| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: mit verschiedenen Trojanern infiziert (VundoGen etc.)Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
| |
16.05.2008, 11:12
| #1 |
 |  mit verschiedenen Trojanern infiziert (VundoGen etc.) Ok, das hat funktioniert außer, dass er die Logfile nicht erstellt hat. Die Logfile vom zweiten Durchlauf danach folgt gleich. Jetzt läuft noch MAM durch. ComboFix 08-05-12.1 - *** 2008-05-16 12:03:33.6 - NTFSx86 Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1031.18.1097 [GMT 2:00] ausgeführt von:: C:\Users\Tino\Desktop\ComboFix.exe . (((((((((((((((((((((((((((((((((((( Weitere Löschungen )))))))))))))))))))))))))))))))))))))))))))))))) . . ---- Previous Run ------- . C:\VundoFix Backups C:\Windows\system32\cbXRKBrO.dll C:\Windows\system32\cnecgudk.dll C:\Windows\System32\nwljupjq.ini C:\Windows\System32\OrBKRXbc.ini C:\Windows\System32\OrBKRXbc.ini2 C:\Windows\System32\pukvhypy.dll C:\Windows\system32\qjpujlwn.dll C:\Windows\System32\twGiknpo.ini C:\Windows\System32\twGiknpo.ini2 C:\Windows\system32\VuvyaGgh.ini C:\Windows\System32\VuvyaGgh.ini2 . ((((((((((((((((((((((( Dateien erstellt von 2008-04-16 bis 2008-05-16 )))))))))))))))))))))))))))))) . 2008-05-16 12:00 . 2008-05-13 11:32 57,344 --a------ C:\Windows\System32\iifcCsSL.dll 2008-05-15 22:48 . 2008-05-15 22:48 125,952 --a------ C:\Windows\System32\dsvrpjci.dll 2008-05-15 22:47 . 2008-05-15 22:47 370,176 --a------ C:\Windows\System32\hgGayvuV.dll 2008-05-15 21:19 . 2008-05-15 21:19 133,120 --a------ C:\Windows\System32\mrmvghtp.dll 2008-05-15 21:14 . 2008-05-15 21:14 125,952 --a------ C:\Windows\System32\dgmbxitt.dll 2008-05-15 21:13 . 2008-05-15 21:13 370,176 --a------ C:\Windows\System32\opnkiGwt.dll 2008-05-15 21:02 . 2008-05-15 22:41 336,526,713 --a------ C:\Windows\MEMORY.DMP 2008-05-15 20:59 . 2008-05-15 20:59 126,016 --a------ C:\Windows\System32\rapniulx.dll 2008-05-15 14:40 . 2008-05-15 14:40 126,528 --a------ C:\Windows\System32\xsalgnuu.dll 2008-05-15 14:04 . 2008-05-15 14:04 <DIR> d-------- C:\Program Files\CCleaner 2008-05-15 12:56 . 2008-05-05 20:46 27,048 --a------ C:\Windows\System32\drivers\mbamcatchme.sys 2008-05-15 12:56 . 2008-05-05 20:46 15,864 --a------ C:\Windows\System32\drivers\mbam.sys 2008-05-15 11:02 . 2008-05-15 11:02 <DIR> d-------- C:\Users\***\AppData\Roaming\Malwarebytes 2008-05-15 11:02 . 2008-05-15 11:02 <DIR> d-------- C:\Users\All Users\Malwarebytes 2008-05-15 11:02 . 2008-05-15 11:02 <DIR> d-------- C:\ProgramData\Malwarebytes 2008-05-15 11:02 . 2008-05-15 12:56 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-05-14 14:06 . 2008-05-14 14:06 <DIR> dr------- C:\Windows\System32\config\systemprofile\Documents 2008-05-14 13:24 . 2008-05-14 13:24 <DIR> d-------- C:\Users\All Users\Office Genuine Advantage 2008-05-14 13:24 . 2008-05-14 13:24 <DIR> d-------- C:\ProgramData\Office Genuine Advantage 2008-05-13 17:35 . 2008-03-05 15:56 3,786,760 --a------ C:\Windows\System32\D3DX9_37.dll 2008-05-13 17:35 . 2008-03-05 15:56 1,420,824 --a------ C:\Windows\System32\D3DCompiler_37.dll 2008-05-13 17:35 . 2008-03-05 16:03 479,752 --a------ C:\Windows\System32\XAudio2_0.dll 2008-05-13 17:35 . 2008-02-05 23:07 462,864 --a------ C:\Windows\System32\d3dx10_37.dll 2008-05-13 17:35 . 2008-03-05 16:03 238,088 --a------ C:\Windows\System32\xactengine3_0.dll 2008-05-13 17:35 . 2008-03-05 16:00 25,608 --a------ C:\Windows\System32\X3DAudio1_3.dll 2008-05-13 17:28 . 2008-05-13 17:28 <DIR> d-------- C:\Program Files\LucasArts 2008-05-13 11:32 . 2008-05-15 13:42 <DIR> d-------- C:\Program Files\DiskTrix 2008-05-05 16:05 . 2008-05-15 12:45 <DIR> d-------- C:\Users\***\AppData\Roaming\skypePM 2008-05-05 16:05 . 2008-05-05 16:05 56 --ah----- C:\Windows\System32\ezsidmv.dat 2008-05-05 16:04 . 2008-05-15 14:20 <DIR> d-------- C:\Users\***\AppData\Roaming\Skype 2008-05-05 16:03 . 2008-05-05 16:03 <DIR> d-------- C:\Users\All Users\Skype 2008-05-05 16:03 . 2008-05-05 16:03 <DIR> d-------- C:\ProgramData\Skype 2008-05-05 16:03 . 2008-05-05 16:03 <DIR> d-------- C:\Program Files\Skype 2008-05-05 16:03 . 2008-05-05 16:03 <DIR> d-------- C:\Program Files\Common Files\Skype 2008-04-21 09:55 . 2008-04-21 09:55 <DIR> d-------- C:\Users\All Users\Apple 2008-04-21 09:55 . 2008-04-21 09:55 <DIR> d-------- C:\ProgramData\Apple 2008-04-21 09:55 . 2008-04-21 09:55 <DIR> d-------- C:\Program Files\Apple Software Update 2008-04-18 21:53 . 2008-04-18 22:21 <DIR> d-------- C:\Users\All Users\TrackMania 2008-04-18 21:53 . 2008-04-18 22:21 <DIR> d-------- C:\ProgramData\TrackMania 2008-04-17 21:32 . 2008-04-17 21:33 <DIR> d-------- C:\Program Files\CDex_170b2 2008-04-16 15:42 . 2008-04-16 15:45 <DIR> d-------- C:\Program Files\TmNationsForever 8 Datei(en), . 247,757 C:\ComboFix\Bytes 8 Datei(en), . 247,757 C:\ComboFix\Bytes . (((((((((((((((((((((((((((((((((((( Find3M Bericht )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-05-16 09:59 352,614 ---ha-w C:\Windows\system32\drivers\vsconfig.xml 2008-05-16 08:42 2,659,840 ----a-w C:\Windows\Internet Logs\xDB92BD.tmp 2008-05-15 16:49 --------- d-----w C:\Program Files\Windows Mail 2008-05-15 16:32 --------- d-----w C:\ProgramData\Microsoft Help 2008-05-15 11:36 --------- d-----w C:\ProgramData\Google Updater 2008-05-14 17:01 62,056 ----a-w C:\Users\***\AppData\Roaming\nvModes.dat 2008-05-13 15:56 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-04-21 07:56 --------- d-----w C:\Program Files\ICQ6 2008-04-15 19:01 --------- d-----w C:\Users\***\AppData\Roaming\Ubisoft 2008-04-15 18:46 --------- d-----w C:\ProgramData\Ubisoft 2008-04-15 18:33 --------- d-----w C:\Program Files\Ubisoft 2008-04-15 18:32 --------- d-----w C:\Users\***\AppData\Roaming\InstallShield 2008-04-12 09:33 --------- d-----w C:\Program Files\Double Fine Productions 2008-04-09 18:51 --------- d-----w C:\ProgramData\Media Center Programs 2008-04-06 21:40 --------- d-----w C:\Program Files\QuickTime 2008-04-06 21:39 --------- d-----w C:\ProgramData\Apple Computer 2008-04-03 11:28 --------- d--h--w C:\ProgramData\{0E8E33D8-193A-414A-A909-0F101A142D26} 2008-04-03 11:25 --------- d-----w C:\Program Files\Stardock Games 2008-04-03 08:56 --------- d-----w C:\Program Files\Crazy Machines II 2008-03-31 11:07 --------- d-----w C:\Program Files\HP 2008-03-29 11:18 0 ---ha-w C:\Windows\system32\drivers\Msft_Kernel_ggsemc_01005.Wdf 2008-03-28 13:39 20,520 ----a-w C:\Windows\system32\drivers\ggsemc.sys 2008-03-28 13:39 13,352 ----a-w C:\Windows\system32\drivers\ggflt.sys 2008-03-28 13:39 1,419,232 ----a-w C:\Windows\System32\wdfcoinstaller01005.dll 2008-03-28 13:33 --------- d-----w C:\ProgramData\Sony Ericsson 2008-03-28 13:31 --------- d-----w C:\Program Files\Sony Ericsson 2008-03-28 09:43 0 ---ha-w C:\Windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf 2008-03-26 18:25 --------- d-----w C:\Program Files\Google 2008-03-25 17:30 --------- d-----w C:\ProgramData\NVIDIA 2008-03-25 17:28 174 --sha-w C:\Program Files\desktop.ini 2008-03-25 17:20 --------- d-----w C:\Program Files\Windows Sidebar 2008-03-25 17:20 --------- d-----w C:\Program Files\Windows Photo Gallery 2008-03-25 17:20 --------- d-----w C:\Program Files\Windows Journal 2008-03-25 17:20 --------- d-----w C:\Program Files\Windows Defender 2008-03-25 17:20 --------- d-----w C:\Program Files\Windows Collaboration 2008-03-25 17:20 --------- d-----w C:\Program Files\Windows Calendar 2008-03-25 16:57 82,432 ----a-w C:\Windows\System32\axaltocm.dll 2008-03-25 16:57 101,888 ----a-w C:\Windows\System32\ifxcardm.dll 2008-03-21 15:13 --------- d-----w C:\Program Files\The FilmMachine 2008-03-21 13:38 --------- d-----w C:\Users\***\AppData\Roaming\Media Player Classic 2008-03-21 13:35 --------- d-----w C:\Program Files\K-Lite Codec Pack 2008-03-21 13:13 --------- d-----w C:\Program Files\AviSynth 2.5 2008-03-21 10:28 --------- d-----w C:\Users\***\AppData\Roaming\Nero 2008-03-21 10:25 --------- d-----w C:\Program Files\Common Files\Nero 2008-03-21 10:22 --------- d-----w C:\ProgramData\Nero 2008-03-21 10:22 --------- d-----w C:\Program Files\Nero 2008-03-20 17:12 --------- d-----w C:\Program Files\THQ 2008-03-20 16:53 107,888 ----a-w C:\Windows\System32\CmdLineExt.dll 2008-03-20 12:31 --------- d-----w C:\Program Files\NeroInstall.bak 2008-03-13 13:40 413,696 ----a-w C:\Windows\System32\wrap_oal.dll 2008-03-13 13:40 110,592 ----a-w C:\Windows\System32\OpenAL32.dll 2008-03-03 13:05 54,672 ----a-w C:\Windows\System32\vsutil_loc0407.dll 2008-03-03 13:05 1,086,952 ----a-w C:\Windows\System32\zpeng24.dll 2008-02-29 07:14 19,000 ----a-w C:\Windows\System32\kd1394.dll 2008-02-29 07:11 988,216 ----a-w C:\Windows\System32\winload.exe 2008-02-29 07:11 927,288 ----a-w C:\Windows\System32\winresume.exe 2008-02-29 06:53 46,592 ----a-w C:\Windows\System32\setbcdlocale.dll 2008-02-29 06:53 40,960 ----a-w C:\Windows\System32\srclient.dll 2008-02-29 06:53 378,368 ----a-w C:\Windows\System32\srcore.dll 2008-02-29 06:35 6,656 ----a-w C:\Windows\System32\kbd106n.dll 2008-02-29 04:21 2,032,128 ----a-w C:\Windows\System32\win32k.sys 2008-02-29 04:12 318,464 ----a-w C:\Windows\System32\rstrui.exe 2008-02-29 04:12 14,848 ----a-w C:\Windows\System32\srdelayed.exe 2008-02-28 16:38 972,072 ----a-w C:\Windows\UNNeroMediaHome.exe 2008-02-26 15:14 972,072 ----a-w C:\Windows\UNRecode.exe 2008-02-22 05:05 615,992 ----a-w C:\Windows\System32\ci.dll 2008-02-22 05:01 826,880 ----a-w C:\Windows\System32\wininet.dll 2008-02-22 04:57 295,936 ----a-w C:\Windows\System32\gdi32.dll 2008-02-20 20:16 1,370,112 ----a-w C:\Windows\Internet Logs\xDBACD1.tmp 2008-02-18 15:04 95,600 ----a-w C:\Windows\System32\NeroCo.dll 2007-11-16 17:04 22,328 ----a-w C:\Users\***\AppData\Roaming\PnkBstrK.sys 2007-10-17 07:17 76 --sh--r C:\Windows\CT4CET.bin 2006-05-03 09:06 163,328 --sh--r C:\Windows\System32\flvDX.dll 2007-02-21 10:47 31,232 --sh--r C:\Windows\System32\msfDX.dll . ------- Sigcheck ------- . ((((((((((((((((((((((((((((( snapshot_2008-05-15_20.22.14.29 ))))))))))))))))))))))))))))))))))))))))) . - 2008-05-15 18:17:08 67,584 --s-a-w C:\Windows\bootstat.dat + 2008-05-16 09:58:45 67,584 --s-a-w C:\Windows\bootstat.dat + 2008-05-16 09:58:46 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2008-05-16 09:58:46 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2008-05-15 18:17:28 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\ntuser.dat + 2008-05-16 10:00:53 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\ntuser.dat + 2008-05-16 10:00:53 262,144 ---ha-w C:\Windows\ServiceProfiles\LocalService\ntuser.dat.LOG1 - 2008-05-15 18:17:28 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.dat + 2008-05-16 10:00:48 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.dat + 2008-05-16 10:00:48 262,144 ---ha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1 - 2008-05-15 18:17:54 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2008-05-16 10:01:39 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2008-05-15 18:17:54 49,152 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2008-05-16 10:01:39 49,152 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2008-05-15 18:17:54 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2008-05-16 10:01:39 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2008-05-15 16:49:43 123,658 ----a-w C:\Windows\System32\perfc007.dat + 2008-05-16 08:36:20 123,658 ----a-w C:\Windows\System32\perfc007.dat - 2008-05-15 16:49:43 102,094 ----a-w C:\Windows\System32\perfc009.dat + 2008-05-16 08:36:20 101,916 ----a-w C:\Windows\System32\perfc009.dat - 2008-05-15 16:49:43 621,940 ----a-w C:\Windows\System32\perfh007.dat + 2008-05-16 08:36:20 621,940 ----a-w C:\Windows\System32\perfh007.dat - 2008-05-15 16:49:43 590,082 ----a-w C:\Windows\System32\perfh009.dat + 2008-05-16 08:36:20 589,904 ----a-w C:\Windows\System32\perfh009.dat - 2008-05-15 16:44:04 9,186 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3039615548-3396779488-269229600-1000_UserData.bin + 2008-05-16 10:01:26 9,466 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3039615548-3396779488-269229600-1000_UserData.bin - 2008-05-15 16:44:03 87,898 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin + 2008-05-16 10:01:25 88,462 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin - 2008-05-15 16:43:57 61,154 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin + 2008-05-16 08:30:29 61,162 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin . -- Snapshot reset to current date -- |
|
16.05.2008, 11:13
| #2 |
| | mit verschiedenen Trojanern infiziert (VundoGen etc.) Teil 2:
__________________. (((((((((((((((((((((((((((( Autostart Punkte der Registrierung )))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Hinweis* leere Eintrage & legitime Standardeintrage werden nicht angezeigt. [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{55535566-ca03-4638-9436-c9d5dac558d3}] 2008-05-15 21:19 133120 --a------ C:\Windows\system32\mrmvghtp.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [2007-03-15 13:09 460784] "ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-19 09:33 125952] "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 12:34 5724184] "DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [2007-11-15 10:23 202544] "IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-02-28 18:07 1828136] "DAEMON Tools Pro Agent"="C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 15:08 136136] "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 09:33 202240] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSServer"="C:\Windows\system32\iifcCsSL.dll" [2008-05-13 11:32 57344] "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2008-01-19 09:38 1008184] "ECenter"="C:\Dell\E-Center\EULALauncher.exe" [2007-05-25 08:03 17920] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2007-05-23 07:34 857648] "OEM02Mon.exe"="C:\Windows\OEM02Mon.exe" [2007-08-29 07:54 36864] "SunJavaUpdateSched"="c:\Program Files\Java\jre1.6.0\bin\jusched.exe" [2007-10-17 09:14 77824] "DELL Webcam Manager"="C:\Program Files\Dell\Dell Webcam Manager\DellWMgr.exe" [2007-07-27 17:43 118784] "Launch LCDMon"="C:\Program Files\Common Files\Logitech\LCD Manager\LCDMon.exe" [2007-07-18 15:26 775952] "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2006-10-03 12:37 81920] "RoxWatchTray"="C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2006-11-05 12:22 221184] "PCMService"="C:\Program Files\Dell\MediaDirect\PCMService.exe" [2007-04-16 17:10 184320] "dscactivate"="C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 10:24 16384] "Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-10-17 09:38 1862144] "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-04-17 16:59 262401] "razer"="C:\Program Files\Razer\razerhid.exe" [2005-05-17 19:21 147456] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 22:52 49152] "Adobe Photo Downloader"="C:\Program Files\Adobe\Adobe Photoshop Lightroom 1.3\apdproxy.exe" [2007-12-04 03:07 61440] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792] "ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-03-03 15:05 959976] "NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-02-18 17:29 2221352] "SigmatelSysTrayApp"="C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe" [2007-09-07 11:23 405504] "NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-10-04 22:24 86016] "NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-10-04 22:24 8497696] "NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-10-04 22:24 81920] "NVHotkey"="C:\Windows\system32\nvHotkey.dll" [2007-10-04 22:24 86016] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696] "2204b1e7"="C:\Windows\system32\qjpujlwn.dll" [ ] "DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [2007-11-15 10:23 202544] "BM2137827b"="C:\Windows\system32\dsvrpjci.dll" [2008-05-15 22:48 125952] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2008-03-22 00:13:16 125624] HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2007-01-02 22:40:10 210520] PDFCreator.lnk - C:\Program Files\PDFCreator\PDFCreator.exe [2008-02-09 14:40:55 2641920] QuickSet.lnk - C:\Program Files\Dell\QuickSet\quickset.exe [2007-07-10 22:19:24 1180952] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{2AA0726C-95B7-4216-AA43-B5BDD524892F}"= C:\Windows\system32\iifcCsSL.dll [2008-05-13 11:32 57344] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.i420"= i420vfw.dll "vidc.yv12"= yv12vfw.dll "msacm.l3fhg"= mp3fhg.acm "msacm.divxa32"= divxa32.acm "VIDC.X264"= x264vfw.dll "VIDC.HFYU"= huffyuv.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdVantage Setup] C:\Program Files\DAEMON Tools\AdVantageSetup.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3039615548-3396779488-269229600-1000] "EnableNotificationsRef"=dword:00000002 "EnableNotifications"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{C7D53B8E-EA77-4D96-B36B-C617CDB8686F}"= C:\Program Files\Dell\MediaDirect\PowerCinema.exe:CyberLink PowerCinema "{E83A3957-59E0-442F-863F-5496D736BFA8}"= C:\Program Files\Dell\MediaDirect\PCMService.exe:CyberLink PowerCinema Resident Program "{E4EF0566-FD20-475C-89F3-07439A3513AB}"= C:\Program Files\Dell\MediaDirect\Kernel\DMP\CLBrowserEngine.exe:Cyberlink Media Server Browser Engine "{323E34C2-2DA2-4994-853F-052A563194DF}"= C:\Program Files\Dell\MediaDirect\Kernel\DMS\CLMSService.exe:CyberLink Media Server "{02245255-FFB9-464C-B4EA-0A69ED922F95}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook "{BAEF8C3B-7DD0-4049-90EF-370151673BC1}"= UDP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{7E5FE2F5-2695-4FCB-A696-CA9237B2C438}"= TCP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{22897FBD-0FB6-49C3-A20B-4CB33E3F2239}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{48AC8F7F-5DDC-47F5-9323-58B51F83CDF6}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "TCP Query User{563022F6-DDDF-42A0-A9C0-93A0E7AEBD89}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer "UDP Query User{04D567FD-2BE1-408C-A3D2-2987E2B89FDD}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer "{A283DDD0-3323-4AC3-9060-109FB7D29CAA}"= UDP:C:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\Crysis.exe:Crysis_32 "{18B0FE4D-53C3-4EA5-BF23-5AB9247C3C2B}"= TCP:C:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\Crysis.exe:Crysis_32 "{4673354A-FA89-4D39-B64E-14BB246DD0FE}"= UDP:C:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\CrysisDedicatedServer.exe:CrysisDedicatedServer_32 "{B3DA8712-E4A0-434F-97CE-38CE6CF06D6E}"= TCP:C:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\CrysisDedicatedServer.exe:CrysisDedicatedServer_32 "{817DFA6F-A647-4190-B75B-39353A77FD46}"= UDP:C:\Windows\System32\PnkBstrA.exe:PnkBstrA "{F32F758C-F57F-4FB6-8F62-0A4966BDBC17}"= TCP:C:\Windows\System32\PnkBstrA.exe:PnkBstrA "{A62C46F1-CB33-4FA1-9C6A-8F8B07C66D4D}"= UDP:C:\Windows\System32\PnkBstrB.exe:PnkBstrB "{627C14AD-D105-4F3F-A245-1F5D4295949C}"= TCP:C:\Windows\System32\PnkBstrB.exe:PnkBstrB "{577525A4-4917-46F2-BDD8-4ABB27140815}"= UDP:C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM) "{926A7E26-ED01-42FF-92AA-6A1C46CBA11C}"= TCP:C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM) "TCP Query User{8D4C48F3-BD8F-421B-858F-CE3421A9DE36}C:\\program files\\mozilla firefox\\firefox.exe"= UDP:C:\program files\mozilla firefox\firefox.exe:Firefox "UDP Query User{ABEC8359-5062-431C-A2A2-554A8FD1D639}C:\\program files\\mozilla firefox\\firefox.exe"= TCP:C:\program files\mozilla firefox\firefox.exe:Firefox "{BA8CD49C-D6BA-473A-AAD7-5D06D084E520}"= UDP:C:\Program Files\Eidos\Kane and Lynch Dead Men\kaneandlynch.exe:Kane & Lynch: Dead Men "{BF850267-E387-4435-A3EB-9DAFFCEE7413}"= TCP:C:\Program Files\Eidos\Kane and Lynch Dead Men\kaneandlynch.exe:Kane & Lynch: Dead Men "TCP Query User{6EE16975-AA14-406D-AB3E-E16D86FBADF4}C:\\users\\***\\downloads\\leecher\\leecher.exe"= UDP:C:\users\***\downloads\leecher\leecher.exe:leecher.exe "UDP Query User{4356964A-52DA-440F-8ED7-5C53BAEA7D80}C:\\users\\***\\downloads\\leecher\\leecher.exe"= TCP:C:\users\***\downloads\leecher\leecher.exe:leecher.exe "TCP Query User{B779B951-EB47-4D4C-B952-CD374AA29445}C:\\users\\***\\downloads\\leecher\\leecher.exe"= UDP:C:\users\***\downloads\leecher\leecher.exe:leecher.exe "UDP Query User{0CBF8502-5454-4270-97C7-FE50ED1FE845}C:\\users\\***\\downloads\\leecher\\leecher.exe"= TCP:C:\users\***\downloads\leecher\leecher.exe:leecher.exe "TCP Query User{4815342F-F7AD-40EC-9983-3374A8BED78F}C:\\program files\\icq6\\icq.exe"= UDP:C:\program files\icq6\icq.exe:ICQ Library "UDP Query User{03CBC366-96BD-42FA-923C-828D2B3D97D2}C:\\program files\\icq6\\icq.exe"= TCP:C:\program files\icq6\icq.exe:ICQ Library "{6125401C-7023-458D-A695-4FF15F5521D5}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone) "{D4B771DF-F009-4556-9133-B67E5FF862C7}"= UDP:C:\Program Files\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\XR_3DA.exe:S.T.A.L.K.E.R. - Shadow of Chernobyl (CLI) "{D05F05BD-53C0-42CC-8821-BDEE1CAF56DE}"= TCP:C:\Program Files\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\XR_3DA.exe:S.T.A.L.K.E.R. - Shadow of Chernobyl (CLI) "{BF637F90-0E50-478D-8E0F-FBDE4A610345}"= UDP:C:\Program Files\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\dedicated\XR_3DA.exe:S.T.A.L.K.E.R. - Shadow of Chernobyl (SRV) "{D7F313FF-2643-4052-A82B-4B9312E8115C}"= TCP:C:\Program Files\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\dedicated\XR_3DA.exe:S.T.A.L.K.E.R. - Shadow of Chernobyl (SRV) "{39C5B51D-D733-4640-B980-B19D92712115}"= UDP:C:\Program Files\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\XR_3DA.exe:S.T.A.L.K.E.R. - Shadow of Chernobyl (CLI) "{1B88CDE4-FA56-418E-BE8A-6DF5F1A26C2E}"= TCP:C:\Program Files\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\XR_3DA.exe:S.T.A.L.K.E.R. - Shadow of Chernobyl (CLI) "{E24874D4-E5AE-43AA-B3A2-BDF75D63E7ED}"= UDP:C:\Program Files\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\dedicated\XR_3DA.exe:S.T.A.L.K.E.R. - Shadow of Chernobyl (SRV) "{EA0B3BB0-68FA-41DA-BCCC-E1133B74ECFF}"= TCP:C:\Program Files\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\dedicated\XR_3DA.exe:S.T.A.L.K.E.R. - Shadow of Chernobyl (SRV) "{4C762CA8-7B21-4D48-B0BF-438D32ABCD3F}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{F7239922-84F5-4F9D-8EBA-30FF7C565AA9}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{CB591C8A-3163-4B46-B679-14B7E9D16A1D}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone) "{B89F9E0C-EE04-4F72-B3E1-B213F9483FC9}"= UDP:C:\Program Files\Stardock Games\Sins of a Solar Empire\Sins of a Solar Empire.exe:Sins of a Solar Empire "{46211F86-F9B6-4B32-A62E-1ED0662108AC}"= TCP:C:\Program Files\Stardock Games\Sins of a Solar Empire\Sins of a Solar Empire.exe:Sins of a Solar Empire "{800BED4C-DCC3-4C3C-AB91-242E804BCF02}"= UDP:C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx9.exe:Assassin's Creed Dx9 "{969EC694-B82F-4733-BB2B-510A3FB5A9DD}"= TCP:C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx9.exe:Assassin's Creed Dx9 "{3426C106-D49B-400C-91B0-1716B3DCD861}"= UDP:C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx10.exe:Assassin's Creed Dx10 "{0CEF7DC3-5729-4531-8595-C0ED851E698D}"= TCP:C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx10.exe:Assassin's Creed Dx10 "{1974DCC9-D7B6-4502-96C5-11A5ABEE151C}"= UDP:C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Launcher.exe:Assassin's Creed Update "{1EBAD838-BC7E-4481-858F-D8E73DA78391}"= TCP:C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Launcher.exe:Assassin's Creed Update "{AA533B53-5160-4E3D-AE53-02D31BF0B126}"= C:\Program Files\Skype\Phone\Skype.exe:Skype [HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile] "EnableFirewall"= 0 (0x0) R1 DLARTL_M;DLARTL_M;C:\Windows\system32\Drivers\DLARTL_M.SYS [2007-02-08 21:05] R2 AESTFilters;Andrea ST Filters Service;C:\Windows\system32\aestsrv.exe [2007-08-29 14:25] R2 sprtsvc_dellsupportcenter;SupportSoft Sprocket Service (dellsupportcenter);C:\Program Files\Dell Support Center\bin\sprtsvc.exe [2007-11-15 10:23] R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;C:\Windows\system32\DRIVERS\b57nd60x.sys [2007-07-18 15:30] R3 OEM02Dev;Creative Camera OEM002 Driver;C:\Windows\system32\DRIVERS\OEM02Dev.sys [2007-10-10 18:03] R3 OEM02Vfx;Creative Camera OEM002 Video VFX Driver;C:\Windows\system32\DRIVERS\OEM02Vfx.sys [2007-08-29 07:55] R3 physX32;physX32;C:\Windows\system32\DRIVERS\physX32.sys [2007-06-26 21:15] S3 ggflt;SEMC USB Flash Driver Filter;C:\Windows\system32\DRIVERS\ggflt.sys [2008-03-28 15:39] S3 MTOnlPktAlyX;MTOnlPktAlyX NDIS Protocol Driver;C:\PROGRA~1\T-Online\T-ONLI~1\BASIS-~1\Basis1\MTOnlPktAlyX.SYS [2006-10-09 15:46] S3 R300;R300;C:\Windows\system32\DRIVERS\atikmdag.sys [2006-11-02 09:36] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{24f3f125-95e4-11dc-ae40-c027fb8d1625}] \shell\AutoRun\command - F:\Autorun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{928e1849-c023-11dc-81d5-0015c57f2f27}] \shell\verb1\command - desktop.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{954d8e25-819d-11dc-bd1a-0015c57f2f27}] \shell\AutoRun\command - G:\INSTALL.EXE [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{954d8e35-819d-11dc-bd1a-0015c57f2f27}] \shell\AutoRun\command - H:\autorun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b8048dca-e1f2-11dc-aaf1-0015c57f2f27}] \shell\AutoRun\command - F:\PsychoLauncher.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ce3bd757-dff0-11dc-b01c-0015c57f2f27}] \shell\AutoRun\command - G:\autorun.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-16 12:07:08 Windows 6.0.6001 Service Pack 1 NTFS Scanne versteckte Prozesse... Scanne versteckte Autostart Einträge... Scanne versteckte Dateien... C:\Windows\system32\wbem\Performance\WmiApRpl_new.ini 56608 bytes C:\Users\***\AppData\Local\Temp\WERAE0A.tmp.version.txt Scan erfolgreich abgeschlossen versteckte Dateien: 2 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\Windows\system32\winlogon.exe -> C:\Windows\system32\iifcCsSL.dll PROCESS: C:\Windows\Explorer.exe -> C:\Windows\system32\dsvrpjci.dll . Zeit der Fertigstellung: 2008-05-16 12:08:35 ComboFix-quarantined-files.txt 2008-05-16 10:08:32 ComboFix2.txt 2008-05-15 18:22:50 ComboFix3.txt 2008-05-15 12:36:30 ComboFix4.txt 2008-05-15 12:19:34 13 Verzeichnis(se), 65,414,291,456 Bytes frei 22 Verzeichnis(se), 65,380,995,072 Bytes frei 366 --- E O F --- 2008-05-15 16:49:47 |
|
16.05.2008, 12:26
| #3 |
| | mit verschiedenen Trojanern infiziert (VundoGen etc.) So hier noch die MAM-Log:
__________________Malwarebytes' Anti-Malware 1.12 Datenbank Version: 722 Scan Art: Komplett Scan (C:\|) Objekte gescannt: 256033 Scan Dauer: 1 hour(s), 4 minute(s), 31 second(s) Infizierte Speicher Prozesse: 0 Infizierte Speicher Module: 1 Infizierte Registrierungsschlüssel: 4 Infizierte Registrierungswerte: 3 Infizierte Datei Objekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 5 Infizierte Speicher Prozesse: (Keine Malware Objekte gefunden) Infizierte Speicher Module: C:\Windows\System32\iifcCsSL.dll (Trojan.Vundo) -> No action taken. Infizierte Registrierungsschlüssel: HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{2aa0726c-95b7-4216-aa43-b5bdd524892f} (Trojan.Vundo) -> No action taken. Infizierte Registrierungswerte: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSServer (Trojan.Agent) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BM2137827b (Trojan.Agent) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{2aa0726c-95b7-4216-aa43-b5bdd524892f} (Trojan.Vundo) -> No action taken. Infizierte Datei Objekte der Registrierung: (Keine Malware Objekte gefunden) Infizierte Verzeichnisse: (Keine Malware Objekte gefunden) Infizierte Dateien: C:\Windows\System32\iifcCsSL.dll (Trojan.Agent) -> No action taken. C:\Windows\System32\dsvrpjci.dll (Trojan.Agent) -> No action taken. C:\Windows\System32\opnkiGwt.dll (Trojan.Vundo) -> No action taken. C:\Windows\System32\hgGayvuV.dll (Trojan.Vundo) -> No action taken. Alles sei laut MAM gelöscht bis auf C:\Windows\System32\iifcCsSL.dll (Trojan.Agent) -> No action taken. C:\Windows\System32\dsvrpjci.dll (Trojan.Agent) -> No action taken. Die sollen wohl bei Neustart gelöscht werden. Wie geht es jetzt weiter. Ist dann alles weg??? |
|
16.05.2008, 12:33
| #4 |
| | mit verschiedenen Trojanern infiziert (VundoGen etc.) AntiVir meldet nach Neustart immer noch Trojanerbefall. |
|
16.05.2008, 15:12
| #5 |
| Administrator > Competence Manager  | mit verschiedenen Trojanern infiziert (VundoGen etc.) Du solltest mit Malwarebytes nochmal alles durchsuchen und dann auch entfernen lassen! 
__________________ Anfragen per Email, Profil- oder privater Nachricht werden ignoriert! Hilfe gibts NUR im Forum! Stulti est se ipsum sapientem putare. |
|
16.05.2008, 15:37
| #6 |
| | mit verschiedenen Trojanern infiziert (VundoGen etc.) Hallo, ich habe alles entfernen lassen, das war jetzt bloß die Log-Datei vor dem Löschen. (siehe Ende der letzten Antwort) Ich lass aber nochmal suchen und entfernen. Die Datei, die AntiVir aber immer nennt, hat MAM noch nie gefunden (also bei den zwei Malen als es durchlief). Ich hoffe, es klappt jetzt. |
|
16.05.2008, 15:39
| #7 |
| Administrator > Competence Manager | mit verschiedenen Trojanern infiziert (VundoGen etc.) Soweit so gut.. Bitte das Combofix nochmal neu herunterladen und nach Anleitung ausführen! (die alte Version bitte vorher löschen!) ComboFix
__________________ Anfragen per Email, Profil- oder privater Nachricht werden ignoriert! Hilfe gibts NUR im Forum! Stulti est se ipsum sapientem putare. |
|
| Themen zu mit verschiedenen Trojanern infiziert (VundoGen etc.) |
| add-on, antivir, appinit_dlls, avira, bho, bonjour, browser, ci.dll, computer, desktop, downloader, error, google, hijack, internet, internet explorer, malware.trace, nmindexstoresvr.exe, pdfcreator, prozesse, registrierungsschlüssel, registry, rundll, senden, software, svchost.exe, system, toolbars, trojaner, unknown file in winsock lsp, vundo.gen, vundogen, windows, windows defender |
Hybrid-Darstellung
