Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung

Plagegeister aller Art und deren Bekämpfung: BOO/TDss.M im Masterbootsektor/HD0 entdeckt

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

 
Alt 24.07.2011, 22:51   #16
Ifron
 
BOO/TDss.M im Masterbootsektor/HD0 entdeckt - Standard

BOO/TDss.M im Masterbootsektor/HD0 entdeckt



Hey M-K-D-B,

hier die logs:

OTL-Fix:

Code:
ATTFilter
All processes killed
========== OTL ==========
Service wpsdrvnt stopped successfully!
Service wpsdrvnt deleted successfully!
C:\Windows\SysWOW64\drivers\wpsdrvnt.sys moved successfully.
Service Teefer stopped successfully!
Service Teefer deleted successfully!
C:\Windows\SysWOW64\drivers\Teefer.sys moved successfully.
Service wg3n stopped successfully!
Service wg3n deleted successfully!
C:\Windows\SysWOW64\drivers\wg3n.sys moved successfully.
Prefs.js: "Game Master 1.1 Customized Web Search" removed from browser.search.defaultthis.engineName
Prefs.js: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2856449&SearchSource=3&q={searchTerms}" removed from browser.search.defaulturl
Prefs.js: "Game Master 1.1 Customized Web Search" removed from browser.search.selectedEngine
Prefs.js: {872b5b88-9db5-4310-bdd0-ac189557e5f5}:3.3.3.2 removed from extensions.enabledItems
Prefs.js: engine@conduit.com:3.3.3.2 removed from extensions.enabledItems
C:\Users\Ann-Marie\AppData\Roaming\mozilla\Firefox\Profiles\bl3lem6s.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\searchplugin folder moved successfully.
C:\Users\Ann-Marie\AppData\Roaming\mozilla\Firefox\Profiles\bl3lem6s.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\META-INF folder moved successfully.
C:\Users\Ann-Marie\AppData\Roaming\mozilla\Firefox\Profiles\bl3lem6s.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\lib folder moved successfully.
C:\Users\Ann-Marie\AppData\Roaming\mozilla\Firefox\Profiles\bl3lem6s.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\defaults folder moved successfully.
C:\Users\Ann-Marie\AppData\Roaming\mozilla\Firefox\Profiles\bl3lem6s.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\components folder moved successfully.
C:\Users\Ann-Marie\AppData\Roaming\mozilla\Firefox\Profiles\bl3lem6s.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\chrome folder moved successfully.
C:\Users\Ann-Marie\AppData\Roaming\mozilla\Firefox\Profiles\bl3lem6s.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5} folder moved successfully.
C:\Users\Ann-Marie\AppData\Roaming\mozilla\Firefox\Profiles\bl3lem6s.default\extensions\engine@conduit.com\searchplugin folder moved successfully.
C:\Users\Ann-Marie\AppData\Roaming\mozilla\Firefox\Profiles\bl3lem6s.default\extensions\engine@conduit.com\META-INF folder moved successfully.
C:\Users\Ann-Marie\AppData\Roaming\mozilla\Firefox\Profiles\bl3lem6s.default\extensions\engine@conduit.com\lib folder moved successfully.
C:\Users\Ann-Marie\AppData\Roaming\mozilla\Firefox\Profiles\bl3lem6s.default\extensions\engine@conduit.com\DualPackage folder moved successfully.
C:\Users\Ann-Marie\AppData\Roaming\mozilla\Firefox\Profiles\bl3lem6s.default\extensions\engine@conduit.com\defaults folder moved successfully.
C:\Users\Ann-Marie\AppData\Roaming\mozilla\Firefox\Profiles\bl3lem6s.default\extensions\engine@conduit.com\components folder moved successfully.
C:\Users\Ann-Marie\AppData\Roaming\mozilla\Firefox\Profiles\bl3lem6s.default\extensions\engine@conduit.com\chrome folder moved successfully.
C:\Users\Ann-Marie\AppData\Roaming\mozilla\Firefox\Profiles\bl3lem6s.default\extensions\engine@conduit.com folder moved successfully.
C:\Users\Ann-Marie\AppData\Roaming\Mozilla\Firefox\Profiles\bl3lem6s.default\searchplugins\conduit.xml moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Restrictions\ deleted successfully.
Registry key HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel\ deleted successfully.
C:\Users\Ann-Marie\AppData\Local\{DDEF54B3-0B02-43E0-8134-DED37598DC14} folder moved successfully.
C:\Users\Ann-Marie\AppData\Local\{13D1B040-B56B-4B67-85D6-628BB3E80A81} folder moved successfully.
C:\Users\Ann-Marie\AppData\Local\{B342C8B4-5EF9-49E3-96CB-D70678747FDC} folder moved successfully.
C:\Users\Ann-Marie\AppData\Local\{CED6590A-550C-4BDC-9FDE-7DA5AA16B566} folder moved successfully.
C:\Users\Ann-Marie\AppData\Local\{D4F34911-DDD3-4080-9362-5E7E43772570} folder moved successfully.
C:\Users\Ann-Marie\AppData\Local\{58A7FFB2-7A6C-4829-BAD3-5D3C141FF498} folder moved successfully.
C:\Users\Ann-Marie\AppData\Local\{4A750548-BFCB-44A1-8FA9-A65945050B6A} folder moved successfully.
C:\Users\Ann-Marie\AppData\Local\{37E444B9-328A-4DC7-9DA5-CDF548036B97} folder moved successfully.
C:\Users\Ann-Marie\AppData\Local\{D50495AE-374D-4F2D-8676-A065A5A9484B} folder moved successfully.
C:\Users\Ann-Marie\AppData\Local\{ADE4BA66-CC25-4458-B292-E9DC94190A98} folder moved successfully.
C:\Users\Ann-Marie\AppData\Local\{D7C3F2DC-645F-44B2-B09C-3EA6F0507701} folder moved successfully.
C:\Users\Ann-Marie\AppData\Local\{D1AA260A-2E89-4507-9F7C-F60413894039} folder moved successfully.
C:\Users\Ann-Marie\AppData\Local\{727D3D80-261F-4BE2-A867-005CAD2F0EA2} folder moved successfully.
C:\Users\Ann-Marie\AppData\Local\{BA5EEFC1-A869-4382-AA98-ECFB5523B547} folder moved successfully.
C:\Users\Ann-Marie\AppData\Local\{50EA10F7-56BE-4F01-A195-BA4EDA0C250F} folder moved successfully.
C:\Users\Ann-Marie\AppData\Local\{827F7D1F-E9FE-43CE-AEC3-83D8BD8D3DE6} folder moved successfully.
C:\Users\Ann-Marie\AppData\Local\{786278F3-F4AF-4FDD-A10D-0062C2E14F8D} folder moved successfully.
C:\Users\Ann-Marie\AppData\Local\{04927D79-B2DA-4304-A0C9-ED1C882A35F8} folder moved successfully.
C:\Users\Ann-Marie\AppData\Local\{73F861E5-C43E-4944-9F8C-188DA170386E} folder moved successfully.
C:\Users\Ann-Marie\AppData\Local\{85CF987B-1571-441D-8F1B-1A42A54FA8A9} folder moved successfully.
C:\Users\Ann-Marie\AppData\Local\{E9298AAD-92BE-4761-BF74-191828F5BAA9} folder moved successfully.
C:\Users\Ann-Marie\AppData\Local\{09702910-F054-4AC9-AEF5-F435F98B2876} folder moved successfully.
C:\Users\Ann-Marie\AppData\Local\{38556073-EB8D-424F-8EB0-43E34B3C408B} folder moved successfully.
C:\Users\Ann-Marie\AppData\Local\{FD8A7B68-4071-466D-B3AD-3D67D91335E4} folder moved successfully.
C:\Users\Ann-Marie\AppData\Local\{622A6E00-B664-4645-80C9-CDC86D1110D8} folder moved successfully.
C:\Users\Ann-Marie\AppData\Local\{3C7A15F0-3BDB-455D-9508-BD67422CE3F1} folder moved successfully.
C:\Users\Ann-Marie\AppData\Local\{5FDC8781-A78A-40F8-BB69-16F919BDCA10} folder moved successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: Administrator
->Temp folder emptied: 0 bytes
 
User: All Users
 
User: Ann-Marie
->Temp folder emptied: 295532 bytes
->Temporary Internet Files folder emptied: 75713036 bytes
->Java cache emptied: 128656 bytes
->FireFox cache emptied: 85799664 bytes
->Flash cache emptied: 41180 bytes
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Public
->Temp folder emptied: 0 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 65907 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 67899 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 155,00 mb
 
 
OTL by OldTimer - Version 3.2.26.1 log created on 07242011_160412

Files\Folders moved on Reboot...
C:\Users\Ann-Marie\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
File move failed. C:\Windows\temp\dsiwmis.log scheduled to be moved on reboot.

Registry entries deleted on Reboot...
         
Eset:

Code:
ATTFilter
ESETSmartInstaller@High as downloader log:
all ok
esets_scanner_update returned -1 esets_gle=53251
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=f71a85fb83c7104ea45255f1509e68d4
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-07-24 07:44:26
# local_time=2011-07-24 09:44:26 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7600 NT 
# compatibility_mode=1797 16775165 100 94 342682 48064090 212315 0
# compatibility_mode=5893 16776573 100 94 15906869 63162077 0 0
# compatibility_mode=8192 67108863 100 0 14921 14921 0 0
# scanned=165651
# found=0
# cleaned=0
# scan_time=4440
         
Security check:

Code:
ATTFilter
 Results of screen317's Security Check version 0.99.17  
 Windows 7   
 Internet Explorer 8  
`````````````````````````````` 
Antivirus/Firewall Check: 
 Avira AntiVir Personal - Free Antivirus 
 ESET Online Scanner v3   
 Sygate Personal Firewall Platinum   
 WMI entry may not exist for antivirus; attempting automatic update. 
``````````````````````````````` 
Anti-malware/Other Utilities Check: 
 Malwarebytes' Anti-Malware    
Flash Player Out of Date! 
 Adobe Flash Player 	10.2.152.26  
 Adobe Reader X (10.1.0) 
 Mozilla Firefox (3.6.13) Firefox Out of Date!  
```````````````````````````````` 
Process Check:  
objlist.exe by Laurent 
 Malwarebytes' Anti-Malware mbamservice.exe  
 Malwarebytes' Anti-Malware mbamgui.exe  
 Avira Antivir avgnt.exe 
 Avira Antivir avguard.exe 
``````````End of Log````````````
         

 

Themen zu BOO/TDss.M im Masterbootsektor/HD0 entdeckt
antivir, avira, avira antivir, beendet, boo/tdss.m, browser, datei, entdeck, entfernen, guten, hochfahren, internetseite, klicke, laptop, mas, neustart, nicht mehr, pcs, popup, scan, seite, seiten, tool, verschiedene, virus, websites




Ähnliche Themen: BOO/TDss.M im Masterbootsektor/HD0 entdeckt


  1. Virus 'BOO/TDss.O' im Masterbootsektor
    Log-Analyse und Auswertung - 08.09.2014 (24)
  2. Windows 7: Virus 'BOO/TDss.O' im Masterbootsektor
    Log-Analyse und Auswertung - 08.05.2014 (33)
  3. BOO/TDss.M im Masterbootsektor/HD0 entdeckt
    Plagegeister aller Art und deren Bekämpfung - 07.05.2014 (3)
  4. BOO/TDss.O im Masterbootsektor
    Log-Analyse und Auswertung - 17.04.2014 (11)
  5. Nach Avira Update: Win 7- BOO/TDss.O wurde im Masterbootsektor gefunden
    Log-Analyse und Auswertung - 22.01.2014 (23)
  6. BOO /TDss.O im Masterbootsektor gefunden nach Installation von Windows 7 auf einer zweiten internen Festplatte
    Plagegeister aller Art und deren Bekämpfung - 07.01.2014 (33)
  7. Windows 7: BOO/TDss.O in Masterbootsektor nach Formatierung
    Log-Analyse und Auswertung - 17.11.2013 (6)
  8. BOO/TDss.M in Masterbootsektor
    Plagegeister aller Art und deren Bekämpfung - 22.03.2012 (22)
  9. BOO/TDss.m Masterbootsektor verseucht! versuch zu bereinigen gescheitert
    Plagegeister aller Art und deren Bekämpfung - 06.01.2012 (27)
  10. Virus ? MasterBootSektor defekt ? Speicherveränderung wurde entdeckt
    Plagegeister aller Art und deren Bekämpfung - 26.12.2011 (28)
  11. BOO/TDss.M im Masterbootsektor gefunden.(Antivir) Auch nach Systemrücksetzung mit Samsung Recovery
    Plagegeister aller Art und deren Bekämpfung - 03.11.2011 (36)
  12. Dringend Hilfe gesucht!! Virus "BOO/TDss.D" auf dem Bootsektor, Masterbootsektor HD0
    Log-Analyse und Auswertung - 11.10.2011 (1)
  13. Masterbootsektor HD0 Virus BOO/TDss.D
    Plagegeister aller Art und deren Bekämpfung - 24.09.2011 (35)
  14. BOO/TDss.M im Masterbootsektor gefunden - wie entfernen?
    Log-Analyse und Auswertung - 20.05.2011 (26)
  15. Masterbootsektor mit BOO/TDss.M vereucht
    Plagegeister aller Art und deren Bekämpfung - 05.05.2011 (32)
  16. 'Masterbootsektor HD0'' BOO/TDss.M' [virus].Laptop lässt sich nicht herunterfahren!
    Plagegeister aller Art und deren Bekämpfung - 03.05.2011 (15)
  17. BOO/Sinowal.F im Masterbootsektor entdeckt - Brauche schnelle Hilfe!
    Plagegeister aller Art und deren Bekämpfung - 15.09.2010 (7)

Zum Thema BOO/TDss.M im Masterbootsektor/HD0 entdeckt - Hey M-K-D-B, hier die logs: OTL-Fix: Code: Alles auswählen Aufklappen ATTFilter All processes killed ========== OTL ========== Service wpsdrvnt stopped successfully! Service wpsdrvnt deleted successfully! C:\Windows\SysWOW64\drivers\wpsdrvnt.sys moved successfully. Service Teefer - BOO/TDss.M im Masterbootsektor/HD0 entdeckt...
Archiv
Du betrachtest: BOO/TDss.M im Masterbootsektor/HD0 entdeckt auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.