Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung
Total Win 7 Security Tool Alert

Total Win 7 Security Tool Alert


Log-Analyse und Auswertung: Total Win 7 Security Tool Alert

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML

Antwort
Alt 03.04.2010, 13:32   #1
Discovery
 
Total Win 7 Security Tool Alert - Standard

Total Win 7 Security Tool Alert


Hallo zusammen,
Total Win 7 Security Tool Alert hat sich von selbst installiert und hat zuerst mein normales AntiVir lahm gelegt.
Bei meinem Internet Explorer konnte ich gar keine Seite mehr öffnen, weil sich immer dieses Prgramm geöffnet hat und mir auf Englisch zuverstehen gab ein Update von 50-90$ zukaufen.
Dazu öffnete sich das Programm auch von alleine und wollte einen Suchlauf durchführen.

Allerdings funktionierte noch Firefox.
Habe mir dann Malwarebytes gedownloadet und damit einen Suchlauf gestartet und hier sind die Logs:
Hoffe jemand weiß damit was anzufangen

Malwarebytes' Anti-Malware 1.45
www.malwarebytes.org

Datenbank Version: 3948

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

03.04.2010 14:31:07
mbam-log-2010-04-03 (14-31-07).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 102913
Laufzeit: 2 Minute(n), 37 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 1
Infizierte Registrierungsschlüssel: 12
Infizierte Registrierungswerte: 13
Infizierte Dateiobjekte der Registrierung: 4
Infizierte Verzeichnisse: 34
Infizierte Dateien: 44

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
C:\Windows\System32\nmklo.dll (Worm.MarioFev) -> Delete on reboot.

Infizierte Registrierungsschlüssel:
HKEY_CLASSES_ROOT\AppID\{38061edc-40bb-4618-a8da-e56353347e6d} (Adware.EZlife) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a9ba40a1-74f1-52bd-f434-00b15a2c8953} (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{a9ba40a1-74f1-52bd-f434-00b15a2c8953} (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a9ba40a1-74f1-52bd-f434-00b15a2c8953} (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\YVIBBBHA8C (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Fci (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ezLife (Adware.EzLife) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\ezLife (Adware.EzLife) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\fci (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Handle (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\WEK9EMDHI9 (Trojan.Agent) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yvibbbha8c (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\canaveral (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ezlife (Adware.EZlife) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\userini (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\userini (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\userini (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\userini (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\idstrf (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\winid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\nofolderoptions (Hijack.FolderOptions) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hsa8ffushf83hoigjhs98jgijg9sd8e (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hsf87efjhdsf87f3jfsdi7fhsujfd (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ewrgetuj (Worm.Prolaco.M) -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Users\Zirpel\AppData\Local\ave.exe" /START "C:\Program Files (x86)\Mozilla Firefox\firefox.exe") Good: (firefox.exe) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Users\Zirpel\AppData\Local\ave.exe" /START "C:\Program Files (x86)\Internet Explorer\iexplore.exe") Good: (iexplore.exe) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Users\Zirpel\AppData\Local\ave.exe" /START "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -safe-mode) Good: (firefox.exe -safe-mode) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions (Hijack.FolderOptions) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Infizierte Verzeichnisse:
C:\ProgramData\92877437 (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AntiVirus Plus (Rogue.AntiVirusPlus) -> Quarantined and deleted successfully.
C:\Users\Zirpel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AntiVirus Plus (Rogue.AntiVirusPlus) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Internet Today (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Internet Today\1.2.0.1420 (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Web Search Operator (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Web Search Operator\4.2.0.2150 (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Web Search Operator\4.2.0.2150\Data (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Web Search Operator\4.2.0.2150\FF (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Web Search Operator\4.2.0.2150\FF\chrome (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Web Search Operator\4.2.0.2150\FF\chrome\content (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Web Search Operator\4.2.0.2150\FF\components (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Textual Content Provider (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Textual Content Provider\1.2.0.2040 (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Textual Content Provider\1.2.0.2040\data (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Automated Content Enhancer (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Automated Content Enhancer\4.2.0.5360 (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Automated Content Enhancer\4.2.0.5360\Data (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Automated Content Enhancer\4.2.0.5360\FF (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Automated Content Enhancer\4.2.0.5360\FF\chrome (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Automated Content Enhancer\4.2.0.5360\FF\chrome\content (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Automated Content Enhancer\4.2.0.5360\FF\components (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Customized Platform Advancer (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Customized Platform Advancer\4.2.0.2050 (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Customized Platform Advancer\4.2.0.2050\Data (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Customized Platform Advancer\4.2.0.2050\FF (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Customized Platform Advancer\4.2.0.2050\FF\chrome (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Customized Platform Advancer\4.2.0.2050\FF\chrome\content (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Customized Platform Advancer\4.2.0.2050\FF\components (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Content Management Wizard (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Content Management Wizard\1.2.0.2080 (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\ezLife (Adware.EzLife) -> Quarantined and deleted successfully.
C:\Program Files (x86)\ezLife\ezLife (Adware.EzLife) -> Quarantined and deleted successfully.
C:\Program Files (x86)\ezLife\ezLife\1.2.0.0 (Adware.EzLife) -> Quarantined and deleted successfully.

Infizierte Dateien:
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AntiVirus Plus\EULA.url (Rogue.AntiVirusPlus) -> Quarantined and deleted successfully.
C:\Users\Zirpel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AntiVirus Plus\EULA.url (Rogue.AntiVirusPlus) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Internet Today\1.2.0.1420\InternetToday.skf (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Internet Today\1.2.0.1420\unins000.dat (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Web Search Operator\4.2.0.2150\unins000.dat (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Web Search Operator\4.2.0.2150\Data\config.md (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Web Search Operator\4.2.0.2150\FF\install.rdf (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Web Search Operator\4.2.0.2150\FF\chrome\WSOAddOn.jar (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Web Search Operator\4.2.0.2150\FF\chrome\content\WSOAddOn.xul (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Web Search Operator\4.2.0.2150\FF\components\WSOFFAddOn.xpt (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Textual Content Provider\1.2.0.2040\unins000.dat (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Textual Content Provider\1.2.0.2040\data\pxtmpdata.mx (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Textual Content Provider\1.2.0.2040\data\TP_Config.mx (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Textual Content Provider\1.2.0.2040\data\TP_Data.mx (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Textual Content Provider\1.2.0.2040\data\TP_DomainExcludeList.mx (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Textual Content Provider\1.2.0.2040\data\TP_DomainInterval.mx (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Textual Content Provider\1.2.0.2040\data\TP_KeywordInterval.mx (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Automated Content Enhancer\4.2.0.5360\unins000.dat (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Automated Content Enhancer\4.2.0.5360\Data\config.md (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Automated Content Enhancer\4.2.0.5360\FF\install.rdf (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Automated Content Enhancer\4.2.0.5360\FF\chrome\ACEAddOn.jar (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Automated Content Enhancer\4.2.0.5360\FF\chrome\content\ACEAddOn.xul (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Automated Content Enhancer\4.2.0.5360\FF\components\ACEFFAddOn.xpt (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Customized Platform Advancer\4.2.0.2050\unins000.dat (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Customized Platform Advancer\4.2.0.2050\Data\config.md (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Customized Platform Advancer\4.2.0.2050\FF\install.rdf (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Customized Platform Advancer\4.2.0.2050\FF\chrome\CPAAddOn.jar (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Customized Platform Advancer\4.2.0.2050\FF\chrome\content\CPAAddOn.xul (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Customized Platform Advancer\4.2.0.2050\FF\components\CPAFFAddOn.xpt (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Content Management Wizard\1.2.0.2080\config.mx (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Content Management Wizard\1.2.0.2080\data.mx (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Content Management Wizard\1.2.0.2080\exclude.mx (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Content Management Wizard\1.2.0.2080\MatchingData.zd5 (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Content Management Wizard\1.2.0.2080\pxtmpdata.mx (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Content Management Wizard\1.2.0.2080\unins000.dat (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files (x86)\ezLife\ezLife\1.2.0.0\uninstall.exe (Adware.EzLife) -> Quarantined and deleted successfully.
C:\Users\Zirpel\AppData\Local\Temp\Yzr.exe (Trojan.FakeAlert) -> Delete on reboot.
C:\ProgramData\sysReserve.ini (Malware.Trace) -> Quarantined and deleted successfully.
C:\Windows\System32\nmklo.dll (Worm.MarioFev) -> Delete on reboot.
C:\Windows\Tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Windows\System32\fci.exe.exe (Worm.Zhelatin) -> Quarantined and deleted successfully.
C:\Windows\mqcd.dbt (Malware.Trace) -> Quarantined and deleted successfully.
C:\Users\Zirpel\AppData\Roaming\avdrn.dat (Malware.Trace) -> Quarantined and deleted successfully.
C:\Users\Zirpel\AppData\Local\ave.exe (Rogue.MultipleAV) -> Quarantined and deleted successfully.

Alt 03.04.2010, 13:37   #2
Discovery
 
Total Win 7 Security Tool Alert - Standard

Total Win 7 Security Tool Alert


So der Schädling ist erstmal entfernt
__________________
Antwort

Themen zu Total Win 7 Security Tool Alert
adware.agent, adware.ezlife, alert, antivir, antivirus, browser, components, dateien, englisch, explorer, firefox.exe, helper, hijack.folderoptions, hijack.startmenuinternet, iexplore.exe, install.exe, internet, internet explorer, lahm, local\temp, malwarebytes, microsoft, mozilla, opera, programdata, programm, rogue.multipleav, security, seite, software, start menu, suchlauf, system, system32, temp, trojan.agent, trojan.downloader, update, von selbst, win 7 security, worm.zhelatin


« Syswiederherstellung deaktivert, versucht sich ins Inet zu verbinden, PC überlastet | Internet Explorer öffnet sich mit Werbeseiten von alleine »


Ähnliche Themen: Total Win 7 Security Tool Alert


  1. Win 7 Total Security
    Log-Analyse und Auswertung - 21.01.2013 (34)
  2. Win 7 Total Security 2013 entfernen
    Anleitungen, FAQs & Links - 11.01.2013 (2)
  3. Total Security befall
    Log-Analyse und Auswertung - 13.05.2011 (9)
  4. AntiVirus Software Alert / Windows Security Alert
    Plagegeister aller Art und deren Bekämpfung - 15.01.2011 (19)
  5. Windows Security Alert / AV Security Suite / Antivirus Software Alert
    Plagegeister aller Art und deren Bekämpfung - 08.01.2011 (1)
  6. Total Security FakeScanner
    Plagegeister aller Art und deren Bekämpfung - 28.12.2010 (1)
  7. Security Alert oder Security Allert...
    Mülltonne - 17.11.2010 (0)
  8. Meldung Windows Security Alert / AV Security Suite / Antivirus Software Alert
    Plagegeister aller Art und deren Bekämpfung - 17.09.2010 (26)
  9. Windows Security Alert / AV Security Suite / Antivirus Software Alert / gefakter AV lähmt PC
    Plagegeister aller Art und deren Bekämpfung - 09.09.2010 (3)
  10. Malware / Virus / Trojaner - "Windows Security Alert / Security Suite"
    Plagegeister aller Art und deren Bekämpfung - 31.08.2010 (11)
  11. selbe problem mit Windows Security Alert - Antivirus Software Alert
    Plagegeister aller Art und deren Bekämpfung - 15.08.2010 (3)
  12. Windows Security Alert / AV Security Suite / Antivirus Software Alert
    Plagegeister aller Art und deren Bekämpfung - 26.07.2010 (21)
  13. Windows Security Alert / AV Security Suite / Antivirus Software Alert// Ohne Internet
    Plagegeister aller Art und deren Bekämpfung - 21.07.2010 (1)
  14. Total Security entfernen
    Anleitungen, FAQs & Links - 22.02.2010 (2)
  15. system alert, windows security alert und fremde antiviren programme
    Plagegeister aller Art und deren Bekämpfung - 01.01.2010 (51)
  16. total security 2009
    Plagegeister aller Art und deren Bekämpfung - 14.10.2009 (6)
  17. total secure 2009, virus alert und popups..
    Log-Analyse und Auswertung - 28.10.2008 (3)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema Total Win 7 Security Tool Alert - Hallo zusammen, Total Win 7 Security Tool Alert hat sich von selbst installiert und hat zuerst mein normales AntiVir lahm gelegt. Bei meinem Internet Explorer konnte ich gar keine Seite - Total Win 7 Security Tool Alert...
Archiv
Du betrachtest: Total Win 7 Security Tool Alert auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58