| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Micro Antivirus 2009 - echt zu blöd ...Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
29.09.2008, 15:23
| #1 |
| |  Micro Antivirus 2009 - echt zu blöd ... Erstmal gleich sorry, dass ich euch mit sowas belästige. Ich weis, "kann schon mal passieren", nur das es mir passiert ärgert und schmerzt am meisten, aber egal. Die rumpelstilzchen-phase hab ich gerade im garten hinter mich gebracht (sorry an die nachbarn!), und jetzt poste ich gleich mal, was in anderen threads zB. von myrtille bereits gefordert wurde: Malwarebytes' Anti-Malware 1.28 Datenbank Version: 1221 Windows 5.1.2600 Service Pack 2 29.09.2008 15:59:27 mbam-log-2008-09-29 (15-59-27).txt Scan-Methode: Vollständiger Scan (C:\|D:\|) Durchsuchte Objekte: 219796 Laufzeit: 1 hour(s), 20 minute(s), 10 second(s) Infizierte Speicherprozesse: 7 Infizierte Speichermodule: 3 Infizierte Registrierungsschlüssel: 16 Infizierte Registrierungswerte: 21 Infizierte Dateiobjekte der Registrierung: 2 Infizierte Verzeichnisse: 2 Infizierte Dateien: 42 Infizierte Speicherprozesse: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\uvapibut\udklcxwj.exe (Trojan.Downloader) -> Unloaded process successfully. C:\Programme\PCHealthCenter\1.exe (Trojan.Fakealert) -> Unloaded process successfully. C:\Programme\PCHealthCenter\2.exe (Trojan.Fakealert) -> Unloaded process successfully. C:\Programme\PCHealthCenter\3.exe (Trojan.Fakealert) -> Unloaded process successfully. C:\Programme\PCHealthCenter\4.exe (Trojan.Fakealert) -> Unloaded process successfully. C:\Programme\PCHealthCenter\7.exe (Trojan.Fakealert) -> Unloaded process successfully. C:\Programme\MicroAV\MicroAV.exe (Rogue.MicroAntivirus) -> Unloaded process successfully. Infizierte Speichermodule: C:\WINDOWS\system32\khfGVlJd.dll (Trojan.Vundo.H) -> Delete on reboot. C:\WINDOWS\system32\hGvutrpo.dll (Trojan.Vundo) -> Delete on reboot. C:\Programme\ICQToolbar\toolbaru.dll (Adware.BHO) -> Delete on reboot. Infizierte Registrierungsschlüssel: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{f2cce6cd-ff43-4157-ae2a-a0ddf79c673f} (Trojan.Vundo.H) -> Delete on reboot. HKEY_CLASSES_ROOT\CLSID\{f2cce6cd-ff43-4157-ae2a-a0ddf79c673f} (Trojan.Vundo.H) -> Delete on reboot. HKEY_CLASSES_ROOT\CLSID\{5E549732-E106-9A48-C292-04F4103235C7} (Trojan.FakeAlert.H) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{9e49f5a8-060f-40a6-b3ff-314d147adbd9} (Trojan.Vundo) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\hgvutrpo (Trojan.Vundo) -> Delete on reboot. HKEY_CLASSES_ROOT\toolband.xttbpos00 (Adware.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\TypeLib\{77d6ddfa-7834-4541-b2b3-a8b0fb0e3924} (Adware.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{055fd26d-3a88-4e15-963d-dc8493744b1d} (Adware.BHO) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{055fd26d-3a88-4e15-963d-dc8493744b1d} (Adware.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{4bd2d6c3-31dc-b947-23d0-dc52ec4f0c4c} (Adware.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{855f3b16-6d32-4fe6-8a56-bbb695989046} (Adware.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\toolband.xttbpos00.1 (Adware.BHO) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\wkey (Malware.Trace) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\MicroAV (Rogue.MicroAntivirus) -> Quarantined and deleted successfully. Infizierte Registrierungswerte: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\sysweb (Trojan.FakeAlert.H) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qi1tc4nduo (Trojan.FakeAlert.H) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{9e49f5a8-060f-40a6-b3ff-314d147adbd9} (Trojan.Vundo) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{855f3b16-6d32-4fe6-8a56-bbb695989046} (Adware.BHO) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\{855f3b16-6d32-4fe6-8a56-bbb695989046} (Adware.BHO) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{855f3b16-6d32-4fe6-8a56-bbb695989046} (Adware.BHO) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\{855f3b16-6d32-4fe6-8a56-bbb695989046} (Adware.BHO) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\antivirus (Rogue.MicroAntivirus) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\antivirus (Rogue.MicroAntivirus) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur13.exe (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur14.exe (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur15.exe (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur16.exe (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur53.exe (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur59.exe (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur13.exe (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur14.exe (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur15.exe (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur16.exe (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur53.exe (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur59.exe (Trojan.Agent) -> Quarantined and deleted successfully. Infizierte Dateiobjekte der Registrierung: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\khfgvljd -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\khfgvljd -> Delete on reboot. Infizierte Verzeichnisse: C:\Programme\PCHealthCenter (Trojan.Fakealert) -> Quarantined and deleted successfully. C:\Programme\MicroAV (Rogue.MicroAntivirus) -> Quarantined and deleted successfully. Infizierte Dateien: C:\WINDOWS\system32\khfGVlJd.dll (Trojan.Vundo.H) -> Delete on reboot. C:\WINDOWS\system32\dJlVGfhk.ini (Trojan.Vundo.H) -> Delete on reboot. C:\WINDOWS\system32\dJlVGfhk.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\Programme\wolqmed\SysWeb.dll (Trojan.FakeAlert.H) -> Delete on reboot. C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\uvapibut\udklcxwj.exe (Trojan.FakeAlert.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\hGvutrpo.dll (Trojan.Vundo) -> Delete on reboot. C:\Programme\ICQToolbar\toolbaru.dll (Adware.BHO) -> Delete on reboot. C:\Dokumente und Einstellungen\user\Lokale Einstellungen\Temporary Internet Files\Content.IE5\DHPHE9XI\wEvkx1zFE1[1].exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Dokumente und Einstellungen\user\Lokale Einstellungen\Temporary Internet Files\Content.IE5\DHPHE9XI\CAC9I7GT (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Dokumente und Einstellungen\user\Lokale Einstellungen\Temporary Internet Files\Content.IE5\DHPHE9XI\file[1].exe (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\sSMddATk.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Programme\PCHealthCenter\0.exe (Trojan.Fakealert) -> Quarantined and deleted successfully. C:\Programme\PCHealthCenter\0.gif (Trojan.Fakealert) -> Quarantined and deleted successfully. C:\Programme\PCHealthCenter\1.exe (Trojan.Fakealert) -> Quarantined and deleted successfully. C:\Programme\PCHealthCenter\1.gif (Trojan.Fakealert) -> Quarantined and deleted successfully. C:\Programme\PCHealthCenter\1.ico (Trojan.Fakealert) -> Quarantined and deleted successfully. C:\Programme\PCHealthCenter\2.exe (Trojan.Fakealert) -> Quarantined and deleted successfully. C:\Programme\PCHealthCenter\2.gif (Trojan.Fakealert) -> Quarantined and deleted successfully. C:\Programme\PCHealthCenter\2.ico (Trojan.Fakealert) -> Quarantined and deleted successfully. C:\Programme\PCHealthCenter\3.exe (Trojan.Fakealert) -> Quarantined and deleted successfully. C:\Programme\PCHealthCenter\3.gif (Trojan.Fakealert) -> Quarantined and deleted successfully. C:\Programme\PCHealthCenter\4.exe (Trojan.Fakealert) -> Quarantined and deleted successfully. C:\Programme\PCHealthCenter\5.exe (Trojan.Fakealert) -> Quarantined and deleted successfully. C:\Programme\PCHealthCenter\7.exe (Trojan.Fakealert) -> Quarantined and deleted successfully. C:\Programme\PCHealthCenter\sc.html (Trojan.Fakealert) -> Quarantined and deleted successfully. C:\Programme\MicroAV\MicroAV.cpl (Rogue.MicroAntivirus) -> Quarantined and deleted successfully. C:\Programme\MicroAV\MicroAV.exe (Rogue.MicroAntivirus) -> Quarantined and deleted successfully. C:\Programme\MicroAV\MicroAV.ooo (Rogue.MicroAntivirus) -> Quarantined and deleted successfully. C:\Programme\MicroAV\MicroAV0.dat (Rogue.MicroAntivirus) -> Quarantined and deleted successfully. C:\Programme\MicroAV\MicroAV1.dat (Rogue.MicroAntivirus) -> Quarantined and deleted successfully. C:\WINDOWS\system32\1.ico (Malware.Trace) -> Quarantined and deleted successfully. C:\WINDOWS\system32\2.ico (Malware.Trace) -> Quarantined and deleted successfully. C:\WINDOWS\system32\YUR13.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\YUR14.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\YUR15.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\YUR16.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\YUR53.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\YUR59.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\x (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\WINDOWS\system32\MicroAV.cpl (Rogue.MicroAntivirus) -> Quarantined and deleted successfully. C:\Dokumente und Einstellungen\user\Desktop\Micro Antivirus 2009.lnk (Rogue.XPertAntivirus) -> Quarantined and deleted successfully. C:\Dokumente und Einstellungen\user\Lokale Einstellungen\Temp\lwpwer.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. Einträge habe ich auch schon gelöscht, mit dem ergebnis, dass schon mal das nervige popup verschwunden ist. Hier folgt das RSIT info file: http://www.file-upload.net/download-.../info.txt.html und noch das log: http://www.file-upload.net/download-...0/log.txt.html Bitte um eure hilfe, wies weitergehn soll, danke! =( Geändert von spidermike (29.09.2008 um 15:37 Uhr) |
| Themen zu Micro Antivirus 2009 - echt zu blöd ... |
| 1.exe, adware.bho, antivirus, antivirus 2009, blöd, browser, content.ie5, dateien, desktop, einstellungen, explorer, gelöscht, helper, icq, internet, internet explorer, malware.trace, malwarebytes, malwarebytes' anti-malware, micro, micro antivirus 2009, microsoft, notification, popup, programme, registrierungsschlüssel, software, system, trojan.agent, trojan.downloader, trojan.fakealert.h, winlogon |
Baum-Darstellung