Wäre für Logfile-Durchsicht und Hilfe dankbar

sambal · 20.07.2008, 19:42

Zitat:

Zitat von nochdigger

Hallo

lade dir bitte Avenger

Anleitung Avenger (by swandog46)

Lade dir das Tool Avenger und speichere es auf dem Desktop:

Doppelklick auf das Avenger-Symbol

Kopiere nun folgenden Text in das weiße Feld bei -> "input script here"

Code:

ATTFilter

Files to delete:
c:\winxp\system32\syshost.exe
C:\WINXP\system32\Mswinmask32.dll
C:\WINXP\system32\byXqromn.dll
C:\WINXP\system32\byXqromn.ini
C:\WINXP\system32\byXqromn.ini2
C:\WINXP\system32\efcCtUlI.dll
C:\WINXP\BM9fe8edb7.xml
C:\WINXP\BM9fe8edb7.txt
C:\WINXP\system32\97f81a55-.txt

Schliesse nun alle Programme und Browser-Fenster

Um den Avenger zu starten klicke auf -> Execute
Dann bestätigen mit "Yes" das der Rechner neu startet

Nachdem das System neu gestartet ist, findest du einen Report vom Avenger unter -> C:\avenger.txt

Öffne die Datei mit dem Editor und kopiere den gesamten Text in deinen Beitrag hier am Trojaner-Board.

Erstelle bitte nach einem Neustart ein frisches HijackThis Log sowie eine Übersicht mit der Filelist.

MFG

Code:

ATTFilter

 Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:41:43, on 20.07.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20733)
Boot mode: Normal

Running processes:
C:\WINXP\System32\smss.exe
C:\WINXP\system32\winlogon.exe
C:\WINXP\system32\services.exe
C:\WINXP\system32\lsass.exe
C:\WINXP\system32\svchost.exe
C:\WINXP\System32\svchost.exe
C:\WINXP\system32\svchost.exe
C:\WINXP\system32\LEXBCES.EXE
C:\WINXP\system32\LEXPPS.EXE
C:\WINXP\system32\spoolsv.exe
C:\WINXP\Explorer.EXE
C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nTrayFw.exe
C:\WINXP\RTHDCPL.EXE
C:\WINXP\system32\RUNDLL32.EXE
C:\Programme\avmwlanstick\wlangui.exe
C:\Programme\Lexmark 2200 Series\lxbvbmgr.exe
C:\Nokia\PC Suite\Nokia PC Suite 6\LaunchApplication.exe
C:\WINXP\system32\winadm.exe
C:\Programme\Gemeinsame Dateien\TerraTec\Scheduler\TTTimer.exe
C:\Programme\Gemeinsame Dateien\TerraTec\Remote\TTTVRC.exe
C:\Programme\Winamp\winampa.exe
C:\WINXP\emMON.exe
C:\Programme\Lexmark 2200 Series\lxbvbmon.exe
C:\Programme\Logitech\Gaming Software\LWEMon.exe
C:\WINXP\system32\ctfmon.exe
C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe
C:\Programme\DAEMON Tools\daemon.exe
C:\Programme\Winamp Remote\bin\OrbTray.exe
C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Programme\movie - XL\j-point.exe
C:\WINXP\system32\winadmd.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\Programme\Gemeinsame Dateien\AAV\aavus.exe
C:\Programme\avmwlanstick\WlanNetService.exe
C:\WINXP\system32\crypserv.exe
C:\PROGRA~1\NVIDIA~1\NETWOR~1\Apache Group\Apache2\bin\apache.exe
C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Programme\1&1\IGDCTRL.EXE
C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nSvcIp.exe
C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nSvcLog.exe
C:\PROGRA~1\NVIDIA~1\NETWOR~1\Apache Group\Apache2\bin\apache.exe
C:\WINXP\system32\nvsvc32.exe
C:\WINXP\system32\PnkBstrA.exe
C:\WINXP\system32\svchost.exe
C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nSvcAppFlt.exe
C:\Programme\PC Connectivity Solution\ServiceLayer.exe
C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe
C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexStoreSvr.exe
C:\WINXP\System32\svchost.exe
C:\WINXP\system32\wuauclt.exe
C:\Programme\HijackThis\HijackThis.exe
C:\WINXP\system32\wscntfy.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.1und1.de/links/home
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://sedoparking.com/domparking.php?id=827484&q=%s
O2 - BHO: (no name) - {02F1680C-3D42-4ABA-A21B-60D7D702D3C5} - (no file)
O2 - BHO: (no name) - {04C1FB24-13C0-4879-91E3-530480B8435D} - (no file)
O2 - BHO: (no name) - {08D55B0E-5701-4FD1-A311-C72728397B36} - (no file)
O2 - BHO: (no name) - {0A7F954D-87AE-4075-9173-E5197729AFB5} - (no file)
O2 - BHO: (no name) - {115aba89-8931-4eb7-ab8f-d4c2144b615a} - (no file)
O2 - BHO: (no name) - {14EEE55C-350A-4DCB-9755-711E339B0143} - (no file)
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - (no file)
O2 - BHO: (no name) - {1F30CC18-E60C-47F6-8491-B147611716A6} - (no file)
O2 - BHO: (no name) - {1F54B5AD-6DDE-46A2-8984-206B63ED3EA5} - (no file)
O2 - BHO: (no name) - {30f432d6-3d78-4f03-96bb-537bae4edbb8} - (no file)
O2 - BHO: (no name) - {35AC88AE-AA2A-4BF4-8CD4-76D4A2FD978A} - (no file)
O2 - BHO: (no name) - {37A8CC70-931A-4BB0-A8F9-D8ECA3E98D34} - (no file)
O2 - BHO: (no name) - {38BA9558-E89A-4B12-904B-09C723ADE336} - (no file)
O2 - BHO: (no name) - {39659af7-55d5-41de-bdf1-d71d9f10383f} - (no file)
O2 - BHO: (no name) - {3C4727C2-BF3F-48F0-9670-33D72E2ED5C0} - (no file)
O2 - BHO: (no name) - {435603ce-22b6-4136-bd34-9e424a84d292} - (no file)
O2 - BHO: (no name) - {4A4F165E-8ACE-4018-A268-1EBE0A5B4DBE} - (no file)
O2 - BHO: (no name) - {4CCB7895-FE8F-48D1-B6BE-13CD331EB0B6} - (no file)
O2 - BHO: (no name) - {4D8D07E3-FEF2-46E1-9DE6-A8ABE8863ABD} - (no file)
O2 - BHO: (no name) - {4F08C949-344E-4D5F-9998-A2F538964B29} - (no file)
O2 - BHO: (no name) - {50e4dbac-4dbb-43af-b42f-1b49971040da} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {552D71CF-C8A1-481C-A67F-99A4BCD6306C} - (no file)
O2 - BHO: (no name) - {56EC59E9-4C9C-4EB8-8C7C-ED5CF78D5660} - (no file)
O2 - BHO: (no name) - {58116D3D-BDDC-4527-A3BD-BEB73A7E1F99} - (no file)
O2 - BHO: (no name) - {5ce2d153-1b85-4c8e-a973-f17c18a1b089} - (no file)
O2 - BHO: (no name) - {61ba702a-4358-4a00-a07f-f42a6f1fe240} - (no file)
O2 - BHO: (no name) - {6559ebb3-4173-43a7-8a33-f9c007a8b5c5} - (no file)
O2 - BHO: (no name) - {6715F9A8-0671-4AC2-88AF-E9AFD87FCD96} - (no file)
O2 - BHO: (no name) - {68b02ca5-2640-4758-9c95-1eb98f5bf0bf} - (no file)
O2 - BHO: (no name) - {68ed779e-3263-4517-a46f-b0204f342b1f} - (no file)
O2 - BHO: (no name) - {6F4F7B70-C56A-4BC0-94B1-AD7B819C3B60} - (no file)
O2 - BHO: (no name) - {70A4B46A-0FB6-46D0-A218-7E93AE2DE733} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {78ee0128-70eb-4af9-ae23-778ece54976b} - (no file)
O2 - BHO: (no name) - {7BA9225C-6D21-4E39-BED0-4EB99F32342C} - (no file)
O2 - BHO: (no name) - {7EA2C94D-292B-4EC8-B129-78DFF24754A5} - (no file)
O2 - BHO: (no name) - {89EE75FD-A270-40F3-9ECC-697E2B30A72B} - (no file)
O2 - BHO: (no name) - {8BDB015D-E913-41B7-B664-DC62D648AA51} - (no file)
O2 - BHO: (no name) - {8FAA2F89-CA9B-4953-92C9-3BD60B72776F} - (no file)
O2 - BHO: (no name) - {8fed5ebc-8cd4-441f-91b7-8c25179bc670} - (no file)
O2 - BHO: (no name) - {94B590DF-35E1-49C5-8EB5-95B138ACEEB4} - (no file)
O2 - BHO: (no name) - {99658FCE-F188-43BE-B47B-B9E8BDDC461C} - (no file)
O2 - BHO: (no name) - {9EC58C69-3FC0-43A6-BC75-813391DBE293} - (no file)
O2 - BHO: (no name) - {9f3b561f-37bd-4555-aabe-a3e6011c0f06} - (no file)
O2 - BHO: (no name) - {A08D782F-5F4A-40AF-AFDD-4ACA0E970D26} - (no file)
O2 - BHO: (no name) - {A24516C0-840E-43FC-82BC-EE006C9DE699} - (no file)
O2 - BHO: (no name) - {AC85C27E-F74C-480D-9CB0-2A359F96C094} - (no file)
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O2 - BHO: (no name) - {BF0CA4FC-6378-4062-B546-3CDE8A28B1E0} - (no file)
O2 - BHO: (no name) - {CCFC88CA-8F0F-496A-BE9C-CA3E99D96814} - (no file)
O2 - BHO: (no name) - {cdf6799b-cb38-4821-b8c1-3af5c86b9d3c} - (no file)
O2 - BHO: (no name) - {D2BBEF7C-6F22-4A47-97AC-B6A5E0E87D11} - (no file)
O2 - BHO: 1&&1 Internet AG Browser Configuration by mquadr.at - {D48FF4B4-E68F-47D1-8E25-81A0F0EEB341} - C:\WINXP\system32\ieconfig_1und1.dll
O2 - BHO: (no name) - {D5BB29A8-24C0-4AAE-A303-14435D5A4AB8} - (no file)
O2 - BHO: (no name) - {D70D5D73-1A76-49FA-AE76-3F0D80FCF6B3} - (no file)
O2 - BHO: (no name) - {D83A984F-325C-4FD1-83BD-61A92D694DBC} - (no file)
O2 - BHO: (no name) - {e074f63e-6109-4a69-80d1-04f06f5fd28a} - (no file)
O2 - BHO: (no name) - {e4d4565d-d938-49f3-aca2-f4c2d7e89546} - (no file)
O2 - BHO: (no name) - {EF6C251D-7E36-422F-A89B-80C4619E5EC7} - (no file)
O2 - BHO: (no name) - {FC8EB5F6-C25F-4975-8254-5677CEB62F4F} - (no file)
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Ask Toolbar - {F4D76F09-7896-458a-890F-E1F05C46069F} - C:\Programme\AskPBar\bar\1.bin\ASKPBAR.DLL
O3 - Toolbar: (no name) - {90222687-F593-4738-B738-FBEE9C7B26DF} - (no file)
O4 - HKLM\..\Run: [nTrayFw] C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nTrayFw.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINXP\JM\JMInsIDE.exe
O4 - HKLM\..\Run: [JMB36X Configure] C:\WINXP\system32\JMRaidSetup.exe boot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINXP\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINXP\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVMWlanClient] C:\Programme\avmwlanstick\wlangui.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Lexmark 2200 Series] "C:\Programme\Lexmark 2200 Series\lxbvbmgr.exe"
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Nokia\PC Suite\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [_winadm] C:\WINXP\system32\winadm.exe
O4 - HKLM\..\Run: [TerraTec Scheduler] "C:\Programme\Gemeinsame Dateien\TerraTec\Scheduler\TTTimer.exe"
O4 - HKLM\..\Run: [TerraTec Remote Control] C:\Programme\Gemeinsame Dateien\TerraTec\Remote\TTTVRC.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Programme\Winamp\winampa.exe
O4 - HKLM\..\Run: [emMON] emMON.exe
O4 - HKLM\..\Run: [Start WingMan Profiler] C:\Programme\Logitech\Gaming Software\LWEMon.exe /noui
O4 - HKLM\..\Run: [BM9fe8edb7] Rundll32.exe "C:\WINXP\system32\hreyhlfm.dll",s
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINXP\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Programme\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [Orb] "C:\Programme\Winamp Remote\bin\OrbTray.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINXP\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINXP\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINXP\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINXP\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O4 - Startup: movie - XL.lnk = C:\Programme\movie - XL\StartJP.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINXP\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINXP\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra button: (no name) - Cmdmapping - (no file) (HKCU)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: efcCtUlI - C:\WINXP\
O23 - Service: AAV UpdateService - Unknown owner - C:\Programme\Gemeinsame Dateien\AAV\aavus.exe
O23 - Service: AVM WLAN Connection Service - AVM Berlin - C:\Programme\avmwlanstick\WlanNetService.exe
O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - C:\WINXP\SYSTEM32\crypserv.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\PROGRA~1\NVIDIA~1\NETWOR~1\Apache Group\Apache2\bin\apache.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: AVM IGD CTRL Service (IGDCTRL) - AVM Berlin - C:\Programme\1&1\IGDCTRL.EXE
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINXP\system32\LEXBCES.EXE
O23 - Service: NBService - Nero AG - C:\Programme\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\PROGRA~1\NVIDIA~1\NETWOR~1\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINXP\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINXP\system32\PnkBstrA.exe
O23 - Service: ServiceLayer - Nokia. - C:\Programme\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 14568 bytes

Wäre für Logfile-Durchsicht und Hilfe dankbar

Log-Analyse und Auswertung: Wäre für Logfile-Durchsicht und Hilfe dankbar

Wäre für Logfile-Durchsicht und Hilfe dankbar

Ähnliche Themen: Wäre für Logfile-Durchsicht und Hilfe dankbar