| |
| |||||||
Log-Analyse und Auswertung: Trojanerfund Spy.GenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
| |
18.05.2008, 22:33
| #1 |
 |  Trojanerfund Spy.Gen Naja, eigentlich wollte mein Freund nur bei Sopcast via Livestream Eishockey gucken, was er schon öfter gemacht hat. Irgendwo hatte ich jetzt gelesen, dass Quicktime wohl etwas anfällig ist, was Trojanereinschleusen angeht. Das hatte er gestern für ein Audiofile runtergeladen. Für Lucky: ctfmon.exe bei virustotal: Datei cftmon.exe empfangen 2008.05.18 23:16:09 (CET)Antivirus Version letzte aktualisierung Ergebnis AhnLab-V3 2008.5.16.0 2008.05.18 - AntiVir 7.8.0.19 2008.05.18 - Authentium 5.1.0.4 2008.05.17 - Avast 4.8.1195.0 2008.05.18 - AVG 7.5.0.516 2008.05.18 - BitDefender 7.2 2008.05.18 - CAT-QuickHeal 9.50 2008.05.17 - ClamAV 0.92.1 2008.05.18 - DrWeb 4.44.0.09170 2008.05.17 - eSafe 7.0.15.0 2008.05.18 Suspicious File eTrust-Vet 31.4.5796 2008.05.16 - Ewido 4.0 2008.05.18 - F-Prot 4.4.2.54 2008.05.16 - F-Secure 6.70.13260.0 2008.05.18 - Fortinet 3.14.0.0 2008.05.18 - GData 2.0.7306.1023 2008.05.18 - Ikarus T3.1.1.26.0 2008.05.18 - Kaspersky 7.0.0.125 2008.05.18 - McAfee 5297 2008.05.17 - Microsoft 1.3408 2008.05.13 - NOD32v2 3107 2008.05.18 - Norman 5.80.02 2008.05.16 - Panda 9.0.0.4 2008.05.18 - Prevx1 V2 2008.05.18 - Rising 20.44.62.00 2008.05.18 - Sophos 4.29.0 2008.05.18 - Sunbelt 3.0.1123.1 2008.05.17 - Symantec 10 2008.05.18 - TheHacker 6.2.92.312 2008.05.18 - VBA32 3.12.6.6 2008.05.18 - VirusBuster 4.3.26:9 2008.05.18 - weitere Informationen File size: 28160 bytes MD5...: cdf6e14ae0de978b67eed9dd6cdfaa29 SHA1..: 7eb0a676ccb457f410f56169593473d90afe9a94 SHA256: b508b5b5a013aef5d9fdfc5a97bfa76dcc2998b7511d5eebbd0c9d3e0e365154 SHA512: df81be5ff4f3ac788190d5f0c33f77b6dba9116801395bb237eea68127c6c2cc<BR>1e36f453c890326f8bf596e92401f5a775e6beb6e0b170ba4bfb321c7c5ba6d4 PEiD..: - PEInfo: PE Structure information<BR><BR>( base data )<BR>entrypointaddress.: 0x40110d<BR>timedatestamp.....: 0x47c1a6d7 (Sun Feb 24 17:18:15 2008)<BR>machinetype.......: 0x14c (I386)<BR><BR>( 3 sections )<BR>name viradd virsiz rawdsiz ntrpy md5<BR>.text 0x1000 0x14c5 0x1600 5.22 3f1555e0e1e53dbc01938133771f0d87<BR>.data 0x3000 0x533b 0x5400 7.75 3d688590e2f69c9bc3da9415a5fbcbfe<BR>.reloc 0x9000 0x1164498 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e<BR><BR>( 2 imports ) <BR>> comctl32.dll: ImageList_EndDrag, ImageList_LoadImageW, ImageList_GetIconSize<BR>> user32.dll: GetWindowTextA, GetCursor, IsMenu<BR><BR>( 0 exports ) <BR> Und folgendes stand bei dem anderen da: Die Datei wurde bereits analysiert: MD5: cdf6e14ae0de978b67eed9dd6cdfaa29 First received: 2008.05.18 23:16:30 (CET) Datum 2008.05.18 23:16:34 (CET) [<1D] Ergebnisse 1/31 Permalink: analisis/a70f9380b268d705c7850b70ea29db79 ->anscheinend wohl das gleiche... Der Rest ist noch in Arbeit. |
|
18.05.2008, 22:36
| #2 | |
| /// Helfer-Team    | Trojanerfund Spy.GenZitat:
__________________ |
|
18.05.2008, 22:41
| #3 |
| | Trojanerfund Spy.Gen Bitte schön...
__________________Datei spools.exe empfangen 2008.05.18 23:38:41 (CET)Antivirus Version letzte aktualisierung Ergebnis AhnLab-V3 2008.5.10.0 2008.05.13 - AntiVir 7.8.0.17 2008.05.13 - Authentium 5.1.0.4 2008.05.14 - Avast 4.8.1169.0 2008.05.12 - AVG 7.5.0.516 2008.05.13 - BitDefender 7.2 2008.05.08 - CAT-QuickHeal 9.50 2008.05.12 - ClamAV 0.92.1 2008.05.13 - DrWeb 4.44.0.09170 2008.05.13 - eSafe 7.0.15.0 2008.05.12 Suspicious File eTrust-Vet 31.4.5784 2008.05.13 - Ewido 4.0 2008.05.13 - F-Prot 4.4.2.54 2008.05.13 - F-Secure 6.70.13260.0 2008.05.13 - Fortinet 3.14.0.0 2008.05.13 - GData 2.0.7306.1023 2008.05.14 - Ikarus T3.1.1.26.0 2008.05.13 - Kaspersky 7.0.0.125 2008.05.13 - McAfee 5293 2008.05.12 - Microsoft 1.3408 2008.05.13 - NOD32v2 3095 2008.05.13 - Norman 5.80.02 2008.05.09 - Panda 9.0.0.4 2008.05.12 - Prevx1 V2 2008.05.18 - Rising 20.44.12.00 2008.05.13 - Sophos 4.29.0 2008.05.13 - Sunbelt 3.0.1114.0 2008.05.12 - Symantec 10 2008.05.13 - TheHacker 6.2.92.309 2008.05.13 - VBA32 3.12.6.6 2008.05.13 - VirusBuster 4.3.26:9 2008.05.12 - Webwasher-Gateway 6.6.2 2008.05.13 - weitere Informationen File size: 28160 bytes MD5...: cdf6e14ae0de978b67eed9dd6cdfaa29 SHA1..: 7eb0a676ccb457f410f56169593473d90afe9a94 SHA256: b508b5b5a013aef5d9fdfc5a97bfa76dcc2998b7511d5eebbd0c9d3e0e365154 SHA512: df81be5ff4f3ac788190d5f0c33f77b6dba9116801395bb237eea68127c6c2cc<BR>1e36f453c890326f8bf596e92401f5a775e6beb6e0b170ba4bfb321c7c5ba6d4 PEiD..: - PEInfo: PE Structure information<BR><BR>( base data )<BR>entrypointaddress.: 0x40110d<BR>timedatestamp.....: 0x47c1a6d7 (Sun Feb 24 17:18:15 2008)<BR>machinetype.......: 0x14c (I386)<BR><BR>( 3 sections )<BR>name viradd virsiz rawdsiz ntrpy md5<BR>.text 0x1000 0x14c5 0x1600 5.22 3f1555e0e1e53dbc01938133771f0d87<BR>.data 0x3000 0x533b 0x5400 7.75 3d688590e2f69c9bc3da9415a5fbcbfe<BR>.reloc 0x9000 0x1164498 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e<BR><BR>( 2 imports ) <BR>> comctl32.dll: ImageList_EndDrag, ImageList_LoadImageW, ImageList_GetIconSize<BR>> user32.dll: GetWindowTextA, GetCursor, IsMenu<BR><BR>( 0 exports ) <BR> |
|
19.05.2008, 13:59
| #4 |
| | Trojanerfund Spy.Gen So, hier schon mal das von dem MBAM... Eine Erkenntnis hab ich schon gesammelt: wir haben zuviel auf'm PC drauf... Malwarebytes' Anti-Malware 1.12 Datenbank Version: 722 Scan Art: Komplett Scan (C:\|) Objekte gescannt: 240996 Scan Dauer: 15 hour(s), 48 minute(s), 44 second(s) Infizierte Speicher Prozesse: 1 Infizierte Speicher Module: 0 Infizierte Registrierungsschlüssel: 36 Infizierte Registrierungswerte: 6 Infizierte Datei Objekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 7 Infizierte Speicher Prozesse: C:\Dokumente und Einstellungen\LocalService\cftmon.exe (Trojan.Agent) -> Unloaded process successfully. Infizierte Speicher Module: (Keine Malware Objekte gefunden) Infizierte Registrierungsschlüssel: HKEY_CLASSES_ROOT\asapcom.asapenvelope (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{286e500c-ef0a-4aa3-a94d-e495f653ef4b} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{319260ab-be0c-4025-8569-7a27ed2faab9} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{8ac5bc54-b13b-4642-99f9-0baa2d116184} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{9809a6b4-70b1-4bb2-b3b5-b415763a534e} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{d5178f77-c5e6-4e8f-9787-48b5d7eccce8} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\asapcom.asapenvelope.1 (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\asapcom.asapmessage (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\asapcom.asapmessage.1 (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\asapcom.asapclass (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\asapcom.asapclass.1 (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\asapcom.asapmain (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\asapcom.asapmain.1 (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\asapcom.asaprecipients (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\asapcom.asaprecipients.1 (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{21447c90-6ec1-4fc1-9379-bd515008aedb} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{32c97a37-e2b8-4097-9330-5f3e1125e181} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{b0c3de1b-e3ff-4dd0-9229-f452cf9c678e} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{d2d94732-a74d-433c-98f7-9ed740e82ae9} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{dfd5d79b-ef2f-4a51-9821-5b469f05262e} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Typelib\{bce2e826-d0f5-41c8-97be-28a6f540ceeb} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\AppID\{127df9b4-d75d-44a6-af78-8c3a8ceb03db} (Adware.WhenUSave) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\acm.acmfactory (Adware.WhenUSave) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\acm.acmfactory.1 (Adware.WhenUSave) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{a9aae1ab-9688-42c5-86f5-c12f6b9015ad} (Adware.WhenUSave) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{43382522-a846-46f4-ac57-1f71ae6e1086} (Adware.WhenUSave) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{572fb162-c0ba-4edf-8cff-e3846153b9b0} (Adware.WhenUSave) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{72a836d1-bc00-43c0-a941-17960e4fb842} (Adware.WhenUSave) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Typelib\{df901432-1b9f-4f5b-9e56-301c553f9095} (Adware.WhenUSave) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\schedule (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\schedule (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\schedule (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\Software\Trymedia Systems (Adware.Trymedia) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\AppID\ACM.DLL (Adware.WhenUSave) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\WUSN.1 (Adware.WhenUSave) -> Quarantined and deleted successfully. Infizierte Registrierungswerte: HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\autoload (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\ntuser (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ntuser (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ntuser (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\autoload (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\autoload (Trojan.Agent) -> Quarantined and deleted successfully. Infizierte Datei Objekte der Registrierung: (Keine Malware Objekte gefunden) Infizierte Verzeichnisse: (Keine Malware Objekte gefunden) Infizierte Dateien: C:\Programme\IncrediMail\bin\asapsdk.dll (Adware.Hotbar) -> Quarantined and deleted successfully. C:\Dokumente und Einstellungen\***l\Anwendungsdaten\Desktopicon\eBayShortcuts.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\Dokumente und Einstellungen\Stefan Schmohl\cftmon.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\drivers\spools.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\Fonts\acrsecB.fon (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\Fonts\acrsecI.fon (Trojan.Agent) -> Quarantined and deleted successfully. C:\Dokumente und Einstellungen\LocalService\cftmon.exe (Trojan.Agent) -> Quarantined and deleted successfully. _______________________________________________ SDFix SDFix: Version 1.183 Run by Administrator on 19.05.2008 at 15:25 Microsoft Windows XP [Version 5.1.2600] Running From: C:\DOKUME~1\***~1\Desktop\SDFix Checking Services : Restoring Windows Registry Values Restoring Windows Default Hosts File Restoring Missing SharedAccess Service Rebooting Checking Files : Trojan Files Found: C:\WINDOWS\smdat32a.sys - Deleted Removing Temp Files ADS Check : Final Check : catchme 0.3.1359.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-19 15:38:41 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] "s1"=dword:b0a84dd9 "s2"=dword:a100fe26 "h0"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "h0"=dword:00000000 "khjeh"=hex:bd,e7,52,13,c8,d8,9c,87,f6,64,75,ff,b0,48,a3,84,30,30,9e,08,1f,.. "p0"="C:\Programme\DAEMON Tools\" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "khjeh"=hex:9a,1a,b3,15,c2,be,03,7f,23,c2,24,21,f4,89,0b,e2,d5,7b,1a,35,29,.. "a0"=hex:20,01,00,00,9c,dd,66,04,ed,5f,ae,a7,3c,1e,65,8d,c0,ee,e4,98,f2,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:0a,56,9e,10,26,17,24,0f,b5,40,59,bb,a9,77,02,14,64,db,c9,5e,23,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41] "khjeh"=hex:26,85,db,b0,18,6f,87,b5,75,ae,d8,da,64,67,b8,60,98,48,4d,28,00,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42] "khjeh"=hex:bb,5a,5c,4a,2d,d3,9d,93,74,e9,39,38,ed,a1,b7,f2,4b,ac,5b,bd,ad,.. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf43] "khjeh"=hex:09,45,08,e1,28,1b,d5,41,2b,c5,e7,22,a5,73,6d,21,d0,72,87,97,2b,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4] "h0"=dword:00000000 "khjeh"=hex:bd,e7,52,13,c8,d8,9c,87,f6,64,75,ff,b0,48,a3,84,30,30,9e,08,1f,.. "p0"="C:\Programme\DAEMON Tools\" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001] "khjeh"=hex:9a,1a,b3,15,c2,be,03,7f,23,c2,24,21,f4,89,0b,e2,d5,7b,1a,35,29,.. "a0"=hex:20,01,00,00,9c,dd,66,04,ed,5f,ae,a7,3c,1e,65,8d,c0,ee,e4,98,f2,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40] "khjeh"=hex:0a,56,9e,10,26,17,24,0f,b5,40,59,bb,a9,77,02,14,64,db,c9,5e,23,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41] "khjeh"=hex:26,85,db,b0,18,6f,87,b5,75,ae,d8,da,64,67,b8,60,98,48,4d,28,00,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42] "khjeh"=hex:bb,5a,5c,4a,2d,d3,9d,93,74,e9,39,38,ed,a1,b7,f2,4b,ac,5b,bd,ad,.. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf43] "khjeh"=hex:09,45,08,e1,28,1b,d5,41,2b,c5,e7,22,a5,73,6d,21,d0,72,87,97,2b,.. scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Remaining Services : Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "C:\\Programme\\MSN Messenger\\msnmsgr.exe"="C:\\Programme\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1" "C:\\Programme\\MSN Messenger\\livecall.exe"="C:\\Programme\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" "C:\\Programme\\PPMate\\ppmate.exe"="C:\\Programme\\PPMate\\ppmate.exe:*:Enabled:PPMate" "C:\\Programme\\PPMate\\ppmnet.exe"="C:\\Programme\\PPMate\\ppmnet.exe:*:Enabled:PPMate" "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Programme\\Bonjour\\mDNSResponder.exe"="C:\\Programme\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "C:\\Programme\\MSN Messenger\\msnmsgr.exe"="C:\\Programme\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1" "C:\\Programme\\MSN Messenger\\livecall.exe"="C:\\Programme\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" Remaining Files : File Backups: - C:\DOKUME~1\***~1\Desktop\SDFix\backups\backups.zip Files with Hidden Attributes : Thu 9 Mar 2006 4,348 ..SH. --- "C:\Dokumente und Einstellungen\All Users\DRM\DRMv1.bak" Sat 18 Aug 2007 0 A.SH. --- "C:\Dokumente und Einstellungen\All Users\DRM\Cache\Indiv02.tmp" Thu 8 May 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\5738cdd16dbca4079cb3b3de6eaf620f\BIT8.tmp" Wed 21 Nov 2007 1,332 ...HR --- "C:\Dokumente und Einstellungen\***\Anwendungsdaten\SecuROM\UserData\securom_v7_01.bak" Finished! ________________________ HJT Logfile of HijackThis v1.99.1 Scan saved at 15:52:11, on 19.05.2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0013) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\Programme\AntiVir PersonalEdition Classic\sched.exe C:\Programme\AntiVir PersonalEdition Classic\avguard.exe C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Programme\FRITZ!DSL\IGDCTRL.EXE C:\Programme\Bonjour\mDNSResponder.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\drivers\CDAC11BA.EXE C:\Programme\Gemeinsame Dateien\InterVideo\DeviceService\DevSvc.exe C:\WINDOWS\system32\CTsvcCDA.exe C:\Programme\Gemeinsame Dateien\Portrait Displays\Shared\DTSRVC.exe C:\WINDOWS\system32\HPZipm12.exe C:\Programme\CyberLink\Shared Files\RichVideo.exe C:\WINDOWS\System32\svchost.exe C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe C:\Programme\Viewpoint\Common\ViewpointService.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\Programme\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\WINDOWS\system32\notepad.exe C:\Programme\D-Link\AirPlus XtremeG\AirPlusCFG.exe C:\Programme\ANI\ANIWZCS2 Service\WZCSLDR2.exe C:\Programme\NVIDIA Corporation\NvMixer\NVMixerTray.exe C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe C:\Programme\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE C:\Programme\CyberLink\PowerDVD\PDVDServ.exe C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe C:\Programme\Java\jre1.6.0_05\bin\jusched.exe C:\Programme\Creative\MediaSource5\MtdAcqu.exe C:\WINDOWS\System32\svchost.exe C:\Programme\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE C:\Programme\FRITZ!DSL\StCenter.exe C:\Programme\ATI Technologies\ATI.ACE\Core-Static\ccc.exe C:\Dokumente und Einstellungen\***\Desktop\HJT\HJT.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h**p://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: metaspinner media GmbH - {12FC9A49-CFE0-49AA-BE9E-8F4EEAFC9443} - C:\Programme\TVgenial\IEButtonTVGenialEBayInterface.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Viewpoint Toolbar BHO - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\Programme\Viewpoint\Viewpoint Toolbar\3.8.0\ViewBarBHO.dll O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Programme\Gemeinsame Dateien\Viewpoint\Toolbar Runtime\3.8.0\IEViewBar.dll O4 - HKLM\..\Run: [D-Link AirPlus XtremeG] C:\Programme\D-Link\AirPlus XtremeG\AirPlusCFG.exe O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Programme\ANI\ANIWZCS2 Service\WZCSLDR2.exe O4 - HKLM\..\Run: [NVMixerTray] "C:\Programme\NVIDIA Corporation\NvMixer\NVMixerTray.exe" O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE O4 - HKLM\..\Run: [CTXFIREG] CTxfiReg.exe O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [CTSysVol] C:\Programme\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r O4 - HKLM\..\Run: [CTDVDDET] C:\Programme\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE O4 - HKLM\..\Run: [RemoteControl] C:\Programme\CyberLink\PowerDVD\PDVDServ.exe O4 - HKLM\..\Run: [LanguageShortcut] C:\Programme\CyberLink\PowerDVD\Language\Language.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Programme\Lexmark X1100 Series\lxbkbmgr.exe" O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Programme\Unlocker\UnlockerAssistant.exe" O4 - HKCU\..\Run: [IncrediMail] C:\Programme\IncrediMail\bin\IncMail.exe /c O4 - HKCU\..\Run: [SB Audigy 2 Startup Menu] "C:\Programme\Creative\SBAudigy2ZS\Program\Startup Menu\ChkColor.EXE" O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe O4 - HKCU\..\Run: [StartCCC] C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe O4 - HKCU\..\Run: [E06DXLRD_688187] "C:\Programme\Microsoft Encarta\Encarta 2006 Enzyklopaedie DVD\EDICT.EXE" -m O4 - HKCU\..\Run: [MtdAcqu] "C:\Programme\Creative\MediaSource5\MtdAcqu.exe" /s O4 - HKCU\..\Run: [L08DXLRD_18448953] "C:\Programme\Microsoft Lernen und Wissen\Microsoft Encarta 2008 – Lernen und Wissen DVD\EDICT.EXE" -m O4 - Startup: FRITZ!DSL Startcenter.lnk = C:\Programme\FRITZ!DSL\StCenter.exe O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Programme\ICQToolbar\toolbaru.dll/SEARCH.HTML O8 - Extra context menu item: &Search - h**p://kp.bar.need2find.com/KP/menusearch.html?p=KP O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\programme\bonjour\mdnsnsp.dll O11 - Options group: [INTERNATIONAL] International* O12 - Plugin for .spop: C:\Programme\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1140214477135 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1181169531296 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pu...sh/swflash.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{A1DECE52-8AED-4844-A803-626747F8939E}: NameServer = 192.168.122.252,192.168.122.253 O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: AVM IGD CTRL Service - AVM Berlin - C:\Programme\FRITZ!DSL\IGDCTRL.EXE O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Programme\Bonjour\mDNSResponder.exe O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE O23 - Service: Capture Device Service - InterVideo Inc. - C:\Programme\Gemeinsame Dateien\InterVideo\DeviceService\DevSvc.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: AVM FRITZ!web Routing Service (de_serv) - AVM Berlin - C:\Programme\Gemeinsame Dateien\AVM\de_serv.exe O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Programme\Gemeinsame Dateien\Portrait Displays\Shared\DTSRVC.exe O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Programme\MAGIX\Common\Database\bin\fbserver.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Programme\CyberLink\Shared Files\RichVideo.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Programme\Viewpoint\Common\ViewpointService.exe Geändert von Sunshine2408 (19.05.2008 um 14:59 Uhr) |
|
19.05.2008, 15:07
| #5 | |
| /// TB-Ausbilder  | Trojanerfund Spy.Gen Hi, die Logs sehen gut aus  Ist diese Datei noch vorhanden? Zitat:
__________________ Anfragen per Email, Profil- oder privater Nachricht werden ignoriert! Hilfe gibts NUR im Forum! Wer nach 24 Stunden keine weitere Antwort von mir bekommen hat, schickt bitte eine PM Spelling mistakes? Never, but keybaord malfunctions constantly! |
|
19.05.2008, 17:31
| #6 |
| | Trojanerfund Spy.Gen Jein, es sind noch die Dateien ftp34.vir (so heißt die datei nach Umbenennung) und ftp34.vir000 da. Konnte ich aber beide diesmal manuell löschen, nachdem Antivir erstmal aufgeschrien hatte, als ich sie lediglich angeklickt hatte, um sie eben zu löschen... Hab allerdings noch eine Datei ftp.exe. Aber die ist hoffentlich harmlos? Da passiert zumindest nix, wenn ich die einfach mal markiere... |
|
19.05.2008, 17:36
| #7 |
| /// TB-Ausbilder | Trojanerfund Spy.Gen ftp.exe sollte zu Windows gehören.  Wenn du sicher gehen willst, kannst du noch die Datei bei virustotal hochladen und schauen was erkannt wird. lg myrtille
__________________ Anfragen per Email, Profil- oder privater Nachricht werden ignoriert! Hilfe gibts NUR im Forum! Wer nach 24 Stunden keine weitere Antwort von mir bekommen hat, schickt bitte eine PM Spelling mistakes? Never, but keybaord malfunctions constantly! |
|
| Themen zu Trojanerfund Spy.Gen |
| adobe, autoload, avg, avira, bho, bonjour, desktop, drivers, dsl, einstellungen, excel, explorer, ftp, hijack, hijackthis, internet, internet explorer, locker, magix, ntuser, object, programm, software, system, tr/spy.gen, trojan, trojanerfund, uleadburninghelper, unknown file in winsock lsp, virus, windows, windows xp, windows\system32\drivers |
Hybrid-Darstellung
