| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Wie werde ich einen persistence Trojaner los?Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
20.03.2011, 19:08
| #1 |
 |  Wie werde ich einen persistence Trojaner los? Hallo leute, eine lange geschichte wie ich mir den Trojaner eingefangen habe, natürlich weiß ich wie man NORMALE Trojaner loswird..nur nicht Trojaner mit einem "persistence" effekt.. //////////////////////////////////////////// Persistence = Das bedeutet das der Trojaner sich nicht löschen lässt..also..falls man den löscht..dass dann einfach der sich wieder erstellt..das ist das problem..ICH KRIEGE DEN TROJANER NICHT WEG ! /////////////////////////////////////////// Ich habe jetzt keine ahung wie man so einen Trojaner entfernt..ich habe mit Malwarebytes und mit avast! durchlaufen lassen. Der Trojaner wird immer wieder in den Container (Quarantäne) verschoben..und erstellt sich wieder..so wie ein Spam ! Ich hatte dann keine ahnung, und wollte euch experten mal fragen ! Also : Wie kriege ich den Trojaner weg ? PS: Der Trojaner der sich immer wieder erstellt liegt in : D:\Users\username\AppData\Roaming ... mit dem Ordnernamen "install" und dem Virusnamen "nukl34r.exe" -ICh habe es erstmals so eingestellt das man alle versteckten Ordner und dateien sieht.. Was tun ? mfg Netzwerk Hier habe auch ein OTL Scan gemacht..alles was an einem Tag passiert ist : OTL Logfile: Code:
ATTFilter OTL logfile created on: 20.03.2011 19:20:15 - Run 1 OTL by OldTimer - Version 3.2.22.3 Folder = D:\Users\home\Desktop Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 8.0.7600.16385) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1.024,00 Mb Total Physical Memory | 342,00 Mb Available Physical Memory | 33,00% Memory free 2,00 Gb Paging File | 1,00 Gb Available in Paging File | 50,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = D: | %SystemRoot% = D:\Windows | %ProgramFiles% = D:\Program Files Drive C: | 15,43 Gb Total Space | 9,83 Gb Free Space | 63,68% Space Free | Partition Type: NTFS Drive D: | 14,89 Gb Total Space | 1,77 Gb Free Space | 11,88% Space Free | Partition Type: NTFS Drive E: | 25,58 Gb Total Space | 18,40 Gb Free Space | 71,94% Space Free | Partition Type: NTFS Computer Name: HOME-PC | User Name: home | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 1 Day ========== Processes (SafeList) ========== PRC - D:\Users\home\Desktop\OTL.exe (OldTimer Tools) PRC - D:\Programme\Emsisoft Anti-Malware\a2service.exe (Emsi Software GmbH) PRC - D:\Programme\TeamViewer\Version6\TeamViewer_Service.exe (TeamViewer GmbH) PRC - D:\Programme\Alwil Software\Avast5\AvastUI.exe (AVAST Software) PRC - D:\Programme\Alwil Software\Avast5\AvastSvc.exe (AVAST Software) PRC - D:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - D:\Programme\Windows Live\Messenger\msnmsgr.exe (Microsoft Corporation) PRC - D:\Programme\Windows Live\Contacts\wlcomm.exe (Microsoft Corporation) PRC - D:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) PRC - D:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE (Microsoft Corp.) PRC - D:\Programme\AVG\AVG9\avgchsvx.exe (AVG Technologies CZ, s.r.o.) PRC - D:\Programme\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation) PRC - D:\Programme\MSN Toolbar\Platform\4.0.0357.1\mswinext.exe (Microsoft Corp.) PRC - D:\Windows\explorer.exe (Microsoft Corporation) PRC - D:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation) PRC - D:\Windows\System32\taskhost.exe (Microsoft Corporation) PRC - D:\Programme\Windows Sidebar\sidebar.exe (Microsoft Corporation) ========== Modules (SafeList) ========== MOD - D:\Users\home\Desktop\OTL.exe (OldTimer Tools) MOD - D:\Programme\Alwil Software\Avast5\snxhk.dll (AVAST Software) MOD - D:\Windows\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.) MOD - D:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll (Microsoft Corporation) ========== Win32 Services (SafeList) ========== SRV - (avg9wd) -- File not found SRV - (avg9emc) -- File not found SRV - (a2AntiMalware) -- D:\Program Files\Emsisoft Anti-Malware\a2service.exe (Emsi Software GmbH) SRV - (TeamViewer6) -- D:\Programme\TeamViewer\Version6\TeamViewer_Service.exe (TeamViewer GmbH) SRV - (avast! Antivirus) -- D:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software) SRV - (SensrSvc) -- D:\Windows\System32\sensrsvc.dll (Microsoft Corporation) SRV - (PeerDistSvc) -- D:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation) SRV - (WinDefend) -- D:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV - (a2acc) -- D:\Programme\Emsisoft Anti-Malware\a2accx86.sys (Emsi Software GmbH) DRV - (aswSP) -- D:\Windows\System32\drivers\aswSP.sys (AVAST Software) DRV - (aswTdi) -- D:\Windows\System32\drivers\aswTdi.sys (AVAST Software) DRV - (aswRdr) -- D:\Windows\System32\drivers\aswRdr.sys (AVAST Software) DRV - (aswMonFlt) -- D:\Windows\System32\drivers\aswMonFlt.sys (AVAST Software) DRV - (aswFsBlk) -- D:\Windows\System32\drivers\aswFsBlk.sys (AVAST Software) DRV - (vmbus) -- D:\Windows\system32\DRIVERS\vmbus.sys (Microsoft Corporation) DRV - (storflt) -- D:\Windows\system32\DRIVERS\vmstorfl.sys (Microsoft Corporation) DRV - (storvsc) -- D:\Windows\system32\DRIVERS\storvsc.sys (Microsoft Corporation) DRV - (WinUsb) -- D:\Windows\System32\drivers\winusb.sys (Microsoft Corporation) DRV - (s3cap) -- D:\Windows\system32\DRIVERS\vms3cap.sys (Microsoft Corporation) DRV - (VMBusHID) -- D:\Windows\system32\DRIVERS\VMBusHID.sys (Microsoft Corporation) DRV - (nvlddmkm) -- D:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation) DRV - (SISNICXP) -- D:\Windows\System32\drivers\sisnicxp.sys (SiS Corporation) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = C9 44 97 0B F0 42 CB 01 [binary data] IE - HKCU\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - Reg Error: Key error. File not found IE - HKCU\..\URLSearchHook: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - Reg Error: Key error. File not found IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search" FF - prefs.js..browser.search.selectedEngine: "AVG Secure Search" FF - prefs.js..extensions.enabledItems: pagehacker-nico@nc:1.2 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.2.3.3 FF - prefs.js..extensions.enabledItems: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}:3.2.3.3 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24 FF - prefs.js..keyword.URL: "hxxp://search.avg.com/route/?d=4c72d621&v=6.010.006.004&i=23&tp=ab&iy=&ychte=de&lng=de&q=" FF - HKLM\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011.01.04 19:40:46 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Firefox\Extensions\\msntoolbar@msn.com: D:\Program Files\MSN Toolbar\Platform\4.0.0357.1\Firefox [2011.01.04 19:41:53 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Firefox\Extensions\\{27182e60-b5f3-411c-b545-b44205977502}: D:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\ [2011.01.05 20:15:58 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: D:\Program Files\Mozilla Firefox\components [2010.12.12 18:33:54 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: D:\Program Files\Mozilla Firefox\plugins [2011.02.14 17:40:49 | 000,000,000 | ---D | M] [2010.10.10 16:39:19 | 000,000,000 | ---D | M] (No name found) -- D:\Users\home\AppData\Roaming\mozilla\Extensions [2010.09.19 15:18:29 | 000,000,000 | ---D | M] (No name found) -- D:\Users\home\AppData\Roaming\mozilla\Extensions\mozswing@mozswing.org [2011.03.20 19:02:49 | 000,000,000 | ---D | M] (No name found) -- D:\Users\home\AppData\Roaming\mozilla\Firefox\Profiles\osc170et.default\extensions [2010.11.09 13:42:38 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- D:\Users\home\AppData\Roaming\mozilla\Firefox\Profiles\osc170et.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} [2010.11.20 17:24:54 | 000,000,000 | ---D | M] (uTorrentBar Community Toolbar) -- D:\Users\home\AppData\Roaming\mozilla\Firefox\Profiles\osc170et.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} [2010.11.20 17:24:54 | 000,000,000 | ---D | M] (Conduit Engine) -- D:\Users\home\AppData\Roaming\mozilla\Firefox\Profiles\osc170et.default\extensions\engine@conduit.com [2010.10.20 08:56:30 | 000,000,000 | ---D | M] ("Page Hacker") -- D:\Users\home\AppData\Roaming\mozilla\Firefox\Profiles\osc170et.default\extensions\pagehacker-nico@nc [2011.02.22 19:21:21 | 000,000,000 | ---D | M] (No name found) -- D:\Programme\Mozilla Firefox\extensions [2010.11.09 13:42:02 | 000,000,000 | ---D | M] (Java Console) -- D:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [2011.01.06 16:23:32 | 000,000,000 | ---D | M] (Java Console) -- D:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} [2011.02.22 19:21:21 | 000,000,000 | ---D | M] (Java Console) -- D:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} [2010.11.09 13:42:02 | 000,000,000 | ---D | M] (Java Console) -- D:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [2011.01.06 16:23:32 | 000,000,000 | ---D | M] (Java Console) -- D:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} [2011.02.22 19:21:21 | 000,000,000 | ---D | M] (Java Console) -- D:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} [2011.02.02 21:40:24 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- D:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll [2010.12.12 18:33:44 | 000,001,392 | ---- | M] () -- D:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml [2010.12.12 18:33:44 | 000,002,344 | ---- | M] () -- D:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml [2010.12.12 18:33:44 | 000,006,805 | ---- | M] () -- D:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml [2010.12.12 18:33:44 | 000,001,178 | ---- | M] () -- D:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml [2010.12.12 18:33:44 | 000,001,105 | ---- | M] () -- D:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2010.11.23 21:51:35 | 000,000,896 | ---- | M]) - D:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 support.steampowered.com O1 - Hosts: 127.0.0.1 support.steampowered.com O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - D:\Programme\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation) O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) O2 - BHO: (Windows Live Messenger Companion Helper) - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - D:\Programme\Windows Live\Companion\companioncore.dll (Microsoft Corporation) O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - D:\Programme\Google\GoogleToolbarNotifier\5.6.6209.1142\swg.dll (Google Inc.) O2 - BHO: (MSN Toolbar BHO) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - D:\Programme\MSN Toolbar\Platform\4.0.0357.1\npwinext.dll (Microsoft Corporation) O3 - HKLM\..\Toolbar: (MSN Toolbar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - D:\Programme\MSN Toolbar\Platform\4.0.0357.1\npwinext.dll (Microsoft Corporation) O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found. O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [Adobe Reader Speed Launcher] D:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [avast5] D:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software) O4 - HKLM..\Run: [Cmaudio] File not found O4 - HKLM..\Run: [ Malwarebytes Anti-Malware (reboot)] D:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation) O4 - HKCU..\Run: [HKCU] File not found O4 - HKCU..\Run: [winupdater] D:\Windupdt\winupdate.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O8 - Extra context menu item: Google Sidewiki... - D:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll (Google Inc.) O9 - Extra Button: @D:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - D:\Programme\Windows Live\Companion\companioncore.dll (Microsoft Corporation) O9 - Extra Button: @D:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - D:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : @D:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - D:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - D:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - D:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} hxxp://gfx1.hotmail.com/mail/w4/m3/photouploadcontrol/VistaMSNPUpldtr-tr.cab (Windows Live Hotmail Photo Upload Tool) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - D:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - D:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation) O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - D:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation) O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - D:\Programme\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation) O20 - AppInit_DLLs: (D:\Windows\System32\avgrsstx.dll) - D:\Windows\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.) O20 - HKLM Winlogon: Shell - (explorer.exe) - explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - D:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2010.08.23 14:38:58 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - D:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{981a6db2-02e5-11e0-b5e1-00e018d8f5d4}\Shell - "" = AutoRun O33 - MountPoints2\{981a6db2-02e5-11e0-b5e1-00e018d8f5d4}\Shell\AutoRun\command - "" = H:\ICM_Manager.exe O33 - MountPoints2\I\Shell - "" = AutoRun O33 - MountPoints2\I\Shell\AutoRun\command - "" = I:\LaunchU3.exe -a O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 1 Day ========== [2011.03.20 19:30:48 | 000,000,000 | ---D | C] -- D:\ProgramData\TEMP [2011.03.20 19:29:56 | 000,000,000 | ---D | C] -- D:\Users\home\Documents\Simply Super Software [2011.03.20 19:29:46 | 000,000,000 | ---D | C] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\Trojan Remover [2011.03.20 19:29:38 | 000,069,632 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\ztvcabinet.dll [2011.03.20 19:29:31 | 000,000,000 | ---D | C] -- D:\Programme\Trojan Remover [2011.03.20 19:29:31 | 000,000,000 | ---D | C] -- D:\Users\home\AppData\Roaming\Simply Super Software [2011.03.20 19:29:31 | 000,000,000 | ---D | C] -- D:\ProgramData\Simply Super Software [2011.03.20 19:19:19 | 000,580,608 | ---- | C] (OldTimer Tools) -- D:\Users\home\Desktop\OTL.exe [2011.03.20 16:48:56 | 000,000,000 | ---D | C] -- D:\Users\home\AppData\Local\{E16E0235-D736-4EE2-972A-B12263E00D63} [2011.03.20 16:44:06 | 000,000,000 | ---D | C] -- D:\Users\home\AppData\Local\{82584209-7673-4A89-8D3A-C42DC95353A0} [2011.03.20 15:36:14 | 000,000,000 | ---D | C] -- D:\Programme\TeamViewer [2011.03.20 15:10:34 | 000,000,000 | ---D | C] -- D:\Windupdt ========== Files - Modified Within 1 Day ========== [2011.03.20 19:34:10 | 000,003,909 | -H-- | M] () -- D:\Users\home\AppData\Roaming\homelog.dat [2011.03.20 19:29:48 | 000,001,101 | ---- | M] () -- D:\Users\Public\Desktop\Trojan Remover.lnk [2011.03.20 19:19:43 | 000,580,608 | ---- | M] (OldTimer Tools) -- D:\Users\home\Desktop\OTL.exe [2011.03.20 19:07:09 | 000,001,092 | ---- | M] () -- D:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2011.03.20 16:55:09 | 000,016,944 | -H-- | M] () -- D:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2011.03.20 16:55:09 | 000,016,944 | -H-- | M] () -- D:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2011.03.20 16:48:06 | 000,001,088 | ---- | M] () -- D:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2011.03.20 16:47:08 | 000,067,584 | --S- | M] () -- D:\Windows\bootstat.dat [2011.03.20 16:46:55 | 804,954,112 | -HS- | M] () -- D:\hiberfil.sys [2011.03.20 15:18:21 | 000,058,444 | ---- | M] () -- D:\Users\home\AppData\Roaming\home3SQLite3.dll [2011.03.20 15:11:15 | 000,658,766 | ---- | M] () -- D:\Windows\System32\perfh007.dat [2011.03.20 15:11:15 | 000,619,952 | ---- | M] () -- D:\Windows\System32\perfh009.dat [2011.03.20 15:11:15 | 000,132,336 | ---- | M] () -- D:\Windows\System32\perfc007.dat [2011.03.20 15:11:15 | 000,108,134 | ---- | M] () -- D:\Windows\System32\perfc009.dat ========== Files Created - No Company Name ========== [2011.03.20 19:29:48 | 000,001,101 | ---- | C] () -- D:\Users\Public\Desktop\Trojan Remover.lnk [2011.03.20 19:29:39 | 000,162,304 | ---- | C] () -- D:\Windows\System32\ztvunrar36.dll [2011.03.20 19:29:39 | 000,077,312 | ---- | C] () -- D:\Windows\System32\ztvunace26.dll [2011.03.20 19:29:38 | 000,153,088 | ---- | C] () -- D:\Windows\System32\UNRAR3.dll [2011.03.20 19:29:38 | 000,075,264 | ---- | C] () -- D:\Windows\System32\unacev2.dll [2011.03.20 15:36:23 | 000,001,136 | ---- | C] () -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 6.lnk [2011.03.20 15:18:22 | 000,058,444 | ---- | C] () -- D:\Users\home\AppData\Roaming\home3SQLite3.dll [2011.02.11 09:45:14 | 000,453,456 | ---- | C] () -- D:\Windows\System32\d3dx10_42.dll [2011.01.04 19:26:41 | 000,233,481 | ---- | C] () -- D:\Windows\hpoins47.dat [2010.11.24 17:40:57 | 000,256,512 | ---- | C] () -- D:\Windows\PEV.exe [2010.11.24 17:40:57 | 000,098,816 | ---- | C] () -- D:\Windows\sed.exe [2010.11.24 17:40:57 | 000,089,088 | ---- | C] () -- D:\Windows\MBR.exe [2010.11.24 17:40:57 | 000,080,412 | ---- | C] () -- D:\Windows\grep.exe [2010.11.24 17:40:57 | 000,068,096 | ---- | C] () -- D:\Windows\zip.exe [2010.10.22 11:54:28 | 000,031,744 | ---- | C] () -- D:\Windows\UNISTB32.EXE [2010.08.28 16:15:13 | 001,970,176 | ---- | C] () -- D:\Windows\System32\d3dx9.dll [2010.08.24 15:58:18 | 000,000,056 | -H-- | C] () -- D:\ProgramData\ezsidmv.dat [2010.04.01 00:39:01 | 000,000,574 | ---- | C] () -- D:\Windows\hpomdl47.dat [2009.07.14 09:47:43 | 000,658,766 | ---- | C] () -- D:\Windows\System32\perfh007.dat [2009.07.14 09:47:43 | 000,295,922 | ---- | C] () -- D:\Windows\System32\perfi007.dat [2009.07.14 09:47:43 | 000,132,336 | ---- | C] () -- D:\Windows\System32\perfc007.dat [2009.07.14 09:47:43 | 000,038,104 | ---- | C] () -- D:\Windows\System32\perfd007.dat [2009.07.14 05:57:37 | 000,067,584 | --S- | C] () -- D:\Windows\bootstat.dat [2009.07.14 05:33:53 | 000,409,040 | ---- | C] () -- D:\Windows\System32\FNTCACHE.DAT [2009.07.14 03:05:48 | 000,619,952 | ---- | C] () -- D:\Windows\System32\perfh009.dat [2009.07.14 03:05:48 | 000,291,294 | ---- | C] () -- D:\Windows\System32\perfi009.dat [2009.07.14 03:05:48 | 000,108,134 | ---- | C] () -- D:\Windows\System32\perfc009.dat [2009.07.14 03:05:48 | 000,031,548 | ---- | C] () -- D:\Windows\System32\perfd009.dat [2009.07.14 03:05:05 | 000,000,741 | ---- | C] () -- D:\Windows\System32\NOISE.DAT [2009.07.14 03:04:11 | 000,215,943 | ---- | C] () -- D:\Windows\System32\dssec.dat [2009.07.14 01:19:49 | 000,066,048 | ---- | C] () -- D:\Windows\System32\PrintBrmUi.exe [2009.07.14 00:55:01 | 000,043,131 | ---- | C] () -- D:\Windows\mib.bin [2009.07.14 00:51:43 | 000,073,728 | ---- | C] () -- D:\Windows\System32\BthpanContextHandler.dll [2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- D:\Windows\System32\BWContextHandler.dll [2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- D:\Windows\System32\mlang.dat [2009.06.04 11:13:27 | 000,233,472 | ---- | C] () -- D:\Windows\System32\cmirmdrv.exe [2009.06.04 11:13:27 | 000,028,672 | ---- | C] () -- D:\Windows\System32\cmirmdrv.dll [2005.04.08 03:16:43 | 000,003,467 | -H-- | C] () -- D:\Users\home\AppData\Roaming\homelog.dat ========== LOP Check ========== [2010.11.22 20:39:32 | 000,000,000 | ---D | M] -- D:\Users\home\AppData\Roaming\AVG10 [2010.09.05 13:13:10 | 000,000,000 | ---D | M] -- D:\Users\home\AppData\Roaming\Babylon [2011.01.29 16:58:23 | 000,000,000 | ---D | M] -- D:\Users\home\AppData\Roaming\Canneverbe Limited [2011.03.08 19:13:30 | 000,000,000 | ---D | M] -- D:\Users\home\AppData\Roaming\FILEminimizerPictures [2010.11.19 22:27:44 | 000,000,000 | ---D | M] -- D:\Users\home\AppData\Roaming\FileZilla [2006.06.25 17:18:34 | 000,000,000 | ---D | M] -- D:\Users\home\AppData\Roaming\install [2011.01.29 16:38:48 | 000,000,000 | ---D | M] -- D:\Users\home\AppData\Roaming\OpenCandy [2011.03.20 19:29:31 | 000,000,000 | ---D | M] -- D:\Users\home\AppData\Roaming\Simply Super Software [2010.11.11 21:27:53 | 000,000,000 | RHSD | M] -- D:\Users\home\AppData\Roaming\System32 [2011.02.11 17:11:46 | 000,000,000 | ---D | M] -- D:\Users\home\AppData\Roaming\Windows Live Writer [2011.02.13 12:28:53 | 000,032,632 | ---- | M] () -- D:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Alternate Data Streams ========== @Alternate Data Stream - 102 bytes -> D:\ProgramData\TEMP:CB0AACC9 < End of report > [/CODE] Hilft euch das irgendwie ? |
|
21.03.2011, 16:05
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Wie werde ich einen persistence Trojaner los? Poste bitte ALLE Logs von Malwarebytes!
__________________
__________________ |
|
| Themen zu Wie werde ich einen persistence Trojaner los? |
| ahnung, alternate, appdata, avast, avast!, avg secure search, dateien, einfach, eingefangen, eingestellt, emsisoft, emsisoft anti-malware, experten, frage, fragen, gen, geschichte, install, langs, leute, location, löschen, malwarebytes, natürlich, nicht löschen, nvlddmkm.sys, oldtimer, ordner, otl scan, otl.exe, plug-in, programdata, quarantäne, roaming, searchplugins, secure search, spam, start menu, super, taskhost.exe, trojaner, trojaner eingefangen, versteckte, virus, webcheck, winupdate.exe |
Linear-Darstellung
