| |
| |||||||
Log-Analyse und Auswertung: Rootkit BOO/TDss.D Bekomme ich nicht mehr weg HELPWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
15.08.2011, 15:13
| #16 |
| /// Winkelfunktion /// TB-Süch-Tiger™   |  Rootkit BOO/TDss.D Bekomme ich nicht mehr weg HELP Dann bitte jetzt CF ausführen: ComboFix Ein Leitfaden und Tutorium zur Nutzung von ComboFix
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
16.08.2011, 13:12
| #17 |
 | Rootkit BOO/TDss.D Bekomme ich nicht mehr weg HELP Hallo Arne!
__________________Habe Combofix Ausgeführt. Den Log habe ich auch. Allerdings Kann ich keine Programme mehr öffnen. Es Kommt ein Schild: z.B. "C:\Users\HaukeS\Desktop\log1234.txt Es wurde versucht, einen Registrierungsschlüssel einem unzulässigen Vorgang zu unterziehen, der zum Löschen markiert wurde". Bin gerade an einem anderen Pc, weil ich auch Firefox usw nicht mehr öffnen kann. ich könnte den Log mit einem stick auf diesen rüberhohlen oder ist das keine gute idee wegen dem virus? Was soll ich tun Meister Grüße Hauke |
|
16.08.2011, 13:34
| #18 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Rootkit BOO/TDss.D Bekomme ich nicht mehr weg HELP Windows neu starten!!
__________________
__________________ |
|
17.08.2011, 17:38
| #19 |
| | Rootkit BOO/TDss.D Bekomme ich nicht mehr weg HELP Ok stimmt Hier der Combifix Log Grüße! |
|
17.08.2011, 21:31
| #20 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Rootkit BOO/TDss.D Bekomme ich nicht mehr weg HELP Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten. GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen. Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst. Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM! Downloade dir bitte  aswMBR.exe und speichere die Datei auf deinem Desktop.
Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).
__________________ Logfiles bitte immer in CODE-Tags posten |
|
18.08.2011, 10:37
| #21 |
| | Rootkit BOO/TDss.D Bekomme ich nicht mehr weg HELP HI Arne! gmer log: GMER Logfile: Code:
ATTFilter GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2011-08-18 10:47:14
Windows 6.1.7600
Running: m2pto3ov.exe; Driver: C:\Users\HaukeS\AppData\Local\Temp\kwrorpob.sys
---- Registry - GMER 1.0.15 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\001f3ad3f68b
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0c607688b5f7
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\001f3ad3f68b (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0c607688b5f7 (not active ControlSet)
---- Files - GMER 1.0.15 ----
File C:\Users\HaukeS\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7NAULF0F\video_gallery[1].htm 0 bytes
File C:\Users\HaukeS\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GJSHXLAK\heias.ret.pu[1].htm 0 bytes
File C:\Users\HaukeS\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HHHKUYF5\postview-tag-cunda[1].gif 43 bytes
File C:\Users\HaukeS\AppData\Roaming\Microsoft\Windows\Cookies\haukes@fastclick[2].txt 0 bytes
File C:\Users\HaukeS\AppData\Roaming\Microsoft\Windows\Cookies\haukes@c-and-a[2].txt 0 bytes
File C:\Users\HaukeS\AppData\Roaming\Microsoft\Windows\Cookies\haukes@turn[1].txt 0 bytes
File C:\Users\HaukeS\AppData\Roaming\Microsoft\Windows\Cookies\haukes@wtp101[1].txt 0 bytes
File C:\Users\HaukeS\AppData\Roaming\Microsoft\Windows\Cookies\haukes@invitemedia[1].txt 0 bytes
File C:\Users\HaukeS\AppData\Roaming\Microsoft\Windows\Cookies\haukes@metalyzer[2].txt 0 bytes
File C:\Windows\assembly\GAC\Policy.11.0.Microsoft.Vbe.Interop\12.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Vbe.Interop.config 880 bytes
File C:\Windows\assembly\GAC\Policy.11.0.Microsoft.Vbe.Interop\12.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Vbe.Interop.dll 11112 bytes executable
File C:\Windows\assembly\GAC\Policy.11.0.Microsoft.Vbe.Interop\12.0.0.0__71e9bce111e9429c\__AssemblyInfo__.ini 222 bytes
---- EOF - GMER 1.0.15 ----
Osam logfile: OSAM Logfile: Code:
ATTFilter Report of OSAM: Autorun Manager v5.0.11926.0 hxxp://www.online-solutions.ru/en/ Saved at 10:53:15 on 18.08.2011 OS: Windows 7 (Build 7600), 32-bit Default Browser: Mozilla Corporation Firefox 3.6.20 Scanner Settings [x] Rootkits detection (hidden registry) [x] Rootkits detection (hidden files) [x] Retrieve files information [x] Check Microsoft signatures Filters [ ] Trusted entries [ ] Empty entries [x] Hidden registry entries (rootkit activity) [x] Exclusively opened files [x] Not found files [x] Files without detailed information [x] Existing files [ ] Non-startable services [ ] Non-startable drivers [x] Active entries [x] Disabled entries [Control Panel Objects] -----( %SystemRoot%\system32 )----- "ISUSPM.cpl" - "Macrovision Corporation" - C:\Windows\system32\ISUSPM.cpl "PWMCP32V.cpl" - "Lenovo Group Limited" - C:\Windows\system32\PWMCP32V.cpl "TpShCPL.cpl" - "Lenovo." - C:\Windows\system32\TpShCPL.cpl -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )----- "mlcfg32.cpl" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~4\Office12\MLCFG32.CPL "PROSet Tools" - "Intel(R) Corporation" - C:\Program Files\Intel\WiFi\bin\iproset.cpl [Drivers] -----( HKLM\SYSTEM\CurrentControlSet\Services )----- "APS Digitizer Activity Monitor" (TPDIGIMN) - "Lenovo." - C:\Windows\System32\DRIVERS\ApsHM86.sys "catchme" (catchme) - ? - C:\Users\HaukeS\AppData\Local\Temp\catchme.sys (File not found) "GarenaPEngine" (GarenaPEngine) - ? - C:\Users\HaukeS\AppData\Local\Temp\MWHA35B.tmp (File not found) "GGSAFER Driver" (GGSAFERDriver) - ? - C:\Program Files\Garena\safedrv.sys (File not found) "Huawei DataCard USB Fake" (hwusbfake) - ? - C:\Windows\System32\DRIVERS\ewusbfake.sys (File not found) "Huawei DataCard USB Modem and USB Serial" (hwdatacard) - ? - C:\Windows\System32\DRIVERS\ewusbmdm.sys (File not found) "Huawei DataCard USB Serial Port" (ewsercd) - ? - C:\Windows\System32\DRIVERS\ewsercd.sys (File not found) "Huawei MobileBroadband USB PNP Device" (ew_hwusbdev) - ? - C:\Windows\System32\DRIVERS\ew_hwusbdev.sys (File not found) "HUAWEI USB-NDIS miniport" (ewusbnet) - ? - C:\Windows\System32\DRIVERS\ewusbnet.sys (File not found) "huawei_CompositeFilter" (ew_usbenumfilter) - ? - C:\Windows\System32\DRIVERS\ew_usbenumfilter.sys (File not found) "huawei_enumerator" (huawei_enumerator) - ? - C:\Windows\System32\DRIVERS\ew_jubusenum.sys (File not found) "kwrorpob" (kwrorpob) - "GMER" - C:\Users\HaukeS\AppData\Local\Temp\kwrorpob.sys (Hidden registry entry, rootkit activity) "MBAMSwissArmy" (MBAMSwissArmy) - "Malwarebytes Corporation" - C:\Windows\system32\drivers\mbamswissarmy.sys "PCDSRVC{3037D694-FD904ACA-06000000}_0 - PCDR Kernel Mode Service Helper Driver" (PCDSRVC{3037D694-FD904ACA-06000000}_0) - "PC-Doctor, Inc." - c:\program files\pc-doctor\pcdsrvc.pkms "PCDSRVC{C4B36920-79E24793-06000000}_0 - PCDR Kernel Mode Service Helper Driver" (PCDSRVC{C4B36920-79E24793-06000000}_0) - "PC-Doctor, Inc." - c:\progra~1\pc-doc~1\pcdsrvc.pkms "regi" (regi) - "InterVideo" - C:\Windows\System32\drivers\regi.sys "SASDIFSV" (SASDIFSV) - "SUPERAdBlocker.com and SUPERAntiSpyware.com" - C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS "SASKUTIL" (SASKUTIL) - "SUPERAdBlocker.com and SUPERAntiSpyware.com" - C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS "Shockprf" (Shockprf) - "Lenovo." - C:\Windows\System32\DRIVERS\Apsx86.sys [Explorer] -----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )----- {F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll -----( HKLM\Software\Classes\Protocols\Filter )----- {807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL -----( HKLM\Software\Classes\Protocols\Handler )----- {32505114-5902-49B2-880A-1F7738E5A384} "Data Page Plugable Protocal mso-offdap11 Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL {314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll {828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL {88FED34C-F0CA-4636-A375-3CB6248B04CD} "Local Groove Web Services Protocol" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~4\Office12\GRA32A~1.DLL {828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL {03C514A3-1EFB-4856-9F99-10D7BE1653C0} "Windows Live Mail HTML Asynchronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\Program Files\Windows Live\Mail\mailcomm.dll -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )----- {B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~4\Office12\GR469A~1.DLL {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "SABShellExecuteHook Class" - "SuperAdBlocker.com" - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )----- {23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Program Files\7-Zip\7-zip.dll {0563DB41-F538-4B37-A92D-4659049B7766} "CLSID_WLMCMimeFilter" - "Microsoft Corporation" - C:\Program Files\Windows Live\Mail\mailcomm.dll {99FD978C-D287-4F50-827F-B2C658EDA8E7} "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~4\Office12\GR469A~1.DLL {AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} "Groove Explorer Icon Overlay 2 (GFS Stub)" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~4\Office12\GR469A~1.DLL {920E6DB1-9907-4370-B3A0-BAFC03D81399} "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~4\Office12\GR469A~1.DLL {16F3DD56-1AF5-4347-846D-7C10C4192619} "Groove Explorer Icon Overlay 3 (GFS Folder)" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~4\Office12\GR469A~1.DLL {2916C86E-86A6-43FE-8112-43ABE6BF8DCC} "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~4\Office12\GR469A~1.DLL {2A541AE1-5BF6-4665-A8A3-CFA9672E4291} "Groove Folder Synchronization" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~4\Office12\GR469A~1.DLL {72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~4\Office12\GR469A~1.DLL {6C467336-8281-4E60-8204-430CED96822D} "Groove GFS Context Menu Handler" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~4\Office12\GR469A~1.DLL {B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~4\Office12\GR469A~1.DLL {A449600E-1DC6-4232-B948-9BD794D62056} "Groove GFS Stub Icon Handler" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~4\Office12\GR469A~1.DLL {387E725D-DC16-4D76-B310-2C93ED4752A0} "Groove XML Icon Handler" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~4\Office12\GR469A~1.DLL {42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\msohevi.dll {993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll {5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~4\Office12\ONFILTER.DLL {00020D75-0000-0000-C000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~4\Office12\MLSHEXT.DLL {C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll {7842554E-6BED-11D2-8CDB-B05550C10000} "Monitor Class" - "Broadcom Corporation." - C:\Program Files\ThinkPad\Bluetooth Software\btncopy.dll {0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~4\Office12\OLKFSTUB.DLL {45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - ? - (File not found | COM-object registry key not found) {2BE99FD4-A181-4996-BFA9-58C5FFD11F6C} "Windows Live Photo Gallery Autoplay Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe {00F30F64-AC33-42F5-8FD1-5DC2D3FDE06C} "Windows Live Photo Gallery Editor Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe {00F3712A-CA79-45B4-9E4D-D7891E7F8B9D} "Windows Live Photo Gallery Editor Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll {00F30F90-3E96-453B-AFCD-D71989ECC2C7} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll {00F33137-EE26-412F-8D71-F84E4C2C6625} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll {00F374B7-B390-4884-B372-2FC349F2172B} "Windows Live Photo Gallery Viewer Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe {00F346CB-35A4-465B-8B8F-65A29DBAB1F6} "Windows Live Photo Gallery Viewer Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll {06A2568A-CED6-4187-BB20-400B8C02BE5A} "{06A2568A-CED6-4187-BB20-400B8C02BE5A}" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoAcquireWizard.exe [Internet Explorer] -----( HKCU\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars )----- {555D4D79-4BD2-4094-A395-CFC534424A05} "HP Smart Web Printing" - "Hewlett-Packard Co." - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_bho.dll -----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )----- <binary data> "&Windows Live Toolbar" - "Microsoft Corporation" - C:\Program Files\Windows Live\Toolbar\wltcore.dll ITBar7Height "ITBar7Height" - ? - (File not found | COM-object registry key not found) <binary data> "ITBar7Layout" - ? - (File not found | COM-object registry key not found) -----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )----- {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_16" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_16.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab -----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )----- "@C:\Program Files\ThinkPad\Bluetooth Software\btrez.dll,-4015" - ? - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm {48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll {F4F55DC8-0B69-4DFE-BA94-CB677B88B2A3} "ClsidExtension" - "Lenovo Group Limited" - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll {DDE87865-83C5-48c4-8357-2F5B1AA84522} "HP Smart Web Printing ein- oder ausblenden" - "Hewlett-Packard Co." - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll {5F7B1267-94A9-47F5-98DB-E99415F33AEC} "In Blog veröffentlichen" - "Microsoft Corporation" - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll {FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL -----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )----- <binary data> "&Windows Live Toolbar" - "Microsoft Corporation" - C:\Program Files\Windows Live\Toolbar\wltcore.dll -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )----- {18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll {72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~4\Office12\GR469A~1.DLL {0347C33E-8762-4905-BF09-768834316C61} "HP Print Enhancer" - "Hewlett-Packard Co." - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} "HP Smart BHO Class" - "Hewlett-Packard Co." - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll {BF468356-BB7E-42D7-9F15-4F3B9BCFCED2} "IePasswordManagerHelper Class" - "Lenovo Group Limited" - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll {DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} "Search Helper" - "Microsoft Corp." - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll {9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} "Windows Live Toolbar Helper" - "Microsoft Corporation" - C:\Program Files\Windows Live\Toolbar\wltcore.dll {5C255C8A-E604-49b4-9D64-90988571CECB} "{5C255C8A-E604-49b4-9D64-90988571CECB}" - ? - (File not found | COM-object registry key not found) [Logon] -----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )----- "OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Shortcut exists | File exists) "desktop.ini" - ? - C:\Users\HaukeS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini "My_AutoWarkey_Script.lnk" - ? - C:\Program Files\Warkeys\AutoWarkey\AutoHotkey\AutoHotkey.exe (Shortcut exists | File exists) "Warkeys Update.lnk" - ? - C:\Program Files\Warkeys\AutoWarkey\AutoHotkey\AutoHotkey.exe (Shortcut exists | File exists) -----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )----- "desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini "Digital Line Detect.lnk" - "Avanquest Software " - C:\Program Files\Digital Line Detect\DLG.exe (Shortcut exists | File exists) "HP Digital Imaging Monitor.lnk" - "Hewlett-Packard Co." - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Shortcut exists | File exists) "Bluetooth.lnk" - "Broadcom Corporation." - C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe (Shortcut exists | File exists) "Update Agent.lnk" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Update Agent.lnk (Shortcut exists | File not found) -----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )----- "ISUSPM Startup" - "Macrovision Corporation" - "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup "ISUSScheduler" - "Macrovision Corporation" - "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start "msnmsgr" - "Microsoft Corporation" - "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background "SUPERAntiSpyware" - "SUPERAntiSpyware.com" - C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )----- "AcWin7Hlpr" - ? - C:\Program Files\Lenovo\Access Connections\AcTBenabler.exe (File found, but it contains no detailed information) "Adobe ARM" - "Adobe Systems Incorporated" - "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" "Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" "cssauth" - "Lenovo Group Limited" - "C:\Program Files\Lenovo\Client Security Solution\cssauth.exe" silent "FingerPrintSoftware" - "AuthenTec" - "C:\Program Files\Lenovo Fingerprint Software\fpapp.exe" \s "GrooveMonitor" - "Microsoft Corporation" - "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" "HP Software Update" - "Hewlett-Packard" - C:\Program Files\HP\HP Software Update\HPWuSchd2.exe "hpqSRMon" - "Hewlett-Packard" - C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe "Launch Backup Service Once" - ? - C:\Program Files\Lenovo\Rescue and Recovery\rrstrigger.exe -start (File found, but it contains no detailed information) "LENOVO.TPFNF6R" - "Lenovo Group Limited" - C:\Program Files\Lenovo\HOTKEY\TPFNF6R.exe "LenVolFx" - "Lenovo" - LenVolEx.exe "Message Center Plus" - ? - C:\Program Files\LENOVO\Message Center Plus\MCPLaunch.exe /start "PWMTRV" - "Lenovo Group Limited" - rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWMTR32V.DLL,PwrMgrBkGndMonitor "TPHOTKEY" - "Lenovo Group Limited" - C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe "TpShocks" - "Lenovo." - TpShocks.exe [Print Monitors] -----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )----- "Send To Microsoft OneNote Monitor" - "Microsoft Corporation" - C:\Windows\system32\msonpmon.dll [Services] -----( HKLM\SYSTEM\CurrentControlSet\Services )----- "##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##" (Bonjour Service) - "Apple Computer, Inc." - C:\Program Files\Bonjour\mDNSResponder.exe "AcPrfMgrSvc" (AcPrfMgrSvc) - "Lenovo" - C:\Program Files\Lenovo\Access Connections\AcPrfMgrSvc.exe "AcSvc" (AcSvc) - "Lenovo" - C:\Program Files\Lenovo\Access Connections\AcSvc.exe "AD Monitor" (ADMonitor) - ? - C:\Windows\system32\ADMonitor.exe "Anzeige am Bildschirm" (TPHKSVC) - "Lenovo Group Limited" - C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe "AuthenTec Fingerprint Service" (ATService) - "AuthenTec, Inc." - C:\Windows\system32\AtService.exe "Bluetooth Service" (btwdins) - "Broadcom Corporation." - C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe "Data Transfer Service" (dtsvc) - ? - C:\Windows\system32\DTS.exe "FLEXnet Licensing Service" (FLEXnet Licensing Service) - "Macrovision Europe Ltd." - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe "HP CUE DeviceDiscovery Service" (hpqddsvc) - "Hewlett-Packard Co." - C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll "hpqcxs08" (hpqcxs08) - "Hewlett-Packard Co." - C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll "Intel(R) PROSet/Wireless Event Log" (EvtEng) - "Intel(R) Corporation" - C:\Program Files\Intel\WiFi\bin\EvtEng.exe "Intel(R) PROSet/Wireless Registry Service" (RegSrvc) - "Intel(R) Corporation" - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe "IviRegMgr" (IviRegMgr) - "InterVideo" - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe "Lenovo Microphone Mute" (LENOVO.MICMUTE) - "Lenovo Group Limited" - C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe "Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE "Microsoft Office Groove Audit Service" (Microsoft Office Groove Audit Service) - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe "Net Driver HPZ12" (Net Driver HPZ12) - "Hewlett-Packard" - C:\Windows\system32\HPZinw12.dll "Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE "Pml Driver HPZ12" (Pml Driver HPZ12) - "Hewlett-Packard" - C:\Windows\system32\HPZipm12.dll "Power Manager DBC Service" (Power Manager DBC Service) - "Lenovo" - C:\Program Files\ThinkPad\Utilities\PWMDBSVC.EXE "RoxMediaDB10" (RoxMediaDB10) - "Sonic Solutions" - C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe "SAS Core Service" (!SASCORE) - "SUPERAntiSpyware.com" - C:\Program Files\SUPERAntiSpyware\SASCORE.EXE "SeaPort" (SeaPort) - "Microsoft Corp." - C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe "SQL Server (MSSMLBIZ)" (MSSQL$MSSMLBIZ) - "Microsoft Corporation" - c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe "SQL Server VSS Writer" (SQLWriter) - "Microsoft Corporation" - c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe "SQL Server-Startdienst für Business Contact Manager" (BcmSqlStartupSvc) - "Microsoft Corporation" - C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe "stllssvr" (stllssvr) - "MicroVision Development, Inc." - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe "System Update" (SUService) - "Lenovo Group Limited" - c:\Program Files\Lenovo\System Update\SUService.exe "ThinkPad HDD APS Logging Service" (TPHDEXLGSVC) - "Lenovo." - C:\Windows\System32\TPHDEXLG.exe "ThinkVantage Registry Monitor Service" (ThinkVantage Registry Monitor Service) - "Lenovo Group Limited" - C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe "TVT Backup Service" (TVT Backup Service) - "Lenovo Group Limited" - C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe [Winlogon] -----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )----- "!SASWinLogon" - "SUPERAntiSpyware.com" - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL [Winsock Providers] -----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )----- "mdnsNSP" - "Apple Computer, Inc." - C:\Program Files\Bonjour\mdnsNSP.dll ===[ Logfile end ]=========================================[ Logfile end ]=== If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru aswMBR logfile: aswMBR version 0.9.8.978 Copyright(c) 2011 AVAST Software Run date: 2011-08-18 11:17:41 ----------------------------- 11:17:41.721 OS Version: Windows 6.1.7600 11:17:41.721 Number of processors: 2 586 0x170A 11:17:41.722 ComputerName: HAUKES-THINK UserName: HaukeS 11:17:43.001 Initialize success 11:18:03.859 AVAST engine defs: 11081701 11:18:24.336 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 11:18:24.340 Disk 0 Vendor: WDC_WD25 14.0 Size: 238475MB BusType: 3 11:18:24.370 Disk 0 MBR read successfully 11:18:24.375 Disk 0 MBR scan 11:18:24.401 Disk 0 MBR:Alureon-I [Rtk] 11:18:24.406 Disk 0 TDL4@MBR code has been found 11:18:24.412 Disk 0 MBR hidden 11:18:24.418 Disk 0 MBR [TDL4] **ROOTKIT** 11:18:24.425 Disk 0 trace - called modules: 11:18:24.434 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll >>UNKNOWN [0x86935ed1]<< 11:18:24.442 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86917aa0] 11:18:24.451 3 CLASSPNP.SYS[891c259e] -> nt!IofCallDriver -> [0x85f25700] 11:18:24.458 5 ACPI.sys[836b13b2] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0x85af6028] 11:18:24.470 \Driver\iaStor[0x85eebc08] -> IRP_MJ_INTERNAL_DEVICE_CONTROL -> 0x86935ed1 11:18:25.963 AVAST engine scan C:\Windows 11:18:28.748 AVAST engine scan C:\Windows\system32 11:20:14.947 AVAST engine scan C:\Windows\system32\drivers 11:20:25.565 AVAST engine scan C:\Users\HaukeS 11:22:59.850 AVAST engine scan C:\ProgramData 11:23:51.896 Scan finished successfully 11:28:13.621 Disk 0 MBR has been saved successfully to "C:\Users\HaukeS\Desktop\MBR.dat" 11:28:13.630 The log file has been saved successfully to "C:\Users\HaukeS\Desktop\aswMBR log.txt" Grüße und danke für die gute betreuung! |
|
18.08.2011, 11:50
| #22 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Rootkit BOO/TDss.D Bekomme ich nicht mehr weg HELPZitat:
Wir sollten den MBR fixen, sichere für den Fall der Fälle ALLE wichtigen Daten, auch wenn meistens alles glatt geht. Starte nach der Datensicherung aswmbr erneut und klick auf den Button FIXMBR.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
18.08.2011, 18:48
| #23 |
| | Rootkit BOO/TDss.D Bekomme ich nicht mehr weg HELP So hab ich gemacht, der pc ist dann abrupt runtergefahren und hat neugestarted. War das jetzt der Mbrfix? Grüße |
|
19.08.2011, 15:15
| #24 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Rootkit BOO/TDss.D Bekomme ich nicht mehr weg HELP Mach dann ein neues Log mit aswmbr
__________________ Logfiles bitte immer in CODE-Tags posten |
|
20.08.2011, 10:04
| #25 |
| | Rootkit BOO/TDss.D Bekomme ich nicht mehr weg HELP Hier der Log aswMBR version 0.9.8.978 Copyright(c) 2011 AVAST Software Run date: 2011-08-20 10:24:30 ----------------------------- 10:24:30.527 OS Version: Windows 6.1.7600 10:24:30.527 Number of processors: 2 586 0x170A 10:24:30.529 ComputerName: HAUKES-THINK UserName: HaukeS 10:24:31.877 Initialize success 10:25:06.736 AVAST engine defs: 11081901 10:26:57.596 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 10:26:57.598 Disk 0 Vendor: WDC_WD25 14.0 Size: 238475MB BusType: 3 10:26:57.614 Disk 0 MBR read successfully 10:26:57.616 Disk 0 MBR scan 10:26:57.633 Disk 0 MBR:Alureon-I [Rtk] 10:26:57.636 Disk 0 TDL4@MBR code has been found 10:26:57.639 Disk 0 MBR hidden 10:26:57.643 Disk 0 MBR [TDL4] **ROOTKIT** 10:26:57.646 Disk 0 trace - called modules: 10:26:57.651 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll >>UNKNOWN [0x86935ed1]<< 10:26:57.656 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86917030] 10:26:57.661 3 CLASSPNP.SYS[892ae59e] -> nt!IofCallDriver -> [0x85ef3660] 10:26:57.667 5 ACPI.sys[836923b2] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0x85af2028] 10:26:57.676 \Driver\iaStor[0x85ee9a78] -> IRP_MJ_INTERNAL_DEVICE_CONTROL -> 0x86935ed1 10:26:58.673 AVAST engine scan C:\Windows 10:27:01.252 AVAST engine scan C:\Windows\system32 10:28:40.167 AVAST engine scan C:\Windows\system32\drivers 10:28:50.114 AVAST engine scan C:\Users\HaukeS 10:31:08.113 AVAST engine scan C:\ProgramData 10:32:03.250 Scan finished successfully 11:00:35.379 Disk 0 MBR has been saved successfully to "C:\Users\HaukeS\Desktop\MBR.dat" 11:00:35.388 The log file has been saved successfully to "C:\Users\HaukeS\Desktop\aswMBR.txt" immer noch der Rootkit drin... soll ich nochmal fixen? |
|
21.08.2011, 13:00
| #26 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Rootkit BOO/TDss.D Bekomme ich nicht mehr weg HELP Wir müssen den MBR anders fixen, Daten hast du ja gesichert. Hast Du noch andere Betriebssysteme außer Win7 (32-Bit) installiert? Wenn nicht: Schau mal hier => RescueDisc-Win7-32-Bit Lad das iso runter, brenn es zB mit ImgBurn per Imagebrennfunktion auf eine CD und starte damit den Rechner (von dieser CD booten) Falls Du eine normale Win7-Installations-DVD (32-Bit) hast, brauchst Du das o.g. Image nicht sondern kannst einfach von der dieser DVD booten. Klick auf Computerreparaturoptionen, weiter, Eingabeaufforderung - die Konsole öffnet sich. Da bitte bootrec.exe /fixboot eintippen (mit enter bestätigen), dann bootrec.exe /fixmbr eintippen (mit enter bestätigen) - Rechner neustarten, CD vorher rausnehmen. Führe im normalen Windowsmodus MBRcheck bzw. aswmbr (je nachdem welches Tool ich dir vorhin aufgab) und wenn es geht GMER nochmals aus und poste die neuen Logs.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
26.08.2011, 11:45
| #27 |
| | Rootkit BOO/TDss.D Bekomme ich nicht mehr weg HELP Hi arne! Hier die logs nach dem genannten vorgang: aswmbr: aswMBR version 0.9.8.978 Copyright(c) 2011 AVAST Software Run date: 2011-08-26 12:17:28 ----------------------------- 12:17:28.690 OS Version: Windows 6.1.7600 12:17:28.690 Number of processors: 2 586 0x170A 12:17:28.690 ComputerName: HAUKES-THINK UserName: HaukeS 12:17:29.719 Initialize success 12:17:32.668 AVAST engine defs: 11082600 12:17:38.689 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 12:17:38.689 Disk 0 Vendor: WDC_WD25 14.0 Size: 238475MB BusType: 3 12:17:38.736 Disk 0 MBR read successfully 12:17:38.752 Disk 0 MBR scan 12:17:38.752 Disk 0 Windows 7 default MBR code 12:17:38.767 Disk 0 scanning sectors +488394752 12:17:38.861 Disk 0 scanning C:\Windows\system32\drivers 12:17:48.268 Service scanning 12:17:50.046 Modules scanning 12:17:58.361 Disk 0 trace - called modules: 12:17:58.376 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll iaStor.sys 12:17:58.376 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8651b030] 12:17:58.392 3 CLASSPNP.SYS[891d359e] -> nt!IofCallDriver -> [0x85af1958] 12:17:58.891 5 ACPI.sys[88a3e3b2] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0x856ec028] 12:18:00.264 AVAST engine scan C:\Windows 12:18:03.306 AVAST engine scan C:\Windows\system32 12:19:52.899 AVAST engine scan C:\Windows\system32\drivers 12:20:03.260 AVAST engine scan C:\Users\HaukeS 12:22:48.126 File: C:\Users\HaukeS\AppData\Local\Temp\jar_cache7161096472331229318.tmp **INFECTED** Win32:Banker-IID [Trj] 12:23:01.075 File: C:\Users\HaukeS\AppData\Roaming\appconf32.exe **INFECTED** Win32:Banker-IJD [Drp] 12:24:22.139 AVAST engine scan C:\ProgramData 12:25:18.730 Scan finished successfully 12:25:43.889 Disk 0 MBR has been saved successfully to "C:\Users\HaukeS\Desktop\MBR.dat" 12:25:43.896 The log file has been saved successfully to "C:\Users\HaukeS\Desktop\logaswmbr.txt" und gmer: GMER Logfile: Code:
ATTFilter GMER 1.0.15.15641 - GMER - Rootkit Detector and Remover
Rootkit scan 2011-08-26 12:42:14
Windows 6.1.7600 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD25 rev.14.0
Running: m2pto3ov.exe; Driver: C:\Users\HaukeS\AppData\Local\Temp\kwrorpob.sys
---- Kernel code sections - GMER 1.0.15 ----
.text ntkrnlpa.exe!ZwSaveKeyEx + 13AD 82E5A579 1 Byte [06]
.text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 82E7EF52 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
? C:\Users\HaukeS\AppData\Local\Temp\aswMBR.sys Das System kann die angegebene Datei nicht finden. !
---- User code sections - GMER 1.0.15 ----
.text C:\Program Files\Mozilla Firefox\firefox.exe[1856] ntdll.dll!LdrLoadDll 773AF585 5 Bytes JMP 00DD1410 C:\Program Files\Mozilla Firefox\firefox.exe (Firefox/Mozilla Corporation)
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[5184] USER32.dll!SetWindowLongA 766DB1E3 5 Bytes JMP 61D4A2FB C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[5184] USER32.dll!SetWindowLongW 766E6614 5 Bytes JMP 61D4A28D C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[5184] USER32.dll!GetWindowInfo 766E6A82 5 Bytes JMP 61B51BD2 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[5184] USER32.dll!TrackPopupMenu 76704B3B 5 Bytes JMP 61B5219D C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
---- User IAT/EAT - GMER 1.0.15 ----
IAT C:\Program Files\Windows Live\Messenger\msnmsgr.exe[2076] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] [753F5D3D] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\Program Files\Windows Live\Messenger\msnmsgr.exe[2076] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [753F5D3D] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\Program Files\Windows Live\Messenger\msnmsgr.exe[2076] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [753F5D3D] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\Program Files\Windows Live\Messenger\msnmsgr.exe[2076] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [753F5D3D] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\Program Files\Windows Live\Messenger\msnmsgr.exe[2076] @ C:\Windows\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress] [753F5D3D] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\Program Files\Windows Live\Messenger\msnmsgr.exe[2076] @ C:\Windows\system32\WININET.dll [KERNEL32.dll!GetProcAddress] [753F5D3D] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\Program Files\Windows Live\Messenger\msnmsgr.exe[2076] @ C:\Windows\system32\Secur32.dll [KERNEL32.dll!GetProcAddress] [753F5D3D] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3528] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree] [7352250F] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3528] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc] [73522494] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3528] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup] [73505624] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3528] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown] [735056E2] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3528] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics] [73518573] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3528] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage] [73514D27] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3528] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth] [735150CE] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3528] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight] [735151A3] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3528] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromHBITMAP] [735166D0] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3528] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC] [735182CA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3528] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode] [73518819] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3528] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode] [7351907A] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3528] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI] [7351E21D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3528] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage] [73514C59] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\System32\rundll32.exe[3932] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [753F5D3D] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\Windows\System32\rundll32.exe[3932] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [753F5D3D] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\Windows\System32\rundll32.exe[3932] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [753F5D3D] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\Windows\System32\rundll32.exe[3932] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] [753F5D3D] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\Program Files\Lenovo\Message Center Plus\MCPLaunch.exe[3996] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [753F5D3D] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\Program Files\Lenovo\Message Center Plus\MCPLaunch.exe[3996] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [753F5D3D] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\Program Files\Lenovo\Message Center Plus\MCPLaunch.exe[3996] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] [753F5D3D] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\Program Files\Lenovo\Message Center Plus\MCPLaunch.exe[3996] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [753F5D3D] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT c:\Program Files\Lenovo\System Update\SUService.exe[4912] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [753F5D3D] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT c:\Program Files\Lenovo\System Update\SUService.exe[4912] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [753F5D3D] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT c:\Program Files\Lenovo\System Update\SUService.exe[4912] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [753F5D3D] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT c:\Program Files\Lenovo\System Update\SUService.exe[4912] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] [753F5D3D] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT c:\Program Files\Lenovo\System Update\SUService.exe[4912] @ C:\Windows\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress] [753F5D3D] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
---- Devices - GMER 1.0.15 ----
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys (Kernelmodustreiber-Frameworklaufzeit/Microsoft Corporation)
AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys (Kernelmodustreiber-Frameworklaufzeit/Microsoft Corporation)
Device \Driver\ACPI_HAL \Device\00000052 halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume3 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
---- Registry - GMER 1.0.15 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\001f3ad3f68b
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0c607688b5f7
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\001f3ad3f68b (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0c607688b5f7 (not active ControlSet)
---- Files - GMER 1.0.15 ----
File C:\Users\HaukeS\AppData\Local\Temp\flaEED6.tmp 22754707 bytes
---- EOF - GMER 1.0.15 ----
Ich bekomme zur Zeit oft einen bluescreen mit der Meldung: Page_fault_on_nonpage_area Grüße Hauke |
|
26.08.2011, 12:42
| #28 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Rootkit BOO/TDss.D Bekomme ich nicht mehr weg HELP Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SUPERAntiSpyware und poste die Logs. Denk dran beide Tools zu updaten vor dem Scan!! Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt: ESET Online Scanner
__________________ Logfiles bitte immer in CODE-Tags posten |
|
02.09.2011, 06:55
| #29 |
| | Rootkit BOO/TDss.D Bekomme ich nicht mehr weg HELP Hi arne! Hier die logs Mbam: Malwarebytes' Anti-Malware 1.51.1.1800 www.malwarebytes.org Datenbank Version: 7631 Windows 6.1.7600 Internet Explorer 8.0.7600.16385 01.09.2011 21:01:38 mbam-log-2011-09-01 (21-01-33).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|Q:\|) Durchsuchte Objekte: 299941 Laufzeit: 38 Minute(n), 40 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 2 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: c:\Users\HaukeS\AppData\Local\Temp\jar_cache7161096472331229318.tmp (Malware.Gen) -> No action taken. c:\Users\HaukeS\AppData\Roaming\appconf32.exe (Malware.Gen) -> No action taken. eset: ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6528 # api_version=3.0.2 # EOSSerial=0473d60f8ff74b42a9ea304314a0ab92 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2011-08-12 02:26:10 # local_time=2011-08-12 04:26:10 (+0100, Mitteleuropäische Sommerzeit) # country="Germany" # lang=1033 # osver=6.1.7600 NT # compatibility_mode=1797 16774142 0 1 246162 246162 0 0 # compatibility_mode=5893 16776574 100 94 50262124 64786156 0 0 # compatibility_mode=8192 67108863 100 0 301 301 0 0 # scanned=133042 # found=1 # cleaned=0 # scan_time=4206 C:\Users\HaukeS\AppData\Local\Temp\P1kAlMiG2Kb7Fz.exe a variant of Win32/Kryptik.RJL trojan (unable to clean) 00000000000000000000000000000000 I ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6528 # api_version=3.0.2 # EOSSerial=0473d60f8ff74b42a9ea304314a0ab92 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2011-09-01 08:33:41 # local_time=2011-09-01 10:33:41 (+0100, Mitteleuropäische Sommerzeit) # country="Germany" # lang=1033 # osver=6.1.7600 NT # compatibility_mode=1797 16774142 0 1 1995850 1995850 0 0 # compatibility_mode=5893 16776574 100 94 52011812 66535844 0 0 # compatibility_mode=8192 67108863 100 0 1749989 1749989 0 0 # scanned=132489 # found=2 # cleaned=0 # scan_time=4569 C:\Users\HaukeS\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TRDSR2WS\c3[1].htm HTML/Iframe.B.Gen virus (unable to clean) 00000000000000000000000000000000 I C:\Users\HaukeS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\46\151adf2e-332d23c1 a variant of Java/Agent.DH trojan (unable to clean) 00000000000000000000000000000000 I Der superanti log ist im anhang. Grüße Hauke |
|
02.09.2011, 09:54
| #30 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Rootkit BOO/TDss.D Bekomme ich nicht mehr weg HELPZitat:
__________________ Logfiles bitte immer in CODE-Tags posten |
|
| Themen zu Rootkit BOO/TDss.D Bekomme ich nicht mehr weg HELP |
| 5 minuten, antivir, bho, bonjour, boo/tdss.d, c:\windows\system32\rundll32.exe, converter, disabletaskmgr, excel.exe, firefox, help, kaspersky, keine dateien, langsam, lenovo, logfile, malware, malware gefunden, mozilla, mp3, plug-in, problem, programm, registry, rootkit, scan, security, sehr langsam, software, start menu, starten, system, taskmanager, temporär, trojaner, trojaner board, version=1.0, webcheck, windows |
Linear-Darstellung
