| |
| |||||||
Log-Analyse und Auswertung: XP Prof.: TR/Kazy.271313 und TR/Urausy.65024584 durch AV gefundenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
02.11.2013, 16:17
| #7 |
 |  XP Prof.: TR/Kazy.271313 und TR/Urausy.65024584 durch AV gefunden Hallo Matthias. Eset hat noch einen Schädling gefunden: Win32/Spy.SpyEye.CFG.A trojan !!! Mist. Hier die gewünschten Logs: Fixlist: Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 30-10-2013
Ran by Dieter at 2013-11-02 15:10:32 Run:1
Running from E:\Dokumente und Einstellungen\Dieter\Desktop
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
start
SearchScopes: HKLM - DefaultScope value is missing.
BHO: No Name - {41564952-412D-5637-00A7-7A786E7484D7} - No File
Toolbar: HKLM - No Name - {41564952-412D-5637-00A7-7A786E7484D7} - No File
Toolbar: HKCU - No Name - {41564952-412D-5637-00A7-7A786E7484D7} - No File
end
*****************
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{41564952-412D-5637-00A7-7A786E7484D7} => Key deleted successfully.
HKCR\CLSID\{41564952-412D-5637-00A7-7A786E7484D7} => Key not found.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{41564952-412D-5637-00A7-7A786E7484D7} => Value deleted successfully.
HKCR\CLSID\{41564952-412D-5637-00A7-7A786E7484D7} => Key not found.
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{41564952-412D-5637-00A7-7A786E7484D7} => Value deleted successfully.
HKCR\CLSID\{41564952-412D-5637-00A7-7A786E7484D7} => Key not found.
==== End of Fixlog ====
Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=e1d4a3da9fa9bd49bda8357470838615
# engine=15730
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-11-02 02:59:49
# local_time=2013-11-02 03:59:49 (+0100, Westeuropäische Normalzeit)
# country="Germany"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=1799 16775165 100 95 85634 205308628 18417 0
# scanned=45980
# found=1
# cleaned=0
# scan_time=2628
sh=AB8A051BCBDC435EAF145B694630C89A6873CB59 ft=0 fh=0000000000000000 vn="Win32/Spy.SpyEye.CFG.A trojan" ac=I fn="E:\Qoobox\Quarantine\E\Masher1.rar\config.bin.vir"
Code:
ATTFilter Results of screen317's Security Check version 0.99.74 Windows XP Service Pack 3 x86 Internet Explorer 6 Out of date! ``````````````Antivirus/Firewall Check:`````````````` Warten Sie, w„hrend WMIC installiert wird.d i s p l a y N a m e ECHO ist ausgeschaltet (OFF). A v i r a ECHO ist ausgeschaltet (OFF). D e s k t o p ECHO ist ausgeschaltet (OFF). Antivirus up to date! `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware Version 1.75.0.1300 Adobe Flash Player 11.9.900.117 Adobe Reader XI Mozilla Firefox (25.0) ````````Process Check: objlist.exe by Laurent```````` Avira Antivir avguard.exe `````````````````System Health check````````````````` Total Fragmentation on Drive E:: ````````````````````End of Log`````````````````````` Code:
ATTFilter Farbar Service Scanner Version: 24-10-2013
Ran by Dieter (administrator) on 02-11-2013 at 16:12:25
Running from "E:\Dokumente und Einstellungen\Dieter\Desktop"
Microsoft Windows XP Professional Service Pack 3 (X86)
Boot Mode: Normal
****************************************************************
Internet Services:
============
Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.
Windows Firewall:
=============
Firewall Disabled Policy:
==================
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall"=DWORD:0
System Restore:
============
System Restore Disabled Policy:
========================
Security Center:
============
Windows Update:
============
Windows Autoupdate Disabled Policy:
============================
Other Services:
==============
File Check:
========
E:\WINDOWS\system32\dhcpcsvc.dll
[2008-04-14 06:52] - [2008-04-14 06:52] - 0127488 ____A (Microsoft Corporation) C29A1C9B75BA38FA37F8C44405DEC360
E:\WINDOWS\system32\Drivers\afd.sys => MD5 is legit
E:\WINDOWS\system32\Drivers\netbt.sys => MD5 is legit
E:\WINDOWS\system32\Drivers\tcpip.sys => MD5 is legit
E:\WINDOWS\system32\Drivers\ipsec.sys => MD5 is legit
E:\WINDOWS\system32\dnsrslvr.dll
[2008-04-14 06:52] - [2009-04-20 18:17] - 0045568 ____A (Microsoft Corporation) 407F3227AC618FD1CA54B335B083DE07
E:\WINDOWS\system32\ipnathlp.dll
[2008-04-14 06:52] - [2008-04-14 06:52] - 0334336 ____A (Microsoft Corporation) CAD058D5F8B889A87CA3EB3CF624DCEF
E:\WINDOWS\system32\netman.dll
[2008-04-14 06:52] - [2008-04-14 06:52] - 0198144 ____A (Microsoft Corporation) E6D88F1F6745BF00B57E7855A2AB696C
E:\WINDOWS\system32\wbem\WMIsvc.dll
[2009-09-19 14:34] - [2008-04-14 06:52] - 0145408 ____A (Microsoft Corporation) 6F3F3973D97714CC5F906A19FE883729
E:\WINDOWS\system32\srsvc.dll
[2009-09-19 14:36] - [2008-04-14 06:52] - 0171520 ____A (Microsoft Corporation) FE77A85495065F3AD59C5C65B6C54182
E:\WINDOWS\system32\Drivers\sr.sys
[2009-09-19 14:36] - [2008-04-14 06:32] - 0073472 ____A (Microsoft Corporation) 50FA898F8C032796D3B1B9951BB5A90F
E:\WINDOWS\system32\wscsvc.dll
[2008-04-14 06:52] - [2008-04-14 06:52] - 0080896 ____A (Microsoft Corporation) 300B3E84FAF1A5C1F791C159BA28035D
E:\WINDOWS\system32\wbem\WMIsvc.dll
[2009-09-19 14:34] - [2008-04-14 06:52] - 0145408 ____A (Microsoft Corporation) 6F3F3973D97714CC5F906A19FE883729
E:\WINDOWS\system32\wuauserv.dll
[2009-09-19 14:37] - [2008-04-14 06:52] - 0006656 ____A (Microsoft Corporation) 7B4FE05202AA6BF9F4DFD0E6A0D8A085
E:\WINDOWS\system32\qmgr.dll
[2009-09-19 14:37] - [2008-04-14 06:52] - 0409088 ____A (Microsoft Corporation) D6F603772A789BB3228F310D650B8BD1
E:\WINDOWS\system32\es.dll
[2008-04-14 06:52] - [2008-07-07 21:26] - 0253952 ____A (Microsoft Corporation) AF4F6B5739D18CA7972AB53E091CBC74
E:\WINDOWS\system32\cryptsvc.dll
[2008-04-14 06:52] - [2008-04-14 06:52] - 0062464 ____A (Microsoft Corporation) 611F824E5C703A5A899F84C5F1699E4D
E:\WINDOWS\system32\svchost.exe
[2008-04-14 06:53] - [2008-04-14 06:53] - 0014336 ____A (Microsoft Corporation) 4FBC75B74479C7A6F829E0CA19DF3366
E:\WINDOWS\system32\rpcss.dll
[2008-04-14 06:52] - [2009-02-09 11:51] - 0401408 ____A (Microsoft Corporation) 3127AFBF2C1ED0AB14A1BBB7AAECB85B
E:\WINDOWS\system32\services.exe
[2008-04-14 06:53] - [2009-02-09 12:21] - 0111104 ____A (Microsoft Corporation) A3EDBE9053889FB24AB22492472B39DC
Extra List:
=======
Gpc(3) IPSec(5) NetBT(6) PSched(7) Tcpip(4)
0x0700000005000000010000000200000003000000040000000600000007000000
IpSec Tag value is correct.
**** End of log ****
Grüße |
| Themen zu XP Prof.: TR/Kazy.271313 und TR/Urausy.65024584 durch AV gefunden |
| adobe, antivir, antivirus, avg, avira, avira searchfree toolbar, browser, cdburnerxp, desktop, dllhost.exe, einstellungen, excel, farbar, farbar recovery scan tool, firefox, flash player, hdd0(c:, homepage, mozilla, ntdll.dll, officejet, prozesse, realtek, registry, scan, software, system, temp, tr/kazy.271313, tr/urausy.65024584, trojaner, usb, warnung, windows, windows xp |
Baum-Darstellung