| |
| |||||||
Log-Analyse und Auswertung: autorun-wurm lpl.exe auf cf-card gefunden, rechner ebenfalls infiziertWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
| |
05.04.2011, 19:52
| #1 |
| /// Winkelfunktion /// TB-Süch-Tiger™   |  autorun-wurm lpl.exe auf cf-card gefunden, rechner ebenfalls infiziert Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten. GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen. Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst. Downloade Dir danach bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
06.04.2011, 20:27
| #2 |
 | autorun-wurm lpl.exe auf cf-card gefunden, rechner ebenfalls infiziert GMER stürzt leider immer ab!
__________________Hier das OSAM File: Code:
ATTFilter Report of OSAM: Autorun Manager v5.0.11926.0 hxxp://www.online-solutions.ru/en/ Saved at 21:26:31 on 06.04.2011 OS: Windows XP Professional Service Pack 3 (Build 2600) Default Browser: Mozilla Corporation Firefox 3.6.16 Scanner Settings [x] Rootkits detection (hidden registry) [x] Rootkits detection (hidden files) [x] Retrieve files information [x] Check Microsoft signatures Filters [ ] Trusted entries [ ] Empty entries [x] Hidden registry entries (rootkit activity) [x] Exclusively opened files [x] Not found files [x] Files without detailed information [x] Existing files [ ] Non-startable services [ ] Non-startable drivers [x] Active entries [x] Disabled entries [Common] -----( %SystemRoot%\Tasks )----- "WGASetup.job" - "Microsoft Corporation" - C:\WINDOWS\system32\KB905474\wgasetup.exe [Control Panel Objects] -----( %SystemRoot%\system32 )----- "alsndmgr.cpl" - ? - C:\WINDOWS\system32\alsndmgr.cpl (File signed by Microsoft | File found, but it contains no detailed information) "DivXControlPanelApplet.cpl" - "DivX, Inc." - C:\WINDOWS\system32\DivXControlPanelApplet.cpl "infocardcpl.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\infocardcpl.cpl "javacpl.cpl" - "Sun Microsystems, Inc." - C:\WINDOWS\system32\javacpl.cpl "nvcpl.cpl" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvcpl.cpl -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )----- "Avira AntiVir Personal - Free Antivirus " - "Avira GmbH" - C:\PROGRA~1\Avira\ANTIVI~1\avconfig.cpl "Avira AntiVir PersonalEdition Classic" - ? - C:\PROGRA~1\ANTIVI~1\avconfig.cpl (File not found) "QuickTime" - "Apple Inc." - C:\Programme\QuickTime\QTSystem\QuickTime.cpl [Drivers] -----( HKLM\SYSTEM\CurrentControlSet\Services )----- "avgio" (avgio) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avgio.sys "avgntflt" (avgntflt) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avgntflt.sys "avipbb" (avipbb) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avipbb.sys "catchme" (catchme) - ? - C:\DOKUME~1\Tonie\LOKALE~1\Temp\catchme.sys (File not found) "cdrbsdrv" (cdrbsdrv) - "B.H.A Corporation" - C:\WINDOWS\system32\drivers\cdrbsdrv.sys "Changer" (Changer) - ? - C:\WINDOWS\system32\drivers\Changer.sys (File not found) "Hamachi Network Interface" (hamachi) - "LogMeIn, Inc." - C:\WINDOWS\System32\DRIVERS\hamachi.sys "i2omgmt" (i2omgmt) - ? - C:\WINDOWS\system32\drivers\i2omgmt.sys (File not found) "lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys (File not found) "PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys (File not found) "PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys (File not found) "PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys (File not found) "PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys (File not found) "PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys (File not found) "PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\WINDOWS\System32\Drivers\PxHelp20.sys "Realtek EAPPkt Protocol" (EAPPkt) - "Windows (R) 2000 DDK provider" - C:\WINDOWS\System32\DRIVERS\EAPPkt.sys "SjyPkt" (SjyPkt) - "Windows (R) 2000 DDK provider" - C:\WINDOWS\System32\Drivers\SjyPkt.sys "Sony Ericsson 750 driver (WDM)" (k750bus) - "MCCI" - C:\WINDOWS\System32\DRIVERS\k750bus.sys "Sony Ericsson 750 USB WMC Device Management Drivers" (k750mgmt) - "MCCI" - C:\WINDOWS\System32\DRIVERS\k750mgmt.sys "Sony Ericsson 750 USB WMC Modem Drivers" (k750mdm) - "MCCI" - C:\WINDOWS\System32\DRIVERS\k750mdm.sys "Sony Ericsson 750 USB WMC Modem Filter" (k750mdfl) - "MCCI" - C:\WINDOWS\System32\DRIVERS\k750mdfl.sys "Sony Ericsson 750 USB WMC OBEX Interface Drivers" (k750obex) - "MCCI" - C:\WINDOWS\System32\DRIVERS\k750obex.sys "sptd" (sptd) - "Duplex Secure Ltd." - C:\WINDOWS\System32\Drivers\sptd.sys (File is exclusively opened, access blocked) "ssmdrv" (ssmdrv) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\ssmdrv.sys "ugldipod" (ugldipod) - ? - C:\DOKUME~1\Tonie\LOKALE~1\Temp\ugldipod.sys (Hidden registry entry, rootkit activity | File not found) "WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys (File not found) [Explorer] -----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )----- {89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install -----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )----- {F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll -----( HKLM\Software\Classes\Protocols\Filter )----- {1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll {1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll {1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll -----( HKLM\Software\Classes\Protocols\Handler )----- {3D9F03FA-7A94-11D3-BE81-0050048385D1} "Data Page Pluggable Protocol mso-offdap Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBCOM~1\10\OWC10.DLL {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL {828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL {CD00020A-8B95-11D1-82DB-00C04FB1625D} "Microsoft PKM KnowledgePluggable Class" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\PKMCDO.DLL {828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )----- {23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Programme\7-Zip\7-zip.dll {42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? - deskpan.dll (File not found) {1CDB2949-8F65-4355-8456-263E7C208A5D} "Desktop Explorer" - "NVIDIA Corporation" - C:\Programme\NVIDIA Corporation\nView\nvshell.dll {1E9B04FB-F9E5-4718-997B-B8DA88302A47} "Desktop Explorer Menu" - "NVIDIA Corporation" - C:\Programme\NVIDIA Corporation\nView\nvshell.dll {A70C977A-BF00-412C-90B7-034C51DA2439} "DesktopContext Class" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvcpl.dll {29F08A22-C8C1-4971-808F-21D9C825B187} "JPEG Lossless Rotator extension" - ? - C:\PROGRA~1\JPEGLO~1\contmenu.dll (File found, but it contains no detailed information) {853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? - (File not found | COM-object registry key not found) {42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office10\msohev.dll {FFB699E0-306A-11d3-8BD1-00104B6F7516} "NVIDIA CPL Extension" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvcpl.dll {1E9B04FB-F9E5-4718-997B-B8DA88302A48} "nView Desktop Context Menu" - "NVIDIA Corporation" - C:\Programme\NVIDIA Corporation\nView\nvshell.dll {0006F045-0000-0000-C000-000000000046} "Outlook-Dateisymbolerweiterung" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office10\OLKFSTUB.DLL {F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} "RealOne Player Context Menu Class" - "RealNetworks, Inc." - C:\Programme\Real\RealPlayer\rpshell.dll {45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\shlext.dll {E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll {764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? - (File not found | COM-object registry key not found) {e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll {BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL {B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - ? - C:\Programme\WinRAR\rarext.dll (File found, but it contains no detailed information) [Internet Explorer] -----( HKCU\SOFTWARE\Microsoft\Internet Explorer\Extensions )----- "Klicke hier um das Projekt xp-AntiSpy zu unterstützen" - ? - C:\Programme\xp-AntiSpy\sponsoring\sponsor.html -----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )----- <binary data> "ITBar7Layout" - ? - (File not found | COM-object registry key not found) <binary data> "{855F3B16-6D32-4FE6-8A56-BBB695989046}" - ? - (File not found | COM-object registry key not found) -----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )----- {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} "Java Plug-in 1.5.0_11" - "Sun Microsystems, Inc." - C:\Programme\Java\jre1.5.0_11\bin\npjpi150_11.dll / hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab {8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_21" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_21.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} "Java Plug-in 1.6.0_21" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_21.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_21" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_21.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab {D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" - "Adobe Systems, Inc." - C:\WINDOWS\system32\Macromed\Flash\Flash9d.ocx / hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab -----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )----- "@C:\Programme\Messenger\Msgslang.dll,-61144" - "Microsoft Corporation" - C:\Programme\Messenger\msmsgs.exe {53707962-6F74-2D53-2644-206D7942484F} "ClsidExtension" - "Safer Networking Limited" - C:\PROGRA~1\SPYBOT~1\SDHelper.dll {DDE87865-83C5-48c4-8357-2F5B1AA84522} "HP Intelligente Auswahl" - "Hewlett-Packard Co." - C:\Programme\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )----- {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "Adobe PDF Reader" - "Adobe Systems Incorporated" - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll {0347C33E-8762-4905-BF09-768834316C61} "HP Print Enhancer" - "Hewlett-Packard Co." - C:\Programme\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} "HP Smart BHO Class" - "Hewlett-Packard Co." - C:\Programme\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll {DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jp2ssv.dll {E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll {53707962-6F74-2D53-2644-206D7942484F} "Spybot-S&D IE Protection" - "Safer Networking Limited" - C:\PROGRA~1\SPYBOT~1\SDHelper.dll {9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll {5C255C8A-E604-49b4-9D64-90988571CECB} "{5C255C8A-E604-49b4-9D64-90988571CECB}" - ? - (File not found | COM-object registry key not found) [Logon] -----( %AllUsersProfile%\Startmenü\Programme\Autostart )----- "desktop.ini" - ? - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini -----( %UserProfile%\Startmenü\Programme\Autostart )----- "desktop.ini" - ? - C:\Dokumente und Einstellungen\Tonie\Startmenü\Programme\Autostart\desktop.ini -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )----- "avgnt" - "Avira GmbH" - "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min "NvCplDaemon" - "NVIDIA Corporation" - RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup "NvMediaCenter" - "NVIDIA Corporation" - RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit [Services] -----( HKLM\SYSTEM\CurrentControlSet\Services )----- ".NET Runtime Optimization Service v2.0.50727_X86" (clr_optimization_v2.0.50727_32) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe "Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe "ASP.NET-Zustandsdienst" (aspnet_state) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe "Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avguard.exe "Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\sched.exe "AVM WLAN Connection Service" (AVM WLAN Connection Service) - "AVM Berlin" - C:\Programme\avmwlanstick\WlanNetService.exe "B's Recorder GOLD Library General Service" (bgsvcgen) - "SOURCENEXT" - C:\WINDOWS\system32\bgsvcgen.exe "Canon Camera Access Library 8" (CCALib8) - "Canon Inc." - C:\Programme\Canon\CAL\CALMAIN.exe "Dienst "Bonjour"" (Bonjour Service) - "Apple Inc." - C:\Programme\Bonjour\mDNSResponder.exe "HP CUE DeviceDiscovery Service" (hpqddsvc) - "Hewlett-Packard Co." - C:\Programme\HP\Digital Imaging\bin\hpqddsvc.dll "hpqcxs08" (hpqcxs08) - "Hewlett-Packard Co." - C:\Programme\HP\Digital Imaging\bin\hpqcxs08.dll "Java Quick Starter" (JavaQuickStarterService) - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jqs.exe "Net Driver HPZ12" (Net Driver HPZ12) - "Hewlett-Packard" - C:\WINDOWS\system32\HPZinw12.dll "NVIDIA Display Driver Service" (NVSvc) - "NVIDIA Corporation" - C:\WINDOWS\system32\nvsvc32.exe "Pml Driver HPZ12" (Pml Driver HPZ12) - "Hewlett-Packard" - C:\WINDOWS\system32\HPZipm12.dll "PnkBstrA" (PnkBstrA) - ? - C:\WINDOWS\system32\PnkBstrA.exe (File found, but it contains no detailed information) "PnkBstrB" (PnkBstrB) - ? - C:\WINDOWS\system32\PnkBstrB.exe (File found, but it contains no detailed information) "ServiceLayer" (ServiceLayer) - "Nokia." - C:\Programme\Nokia\PC Connectivity Solution\ServiceLayer.exe "Windows CardSpace" (idsvc) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe "Windows Presentation Foundation Font Cache 3.0.0.0" (FontCache3.0.0.0) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [Winlogon] -----( HKCU\Control Panel\IOProcs )----- "MVB" - ? - mvfs32.dll (File not found) [Winsock Providers] -----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )----- "mdnsNSP" - "Apple Inc." - C:\Programme\Bonjour\mdnsNSP.dll ===[ Logfile end ]=========================================[ Logfile end ]=== If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru Code:
ATTFilter MBRCheck, version 1.2.3
(c) 2010, AD
Command-line:
Windows Version: Windows XP Professional
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x0000003d
Kernel Drivers (total 122):
0x804D7000 \WINDOWS\system32\ntkrnlpa.exe
0x806E6000 \WINDOWS\system32\hal.dll
0xB85A8000 \WINDOWS\system32\KDCOM.DLL
0xB84B8000 \WINDOWS\system32\BOOTVID.dll
0xB7EA6000 spzb.sys
0xB85AA000 \WINDOWS\System32\Drivers\WMILIB.SYS
0xB7E8E000 \WINDOWS\System32\Drivers\SCSIPORT.SYS
0xB7E5F000 ACPI.sys
0xB7E4E000 pci.sys
0xB80A8000 isapnp.sys
0xB8670000 pciide.sys
0xB8328000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xB85AC000 viaide.sys
0xB80B8000 MountMgr.sys
0xB7E2F000 ftdisk.sys
0xB85AE000 dmload.sys
0xB7E09000 dmio.sys
0xB8330000 PartMgr.sys
0xB80C8000 VolSnap.sys
0xB7DF1000 atapi.sys
0xB80D8000 disk.sys
0xB80E8000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xB7DD1000 fltmgr.sys
0xB7DBF000 sr.sys
0xB80F8000 PxHelp20.sys
0xB7DA8000 KSecDD.sys
0xB7D95000 WudfPf.sys
0xB7D08000 Ntfs.sys
0xB7CDB000 NDIS.sys
0xB8108000 uagp35.sys
0xB7CC1000 Mup.sys
0xB8318000 \SystemRoot\system32\DRIVERS\intelppm.sys
0xB6ED1000 \SystemRoot\system32\DRIVERS\nv4_mini.sys
0xB6EBD000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xB8450000 \SystemRoot\system32\DRIVERS\RTL8139.SYS
0xB8158000 \SystemRoot\system32\DRIVERS\imapi.sys
0xB8458000 \SystemRoot\System32\Drivers\cdrbsdrv.SYS
0xB8168000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xB8178000 \SystemRoot\system32\DRIVERS\redbook.sys
0xB6E9A000 \SystemRoot\system32\DRIVERS\ks.sys
0xB8460000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0xB6E76000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xB8468000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xB8188000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0xB8470000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xB8478000 \SystemRoot\system32\DRIVERS\fdc.sys
0xB6E43000 \SystemRoot\system32\DRIVERS\parport.sys
0xB8198000 \SystemRoot\system32\DRIVERS\serial.sys
0xB7C89000 \SystemRoot\system32\DRIVERS\serenum.sys
0xB6A54000 \SystemRoot\system32\drivers\ALCXWDM.SYS
0xB6A30000 \SystemRoot\system32\drivers\portcls.sys
0xB81A8000 \SystemRoot\system32\drivers\drmk.sys
0xB87BD000 \SystemRoot\system32\DRIVERS\audstub.sys
0xB81B8000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xB7C85000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xB6A19000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xB81C8000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xB81D8000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xB8480000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xB6968000 \SystemRoot\system32\DRIVERS\psched.sys
0xB81E8000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xB8488000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xB8490000 \SystemRoot\system32\DRIVERS\raspti.sys
0xB6938000 \SystemRoot\system32\DRIVERS\rdpdr.sys
0xB8208000 \SystemRoot\system32\DRIVERS\termdd.sys
0xB8498000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xB85F8000 \SystemRoot\system32\DRIVERS\swenum.sys
0xB68DA000 \SystemRoot\system32\DRIVERS\update.sys
0xB78A4000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xB8218000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xB8258000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xB862C000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xB84B0000 \SystemRoot\system32\DRIVERS\flpydisk.sys
0xB8634000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xB86C3000 \SystemRoot\System32\Drivers\Null.SYS
0xB8636000 \SystemRoot\System32\Drivers\Beep.SYS
0xB8348000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0xB8378000 \SystemRoot\System32\drivers\vga.sys
0xB8638000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xB863A000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xB8380000 \SystemRoot\System32\Drivers\Msfs.SYS
0xB8388000 \SystemRoot\System32\Drivers\Npfs.SYS
0xB8588000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xB4757000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xB46FE000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xB46D8000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xB46B0000 \SystemRoot\system32\DRIVERS\netbt.sys
0xB8278000 \SystemRoot\system32\DRIVERS\wanarp.sys
0xB468E000 \SystemRoot\System32\drivers\afd.sys
0xB8288000 \SystemRoot\system32\DRIVERS\netbios.sys
0xB8390000 \SystemRoot\system32\DRIVERS\ssmdrv.sys
0xB4663000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xB45F3000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xB8298000 \SystemRoot\System32\Drivers\Fips.SYS
0xB45D7000 \SystemRoot\system32\DRIVERS\avipbb.sys
0xB863E000 \??\C:\Programme\Avira\AntiVir Desktop\avgio.sys
0xB8548000 \SystemRoot\system32\DRIVERS\hidusb.sys
0xB82C8000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0xB82D8000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xB68D2000 \SystemRoot\system32\DRIVERS\mouhid.sys
0xB44F7000 \SystemRoot\System32\Drivers\dump_atapi.sys
0xB864A000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xB8560000 \SystemRoot\System32\drivers\Dxapi.sys
0xB83B8000 \SystemRoot\System32\watchdog.sys
0xBD000000 \SystemRoot\System32\drivers\dxg.sys
0xB8692000 \SystemRoot\System32\drivers\dxgthk.sys
0xBD012000 \SystemRoot\System32\nv4_disp.dll
0xBD635000 \SystemRoot\System32\ATMFD.DLL
0xB43AB000 \SystemRoot\system32\DRIVERS\avgntflt.sys
0xB425A000 \SystemRoot\system32\DRIVERS\EAPPkt.sys
0xB436F000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xB404D000 \SystemRoot\system32\DRIVERS\mrxdav.sys
0xB8644000 \SystemRoot\System32\Drivers\ParVdm.SYS
0xB3E65000 \SystemRoot\system32\DRIVERS\srv.sys
0xB3BD0000 \SystemRoot\system32\drivers\wdmaud.sys
0xB3CF5000 \SystemRoot\system32\drivers\sysaudio.sys
0xB37EC000 \SystemRoot\System32\Drivers\Fastfat.SYS
0xB37AB000 \??\C:\DOKUME~1\Tonie\LOKALE~1\Temp\ugldipod.sys
0xB3732000 \SystemRoot\system32\DRIVERS\wg111v2.sys
0xB3679000 \SystemRoot\System32\Drivers\HTTP.sys
0x7C910000 \WINDOWS\system32\ntdll.dll
Processes (total 39):
0 System Idle Process
4 System
468 C:\WINDOWS\system32\smss.exe
516 csrss.exe
540 C:\WINDOWS\system32\winlogon.exe
584 C:\WINDOWS\system32\services.exe
596 C:\WINDOWS\system32\lsass.exe
784 C:\WINDOWS\system32\nvsvc32.exe
808 C:\WINDOWS\system32\svchost.exe
856 svchost.exe
896 C:\WINDOWS\system32\svchost.exe
940 C:\WINDOWS\system32\svchost.exe
1020 svchost.exe
1128 svchost.exe
1316 C:\WINDOWS\system32\spoolsv.exe
1384 C:\WINDOWS\explorer.exe
1396 C:\Programme\Avira\AntiVir Desktop\sched.exe
1440 svchost.exe
1544 C:\Programme\Avira\AntiVir Desktop\avguard.exe
1556 C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe
1576 C:\Programme\avmwlanstick\WLanNetService.exe
1612 C:\WINDOWS\system32\bgsvcgen.exe
1664 C:\Programme\Bonjour\mDNSResponder.exe
1712 C:\WINDOWS\system32\svchost.exe
1740 C:\Programme\Java\jre6\bin\jqs.exe
1792 C:\WINDOWS\system32\svchost.exe
1872 C:\WINDOWS\system32\svchost.exe
1888 C:\WINDOWS\system32\PnkBstrA.exe
1920 C:\WINDOWS\system32\PnkBstrB.exe
1964 C:\WINDOWS\system32\svchost.exe
492 C:\Programme\Canon\CAL\CALMAIN.exe
644 C:\Programme\Avira\AntiVir Desktop\avgnt.exe
732 C:\WINDOWS\system32\rundll32.exe
816 C:\WINDOWS\soundman.exe
3332 C:\Programme\Mozilla Firefox\firefox.exe
2836 C:\WINDOWS\system32\wbem\wmiapsrv.exe
2952 alg.exe
2112 <unknown>
3240 C:\Dokumente und Einstellungen\Tonie\Desktop\MBRCheck.exe
\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x0000000f`a012bc00 (NTFS)
\\.\F: --> \\.\PhysicalDrive0 at offset 0x00000028`09f85400 (NTFS)
PhysicalDrive0 Model Number: SAMSUNGSP2504C, Rev: VT100-50
Size Device Name MBR Status
--------------------------------------------
232 GB \\.\PhysicalDrive0 Windows XP MBR code detected
SHA1: ADFE55CD0C6ED2E00B22375835E4C2736CE9AD11
Done!
Habe vor ca. 3 Tagen (während des Threads) eine Datei auf eine externe FP geladen. Heute habe ich sie mir wieder angeschaut und festgestellt, dass auch ein Ordner mit Namen "recycler" mit drauf ist. Das scheint ja immer noch das Virus zu sein. Muss ich jetzt wieder von vorne anfangen oder hat das nichts zu sagen? Meine Autorun-funktion habe ich erst gerade über xp-antispy deaktiviert! Geändert von Trojanie (06.04.2011 um 20:35 Uhr) |
|
| Themen zu autorun-wurm lpl.exe auf cf-card gefunden, rechner ebenfalls infiziert |
| 0x00000001, 32 bit, 7-zip, antivir, any video converter, autorun wurm, avgntflt.sys, avira, bho, call of duty, canon, chip.de, desktop, error, fehlermeldung, festplatte, flash player, fontcache, format, keine viren, live cd, location, logfile, loswerden, mozilla, netgear, object, oldtimer, otl.exe, otl.txt, plug-in, realtek, recycle.bin, registry, rundll, safer networking, saver, sched.exe, searchplugins, security, shell32.dll, shortcut, software, sptd.sys, spyware, spyware terminator, stick, super, system, tcp, udp, video converter, viren, warum, windows internet, world at war |
Hybrid-Darstellung
