![]() |
|
Log-Analyse und Auswertung: Email von Telekom-Abuse-Team | Log-File anbeiWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
![]() |
|
![]() | #1 | |
![]() | ![]() Email von Telekom-Abuse-Team | Log-File anbei Hallo Markus, Zitat:
Fund 1: Code:
ATTFilter Protokollname: System Quelle: Microsoft Antimalware Datum: 06.02.2013 17:50:02 Ereignis-ID: 1116 Aufgabenkategorie:Keine Ebene: Warnung Schlüsselwörter:Klassisch Benutzer: Nicht zutreffend Computer: GG-PC Beschreibung: Microsoft Antimalware has detected malware or other potentially unwanted software. For more information please see the following: hxxp://go.microsoft.com/fwlink/?linkid=37020&name=Exploit:Java/Blacole.GL&threatid=2147663917 Name: Exploit:Java/Blacole.GL ID: 2147663917 Severity: Severe Category: Exploit Path: containerfile:_D:\Users\GG\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63\2ac0763f-74351f2d;file:_D:\Users\GG\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63\2ac0763f-74351f2d->joiua/joiub.class Detection Origin: Local machine Detection Type: Concrete Detection Source: User User: GG-PC\GG Process Name: Unknown Signature Version: AV: 1.143.1680.0, AS: 1.143.1680.0, NIS: 18.36.0.0 Engine Version: AM: 1.1.9103.0, NIS: 2.1.8904.0 Ereignis-XML: <Event xmlns="hxxp://schemas.microsoft.com/win/2004/08/events/event"> <System> <Provider Name="Microsoft Antimalware" /> <EventID Qualifiers="0">1116</EventID> <Level>3</Level> <Task>0</Task> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2013-02-06T16:50:02.000000000Z" /> <EventRecordID>22421</EventRecordID> <Channel>System</Channel> <Computer>GG-PC</Computer> <Security /> </System> <EventData> <Data>%%860</Data> <Data>4.1.0522.0</Data> <Data>{D103C3B5-BA22-43C8-BF9B-A3FC50CEA63A}</Data> <Data>2013-02-06T16:49:19.657Z</Data> <Data> </Data> <Data> </Data> <Data>2147663917</Data> <Data>Exploit:Java/Blacole.GL</Data> <Data>5</Data> <Data>Severe</Data> <Data>30</Data> <Data>Exploit</Data> <Data>hxxp://go.microsoft.com/fwlink/?linkid=37020&name=Exploit:Java/Blacole.GL&threatid=2147663917</Data> <Data>1</Data> <Data> </Data> <Data>1</Data> <Data>1</Data> <Data>%%815</Data> <Data>Unknown</Data> <Data>GG-PC\GG</Data> <Data> </Data> <Data>containerfile:_D:\Users\GG\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63\2ac0763f-74351f2d;file:_D:\Users\GG\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63\2ac0763f-74351f2d->joiua/joiub.class</Data> <Data>1</Data> <Data>%%845</Data> <Data>0</Data> <Data>%%812</Data> <Data>0</Data> <Data>%%822</Data> <Data>0</Data> <Data>9</Data> <Data>%%887</Data> <Data> </Data> <Data>0x00000000</Data> <Data>Der Vorgang wurde erfolgreich beendet. </Data> <Data> </Data> <Data>0</Data> <Data>0</Data> <Data>No additional actions required</Data> <Data> </Data> <Data> </Data> <Data>AV: 1.143.1680.0, AS: 1.143.1680.0, NIS: 18.36.0.0</Data> <Data>AM: 1.1.9103.0, NIS: 2.1.8904.0</Data> </EventData> </Event> Code:
ATTFilter Protokollname: System Quelle: Microsoft Antimalware Datum: 06.02.2013 17:50:02 Ereignis-ID: 1116 Aufgabenkategorie:Keine Ebene: Warnung Schlüsselwörter:Klassisch Benutzer: Nicht zutreffend Computer: GG-PC Beschreibung: Microsoft Antimalware has detected malware or other potentially unwanted software. For more information please see the following: hxxp://go.microsoft.com/fwlink/?linkid=37020&name=Exploit:Java/CVE-2012-1723&threatid=2147659851 Name: Exploit:Java/CVE-2012-1723 ID: 2147659851 Severity: Severe Category: Exploit Path: containerfile:_D:\Users\GG\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63\2ac0763f-74351f2d;file:_D:\Users\GG\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63\2ac0763f-74351f2d->joiua/joiua.class Detection Origin: Local machine Detection Type: Concrete Detection Source: User User: GG-PC\GG Process Name: Unknown Signature Version: AV: 1.143.1680.0, AS: 1.143.1680.0, NIS: 18.36.0.0 Engine Version: AM: 1.1.9103.0, NIS: 2.1.8904.0 Ereignis-XML: <Event xmlns="hxxp://schemas.microsoft.com/win/2004/08/events/event"> <System> <Provider Name="Microsoft Antimalware" /> <EventID Qualifiers="0">1116</EventID> <Level>3</Level> <Task>0</Task> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2013-02-06T16:50:02.000000000Z" /> <EventRecordID>22420</EventRecordID> <Channel>System</Channel> <Computer>GG-PC</Computer> <Security /> </System> <EventData> <Data>%%860</Data> <Data>4.1.0522.0</Data> <Data>{4C459897-2F79-4322-A515-112BFA227E62}</Data> <Data>2013-02-06T16:49:19.657Z</Data> <Data> </Data> <Data> </Data> <Data>2147659851</Data> <Data>Exploit:Java/CVE-2012-1723</Data> <Data>5</Data> <Data>Severe</Data> <Data>30</Data> <Data>Exploit</Data> <Data>hxxp://go.microsoft.com/fwlink/?linkid=37020&name=Exploit:Java/CVE-2012-1723&threatid=2147659851</Data> <Data>1</Data> <Data> </Data> <Data>1</Data> <Data>1</Data> <Data>%%815</Data> <Data>Unknown</Data> <Data>GG-PC\GG</Data> <Data> </Data> <Data>containerfile:_D:\Users\GG\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63\2ac0763f-74351f2d;file:_D:\Users\GG\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63\2ac0763f-74351f2d->joiua/joiua.class</Data> <Data>1</Data> <Data>%%845</Data> <Data>0</Data> <Data>%%812</Data> <Data>0</Data> <Data>%%822</Data> <Data>0</Data> <Data>9</Data> <Data>%%887</Data> <Data> </Data> <Data>0x00000000</Data> <Data>Der Vorgang wurde erfolgreich beendet. </Data> <Data> </Data> <Data>0</Data> <Data>0</Data> <Data>No additional actions required</Data> <Data> </Data> <Data> </Data> <Data>AV: 1.143.1680.0, AS: 1.143.1680.0, NIS: 18.36.0.0</Data> <Data>AM: 1.1.9103.0, NIS: 2.1.8904.0</Data> </EventData> </Event> Code:
ATTFilter Protokollname: System Quelle: Microsoft Antimalware Datum: 06.02.2013 17:50:02 Ereignis-ID: 1116 Aufgabenkategorie:Keine Ebene: Warnung Schlüsselwörter:Klassisch Benutzer: Nicht zutreffend Computer: GG-PC Beschreibung: Microsoft Antimalware has detected malware or other potentially unwanted software. For more information please see the following: hxxp://go.microsoft.com/fwlink/?linkid=37020&name=Exploit:Java/CVE-2012-1723.gen!A&threatid=2147679014 Name: Exploit:Java/CVE-2012-1723.gen!A ID: 2147679014 Severity: Severe Category: Exploit Path: containerfile:_D:\Users\GG\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63\2ac0763f-74351f2d;file:_D:\Users\GG\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63\2ac0763f-74351f2d->joiua/joiuc.class Detection Origin: Local machine Detection Type: Generic Detection Source: User User: GG-PC\GG Process Name: Unknown Signature Version: AV: 1.143.1680.0, AS: 1.143.1680.0, NIS: 18.36.0.0 Engine Version: AM: 1.1.9103.0, NIS: 2.1.8904.0 Ereignis-XML: <Event xmlns="hxxp://schemas.microsoft.com/win/2004/08/events/event"> <System> <Provider Name="Microsoft Antimalware" /> <EventID Qualifiers="0">1116</EventID> <Level>3</Level> <Task>0</Task> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2013-02-06T16:50:02.000000000Z" /> <EventRecordID>22418</EventRecordID> <Channel>System</Channel> <Computer>GG-PC</Computer> <Security /> </System> <EventData> <Data>%%860</Data> <Data>4.1.0522.0</Data> <Data>{44FA6FFE-6BFB-4F46-8B68-E8839F313D58}</Data> <Data>2013-02-06T16:49:19.657Z</Data> <Data> </Data> <Data> </Data> <Data>2147679014</Data> <Data>Exploit:Java/CVE-2012-1723.gen!A</Data> <Data>5</Data> <Data>Severe</Data> <Data>30</Data> <Data>Exploit</Data> <Data>hxxp://go.microsoft.com/fwlink/?linkid=37020&name=Exploit:Java/CVE-2012-1723.gen!A&threatid=2147679014</Data> <Data>1</Data> <Data> </Data> <Data>1</Data> <Data>1</Data> <Data>%%815</Data> <Data>Unknown</Data> <Data>GG-PC\GG</Data> <Data> </Data> <Data>containerfile:_D:\Users\GG\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63\2ac0763f-74351f2d;file:_D:\Users\GG\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63\2ac0763f-74351f2d->joiua/joiuc.class</Data> <Data>1</Data> <Data>%%845</Data> <Data>0</Data> <Data>%%812</Data> <Data>2</Data> <Data>%%823</Data> <Data>0</Data> <Data>9</Data> <Data>%%887</Data> <Data> </Data> <Data>0x00000000</Data> <Data>Der Vorgang wurde erfolgreich beendet. </Data> <Data> </Data> <Data>0</Data> <Data>0</Data> <Data>No additional actions required</Data> <Data> </Data> <Data> </Data> <Data>AV: 1.143.1680.0, AS: 1.143.1680.0, NIS: 18.36.0.0</Data> <Data>AM: 1.1.9103.0, NIS: 2.1.8904.0</Data> </EventData> </Event> Code:
ATTFilter Protokollname: System Quelle: Microsoft Antimalware Datum: 06.02.2013 18:30:21 Ereignis-ID: 1117 Aufgabenkategorie:Keine Ebene: Informationen Schlüsselwörter:Klassisch Benutzer: Nicht zutreffend Computer: GG-PC Beschreibung: Microsoft Antimalware has taken action to protect this machine from malware or other potentially unwanted software. For more information please see the following: hxxp://go.microsoft.com/fwlink/?linkid=37020&name=Exploit:JS/Blacole.HI&threatid=2147658482 Name: Exploit:JS/Blacole.HI ID: 2147658482 Severity: Severe Category: Exploit Path: file:_D:\Users\GG\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\8IRFR94W\main[1].htm Detection Origin: Local machine Detection Type: Concrete Detection Source: User User: GG-PC\GG Process Name: Unknown Action: Remove Action Status: No additional actions required Error Code: 0x00000000 Error description: Der Vorgang wurde erfolgreich beendet. Signature Version: AV: 1.143.1680.0, AS: 1.143.1680.0, NIS: 18.36.0.0 Engine Version: AM: 1.1.9103.0, NIS: 2.1.8904.0 Ereignis-XML: <Event xmlns="hxxp://schemas.microsoft.com/win/2004/08/events/event"> <System> <Provider Name="Microsoft Antimalware" /> <EventID Qualifiers="0">1117</EventID> <Level>4</Level> <Task>0</Task> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2013-02-06T17:30:21.000000000Z" /> <EventRecordID>22432</EventRecordID> <Channel>System</Channel> <Computer>GG-PC</Computer> <Security /> </System> <EventData> <Data>%%860</Data> <Data>4.1.0522.0</Data> <Data>{1A08FFB1-F54D-4084-83F6-316A1C10783B}</Data> <Data>2013-02-06T16:49:19.657Z</Data> <Data> </Data> <Data> </Data> <Data>2147658482</Data> <Data>Exploit:JS/Blacole.HI</Data> <Data>5</Data> <Data>Severe</Data> <Data>30</Data> <Data>Exploit</Data> <Data>hxxp://go.microsoft.com/fwlink/?linkid=37020&name=Exploit:JS/Blacole.HI&threatid=2147658482</Data> <Data>4</Data> <Data> </Data> <Data>2</Data> <Data>1</Data> <Data>%%815</Data> <Data>Unknown</Data> <Data>GG-PC\GG</Data> <Data> </Data> <Data>file:_D:\Users\GG\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\8IRFR94W\main[1].htm</Data> <Data>1</Data> <Data>%%845</Data> <Data>0</Data> <Data>%%812</Data> <Data>0</Data> <Data>%%822</Data> <Data>0</Data> <Data>3</Data> <Data>%%808</Data> <Data> </Data> <Data>0x00000000</Data> <Data>Der Vorgang wurde erfolgreich beendet. </Data> <Data> </Data> <Data>0</Data> <Data>0</Data> <Data>No additional actions required</Data> <Data>GG-PC\GG</Data> <Data> </Data> <Data>AV: 1.143.1680.0, AS: 1.143.1680.0, NIS: 18.36.0.0</Data> <Data>AM: 1.1.9103.0, NIS: 2.1.8904.0</Data> </EventData> </Event> Code:
ATTFilter Protokollname: System Quelle: Microsoft Antimalware Datum: 06.02.2013 18:30:21 Ereignis-ID: 1117 Aufgabenkategorie:Keine Ebene: Informationen Schlüsselwörter:Klassisch Benutzer: Nicht zutreffend Computer: GG-PC Beschreibung: Microsoft Antimalware has taken action to protect this machine from malware or other potentially unwanted software. For more information please see the following: hxxp://go.microsoft.com/fwlink/?linkid=37020&name=Exploit:Java/Blacole.GM&threatid=2147663918 Name: Exploit:Java/Blacole.GM ID: 2147663918 Severity: Severe Category: Exploit Path: containerfile:_D:\Users\GG\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63\2ac0763f-74351f2d;file:_D:\Users\GG\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63\2ac0763f-74351f2d->joiua/joiud.class Detection Origin: Local machine Detection Type: Concrete Detection Source: User User: GG-PC\GG Process Name: Unknown Action: Remove Action Status: No additional actions required Error Code: 0x00000000 Error description: Der Vorgang wurde erfolgreich beendet. Signature Version: AV: 1.143.1680.0, AS: 1.143.1680.0, NIS: 18.36.0.0 Engine Version: AM: 1.1.9103.0, NIS: 2.1.8904.0 Ereignis-XML: <Event xmlns="hxxp://schemas.microsoft.com/win/2004/08/events/event"> <System> <Provider Name="Microsoft Antimalware" /> <EventID Qualifiers="0">1117</EventID> <Level>4</Level> <Task>0</Task> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2013-02-06T17:30:21.000000000Z" /> <EventRecordID>22429</EventRecordID> <Channel>System</Channel> <Computer>GG-PC</Computer> <Security /> </System> <EventData> <Data>%%860</Data> <Data>4.1.0522.0</Data> <Data>{A779CFBF-D6C6-4DBF-8D9E-B04D0053179B}</Data> <Data>2013-02-06T16:49:19.657Z</Data> <Data> </Data> <Data> </Data> <Data>2147663918</Data> <Data>Exploit:Java/Blacole.GM</Data> <Data>5</Data> <Data>Severe</Data> <Data>30</Data> <Data>Exploit</Data> <Data>hxxp://go.microsoft.com/fwlink/?linkid=37020&name=Exploit:Java/Blacole.GM&threatid=2147663918</Data> <Data>4</Data> <Data> </Data> <Data>2</Data> <Data>1</Data> <Data>%%815</Data> <Data>Unknown</Data> <Data>GG-PC\GG</Data> <Data> </Data> <Data>containerfile:_D:\Users\GG\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63\2ac0763f-74351f2d;file:_D:\Users\GG\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63\2ac0763f-74351f2d->joiua/joiud.class</Data> <Data>1</Data> <Data>%%845</Data> <Data>0</Data> <Data>%%812</Data> <Data>0</Data> <Data>%%822</Data> <Data>0</Data> <Data>3</Data> <Data>%%808</Data> <Data> </Data> <Data>0x00000000</Data> <Data>Der Vorgang wurde erfolgreich beendet. </Data> <Data> </Data> <Data>0</Data> <Data>0</Data> <Data>No additional actions required</Data> <Data>GG-PC\GG</Data> <Data> </Data> <Data>AV: 1.143.1680.0, AS: 1.143.1680.0, NIS: 18.36.0.0</Data> <Data>AM: 1.1.9103.0, NIS: 2.1.8904.0</Data> </EventData> </Event> Danke nochmal für Deine Mühe. Gruß |
![]() |
Themen zu Email von Telekom-Abuse-Team | Log-File anbei |
adblock, antivirus, autorun, bho, browser, email, exploit:java/blacole.gl, exploit:js/blacole.hi, festplatte, flash player, format, helper, hijack, homepage, hängen, jdownloader, karte, kreditkarte, neu aufsetzen, object, realtek, registry, robot, security, sicherheit, software, starmoney, windows |