| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: TR/Sirefef.BP.1 + TR/Rootkit.Gen2 - Antivir meldet VirusWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
29.02.2012, 11:43
| #1 |
 |  TR/Sirefef.BP.1 + TR/Rootkit.Gen2 - Antivir meldet Virus Hallo zusammen, nun hat es mich auch getroffen und ich habe keine Ahnung wie es passiert ist: Folgende Symtome: Ständige Warnung von Antivir: Code:
ATTFilter In der Datei 'C:\Windows\System32\fgdxbus.dll'
wurde ein Virus oder unerwünschtes Programm 'TR/Sirefef.BP.1' [trojan] gefunden.
Ausgeführte Aktion: Zugriff verweigern
Hier die dds.txt: Code:
ATTFilter .
DDS (Ver_2011-08-26.01) - NTFSx86 MINIMAL
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_26
Run by *** at 9:12:31 on 2012-02-29
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.2975.2587 [GMT 1:00]
.
AV: AntiVir Desktop *Enabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: AntiVir Desktop *Enabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\Explorer.EXE
C:\Windows\system32\ctfmon.exe
C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = about:blank
uInternet Settings,ProxyOverride = *.local
BHO: Adobe PDF Reader: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\programdata\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\tools\spybot~1\SDHelper.dll
BHO: IEHlprObj Class: {ce7c3cf0-4b15-11d1-abed-709549c10000} - c:\program files\lotusorganizer6.1\org6\organize\iehelper.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
mRun: [LManager] c:\program files\launch manager\LManager.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [Acer ePower Management] c:\program files\acer\acer epower management\ePowerTray.exe
mRun: [RtHDVCpl] c:\program files\realtek\audio\hda\RtHDVCpl.exe
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [FreePDF Assistant] "c:\program files\freepdf_xp\fpassist.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [EvtMgr6] c:\program files\logitech\setpointp\SetPoint.exe /launchGaming
mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [Malwarebytes' Anti-Malware] "c:\program files\tools\malwarebytes' anti-malware\mbamgui.exe" /starttray
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: SoftwareSASGeneration = 3 (0x3)
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Bild an &Bluetooth-Gerät senden... - c:\program files\bluetooth software\btsendto_ie_ctx.htm
IE: Nach Microsoft E&xel exportieren - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: Seite an &Bluetooth-Gerät senden... - c:\program files\bluetooth software\btsendto_ie.htm
IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\bluetooth software\btsendto_ie.htm
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\windows\windowsmobile\INetRepl.dll
IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\windows\windowsmobile\INetRepl.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
IE: {B4E30F61-16D9-11D3-85D1-005004229569} - {85E0B172-04FA-11D1-B7DA-00A0C90348D6} - c:\program files\lotusorganizer6.1\org6\organize\bandobjs.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\tools\spybot~1\SDHelper.dll
LSP: mswsock.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
TCP: Interfaces\{A0354CB9-29FF-4CB5-B6D3-0D86E13EB2B9} : NameServer = 192.168.200.1
TCP: Interfaces\{A87420D3-C976-49D8-B7B4-13DAD0F40992} : DhcpNameServer = 192.168.178.1
TCP: Interfaces\{A87420D3-C976-49D8-B7B4-13DAD0F40992}\14C44494F5E4F42544 : DhcpNameServer = 192.168.1.1
TCP: Interfaces\{A87420D3-C976-49D8-B7B4-13DAD0F40992}\3677C616E67657563747 : DhcpNameServer = 10.206.246.101
TCP: Interfaces\{A87420D3-C976-49D8-B7B4-13DAD0F40992}\75C414E4D2035324536313 : DhcpNameServer = 192.168.2.1
TCP: Interfaces\{A87420D3-C976-49D8-B7B4-13DAD0F40992}\D416474786961637F584F6D656 : DhcpNameServer = 192.168.1.1
TCP: Interfaces\{A87420D3-C976-49D8-B7B4-13DAD0F40992}\D41657C6471637368656 : DhcpNameServer = 192.168.50.20
TCP: Interfaces\{A87420D3-C976-49D8-B7B4-13DAD0F40992}\D416E6E69626563747 : DhcpNameServer = 192.168.2.1
TCP: Interfaces\{A87420D3-C976-49D8-B7B4-13DAD0F40992}\E4544574541425 : DhcpNameServer = 192.168.1.1
TCP: Interfaces\{B9448657-55C5-4767-B5DC-FE9D0F482D16} : DhcpNameServer = 192.168.0.1
TCP: Interfaces\{BF5FB075-78F0-4B09-B4C3-CF5BCB9F203C} : NameServer = 193.189.244.225 193.189.244.206
TCP: Interfaces\{EA287D01-8775-4EE9-A83F-2668725D0088} : NameServer = 193.189.244.225 193.189.244.206
Notify: igfxcui - igfxdev.dll
Notify: LBTWlgn - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
Hosts: 127.0.0.1 www.spywareinfo.com
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\***\appdata\roaming\mozilla\firefox\profiles\8i8ba79a.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
FF - component: c:\programdata\real\realplayer\browserrecordplugin\firefox\ext\components\nprpffbrowserrecordext.dll
FF - component: c:\programdata\real\realplayer\browserrecordplugin\firefox\ext\components\nprpffbrowserrecordlegacyext.dll
FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\divx\divx ovs helper\npovshelper.dll
FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npFoxitReaderPlugin.dll
FF - plugin: c:\program files\realplayer\netscape6\nppl3260.dll
FF - plugin: c:\program files\realplayer\netscape6\nprjplug.dll
FF - plugin: c:\program files\realplayer\netscape6\nprpjplug.dll
FF - plugin: c:\program files\tools\picasa3\npPicasa3.dll
FF - plugin: c:\programdata\real\realplayer\browserrecordplugin\mozillaplugins\nprphtml5videoshim.dll
FF - plugin: c:\windows\system32\tvuax\npTVUAx.dll
.
============= SERVICES / DRIVERS ===============
.
R3 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [2011-2-20 218688]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\drivers\vwififlt.sys [2009-7-14 48128]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\common files\adobe\arm\1.0\armsvc.exe [2012-1-3 63928]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\avira\antivir desktop\sched.exe [2010-7-17 136360]
S2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2010-7-17 269480]
S2 Apache2.2;Apache2.2;d:\xampp\apache\bin\httpd.exe [2010-10-18 20549]
S2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2010-7-17 66616]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 ePowerSvc;Acer ePower Service;c:\program files\acer\acer epower management\ePowerSvc.exe [2010-7-17 727584]
S2 lxbk_device;lxbk_device;c:\windows\system32\lxbkcoms.exe -service --> c:\windows\system32\lxbkcoms.exe -service [?]
S2 MBAMService;MBAMService;c:\program files\tools\malwarebytes' anti-malware\mbamservice.exe [2010-11-17 652872]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\tools\spybot - search & destroy\SDWinSec.exe [2011-3-29 1153368]
S2 TeamViewer7;TeamViewer 7;c:\program files\teamviewer\version7\TeamViewer_Service.exe [2012-2-21 2916736]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]
S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\drivers\btwl2cap.sys [2010-7-17 29472]
S3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\drivers\ewusbnet.sys [2010-8-4 198656]
S3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\drivers\ewusbdev.sys [2010-8-4 101120]
S3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2010-7-17 122368]
S3 L1C;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20);c:\windows\system32\drivers\L1C62x86.sys [2009-6-10 50688]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2010-11-17 20464]
S3 NETw5s32;Intel(R) Wireless WiFi Link Adaptertreiber für Windows 7 32-Bit;c:\windows\system32\drivers\NETw5s32.sys [2009-9-15 6114816]
S3 netw5v32;Intel(R) Wireless WiFi Link 5000-Serie - Adaptertreiber für Windows Vista 32 Bit;c:\windows\system32\drivers\netw5v32.sys [2009-6-10 4231168]
S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2011-3-29 52224]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\drivers\vwifimp.sys [2009-7-14 14336]
S3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\wat\WatAdminSvc.exe [2010-7-24 1343400]
S3 WinRing0_1_2_0;WinRing0_1_2_0;c:\program files\acer\fanspeed\WinRing0.sys [2010-7-17 14416]
.
=============== Created Last 30 ================
.
2012-02-28 11:00:35 0 --sha-w- c:\windows\system32\dds_log_trash.cmd
2012-02-28 10:59:36 -------- d-sh--w- c:\users\***\appdata\local\dbfb66cc
2012-02-28 09:00:51 6552120 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{2809e461-c1a3-4e15-84f2-f6600026729f}\mpengine.dll
2012-02-21 08:41:09 -------- d-----w- c:\program files\TeamViewer
2012-02-20 12:39:07 -------- d-----w- c:\users\***\appdata\roaming\Free Monitor for Google
2012-02-19 19:59:05 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2012-02-19 19:59:03 141112 ----a-w- c:\program files\internet explorer\sqmapi.dll
2012-02-19 19:59:00 194048 ----a-w- c:\program files\internet explorer\IEShims.dll
2012-02-19 19:59:00 1798656 ----a-w- c:\windows\system32\jscript9.dll
2012-02-19 19:58:58 1127424 ----a-w- c:\windows\system32\wininet.dll
2012-02-19 19:58:57 678912 ----a-w- c:\program files\internet explorer\iedvtool.dll
2012-02-19 19:58:53 1427456 ----a-w- c:\windows\system32\inetcpl.cpl
2012-02-16 19:42:27 478720 ----a-w- c:\windows\system32\timedate.cpl
2012-02-16 19:42:17 690688 ----a-w- c:\windows\system32\msvcrt.dll
2012-02-16 19:42:09 442880 ----a-w- c:\windows\system32\ntshrui.dll
2012-02-16 19:42:07 2343424 ----a-w- c:\windows\system32\win32k.sys
.
==================== Find3M ====================
.
2012-02-28 11:00:08 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-01-29 04:10:42 237072 ------w- c:\windows\system32\MpSigStub.exe
2011-12-29 09:33:44 16400 ----a-w- c:\windows\system32\drivers\LNonPnP.sys
2011-12-10 14:24:06 20464 ----a-w- c:\windows\system32\drivers\mbam.sys
.
============= FINISH: 9:13:50,80 ===============
Meine Fragen:
Ich hoffe auf eure Hilfe und verbleibe, mit freundlichem Gruß, Scalary. |
| Themen zu TR/Sirefef.BP.1 + TR/Rootkit.Gen2 - Antivir meldet Virus |
| 32 bit, acrobat update, antivir, antivir guard, avg, avgnt, avira, defender, desktop, e-banking, firefox, frage, google, home, mbamservice.exe, monitor, mozilla, netzwerk, picasa, plug-in, programm, realtek, security, svchost.exe, system, system neu, tr/rootkit.gen2, tr/sirefef.bp.1, trojan, updates, virus, vista, vista 32 bit, warnung, windows, windows 7 home, windows 7 home premium, wörter, ändern |
Richtig?
Baum-Darstellung