Hallo,
habe folgendes Problem:
Seit mehreren Wochen wirft Antivir immer Trojaner-Meldungen aus dem
C:\Windows\Temp Ordner raus. Die Dateinamen sind immer "setup.exe".
Selbstverständlich klicke nun ich auf "In Quarantäne verschieben".
Jedoch kommen diese Meldungen alle 2-3 Minuten wieder, manchmal schneller oder langsamer, manchmal in den selben Dateipfaden im \Temp Ordner, manchmal in anderen.
Außerdem öffnen sich von Zeit zu Zeit irgendwelche Ad-Fenster (vor ein paar Tagen im IE, jetzt auch im Firefox)
Avira: (Nur letzter Fund - andere falls benötigt)
Zitat:
Exportierte Ereignisse:
21.04.2011 03:58 [Guard] Malware gefunden
In der Datei 'C:\Windows\Temp\sbcs\setup.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Spy.8192.181' [trojan] gefunden.
Ausgeführte Aktion: Datei in Quarantäne verschieben
|
VirusTotal Log von einer infizierten Datei:
Zitat:
AhnLab-V3 - 2011.04.21.00 - 2011.04.21 - -
AntiVir - 7.11.6.215 - 2011.04.20 - TR/Mooplids.A.9
Antiy-AVL - 2.0.3.7 - 2011.04.21 - -
Avast - 4.8.1351.0 - 2011.04.20 - -
Avast5 - 5.0.677.0 - 2011.04.20 - -
AVG - 10.0.0.1190 - 2011.04.20 - -
BitDefender - 7.2 - 2011.04.21 - Trojan.Generic.KDV.187497
CAT-QuickHeal - 11.00 - 2011.04.20 - -
ClamAV - 0.97.0.0 - 2011.04.20 - -
Commtouch - 5.3.2.6 - 2011.04.21 - -
Comodo - 8417 - 2011.04.21 - -
eSafe - 7.0.17.0 - 2011.04.20 - -
eTrust-Vet - 36.1.8282 - 2011.04.20 - Win32/Bredolab.ARL
F-Prot - 4.6.2.117 - 2011.04.21 - -
F-Secure - 9.0.16440.0 - 2011.04.21 - Trojan.Generic.KDV.187497
Fortinet - 4.2.257.0 - 2011.04.21 - W32/Menti.GENA!tr
GData - 22 - 2011.04.21 - Trojan.Generic.KDV.187497
Ikarus - T3.1.1.103.0 - 2011.04.21 - -
Jiangmin - 13.0.900 - 2011.04.21 - -
K7AntiVirus - 9.97.4439 - 2011.04.20 - -
Kaspersky - 7.0.0.125 - 2011.04.21 - Trojan.Win32.Menti.gena
McAfee - 5.400.0.1158 - 2011.04.21 - Artemis!EC655EAC875B
McAfee-GW-Edition - 2010.1D - 2011.04.20 - Artemis!EC655EAC875B
Microsoft - 1.6802 - 2011.04.20 - VirTool:Win32/Obfuscator.ON
NOD32 - 6059 - 2011.04.21 - a variant of Win32/Kryptik.MOE
Panda - 10.0.3.5 - 2011.04.20 - Generic Trojan
PCTools - 7.0.3.5 - 2011.04.20 - Trojan.Gen
Prevx - 3.0 - 2011.04.21 - Medium Risk Malware Dropper
Rising - 23.54.02.06 - 2011.04.20 - -
Sophos - 4.64.0 - 2011.04.21 - Mal/FakeAV-JX
SUPERAntiSpyware - 4.40.0.1006 - 2011.04.21 - Trojan.Agent/Gen-Falprod[RE]
Symantec - 20101.3.2.89 - 2011.04.21 - Trojan.Gen
TheHacker - 6.7.0.1.179 - 2011.04.21 - -
TrendMicro - 9.200.0.1012 - 2011.04.20 - TROJ_GEN.RFFC3DE
TrendMicro-HouseCall - 9.200.0.1012 - 2011.04.21 - TROJ_GEN.RFFC3DE
VBA32 - 3.12.16.0 - 2011.04.20 - Trojan.Menti.gena
VIPRE - 9074 - 2011.04.21 - Trojan.Win32.Generic!BT
ViRobot - 2011.4.20.4420 - 2011.04.20 - -
VirusBuster - 13.6.313.2 - 2011.04.20 - Trojan.Menti!YDGZ4O1YWy8
File info:
MD5: ec655eac875b1228c02a844c4447e2a6
SHA1: f73b89bd38d29002548a6cf84e4a8dc06b5da66a
SHA256: 8df8be6dad98a7ce07cb3bf60a24c5b0ac678b25664a6ea16f64b2127a5c61dc
File size: 31744 bytes
Scan date: 2011-04-21 01:26:36 (UTC)
|
Malwarebytes Logfile: Zitat:
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org
Datenbank Version: 6410
Windows 6.0.6001 Service Pack 1
Internet Explorer 7.0.6001.18000
21.04.2011 04:01:32
mbam-log-2011-04-21 (04-01-32).txt
Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 168928
Laufzeit: 8 Minute(n), 18 Sekunde(n)
Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 1
Infizierte Registrierungsschlüssel: 15
Infizierte Registrierungswerte: 2
Infizierte Dateiobjekte der Registrierung: 1
Infizierte Verzeichnisse: 1
Infizierte Dateien: 16
Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule:
c:\Windows\System32\pkvpvwwh.dll (IPH.GenericBHO) -> Delete on reboot.
Infizierte Registrierungsschlüssel:
HKEY_CLASSES_ROOT\CLSID\{9822B241-E9A4-8215-A845-54AFDDB4CD29} (IPH.GenericBHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Fpyjiqsy (IPH.GenericBHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9822B241-E9A4-8215-A845-54AFDDB4CD29} (IPH.GenericBHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{9822B241-E9A4-8215-A845-54AFDDB4CD29} (IPH.GenericBHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{500BCA15-57A7-4eaf-8143-8C619470B13D} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{9233C3C0-1472-4091-A505-5580A23BB4AC} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\XML.XML.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\XML.XML (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{500BCA15-57A7-4EAF-8143-8C619470B13D} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{500BCA15-57A7-4EAF-8143-8C619470B13D} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\NordBull (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\PopRock (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Antimalware Doctor Inc (Rogue.AntimalwareDoctor) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Antimalware Doctor (Rogue.AntimalwareDoctor) -> Quarantined and deleted successfully.
Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\newreleaseversion70700.exe (Trojan.FakeAlert) -> Value: newreleaseversion70700.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Oyubeyev (Trojan.Agent.U) -> Value: Oyubeyev -> Quarantined and deleted successfully.
Infizierte Dateiobjekte der Registrierung:
HKEY_CLASSES_ROOT\regfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: ("regedit.exe" "%1") Good: (regedit.exe "%1") -> Quarantined and deleted successfully.
Infizierte Verzeichnisse:
c:\Users\koerner.alexander\AppData\Roaming\microsoft\Windows\start menu\Programs\antimalware doctor (Rogue.AntiMalwareDoctor) -> Quarantined and deleted successfully.
Infizierte Dateien:
c:\Windows\System32\pkvpvwwh.dll (IPH.GenericBHO) -> Delete on reboot.
c:\windows\temp\ijhx\setup.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Users\koerner.alexander\downloads\zwinkysetup2.3.50.57.zjfox000.exe (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\Users\koerner.alexander\downloads\webfettisetup2.3.50.56.sa.hp.zkfox000.exe (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\Windows\System32\config\systemprofile\AppData\Roaming\Adobe\plugs\kb3057744.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Windows\System32\config\systemprofile\AppData\Roaming\Adobe\plugs\kb3057931.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Windows\System32\config\systemprofile\AppData\Roaming\Adobe\plugs\kb3058025.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\koerner.alexander\Desktop\antimalware doctor.lnk (Rogue.AntimalwareDoctor) -> Quarantined and deleted successfully.
c:\Users\koerner.alexander\AppData\Roaming\microsoft\internet explorer\quick launch\antimalware doctor.lnk (Rogue.AntimalwareDoctor) -> Quarantined and deleted successfully.
c:\Users\koerner.alexander\AppData\Roaming\microsoft\Windows\start menu\antimalware doctor.lnk (Rogue.AntimalwareDoctor) -> Quarantined and deleted successfully.
c:\Users\koerner.alexander\AppData\Roaming\microsoft\Windows\start menu\Programs\Startup\antimalware doctor.lnk (Rogue.AntiMalwareDoctor) -> Quarantined and deleted successfully.
c:\Windows\Tasks\{22116563-108c-42c0-a7ce-60161b75e508}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Windows\Tasks\{bbaeaeaf-1275-40e2-bd6c-bc8f88bd114a}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Windows\Tasks\{810401e2-dde0-454e-b0e2-aa89c9e5967c}.job (Trojan.FraudPack) -> Quarantined and deleted successfully.
c:\Users\koerner.alexander\AppData\Roaming\microsoft\Windows\start menu\Programs\antimalware doctor\antimalware doctor.lnk (Rogue.AntiMalwareDoctor) -> Quarantined and deleted successfully.
c:\Users\koerner.alexander\AppData\Roaming\microsoft\Windows\start menu\Programs\antimalware doctor\uninstall.lnk (Rogue.AntiMalwareDoctor) -> Quarantined and deleted successfully.
|
HijackThis: Zitat:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 04:17:12, on 21.04.2011
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18248)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\System32\spool\drivers\w32x86\3\E_FATIAEE.EXE
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Hercules\Audio\DJ Console Series\HDJSeriesCPL.exe
C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe
C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe
C:\Users\KOERNE~1.ALE\AppData\Local\Temp\RtkBtMnt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.orbitdownloader.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 172.21.0.2:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll (file missing)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - C:\Program Files\Windows Live\Messenger\wlchtc.dll
O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (file missing)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (file missing)
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Skytel] Skytel.exe
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [EPSON Stylus DX4200 Series] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIAEE.EXE /F "C:\Windows\TEMP\E_S544E.tmp" /EF "HKLM"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Hercules DJ Series] C:\Program Files\Hercules\Audio\DJ Console Series\HDJSeriesCPL.exe /boot
O4 - HKLM\..\Run: [LogMeIn Hamachi Ui] "C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
O4 - HKLM\..\Run: [NokiaMServer] C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"
O4 - HKUS\S-1-5-18\..\Run: [Metropolis] rundll32.exe C:\Windows\system32\sshnas21.dll,GetHandle (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Q7NZMT7RLB] C:\Windows\TEMP\Pzl.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Oyubeyev] rundll32.exe "C:\Windows\system32\config\systemprofile\AppData\Local\dpintrt.dll",Startup (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Metropolis] rundll32.exe C:\Windows\system32\sshnas21.dll,GetHandle (User 'Default user')
O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\koerner.alexander\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - hxxp://messenger.zone.msn.com/MessengerGamesContent/GameContent/de/uno1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - hxxp://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = delasalle.local
O17 - HKLM\Software\..\Telephony: DomainName = delasalle.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = delasalle.local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = delasalle.local
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Avira AntiVir Personal - Free Antivirus Planer (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Update Service (gupdate1c9b9472b0bf9df) (gupdate1c9b9472b0bf9df) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
O23 - Service: Hercules DJ Control MP3 (HerculesDJControlMP3) - Unknown owner - C:\Program Files\Hercules\Audio\DJ Console Series\HerculesDJControlMP3.EXE
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
--
End of file - 8582 bytes
|
Hoffe ihr könnt helfen,
Lg Alex
21.04.2011, 03:25
Baum-Darstellung