![]() |
|
Log-Analyse und Auswertung: Langsamer IE, Internet plötzlich abgebrochen, PopUps, VirenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
![]() | #2 |
| ![]() Langsamer IE, Internet plötzlich abgebrochen, PopUps, Viren ich hab malware laufen lassen,.
__________________es war anscheinend wirklich ein "vundo" trojaner... kann mir bitte jemand sagen, ob mein PC jetzt sicher ist (emails, ebay, homebanking)? Im Moment läuft alles OK, keine popups (bis jetzt) Code:
ATTFilter Malwarebytes' Anti-Malware 1.31 Datenbank Version: 1460 Windows 5.1.2600 Service Pack 2 04.12.2008 16:29:50 mbam-log-2008-12-04 (16-29-50).txt Scan-Methode: Vollständiger Scan (C:\|D:\|) Durchsuchte Objekte: 211576 Laufzeit: 56 minute(s), 31 second(s) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 4 Infizierte Registrierungsschlüssel: 22 Infizierte Registrierungswerte: 2 Infizierte Dateiobjekte der Registrierung: 2 Infizierte Verzeichnisse: 0 Infizierte Dateien: 30 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: C:\WINDOWS\system32\opNeeCVN.dll (Trojan.Vundo.H) -> Delete on reboot. C:\WINDOWS\system32\rfigrhfe.dll (Trojan.Vundo.H) -> Delete on reboot. C:\WINDOWS\system32\urqOHWmj.dll (Trojan.Vundo) -> Delete on reboot. C:\WINDOWS\system32\wnkogx.dll (Trojan.Vundo) -> Delete on reboot. Infizierte Registrierungsschlüssel: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{19c5f754-b94e-4cba-901f-d0d5705c49f4} (Trojan.Vundo.H) -> Delete on reboot. HKEY_CLASSES_ROOT\CLSID\{19c5f754-b94e-4cba-901f-d0d5705c49f4} (Trojan.Vundo.H) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo.H) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\urqohwmj (Trojan.Vundo.H) -> Delete on reboot. HKEY_CLASSES_ROOT\CLSID\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo.H) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a36951dd-1939-4e12-8434-c3ca8b441a82} (Trojan.Vundo.H) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{a36951dd-1939-4e12-8434-c3ca8b441a82} (Trojan.Vundo.H) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{19c5f754-b94e-4cba-901f-d0d5705c49f4} (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{a36951dd-1939-4e12-8434-c3ca8b441a82} (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{055fd26d-3a88-4e15-963d-dc8493744b1d} (Adware.BHO) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.Shopping.Report) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6fd31ed6-7c94-4bbc-8e95-f927f4d3a949} (Adware.180Solutions) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1f158a1e-a687-4a11-9679-b3ac64b86a1c} (Adware.Seekmo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\agadoo (Adware.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\xpre (Trojan.Downloader) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\instkey (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully. Infizierte Registrierungswerte: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\6847afc3 (Trojan.Vundo.H) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Delete on reboot. Infizierte Dateiobjekte der Registrierung: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\opneecvn -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\opneecvn -> Delete on reboot. Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: C:\WINDOWS\system32\opNeeCVN.dll (Trojan.Vundo.H) -> Delete on reboot. C:\WINDOWS\system32\NVCeeNpo.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\NVCeeNpo.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\urqOHWmj.dll (Trojan.Vundo.H) -> Delete on reboot. C:\WINDOWS\system32\wnkogx.dll (Trojan.Vundo.H) -> Delete on reboot. C:\WINDOWS\system32\rfigrhfe.dll (Trojan.Vundo.H) -> Delete on reboot. C:\WINDOWS\system32\efhrgifr.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\Qoobox\Quarantine\C\Programme\Network Monitor\netmon.exe.vir (Trojan.DNSChanger) -> Quarantined and deleted successfully. C:\Qoobox\Quarantine\C\WINDOWS\bmF0YXNjaGE\asappsrv.dll.vir (Adware.CommAd) -> Quarantined and deleted successfully. C:\Qoobox\Quarantine\C\WINDOWS\bmF0YXNjaGE\command.exe.vir (Adware.CommAd) -> Quarantined and deleted successfully. C:\Qoobox\Quarantine\C\WINDOWS\system32\ddcDsTLe.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Qoobox\Quarantine\C\WINDOWS\system32\dxkptn.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Qoobox\Quarantine\C\WINDOWS\system32\ktvkrnvp.dll.vir (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\Qoobox\Quarantine\C\WINDOWS\system32\lmdjtypw.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Qoobox\Quarantine\C\WINDOWS\system32\ngwqkr.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Qoobox\Quarantine\C\WINDOWS\system32\ondypwju.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Qoobox\Quarantine\C\WINDOWS\system32\prunnet.exe.vir (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Qoobox\Quarantine\C\WINDOWS\system32\tuvVOigG.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Qoobox\Quarantine\C\WINDOWS\system32\urqNEXNF.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Qoobox\Quarantine\C\WINDOWS\system32\vcftdksu.dll.vir (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{D944029F-9AF5-4820-BB1C-A5E75179E378}\RP319\A0345893.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{D944029F-9AF5-4820-BB1C-A5E75179E378}\RP319\A0345894.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{D944029F-9AF5-4820-BB1C-A5E75179E378}\RP319\A0345895.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{D944029F-9AF5-4820-BB1C-A5E75179E378}\RP319\A0345897.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\rhaynbkc.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\AT\MTK63G.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\WINDOWS\system32\evp\peco85IV.exe (Adware.ZenoSearch) -> Quarantined and deleted successfully. C:\WINDOWS\system32\mcrh.tmp (Malware.Trace) -> Quarantined and deleted successfully. C:\WINDOWS\system32\g16.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\Programme\setup.exe (Rogue.Installer) -> Quarantined and deleted successfully. |
Themen zu Langsamer IE, Internet plötzlich abgebrochen, PopUps, Viren |
antivirus, application, bitte um hilfe, bonjour, combofix, desktop, excel, fehler, firefox, frage, google, hijack, hijackthis, hkus\s-1-5-18, internet, internet explorer, malware, msn-messenger, mysql server, object, pc läuft, pdfcreator, popup, problem, registry, server, software, toolbars, viren, virus, virus gefunden, vundo, windows xp |