Trojaner-Board
Seite 3 von 5 12 3 45
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   funmoods & DR/FakePic.Gen tmp.edb (https://www.trojaner-board.de/111117-funmoods-dr-fakepic-gen-tmp-edb.html)

disteffensso 12.03.2012 20:17
Gibt kein Log. "Scan Results" ist leer.
Klicke ich auf "show information messages" erscheint- vermutlich 265 mal- OK.
Kaspersky TDSSKiller sagt:
No threads found.
Processed: 265 objekts

cosinus 12.03.2012 20:26
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

disteffensso 12.03.2012 21:06
Arne,
hier ist es jetzt 03:00 morgens. 6 Stunden vor. Können wir morgen weiter machen?
Besten Dank derweil.
Stefan

Combofix Logfile:
Code:
ComboFix 12-03-12.03 - stefan 12.03.2012  20:35:26.3.2 - x86
Microsoft® Windows Vista™ Business  6.0.6002.2.1252.49.1031.18.1915.1047 [GMT 1:00]
ausgeführt von:: c:\users\stefan\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\stefan\AppData\Roaming\Desktopicon
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-02-12 bis 2012-03-12  ))))))))))))))))))))))))))))))
.
.
2012-03-12 19:46 . 2012-03-12 19:46        --------        d-----w-        c:\users\Gast\AppData\Local\temp
2012-03-12 19:46 . 2012-03-12 19:46        --------        d-----w-        c:\users\Default\AppData\Local\temp
2012-03-10 03:40 . 2012-02-08 06:03        6552120        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{AC21A542-62BD-4899-A57B-8CE324FC2337}\mpengine.dll
2012-03-09 14:43 . 2012-03-09 14:43        --------        d-----w-        c:\program files\File-Upload.net
2012-03-09 03:04 . 2012-03-09 03:04        --------        d-----w-        c:\program files\ESET
2012-03-08 14:07 . 2012-03-08 14:07        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware
2012-03-08 14:07 . 2011-12-10 14:24        20464        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-03-08 12:43 . 2012-03-08 12:43        --------        d-----w-        c:\users\stefan\AppData\Roaming\dvdcss
2012-03-08 07:29 . 2012-03-08 07:29        --------        d-----w-        c:\program files\7-Zip
2012-03-07 11:31 . 2012-03-08 06:45        --------        d-----w-        C:\sh4ldr
2012-03-07 11:31 . 2012-03-07 11:31        --------        d-----w-        c:\program files\Enigma Software Group
2012-02-16 06:32 . 2011-12-14 16:17        680448        ----a-w-        c:\windows\system32\msvcrt.dll
2012-02-16 06:32 . 2012-01-12 19:52        2044416        ----a-w-        c:\windows\system32\win32k.sys
2012-02-16 06:32 . 2011-12-20 10:56        2409784        ----a-w-        c:\program files\Windows Mail\OESpamFilter.dat
2012-02-15 16:33 . 2012-02-15 16:53        --------        d-----w-        c:\users\stefan\AppData\Roaming\redsn0w
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-03-07 12:46 . 2011-05-14 07:44        414368        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2012-02-23 08:18 . 2009-10-03 08:00        237072        ------w-        c:\windows\system32\MpSigStub.exe
2012-02-17 02:01 . 2011-11-13 19:02        137416        ----a-w-        c:\windows\system32\drivers\avipbb.sys
2012-02-17 16:52 . 2011-04-20 21:41        134104        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
"iCloudServices"="c:\program files\Common Files\Apple\Internet Services\iCloudServices.exe" [2011-11-11 59240]
"ApplePhotoStreams"="c:\program files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe" [2011-11-11 59240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-12-06 1029416]
"NDSTray.exe"="NDSTray.exe" [BU]
"topi"="c:\program files\TOSHIBA\Toshiba Online Product Information\topi.exe" [2007-07-10 581632]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-06-25 150040]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-06-25 170520]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-06-25 145944]
"Camera Assistant Software"="c:\program files\Camera Assistant Software for Toshiba\traybar.exe" [2008-04-29 417792]
"Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdSync.exe" [2008-01-21 215552]
"MobileConnect"="c:\program files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe" [2008-07-04 2072576]
"Toshiba TEMPRO"="c:\program files\Toshiba TEMPRO\TemproTray.exe" [2010-10-26 1050072]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-10-06 59240]
"PCTools FGuard"="c:\program files\PC Tools Security\BDT\FGuard.exe" [2011-05-20 247760]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-01 59240]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-10-11 258512]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-06-05 202256]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-01-16 421736]
.
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
TRDCReminder.lnk - c:\program files\TOSHIBA\TRDCReminder\TRDCReminder.exe [2008-3-5 393216]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux4"=wdmaud.drv
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^Users^stefan^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^PMB Medien-Prüfung.lnk]
path=c:\users\stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PMB Medien-Prüfung.lnk
backup=c:\windows\pss\PMB Medien-Prüfung.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\00TCrdMain]
2008-05-09 09:49        716800        ----a-w-        c:\program files\TOSHIBA\FlashCards\TCrdMain.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2011-06-06 10:55        937920        ----a-w-        c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google EULA Launcher]
2008-05-28 11:40        20480        ----a-w-        c:\program files\Google\Google EULA\GoogleEULALauncher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2006-12-10 19:52        49152        ----a-w-        c:\program files\HP\HP Software Update\hpwuSchd2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HSON]
2007-10-31 20:01        54608        ----a-w-        c:\program files\TOSHIBA\TBS\HSON.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]
2008-04-08 13:14        6037504        ----a-w-        c:\windows\RtHDVCpl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skytel]
2007-11-20 16:15        1826816        ----a-w-        c:\windows\SkyTel.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmoothView]
2008-06-24 08:06        509816        ----a-w-        c:\program files\TOSHIBA\SmoothView\SmoothView.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2008-08-13 16:24        68856        ----a-w-        c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2010-06-05 22:57        202256        ----a-w-        c:\program files\Common Files\Real\Update_OB\realsched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Toshiba Registration]
2008-01-11 02:07        574864        ----a-w-        c:\program files\TOSHIBA\Registration\ToshibaRegistration.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TPwrMain]
2008-01-17 14:27        431456        ----a-w-        c:\program files\TOSHIBA\Power Saver\TPwrMain.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" -osboot
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe"
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001
.
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - 78945024
*Deregistered* - 78945024
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork        REG_MULTI_SZ          PLA DPS BFE mpssvc
HPZ12        REG_MULTI_SZ          Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt        REG_MULTI_SZ          hpqcxs08 hpqddsvc
WindowsMobile        REG_MULTI_SZ          wcescomm rapimgr
LocalServiceRestricted        REG_MULTI_SZ          WcesComm RapiMgr
LocalServiceAndNoImpersonation        REG_MULTI_SZ          FontCache
.
Inhalt des "geplante Tasks" Ordners
.
2012-03-11 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-08-13 09:49]
.
2012-03-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-10-11 21:02]
.
2012-03-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-10-11 21:02]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page =
mStart Page =
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://de.search.yahoo.com/search?fr=mcafee&p=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
LSP: c:\program files\Avira\AntiVir Desktop\avsda.dll
FF - ProfilePath - c:\users\stefan\AppData\Roaming\Mozilla\Firefox\Profiles\afsd7hfq.default\
FF - prefs.js: browser.search.defaulturl -
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?q=
FF - user.js: yahoo.homepage.dontask - true);user_pref(extensions.funmoods_i.hmpg, true
FF - user.js: extensions.funmoods_i.hmpgUrl - hxxp://start.funmoods.com/?f=1&a=make
FF - user.js: extensions.funmoods_i.dfltSrch - true
FF - user.js: extensions.funmoods_i.srchPrvdr - Search
FF - user.js: extensions.funmoods_i.dnsErr - true
FF - user.js: extensions.funmoods_i.newTab - true
FF - user.js: extensions.funmoods_i.newTabUrl - hxxp://start.funmoods.com/?f=2&a=make
FF - user.js: extensions.funmoods_i.tlbrSrchUrl - hxxp://start.funmoods.com/results.php?f=3&a=make&q=
FF - user.js: extensions.funmoods_i.id - 90911d57000000000000001a7342fff6
FF - user.js: extensions.funmoods_i.instlDay - 15372
FF - user.js: extensions.funmoods_i.vrsn - 1.5.11.16
FF - user.js: extensions.funmoods_i.vrsni - 1.5.11.16
FF - user.js: extensions.funmoods_i.vrsnTs - 1.5.11.1617:24
FF - user.js: extensions.funmoods_i.prtnrId - funmoods
FF - user.js: extensions.funmoods_i.prdct - funmoods
FF - user.js: extensions.funmoods_i.aflt - make
FF - user.js: extensions.funmoods_i.smplGrp - none
FF - user.js: extensions.funmoods_i.tlbrId - base
FF - user.js: extensions.funmoods_i.instlRef -
FF - user.js: extensions.funmoods_i.dfltLng -
FF - user.js: extensions.funmoods_i.excTlbr - false
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKLM-Run-cfFncEnabler.exe - cfFncEnabler.exe
MSConfigStartUp-Adobe Reader Speed Launcher - c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe
MSConfigStartUp-WinampAgent - c:\program files\Winamp\winampa.exe
AddRemove-AOL Toolbar 4.0 - c:\program files\AOL\AOL Toolbar 4.0\uninstall.exe
AddRemove-DivX Setup.divx.com - c:\programdata\DivX\Setup\DivXSetup.exe
AddRemove-softonic-de3 Toolbar - c:\progra~1\SOFTON~1\UNWISE.EXE
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2012-03-12 20:49
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Zeit der Fertigstellung: 2012-03-12  20:53:42
ComboFix-quarantined-files.txt  2012-03-12 19:53
.
Vor Suchlauf: 10 Verzeichnis(se), 26.457.956.352 Bytes frei
Nach Suchlauf: 14 Verzeichnis(se), 26.397.908.992 Bytes frei
.
- - End Of File - - A29FEE5D9FD5254B617CC2A265A6D4B3
--- --- ---
[COMOFIX Scan]

cosinus 12.03.2012 21:13
Ja morgen kanns weiter gehen :pfeiff:

disteffensso 13.03.2012 17:42
Hi Arne,

gehts gut?

Schönen Gruß
vonStefan.

cosinus 13.03.2012 17:44
Danke für den Reminder :D geht sofort weiter! ;)

Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe - (aswMBR.exe Anleitung)
    Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
    Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS-Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).

disteffensso 14.03.2012 09:04
Habe gestern auf eine email gewartet. Daher nicht mehr reagiert. Der Rechner sprang nachts von standby aus alleine an.
GMER ging nicht.

Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 08:56:35 on 14.03.2012

OS: Windows Vista Business Edition Service Pack 2 (Build 6002), 32-bit
Default Browser: Google Inc. Google Chrome 17.0.963.79

Scanner Settings
Rootkits detection (hidden registry)
Rootkits detection (hidden files)
Retrieve files information
Check Microsoft signatures

Filters
Trusted entries
Empty entries
Hidden registry entries (rootkit activity)
Exclusively opened files
Not found files
Files without detailed information
Existing files
Non-startable services
Non-startable drivers
Active entries
Disabled entries

        Risk        Name        Publisher        Full Path        Status
Common
%SystemRoot%\Tasks
        ||||          "GoogleUpdateTaskMachineCore.job"        "Google Inc."        C:\Program Files\Google\Update\GoogleUpdate.exe        File exists
        ||||          "GoogleUpdateTaskMachineUA.job"        "Google Inc."        C:\Program Files\Google\Update\GoogleUpdate.exe        File exists
        ||||          "Google Software Updater.job"        "Google"        C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe        File exists
Control Panel Objects
%SystemRoot%\system32
                      "FlashPlayerCPLApp.cpl"        "Adobe Systems Incorporated"        C:\Windows\system32\FlashPlayerCPLApp.cpl        File exists
        ||||||        "TOSCDSPD.cpl"        "TOSHIBA"        C:\Windows\system32\TOSCDSPD.cpl        File exists
HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls
        ||||||        "QuickTime"        "Apple Inc."        C:\Program Files\QuickTime\QTSystem\QuickTime.cpl        File exists
Drivers
HKLM\SYSTEM\CurrentControlSet\Services
        ||||||        "avfwot" (avfwot)        "Avira GmbH"        C:\Windows\System32\DRIVERS\avfwot.sys        File exists
        ||||||        "avgntflt" (avgntflt)        "Avira GmbH"        C:\Windows\System32\DRIVERS\avgntflt.sys        File exists
        ||||||        "avipbb" (avipbb)        "Avira GmbH"        C:\Windows\System32\DRIVERS\avipbb.sys        File exists
        ||||||        "avkmgr" (avkmgr)        "Avira GmbH"        C:\Windows\System32\DRIVERS\avkmgr.sys        File exists
                      "catchme" (catchme)                C:\Users\stefan\AppData\Local\Temp\catchme.sys        File not found
                      "esgiguard" (esgiguard)                C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys        File not found
                      "IP in IP Tunnel Driver" (IpInIp)                C:\Windows\System32\DRIVERS\ipinip.sys        File not found
                      "IPX Traffic Filter Driver" (NwlnkFlt)                C:\Windows\System32\DRIVERS\nwlnkflt.sys        File not found
                      "IPX Traffic Forwarder Driver" (NwlnkFwd)                C:\Windows\System32\DRIVERS\nwlnkfwd.sys        File not found
        ||||||        "PxHelp20" (PxHelp20)        "Sonic Solutions"        C:\Windows\System32\Drivers\PxHelp20.sys        File exists
        ||||||        "ssmdrv" (ssmdrv)        "Avira GmbH"        C:\Windows\System32\DRIVERS\ssmdrv.sys        File exists
Explorer
HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
        ||||||        {BDEADF00-C265-11d0-BCED-00A0C90AB50F} "Webordner"        "Microsoft Corporation"        C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL        File exists
HKLM\Software\Classes\Folder\shellex\ColumnHandlers
        ||||||        {F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension"        "Adobe Systems, Inc."        C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll        File exists
HKLM\Software\Classes\Protocols\Handler
                      {5513F07E-936B-4E52-9B00-067394E91CC5} "McAfee SACore Protocol Handler"                c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll        File not found
                      {5513F07E-936B-4E52-9B00-067394E91CC5} "McAfee SACore Protocol Handler"                c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll        File not found
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
                      {911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files"                        File not found | COM-object registry key not found
        ||||||        {23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension"        "Igor Pavlov"        C:\Program Files\7-Zip\7-zip.dll        File exists
                      {1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder"                        File not found | COM-object registry key not found
                      {34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder"                        File not found | COM-object registry key not found
                      {0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder"                        File not found | COM-object registry key not found
                      {2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band"                        File not found | COM-object registry key not found
                      {FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist"                        File not found | COM-object registry key not found
                      {B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes"        "Apple Inc."        C:\Program Files\iTunes\iTunesMiniPlayer.dll        File exists
        ||||||        {993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler"        "Microsoft Corporation"        C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll        File exists
        ||||||        {C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler"        "Microsoft Corporation"        C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll        File exists
        ||||||        {F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} "RealOne Player Context Menu Class"        "RealNetworks, Inc."        c:\program files\real\realplayer\rpshell.dll        File exists
                      {C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder"                        File not found | COM-object registry key not found
                      {E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder"                        File not found | COM-object registry key not found
                      {45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning"        "Avira Operations GmbH & Co. KG"        C:\Program Files\Avira\AntiVir Desktop\shlext.dll        File exists
                      {da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service"                        File not found | COM-object registry key not found
Internet Explorer
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser
                      ITBar7Height "ITBar7Height"                        File not found | COM-object registry key not found
                      "ITBar7Layout"                        File not found | COM-object registry key not found
HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units
        ||||          {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_29"
hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab        "Sun Microsystems, Inc."        C:\Program Files\Java\jre6\bin\npjpi160_29.dll        File exists
                      {E2883E8F-472F-4FB0-9522-AC9BF37916A7} "{E2883E8F-472F-4FB0-9522-AC9BF37916A7}"
hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab                        File not found | COM-object registry key not found
HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions
                      "Amazon.de"                hxxp://www.amazon.de/exec/obidos/redirect-home?tag=Toshibadebholink-21&site=home        HTTP value
                      {DE9C389F-3316-41A7-809B-AA305ED9D922} "AOL Toolbar"                        File not found | COM-object registry key not found
                      "eBay - Der weltweite Online Marktplatz"                hxxp://rover.ebay.com/rover/1/707-44556-9400-3/4        HTTP value
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
        ||||||        {18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper"        "Adobe Systems Incorporated"        C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll        File exists
        ||||          {DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper"        "Sun Microsystems, Inc."        C:\Program Files\Java\jre6\bin\jp2ssv.dll        File exists
Logon
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup
        ||||||        "desktop.ini"                C:\Users\stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini        File exists
%AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup
        ||||||        "desktop.ini"                C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini        File exists
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
                      "ApplePhotoStreams"        "Apple Inc."        C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe        File exists
                      "iCloudServices"        "Apple Inc."        C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe        File exists
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
        ||||          "Adobe ARM"        "Adobe Systems Incorporated"        "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"        File exists
                      "AppleSyncNotifier"        "Apple Inc."        C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe        File exists
        ||||          "APSDaemon"        "Apple Inc."        "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"        File exists
                      "avgnt"        "Avira Operations GmbH & Co. KG"        "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min        File exists
        ||||          "Camera Assistant Software"        "Chicony"        "C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe" /start        File exists
                      "iTunesHelper"        "Apple Inc."        "C:\Program Files\iTunes\iTunesHelper.exe"        File exists
        ||||          "MobileConnect"        "Vodafone"        %programfiles%\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe /silent        File exists
                      "NDSTray.exe"                NDSTray.exe        File not found
        ||||||        "PCTools FGuard"        "Threat Expert Ltd."        C:\Program Files\PC Tools Security\BDT\FGuard.exe        File exists
        ||||          "QuickTime Task"        "Apple Inc."        "C:\Program Files\QuickTime\QTTask.exe" -atboottime        File exists
        ||||          "SunJavaUpdateSched"        "Sun Microsystems, Inc."        "C:\Program Files\Common Files\Java\Java Update\jusched.exe"        File exists
        ||||          "TkBellExe"        "RealNetworks, Inc."        "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot        File exists
        ||||          "topi"        "TOSHIBA"        C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe -startup        File exists
        ||||          "Toshiba TEMPRO"        "Toshiba Europe GmbH"        C:\Program Files\Toshiba TEMPRO\TemproTray.exe        File exists
Services
HKLM\SYSTEM\CurrentControlSet\Services
        ||||||        "@C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100" (WPFFontCache_v0400)        "Microsoft Corporation"        C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe        File exists
        ||            "Adobe Acrobat Update Service" (AdobeARMservice)        "Adobe Systems Incorporated"        C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe        File exists
        ||||||        "Apple Mobile Device" (Apple Mobile Device)        "Apple Inc."        C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe        File exists
                      "Avira Browser Schutz" (AntiVirWebService)        "Avira Operations GmbH & Co. KG"        C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE        File exists
                      "Avira Echtzeit Scanner" (AntiVirService)        "Avira Operations GmbH & Co. KG"        C:\Program Files\Avira\AntiVir Desktop\avguard.exe        File exists
                      "Avira Email Schutz" (AntiVirMailService)        "Avira Operations GmbH & Co. KG"        C:\Program Files\Avira\AntiVir Desktop\avmailc.exe        File exists
                      "Avira FireWall" (AntiVirFirewallService)        "Avira Operations GmbH & Co. KG"        C:\Program Files\Avira\AntiVir Desktop\avfwsvc.exe        File exists
                      "Avira Planer" (AntiVirSchedulerService)        "Avira Operations GmbH & Co. KG"        C:\Program Files\Avira\AntiVir Desktop\sched.exe        File exists
        ||||||        "Browser Defender Update Service" (Browser Defender Update Service)        "Threat Expert Ltd."        C:\Program Files\PC Tools Security\BDT\BDTUpdateService.exe        File exists
        ||||||        "ConfigFree Service" (ConfigFree Service)        "TOSHIBA CORPORATION"        C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe        File exists
        ||||||        "Dienst "Bonjour"" (Bonjour Service)        "Apple Inc."        C:\Program Files\Bonjour\mDNSResponder.exe        File exists
                      "Freemake Improver" (Freemake Improver)        "Freemake"        C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe        File exists
        ||||          "Google Software Updater" (gusvc)        "Google"        C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe        File exists
        ||||          "Google Update Service (gupdate)" (gupdate)        "Google Inc."        C:\Program Files\Google\Update\GoogleUpdate.exe        File exists
        ||||          "Google Update-Dienst (gupdatem)" (gupdatem)        "Google Inc."        C:\Program Files\Google\Update\GoogleUpdate.exe        File exists
        ||||||        "HP CUE DeviceDiscovery Service" (hpqddsvc)        "Hewlett-Packard Co."        C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll        File exists
        ||||||        "hpqcxs08" (hpqcxs08)        "Hewlett-Packard Co."        C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll        File exists
        ||||||        "iPod-Dienst" (iPod Service)        "Apple Inc."        C:\Program Files\iPod\bin\iPodService.exe        File exists
                      "McAfee SiteAdvisor Service" (McAfee SiteAdvisor Service)        "McAfee, Inc."        C:\Program Files\McAfee\SiteAdvisor\McSACore.exe        File exists
        ||||||        "Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32)        "Microsoft Corporation"        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe        File exists
        ||||||        "Net Driver HPZ12" (Net Driver HPZ12)        "Hewlett-Packard"        C:\Windows\system32\HPZinw12.dll        File exists
        ||||||        "Notebook Performance Tuning Service (TEMPRO)" (TemproMonitoringService)        "Toshiba Europe GmbH"        C:\Program Files\Toshiba TEMPRO\TemproSvc.exe        File exists
        ||||||        "Pml Driver HPZ12" (Pml Driver HPZ12)        "Hewlett-Packard"        C:\Windows\system32\HPZipm12.dll        File exists
        ||||||        "SmartFaceVWatchSrv" (SmartFaceVWatchSrv)        "Toshiba"        C:\Program Files\TOSHIBA\SmartFaceV\SmartFaceVWatchSrv.exe        File exists
        ||||||        "TGCM_ImportWiFiSvc" (TGCM_ImportWiFiSvc)        "Telefónica I+D"        C:\Program Files\o2\Mobile Connection Manager\ImpWiFiSvc.exe        File exists
Winsock Providers
HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries
        ||||||        "mdnsNSP"        "Apple Inc."        C:\Program Files\Bonjour\mdnsNSP.dll        File exists
HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries
                      "AVSDA"        "Avira Operations GmbH & Co. KG"        C:\Program Files\Avira\AntiVir Desktop\avsda.dll        File exists
If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

disteffensso 14.03.2012 12:16
Hi Arne,

Code:
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-03-14 09:07:41
-----------------------------
09:07:41.938    OS Version: Windows 6.0.6002 Service Pack 2
09:07:41.938    Number of processors: 2 586 0xF0D
09:07:41.954    ComputerName: STEFANS-PC  UserName: stefan
09:08:05.434    Initialize success
09:15:36.471    AVAST engine defs: 12031301
09:16:12.524    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
09:16:12.524    Disk 0 Vendor: WDC_WD25 01.0 Size: 238475MB BusType: 3
09:16:12.539    Disk 0 MBR read successfully
09:16:12.555    Disk 0 MBR scan
09:16:12.633    Disk 0 Windows VISTA default MBR code
09:16:12.648    Disk 0 Partition 1 00    27 Hidden NTFS WinRE NTFS        1500 MB offset 2048
09:16:12.680    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS NTFS      119000 MB offset 3074048
09:16:12.695    Disk 0 Partition 3 00    07    HPFS/NTFS NTFS      117973 MB offset 246786048
09:16:12.711    Disk 0 scanning sectors +488394752
09:16:12.789    Disk 0 scanning C:\Windows\system32\drivers
09:16:28.155    Service scanning
09:16:58.186    Modules scanning
09:17:03.583    Disk 0 trace - called modules:
09:17:03.615    ntkrnlpa.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll
09:17:03.630    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86503478]
09:17:03.630    3 CLASSPNP.SYS[883118b3] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0x85536028]
09:17:05.409    AVAST engine scan C:\Windows
09:17:19.964    AVAST engine scan C:\Windows\system32
09:23:54.118    AVAST engine scan C:\Windows\system32\drivers
09:24:19.452    AVAST engine scan C:\Users\stefan
09:45:23.651    AVAST engine scan C:\ProgramData
09:47:03.507    Scan finished successfully
12:10:32.415    Disk 0 MBR has been saved successfully to "C:\Users\stefan\Documents\Documents\MBR.dat"
12:10:32.415    The log file has been saved successfully to "C:\Users\stefan\Documents\Documents\aswMBR.txt"
12:11:42.157    Disk 0 MBR has been saved successfully to "C:\Users\stefan\Documents\Documents\MBR.dat"
12:11:42.173    The log file has been saved successfully to "C:\Users\stefan\Documents\Documents\aswMBR.txt"
12:11:58.599    Disk 0 MBR has been saved successfully to "C:\Users\stefan\Desktop\MBR.dat"
12:11:58.864    The log file has been saved successfully to "C:\Users\stefan\Desktop\aswMBR.txt"
Gruß
vonStefan.

cosinus 14.03.2012 15:27
Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

disteffensso 14.03.2012 19:42
Arne,
ich könnt´ Dich abknutschen.
Zumal alle Superschlaumeier genau wußten, daß das nur mit Format C:\ geht. HA! Großartiger Mann, Bastard Operator from Hell!

Code:
Malwarebytes Anti-Malware 1.60.1.1000
www.malwarebytes.org

Datenbank Version: v2012.03.14.02

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
stefan :: STEFANS-PC [Administrator]

14.03.2012 16:01:16
mbam-log-2012-03-14 (16-01-16).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 468428
Laufzeit: 3 Stunde(n), 31 Minute(n), 13 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
Gruß
vonStefan

PS:SaS- Scan folgt.

cosinus 14.03.2012 21:22
Bitte achte auf die CODE-Tags! Ich musste das jetzt schon zum dritten Mal bei dir korrigieren!

disteffensso 15.03.2012 04:59
Ich setze 2 eckige Klammern und schreibe code hinein.
Am Schluß mache ich das Gleiche und schreibe den Scannamen ´rein.
Mir ist der Fehler nicht klar. Oder soll am Schluß nur Klammern/code stehen und das mit dem Text "CustomScan" war eine Ausnahme?

Soll ich "remove Threads" klicken?

Gruß
von Stefan.

cosinus 15.03.2012 05:01
Zitat:
Am Schluß mache ich das Gleiche und schreibe den Scannamen ´rein.
Genau das ist falsch. Wo du das her hast ist für mich nicht zu erklären :balla:

disteffensso 15.03.2012 05:44
SAS- Log, ich habs gezippt, aber es läßt sich nicht hochladen. Entpacken am Rechner geht.

Gruß

vonStefan.

disteffensso 15.03.2012 06:12
Vielleicht darf ichs ausnahmsweise auf 2 x hier posten?

Gruß
vonStefan


Alle Zeitangaben in WEZ +1. Es ist jetzt 22:48 Uhr.
Seite 3 von 5 12 3 45
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58