![]() |
|
Plagegeister aller Art und deren Bekämpfung: mit verschiedenen Trojanern infiziert (VundoGen etc.)Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
![]() |
|
![]() | #1 |
![]() | ![]() mit verschiedenen Trojanern infiziert (VundoGen etc.) Hallo, könntest du vielleicht heute noch zurückschreiben? Ich brauche den Rechner ziemlich dringend. Vielen Dank dafür! |
![]() | #2 | |
Administrator > Competence Manager | ![]() mit verschiedenen Trojanern infiziert (VundoGen etc.)Zitat:
![]() Bitte abarbeiten: ComboFix
__________________ |
![]() | #3 |
![]() | ![]() mit verschiedenen Trojanern infiziert (VundoGen etc.) Hallo,
__________________hier die ComboFix-Log: ComboFix 08-05-12.1 - *** 2008-05-15 20:13:06.4 - NTFSx86 Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1031.18.1149 [GMT 2:00] ausgeführt von:: C:\Users\***\Desktop\Trojaner\ComboFix.exe . (((((((((((((((((((((((((((((((((((( Weitere L”schungen )))))))))))))))))))))))))))))))))))))))))))))))) . C:\Windows\System32\OrBKRXbc.ini C:\Windows\System32\OrBKRXbc.ini2 . ((((((((((((((((((((((( Dateien erstellt von 2008-04-15 bis 2008-05-15 )))))))))))))))))))))))))))))) . 2008-05-15 20:17 . 2008-05-13 11:32 57,344 --a------ C:\Windows\System32\qoMdEUOI.dll 2008-05-15 14:42 . 2008-05-15 14:42 134,208 --a------ C:\Windows\System32\cnecgudk.dll 2008-05-15 14:40 . 2008-05-15 14:40 126,528 --a------ C:\Windows\System32\xsalgnuu.dll 2008-05-15 14:39 . 2008-05-15 14:39 <DIR> d-------- C:\VundoFix Backups 2008-05-15 14:04 . 2008-05-15 14:04 <DIR> d-------- C:\Program Files\CCleaner 2008-05-15 12:56 . 2008-05-05 20:46 27,048 --a------ C:\Windows\System32\drivers\mbamcatchme.sys 2008-05-15 12:56 . 2008-05-05 20:46 15,864 --a------ C:\Windows\System32\drivers\mbam.sys 2008-05-15 11:02 . 2008-05-15 11:02 <DIR> d-------- C:\Users\***\AppData\Roaming\Malwarebytes 2008-05-15 11:02 . 2008-05-15 11:02 <DIR> d-------- C:\Users\All Users\Malwarebytes 2008-05-15 11:02 . 2008-05-15 11:02 <DIR> d-------- C:\ProgramData\Malwarebytes 2008-05-15 11:02 . 2008-05-15 12:56 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-05-15 10:51 . 2008-05-15 20:17 954 ---hs---- C:\Windows\System32\nwljupjq.ini 2008-05-15 09:58 . 2008-05-15 09:58 113,664 --a------ C:\Windows\System32\qjpujlwn.dll 2008-05-15 09:52 . 2008-05-15 09:52 123,392 --a------ C:\Windows\System32\pukvhypy.dll 2008-05-14 14:06 . 2008-05-14 14:06 <DIR> dr------- C:\Windows\System32\config\systemprofile\Documents 2008-05-14 13:24 . 2008-05-14 13:24 <DIR> d-------- C:\Users\All Users\Office Genuine Advantage 2008-05-14 13:24 . 2008-05-14 13:24 <DIR> d-------- C:\ProgramData\Office Genuine Advantage 2008-05-13 17:35 . 2008-03-05 15:56 3,786,760 --a------ C:\Windows\System32\D3DX9_37.dll 2008-05-13 17:35 . 2008-03-05 15:56 1,420,824 --a------ C:\Windows\System32\D3DCompiler_37.dll 2008-05-13 17:35 . 2008-03-05 16:03 479,752 --a------ C:\Windows\System32\XAudio2_0.dll 2008-05-13 17:35 . 2008-02-05 23:07 462,864 --a------ C:\Windows\System32\d3dx10_37.dll 2008-05-13 17:35 . 2008-03-05 16:03 238,088 --a------ C:\Windows\System32\xactengine3_0.dll 2008-05-13 17:35 . 2008-03-05 16:00 25,608 --a------ C:\Windows\System32\X3DAudio1_3.dll 2008-05-13 17:28 . 2008-05-13 17:28 <DIR> d-------- C:\Program Files\LucasArts 2008-05-13 11:37 . 2008-05-13 11:37 370,176 --a------ C:\Windows\System32\cbXRKBrO.dll 2008-05-13 11:32 . 2008-05-15 13:42 <DIR> d-------- C:\Program Files\DiskTrix 2008-05-05 16:05 . 2008-05-15 12:45 <DIR> d-------- C:\Users\***\AppData\Roaming\skypePM 2008-05-05 16:05 . 2008-05-05 16:05 56 --ah----- C:\Windows\System32\ezsidmv.dat 2008-05-05 16:04 . 2008-05-15 14:20 <DIR> d-------- C:\Users\***\AppData\Roaming\Skype 2008-05-05 16:03 . 2008-05-05 16:03 <DIR> d-------- C:\Users\All Users\Skype 2008-05-05 16:03 . 2008-05-05 16:03 <DIR> d-------- C:\ProgramData\Skype 2008-05-05 16:03 . 2008-05-05 16:03 <DIR> d-------- C:\Program Files\Skype 2008-05-05 16:03 . 2008-05-05 16:03 <DIR> d-------- C:\Program Files\Common Files\Skype 2008-04-21 09:55 . 2008-04-21 09:55 <DIR> d-------- C:\Users\All Users\Apple 2008-04-21 09:55 . 2008-04-21 09:55 <DIR> d-------- C:\ProgramData\Apple 2008-04-21 09:55 . 2008-04-21 09:55 <DIR> d-------- C:\Program Files\Apple Software Update 2008-04-18 21:53 . 2008-04-18 22:21 <DIR> d-------- C:\Users\All Users\TrackMania 2008-04-18 21:53 . 2008-04-18 22:21 <DIR> d-------- C:\ProgramData\TrackMania 2008-04-17 21:32 . 2008-04-17 21:33 <DIR> d-------- C:\Program Files\CDex_170b2 2008-04-16 15:42 . 2008-04-16 15:45 <DIR> d-------- C:\Program Files\TmNationsForever 2008-04-15 21:01 . 2008-04-15 21:01 <DIR> d-------- C:\Users\***\AppData\Roaming\Ubisoft 2008-04-15 20:46 . 2008-04-15 20:46 <DIR> d-------- C:\Users\All Users\Ubisoft 2008-04-15 20:46 . 2008-04-15 20:46 <DIR> d-------- C:\ProgramData\Ubisoft 2008-04-15 20:33 . 2008-04-15 20:33 <DIR> d-------- C:\Program Files\Ubisoft 2008-04-15 20:32 . 2008-04-15 20:32 <DIR> d-------- C:\Users\***\AppData\Roaming\InstallShield 2008-04-15 20:32 . 2008-04-15 20:32 54,156 --ah----- C:\Windows\QTFont.qfn 8 Datei(en), . 247,757 C:\ComboFix\Bytes 8 Datei(en), . 247,757 C:\ComboFix\Bytes . (((((((((((((((((((((((((((((((((((( Find3M Bericht )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-05-15 18:17 352,614 ---ha-w C:\Windows\system32\drivers\vsconfig.xml 2008-05-15 16:49 --------- d-----w C:\Program Files\Windows Mail 2008-05-15 16:32 --------- d-----w C:\ProgramData\Microsoft Help 2008-05-15 11:36 --------- d-----w C:\ProgramData\Google Updater 2008-05-14 17:01 62,056 ----a-w C:\Users\***\AppData\Roaming\nvModes.dat 2008-05-13 15:56 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-04-21 07:56 --------- d-----w C:\Program Files\ICQ6 2008-04-12 09:33 --------- d-----w C:\Program Files\Double Fine Productions 2008-04-09 18:51 --------- d-----w C:\ProgramData\Media Center Programs 2008-04-06 21:40 --------- d-----w C:\Program Files\QuickTime 2008-04-06 21:39 --------- d-----w C:\ProgramData\Apple Computer 2008-04-03 11:28 --------- d--h--w C:\ProgramData\{0E8E33D8-193A-414A-A909-0F101A142D26} 2008-04-03 11:25 --------- d-----w C:\Program Files\Stardock Games 2008-04-03 08:56 --------- d-----w C:\Program Files\Crazy Machines II 2008-03-31 11:07 --------- d-----w C:\Program Files\HP 2008-03-29 11:18 0 ---ha-w C:\Windows\system32\drivers\Msft_Kernel_ggsemc_01005.Wdf 2008-03-28 13:39 20,520 ----a-w C:\Windows\system32\drivers\ggsemc.sys 2008-03-28 13:39 13,352 ----a-w C:\Windows\system32\drivers\ggflt.sys 2008-03-28 13:39 1,419,232 ----a-w C:\Windows\System32\wdfcoinstaller01005.dll 2008-03-28 13:33 --------- d-----w C:\ProgramData\Sony Ericsson 2008-03-28 13:31 --------- d-----w C:\Program Files\Sony Ericsson 2008-03-28 09:43 0 ---ha-w C:\Windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf 2008-03-26 18:25 --------- d-----w C:\Program Files\Google 2008-03-25 17:30 --------- d-----w C:\ProgramData\NVIDIA 2008-03-25 17:28 174 --sha-w C:\Program Files\desktop.ini 2008-03-25 17:20 --------- d-----w C:\Program Files\Windows Sidebar 2008-03-25 17:20 --------- d-----w C:\Program Files\Windows Photo Gallery 2008-03-25 17:20 --------- d-----w C:\Program Files\Windows Journal 2008-03-25 17:20 --------- d-----w C:\Program Files\Windows Defender 2008-03-25 17:20 --------- d-----w C:\Program Files\Windows Collaboration 2008-03-25 17:20 --------- d-----w C:\Program Files\Windows Calendar 2008-03-25 16:57 82,432 ----a-w C:\Windows\System32\axaltocm.dll 2008-03-25 16:57 101,888 ----a-w C:\Windows\System32\ifxcardm.dll 2008-03-21 15:13 --------- d-----w C:\Program Files\The FilmMachine 2008-03-21 13:38 --------- d-----w C:\Users\***\AppData\Roaming\Media Player Classic 2008-03-21 13:35 --------- d-----w C:\Program Files\K-Lite Codec Pack 2008-03-21 13:13 --------- d-----w C:\Program Files\AviSynth 2.5 2008-03-21 10:28 --------- d-----w C:\Users\***\AppData\Roaming\Nero 2008-03-21 10:25 --------- d-----w C:\Program Files\Common Files\Nero 2008-03-21 10:22 --------- d-----w C:\ProgramData\Nero 2008-03-21 10:22 --------- d-----w C:\Program Files\Nero 2008-03-20 17:12 --------- d-----w C:\Program Files\THQ 2008-03-20 16:53 107,888 ----a-w C:\Windows\System32\CmdLineExt.dll 2008-03-20 12:31 --------- d-----w C:\Program Files\NeroInstall.bak 2008-03-13 13:40 413,696 ----a-w C:\Windows\System32\wrap_oal.dll 2008-03-13 13:40 110,592 ----a-w C:\Windows\System32\OpenAL32.dll 2008-03-03 13:05 54,672 ----a-w C:\Windows\System32\vsutil_loc0407.dll 2008-03-03 13:05 1,086,952 ----a-w C:\Windows\System32\zpeng24.dll 2008-02-29 07:14 19,000 ----a-w C:\Windows\System32\kd1394.dll 2008-02-29 07:11 988,216 ----a-w C:\Windows\System32\winload.exe 2008-02-29 07:11 927,288 ----a-w C:\Windows\System32\winresume.exe 2008-02-29 06:53 46,592 ----a-w C:\Windows\System32\setbcdlocale.dll 2008-02-29 06:53 40,960 ----a-w C:\Windows\System32\srclient.dll 2008-02-29 06:53 378,368 ----a-w C:\Windows\System32\srcore.dll 2008-02-29 06:35 6,656 ----a-w C:\Windows\System32\kbd106n.dll 2008-02-29 04:21 2,032,128 ----a-w C:\Windows\System32\win32k.sys 2008-02-29 04:12 318,464 ----a-w C:\Windows\System32\rstrui.exe 2008-02-29 04:12 14,848 ----a-w C:\Windows\System32\srdelayed.exe 2008-02-28 16:38 972,072 ----a-w C:\Windows\UNNeroMediaHome.exe 2008-02-26 15:14 972,072 ----a-w C:\Windows\UNRecode.exe 2008-02-22 05:05 615,992 ----a-w C:\Windows\System32\ci.dll 2008-02-22 05:01 826,880 ----a-w C:\Windows\System32\wininet.dll 2008-02-22 04:57 295,936 ----a-w C:\Windows\System32\gdi32.dll 2008-02-20 20:16 1,370,112 ----a-w C:\Windows\Internet Logs\xDBACD1.tmp 2008-02-18 15:04 95,600 ----a-w C:\Windows\System32\NeroCo.dll 2007-11-16 17:04 22,328 ----a-w C:\Users\***\AppData\Roaming\PnkBstrK.sys 2007-10-17 07:17 76 --sh--r C:\Windows\CT4CET.bin 2006-05-03 09:06 163,328 --sh--r C:\Windows\System32\flvDX.dll 2007-02-21 10:47 31,232 --sh--r C:\Windows\System32\msfDX.dll . ------- Sigcheck ------- . ((((((((((((((((((((((((((((( snapshot_2008-05-15_14.34.55.66 ))))))))))))))))))))))))))))))))))))))))) . - 2008-05-15 12:31:09 67,584 --s-a-w C:\Windows\bootstat.dat + 2008-05-15 18:17:08 67,584 --s-a-w C:\Windows\bootstat.dat + 2008-05-15 18:13:02 6,225,920 ----a-w C:\Windows\erdnt\Hiv-backup\schema.dat + 2008-05-15 18:15:14 6,225,920 ----a-w C:\Windows\erdnt\subs\schema.dat - 2008-04-08 20:42:01 1,165,584 ----a-r C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\accicons.exe + 2008-05-15 16:32:09 1,165,584 ----a-r C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\accicons.exe - 2008-04-08 20:42:01 20,240 ----a-r C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\cagicon.exe + 2008-05-15 16:32:09 20,240 ----a-r C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\cagicon.exe - 2008-04-08 20:42:01 159,504 ----a-r C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\inficon.exe + 2008-05-15 16:32:09 159,504 ----a-r C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\inficon.exe - 2008-04-08 20:42:01 184,080 ----a-r C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\joticon.exe + 2008-05-15 16:32:09 184,080 ----a-r C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\joticon.exe - 2008-04-08 20:42:01 217,864 ----a-r C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\misc.exe + 2008-05-15 16:32:09 217,864 ----a-r C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\misc.exe - 2008-04-08 20:42:01 18,704 ----a-r C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\mspicons.exe + 2008-05-15 16:32:09 18,704 ----a-r C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\mspicons.exe - 2008-04-08 20:42:01 35,088 ----a-r C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\oisicon.exe + 2008-05-15 16:32:09 35,088 ----a-r C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\oisicon.exe - 2008-04-08 20:42:01 845,584 ----a-r C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\outicon.exe + 2008-05-15 16:32:09 845,584 ----a-r C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\outicon.exe - 2008-04-08 20:42:01 922,384 ----a-r C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pptico.exe + 2008-05-15 16:32:09 922,384 ----a-r C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pptico.exe - 2008-04-08 20:42:01 272,648 ----a-r C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pubs.exe + 2008-05-15 16:32:09 272,648 ----a-r C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pubs.exe - 2008-04-08 20:42:01 888,080 ----a-r C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\wordicon.exe + 2008-05-15 16:32:09 888,080 ----a-r C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\wordicon.exe - 2008-04-08 20:42:01 1,172,240 ----a-r C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\xlicons.exe + 2008-05-15 16:32:09 1,172,240 ----a-r C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\xlicons.exe - 2008-05-15 12:29:14 262,144 ----a-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\UsrClass.dat + 2008-05-15 16:44:40 262,144 ----a-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\UsrClass.dat - 2008-05-15 12:31:22 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\ntuser.dat + 2008-05-15 18:17:28 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\ntuser.dat + 2008-05-15 18:17:28 262,144 ---ha-w C:\Windows\ServiceProfiles\LocalService\ntuser.dat.LOG1 - 2008-05-15 12:23:32 262,144 ----a-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\UsrClass.dat + 2008-05-15 16:48:58 262,144 ----a-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\UsrClass.dat - 2008-05-15 12:31:22 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.dat + 2008-05-15 18:17:28 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.dat + 2008-05-15 18:17:28 262,144 ---ha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1 + 2008-05-15 16:29:49 2,366 ----a-w C:\Windows\SoftwareDistribution\EventCache\{CA182A7E-E3E2-4480-846F-07D23AB5D591}.bin - 2008-05-15 12:31:17 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2008-05-15 18:17:54 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2008-05-15 12:31:17 49,152 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2008-05-15 18:17:54 49,152 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2008-05-15 12:31:17 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2008-05-15 18:17:54 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2008-04-06 05:56:20 19,836,024 ----a-w C:\Windows\System32\mrt.exe + 2008-05-09 21:35:04 16,863,864 ----a-w C:\Windows\System32\mrt.exe - 2008-05-15 12:21:55 123,658 ----a-w C:\Windows\System32\perfc007.dat + 2008-05-15 16:49:43 123,658 ----a-w C:\Windows\System32\perfc007.dat - 2008-05-15 12:21:55 101,916 ----a-w C:\Windows\System32\perfc009.dat + 2008-05-15 16:49:43 102,094 ----a-w C:\Windows\System32\perfc009.dat - 2008-05-15 12:21:55 621,940 ----a-w C:\Windows\System32\perfh007.dat + 2008-05-15 16:49:43 621,940 ----a-w C:\Windows\System32\perfh007.dat - 2008-05-15 12:21:55 589,904 ----a-w C:\Windows\System32\perfh009.dat + 2008-05-15 16:49:43 590,082 ----a-w C:\Windows\System32\perfh009.dat - 2008-05-15 12:12:09 6,225,920 ----a-w C:\Windows\System32\SMI\Store\Machine\schema.dat + 2008-05-15 18:15:14 6,225,920 ----a-w C:\Windows\System32\SMI\Store\Machine\schema.dat - 2008-05-15 12:16:25 8,988 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3039615548-3396779488-269229600-1000_UserData.bin + 2008-05-15 16:44:04 9,186 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3039615548-3396779488-269229600-1000_UserData.bin - 2008-05-15 12:16:24 87,672 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin + 2008-05-15 16:44:03 87,898 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin - 2008-05-15 12:16:14 61,094 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin + 2008-05-15 16:43:57 61,154 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin + 2008-04-16 00:49:12 2,413,032 ----a-w C:\Windows\winsxs\x86_microsoft-windows-oespamfilter-dat_31bf3856ad364e35_6.0.6000.16674_none_f05a2d326e88eb29\OESpamFilter.dat + 2008-04-16 00:44:28 2,413,032 ----a-w C:\Windows\winsxs\x86_microsoft-windows-oespamfilter-dat_31bf3856ad364e35_6.0.6000.20815_none_f125abb58774f9cb\OESpamFilter.dat + 2008-04-16 00:44:37 2,413,032 ----a-w C:\Windows\winsxs\x86_microsoft-windows-oespamfilter-dat_31bf3856ad364e35_6.0.6001.18054_none_f2560bb06b9f4438\OESpamFilter.dat + 2008-04-16 00:43:45 2,413,032 ----a-w C:\Windows\winsxs\x86_microsoft-windows-oespamfilter-dat_31bf3856ad364e35_6.0.6001.22159_none_f2e4a9ed84b862b5\OESpamFilter.dat . -- Snapshot reset to current date -- . (((((((((((((((((((((((((((( Autostart Punkte der Registrierung )))))))))))))))))))))))))))))))))))))))) . . |
![]() | #4 |
![]() | ![]() mit verschiedenen Trojanern infiziert (VundoGen etc.) ComboFix Teil 2: REGEDIT4 *Hinweis* leere Eintrage & legitime Standardeintrage werden nicht angezeigt. [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E50D29B8-E3A5-446C-972F-B78CEF715BC5}] 2008-05-13 11:37 370176 --a------ C:\Windows\system32\cbXRKBrO.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{f8d3a4aa-f252-4e99-9eae-3fed9491f38c}] 2008-05-15 14:42 134208 --a------ C:\Windows\system32\cnecgudk.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [2007-03-15 13:09 460784] "ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-19 09:33 125952] "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 12:34 5724184] "DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [2007-11-15 10:23 202544] "IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-02-28 18:07 1828136] "DAEMON Tools Pro Agent"="C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 15:08 136136] "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 09:33 202240] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSServer"="C:\Windows\system32\qoMdEUOI.dll" [2008-05-13 11:32 57344] "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2008-01-19 09:38 1008184] "ECenter"="C:\Dell\E-Center\EULALauncher.exe" [2007-05-25 08:03 17920] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2007-05-23 07:34 857648] "OEM02Mon.exe"="C:\Windows\OEM02Mon.exe" [2007-08-29 07:54 36864] "SunJavaUpdateSched"="c:\Program Files\Java\jre1.6.0\bin\jusched.exe" [2007-10-17 09:14 77824] "DELL Webcam Manager"="C:\Program Files\Dell\Dell Webcam Manager\DellWMgr.exe" [2007-07-27 17:43 118784] "Launch LCDMon"="C:\Program Files\Common Files\Logitech\LCD Manager\LCDMon.exe" [2007-07-18 15:26 775952] "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2006-10-03 12:37 81920] "RoxWatchTray"="C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2006-11-05 12:22 221184] "PCMService"="C:\Program Files\Dell\MediaDirect\PCMService.exe" [2007-04-16 17:10 184320] "dscactivate"="C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 10:24 16384] "Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-10-17 09:38 1862144] "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-04-17 16:59 262401] "razer"="C:\Program Files\Razer\razerhid.exe" [2005-05-17 19:21 147456] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 22:52 49152] "Adobe Photo Downloader"="C:\Program Files\Adobe\Adobe Photoshop Lightroom 1.3\apdproxy.exe" [2007-12-04 03:07 61440] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792] "ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-03-03 15:05 959976] "NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-02-18 17:29 2221352] "SigmatelSysTrayApp"="C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe" [2007-09-07 11:23 405504] "NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-10-04 22:24 86016] "NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-10-04 22:24 8497696] "NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-10-04 22:24 81920] "NVHotkey"="C:\Windows\system32\nvHotkey.dll" [2007-10-04 22:24 86016] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696] "2204b1e7"="C:\Windows\system32\qjpujlwn.dll" [2008-05-15 09:58 113664] "BM2137827b"="C:\Windows\system32\xsalgnuu.dll" [2008-05-15 14:40 126528] "DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [2007-11-15 10:23 202544] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2008-03-22 00:13:16 125624] HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2007-01-02 22:40:10 210520] PDFCreator.lnk - C:\Program Files\PDFCreator\PDFCreator.exe [2008-02-09 14:40:55 2641920] QuickSet.lnk - C:\Program Files\Dell\QuickSet\quickset.exe [2007-07-10 22:19:24 1180952] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{2AA0726C-95B7-4216-AA43-B5BDD524892F}"= C:\Windows\system32\qoMdEUOI.dll [2008-05-13 11:32 57344] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.i420"= i420vfw.dll "vidc.yv12"= yv12vfw.dll "msacm.l3fhg"= mp3fhg.acm "msacm.divxa32"= divxa32.acm "VIDC.X264"= x264vfw.dll "VIDC.HFYU"= huffyuv.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdVantage Setup] C:\Program Files\DAEMON Tools\AdVantageSetup.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3039615548-3396779488-269229600-1000] "EnableNotificationsRef"=dword:00000002 "EnableNotifications"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{C7D53B8E-EA77-4D96-B36B-C617CDB8686F}"= C:\Program Files\Dell\MediaDirect\PowerCinema.exe:CyberLink PowerCinema "{E83A3957-59E0-442F-863F-5496D736BFA8}"= C:\Program Files\Dell\MediaDirect\PCMService.exe:CyberLink PowerCinema Resident Program "{E4EF0566-FD20-475C-89F3-07439A3513AB}"= C:\Program Files\Dell\MediaDirect\Kernel\DMP\CLBrowserEngine.exe:Cyberlink Media Server Browser Engine "{323E34C2-2DA2-4994-853F-052A563194DF}"= C:\Program Files\Dell\MediaDirect\Kernel\DMS\CLMSService.exe:CyberLink Media Server "{02245255-FFB9-464C-B4EA-0A69ED922F95}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook "{BAEF8C3B-7DD0-4049-90EF-370151673BC1}"= UDP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{7E5FE2F5-2695-4FCB-A696-CA9237B2C438}"= TCP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{22897FBD-0FB6-49C3-A20B-4CB33E3F2239}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{48AC8F7F-5DDC-47F5-9323-58B51F83CDF6}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "TCP Query User{563022F6-DDDF-42A0-A9C0-93A0E7AEBD89}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer "UDP Query User{04D567FD-2BE1-408C-A3D2-2987E2B89FDD}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer "{A283DDD0-3323-4AC3-9060-109FB7D29CAA}"= UDP:C:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\Crysis.exe:Crysis_32 "{18B0FE4D-53C3-4EA5-BF23-5AB9247C3C2B}"= TCP:C:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\Crysis.exe:Crysis_32 "{4673354A-FA89-4D39-B64E-14BB246DD0FE}"= UDP:C:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\CrysisDedicatedServer.exe:CrysisDedicatedServer_32 "{B3DA8712-E4A0-434F-97CE-38CE6CF06D6E}"= TCP:C:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\CrysisDedicatedServer.exe:CrysisDedicatedServer_32 "{817DFA6F-A647-4190-B75B-39353A77FD46}"= UDP:C:\Windows\System32\PnkBstrA.exe:PnkBstrA "{F32F758C-F57F-4FB6-8F62-0A4966BDBC17}"= TCP:C:\Windows\System32\PnkBstrA.exe:PnkBstrA "{A62C46F1-CB33-4FA1-9C6A-8F8B07C66D4D}"= UDP:C:\Windows\System32\PnkBstrB.exe:PnkBstrB "{627C14AD-D105-4F3F-A245-1F5D4295949C}"= TCP:C:\Windows\System32\PnkBstrB.exe:PnkBstrB "{577525A4-4917-46F2-BDD8-4ABB27140815}"= UDP:C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM) "{926A7E26-ED01-42FF-92AA-6A1C46CBA11C}"= TCP:C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM) "TCP Query User{8D4C48F3-BD8F-421B-858F-CE3421A9DE36}C:\\program files\\mozilla firefox\\firefox.exe"= UDP:C:\program files\mozilla firefox\firefox.exe:Firefox "UDP Query User{ABEC8359-5062-431C-A2A2-554A8FD1D639}C:\\program files\\mozilla firefox\\firefox.exe"= TCP:C:\program files\mozilla firefox\firefox.exe:Firefox "{BA8CD49C-D6BA-473A-AAD7-5D06D084E520}"= UDP:C:\Program Files\Eidos\Kane and Lynch Dead Men\kaneandlynch.exe:Kane & Lynch: Dead Men "{BF850267-E387-4435-A3EB-9DAFFCEE7413}"= TCP:C:\Program Files\Eidos\Kane and Lynch Dead Men\kaneandlynch.exe:Kane & Lynch: Dead Men "TCP Query User{6EE16975-AA14-406D-AB3E-E16D86FBADF4}C:\\users\\***\\downloads\\leecher\\leecher.exe"= UDP:C:\users\***\downloads\leecher\leecher.exe:leecher.exe "UDP Query User{4356964A-52DA-440F-8ED7-5C53BAEA7D80}C:\\users\\***\\downloads\\leecher\\leecher.exe"= TCP:C:\users\***\downloads\leecher\leecher.exe:leecher.exe "TCP Query User{B779B951-EB47-4D4C-B952-CD374AA29445}C:\\users\\***\\downloads\\leecher\\leecher.exe"= UDP:C:\users\***\downloads\leecher\leecher.exe:leecher.exe "UDP Query User{0CBF8502-5454-4270-97C7-FE50ED1FE845}C:\\users\\***\\downloads\\leecher\\leecher.exe"= TCP:C:\users\***\downloads\leecher\leecher.exe:leecher.exe "TCP Query User{4815342F-F7AD-40EC-9983-3374A8BED78F}C:\\program files\\icq6\\icq.exe"= UDP:C:\program files\icq6\icq.exe:ICQ Library "UDP Query User{03CBC366-96BD-42FA-923C-828D2B3D97D2}C:\\program files\\icq6\\icq.exe"= TCP:C:\program files\icq6\icq.exe:ICQ Library "{6125401C-7023-458D-A695-4FF15F5521D5}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone) "{D4B771DF-F009-4556-9133-B67E5FF862C7}"= UDP:C:\Program Files\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\XR_3DA.exe:S.T.A.L.K.E.R. - Shadow of Chernobyl (CLI) "{D05F05BD-53C0-42CC-8821-BDEE1CAF56DE}"= TCP:C:\Program Files\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\XR_3DA.exe:S.T.A.L.K.E.R. - Shadow of Chernobyl (CLI) "{BF637F90-0E50-478D-8E0F-FBDE4A610345}"= UDP:C:\Program Files\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\dedicated\XR_3DA.exe:S.T.A.L.K.E.R. - Shadow of Chernobyl (SRV) "{D7F313FF-2643-4052-A82B-4B9312E8115C}"= TCP:C:\Program Files\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\dedicated\XR_3DA.exe:S.T.A.L.K.E.R. - Shadow of Chernobyl (SRV) "{39C5B51D-D733-4640-B980-B19D92712115}"= UDP:C:\Program Files\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\XR_3DA.exe:S.T.A.L.K.E.R. - Shadow of Chernobyl (CLI) "{1B88CDE4-FA56-418E-BE8A-6DF5F1A26C2E}"= TCP:C:\Program Files\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\XR_3DA.exe:S.T.A.L.K.E.R. - Shadow of Chernobyl (CLI) "{E24874D4-E5AE-43AA-B3A2-BDF75D63E7ED}"= UDP:C:\Program Files\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\dedicated\XR_3DA.exe:S.T.A.L.K.E.R. - Shadow of Chernobyl (SRV) "{EA0B3BB0-68FA-41DA-BCCC-E1133B74ECFF}"= TCP:C:\Program Files\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\dedicated\XR_3DA.exe:S.T.A.L.K.E.R. - Shadow of Chernobyl (SRV) "{4C762CA8-7B21-4D48-B0BF-438D32ABCD3F}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{F7239922-84F5-4F9D-8EBA-30FF7C565AA9}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{CB591C8A-3163-4B46-B679-14B7E9D16A1D}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone) "{B89F9E0C-EE04-4F72-B3E1-B213F9483FC9}"= UDP:C:\Program Files\Stardock Games\Sins of a Solar Empire\Sins of a Solar Empire.exe:Sins of a Solar Empire "{46211F86-F9B6-4B32-A62E-1ED0662108AC}"= TCP:C:\Program Files\Stardock Games\Sins of a Solar Empire\Sins of a Solar Empire.exe:Sins of a Solar Empire "{800BED4C-DCC3-4C3C-AB91-242E804BCF02}"= UDP:C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx9.exe:Assassin's Creed Dx9 "{969EC694-B82F-4733-BB2B-510A3FB5A9DD}"= TCP:C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx9.exe:Assassin's Creed Dx9 "{3426C106-D49B-400C-91B0-1716B3DCD861}"= UDP:C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx10.exe:Assassin's Creed Dx10 "{0CEF7DC3-5729-4531-8595-C0ED851E698D}"= TCP:C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx10.exe:Assassin's Creed Dx10 "{1974DCC9-D7B6-4502-96C5-11A5ABEE151C}"= UDP:C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Launcher.exe:Assassin's Creed Update "{1EBAD838-BC7E-4481-858F-D8E73DA78391}"= TCP:C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Launcher.exe:Assassin's Creed Update "{AA533B53-5160-4E3D-AE53-02D31BF0B126}"= C:\Program Files\Skype\Phone\Skype.exe:Skype [HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile] "EnableFirewall"= 0 (0x0) R1 DLARTL_M;DLARTL_M;C:\Windows\system32\Drivers\DLARTL_M.SYS [2007-02-08 21:05] R2 AESTFilters;Andrea ST Filters Service;C:\Windows\system32\aestsrv.exe [2007-08-29 14:25] R2 sprtsvc_dellsupportcenter;SupportSoft Sprocket Service (dellsupportcenter);C:\Program Files\Dell Support Center\bin\sprtsvc.exe [2007-11-15 10:23] R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;C:\Windows\system32\DRIVERS\b57nd60x.sys [2007-07-18 15:30] R3 OEM02Dev;Creative Camera OEM002 Driver;C:\Windows\system32\DRIVERS\OEM02Dev.sys [2007-10-10 18:03] R3 OEM02Vfx;Creative Camera OEM002 Video VFX Driver;C:\Windows\system32\DRIVERS\OEM02Vfx.sys [2007-08-29 07:55] R3 physX32;physX32;C:\Windows\system32\DRIVERS\physX32.sys [2007-06-26 21:15] S3 ggflt;SEMC USB Flash Driver Filter;C:\Windows\system32\DRIVERS\ggflt.sys [2008-03-28 15:39] S3 MTOnlPktAlyX;MTOnlPktAlyX NDIS Protocol Driver;C:\PROGRA~1\T-Online\T-ONLI~1\BASIS-~1\Basis1\MTOnlPktAlyX.SYS [2006-10-09 15:46] S3 R300;R300;C:\Windows\system32\DRIVERS\atikmdag.sys [2006-11-02 09:36] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{24f3f125-95e4-11dc-ae40-c027fb8d1625}] \shell\AutoRun\command - F:\Autorun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{928e1849-c023-11dc-81d5-0015c57f2f27}] \shell\verb1\command - desktop.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{954d8e25-819d-11dc-bd1a-0015c57f2f27}] \shell\AutoRun\command - G:\INSTALL.EXE [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{954d8e35-819d-11dc-bd1a-0015c57f2f27}] \shell\AutoRun\command - H:\autorun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b8048dca-e1f2-11dc-aaf1-0015c57f2f27}] \shell\AutoRun\command - F:\PsychoLauncher.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ce3bd757-dff0-11dc-b01c-0015c57f2f27}] \shell\AutoRun\command - G:\autorun.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, h**p://www.gmer.net Rootkit scan 2008-05-15 20:17:48 Windows 6.0.6001 Service Pack 1 NTFS Scanne versteckte Prozesse... Scanne versteckte Autostart Eintr„ge... Scanne versteckte Dateien... C:\Users\***\AppData\Local\Google\Google Desktop\07efa07df2af\sidebar_plugins_00000000__ss_un_uploaded_events 2560 bytes C:\Users\***\AppData\Local\Temp\si2413.tmp 0 bytes C:\Users\***\AppData\Local\Temp\STS3BB8.tmp 88 bytes Scan erfolgreich abgeschlossen versteckte Dateien: 3 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\Windows\system32\winlogon.exe -> C:\Windows\system32\qoMdEUOI.dll PROCESS: C:\Windows\Explorer.exe -> C:\Windows\system32\qjpujlwn.dll . ------------------------ Other Running Processes ------------------------ . C:\Windows\System32\audiodg.exe C:\Windows\System32\ZoneLabs\vsmon.exe C:\Windows\System32\wlanext.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe C:\Windows\System32\IoctlSvc.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe C:\Windows\System32\stacsv.exe C:\Program Files\Dell\QuickSet\NicConfigSvc.exe C:\Windows\System32\conime.exe C:\Program Files\Common Files\Logitech\LCD Manager\Applets\LCDCountdown.exe C:\Program Files\Common Files\Logitech\LCD Manager\Applets\LCDPOP3.exe C:\Program Files\Common Files\Logitech\LCD Manager\Applets\LCDMedia.exe C:\Program Files\Common Files\Logitech\LCD Manager\Applets\LCDClock.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Program Files\Razer\razerofa.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\guardgui.exe C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe C:\Windows\ehome\ehmsas.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe C:\Windows\System32\wbem\WMIADAP.exe C:\Windows\System32\dllhost.exe . ************************************************************************** . Zeit der Fertigstellung: 2008-05-15 20:22:49 - machine was rebooted ComboFix-quarantined-files.txt 2008-05-15 18:22:43 ComboFix2.txt 2008-05-15 12:36:30 ComboFix3.txt 2008-05-15 12:19:34 Das System hat keinen Meldungstext für die Meldungsnummer 0x2379 in der Meldungsdatei Application gefunden. 23 Verzeichnis(se), 65,633,492,992 Bytes frei 430 --- E O F --- 2008-05-15 16:49:47 |
![]() | #5 |
Administrator > Competence Manager | ![]() mit verschiedenen Trojanern infiziert (VundoGen etc.)Scripten mit Combofix
Code:
ATTFilter KILLALL:: Registry:: [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{43128818-37A4-452D-B84B-F51BA0FD8710}] [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{f8d3a4aa-f252-4e99-9eae-3fed9491f38c}] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{2AA0726C-95B7-4216-AA43-B5BDD524892F}"=- FILE:: C:\Windows\System32\nwljupjq.ini C:\Windows\System32\qjpujlwn.dll C:\Windows\System32\pukvhypy.dll C:\Windows\system32\cbXRKBrO.dll C:\Windows\system32\cnecgudk.dll C:\Windows\system32\qjpujlwn.dll C:\Windows\system32\qoMdEUOI.dll Folder:: C:\VundoFix Backups
![]()
Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann Malwarebytes' Anti-Malware
__________________ Anfragen per Email, Profil- oder privater Nachricht werden ignoriert! Hilfe gibts NUR im Forum! Stulti est se ipsum sapientem putare. Geändert von Sunny (16.05.2008 um 15:19 Uhr) |
![]() | #6 |
![]() | ![]() mit verschiedenen Trojanern infiziert (VundoGen etc.) Das Erstellen des Scripts und das Ausführen mit CF funktioniert leider nicht. Es kommt zum Blue Screen und Neustart des Rechners ohne Ausführung der Löschaktion durch CF. Was ist da möglich???? |
![]() | #7 |
![]() ![]() ![]() ![]() | ![]() mit verschiedenen Trojanern infiziert (VundoGen etc.) Lass bitte bei dem Script killall:: und den Part mit registry:: weg und versuchs nochmal....
__________________ MfG Ralf |
![]() | #8 |
![]() | ![]() mit verschiedenen Trojanern infiziert (VundoGen etc.) Ok, das hat funktioniert außer, dass er die Logfile nicht erstellt hat. Die Logfile vom zweiten Durchlauf danach folgt gleich. Jetzt läuft noch MAM durch. ComboFix 08-05-12.1 - *** 2008-05-16 12:03:33.6 - NTFSx86 Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1031.18.1097 [GMT 2:00] ausgeführt von:: C:\Users\Tino\Desktop\ComboFix.exe . (((((((((((((((((((((((((((((((((((( Weitere Löschungen )))))))))))))))))))))))))))))))))))))))))))))))) . . ---- Previous Run ------- . C:\VundoFix Backups C:\Windows\system32\cbXRKBrO.dll C:\Windows\system32\cnecgudk.dll C:\Windows\System32\nwljupjq.ini C:\Windows\System32\OrBKRXbc.ini C:\Windows\System32\OrBKRXbc.ini2 C:\Windows\System32\pukvhypy.dll C:\Windows\system32\qjpujlwn.dll C:\Windows\System32\twGiknpo.ini C:\Windows\System32\twGiknpo.ini2 C:\Windows\system32\VuvyaGgh.ini C:\Windows\System32\VuvyaGgh.ini2 . ((((((((((((((((((((((( Dateien erstellt von 2008-04-16 bis 2008-05-16 )))))))))))))))))))))))))))))) . 2008-05-16 12:00 . 2008-05-13 11:32 57,344 --a------ C:\Windows\System32\iifcCsSL.dll 2008-05-15 22:48 . 2008-05-15 22:48 125,952 --a------ C:\Windows\System32\dsvrpjci.dll 2008-05-15 22:47 . 2008-05-15 22:47 370,176 --a------ C:\Windows\System32\hgGayvuV.dll 2008-05-15 21:19 . 2008-05-15 21:19 133,120 --a------ C:\Windows\System32\mrmvghtp.dll 2008-05-15 21:14 . 2008-05-15 21:14 125,952 --a------ C:\Windows\System32\dgmbxitt.dll 2008-05-15 21:13 . 2008-05-15 21:13 370,176 --a------ C:\Windows\System32\opnkiGwt.dll 2008-05-15 21:02 . 2008-05-15 22:41 336,526,713 --a------ C:\Windows\MEMORY.DMP 2008-05-15 20:59 . 2008-05-15 20:59 126,016 --a------ C:\Windows\System32\rapniulx.dll 2008-05-15 14:40 . 2008-05-15 14:40 126,528 --a------ C:\Windows\System32\xsalgnuu.dll 2008-05-15 14:04 . 2008-05-15 14:04 <DIR> d-------- C:\Program Files\CCleaner 2008-05-15 12:56 . 2008-05-05 20:46 27,048 --a------ C:\Windows\System32\drivers\mbamcatchme.sys 2008-05-15 12:56 . 2008-05-05 20:46 15,864 --a------ C:\Windows\System32\drivers\mbam.sys 2008-05-15 11:02 . 2008-05-15 11:02 <DIR> d-------- C:\Users\***\AppData\Roaming\Malwarebytes 2008-05-15 11:02 . 2008-05-15 11:02 <DIR> d-------- C:\Users\All Users\Malwarebytes 2008-05-15 11:02 . 2008-05-15 11:02 <DIR> d-------- C:\ProgramData\Malwarebytes 2008-05-15 11:02 . 2008-05-15 12:56 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-05-14 14:06 . 2008-05-14 14:06 <DIR> dr------- C:\Windows\System32\config\systemprofile\Documents 2008-05-14 13:24 . 2008-05-14 13:24 <DIR> d-------- C:\Users\All Users\Office Genuine Advantage 2008-05-14 13:24 . 2008-05-14 13:24 <DIR> d-------- C:\ProgramData\Office Genuine Advantage 2008-05-13 17:35 . 2008-03-05 15:56 3,786,760 --a------ C:\Windows\System32\D3DX9_37.dll 2008-05-13 17:35 . 2008-03-05 15:56 1,420,824 --a------ C:\Windows\System32\D3DCompiler_37.dll 2008-05-13 17:35 . 2008-03-05 16:03 479,752 --a------ C:\Windows\System32\XAudio2_0.dll 2008-05-13 17:35 . 2008-02-05 23:07 462,864 --a------ C:\Windows\System32\d3dx10_37.dll 2008-05-13 17:35 . 2008-03-05 16:03 238,088 --a------ C:\Windows\System32\xactengine3_0.dll 2008-05-13 17:35 . 2008-03-05 16:00 25,608 --a------ C:\Windows\System32\X3DAudio1_3.dll 2008-05-13 17:28 . 2008-05-13 17:28 <DIR> d-------- C:\Program Files\LucasArts 2008-05-13 11:32 . 2008-05-15 13:42 <DIR> d-------- C:\Program Files\DiskTrix 2008-05-05 16:05 . 2008-05-15 12:45 <DIR> d-------- C:\Users\***\AppData\Roaming\skypePM 2008-05-05 16:05 . 2008-05-05 16:05 56 --ah----- C:\Windows\System32\ezsidmv.dat 2008-05-05 16:04 . 2008-05-15 14:20 <DIR> d-------- C:\Users\***\AppData\Roaming\Skype 2008-05-05 16:03 . 2008-05-05 16:03 <DIR> d-------- C:\Users\All Users\Skype 2008-05-05 16:03 . 2008-05-05 16:03 <DIR> d-------- C:\ProgramData\Skype 2008-05-05 16:03 . 2008-05-05 16:03 <DIR> d-------- C:\Program Files\Skype 2008-05-05 16:03 . 2008-05-05 16:03 <DIR> d-------- C:\Program Files\Common Files\Skype 2008-04-21 09:55 . 2008-04-21 09:55 <DIR> d-------- C:\Users\All Users\Apple 2008-04-21 09:55 . 2008-04-21 09:55 <DIR> d-------- C:\ProgramData\Apple 2008-04-21 09:55 . 2008-04-21 09:55 <DIR> d-------- C:\Program Files\Apple Software Update 2008-04-18 21:53 . 2008-04-18 22:21 <DIR> d-------- C:\Users\All Users\TrackMania 2008-04-18 21:53 . 2008-04-18 22:21 <DIR> d-------- C:\ProgramData\TrackMania 2008-04-17 21:32 . 2008-04-17 21:33 <DIR> d-------- C:\Program Files\CDex_170b2 2008-04-16 15:42 . 2008-04-16 15:45 <DIR> d-------- C:\Program Files\TmNationsForever 8 Datei(en), . 247,757 C:\ComboFix\Bytes 8 Datei(en), . 247,757 C:\ComboFix\Bytes . (((((((((((((((((((((((((((((((((((( Find3M Bericht )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-05-16 09:59 352,614 ---ha-w C:\Windows\system32\drivers\vsconfig.xml 2008-05-16 08:42 2,659,840 ----a-w C:\Windows\Internet Logs\xDB92BD.tmp 2008-05-15 16:49 --------- d-----w C:\Program Files\Windows Mail 2008-05-15 16:32 --------- d-----w C:\ProgramData\Microsoft Help 2008-05-15 11:36 --------- d-----w C:\ProgramData\Google Updater 2008-05-14 17:01 62,056 ----a-w C:\Users\***\AppData\Roaming\nvModes.dat 2008-05-13 15:56 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-04-21 07:56 --------- d-----w C:\Program Files\ICQ6 2008-04-15 19:01 --------- d-----w C:\Users\***\AppData\Roaming\Ubisoft 2008-04-15 18:46 --------- d-----w C:\ProgramData\Ubisoft 2008-04-15 18:33 --------- d-----w C:\Program Files\Ubisoft 2008-04-15 18:32 --------- d-----w C:\Users\***\AppData\Roaming\InstallShield 2008-04-12 09:33 --------- d-----w C:\Program Files\Double Fine Productions 2008-04-09 18:51 --------- d-----w C:\ProgramData\Media Center Programs 2008-04-06 21:40 --------- d-----w C:\Program Files\QuickTime 2008-04-06 21:39 --------- d-----w C:\ProgramData\Apple Computer 2008-04-03 11:28 --------- d--h--w C:\ProgramData\{0E8E33D8-193A-414A-A909-0F101A142D26} 2008-04-03 11:25 --------- d-----w C:\Program Files\Stardock Games 2008-04-03 08:56 --------- d-----w C:\Program Files\Crazy Machines II 2008-03-31 11:07 --------- d-----w C:\Program Files\HP 2008-03-29 11:18 0 ---ha-w C:\Windows\system32\drivers\Msft_Kernel_ggsemc_01005.Wdf 2008-03-28 13:39 20,520 ----a-w C:\Windows\system32\drivers\ggsemc.sys 2008-03-28 13:39 13,352 ----a-w C:\Windows\system32\drivers\ggflt.sys 2008-03-28 13:39 1,419,232 ----a-w C:\Windows\System32\wdfcoinstaller01005.dll 2008-03-28 13:33 --------- d-----w C:\ProgramData\Sony Ericsson 2008-03-28 13:31 --------- d-----w C:\Program Files\Sony Ericsson 2008-03-28 09:43 0 ---ha-w C:\Windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf 2008-03-26 18:25 --------- d-----w C:\Program Files\Google 2008-03-25 17:30 --------- d-----w C:\ProgramData\NVIDIA 2008-03-25 17:28 174 --sha-w C:\Program Files\desktop.ini 2008-03-25 17:20 --------- d-----w C:\Program Files\Windows Sidebar 2008-03-25 17:20 --------- d-----w C:\Program Files\Windows Photo Gallery 2008-03-25 17:20 --------- d-----w C:\Program Files\Windows Journal 2008-03-25 17:20 --------- d-----w C:\Program Files\Windows Defender 2008-03-25 17:20 --------- d-----w C:\Program Files\Windows Collaboration 2008-03-25 17:20 --------- d-----w C:\Program Files\Windows Calendar 2008-03-25 16:57 82,432 ----a-w C:\Windows\System32\axaltocm.dll 2008-03-25 16:57 101,888 ----a-w C:\Windows\System32\ifxcardm.dll 2008-03-21 15:13 --------- d-----w C:\Program Files\The FilmMachine 2008-03-21 13:38 --------- d-----w C:\Users\***\AppData\Roaming\Media Player Classic 2008-03-21 13:35 --------- d-----w C:\Program Files\K-Lite Codec Pack 2008-03-21 13:13 --------- d-----w C:\Program Files\AviSynth 2.5 2008-03-21 10:28 --------- d-----w C:\Users\***\AppData\Roaming\Nero 2008-03-21 10:25 --------- d-----w C:\Program Files\Common Files\Nero 2008-03-21 10:22 --------- d-----w C:\ProgramData\Nero 2008-03-21 10:22 --------- d-----w C:\Program Files\Nero 2008-03-20 17:12 --------- d-----w C:\Program Files\THQ 2008-03-20 16:53 107,888 ----a-w C:\Windows\System32\CmdLineExt.dll 2008-03-20 12:31 --------- d-----w C:\Program Files\NeroInstall.bak 2008-03-13 13:40 413,696 ----a-w C:\Windows\System32\wrap_oal.dll 2008-03-13 13:40 110,592 ----a-w C:\Windows\System32\OpenAL32.dll 2008-03-03 13:05 54,672 ----a-w C:\Windows\System32\vsutil_loc0407.dll 2008-03-03 13:05 1,086,952 ----a-w C:\Windows\System32\zpeng24.dll 2008-02-29 07:14 19,000 ----a-w C:\Windows\System32\kd1394.dll 2008-02-29 07:11 988,216 ----a-w C:\Windows\System32\winload.exe 2008-02-29 07:11 927,288 ----a-w C:\Windows\System32\winresume.exe 2008-02-29 06:53 46,592 ----a-w C:\Windows\System32\setbcdlocale.dll 2008-02-29 06:53 40,960 ----a-w C:\Windows\System32\srclient.dll 2008-02-29 06:53 378,368 ----a-w C:\Windows\System32\srcore.dll 2008-02-29 06:35 6,656 ----a-w C:\Windows\System32\kbd106n.dll 2008-02-29 04:21 2,032,128 ----a-w C:\Windows\System32\win32k.sys 2008-02-29 04:12 318,464 ----a-w C:\Windows\System32\rstrui.exe 2008-02-29 04:12 14,848 ----a-w C:\Windows\System32\srdelayed.exe 2008-02-28 16:38 972,072 ----a-w C:\Windows\UNNeroMediaHome.exe 2008-02-26 15:14 972,072 ----a-w C:\Windows\UNRecode.exe 2008-02-22 05:05 615,992 ----a-w C:\Windows\System32\ci.dll 2008-02-22 05:01 826,880 ----a-w C:\Windows\System32\wininet.dll 2008-02-22 04:57 295,936 ----a-w C:\Windows\System32\gdi32.dll 2008-02-20 20:16 1,370,112 ----a-w C:\Windows\Internet Logs\xDBACD1.tmp 2008-02-18 15:04 95,600 ----a-w C:\Windows\System32\NeroCo.dll 2007-11-16 17:04 22,328 ----a-w C:\Users\***\AppData\Roaming\PnkBstrK.sys 2007-10-17 07:17 76 --sh--r C:\Windows\CT4CET.bin 2006-05-03 09:06 163,328 --sh--r C:\Windows\System32\flvDX.dll 2007-02-21 10:47 31,232 --sh--r C:\Windows\System32\msfDX.dll . ------- Sigcheck ------- . ((((((((((((((((((((((((((((( snapshot_2008-05-15_20.22.14.29 ))))))))))))))))))))))))))))))))))))))))) . - 2008-05-15 18:17:08 67,584 --s-a-w C:\Windows\bootstat.dat + 2008-05-16 09:58:45 67,584 --s-a-w C:\Windows\bootstat.dat + 2008-05-16 09:58:46 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2008-05-16 09:58:46 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2008-05-15 18:17:28 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\ntuser.dat + 2008-05-16 10:00:53 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\ntuser.dat + 2008-05-16 10:00:53 262,144 ---ha-w C:\Windows\ServiceProfiles\LocalService\ntuser.dat.LOG1 - 2008-05-15 18:17:28 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.dat + 2008-05-16 10:00:48 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.dat + 2008-05-16 10:00:48 262,144 ---ha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1 - 2008-05-15 18:17:54 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2008-05-16 10:01:39 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2008-05-15 18:17:54 49,152 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2008-05-16 10:01:39 49,152 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2008-05-15 18:17:54 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2008-05-16 10:01:39 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2008-05-15 16:49:43 123,658 ----a-w C:\Windows\System32\perfc007.dat + 2008-05-16 08:36:20 123,658 ----a-w C:\Windows\System32\perfc007.dat - 2008-05-15 16:49:43 102,094 ----a-w C:\Windows\System32\perfc009.dat + 2008-05-16 08:36:20 101,916 ----a-w C:\Windows\System32\perfc009.dat - 2008-05-15 16:49:43 621,940 ----a-w C:\Windows\System32\perfh007.dat + 2008-05-16 08:36:20 621,940 ----a-w C:\Windows\System32\perfh007.dat - 2008-05-15 16:49:43 590,082 ----a-w C:\Windows\System32\perfh009.dat + 2008-05-16 08:36:20 589,904 ----a-w C:\Windows\System32\perfh009.dat - 2008-05-15 16:44:04 9,186 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3039615548-3396779488-269229600-1000_UserData.bin + 2008-05-16 10:01:26 9,466 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3039615548-3396779488-269229600-1000_UserData.bin - 2008-05-15 16:44:03 87,898 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin + 2008-05-16 10:01:25 88,462 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin - 2008-05-15 16:43:57 61,154 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin + 2008-05-16 08:30:29 61,162 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin . -- Snapshot reset to current date -- |
![]() |
Themen zu mit verschiedenen Trojanern infiziert (VundoGen etc.) |
add-on, antivir, appinit_dlls, avira, bho, bonjour, browser, ci.dll, computer, desktop, downloader, error, google, hijack, internet, internet explorer, malware.trace, nmindexstoresvr.exe, pdfcreator, prozesse, registrierungsschlüssel, registry, rundll, senden, software, svchost.exe, system, toolbars, trojaner, unknown file in winsock lsp, vundo.gen, vundogen, windows, windows defender |