| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Trojaner win32/sirefef.OWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
27.10.2011, 11:00
| #12 |
| |  Trojaner win32/sirefef.OInhalt des LogFiles: All processes killed Error: Unable to interpret <:OTL PRC - File not found -- C:\Windows\1497257308:2745876902.exe PRC - [2011.10.27 07:31:46 | 000,283,648 | ---- | M] () -- C:\Programme\LP\936B\0A0.exe PRC - [2011.10.27 07:31:39 | 000,190,464 | ---- | M] () -- C:\Programme\CCC28\lvvm.exe PRC - [2011.10.27 07:31:18 | 000,173,056 | ---- | M] () -- C:\Users\Garbert\AppData\Roaming\B4CCC\F1193.exe MOD - [2011.10.27 07:31:46 | 000,283,648 | ---- | M] () -- C:\Programme\LP\936B\0A0.exe MOD - [2011.10.27 07:31:39 | 000,190,464 | ---- | M] () -- C:\Programme\CCC28\lvvm.exe MOD - [2011.10.27 07:31:18 | 000,173,056 | ---- | M] () -- C:\Users\Garbert\AppData\Roaming\B4CCC\F1193.exe IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = iGoogle IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = GMX - E-Mail, FreeMail, De-Mail, Themen- & Shopping-Portal - kostenlos IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = GMX Suche - einfach besser finden! [binary data] IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Se> in the current context! Error: Unable to interpret <archDefaultBranded = 1 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = 1&1 - Telefon-Internet-Flatrates und mobiles Internet [binary data] IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Google IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local> IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:54545 O2 - BHO: (no name) - {0124123D-61B4-456f-AF86-78C53A0790C5} - No CLSID value found. O2 - BHO: (1&&1 Internet AG Browser Configuration by mquadr.at) - {D48FF4B4-E68F-47D1-8E25-81A0F0EEB341} - C:\Windows\System32\ieconfig_1und1.dll (mquadr.at softwareengineering und consulting gmbh) O3 - HKLM\..\Toolbar: (no name) - {0124123D-61B4-456f-AF86-78C53A0790C5} - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4> in the current context! Error: Unable to interpret <965-11D4-9B18-009027A5CD4F} - No CLSID value found. O4 - HKLM..\Run: [0A0.exe] C:\Programme\LP\936B\0A0.exe () O4 - HKLM..\Run: [F6sWK7fRLgXjCkB] C:\Users\Garbert\AppData\Roaming\svhostu.exe () O4 - HKLM..\Run: [gG5sQJ6dE8R9YwU8234A] C:\Windows\System32\dekIVrzONxuSoFp.exe () O4 - HKCU..\Run: [vasja] C:\Users\Garbert\Desktop\0.9056710880911472.exe (Home) O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - %SystemRoot%\system32\pnrpnsp.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - %SystemRoot%\system32\pnrpnsp.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - %SystemRoot%\system32\pnrpnsp.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - %SystemRoot%\system32\pnrpnsp.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - %SystemRoo> in the current context! Error: Unable to interpret <t%\system32\pnrpnsp.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - %SystemRoot%\system32\pnrpnsp.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - %SystemRoot%\system32\pnrpnsp.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - %SystemRoot%\system32\pnrpnsp.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - %SystemRoot%\system32\pnrpnsp.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - %SystemRoot%\system32\pnrpnsp.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - %SystemRoot%\system32\pnrpnsp.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - %SystemRoot%\system32\pnrpnsp.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - %SystemRoot%\system32\pnrpnsp.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - %SystemRoot%\system32\pnrpnsp.dll File not found O20 - HKCU Winlogon: Shell - (C:\Users\Garbert\Ap> in the current context! Error: Unable to interpret <pData\Roaming\B4CCC\F1193.exe) -C:\Users\Garbert\AppData\Roaming\B4CCC\F1193.exe () O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O32 - AutoRun File - [2007.04.26 14:02:32 | 000,191,826 | R--- | M] () - E:\autorun.inf -- [ CDFS ] O32 - AutoRun File - [2011.06.20 07:52:08 | 000,000,061 | RHS- | M] () - G:\autorun.inf -- [ FAT32 ] O33 - MountPoints2\{77929b51-ffdf-11e0-b22d-806e6f6e6963}\Shell\AutoRun\command - "" = 1j038ki.exe O33 - MountPoints2\{77929b51-ffdf-11e0-b22d-806e6f6e6963}\Shell\open\Command - "" = 1j038ki.exe O33 - MountPoints2\{a9b99377-2c7b-11dd-bad4-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{a9b99377-2c7b-11dd-bad4-806e6f6e6963}\Shell\AutoRun\command - "" = E:\Setup.exe -- [2005.04.27 20:38:10 | 000,401,408 | R--- | M] (Hewlett-Packard) [2011.10.27 07:37:02 | 000,000,000 | ---D | C] -- C:\Users\Garbert\AppData\Roaming\vdEK8gRZ9YwUeOt [2011.10.27 07:37:02 | 000,000,000 | ---D | C] -- C:\Users\Garbert\> in the current context! Error: Unable to interpret <AppData\Roaming\qNGarbertA0uvSoFpGsJ [2011.10.27 07:31:20 | 000,000,000 | ---D | C] -- C:\Program Files\CCC28 [2011.10.27 07:31:11 | 000,000,000 | ---D | C] -- C:\Users\Garbert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Security 2011 [2011.10.27 07:31:10 | 000,000,000 | ---D | C] -- C:\Users\Garbert\AppData\Roaming\pL8gTZqhYwIr [2011.10.27 07:31:10 | 000,000,000 | ---D | C] -- C:\Users\Garbert\AppData\Roaming\DcA1uvD2oFpHJd [2011.10.27 07:31:05 | 000,000,000 | ---D | C] -- C:\Users\Garbert\AppData\Roaming\kOBtxP0yc1b3n4Q [2011.10.27 07:31:04 | 000,000,000 | ---D | C] -- C:\Users\Garbert\AppData\Roaming\a3onF4amHsJfLgZ [2011.10.27 07:30:59 | 000,000,000 | ---D | C] -- C:\Users\Garbert\AppData\Roaming\B4CCC [2011.10.27 07:30:56 | 000,000,000 | ---D | C] -- C:\Program Files\LP [2011.10.27 07:30:55 | 000,000,000 | ---D | C] -- C:\Users\Garbert\AppData\Roaming\Oline [2011.10.27 07:30:55 | 000,000,000 | ---D | C] -- C:\Users\Garbert\AppData\Roaming\Acesu [2011.10.27 07:30:53 | 000,165,376 | ---- | > in the current context! Error: Unable to interpret <C] (Alcatel Microelectronics) -- C:\Users\Garbert\AppData\Roaming\lt6ow0jc.exe [2011.10.27 07:30:51 | 000,168,960 | ---- | C] (Home) -- C:\Users\Garbert\Desktop\0.9056710880911472.exe [2011.10.27 07:30:51 | 000,165,376 | ---- | C] (Alcatel Microelectronics) -- C:\Users\Garbert\Desktop\0.64406117213402.exe [2011.10.20 18:33:13 | 000,000,000 | ---D | C] -- C:\Users\Garbert\AppData\Roaming\Haleok [2011.10.20 18:33:13 | 000,000,000 | ---D | C] -- C:\Users\Garbert\AppData\Roaming\Axso [2011.10.18 21:49:59 | 000,000,000 | -HSD | C] -- C:\Windows\System32\%APPDATA% [2011.10.27 08:08:50 | 000,000,000 | ---- | M] () -- C:\Windows\1497257308 [2011.10.27 07:31:12 | 000,001,213 | ---- | M] () -- C:\Users\Garbert\AppData\Roaming\ldr.ini [2011.10.27 07:31:05 | 000,099,840 | ---- | M] () -- C:\Users\Garbert\AppData\Roaming\svhostu.exe [2011.10.27 07:31:04 | 001,776,640 | ---- | M] () -- C:\Windows\System32\dekIVrzONxuSoFp.exe [2011.10.27 07:31:00 | 000,283,648 | ---- | M] () -- C:\Users\Garbert\Desktop\0.6136625930725045.ex> in the current context! Error: Unable to interpret <e [2011.10.27 07:30:55 | 000,168,960 | ---- | M] (Home) -- C:\Users\Garbert\Desktop\0.9056710880911472.exe [2011.10.27 07:30:53 | 000,000,008 | ---- | M] () -- C:\Users\Garbert\AppData\Roaming\cbawfxrmd876sqdc.dat [2011.10.27 07:30:52 | 000,165,376 | ---- | M] (Alcatel Microelectronics) -- C:\Users\Garbert\AppData\Roaming\lt6ow0jc.exe [2011.10.27 07:30:52 | 000,165,376 | ---- | M] (Alcatel Microelectronics) -- C:\Users\Garbert\Desktop\0.64406117213402.exe [2011.10.27 07:31:04 | 000,000,000 | ---D | M] -- C:\Users\Garbert\AppData\Roaming\a3onF4amHsJfLgZ [2011.10.27 07:30:55 | 000,000,000 | ---D | M] -- C:\Users\Garbert\AppData\Roaming\Acesu [2008.05.28 09:30:29 | 000,000,000 | ---D | M] -- C:\Users\Garbert\AppData\Roaming\AOMobil [2011.10.24 21:34:09 | 000,000,000 | ---D | M] -- C:\Users\Garbert\AppData\Roaming\Axso [2011.10.27 07:31:18 | 000,000,000 | ---D | M] -- C:\Users\Garbert\AppData\Roaming\B4CCC [2011.10.27 07:31:10 | 000,000,000 | ---D | M] -- C:\Users\Garbert\AppData\Roaming\DcA1uvD2oFpHJd [2011.10.2> in the current context! Error: Unable to interpret <0 18:33:13 | 000,000,000 | ---D | M] -- C:\Users\Garbert\AppData\Roaming\Haleok [2011.10.27 07:31:05 | 000,000,000 | ---D | M] -- C:\Users\Garbert\AppData\Roaming\kOBtxP0yc1b3n4Q [2011.10.27 07:30:55 | 000,000,000 | ---D | M] -- C:\Users\Garbert\AppData\Roaming\Oline [2009.03.06 14:53:02 | 000,000,000 | ---D | M] -- C:\Users\Garbert\AppData\Roaming\OpenOffice.org [2011.10.27 07:31:11 | 000,000,000 | ---D | M] -- C:\Users\Garbert\AppData\Roaming\pL8gTZqhYwIr [2011.10.27 07:37:02 | 000,000,000 | ---D | M] -- C:\Users\Garbert\AppData\Roaming\qNGarbertA0uvSoFpGsJ [2011.10.27 07:37:02 | 000,000,000 | ---D | M] -- C:\Users\Garbert\AppData\Roaming\vdEK8gRZ9YwUeOt @Alternate Data Stream - 816 bytes -> C:\Windows\1497257308:2745876902.exe :Commands [emptytemp] [resethosts] > in the current context! OTL by OldTimer - Version 3.2.31.0 log created on 10272011_115427 Files\Folders moved on Reboot... Registry entries deleted on Reboot... |
| Themen zu Trojaner win32/sirefef.O |
| dringend, funktionieren, scan, scanner, tools, troja, trojaner, trojaner win32/sirefef.o, unterstützung, virenscan, virenscanner, win |
Baum-Darstellung