| |
| |||||||
Log-Analyse und Auswertung: Trojaner TR/DLdr.Small.qdWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
15.11.2004, 16:46
| #1 |
 |  Trojaner TR/DLdr.Small.qd Hallo! hab folgende Logs für euch zur auswertung: Logfile of HijackThis v1.98.2 Scan saved at 15:10:39, on 15.11.2004 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Programme\AVPersonal\AVGUARD.EXE C:\Programme\AVPersonal\AVWUPSRV.EXE C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Programme\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe C:\Programme\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe C:\Programme\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe C:\WINDOWS\System32\VSStatmn32.exe C:\Programme\AVPersonal\AVGNT.EXE C:\WINDOWS\System32\ctfmon.exe C:\Programme\Tweak-XP Pro\AdBlocker.exe C:\Programme\Tweak-XP Pro\transtask.exe C:\WINDOWS\System32\wmplayer612.exe C:\lotus\organize\easyclip6.exe C:\WINDOWS\System32\wuauclt.exe C:\Programme\Internet Explorer\IEXPLORE.EXE C:\Programme\Internet Explorer\iexplore.exe C:\DOKUME~1\VERSIC~1\LOKALE~1\Temp\mwavscan.com C:\DOKUME~1\VERSIC~1\LOKALE~1\Temp\kavss.exe C:\Programme\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\system32\NOTEPAD.EXE C:\PROGRA~1\WINZIP\winzip32.exe C:\Dokumente und Einstellungen\Versicherungsbüro\Lokale Einstellungen\Temp\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.de/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SYSTEM\blank.htm O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [SystemTray] SysTray.Exe O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Programme\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe O4 - HKLM\..\Run: [CamMonitor] C:\Programme\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe O4 - HKLM\..\Run: [DSN] C:\WINDOWS\System32\RemoveUserDsn.exe O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [Windows Media Player 6.1.2] wmplayer612.exe O4 - HKLM\..\Run: [$WindowsRegKey%update] IEXPLORE.EXE O4 - HKLM\..\Run: [Mcafee Antivirus Monitoring System32mn] VSStatmn32.exe O4 - HKLM\..\Run: [AVGCtrl] C:\Programme\AVPersonal\AVGNT.EXE /min O4 - HKLM\..\RunServices: [Windows Media Player 6.1.2] wmplayer612.exe O4 - HKLM\..\RunServices: [$WindowsRegKey%update] IEXPLORE.EXE O4 - HKLM\..\RunServices: [Mcafee Antivirus Monitoring System32mn] VSStatmn32.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [BlockAds] "C:\Programme\Tweak-XP Pro\AdBlocker.exe" O4 - HKCU\..\Run: [TransTask] "C:\Programme\Tweak-XP Pro\transtask.exe" O4 - HKCU\..\Run: [Windows Media Player 6.1.2] wmplayer612.exe O4 - HKCU\..\Run: [Mcafee Antivirus Monitoring System32mn] VSStatmn32.exe O4 - Startup: Lotus Organizer EasyClip.lnk = ? O4 - Startup: Lotus Organizer 6.0.lnk = C:\lotus\organize\org6.exe O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE O9 - Extra button: Web-Eintrag - {B4E30F61-16D9-11D3-85D1-005004229569} - c:\lotus\organize\bandobjs.dll O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_fi...3f7497194f6505 O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1093588833293 O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab O16 - DPF: {771A1334-6B08-4A6B-AEDC-CF994BA2CEBE} (Installer Class) - http://www.ysbweb.com/ist/softwares/...sb_regular.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{D72C0B51-5350-4985-8951-3AB1CB589407}: NameServer = 217.237.150.141 217.237.150.97 ich hoff irh könnt mir helfen. DAnke im vorraus PS: windows update lad ich grad runter |
|
15.11.2004, 16:47
| #2 |
| | Trojaner TR/DLdr.Small.qd ergänzung zu oben:
__________________Die folgende log isch von eScan: File C:\WINDOWS\System32\VSStatmn32.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken. File C:\WINDOWS\System32\wmplayer612.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\wmplayer612.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\VSStatmn32.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\wmplayer612.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\VSStatmn32.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\wmplayer612.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\VSStatmn32.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken. File C:\WINDOWS\System32\clocker.exe infected by "TrojanDownloader.Win32.IstBar.er" Virus. Action Taken: No Action Taken. File C:\WINDOWS\System32\VSStatmn32.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken. File C:\WINDOWS\System32\wmplayer612.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken. File C:\WINDOWS\System32\IExplore32b.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken. File C:\WINDOWS\OPTIONS\CABS\EBD.CAB tagged as not-a-virus:Tool.DOS.Restart. No Action Taken. File C:\WINDOWS\SYSTEM32\clocker.exe infected by "TrojanDownloader.Win32.IstBar.er" Virus. Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM32\VSStatmn32.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM32\wmplayer612.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM32\IExplore32b.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken. File C:\WINDOWS\CONFIG\loudc.exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\WINDOWS\CONFIG\pro.exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Downloaded Program Files\WinAdToolsX.dll tagged as not-a-virus:AdWare.WinAD. No Action Taken. File C:\Programme\AVPersonal\INFECTED\IEXPLORE.VIR infected by "Backdoor.Rbot.j" Virus. Action Taken: No Action Taken. File C:\Programme\AVPersonal\INFECTED\YOURSITEBAR.EXE.VIR infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\Programme\AVPersonal\INFECTED\YOURSITEBAR[2].EXE.VIR infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\Programme\AVPersonal\INFECTED\YOURSITEBAR.EXE.001 infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\Programme\AVPersonal\INFECTED\YOURSITEBAR[1].EXE.VIR infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\Programme\AVPersonal\INFECTED\YOURSITEBAR.EXE.002 infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\Dokumente und Einstellungen\Versicherungsbüro\Lokale Einstellungen\Temporary Internet Files\Content.IE5\G127O5UV\tool[1].exe infected by "TrojanDownloader.Win32.IstBar.er" Virus. Action Taken: No Action Taken. File C:\Dokumente und Einstellungen\Versicherungsbüro\Lokale Einstellungen\Temporary Internet Files\Content.IE5\6VUB8HIJ\sbc[1].exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\Dokumente und Einstellungen\Versicherungsbüro\Lokale Einstellungen\Temporary Internet Files\Content.IE5\6VUB8HIJ\pro[1].exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{E2DFB348-3D7C-4C24-8D89-0D56F50DDEB9}\RP513\A0038674.exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{E2DFB348-3D7C-4C24-8D89-0D56F50DDEB9}\RP518\A0039788.exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{E2DFB348-3D7C-4C24-8D89-0D56F50DDEB9}\RP518\A0039789.exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{E2DFB348-3D7C-4C24-8D89-0D56F50DDEB9}\RP518\A0039797.exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{E2DFB348-3D7C-4C24-8D89-0D56F50DDEB9}\RP518\A0039798.exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{E2DFB348-3D7C-4C24-8D89-0D56F50DDEB9}\RP519\A0039804.exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{E2DFB348-3D7C-4C24-8D89-0D56F50DDEB9}\RP519\A0039805.exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{E2DFB348-3D7C-4C24-8D89-0D56F50DDEB9}\RP520\A0039811.exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{E2DFB348-3D7C-4C24-8D89-0D56F50DDEB9}\RP520\A0039812.exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{E2DFB348-3D7C-4C24-8D89-0D56F50DDEB9}\RP520\A0040818.exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{E2DFB348-3D7C-4C24-8D89-0D56F50DDEB9}\RP520\A0040819.exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{E2DFB348-3D7C-4C24-8D89-0D56F50DDEB9}\RP511\A0030673.exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{E2DFB348-3D7C-4C24-8D89-0D56F50DDEB9}\RP511\A0031494.exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{E2DFB348-3D7C-4C24-8D89-0D56F50DDEB9}\RP511\A0034502.exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{E2DFB348-3D7C-4C24-8D89-0D56F50DDEB9}\RP516\A0038749.exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{E2DFB348-3D7C-4C24-8D89-0D56F50DDEB9}\RP516\A0038750.exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{E2DFB348-3D7C-4C24-8D89-0D56F50DDEB9}\RP516\A0038767.exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{E2DFB348-3D7C-4C24-8D89-0D56F50DDEB9}\RP516\A0038768.exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{E2DFB348-3D7C-4C24-8D89-0D56F50DDEB9}\RP516\A0039771.exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{E2DFB348-3D7C-4C24-8D89-0D56F50DDEB9}\RP516\A0039777.dll tagged as not-a-virus:AdWare.WinAD. No Action Taken. File C:\System Volume Information\_restore{E2DFB348-3D7C-4C24-8D89-0D56F50DDEB9}\RP517\A0039778.exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{E2DFB348-3D7C-4C24-8D89-0D56F50DDEB9}\RP517\A0039779.exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{E2DFB348-3D7C-4C24-8D89-0D56F50DDEB9}\RP517\A0039785.dll tagged as not-a-virus:AdWare.WinAD. No Action Taken. File C:\System Volume Information\_restore{E2DFB348-3D7C-4C24-8D89-0D56F50DDEB9}\RP517\A0039786.exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{E2DFB348-3D7C-4C24-8D89-0D56F50DDEB9}\RP517\A0039787.exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. nochmals danke im vorraus |
|
15.11.2004, 17:17
| #3 | |
| Administrator, a.D.   | Trojaner TR/DLdr.Small.qd Hallo,
__________________der Grund für diese derartige hohe Kompromittierung ist auf dein ungepatchtes System zurück zu führen. Zitat:
http://www.trojaner-board.de/showpos...28&postcount=2
__________________ |
|
16.11.2004, 09:14
| #4 |
| | Trojaner TR/DLdr.Small.qd Also ich hab jetzt den neusten patch drauf gemacht, gibt es noch eine andere möglichkeit außer formatieren? |
|
16.11.2004, 12:54
| #5 |
 | Trojaner TR/DLdr.Small.qd @ Bizarre, Die Sophos Viren-Enzyklopädie: Backdoor.Win32.Rbot.gen-> "Erläuterung". Cidre's Rat beachten und Festplatte formatieren - Schritt für Schritt. SD |
|
| Themen zu Trojaner TR/DLdr.Small.qd |
| adobe, antivirus, auswertung, bho, button, check, einstellungen, explorer, hijack, hijackthis, internet, internet explorer, mcafee, microsoft, programme, software, symantec, system, system32, tcpip, temp, trojaner, update, windows, windows media player, windows xp |
