![]() |
|
Plagegeister aller Art und deren Bekämpfung: Hilfe Phising-Attacke wsnpoem Trojaner!Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
![]() |
|
![]() | #1 |
| ![]() Hilfe Phising-Attacke wsnpoem Trojaner! Probier bitte mal das kostenlose McAfee Rootkit Detective und benenne die Datei ntos.exe mit dem Tool um. Anschließend soll ein Vierenscanner den Trojaner finden können. Ich konnte es (gott sei dank) noch nicht selber testen. Vielleicht hilfts. |
![]() | #2 |
![]() | ![]() Hilfe Phising-Attacke wsnpoem Trojaner! Ich finde keine ntos.exe auf meinem rechner?
__________________ |
![]() | #3 |
![]() ![]() ![]() ![]() ![]() | ![]() Hilfe Phising-Attacke wsnpoem Trojaner! Hi,
__________________das die ntos.exe nicht gefunden wird, ist genau das Problem! ntos.exe und wnpoem gehören mit audio.dll und video.dll zusammen, und dies alles ist nicht zu finden... Gehe bitte noch vor, wie weiter unten von mir beschrieben (Rootkitscann durchführen, Silentrunner etc.) Chris
__________________ |
![]() | #4 |
![]() | ![]() Hilfe Phising-Attacke wsnpoem Trojaner! Hi, habe das Programm runtergeladen und dann? Was/wie soll ich scannen? Nach dem scan steht da: Scan complete. Hidden registry keys/values: 15 |
![]() | #5 |
![]() ![]() ![]() ![]() ![]() | ![]() Hilfe Phising-Attacke wsnpoem Trojaner! Hi, poste das Log von BlackLight: Blacklight-Logfile posten. Sein Pfad wird etwa so lauten: C:\fsbl-xxxxxxxxxxxxxx.log, wobei die 'x' für Ziffern stehen ..- chris
__________________ ![]() ![]() Vor dem posten beachten! Spenden (Wer spenden will, kann sich gerne melden ![]() |
![]() | #6 |
![]() | ![]() Hilfe Phising-Attacke wsnpoem Trojaner! Hallo, also ich habe McAfee® Rootkit Detective auf chip heruntergeladen. Habe die Datei entpackt, auf dem Desktop habe ich jetzt einen McAfee® Rootkit Detective Ordern mit einer exe datei. Diese habe ich gestartet und habe meinen Rechner gescant. Danach habe ich in meinem Ordner den McAfee® Rootkit Detective Report in einer Textdatei. Hier der Inhalt: McAfee(R) Rootkit Detective 1.1 scan report On 09-11-2007 at 17:26:37 OS-Version 5.1.2600 Service Pack 2.0 ==================================== Object-Type: SSDT-hook Object-Name: ZwConnectPort Object-Path: C:\WINDOWS\system32\vsdatant.sys Object-Type: SSDT-hook Object-Name: ZwCreateFile Object-Path: C:\WINDOWS\system32\vsdatant.sys Object-Type: SSDT-hook Object-Name: ZwCreateKey Object-Path: C:\WINDOWS\system32\vsdatant.sys Object-Type: SSDT-hook Object-Name: ZwCreatePort Object-Path: C:\WINDOWS\system32\vsdatant.sys Object-Type: SSDT-hook Object-Name: ZwCreateProcess Object-Path: C:\WINDOWS\system32\vsdatant.sys Object-Type: SSDT-hook Object-Name: ZwCreateProcessEx Object-Path: C:\WINDOWS\system32\vsdatant.sys Object-Type: SSDT-hook Object-Name: ZwCreateSection Object-Path: C:\WINDOWS\system32\vsdatant.sys Object-Type: SSDT-hook Object-Name: ZwCreateThread Object-Path: (NULL) Object-Type: SSDT-hook Object-Name: ZwCreateWaitablePort Object-Path: C:\WINDOWS\system32\vsdatant.sys Object-Type: SSDT-hook Object-Name: ZwDeleteFile Object-Path: C:\WINDOWS\system32\vsdatant.sys Object-Type: SSDT-hook Object-Name: ZwDeleteKey Object-Path: C:\WINDOWS\system32\vsdatant.sys Object-Type: SSDT-hook Object-Name: ZwDeleteValueKey Object-Path: C:\WINDOWS\system32\vsdatant.sys Object-Type: SSDT-hook Object-Name: ZwDuplicateObject Object-Path: C:\WINDOWS\system32\vsdatant.sys Object-Type: SSDT-hook Object-Name: ZwEnumerateKey Object-Path: C:\WINDOWS\system32\drivers\sptd.sys Object-Type: SSDT-hook Object-Name: ZwEnumerateValueKey Object-Path: C:\WINDOWS\system32\drivers\sptd.sys Object-Type: SSDT-hook Object-Name: ZwLoadKey2 Object-Path: C:\WINDOWS\system32\vsdatant.sys Object-Type: SSDT-hook Object-Name: ZwOpenFile Object-Path: C:\WINDOWS\system32\vsdatant.sys Object-Type: SSDT-hook Object-Name: ZwOpenKey Object-Path: C:\WINDOWS\system32\drivers\sptd.sys Object-Type: SSDT-hook Object-Name: ZwOpenProcess Object-Path: (NULL) Object-Type: SSDT-hook Object-Name: ZwOpenThread Object-Path: (NULL) Object-Type: SSDT-hook Object-Name: ZwQueryKey Object-Path: C:\WINDOWS\system32\drivers\sptd.sys Object-Type: SSDT-hook Object-Name: ZwQueryValueKey Object-Path: C:\WINDOWS\system32\drivers\sptd.sys Object-Type: SSDT-hook Object-Name: ZwRenameKey Object-Path: C:\WINDOWS\system32\vsdatant.sys Object-Type: SSDT-hook Object-Name: ZwReplaceKey Object-Path: C:\WINDOWS\system32\vsdatant.sys Object-Type: SSDT-hook Object-Name: ZwRequestWaitReplyPort Object-Path: C:\WINDOWS\system32\vsdatant.sys Object-Type: SSDT-hook Object-Name: ZwRestoreKey Object-Path: C:\WINDOWS\system32\vsdatant.sys Object-Type: SSDT-hook Object-Name: ZwSecureConnectPort Object-Path: C:\WINDOWS\system32\vsdatant.sys Object-Type: SSDT-hook Object-Name: ZwSetInformationFile Object-Path: C:\WINDOWS\system32\vsdatant.sys Object-Type: SSDT-hook Object-Name: ZwSetValueKey Object-Path: C:\WINDOWS\system32\vsdatant.sys Object-Type: SSDT-hook Object-Name: ZwTerminateProcess Object-Path: (NULL) Object-Type: SSDT-hook Object-Name: ZwWriteVirtualMemory Object-Path: (NULL) Object-Type: IRP-hook Object-Name: \Driver\Ftdisk->IRP_MJ_SYSTEM_CONTROL Object-Path: Object-Type: IRP-hook Object-Name: \Driver\Ftdisk->IRP_MJ_POWER Object-Path: Object-Type: IRP-hook Object-Name: \Driver\Ftdisk->IRP_MJ_CLEANUP Object-Path: Object-Type: IRP-hook Object-Name: \Driver\Ftdisk->IRP_MJ_SHUTDOWN Object-Path: Object-Type: IRP-hook Object-Name: \Driver\Ftdisk->IRP_MJ_INTERNAL_DEVICE_CONTROL Object-Path: Object-Type: IRP-hook Object-Name: \Driver\Ftdisk->IRP_MJ_DEVICE_CONTROL Object-Path: Object-Type: IRP-hook Object-Name: \Driver\Ftdisk->IRP_MJ_FLUSH_BUFFERS Object-Path: Object-Type: IRP-hook Object-Name: \Driver\Ftdisk->IRP_MJ_WRITE Object-Path: Object-Type: IRP-hook Object-Name: \Driver\Ftdisk->IRP_MJ_READ Object-Path: Object-Type: IRP-hook Object-Name: \Driver\Ftdisk->IRP_MJ_CREATE Object-Path: Object-Type: IRP-hook Object-Name: \Driver\Tcpip->IRP_MJ_CLEANUP Object-Path: \SystemRoot\System32\vsdatant.sys Object-Type: IRP-hook Object-Name: \Driver\Tcpip->IRP_MJ_INTERNAL_DEVICE_CONTROL Object-Path: \SystemRoot\System32\vsdatant.sys Object-Type: IRP-hook Object-Name: \Driver\Tcpip->IRP_MJ_DEVICE_CONTROL Object-Path: \SystemRoot\System32\vsdatant.sys Object-Type: IRP-hook Object-Name: \Driver\Tcpip->IRP_MJ_CLOSE Object-Path: \SystemRoot\System32\vsdatant.sys Object-Type: IRP-hook Object-Name: \Driver\Tcpip->IRP_MJ_CREATE Object-Path: \SystemRoot\System32\vsdatant.sys Object-Type: Registry-value Object-Name: (Default) Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg Status: Unable to access registry key Object-Type: Registry-key Object-Name: 19659239224E364682FA4BAF72C53EA4td\Cfg Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 Status: Hidden Object-Type: Registry-value Object-Name: (Default) Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 Status: Unable to access registry key Object-Type: Registry-value Object-Name: h0 Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 Status: Hidden Object-Type: Registry-value Object-Name: khjeh Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 Status: Hidden Object-Type: Registry-value Object-Name: s1 Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg Status: Hidden Object-Type: Registry-value Object-Name: s2 Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg Status: Hidden Object-Type: Registry-value Object-Name: g0 Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg Status: Hidden Object-Type: Registry-value Object-Name: h0 Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg Status: Hidden Object-Type: Registry-key Object-Name: 19659239224E364682FA4BAF72C53EA4td\Cfg Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 Status: Hidden Object-Type: Registry-value Object-Name: (Default) Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg Status: Unable to access registry key Object-Type: Registry-key Object-Name: 19659239224E364682FA4BAF72C53EA4td\Cfg Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 Status: Hidden Object-Type: Registry-value Object-Name: (Default) Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 Status: Unable to access registry key Object-Type: Registry-value Object-Name: h0 Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 Status: Hidden Object-Type: Registry-value Object-Name: khjeh Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 Status: Hidden Object-Type: Registry-value Object-Name: s1 Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg Status: Hidden Object-Type: Registry-value Object-Name: s2 Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg Status: Hidden Object-Type: Registry-value Object-Name: g0 Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg Status: Hidden Object-Type: Registry-value Object-Name: h0 Object-Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg Status: Hidden Object-Type: Process Object-Name: jusched.exe Pid: 3316 Object-Path: C:\Programme\Java\jre1.6.0_02\bin\jusched.exe Status: Visible Object-Type: Process Object-Name: svchost.exe Pid: 1332 Object-Path: C:\WINDOWS\system32\svchost.exe Status: Visible Object-Type: Process Object-Name: sched.exe Pid: 712 Object-Path: C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe Status: Visible Object-Type: Process Object-Name: System Idle Process Pid: 0 Object-Path: Status: Visible Object-Type: Process Object-Name: E_FATIAEE.EXE Pid: 3412 Object-Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAEE.EXE Status: Visible Object-Type: Process Object-Name: svchost.exe Pid: 1304 Object-Path: C:\WINDOWS\system32\svchost.exe Status: Visible Object-Type: Process Object-Name: atiptaxx.exe Pid: 2916 Object-Path: C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe Status: Visible Object-Type: Process Object-Name: explorer.exe Pid: 1616 Object-Path: C:\WINDOWS\Explorer.EXE Status: Visible Object-Type: Process Object-Name: System Pid: 4 Object-Path: Status: Visible Object-Type: Process Object-Name: services.exe Pid: 904 Object-Path: C:\WINDOWS\system32\services.exe Status: Visible Object-Type: Process Object-Name: SOUNDMAN.EXE Pid: 3076 Object-Path: C:\WINDOWS\SOUNDMAN.EXE Status: Visible Object-Type: Process Object-Name: iexplore.exe Pid: 2332 Object-Path: C:\Programme\Internet Explorer\iexplore.exe Status: Visible Object-Type: Process Object-Name: svchost.exe Pid: 1092 Object-Path: C:\WINDOWS\system32\svchost.exe Status: Visible Object-Type: Process Object-Name: svchost.exe Pid: 1216 Object-Path: C:\WINDOWS\System32\svchost.exe Status: Visible Object-Type: Process Object-Name: alg.exe Pid: 2456 Object-Path: C:\WINDOWS\System32\alg.exe Status: Visible Object-Type: Process Object-Name: SynTPEnh.exe Pid: 3016 Object-Path: C:\Programme\Synaptics\SynTP\SynTPEnh.exe Status: Visible Object-Type: Process Object-Name: zlclient.exe Pid: 3388 Object-Path: C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe Status: Visible Object-Type: Process Object-Name: iexplore.exe Pid: 3144 Object-Path: C:\Programme\Internet Explorer\iexplore.exe Status: Visible Object-Type: Process Object-Name: Rootkit_Detecti Pid: 3300 Object-Path: C:\Dokumente und Einstellungen\Pielot\Desktop\McafeeRootkitDetective\Rootkit_Detective.exe Status: Visible Object-Type: Process Object-Name: avgnt.exe Pid: 3364 Object-Path: C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe Status: Visible Object-Type: Process Object-Name: spoolsv.exe Pid: 2000 Object-Path: C:\WINDOWS\system32\spoolsv.exe Status: Visible Object-Type: Process Object-Name: lsass.exe Pid: 916 Object-Path: C:\WINDOWS\system32\lsass.exe Status: Visible Object-Type: Process Object-Name: ati2evxx.exe Pid: 1536 Object-Path: C:\WINDOWS\SYSTEM32\Ati2evxx.exe Status: Visible Object-Type: Process Object-Name: csrss.exe Pid: 824 Object-Path: C:\WINDOWS\system32\csrss.exe Status: Visible Object-Type: Process Object-Name: GoogleToolbarNo Pid: 3460 Object-Path: C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe Status: Visible Object-Type: Process Object-Name: svchost.exe Pid: 732 Object-Path: C:\WINDOWS\System32\svchost.exe Status: Visible Object-Type: Process Object-Name: vsmon.exe Pid: 1352 Object-Path: C:\WINDOWS\system32\ZoneLabs\vsmon.exe Status: Visible Object-Type: Process Object-Name: svchost.exe Pid: 920 Object-Path: C:\WINDOWS\system32\svchost.exe Status: Visible Object-Type: Process Object-Name: ati2evxx.exe Pid: 1076 Object-Path: C:\WINDOWS\system32\Ati2evxx.exe Status: Visible Object-Type: Process Object-Name: winlogon.exe Pid: 860 Object-Path: C:\WINDOWS\SYSTEM32\winlogon.exe Status: Visible Object-Type: Process Object-Name: MDM.EXE Pid: 736 Object-Path: C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE Status: Visible Object-Type: Process Object-Name: ctfmon.exe Pid: 3404 Object-Path: C:\WINDOWS\system32\ctfmon.exe Status: Visible Object-Type: Process Object-Name: smss.exe Pid: 772 Object-Path: C:\WINDOWS\System32\smss.exe Status: Visible Object-Type: Process Object-Name: svchost.exe Pid: 1176 Object-Path: C:\WINDOWS\system32\svchost.exe Status: Visible Object-Type: Process Object-Name: avguard.exe Pid: 2044 Object-Path: C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe Status: Visible Object-Type: Process Object-Name: wdfmgr.exe Pid: 1300 Object-Path: C:\WINDOWS\system32\wdfmgr.exe Status: Visible Scan complete. Hidden registry keys/values: 15 |
![]() |
Themen zu Hilfe Phising-Attacke wsnpoem Trojaner! |
adobe, antivir, avira, bho, desktop, drivers, e-banking, einstellungen, excel, explorer, google, handel, hijack, hijackthis, hkus\s-1-5-18, icq, internet, internet explorer, logfile, mehrere, microsoft, nicht sicher, object, programme, s-1-5-18, shockwave, software, system, trend micro, trojaner, urlsearchhook, usb, virensoftware, windows, windows xp |