| |
| |||||||
Log-Analyse und Auswertung: Fund Echtzeitscanner Antivir - 'TR/Damaged.Gen8' [trojan]Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
27.02.2012, 14:35
| #1 |
| | ![Fund Echtzeitscanner Antivir - 'TR/Damaged.Gen8' [trojan] - Standard](images/icons/icon1.gif){kind=icon} Fund Echtzeitscanner Antivir - 'TR/Damaged.Gen8' [trojan] Guten Tag, habe gestern einen neuen Laptop für meine Ma eingerichtet (Windows, Programme usw. installiert). Jedenfalls fand der Echtzeitscanner von Antivir 4 infizierte Dateien. Das eigentliche Problem ist, dass ich dies nicht gleich mitbekommen habe bzw. der Fund nicht angezeigt wurde. Hatte die Funde daher erst 3-4 Stunden später und eher zufällig in der Ereignisliste gefunden. Hier die Einträge von Antivir: 26.02.2012 - 20:40:38 In der Datei 'C:\Windows\winsxs\Temp\PendingRenames\53744184bef4cc01090c000040015004.x86_microsoft-windows-f..rcluster-clientcore_31bf3856ad364e35_6.1.7601.17514_none_934ef25796a1b53e_clusapi.dll_06332635' wurde ein Virus oder unerwünschtes Programm 'TR/Damaged.Gen8' [trojan] gefunden. Ausgeführte Aktion: Übergeben an Scanner 26.02.2012 - 20:37:52 In der Datei 'C:\Windows\winsxs\Temp\PendingRenames\7986e920bef4cc01a409000040015004.wow64_microsoft-windows-wmi-core-svc_31bf3856ad364e35_6.1.7601.17514_none_092d6b9141f16aca_wmiaprpl.dll_5d18a476' wurde ein Virus oder unerwünschtes Programm 'TR/Damaged.Gen8' [trojan] gefunden. Ausgeführte Aktion: Übergeben an Scanner 26.02.2012 - 20:37:40 In der Datei 'C:\Windows\winsxs\Temp\PendingRenames\e597ad19bef4cc013309000040015004.wow64_microsoft-windows-gdi_31bf3856ad364e35_6.1.7601.17563_none_1216b853a5b01be6_fontsub.dll_367a1189' wurde ein Virus oder unerwünschtes Programm 'TR/Damaged.Gen8' [trojan] gefunden. Ausgeführte Aktion: Übergeben an Scanner 26.02.2012 - 20:37:20 In der Datei 'C:\Windows\winsxs\Temp\PendingRenames\6892bf0dbef4cc019d08000040015004.x86_microsoft-windows-dhcp-client-dll_31bf3856ad364e35_6.1.7601.17514_none_d961938b8cd1e885_dhcpcore.dll_8036fe08' wurde ein Virus oder unerwünschtes Programm 'TR/Damaged.Gen8' [trojan] gefunden. Ausgeführte Aktion: Übergeben an Scanner Bin mir auch nicht mehr sicher, ob der fund durch einen Download oder durch den Anschluss einer externen Festplatte stattfand. Hatte nochmal mit Antivir gescannt, aber nichts gefunden...wollte daher durch die Hilfe im Board auf Nummer sicher gehen. Danke im vorraus. Hier die Logs: DDS.txt . DDS (Ver_2011-08-26.01) - NTFSAMD64 Internet Explorer: 9.0.8112.16421 Run by Barbara at 13:38:31 on 2012-02-27 Microsoft Windows 7 Professional N 6.1.7601.1.1252.49.1031.18.3691.2836 [GMT 1:00] . AV: Avira Desktop *Enabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C} SP: Avira Desktop *Enabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . ============== Running Processes =============== . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe C:\Windows\system32\conhost.exe C:\Windows\system32\svchost.exe -k RPCSS C:\Windows\system32\atiesrxx.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\atieclxx.exe C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\system32\WLANExt.exe C:\Windows\system32\conhost.exe C:\Windows\System32\spoolsv.exe C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe C:\Program Files (x86)\Bluetooth Suite\adminservice.exe C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe C:\Program Files (x86)\Secunia\PSI\PSIA.exe C:\Program Files (x86)\Secunia\PSI\sua.exe C:\Program Files (x86)\Skype\Updater\Updater.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\system32\taskhost.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe C:\Program Files\Synaptics\SynTP\SynTPHelper.exe C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\SearchFilterHost.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Windows\system32\DllHost.exe C:\Windows\system32\DllHost.exe C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\conhost.exe C:\Windows\SysWOW64\cscript.exe C:\Windows\system32\wbem\wmiprvse.exe . ============== Pseudo HJT Report =============== . mWinlogon: Userinit=userinit.exe BHO: CIESpeechBHO Class: {8d10f6c4-0e01-4bd4-8601-11ac1fdf8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll mRun: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\SECUNI~1.LNK - C:\Program Files (x86)\Secunia\PSI\psi_tray.exe mPolicies-explorer: NoActiveDesktop = 1 (0x1) mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1) mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5) mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) mPolicies-system: DisableCAD = 1 (0x1) mPolicies-system: UseOEMBackground = 0 (0x0) mPolicies-system: DisplayLastLogonInfo = 0 (0x0) IE: {7815BE26-237D-41A8-A98F-F7BD75F71086} - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll TCP: DhcpNameServer = 192.168.2.1 TCP: Interfaces\{0BB6FA7E-E5CF-425C-AC8D-A83242E5A38D} : DhcpNameServer = 192.168.2.1 Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} mRun-x64: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min . ================= FIREFOX =================== . FF - ProfilePath - C:\Users\Barbara\AppData\Roaming\Mozilla\Firefox\Profiles\jarg581u.default\ FF - prefs.js: browser.startup.homepage - google.de FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll . ---- FIREFOX POLICIES ---- FF - user.js: extensions.softonic_i.newTab - false FF - user.js: extensions.softonic_i.tlbrSrchUrl - hxxp://search.softonic.com/MON00015/tb_v1?SearchSource=1&cc=&q= FF - user.js: extensions.softonic_i.id - 588fd8db000000000000d0df9a1a046b FF - user.js: extensions.softonic_i.instlDay - 15397 FF - user.js: extensions.softonic_i.vrsn - 1.5.11.5 FF - user.js: extensions.softonic_i.vrsni - 1.5.11.5 FF - user.js: extensions.softonic_i.vrsnTs - 1.5.11.51:58:31 FF - user.js: extensions.softonic_i.prtnrId - softonic FF - user.js: extensions.softonic_i.prdct - softonic FF - user.js: extensions.softonic_i.aflt - SD FF - user.js: extensions.softonic_i.smplGrp - eng7 FF - user.js: extensions.softonic_i.tlbrId - de12JANdefault FF - user.js: extensions.softonic_i.instlRef - MON00015 FF - user.js: extensions.softonic_i.dfltLng - de FF - user.js: extensions.softonic_i.excTlbr - false . ============= SERVICES / DRIVERS =============== . R0 amd_sata;amd_sata;C:\Windows\system32\DRIVERS\amd_sata.sys --> C:\Windows\system32\DRIVERS\amd_sata.sys [?] R0 amd_xata;amd_xata;C:\Windows\system32\DRIVERS\amd_xata.sys --> C:\Windows\system32\DRIVERS\amd_xata.sys [?] R1 avkmgr;avkmgr;C:\Windows\system32\DRIVERS\avkmgr.sys --> C:\Windows\system32\DRIVERS\avkmgr.sys [?] R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?] R2 AERTFilters;Andrea RT Filters Service;C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe [2012-2-26 98208] R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\system32\atiesrxx.exe --> C:\Windows\system32\atiesrxx.exe [?] R2 AMD FUEL Service;AMD FUEL Service;C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2011-7-5 365568] R2 AntiVirSchedulerService;Avira Planer;C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [2012-2-26 86224] R2 AntiVirService;Avira Echtzeit Scanner;C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [2012-2-26 110032] R2 Atheros Bt&Wlan Coex Agent;Atheros Bt&Wlan Coex Agent;C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [2011-3-1 138400] R2 AtherosSvc;AtherosSvc;C:\Program Files (x86)\Bluetooth Suite\AdminService.exe [2011-3-1 76448] R2 avgntflt;avgntflt;C:\Windows\system32\DRIVERS\avgntflt.sys --> C:\Windows\system32\DRIVERS\avgntflt.sys [?] R2 HPWMISVC;HPWMISVC;C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2012-2-15 34872] R2 IconMan_R;IconMan_R;C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [2012-2-27 1817088] R2 Secunia PSI Agent;Secunia PSI Agent;C:\Program Files (x86)\Secunia\PSI\psia.exe [2011-7-29 994360] R2 Secunia Update Agent;Secunia Update Agent;C:\Program Files (x86)\Secunia\PSI\sua.exe [2011-7-29 399416] R2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-1-31 158856] R3 amdiox64;AMD IO Driver;C:\Windows\system32\DRIVERS\amdiox64.sys --> C:\Windows\system32\DRIVERS\amdiox64.sys [?] R3 amdkmdag;amdkmdag;C:\Windows\system32\DRIVERS\atikmdag.sys --> C:\Windows\system32\DRIVERS\atikmdag.sys [?] R3 amdkmdap;amdkmdap;C:\Windows\system32\DRIVERS\atikmpag.sys --> C:\Windows\system32\DRIVERS\atikmpag.sys [?] R3 AtiHDAudioService;ATI Function Driver for HD Audio Service;C:\Windows\system32\drivers\AtihdW76.sys --> C:\Windows\system32\drivers\AtihdW76.sys [?] R3 BTATH_BUS;Atheros Bluetooth Bus;C:\Windows\system32\DRIVERS\btath_bus.sys --> C:\Windows\system32\DRIVERS\btath_bus.sys [?] R3 RSPCIESTOR;Realtek PCIE CardReader Driver;C:\Windows\system32\DRIVERS\RtsPStor.sys --> C:\Windows\system32\DRIVERS\RtsPStor.sys [?] R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?] R3 usbfilter;AMD USB Filter Driver;C:\Windows\system32\DRIVERS\usbfilter.sys --> C:\Windows\system32\DRIVERS\usbfilter.sys [?] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576] S3 AthBTPort;Atheros Virtual Bluetooth Class;C:\Windows\system32\DRIVERS\btath_flt.sys --> C:\Windows\system32\DRIVERS\btath_flt.sys [?] S3 BTATH_A2DP;Bluetooth A2DP Audio Driver;C:\Windows\system32\drivers\btath_a2dp.sys --> C:\Windows\system32\drivers\btath_a2dp.sys [?] S3 BTATH_HCRP;Bluetooth HCRP Server driver;C:\Windows\system32\DRIVERS\btath_hcrp.sys --> C:\Windows\system32\DRIVERS\btath_hcrp.sys [?] S3 BTATH_LWFLT;Bluetooth LWFLT Device;C:\Windows\system32\DRIVERS\btath_lwflt.sys --> C:\Windows\system32\DRIVERS\btath_lwflt.sys [?] S3 BTATH_RCP;Bluetooth AVRCP Device;C:\Windows\system32\DRIVERS\btath_rcp.sys --> C:\Windows\system32\DRIVERS\btath_rcp.sys [?] S3 BtFilter;BtFilter;C:\Windows\system32\DRIVERS\btfilter.sys --> C:\Windows\system32\DRIVERS\btfilter.sys [?] S3 PSI;PSI;C:\Windows\system32\DRIVERS\psi_mf.sys --> C:\Windows\system32\DRIVERS\psi_mf.sys [?] S3 StorSvc;Speicherdienst;C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-14 20992] S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?] . =============== Created Last 30 ================ . 2012-02-27 02:13:30 -------- d-----w- C:\Users\Barbara\AppData\Local\WindowsUpdate 2012-02-27 01:40:39 -------- d-----w- C:\Users\Barbara\AppData\Roaming\Malwarebytes 2012-02-27 01:40:32 -------- d-----w- C:\ProgramData\Malwarebytes 2012-02-27 01:40:30 23152 ----a-w- C:\Windows\System32\drivers\mbam.sys 2012-02-27 01:40:29 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware 2012-02-27 01:28:26 1792000 ----a-w- C:\Windows\SysWow64\authui.dll.backup 2012-02-27 01:28:24 1927680 ----a-w- C:\Windows\System32\authui.dll.backup 2012-02-27 00:58:28 -------- d-----w- C:\Users\Barbara\AppData\Local\Windows 7 Account Screen Editor 2012-02-27 00:52:34 -------- d-----w- C:\Users\Barbara\AppData\Roaming\OpenOffice.org 2012-02-27 00:48:13 -------- d-----w- C:\Users\Barbara\AppData\Local\Secunia PSI 2012-02-27 00:40:25 -------- d-----w- C:\Windows\SysWow64\sda 2012-02-27 00:39:51 9888360 ----a-w- C:\Windows\SysWow64\RtsPStorIcon.dll 2012-02-27 00:39:51 335464 ----a-w- C:\Windows\System32\drivers\RtsPStor.sys 2012-02-26 23:17:26 -------- d-----w- C:\Program Files (x86)\Audacity 2012-02-26 23:15:19 -------- d-----w- C:\Program Files\CCleaner 2012-02-26 23:10:39 -------- d-----w- C:\Users\Barbara\AppData\Roaming\Canneverbe Limited 2012-02-26 23:10:39 -------- d-----w- C:\ProgramData\Canneverbe Limited 2012-02-26 23:05:50 564792 ----a-w- C:\Windows\System32\drivers\sptd.sys 2012-02-26 23:05:18 -------- d-----w- C:\Program Files (x86)\DAEMON Tools Lite 2012-02-26 23:04:48 -------- d-----w- C:\Users\Barbara\AppData\Roaming\DAEMON Tools Lite 2012-02-26 23:04:44 -------- d-----w- C:\ProgramData\DAEMON Tools Lite 2012-02-26 22:36:31 -------- d-----w- C:\Program Files (x86)\GIMP-2.0 2012-02-26 22:34:47 750488 ----a-w- C:\Windows\System32\npdeployJava1.dll 2012-02-26 22:34:47 660368 ----a-w- C:\Windows\System32\deployJava1.dll 2012-02-26 22:32:20 -------- d-----w- C:\Program Files (x86)\Secunia 2012-02-26 22:30:29 -------- d-----r- C:\Program Files (x86)\Skype 2012-02-26 22:29:01 51496 ----a-w- C:\Windows\System32\drivers\stflt.sys 2012-02-26 22:28:16 -------- d-----w- C:\Program Files (x86)\Spyware Terminator 2012-02-26 22:23:43 -------- d-----w- C:\Program Files\VideoLAN 2012-02-26 22:14:42 -------- d-----w- C:\Program Files (x86)\Common Files\Atheros 2012-02-26 22:14:31 -------- d-----w- C:\Program Files (x86)\Bluetooth Suite 2012-02-26 21:58:58 -------- d-----w- C:\Users\Barbara\AppData\Local\Hewlett-Packard 2012-02-26 21:52:14 -------- d-----w- C:\Users\Barbara\AppData\Roaming\hpqLog 2012-02-26 21:51:21 -------- d-----w- C:\ProgramData\{A8DA1505-E615-42BB-BB77-74D5CC91FE7E} 2012-02-26 21:49:25 -------- d-----w- C:\Users\Barbara\AppData\Local\AMD 2012-02-26 21:48:53 -------- d-----w- C:\Users\Barbara\AppData\Local\ATI 2012-02-26 21:37:50 0 ----a-w- C:\Windows\ativpsrm.bin 2012-02-26 21:33:41 -------- d-----w- C:\Program Files (x86)\AMD APP 2012-02-26 21:33:37 -------- d-----w- C:\Program Files\Common Files\ATI Technologies 2012-02-26 21:33:37 -------- d-----w- C:\Program Files (x86)\Common Files\ATI Technologies 2012-02-26 21:33:33 47232 ----a-w- C:\Windows\System32\drivers\usbfilter.sys 2012-02-26 21:32:13 -------- d-----w- C:\ProgramData\AMD 2012-02-26 21:32:12 46136 ----a-w- C:\Windows\System32\drivers\amdiox64.sys 2012-02-26 21:31:10 -------- d-----w- C:\Program Files (x86)\ATI Technologies 2012-02-26 21:30:50 -------- d-----w- C:\Program Files\ATI Technologies 2012-02-26 21:30:47 -------- d-----w- C:\Program Files\ATI 2012-02-26 21:28:34 -------- d-----w- C:\Program Files (x86)\AMD High-Definition Graphics Driver 2012-02-26 21:26:11 -------- d-----w- C:\Windows\SysWow64\RTCOM 2012-02-26 21:26:11 -------- d-----w- C:\Program Files\Realtek 2012-02-26 21:08:24 -------- d-----w- C:\Program Files\Windows Portable Devices 2012-02-26 21:08:24 -------- d-----w- C:\Program Files\DVD Maker 2012-02-26 21:08:24 -------- d-----w- C:\Program Files (x86)\Windows Portable Devices 2012-02-26 21:08:21 -------- d-----w- C:\Windows\SysWow64\LogFiles 2012-02-26 21:08:21 -------- d-----w- C:\Windows\ehome 2012-02-26 21:06:47 -------- d-----w- C:\Users\Barbara\AppData\Local\ElevatedDiagnostics 2012-02-26 21:05:10 -------- d-----w- C:\805d05e58990ffe99a 2012-02-26 20:53:07 18432 ----a-w- C:\Windows\SysWow64\amcompat.tlb 2012-02-26 20:53:07 18432 ----a-w- C:\Windows\System32\amcompat.tlb 2012-02-26 20:51:56 105472 ----a-w- C:\Windows\SysWow64\wmpshell.dll 2012-02-26 20:50:59 504320 ----a-w- C:\Windows\SysWow64\msscp.dll 2012-02-26 20:49:54 84992 ----a-w- C:\Windows\System32\Mcx2Svc.dll 2012-02-26 20:28:24 -------- d-----w- C:\SWSetup 2012-02-26 20:28:24 -------- d-----w- C:\HP 2012-02-26 20:17:39 -------- d-----w- C:\Program Files (x86)\HP 2012-02-26 20:09:09 414368 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl 2012-02-26 20:04:32 -------- d-----w- C:\ProgramData\Synaptics 2012-02-26 18:30:36 -------- d-----w- C:\Windows\System32\SPReview 2012-02-26 18:30:14 -------- d-----w- C:\Windows\System32\EventProviders 2012-02-26 17:50:59 99176 ----a-w- C:\Windows\SysWow64\PresentationHostProxy.dll 2012-02-26 17:49:59 932352 ----a-w- C:\Windows\SysWow64\printui.dll 2012-02-26 17:48:59 50688 ----a-w- C:\Windows\SysWow64\runonce.exe 2012-02-26 17:47:49 189952 ----a-w- C:\Windows\SysWow64\sqmapi.dll 2012-02-26 17:47:13 606208 ----a-w- C:\Windows\SysWow64\wbem\fastprox.dll 2012-02-26 17:47:13 363008 ----a-w- C:\Windows\SysWow64\wbemcomn.dll 2012-02-26 17:43:42 529408 ----a-w- C:\Windows\System32\wbemcomn.dll 2012-02-26 17:43:18 244736 ----a-w- C:\Windows\System32\sqmapi.dll 2012-02-26 17:43:15 -------- d-----w- C:\Program Files (x86)\OpenOffice.org 3 2012-02-26 16:52:04 2565632 ----a-w- C:\Windows\System32\esent.dll 2012-02-26 16:52:04 1699328 ----a-w- C:\Windows\SysWow64\esent.dll 2012-02-26 16:52:04 1659776 ----a-w- C:\Windows\System32\drivers\ntfs.sys 2012-02-26 16:52:03 166272 ----a-w- C:\Windows\System32\drivers\nvstor.sys 2012-02-26 16:52:03 148352 ----a-w- C:\Windows\System32\drivers\nvraid.sys 2012-02-26 16:52:03 107904 ----a-w- C:\Windows\System32\drivers\amdsata.sys 2012-02-26 16:52:02 96768 ----a-w- C:\Windows\System32\fsutil.exe 2012-02-26 16:52:02 74240 ----a-w- C:\Windows\SysWow64\fsutil.exe 2012-02-26 16:52:02 410496 ----a-w- C:\Windows\System32\drivers\iaStorV.sys 2012-02-26 16:52:02 27008 ----a-w- C:\Windows\System32\drivers\amdxata.sys 2012-02-26 16:52:02 189824 ----a-w- C:\Windows\System32\drivers\storport.sys 2012-02-26 16:51:32 52736 ----a-w- C:\Windows\System32\drivers\usbehci.sys 2012-02-26 16:51:32 343040 ----a-w- C:\Windows\System32\drivers\usbhub.sys 2012-02-26 16:51:32 325120 ----a-w- C:\Windows\System32\drivers\usbport.sys 2012-02-26 16:51:31 98816 ----a-w- C:\Windows\System32\drivers\usbccgp.sys 2012-02-26 16:51:31 7936 ----a-w- C:\Windows\System32\drivers\usbd.sys 2012-02-26 16:51:31 30720 ----a-w- C:\Windows\System32\drivers\usbuhci.sys 2012-02-26 16:51:31 25600 ----a-w- C:\Windows\System32\drivers\usbohci.sys 2012-02-26 16:51:27 80384 ----a-w- C:\Windows\System32\drivers\BTHUSB.SYS 2012-02-26 16:51:27 552960 ----a-w- C:\Windows\System32\drivers\bthport.sys 2012-02-26 16:51:27 229376 ----a-w- C:\Windows\System32\fsquirt.exe 2012-02-26 16:33:22 -------- d-----w- C:\Windows\SysWow64\wbem\en-US 2012-02-26 16:33:19 -------- d-----w- C:\Windows\System32\wbem\en-US 2012-02-26 16:29:08 -------- d-----w- C:\Users\Barbara\AppData\Local\Thunderbird 2012-02-26 16:20:00 -------- d-----w- C:\Users\Barbara\AppData\Local\Mozilla 2012-02-26 16:06:25 86528 ----a-w- C:\Windows\SysWow64\iesysprep.dll 2012-02-26 16:03:18 1139200 ----a-w- C:\Windows\System32\FntCache.dll 2012-02-26 16:03:17 902656 ----a-w- C:\Windows\System32\d2d1.dll 2012-02-26 16:03:17 1544192 ----a-w- C:\Windows\System32\DWrite.dll 2012-02-26 16:03:17 1076736 ----a-w- C:\Windows\SysWow64\DWrite.dll 2012-02-26 16:03:16 739840 ----a-w- C:\Windows\SysWow64\d2d1.dll 2012-02-26 14:55:28 -------- d-----w- C:\Users\Barbara\AppData\Roaming\Synaptics 2012-02-26 14:20:08 -------- d-----w- C:\Users\Barbara\AppData\Roaming\Avira 2012-02-26 14:15:30 97312 ----a-w- C:\Windows\System32\drivers\avgntflt.sys 2012-02-26 14:15:30 27760 ----a-w- C:\Windows\System32\drivers\avkmgr.sys 2012-02-26 14:15:29 -------- d-----w- C:\ProgramData\Avira 2012-02-26 14:15:29 -------- d-----w- C:\Program Files (x86)\Avira 2012-02-26 14:04:04 294912 ----a-w- C:\Windows\System32\browserchoice.exe 2012-02-26 13:40:11 -------- d-----w- C:\Program Files\Synaptics 2012-02-26 13:38:13 509952 ----a-w- C:\Windows\System32\ntshrui.dll 2012-02-26 13:38:12 442880 ----a-w- C:\Windows\SysWow64\ntshrui.dll 2012-02-26 13:38:11 886784 ----a-w- C:\Program Files\Common Files\System\wab32.dll 2012-02-26 13:38:11 708608 ----a-w- C:\Program Files (x86)\Common Files\System\wab32.dll 2012-02-26 13:38:01 2315776 ----a-w- C:\Windows\System32\tquery.dll 2012-02-26 13:38:00 2223616 ----a-w- C:\Windows\System32\mssrch.dll 2012-02-26 13:38:00 1549312 ----a-w- C:\Windows\SysWow64\tquery.dll 2012-02-26 13:32:40 690688 ----a-w- C:\Windows\SysWow64\msvcrt.dll 2012-02-26 13:31:57 870912 ----a-w- C:\Windows\SysWow64\XpsPrint.dll 2012-02-26 13:23:38 5561216 ----a-w- C:\Windows\System32\ntoskrnl.exe 2012-02-26 13:23:35 3912576 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe 2012-02-26 13:23:34 3967872 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe 2012-02-26 13:22:16 1731920 ----a-w- C:\Windows\System32\ntdll.dll 2012-02-26 13:22:15 1292080 ----a-w- C:\Windows\SysWow64\ntdll.dll 2012-02-26 13:22:10 77312 ----a-w- C:\Windows\System32\packager.dll 2012-02-26 13:22:10 67072 ----a-w- C:\Windows\SysWow64\packager.dll 2012-02-26 13:21:05 8643640 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{1B0724F7-5D68-4428-AF4D-6993C34B46D7}\mpengine.dll 2012-02-26 13:21:04 279656 ------w- C:\Windows\System32\MpSigStub.exe 2012-02-26 13:14:48 63648 ----a-w- C:\Windows\System32\athihvui.dll 2012-02-26 13:14:48 443040 ----a-w- C:\Windows\System32\athihvs.dll 2012-02-26 13:14:48 2727424 ----a-w- C:\Windows\System32\drivers\athrx.sys 2012-02-26 13:14:48 -------- d-----w- C:\Windows\System32\nn-NO 2012-02-26 13:14:48 -------- d-----w- C:\Windows\Options 2012-02-26 13:14:40 -------- d-----w- C:\Program Files (x86)\Cisco 2012-02-26 13:14:39 -------- d-----w- C:\Program Files (x86)\Atheros 2012-02-26 13:14:11 -------- d-sh--w- C:\Windows\Installer 2012-02-26 13:14:05 -------- d-----w- C:\ProgramData\Atheros 2012-02-26 13:13:59 -------- d-----w- C:\Program Files\HP Treiber 2012-02-26 13:02:10 -------- d-----w- C:\Users\Barbara\AppData\Local\Diagnostics 2012-02-26 12:59:02 -------- d-----w- C:\Users\Barbara\AppData\Local\VirtualStore 2012-02-26 12:48:57 -------- d-----w- C:\Windows\Panther . ==================== Find3M ==================== . 2012-02-26 19:37:08 175616 ----a-w- C:\Windows\System32\msclmd.dll 2012-02-26 19:37:08 152576 ----a-w- C:\Windows\SysWow64\msclmd.dll 2012-01-14 04:06:27 3145728 ----a-w- C:\Windows\System32\win32k.sys 2011-12-30 06:26:08 515584 ----a-w- C:\Windows\System32\timedate.cpl 2011-12-30 05:27:56 478720 ----a-w- C:\Windows\SysWow64\timedate.cpl 2011-12-28 03:59:24 498688 ----a-w- C:\Windows\System32\drivers\afd.sys 2011-12-16 08:46:06 634880 ----a-w- C:\Windows\System32\msvcrt.dll . ============= FINISH: 13:40:32,13 =============== Attach.txt . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2011-08-26.01) . Microsoft Windows 7 Professional N Boot Device: \Device\HarddiskVolume1 Install Date: 26.02.2012 13:58:41 System Uptime: 27.02.2012 13:36:05 (0 hours ago) . Motherboard: Hewlett-Packard | | 3577 Processor: AMD E-450 APU with Radeon(tm) HD Graphics | Socket FT1 | 1650/100mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 298 GiB total, 258,275 GiB free. D: is CDROM () . ==== Disabled Device Manager Items ============= . ==== System Restore Points =================== . RP8: 26.02.2012 21:04:37 - Windows Update RP9: 26.02.2012 21:15:22 - Installed HP Product Detection RP10: 26.02.2012 21:18:01 - Installed Hewlett-Packard ACLM.NET v1.1.0.0. RP11: 26.02.2012 21:28:25 - Installed HP On Screen Display RP12: 26.02.2012 21:30:18 - Installiert YouCam RP13: 26.02.2012 21:32:10 - Windows Update RP14: 26.02.2012 21:48:03 - Windows Update RP15: 26.02.2012 22:01:34 - Installed HP Power Manager RP16: 26.02.2012 22:03:04 - Installed HP Quick Launch RP17: 26.02.2012 22:20:38 - Installed LS_HSI. RP18: 26.02.2012 22:34:35 - Windows Update RP19: 26.02.2012 22:51:38 - Installed HP Support Assistant RP20: 26.02.2012 22:55:49 - Windows Modules Installer RP21: 26.02.2012 22:56:37 - Windows Modules Installer RP22: 26.02.2012 23:21:06 - Installed Skype™ 5.8 RP23: 26.02.2012 23:29:33 - Installed Skype™ 5.8 RP24: 26.02.2012 23:34:00 - Installed Java(TM) 7 Update 3 (64-bit) RP26: 27.02.2012 00:05:25 - SPTD setup V1.80 RP27: 27.02.2012 00:30:32 - Windows Update RP28: 27.02.2012 01:21:43 - Removed LightScribe System Software. RP29: 27.02.2012 01:22:41 - Windows Update RP30: 27.02.2012 01:39:52 - Installiert Realtek PCIE Card Reader RP31: 27.02.2012 01:41:10 - Removed HP Quick Launch RP32: 27.02.2012 11:27:59 - Windows Update RP33: 27.02.2012 11:36:43 - Windows Update . ==== Installed Programs ====================== . AMD VISION Engine Control Center Atheros Driver Installation Program Audacity 1.3.14 (Unicode) Avira Free Antivirus Catalyst Control Center - Branding Catalyst Control Center Graphics Previews Common Catalyst Control Center InstallProxy Catalyst Control Center Localization All CCC Help Chinese Standard CCC Help Chinese Traditional CCC Help Czech CCC Help Danish CCC Help Dutch CCC Help English CCC Help Finnish CCC Help French CCC Help German CCC Help Greek CCC Help Hungarian CCC Help Italian CCC Help Japanese CCC Help Korean CCC Help Norwegian CCC Help Polish CCC Help Portuguese CCC Help Russian CCC Help Spanish CCC Help Swedish CCC Help Thai CCC Help Turkish CDBurnerXP Cisco EAP-FAST Module Cisco LEAP Module Cisco PEAP Module DAEMON Tools Lite ESU for Microsoft Windows 7 GIMP 2.6.12 Hewlett-Packard ACLM.NET v1.1.0.0 HP On Screen Display HP Power Manager HP Product Detection HP Quick Launch Malwarebytes Anti-Malware Version 1.60.1.1000 Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 Mozilla Firefox 10.0.2 (x86 de) Mozilla Thunderbird 10.0.2 (x86 de) OpenOffice.org 3.3 Realtek High Definition Audio Driver Realtek PCIE Card Reader Secunia PSI (2.0.0.4002) Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078) Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351) Security Update for Microsoft .NET Framework 4 Extended (KB2487367) Security Update for Microsoft .NET Framework 4 Extended (KB2656351) Skype™ 5.8 Update for Microsoft .NET Framework 4 Client Profile (KB2468871) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) Update for Microsoft .NET Framework 4 Extended (KB2468871) Update for Microsoft .NET Framework 4 Extended (KB2533523) Update for Microsoft .NET Framework 4 Extended (KB2600217) . ==== End Of File =========================== Gmer.txt GMER 1.0.15.15641 - hxxp://www.gmer.net Rootkit scan 2012-02-27 14:17:51 Windows 6.1.7601 Service Pack 1 Running: 7fx4ytu8.exe ---- Registry - GMER 1.0.15 ---- Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\d0df9a1a046b Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files (x86)\DAEMON Tools Lite\ Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ... Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\d0df9a1a046b (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files (x86)\DAEMON Tools Lite\ Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ... ---- EOF - GMER 1.0.15 ---- Die Logfiles sind auch im Anhang zu finden. Vielen Dank nochmal MFG |
|
27.02.2012, 22:29
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Fund Echtzeitscanner Antivir - 'TR/Damaged.Gen8' [trojan] Bitte nun routinemäßig einen Vollscan mit Malwarebytes machen und Log posten.
__________________Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Außerdem müssen alle Funde entfernt werden. Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten! ESET Online Scanner
Bitte alles nach Möglichkeit hier in CODE-Tags posten. Wird so gemacht: [code] hier steht das Log [/code] Und das ganze sieht dann so aus: Code:
ATTFilter hier steht das Log
__________________ |
|
28.02.2012, 18:18
| #3 |
| | Fund Echtzeitscanner Antivir - 'TR/Damaged.Gen8' [trojan] Hiho,
__________________vielen Dank für die Hilfe. Hier die Scans. Eset log.txt Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=015d263d3757eb48867b233ff469d6e2
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-02-28 05:06:00
# local_time=2012-02-28 06:06:00 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1792 16777215 100 0 181287 181287 0 0
# compatibility_mode=5893 16776573 100 94 7252 82073266 0 0
# compatibility_mode=7937 16777214 0 25 135797 135797 0 0
# compatibility_mode=8192 67108863 100 0 3959 3959 0 0
# scanned=137773
# found=0
# cleaned=0
# scan_time=5344
Code:
ATTFilter Malwarebytes Anti-Malware 1.60.1.1000 www.malwarebytes.org Datenbank Version: v2012.02.26.07 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 Barbara :: BARBARA-PC [Administrator] 28.02.2012 15:01:20 mbam-log-2012-02-28 (15-01-20).txt Art des Suchlaufs: Vollständiger Suchlauf Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 310216 Laufzeit: 1 Stunde(n), 24 Minute(n), 56 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) |
|
28.02.2012, 21:14
| #4 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Fund Echtzeitscanner Antivir - 'TR/Damaged.Gen8' [trojan] Log sind unauffällig. Werden wohl Fehlalarme sein.
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
| Themen zu Fund Echtzeitscanner Antivir - 'TR/Damaged.Gen8' [trojan] |
| 64-bit, anschluss, antivir, avira, defender, desktop, echtzeitscanner, explorer, festplatte, firefox, infizierte, installation, mozilla, problem, programme, realtek, registry, scan, secunia psi, spyware, svchost.exe, system, temp, trojan, updates, virus, windows |
![Fund Echtzeitscanner Antivir - 'TR/Damaged.Gen8' [trojan]](iconimages/log-analyse-auswertung/fund-echtzeitscanner-antivir-tr-damaged-gen8-trojan_ltr.gif)
Linear-Darstellung
