| |
| |||||||
Log-Analyse und Auswertung: wcs.exeWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
18.10.2008, 11:46
| #1 |
| |  wcs.exe Hallo ich habe vor kurzem per Zufall auf meinem Rechner die Datei "wcs.exe" gefunden, da ich diese Datei nich kannte und sich immer beim Abmelden bzw. Ausschalten eine Fehlermeldung mit eben dieser Datei zeigte habe ich sie bei Google gesucht und bin auf dieses Forum gestoßen. Hier hab ich mir dan HJT herruntergeladen und bin der Anleitung bis zum Schritt "Einsetzen von HJT - Auswertung" gefolgt. Nun bin ich jedoch komplett Planlos und weis nicht weiter. Ich bitte um Eure Hilfe und hoffe auf schnelle Antwort. MFG Anubis PS.: anbei das erste Log was ich mit HJT gemacht hat Code:
ATTFilter Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:52:08, on 18.10.2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\acs.exe C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe C:\Acer\Empowering Technology\admServ.exe C:\Programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe C:\WINDOWS\Explorer.EXE C:\Programme\Applications\iebtm.exe C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe C:\Program Files\Atheros\ACU.exe C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\system32\igfxsrvc.exe C:\Programme\Launch Manager\LManager.exe C:\Programme\Applications\iebtmm.exe C:\Programme\Gemeinsame Dateien\Logitech\LComMgr\LVComSX.exe C:\Programme\Synaptics\SynTP\SynTPEnh.exe C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe C:\Acer\Empowering Technology\admtray.exe C:\Programme\Hewlett-Packard\HP Software Update\HPWuSchd.exe C:\Programme\HP\hpcoretech\hpcmpmgr.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe C:\WINDOWS\system32\ctfmon.exe C:\Programme\Messenger\msmsgs.exe C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\igfxext.exe C:\DOKUME~1\WINKLE~1.WIN\LOKALE~1\Temp\RtkBtMnt.exe C:\Programme\Applications\wcm.exe C:\Programme\Applications\wcs.exe C:\Programme\Internet Explorer\iexplore.exe C:\Programme\Internet Explorer\iexplore.exe C:\Programme\Internet Explorer\iexplore.exe C:\Dokumente und Einstellungen\XXX\Desktop\HiJackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = h**p://windiwsfsearch.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://de.intl.acer.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = h**p://windiwsfsearch.com/ie6.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://windiwsfsearch.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://de.intl.acer.yahoo.com O2 - BHO: 675873 helper - {030A0F33-5B99-482E-83F5-2EEB8457878B} - C:\WINDOWS\system32\675873\675873.dll O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: VirRLWarningBHO Class - {A81EBFD7-0FA3-41ec-B60D-6DAE78B4D31A} - C:\Programme\VirRL2009\VirRLWarning.dll (file missing) O2 - BHO: (no name) - {BE1A344F-9FF5-4024-949B-52205E6DB2D0} - C:\Programme\Applications\iebt.dll O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll O3 - Toolbar: Internet Service - {144A6B24-0EBC-4D89-BF09-A06A718E57B5} - C:\Programme\Applications\iebr.dll O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Programme\isuspm.exe" -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [Acer Assist Launcher] C:\Programme\Acer Assist\launcher.exe O4 - HKLM\..\Run: [ACU] "C:\Program Files\Atheros\ACU.exe" -nogui O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [AzMixerSel] C:\Programme\Realtek\InstallShield\AzMixerSel.exe O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [LManager] C:\Programme\Launch Manager\LManager.exe O4 - HKLM\..\Run: [LVCOMSX] "C:\Programme\Gemeinsame Dateien\Logitech\LComMgr\LVComSX.exe" O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe O4 - HKLM\..\Run: [ADMTray.exe] "C:\Acer\Empowering Technology\admtray.exe" O4 - HKLM\..\Run: [HP Software Update] "C:\Programme\Hewlett-Packard\HP Software Update\HPWuSchd.exe" O4 - HKLM\..\Run: [HP Component Manager] "C:\Programme\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe O4 - HKLM\..\Run: [DeviceDiscovery] C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background O4 - HKLM\..\Policies\Explorer\Run: [smile] C:\Programme\Applications\wcs.exe O4 - HKLM\..\Policies\Explorer\Run: [start] C:\Programme\Applications\iebtm.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: BTTray.lnk = ? O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\Programme\Microsoft Office\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Senden an &Bluetooth-Gerät... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm O9 - Extra button: (no name) - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.howtoiexplorer.com/redirect.php (file missing) O9 - Extra 'Tools' menuitem: IE Anti-Spyware - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.howtoiexplorer.com/redirect.php (file missing) O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\OFFICE11\REFIEBAR.DLL O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O22 - SharedTaskScheduler: amenity - {fef6ace8-bb45-4009-8342-63415164d691} - C:\WINDOWS\system32\bmztmss.dll O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: AdminWorks Agent X6 (AWService) - Avocent Inc. - C:\Acer\Empowering Technology\admServ.exe O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe O23 - Service: hpdj - HP - C:\DOKUME~1\WINKLE~1.WIN\LOKALE~1\Temp\hpdj.exe O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Programme\Gemeinsame Dateien\Logitech\SrvLnch\SrvLnch.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\Windows\System32\ZoneLabs\vsmon.exe -- End of file - 8266 bytes |
|
18.10.2008, 13:14
| #2 |
| Gast | wcs.exe Moin,
__________________Na da hast du dir aber einiges eingefangen.. Wir lassen mal gleich alles durchlaufen, nicht das uns da was durchrutscht: 1. SmitFraudFix 2. Malwarebytes Anti-Malware 3. SASW Poste dann alle Logs hier. lg, Sky |
|
20.10.2008, 17:34
| #3 |
| | wcs.exe Danke für die Informationen
__________________ich hatte gehofft das es nich so schlimm ist ich hatte vor kurzer zeit(so ca. vor fünf Tagen) schon mal CCleaner und Avira AntiVir drüber laufen lassen und Avira hatte nur 2 verdächtige Dateien und 12 Warnungen gehabt. Na ja aber nun auch egal also hier die logs von SmitfraudFix Code:
ATTFilter SmitFraudFix v2.364
Scan done at 21:34:48,76, 18.10.2008
Run from C:\Dokumente und Einstellungen\XXX\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode
»»»»»»»»»»»»»»»»»»»»»»»» Process
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Acer\Empowering Technology\admServ.exe
C:\Programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Applications\iebtm.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe
C:\Program Files\Atheros\ACU.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\igfxsrvc.exe
C:\Programme\Launch Manager\LManager.exe
C:\Programme\Applications\iebtmm.exe
C:\Programme\Gemeinsame Dateien\Logitech\LComMgr\LVComSX.exe
C:\Programme\Synaptics\SynTP\SynTPEnh.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Acer\Empowering Technology\admtray.exe
C:\Programme\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Programme\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Messenger\msmsgs.exe
C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\igfxext.exe
C:\DOKUME~1\WINKLE~1.WIN\LOKALE~1\Temp\RtkBtMnt.exe
C:\Programme\Applications\wcm.exe
C:\Programme\Applications\wcs.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Dokumente und Einstellungen\Winkler.WINKLER-PC\Desktop\HiJackThis.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\cmd.exe
»»»»»»»»»»»»»»»»»»»»»»»» hosts
»»»»»»»»»»»»»»»»»»»»»»»» C:\
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32
C:\WINDOWS\system32\algg.exe FOUND !
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles
»»»»»»»»»»»»»»»»»»»»»»»» C:\Dokumente und Einstellungen\XXX
»»»»»»»»»»»»»»»»»»»»»»»» C:\Dokumente und Einstellungen\XXX\Application Data
»»»»»»»»»»»»»»»»»»»»»»»» Start Menu
C:\DOKUME~1\ALLUSE~1.WIN\STARTM~1\Antivirus Scan.url FOUND !
C:\DOKUME~1\ALLUSE~1.WIN\STARTM~1\Online Spyware Test.url FOUND !
»»»»»»»»»»»»»»»»»»»»»»»» C:\DOKUME~1\WINKLE~1.WIN\FAVORI~1
»»»»»»»»»»»»»»»»»»»»»»»» Desktop
»»»»»»»»»»»»»»»»»»»»»»»» C:\Programme
»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys
»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Die derzeitige Homepage"
»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, following keys are not inevitably infected!!!
o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, following keys are not inevitably infected!!!
IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, following keys are not inevitably infected!!!
VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, following keys are not inevitably infected!!!
404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
+--------------------------------------------------+
[!] Suspicious: 675873.dll
BHO: 675873 Class - {030A0F33-5B99-482E-83F5-2EEB8457878B}
BHO CLSID TypeLib: {E63648F7-3933-440E-AAAA-A8584DD7B7EB}
Corrected TypeLib: {E63648F7-3933-440E-B4F6-A8584DD7B7EB}
Interface: {F7D09218-46D7-4D3D-9B7F-315204CD0836}
»»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix
!!!Attention, following keys are not inevitably infected!!!
AntiXPVSTFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{fef6ace8-bb45-4009-8342-63415164d691}"="amenity"
[HKEY_CLASSES_ROOT\CLSID\{fef6ace8-bb45-4009-8342-63415164d691}\InProcServer32]
@="C:\WINDOWS\system32\bmztmss.dll"
[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{fef6ace8-bb45-4009-8342-63415164d691}\InProcServer32]
@="C:\WINDOWS\system32\bmztmss.dll"
»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""
»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
"System"=""
»»»»»»»»»»»»»»»»»»»»»»»» RK
»»»»»»»»»»»»»»»»»»»»»»»» DNS
Description: Atheros AR5005G Wireless Network Adapter - Paketplaner-Miniport
DNS Server Search Order: 192.168.1.254
HKLM\SYSTEM\CCS\Services\Tcpip\..\{F60EE6D3-C42F-4095-9DAD-3C145475031B}: DhcpNameServer=192.168.1.254
HKLM\SYSTEM\CS1\Services\Tcpip\..\{F60EE6D3-C42F-4095-9DAD-3C145475031B}: DhcpNameServer=192.168.1.254
HKLM\SYSTEM\CS3\Services\Tcpip\..\{F60EE6D3-C42F-4095-9DAD-3C145475031B}: DhcpNameServer=192.168.1.254
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.254
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.254
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.254
»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection
»»»»»»»»»»»»»»»»»»»»»»»» End
von Malwarebytes' Anti-Malware Code:
ATTFilter Malwarebytes' Anti-Malware 1.29
Datenbank Version: 1286
Windows 5.1.2600 Service Pack 3
19.10.2008 09:00:43
mbam-log-2008-10-19 (09-00-43).txt
Scan-Methode: Vollständiger Scan (C:\|D:\|)
Durchsuchte Objekte: 218937
Laufzeit: 2 hour(s), 29 minute(s), 59 second(s)
Infizierte Speicherprozesse: 4
Infizierte Speichermodule: 3
Infizierte Registrierungsschlüssel: 26
Infizierte Registrierungswerte: 5
Infizierte Dateiobjekte der Registrierung: 5
Infizierte Verzeichnisse: 3
Infizierte Dateien: 26
Infizierte Speicherprozesse:
C:\Programme\Applications\iebtm.exe (Trojan.Zlob) -> Unloaded process successfully.
C:\Programme\Applications\iebtmm.exe (Trojan.Zlob) -> Unloaded process successfully.
C:\Programme\Applications\wcm.exe (Trojan.Zlob) -> Unloaded process successfully.
C:\Programme\Applications\wcs.exe (Trojan.Zlob) -> Unloaded process successfully.
Infizierte Speichermodule:
C:\Windows\System32\675873\675873.dll (Trojan.BHO) -> Delete on reboot.
C:\Windows\System32\bmztmss.dll (Trojan.Zlob) -> Delete on reboot.
C:\Programme\Applications\iebt.dll (Trojan.Zlob) -> Delete on reboot.
Infizierte Registrierungsschlüssel:
HKEY_CLASSES_ROOT\CLSID\{fef6ace8-bb45-4009-8342-63415164d691} (Trojan.Zlob.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{e63648f7-3933-440e-b4f6-a8584dd7b7eb} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{f7d09218-46d7-4d3d-9b7f-315204cd0836} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{030a0f33-5b99-482e-83f5-2eeb8457878b} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{030a0f33-5b99-482e-83f5-2eeb8457878b} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\virrlwarning.warningbho (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\virrlwarning.warningbho.1 (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\z444.z444mgr (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\z444.z444mgr.1 (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{967a494a-6aec-4555-9caf-fa6eb00acf91} (Rogue.PestPatrol) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{9692be2f-eb8f-49d9-a11c-c24c1ef734d5} (Rogue.PestPatrol) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{144a6b24-0ebc-4d89-bf09-a06a718e57b5} (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{be1a344f-9ff5-4024-949b-52205e6db2d0} (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{be1a344f-9ff5-4024-949b-52205e6db2d0} (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a81ebfd7-0fa3-41ec-b60d-6dae78b4d31a} (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{F5734812-E6A1-8833-ECA9-949B5B8A88BF} (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{a8954909-1f0f-41a5-a7fa-3b376d69e226} (Rogue.PestPatrol) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{daed9266-8c28-4c1c-8b58-5c66eff1d302} (Search.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a81ebfd7-0fa3-41ec-b60d-6dae78b4d31a} (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{9034a523-d068-4be8-a284-9df278be776e} (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Windows Safety Alert (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\e405.e405mgr (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEBrowse Tool (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IExplorer Bar (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Warning Center (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\multimediaControls.chl (Trojan.Zlob) -> Quarantined and deleted successfully.
Infizierte Registrierungswerte:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{fef6ace8-bb45-4009-8342-63415164d691} (Trojan.Zlob.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{144a6b24-0ebc-4d89-bf09-a06a718e57b5} (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{9034a523-d068-4be8-a284-9df278be776e} (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\start (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\smile (Trojan.Zlob) -> Quarantined and deleted successfully.
Infizierte Dateiobjekte der Registrierung:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchURL (Hijack.Search) -> Bad: (h**p://windiwsfsearch.com) Good: (h**p://www.google.com/) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page (Hijack.Search) -> Bad: (h**p://windiwsfsearch.com) Good: (h**p://www.google.com/) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Search Bar (Hijack.Search) -> Bad: (h**p://windiwsfsearch.com/ie6.html) Good: (h**p://www.google.com/) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\SearchMigratedDefaultURL (Hijack.Search) -> Bad: (h**p://windiwsfsearch.com/search?q={searchTerms}) Good: (h**p://www.google.com/) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchUrl\w\ (Hijack.Search) -> Bad: (h**p://windiwsfsearch.com/search?q=%s) Good: (h**p://www.google.com/) -> Quarantined and deleted successfully.
Infizierte Verzeichnisse:
C:\Programme\VirRL2009 (Rogue.AntiVirusLab) -> Quarantined and deleted successfully.
C:\Programme\VideoAccessCodec (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Windows\System32\675873 (Trojan.BHO) -> Delete on reboot.
Infizierte Dateien:
C:\Windows\System32\bmztmss.dll (Trojan.Zlob.H) -> Delete on reboot.
C:\Windows\System32\675873\675873.dll (Trojan.BHO) -> Delete on reboot.
C:\Programme\Applications\iebr.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Programme\Applications\iebt.dll (Trojan.Zlob) -> Delete on reboot.
C:\System Volume Information\_restore{14C46F5A-3CDA-4288-944E-7A390B2E91B1}\RP61\A0010187.exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{14C46F5A-3CDA-4288-944E-7A390B2E91B1}\RP62\A0010260.exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{14C46F5A-3CDA-4288-944E-7A390B2E91B1}\RP62\A0010261.exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{14C46F5A-3CDA-4288-944E-7A390B2E91B1}\RP64\A0010600.exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\Programme\VideoAccessCodec\install.ico (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Programme\VideoAccessCodec\Uninstall.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Windows\System32\algg.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\All Users.WINDOWS\Startmenü\Antivirus Scan.url (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\All Users.WINDOWS\Startmenü\Online Spyware Test.url (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Programme\Applications\iebtm.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Programme\Applications\iebtmm.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Programme\Applications\iebtu.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Programme\Applications\iebu.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Programme\Applications\myd.ico (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Programme\Applications\mym.ico (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Programme\Applications\myp.ico (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Programme\Applications\myv.ico (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Programme\Applications\ot.ico (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Programme\Applications\ts.ico (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Programme\Applications\wcm.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Programme\Applications\wcs.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Programme\Applications\wcu.exe (Trojan.Zlob) -> Quarantined and deleted successfully.
Code:
ATTFilter SUPERAntiSpyware Scan Log
http://www.superantispyware.com
Generated 10/19/2008 at 11:40 AM
Application Version : 4.21.1004
Core Rules Database Version : 3602
Trace Rules Database Version: 1588
Scan type : Custom Scan
Total Scan Time : 01:58:12
Memory items scanned : 402
Memory threats detected : 0
Registry items scanned : 4511
Registry threats detected : 6
File items scanned : 176246
File threats detected : 23
Rootkit.Rustock/Variant
HKLM\System\ControlSet001\Services\winequfm
C:\WINDOWS\SYSTEM32\DRIVERS\WINEQUFM.SYS
HKLM\System\ControlSet001\Enum\Root\LEGACY_winequfm
HKLM\System\ControlSet003\Services\winequfm
HKLM\System\ControlSet003\Enum\Root\LEGACY_winequfm
HKLM\System\CurrentControlSet\Services\winequfm
HKLM\System\CurrentControlSet\Enum\Root\LEGACY_winequfm
Adware.Tracking Cookie
C:\Dokumente und Einstellungen\XXX\Cookies\XXX@exoclick[1].txt
C:\Dokumente und Einstellungen\XXX\Cookies\XXX@doubleclick[1].txt
C:\Dokumente und Einstellungen\XXX\Cookies\XXX@cgi-bin[2].txt
C:\Dokumente und Einstellungen\XXX\Cookies\XXX@12finder[1].txt
C:\Dokumente und Einstellungen\XXX\Cookies\XXX@advertising[2].txt
C:\Dokumente und Einstellungen\XXX\Cookies\XXX@tacoda[2].txt
C:\Dokumente und Einstellungen\XXX\Cookies\XXX@ad.yieldmanager[1].txt
C:\Dokumente und Einstellungen\XXX\Cookies\XXX@webmasterplan[2].txt
C:\Dokumente und Einstellungen\XXX\Cookies\XXX@de.pcvirusremover2008[1].txt
C:\Dokumente und Einstellungen\XXX\Cookies\XXX@komtrack[2].txt
C:\Dokumente und Einstellungen\XXX\Cookies\XXX@adtrafficstats[2].txt
Adware.Media-Codec/ZLob
C:\Programme\Applications
Trojan.FakeAlert-IEBT
C:\SYSTEM VOLUME INFORMATION\_RESTORE{14C46F5A-3CDA-4288-944E-7A390B2E91B1}\RP61\A0010197.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{14C46F5A-3CDA-4288-944E-7A390B2E91B1}\RP62\A0010245.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{14C46F5A-3CDA-4288-944E-7A390B2E91B1}\RP63\A0010375.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{14C46F5A-3CDA-4288-944E-7A390B2E91B1}\RP63\A0010543.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{14C46F5A-3CDA-4288-944E-7A390B2E91B1}\RP63\A0010594.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{14C46F5A-3CDA-4288-944E-7A390B2E91B1}\RP64\A0010609.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{14C46F5A-3CDA-4288-944E-7A390B2E91B1}\RP65\A0010656.DLL
Trojan.Unclassified-Packed/Suspicious
C:\SYSTEM VOLUME INFORMATION\_RESTORE{14C46F5A-3CDA-4288-944E-7A390B2E91B1}\RP65\A0010613.DLL
Rogue.Windows AntiVirus 2008-Installer
C:\USERS\XXX\LOKALE EINSTELLUNGEN\TEMPORARY INTERNET FILES\CONTENT.IE5\LMT19SE2\WAV2008SETUP[1].EXE
C:\USERS\XXX\LOKALE EINSTELLUNGEN\TEMPORARY INTERNET FILES\CONTENT.IE5\KBWLYN8J\WAV2008SETUP[1].EXE
|
|
20.10.2008, 18:24
| #4 |
| Gast | wcs.exe Oha, da hat sich aber einiges eingenistet! Hast du noch Probleme? Ich würde dir dennoch raten dein System neuaufzusetzen, du hast Zlob, der sehr komplex ist, und manchmal mit Backdoor-Fähigkeiten daherkommt, und womöglich Ein Rustock-Rootkit. |
|
24.10.2008, 08:09
| #5 |
| | wcs.exe nein ich habe keine Probleme mehr seit dem die Programme über meinen Rechner gelaufen sind Also vielen Dank noch mal für die ganzen Informationen und die Hilfe mein PC läuft wieder einwandfrei Danke vielen Danke  :Mit freundlichen Grüßen Anubis |
|
| Themen zu wcs.exe |
| adobe, antivir, askbar, avira, bho, desktop, einstellungen, excel, explorer, fehlermeldung, google, helper, hijack, hijackthis, hkus\s-1-5-18, internet, internet explorer, launch, logfile, monitor, realtek, senden, software, system, temp, windows, windows xp, windows xp sp3, xp sp3 |
Linear-Darstellung
