Trojaner-Board
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Firefox öffnet automatisch neue Fenster bis zum Absturtz (https://www.trojaner-board.de/100881-firefox-oeffnet-automatisch-neue-fenster-absturtz.html)

Haven 29.06.2011 16:16
Firefox öffnet automatisch neue Fenster bis zum Absturtz
 
Also fang ich mal an:

Mein Problem besteht darin, wenn ich Firefox öffne und auf irgendeinen Link (z.B: www.google.com) klicke, öffnen sich unbegrentzt neue Fenster, mit vier neuen tabs. Wenn diese nicht direkt geschlossen werden, öffnen sich solange Fenster bis Firefox abstürtzt.
In den Fenstern befinden sich immer die gleichen tabs:

1.hxxp://www.xn--py0}-dfa52c93a.com/ Meldung:Fehler Server konnte nicht gefunden werden.

2.hxxp://navigationshilfe1.t-online.de/dnserror?url=hxxp://www.xn--mp-hja3603a.com/

3.hxxp://xn--t)t tmw12-99a1a4qoag499ffp1l/;%C3%86%C3%84$%C2%AFb%C3%A2t%C2%A8%C2%BAg%1Df%C2%AEsg%CB%9C-%C2%BB%C2%AB;%C2%B2%C3%84%E2%80%99W%C3%A8M%C2%A6{%C3%A0%C5%92%C5%A1%C3%A4%C3%94%C3%9F%1D%03w%E2%80%9C+~%C2%B0%C3%B0%C3%B9 Meldung: Fehler Server konnte nicht gefunden werden

4.hxxp://www.ãÒk—„‡úÊ.com/ Meldung: Fehler Server konnte nicht gefunden werden

Deinstallation half nichts.
firefox ist auch auf dem neusten Stand.

OTL logs sind im anhang




Vielleicht könnt ihr mir ja helfen.

Noch ein Kompliment:
Was ich gelesen habe und die ganzen freundlich modis/ admins :schleim:
find ich richtig gut. Echt klasse Forum.

markusg 29.06.2011 16:20
hi,
öffne malwarebytes, logdateien, poste alle logs bitte.

Haven 29.06.2011 16:31
Ich habe Malwarebytes deinstalliert da es bei mir einen Bluescreen verursacht hat.

markusg 29.06.2011 16:46
ok.
bitte erstelle und poste ein combofix log.
Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Haven 29.06.2011 17:13
Ok mach ich.
Kannst du mir vielleicht sagen wie ich norton beenden kann. (hab versucht mit taskmanager die restlichen prozesse zu killen, hat aber wie erwartet nicht funktioniert)
Da Combofix immer eine Meldung ausspuckt.

markusg 29.06.2011 17:20
hi, überspringe es einfach, mit ok, dann gehts weiter

Haven 29.06.2011 17:34
So hier das log:

Combofix Logfile:
Code:
ComboFix 11-06-29.04 - Fabian 29.06.2011  18:22:50.1.4 - x86
Microsoft Windows 7 Home Premium  6.1.7601.1.1252.49.1031.18.3327.1882 [GMT 2:00]
ausgeführt von:: c:\users\Fabian\Desktop\ComboFix.exe
AV: Norton Internet Security *Enabled/Updated* {88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855}
FW: Norton Internet Security *Enabled* {B0F2DB13-C654-2E74-30D4-99C9310F0F2E}
SP: Norton Internet Security *Enabled/Updated* {33A8BBD2-AA01-20A2-213B-0B8EB45B02E8}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\SWCTL.DLL
.
.
(((((((((((((((((((((((  Dateien erstellt von 2011-05-28 bis 2011-06-29  ))))))))))))))))))))))))))))))
.
.
2011-06-29 16:28 . 2011-06-29 16:28        --------        d-----w-        c:\users\Default\AppData\Local\temp
2011-06-29 15:34 . 2011-06-29 15:34        406528        ----a-w-        c:\windows\system32\ReWire.dll
2011-06-29 15:34 . 2011-06-29 15:34        338432        ----a-w-        c:\windows\system32\REX Shared Library.dll
2011-06-29 15:34 . 2011-06-29 15:34        --------        d-----w-        c:\programdata\Propellerhead Software
2011-06-29 15:34 . 2011-06-29 15:35        --------        d-----w-        c:\users\Fabian\AppData\Roaming\Propellerhead Software
2011-06-29 15:33 . 2011-06-29 15:33        --------        d-----w-        c:\program files\Propellerhead
2011-06-29 15:09 . 2011-06-29 15:09        --------        d-----w-        C:\found.000
2011-06-29 14:17 . 2009-07-13 23:15        243584        ----a-w-        c:\windows\system32\wdrvhook.dll
2011-06-29 13:45 . 2011-06-29 13:45        --------        d-----w-        c:\users\Fabian\AppData\Local\Google
2011-06-29 04:49 . 2011-05-24 10:44        293376        ----a-w-        c:\windows\system32\umpnpmgr.dll
2011-06-29 04:49 . 2011-05-04 04:34        1549312        ----a-w-        c:\windows\system32\tquery.dll
2011-06-29 04:49 . 2011-05-04 04:32        1401344        ----a-w-        c:\windows\system32\mssrch.dll
2011-06-29 04:49 . 2011-05-04 04:28        427520        ----a-w-        c:\windows\system32\SearchIndexer.exe
2011-06-29 04:49 . 2011-05-04 04:32        666624        ----a-w-        c:\windows\system32\mssvp.dll
2011-06-29 04:49 . 2011-05-04 04:32        337408        ----a-w-        c:\windows\system32\mssph.dll
2011-06-29 04:49 . 2011-05-04 04:32        197120        ----a-w-        c:\windows\system32\mssphtb.dll
2011-06-29 04:49 . 2011-05-04 04:32        59392        ----a-w-        c:\windows\system32\msscntrs.dll
2011-06-29 04:49 . 2011-05-04 04:28        86528        ----a-w-        c:\windows\system32\SearchFilterHost.exe
2011-06-29 04:49 . 2011-05-04 04:28        164352        ----a-w-        c:\windows\system32\SearchProtocolHost.exe
2011-06-28 15:28 . 2011-06-28 15:28        --------        d-----w-        c:\program files\Setup Files
2011-06-28 14:58 . 2011-06-29 11:50        --------        d-----w-        c:\program files\MSI
2011-06-27 19:09 . 2011-06-27 19:09        --------        d-----w-        c:\program files\VirtualDJ
2011-06-27 19:07 . 2011-06-27 19:07        --------        d-----w-        c:\users\Fabian\AppData\Roaming\Malwarebytes
2011-06-27 19:07 . 2011-06-27 19:07        --------        d-----w-        c:\programdata\Malwarebytes
2011-06-27 15:31 . 2010-01-01 08:00        2106216        ----a-w-        c:\program files\Mozilla Firefox\D3DCompiler_43.dll
2011-06-27 15:31 . 2010-01-01 08:00        1998168        ----a-w-        c:\program files\Mozilla Firefox\d3dx9_43.dll
2011-06-20 17:31 . 2011-06-20 17:35        --------        d-----w-        c:\program files\WinSnap
2011-06-20 17:18 . 2011-06-20 17:18        106496        --sha-r-        c:\windows\system32\korwbrkrk.dll
2011-06-20 17:09 . 2011-06-23 16:30        --------        d-----w-        c:\users\Fabian\AppData\Roaming\Google Talk
2011-06-20 15:49 . 2011-04-29 02:46        310272        ----a-w-        c:\windows\system32\drivers\srv2.sys
2011-06-20 15:49 . 2011-04-29 02:46        311808        ----a-w-        c:\windows\system32\drivers\srv.sys
2011-06-20 15:49 . 2011-04-29 02:46        114688        ----a-w-        c:\windows\system32\drivers\srvnet.sys
2011-06-20 15:48 . 2011-04-25 04:31        1290624        ----a-w-        c:\windows\system32\drivers\tcpip.sys
2011-06-20 15:48 . 2011-04-25 02:18        338944        ----a-w-        c:\windows\system32\drivers\afd.sys
2011-06-20 15:48 . 2011-02-25 05:34        571904        ----a-w-        c:\windows\system32\oleaut32.dll
2011-06-20 13:54 . 2011-05-09 20:46        6962000        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{DB9669F9-3973-4BDC-B029-1FD4794A8FEF}\mpengine.dll
2011-06-13 09:18 . 2011-06-13 09:18        --------        d-----w-        c:\users\Fabian\AppData\Roaming\DVDVideoSoftIEHelpers
2011-06-13 09:18 . 2011-06-13 09:18        --------        d-----w-        c:\program files\Common Files\Plasmoo
2011-06-13 09:18 . 2011-06-13 09:18        --------        d-----w-        c:\program files\Common Files\DVDVideoSoft
2011-06-13 09:18 . 2011-06-13 09:18        --------        d-----w-        c:\program files\DVDVideoSoft
2011-06-11 14:06 . 2010-10-27 02:43        110592        ----a-w-        c:\windows\system32\rtvcvfw32.dll
2011-06-11 14:06 . 2011-06-11 14:10        --------        d-----w-        c:\program files\MSI Afterburner
2011-06-11 08:28 . 2011-06-11 10:36        --------        d-----w-        c:\users\Fabian\AppData\Local\ElevatedDiagnostics
2011-06-09 16:36 . 2011-06-09 16:36        --------        d-----w-        c:\program files\RealVNC
2011-06-06 15:17 . 2011-06-20 15:38        404640        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2011-06-04 08:06 . 2011-06-04 08:06        --------        d-----w-        C:\OscarData
2011-06-01 15:28 . 2011-06-01 15:28        --------        d-----w-        c:\users\Fabian\.thumbnails
2011-06-01 14:55 . 2011-06-01 14:55        --------        d-----w-        c:\users\Fabian\AppData\Roaming\Blender Foundation
2011-06-01 14:55 . 2011-06-01 14:55        --------        d-----w-        c:\program files\Blender Foundation
2011-06-01 14:29 . 2011-06-01 14:29        --------        d-----w-        c:\program files\MAXON
2011-06-01 14:27 . 2011-06-01 14:41        --------        d-----w-        c:\users\Fabian\AppData\Roaming\MAXON
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-05-05 14:38 . 2011-05-05 14:38        298728        ----a-w-        c:\windows\system32\dllcin32.exe
2011-04-28 16:15 . 2011-04-04 10:25        2755072        ----a-w-        c:\windows\system32\themeui.dll
2011-04-28 16:15 . 2009-07-13 23:39        37376        ----a-w-        c:\windows\system32\themeservice.dll
2011-04-28 16:15 . 2009-07-13 23:40        249856        ----a-w-        c:\windows\system32\uxtheme.dll
2011-04-22 19:14 . 2011-05-25 18:51        27008        ----a-w-        c:\windows\system32\drivers\Diskdump.sys
2011-04-14 09:32 . 2011-04-14 09:32        425768        ----a-w-        c:\program files\iTunesPhotoProcessor.exe
2011-04-14 09:32 . 2011-04-14 09:32        293152        ----a-w-        c:\program files\iTunesOutlookAddIn.dll
2011-04-14 09:32 . 2011-04-14 09:32        214816        ----a-w-        c:\program files\iTunesPhotoProcessor.dll
2011-04-14 09:32 . 2011-04-14 09:32        421160        ----a-w-        c:\program files\iTunesHelper.exe
2011-04-14 09:32 . 2011-04-14 09:32        165152        ----a-w-        c:\program files\iTunesHelper.dll
2011-04-14 09:32 . 2011-04-14 09:32        124200        ----a-w-        c:\program files\iTunesMiniPlayer.dll
2011-04-14 09:32 . 2011-04-14 09:32        9776936        ----a-w-        c:\program files\iTunes.exe
2011-04-14 09:32 . 2011-04-14 09:32        402216        ----a-w-        c:\program files\iTunesAdmin.dll
2011-04-14 09:32 . 2011-04-14 09:32        19778336        ----a-w-        c:\program files\iTunes.dll
2011-04-14 09:32 . 2011-04-14 09:32        111904        ----a-w-        c:\program files\ITDetector.ocx
2011-04-14 09:32 . 2011-04-14 09:32        754976        ----a-w-        c:\program files\gnsdk_sdkmanager.dll
2011-04-14 09:32 . 2011-04-14 09:32        648992        ----a-w-        c:\program files\iPodUpdaterExt.dll
2011-04-14 09:32 . 2011-04-14 09:32        2733344        ----a-w-        c:\program files\gnsdk_dsp.dll
2011-04-14 09:32 . 2011-04-14 09:32        267552        ----a-w-        c:\program files\gnsdk_submit.dll
2011-04-14 09:32 . 2011-04-14 09:32        197920        ----a-w-        c:\program files\gnsdk_musicid.dll
2011-04-09 06:02 . 2011-05-12 14:05        3967872        ----a-w-        c:\windows\system32\ntkrnlpa.exe
2011-04-09 06:02 . 2011-05-12 14:05        3912576        ----a-w-        c:\windows\system32\ntoskrnl.exe
2011-04-09 05:56 . 2011-05-19 13:01        123904        ----a-w-        c:\windows\system32\poqexec.exe
2011-04-06 14:20 . 2011-04-06 14:20        91424        ----a-w-        c:\windows\system32\dnssd.dll
2011-04-06 14:20 . 2011-04-06 14:20        75040        ----a-w-        c:\windows\system32\jdns_sd.dll
2011-04-06 14:20 . 2011-04-06 14:20        197920        ----a-w-        c:\windows\system32\dnssdX.dll
2011-04-06 14:20 . 2011-04-06 14:20        107808        ----a-w-        c:\windows\system32\dns-sd.exe
2011-04-04 10:30 . 2009-07-14 02:05        152576        ----a-w-        c:\windows\system32\msclmd.dll
2011-06-16 04:32 . 2011-03-13 13:58        142296        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[7] 2011-02-26 . 255CF508D7CFB10E0794D6AC93280BD8 . 2614784 . . [6.1.7600.16385] . . c:\windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_525b5180f3f95373\explorer.exe
[7] 2011-02-26 . 2AF58D15EDC06EC6FDACCE1F19482BBF . 2614784 . . [6.1.7600.16385] . . c:\windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_51a3a583dafd0cef\explorer.exe
[7] 2011-02-26 . 0FB9C74046656D1579A64660AD67B746 . 2616320 . . [6.1.7600.16385] . . c:\windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_54149f9ef14031fc\explorer.exe
[-] 2011-02-25 . 5AE75E256D5C7AEF27201B57C92AF58A . 2607104 . . [6.1.7600.16385] . . c:\windows\explorer.exe
[7] 2011-02-25 . 8B88EBBB05A0E56B7DCC708498C02B3E . 2616320 . . [6.1.7600.16385] . . c:\windows\System32\SLTrans\explorer.exe
[7] 2011-02-25 . 8B88EBBB05A0E56B7DCC708498C02B3E . 2616320 . . [6.1.7600.16385] . . c:\windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_5389023fd8245f84\explorer.exe
[7] 2010-11-20 . 40D777B7A95E00593EB1568C68514493 . 2616320 . . [6.1.7600.16385] . . c:\windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_53bc10fdd7fe87ca\explorer.exe
[7] 2009-10-31 . C76153C7ECA00FA852BB0C193378F917 . 2614272 . . [6.1.7600.16385] . . c:\windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_52283b2af41f3691\explorer.exe
[7] 2009-10-31 . 2626FC9755BE22F805D3CFA0CE3EE727 . 2614272 . . [6.1.7600.16385] . . c:\windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_51a66d6ddafc2ed1\explorer.exe
[7] 2009-08-03 . 9FF6C4C91A3711C0A3B18F87B08B518D . 2613248 . . [6.1.7600.16385] . . c:\windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_526619d4f3f142e6\explorer.exe
[7] 2009-08-03 . B95EEB0F4E5EFBF1038A35B3351CF047 . 2613248 . . [6.1.7600.16385] . . c:\windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_51e07e31dad00878\explorer.exe
[7] 2009-07-14 . 15BC38A7492BEFE831966ADB477CF76F . 2613248 . . [6.1.7600.16385] . . c:\windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_518afd35db100430\explorer.exe
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1411072]
"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]
"CCWinTray"="c:\windows\tray\wintmr.exe" [2009-07-13 5850520]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UpdatePSTShortCut"="c:\program files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" [2009-09-29 210216]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-01-26 336384]
"ATICustomerCare"="c:\program files\ATI\ATICustomerCare\ATICustomerCare.exe" [2010-05-04 311296]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2011-02-24 10025576]
"sllaunch"="c:\windows\system32\sllaunch.exe" [2010-10-16 145843]
"ChicoSys"="c:\windows\system32\cc32\webtmr.exe" [2009-07-13 5496728]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CCWinTray"="c:\windows\tray\wintmr.exe" [2009-07-13 5850520]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
"NoHotStart"= 0 (0x0)
"HideFastUserSwitching"= 1 (0x1)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableClock"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoStrCmpLogical"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ksupmgr]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeAAMUpdater-1.0]
2010-03-06 01:44        500208        ------w-        c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS5ServiceManager]
2010-07-22 20:10        402432        ----a-w-        c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CCWinTray]
2009-07-13 23:15        5850520        ----a-w-        c:\windows\tray\wintmr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ChicoSys]
2009-07-13 23:15        5496728        ----a-w-        c:\windows\System32\cc32\webtmr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2011-04-14 09:32        421160        ----a-w-        c:\program files\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LGODDFU]
2011-03-13 13:20        557056        ----a-w-        c:\program files\lg_fwupdate\fwupdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 16:38        421888        ----a-w-        c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SwitchBoard]
2010-02-19 11:37        517096        ----a-w-        c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 ksupmgr;File-/Update Service;c:\windows\system32\ksupmgr.exe [2010-08-25 765592]
R3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [2011-03-24 14216]
R3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [2011-03-24 8456]
R3 FLASHSYS;FLASHSYS;c:\program files\MSI\Live Update 4\LU4\FLASHSYS.sys [x]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [x]
R3 MSI_MSIBIOS_010507;MSI_MSIBIOS_010507;c:\program files\MSI\Live Update 5\msibios32_100507.sys [2010-05-10 25912]
R3 MsibiosDevice;MsibiosDevice;c:\program files\MSI\Live Update 4\LU4\msibios.sys [x]
R3 MSICDSetup;MSICDSetup;D:\CDriver.sys [x]
R3 NTIOLib_1_0_4;NTIOLib_1_0_4;c:\program files\MSI\Live Update 5\NTIOLib.sys [2010-10-20 7680]
R3 NTIOLib_1_0_6;NTIOLib_1_0_6;c:\program files\Setup Files\Ms7599v1F0\NTIOLib.sys [2011-01-06 7680]
R3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NIS\1108000.005\SYMDS.SYS [2009-08-30 328752]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NIS\1108000.005\SYMEFA.SYS [2010-04-22 173104]
S1 BHDrvx86;BHDrvx86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20110616.003\BHDrvx86.sys [2011-05-19 810616]
S1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NIS\1108000.005\ccHPx86.sys [2010-02-26 501888]
S1 IDSVix86;IDSVix86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20110628.050\IDSvix86.sys [2011-06-03 367736]
S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NIS\1108000.005\Ironx86.SYS [2010-04-29 116784]
S1 SYMTDIv;Symantec Vista Network Dispatch Driver;c:\windows\System32\Drivers\NIS\1108000.005\SYMTDIV.SYS [2010-05-06 339504]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2009-07-14 20992]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2011-01-26 176128]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2011-01-26 284672]
S2 AMD Reservation Manager;AMD Reservation Manager;c:\program files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe [2010-06-17 140224]
S2 NIS;Norton Internet Security;c:\program files\Norton Internet Security\Engine\17.8.0.5\ccSvcHst.exe [2010-02-26 126392]
S3 amdiox86;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox86.sys [2010-02-18 37944]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2011-01-26 7566848]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2011-01-26 238592]
S3 netr73;RT73 USB-Drahtlos-LAN-Kartentreiber für Vista;c:\windows\system32\DRIVERS\netr73.sys [2009-07-13 545792]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2011-01-21 328808]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-13 14336]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - ERASERUTILDRVI11
*Deregistered* - EraserUtilDrvI11
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Akamai        REG_MULTI_SZ          Akamai
.
Inhalt des "geplante Tasks" Ordners
.
2011-06-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1747697056-1716269925-3793502237-1001Core.job
- c:\users\Fabian\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-29 13:45]
.
2011-06-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1747697056-1716269925-3793502237-1001UA.job
- c:\users\Fabian\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-29 13:45]
.
.
------- Zusätzlicher Suchlauf -------
.
uInternet Settings,ProxyOverride = *.local
IE: Free YouTube to MP3 Converter - c:\users\Fabian\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\Fabian\AppData\Roaming\Mozilla\Firefox\Profiles\kxz94sw8.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.web.de/|hxxp://www.websitetooltester.com/|https://www.google.com/a/cpanel/cms-testlabor.de/UserHub?pli=1|https://sites.google.com/a/cms-testlabor.de/intranet-websitetooltester/home/stundenzettel|hxxp://pesito.kanbantool.com/boards/7747-fabian-todo#board-view
FF - prefs.js: network.proxy.type - 0
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKCU-Run-AdobeBridge - (no file)
MSConfigStartUp-Yodm3D - c:\users\Fabian\AppData\Local\Temp\Rar$EX49.568\Yodm3D.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NIS]
"ImagePath"="\"c:\program files\Norton Internet Security\Engine\17.8.0.5\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files\Norton Internet Security\Engine\17.8.0.5\diMaster.dll\" /prefetch:1"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'Explorer.EXE'(1836)
c:\program files\RocketDock\RocketDock.dll
c:\progra~1\Yzshadow\YzShadow.dll
c:\users\Fabian\AppData\Local\Temp\catchme.dll
.
Zeit der Fertigstellung: 2011-06-29  18:30:19
ComboFix-quarantined-files.txt  2011-06-29 16:30
.
Vor Suchlauf: 9 Verzeichnis(se), 279.537.295.360 Bytes frei
Nach Suchlauf: 15 Verzeichnis(se), 280.059.523.072 Bytes frei
.
- - End Of File - - B55EAF6AD0C460E8CB0E8D7AAFF91700
--- --- ---

markusg 29.06.2011 17:40
erstelle mal bitte nen gmer report
http://www.trojaner-board.de/74908-a...t-scanner.html

Haven 29.06.2011 17:47
So hier der Gmer Log:


GMER 1.0.15.15640 - hxxp://www.gmer.net
Rootkit quick scan 2011-06-29 18:46:49
Windows 6.1.7601 Service Pack 1 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T1L0-4 ST3500418AS rev.CC38
Running: pgtmop6f.exe; Driver: C:\Users\Fabian\AppData\Local\Temp\uxdiipod.sys


---- Disk sectors - GMER 1.0.15 ----

Disk \Device\Harddisk0\DR0 TDL4@MBR code has been found <-- ROOTKIT !!!
Disk \Device\Harddisk0\DR0 sector 00: rootkit-like behavior

---- Devices - GMER 1.0.15 ----

AttachedDevice \Driver\tdx \Device\Ip SYMTDIV.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\tdx \Device\Tcp SYMTDIV.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\tdx \Device\Udp SYMTDIV.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\tdx \Device\RawIp SYMTDIV.SYS (Network Dispatch Driver/Symantec Corporation)

---- EOF - GMER 1.0.15 ----

markusg 29.06.2011 17:49
nutze den tdss killer
Wie werden Schadprogramme der Familie Rootkit.Win32.TDSS bekämpft?
log posten

Haven 29.06.2011 17:53
so poste kurz log und danach reboot ich:
\Device\Harddisk0\DR0 (Rootkit.Win32.TDSS.tdl4) - will be cured after reboot
\Device\Harddisk0\DR0 - ok

Haven 29.06.2011 18:00
Post nur noch kurz das log und dann reboot ich:
\Device\Harddisk0\DR0 (Rootkit.Win32.TDSS.tdl4) - will be cured after reboot
\Device\Harddisk0\DR0 - ok

markusg 29.06.2011 18:00
gibts noch die selben probleme?

Haven 29.06.2011 18:06
Du bist mein Held :D

Funktioniert wieder alles so wie vorher.
Vielen Dank!

Sry für doppelpost

markusg 29.06.2011 18:35
hi,
machst du onlinebanking einkäufe oder sonst was wichtiges mit dem pc?


Alle Zeitangaben in WEZ +1. Es ist jetzt 10:16 Uhr.
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2024, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28