14:58
| #8 |
| | [Trojan:Win32/Vundo.gen!H] Wie entferne ich ihn? Ja, CCleaner findet keine Fehler in der Registry mehr. Log von HiJackThis: Code:
ATTFilter Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:56:13, on 13.07.2008 Platform: Windows Vista (WinNT 6.00.1904) MSIE: Internet Explorer v7.00 (7.00.6000.16681) Boot mode: Normal Running processes: C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32\taskeng.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe C:\Windows\RtHDVCpl.exe C:\Program Files\Sceneo\Bonavista\Services\ODSBC\ODSBCApp.exe C:\Program Files\Home Cinema\TV Enhance\TVEService.exe C:\Program Files\G DATA InternetSecurity TotalCare\AVKTray\AVKTray.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Program Files\Razer\Lachesis\razerhid.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\Razer\Lachesis\OSD.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files\ICQ6\ICQ.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Ashampoo\Ashampoo Magical Defrag\bin\aDefragCtrl.exe C:\Program Files\G DATA InternetSecurity TotalCare\Firewall\GDFirewallTray.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\eMule.de 0.48a v18\emule.exe C:\Program Files\Razer\Lachesis\razertra.exe C:\Program Files\Razer\Lachesis\razerofa.exe C:\Program Files\Mozilla Firefox 3 Beta 3\firefox.exe C:\Windows\system32\SearchFilterHost.exe C:\Users\niko2\Desktop\vundo\hijackthis+\HiJackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.msn.de R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = F2 - REG:system.ini: UserInit=C:\Windows\system32\userinit.exe,c:\program files\g data internetsecurity totalcare\avkkid\avkcks.exe, O1 - Hosts: ::1 localhost O2 - BHO: G DATA WebFilter Class - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files\G DATA InternetSecurity TotalCare\Webfilter\AVKWebIE.dll O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O3 - Toolbar: G DATA WebFilter - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files\G DATA InternetSecurity TotalCare\Webfilter\AVKWebIE.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [TVBroadcast] C:\Program Files\Sceneo\Bonavista\SERVICES\ODSBC\ODSBCApp.exe O4 - HKLM\..\Run: [TVEService] "C:\Program Files\Home Cinema\TV Enhance\TVEService.exe" O4 - HKLM\..\Run: [AVKTray] "C:\Program Files\G DATA InternetSecurity TotalCare\AVKTray\AVKTray.exe" O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [Lachesis] C:\Program Files\Razer\Lachesis\razerhid.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [MSConfig] "C:\Windows\system32\msconfig.exe" /auto O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKCU\..\Run: [Fraps] C:\FRAPS\FRAPS.EXE O4 - HKCU\..\Run: [ICQ] "C:\Program Files\ICQ6\ICQ.exe" silent O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST') O4 - HKUS\S-1-5-18\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe (User 'Default user') O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Ashampoo Magical Defrag.lnk = C:\Program Files\Ashampoo\Ashampoo Magical Defrag\bin\aDefragCtrl.exe O4 - Global Startup: G DATA Firewall Tray.lnk = ? O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O13 - Gopher Prefix: O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ashampoo Defrag Service (AshampooDefragService) - - C:\Program Files\Ashampoo\Ashampoo Magical Defrag\bin\aDefragService.exe O23 - Service: AVK Tuner Service - G DATA Software AG - C:\Program Files\G DATA InternetSecurity TotalCare\AVKTuner\AVKTunerService.exe O23 - Service: AVKProxy - G DATA Software AG - C:\Program Files\Common Files\G DATA\AVKProxy\AVKProxy.exe O23 - Service: AVK Service (AVKService) - G DATA Software AG - C:\Program Files\G DATA InternetSecurity TotalCare\AVK\AVKService.exe O23 - Service: AVK Wächter (AVKWCtl) - G DATA Software AG - C:\Program Files\G DATA InternetSecurity TotalCare\AVK\AVKWCtl.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: C-DillaCdaC11BA - Macrovision - C:\Windows\system32\drivers\CDAC11BA.EXE O23 - Service: AVM FRITZ!web Routing Service (de_serv) - Unknown owner - C:\Program Files\Common Files\AVM\de_serv.exe (file missing) O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - The Firebird Project - C:\MAGIX\Common\Database\bin\fbserver.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: G DATA Personal Firewall (GDFwSvc) - G DATA Software AG - C:\Program Files\G DATA InternetSecurity TotalCare\Firewall\GDFwSvc.exe O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe O23 - Service: SF FrontLine Drivers Auto Removal (v1) (sfrem01) - Protection Technology (StarForce) - C:\Windows\system32\sfrem01.exe O23 - Service: Sceneo PVR Service (srvcPVR) - Buhl Data Service GmbH - C:\Program Files\Sceneo\Bonavista\Services\PVR\PVRService.exe O23 - Service: TVEnhance Background Capture Service (TBCS) (TVECapSvc) - Unknown owner - C:\Program Files\Home Cinema\TV Enhance\Kernel\TV\TVECapSvc.exe O23 - Service: TVEnhance Task Scheduler (TTS)) (TVESched) - Unknown owner - C:\Program Files\Home Cinema\TV Enhance\Kernel\TV\TVESched.exe O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe -- End of file - 10741 bytes |
|
13.07.2008, 15:23
| #9 | |
| | [Trojan:Win32/Vundo.gen!H] Wie entferne ich ihn? Ok gut, wenn du keine Probleme mehr hast, sollte es das gewesen sein
__________________ Kein Support per PN Zitat:
|
|
14.07.2008, 12:39
| #10 | |
| | [Trojan:Win32/Vundo.gen!H] Wie entferne ich ihn? Hallo! ich hab genau dasselbe problem, [edit] Bitte eröffne, wie jeder andere hier auch, für dein Problem einen eigenen Beitrag. Nur so wird sichergestellt as jedem User übersichtlich und individuell geholfen werden kann. Zitat:
Sunny [/edit] |
|
01.08.2008, 02:35
| #11 |
| | [Trojan:Win32/Vundo.gen!H] Wie entferne ich ihn? ahoy! hatte fast exakt das gleiche problem! hab die tools runtergeladen wie beschrieben laufen lassen und alles ist spitze! und 25gb mehr platz auf C:/ ! also vielen dank nochmal! ihr seid spitze! :aplaus: |
|
| Themen zu [Trojan:Win32/Vundo.gen!H] Wie entferne ich ihn? |
| bho, bonjour, browser, defender, desktop, drivers, g data, gdata, helfen, helper, home, immer wieder, internet, internet explorer, kommt immer wieder, logfile, magix, problem, programm, registrierungsdatenbank, registry, rundll, security, senden, software, svchost.exe, trojan, trojaner, unknown file in winsock lsp, userinit.exe, virus, vista, vundo, windows, windows defender, windows vista home, windows-explorer, windows\system32\drivers, ändern |
![[Trojan:Win32/Vundo.gen!H] Wie entferne ich ihn?](iconimages/plagegeister-aller-art-deren-bekaempfung/trojan-win32-vundo-gen-h-entferne-ihn_ltr.gif)
Linear-Darstellung
