| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: mit verschiedenen Trojanern infiziert (VundoGen etc.)Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
16.05.2008, 11:12
| #13 |
 |  mit verschiedenen Trojanern infiziert (VundoGen etc.) Ok, das hat funktioniert außer, dass er die Logfile nicht erstellt hat. Die Logfile vom zweiten Durchlauf danach folgt gleich. Jetzt läuft noch MAM durch. ComboFix 08-05-12.1 - *** 2008-05-16 12:03:33.6 - NTFSx86 Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1031.18.1097 [GMT 2:00] ausgeführt von:: C:\Users\Tino\Desktop\ComboFix.exe . (((((((((((((((((((((((((((((((((((( Weitere Löschungen )))))))))))))))))))))))))))))))))))))))))))))))) . . ---- Previous Run ------- . C:\VundoFix Backups C:\Windows\system32\cbXRKBrO.dll C:\Windows\system32\cnecgudk.dll C:\Windows\System32\nwljupjq.ini C:\Windows\System32\OrBKRXbc.ini C:\Windows\System32\OrBKRXbc.ini2 C:\Windows\System32\pukvhypy.dll C:\Windows\system32\qjpujlwn.dll C:\Windows\System32\twGiknpo.ini C:\Windows\System32\twGiknpo.ini2 C:\Windows\system32\VuvyaGgh.ini C:\Windows\System32\VuvyaGgh.ini2 . ((((((((((((((((((((((( Dateien erstellt von 2008-04-16 bis 2008-05-16 )))))))))))))))))))))))))))))) . 2008-05-16 12:00 . 2008-05-13 11:32 57,344 --a------ C:\Windows\System32\iifcCsSL.dll 2008-05-15 22:48 . 2008-05-15 22:48 125,952 --a------ C:\Windows\System32\dsvrpjci.dll 2008-05-15 22:47 . 2008-05-15 22:47 370,176 --a------ C:\Windows\System32\hgGayvuV.dll 2008-05-15 21:19 . 2008-05-15 21:19 133,120 --a------ C:\Windows\System32\mrmvghtp.dll 2008-05-15 21:14 . 2008-05-15 21:14 125,952 --a------ C:\Windows\System32\dgmbxitt.dll 2008-05-15 21:13 . 2008-05-15 21:13 370,176 --a------ C:\Windows\System32\opnkiGwt.dll 2008-05-15 21:02 . 2008-05-15 22:41 336,526,713 --a------ C:\Windows\MEMORY.DMP 2008-05-15 20:59 . 2008-05-15 20:59 126,016 --a------ C:\Windows\System32\rapniulx.dll 2008-05-15 14:40 . 2008-05-15 14:40 126,528 --a------ C:\Windows\System32\xsalgnuu.dll 2008-05-15 14:04 . 2008-05-15 14:04 <DIR> d-------- C:\Program Files\CCleaner 2008-05-15 12:56 . 2008-05-05 20:46 27,048 --a------ C:\Windows\System32\drivers\mbamcatchme.sys 2008-05-15 12:56 . 2008-05-05 20:46 15,864 --a------ C:\Windows\System32\drivers\mbam.sys 2008-05-15 11:02 . 2008-05-15 11:02 <DIR> d-------- C:\Users\***\AppData\Roaming\Malwarebytes 2008-05-15 11:02 . 2008-05-15 11:02 <DIR> d-------- C:\Users\All Users\Malwarebytes 2008-05-15 11:02 . 2008-05-15 11:02 <DIR> d-------- C:\ProgramData\Malwarebytes 2008-05-15 11:02 . 2008-05-15 12:56 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-05-14 14:06 . 2008-05-14 14:06 <DIR> dr------- C:\Windows\System32\config\systemprofile\Documents 2008-05-14 13:24 . 2008-05-14 13:24 <DIR> d-------- C:\Users\All Users\Office Genuine Advantage 2008-05-14 13:24 . 2008-05-14 13:24 <DIR> d-------- C:\ProgramData\Office Genuine Advantage 2008-05-13 17:35 . 2008-03-05 15:56 3,786,760 --a------ C:\Windows\System32\D3DX9_37.dll 2008-05-13 17:35 . 2008-03-05 15:56 1,420,824 --a------ C:\Windows\System32\D3DCompiler_37.dll 2008-05-13 17:35 . 2008-03-05 16:03 479,752 --a------ C:\Windows\System32\XAudio2_0.dll 2008-05-13 17:35 . 2008-02-05 23:07 462,864 --a------ C:\Windows\System32\d3dx10_37.dll 2008-05-13 17:35 . 2008-03-05 16:03 238,088 --a------ C:\Windows\System32\xactengine3_0.dll 2008-05-13 17:35 . 2008-03-05 16:00 25,608 --a------ C:\Windows\System32\X3DAudio1_3.dll 2008-05-13 17:28 . 2008-05-13 17:28 <DIR> d-------- C:\Program Files\LucasArts 2008-05-13 11:32 . 2008-05-15 13:42 <DIR> d-------- C:\Program Files\DiskTrix 2008-05-05 16:05 . 2008-05-15 12:45 <DIR> d-------- C:\Users\***\AppData\Roaming\skypePM 2008-05-05 16:05 . 2008-05-05 16:05 56 --ah----- C:\Windows\System32\ezsidmv.dat 2008-05-05 16:04 . 2008-05-15 14:20 <DIR> d-------- C:\Users\***\AppData\Roaming\Skype 2008-05-05 16:03 . 2008-05-05 16:03 <DIR> d-------- C:\Users\All Users\Skype 2008-05-05 16:03 . 2008-05-05 16:03 <DIR> d-------- C:\ProgramData\Skype 2008-05-05 16:03 . 2008-05-05 16:03 <DIR> d-------- C:\Program Files\Skype 2008-05-05 16:03 . 2008-05-05 16:03 <DIR> d-------- C:\Program Files\Common Files\Skype 2008-04-21 09:55 . 2008-04-21 09:55 <DIR> d-------- C:\Users\All Users\Apple 2008-04-21 09:55 . 2008-04-21 09:55 <DIR> d-------- C:\ProgramData\Apple 2008-04-21 09:55 . 2008-04-21 09:55 <DIR> d-------- C:\Program Files\Apple Software Update 2008-04-18 21:53 . 2008-04-18 22:21 <DIR> d-------- C:\Users\All Users\TrackMania 2008-04-18 21:53 . 2008-04-18 22:21 <DIR> d-------- C:\ProgramData\TrackMania 2008-04-17 21:32 . 2008-04-17 21:33 <DIR> d-------- C:\Program Files\CDex_170b2 2008-04-16 15:42 . 2008-04-16 15:45 <DIR> d-------- C:\Program Files\TmNationsForever 8 Datei(en), . 247,757 C:\ComboFix\Bytes 8 Datei(en), . 247,757 C:\ComboFix\Bytes . (((((((((((((((((((((((((((((((((((( Find3M Bericht )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-05-16 09:59 352,614 ---ha-w C:\Windows\system32\drivers\vsconfig.xml 2008-05-16 08:42 2,659,840 ----a-w C:\Windows\Internet Logs\xDB92BD.tmp 2008-05-15 16:49 --------- d-----w C:\Program Files\Windows Mail 2008-05-15 16:32 --------- d-----w C:\ProgramData\Microsoft Help 2008-05-15 11:36 --------- d-----w C:\ProgramData\Google Updater 2008-05-14 17:01 62,056 ----a-w C:\Users\***\AppData\Roaming\nvModes.dat 2008-05-13 15:56 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-04-21 07:56 --------- d-----w C:\Program Files\ICQ6 2008-04-15 19:01 --------- d-----w C:\Users\***\AppData\Roaming\Ubisoft 2008-04-15 18:46 --------- d-----w C:\ProgramData\Ubisoft 2008-04-15 18:33 --------- d-----w C:\Program Files\Ubisoft 2008-04-15 18:32 --------- d-----w C:\Users\***\AppData\Roaming\InstallShield 2008-04-12 09:33 --------- d-----w C:\Program Files\Double Fine Productions 2008-04-09 18:51 --------- d-----w C:\ProgramData\Media Center Programs 2008-04-06 21:40 --------- d-----w C:\Program Files\QuickTime 2008-04-06 21:39 --------- d-----w C:\ProgramData\Apple Computer 2008-04-03 11:28 --------- d--h--w C:\ProgramData\{0E8E33D8-193A-414A-A909-0F101A142D26} 2008-04-03 11:25 --------- d-----w C:\Program Files\Stardock Games 2008-04-03 08:56 --------- d-----w C:\Program Files\Crazy Machines II 2008-03-31 11:07 --------- d-----w C:\Program Files\HP 2008-03-29 11:18 0 ---ha-w C:\Windows\system32\drivers\Msft_Kernel_ggsemc_01005.Wdf 2008-03-28 13:39 20,520 ----a-w C:\Windows\system32\drivers\ggsemc.sys 2008-03-28 13:39 13,352 ----a-w C:\Windows\system32\drivers\ggflt.sys 2008-03-28 13:39 1,419,232 ----a-w C:\Windows\System32\wdfcoinstaller01005.dll 2008-03-28 13:33 --------- d-----w C:\ProgramData\Sony Ericsson 2008-03-28 13:31 --------- d-----w C:\Program Files\Sony Ericsson 2008-03-28 09:43 0 ---ha-w C:\Windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf 2008-03-26 18:25 --------- d-----w C:\Program Files\Google 2008-03-25 17:30 --------- d-----w C:\ProgramData\NVIDIA 2008-03-25 17:28 174 --sha-w C:\Program Files\desktop.ini 2008-03-25 17:20 --------- d-----w C:\Program Files\Windows Sidebar 2008-03-25 17:20 --------- d-----w C:\Program Files\Windows Photo Gallery 2008-03-25 17:20 --------- d-----w C:\Program Files\Windows Journal 2008-03-25 17:20 --------- d-----w C:\Program Files\Windows Defender 2008-03-25 17:20 --------- d-----w C:\Program Files\Windows Collaboration 2008-03-25 17:20 --------- d-----w C:\Program Files\Windows Calendar 2008-03-25 16:57 82,432 ----a-w C:\Windows\System32\axaltocm.dll 2008-03-25 16:57 101,888 ----a-w C:\Windows\System32\ifxcardm.dll 2008-03-21 15:13 --------- d-----w C:\Program Files\The FilmMachine 2008-03-21 13:38 --------- d-----w C:\Users\***\AppData\Roaming\Media Player Classic 2008-03-21 13:35 --------- d-----w C:\Program Files\K-Lite Codec Pack 2008-03-21 13:13 --------- d-----w C:\Program Files\AviSynth 2.5 2008-03-21 10:28 --------- d-----w C:\Users\***\AppData\Roaming\Nero 2008-03-21 10:25 --------- d-----w C:\Program Files\Common Files\Nero 2008-03-21 10:22 --------- d-----w C:\ProgramData\Nero 2008-03-21 10:22 --------- d-----w C:\Program Files\Nero 2008-03-20 17:12 --------- d-----w C:\Program Files\THQ 2008-03-20 16:53 107,888 ----a-w C:\Windows\System32\CmdLineExt.dll 2008-03-20 12:31 --------- d-----w C:\Program Files\NeroInstall.bak 2008-03-13 13:40 413,696 ----a-w C:\Windows\System32\wrap_oal.dll 2008-03-13 13:40 110,592 ----a-w C:\Windows\System32\OpenAL32.dll 2008-03-03 13:05 54,672 ----a-w C:\Windows\System32\vsutil_loc0407.dll 2008-03-03 13:05 1,086,952 ----a-w C:\Windows\System32\zpeng24.dll 2008-02-29 07:14 19,000 ----a-w C:\Windows\System32\kd1394.dll 2008-02-29 07:11 988,216 ----a-w C:\Windows\System32\winload.exe 2008-02-29 07:11 927,288 ----a-w C:\Windows\System32\winresume.exe 2008-02-29 06:53 46,592 ----a-w C:\Windows\System32\setbcdlocale.dll 2008-02-29 06:53 40,960 ----a-w C:\Windows\System32\srclient.dll 2008-02-29 06:53 378,368 ----a-w C:\Windows\System32\srcore.dll 2008-02-29 06:35 6,656 ----a-w C:\Windows\System32\kbd106n.dll 2008-02-29 04:21 2,032,128 ----a-w C:\Windows\System32\win32k.sys 2008-02-29 04:12 318,464 ----a-w C:\Windows\System32\rstrui.exe 2008-02-29 04:12 14,848 ----a-w C:\Windows\System32\srdelayed.exe 2008-02-28 16:38 972,072 ----a-w C:\Windows\UNNeroMediaHome.exe 2008-02-26 15:14 972,072 ----a-w C:\Windows\UNRecode.exe 2008-02-22 05:05 615,992 ----a-w C:\Windows\System32\ci.dll 2008-02-22 05:01 826,880 ----a-w C:\Windows\System32\wininet.dll 2008-02-22 04:57 295,936 ----a-w C:\Windows\System32\gdi32.dll 2008-02-20 20:16 1,370,112 ----a-w C:\Windows\Internet Logs\xDBACD1.tmp 2008-02-18 15:04 95,600 ----a-w C:\Windows\System32\NeroCo.dll 2007-11-16 17:04 22,328 ----a-w C:\Users\***\AppData\Roaming\PnkBstrK.sys 2007-10-17 07:17 76 --sh--r C:\Windows\CT4CET.bin 2006-05-03 09:06 163,328 --sh--r C:\Windows\System32\flvDX.dll 2007-02-21 10:47 31,232 --sh--r C:\Windows\System32\msfDX.dll . ------- Sigcheck ------- . ((((((((((((((((((((((((((((( snapshot_2008-05-15_20.22.14.29 ))))))))))))))))))))))))))))))))))))))))) . - 2008-05-15 18:17:08 67,584 --s-a-w C:\Windows\bootstat.dat + 2008-05-16 09:58:45 67,584 --s-a-w C:\Windows\bootstat.dat + 2008-05-16 09:58:46 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2008-05-16 09:58:46 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2008-05-15 18:17:28 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\ntuser.dat + 2008-05-16 10:00:53 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\ntuser.dat + 2008-05-16 10:00:53 262,144 ---ha-w C:\Windows\ServiceProfiles\LocalService\ntuser.dat.LOG1 - 2008-05-15 18:17:28 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.dat + 2008-05-16 10:00:48 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.dat + 2008-05-16 10:00:48 262,144 ---ha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1 - 2008-05-15 18:17:54 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2008-05-16 10:01:39 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2008-05-15 18:17:54 49,152 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2008-05-16 10:01:39 49,152 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2008-05-15 18:17:54 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2008-05-16 10:01:39 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2008-05-15 16:49:43 123,658 ----a-w C:\Windows\System32\perfc007.dat + 2008-05-16 08:36:20 123,658 ----a-w C:\Windows\System32\perfc007.dat - 2008-05-15 16:49:43 102,094 ----a-w C:\Windows\System32\perfc009.dat + 2008-05-16 08:36:20 101,916 ----a-w C:\Windows\System32\perfc009.dat - 2008-05-15 16:49:43 621,940 ----a-w C:\Windows\System32\perfh007.dat + 2008-05-16 08:36:20 621,940 ----a-w C:\Windows\System32\perfh007.dat - 2008-05-15 16:49:43 590,082 ----a-w C:\Windows\System32\perfh009.dat + 2008-05-16 08:36:20 589,904 ----a-w C:\Windows\System32\perfh009.dat - 2008-05-15 16:44:04 9,186 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3039615548-3396779488-269229600-1000_UserData.bin + 2008-05-16 10:01:26 9,466 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3039615548-3396779488-269229600-1000_UserData.bin - 2008-05-15 16:44:03 87,898 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin + 2008-05-16 10:01:25 88,462 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin - 2008-05-15 16:43:57 61,154 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin + 2008-05-16 08:30:29 61,162 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin . -- Snapshot reset to current date -- |
| Themen zu mit verschiedenen Trojanern infiziert (VundoGen etc.) |
| add-on, antivir, appinit_dlls, avira, bho, bonjour, browser, ci.dll, computer, desktop, downloader, error, google, hijack, internet, internet explorer, malware.trace, nmindexstoresvr.exe, pdfcreator, prozesse, registrierungsschlüssel, registry, rundll, senden, software, svchost.exe, system, toolbars, trojaner, unknown file in winsock lsp, vundo.gen, vundogen, windows, windows defender |
Baum-Darstellung