Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung

Log-Analyse und Auswertung: GVU 2.07 trojaner

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML.

 
Alt 04.08.2012, 07:34   #1
artist91
 
GVU 2.07 trojaner - Standard

GVU 2.07 trojaner



Ich habe alles soweit wie hier im forum versucht durchzuarbeiten. Nun eine Frage von mir ist das jetzt so in Ordnung :
Zitat:
All processes killed
========== OTL ==========
Service WDICA stopped successfully!
Service WDICA deleted successfully!
Service PDRFRAME stopped successfully!
Service PDRFRAME deleted successfully!
Service PDRELI stopped successfully!
Service PDRELI deleted successfully!
Service PDFRAME stopped successfully!
Service PDFRAME deleted successfully!
Service PDCOMP stopped successfully!
Service PDCOMP deleted successfully!
Service PCIDump stopped successfully!
Service PCIDump deleted successfully!
Service lbrtfdc stopped successfully!
Service lbrtfdc deleted successfully!
Service i2omgmt stopped successfully!
Service i2omgmt deleted successfully!
Service Changer stopped successfully!
Service Changer deleted successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
Prefs.js: 0 removed from network.proxy.type
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\HonorAutoRunSetting deleted successfully.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\AUTOEXEC.BAT moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{48412bc2-a3bd-11df-9b93-c9942e313d71}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{48412bc2-a3bd-11df-9b93-c9942e313d71}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{48412bc2-a3bd-11df-9b93-c9942e313d71}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{48412bc2-a3bd-11df-9b93-c9942e313d71}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{48412bc2-a3bd-11df-9b93-c9942e313d71}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{48412bc2-a3bd-11df-9b93-c9942e313d71}\ not found.
File J:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{48412bc6-a3bd-11df-9b93-c9942e313d71}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{48412bc6-a3bd-11df-9b93-c9942e313d71}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{48412bc6-a3bd-11df-9b93-c9942e313d71}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{48412bc6-a3bd-11df-9b93-c9942e313d71}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{48412bc6-a3bd-11df-9b93-c9942e313d71}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{48412bc6-a3bd-11df-9b93-c9942e313d71}\ not found.
File J:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{48412bca-a3bd-11df-9b93-e931f1f1fa94}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{48412bca-a3bd-11df-9b93-e931f1f1fa94}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{48412bca-a3bd-11df-9b93-e931f1f1fa94}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{48412bca-a3bd-11df-9b93-e931f1f1fa94}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{48412bca-a3bd-11df-9b93-e931f1f1fa94}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{48412bca-a3bd-11df-9b93-e931f1f1fa94}\ not found.
File J:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5fe1641f-5e1f-11e0-9c2c-bbff7ea5f3f7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5fe1641f-5e1f-11e0-9c2c-bbff7ea5f3f7}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5fe1641f-5e1f-11e0-9c2c-bbff7ea5f3f7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5fe1641f-5e1f-11e0-9c2c-bbff7ea5f3f7}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5fe1641f-5e1f-11e0-9c2c-bbff7ea5f3f7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5fe1641f-5e1f-11e0-9c2c-bbff7ea5f3f7}\ not found.
File J:\setup_vmc_lite.exe /checkApplicationPresence not found.
File C:\Dokumente und Einstellungen\Torabian\Desktop\mbam-setup-1.62.0.1300.exe not found.
C:\WINDOWS\System32\ConduitEngine.tmp deleted successfully.
C:\WINDOWS\System32\CONFIG.TMP deleted successfully.
C:\WINDOWS\System32\REN446.tmp deleted successfully.
File C:\WINDOWS\System32\ADW.exe not found.
C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml moved successfully.
C:\Programme\Mozilla Firefox\searchplugins\bing.xml moved successfully.
C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml moved successfully.
C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml moved successfully.
C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml moved successfully.
C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml moved successfully.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ras_0oed.pad moved successfully.
File C:\Dokumente und Einstellungen\Torabian\Startmenü\Programme\Autostart\ctfmon.lnk not found.
========== FILES ==========
< ipconfig /flushdns /c >
No captured output from command...
C:\Dokumente und Einstellungen\Türkyilmaz\Desktop\cmd.bat deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56478 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 196608 bytes
->Temporary Internet Files folder emptied: 1696231 bytes

User: Türkyilmaz
->Temp folder emptied: 5374595541 bytes
->Temporary Internet Files folder emptied: 299409204 bytes
->Java cache emptied: 3755778 bytes
->FireFox cache emptied: 166724915 bytes
->Google Chrome cache emptied: 403125716 bytes
->Apple Safari cache emptied: 894976 bytes
->Flash cache emptied: 58617 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 1258715 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 166332759 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 6.121,00 mb


[EMPTYFLASH]

User: All Users

User: Default User
->Flash cache emptied: 0 bytes

User: LocalService

User: NetworkService

User: Türkyilmaz
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0,00 mb


OTL by OldTimer - Version 3.2.43.0 log created on 08042012_080358

Files\Folders moved on Reboot...
File\Folder C:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen\Temp\Perflib_Perfdata_7c.dat not found!
File\Folder C:\Dokumente und Einstellungen\Türkyilmaz\Lokale Einstellungen\Temp\div4C2.tmp\div7CD.tmp not found!
C:\Dokumente und Einstellungen\Türkyilmaz\Lokale Einstellungen\Temp\deo0_sar.exe moved successfully.
C:\Dokumente und Einstellungen\Türkyilmaz\Lokale Einstellungen\Temporary Internet Files\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat moved successfully.

Registry entries deleted on Reboot...

 

Themen zu GVU 2.07 trojaner
autostart, cdrom, desktop, dllcache, einstellungen, explorer, firefox, forum, frage, google, internet, internet explorer, java, log, microsoft, mozilla, nodrivetypeautorun, programme, services, setup, software, system, system32, trojaner, windows




Zum Thema GVU 2.07 trojaner - Ich habe alles soweit wie hier im forum versucht durchzuarbeiten. Nun eine Frage von mir ist das jetzt so in Ordnung : Zitat: All processes killed ========== OTL ========== Service - GVU 2.07 trojaner...
Archiv
Du betrachtest: GVU 2.07 trojaner auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.