Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   mystart incredibar lässt sich nicht aus Firefox beseitigen (https://www.trojaner-board.de/123988-mystart-incredibar-laesst-firefox-beseitigen.html)

Hillbilli 12.09.2012 20:45
mystart incredibar lässt sich nicht aus Firefox beseitigen
 
Guten Abend,

auch ich habe mir leider mystart incredibar eingefangen.

Habe verschiedene Malware-Programme drüberlaufen lassen, aber z.B. Malwarebytes findet mittlerweile nichts mehr bzw. hat noch nie was befunden.

Bestehendes Problem: Öffne neuen Tab in Firefox und die oben genannte Seite öffnet sich. Einzige Abhilfe momentan ist about:config in Firefox und die 2 Ergebnisse diesbezüglich zurückzustellen. Nach ein paar neuen Tabs ist's wieder da.

Würde mich sehr über Hilfe freuen. Habe soeben OTl laufen lassen und könnte das Ergebnis posten.

Danke im Voraus!

cosinus 14.09.2012 21:46
Ohne die Logs von Malwarebytes und Co wird das hier nichts. :glaskugel:
Alles von Malwarebytes (und evtl. anderen Scannern) muss hier gepostet werden.

Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log

Hillbilli 15.09.2012 11:34
Danke schonmal für's meiner Annehmen!

Werde die Programme durchlaufen lassen und die Ergebnisse anschließend posten.

Mit freundlichem Gruß

Code:
Malwarebytes Anti-Malware (Test) 1.65.0.1400
www.malwarebytes.org

Datenbank Version: v2012.09.15.05

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 7.0.5730.11
Hillbilli :: COMPUTER [Administrator]

Schutz: Aktiviert

15.09.2012 21:24:56
mbam-log-2012-09-15 (21-24-56).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 365023
Laufzeit: 2 Stunde(n), 10 Minute(n), 31 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
Das ist mal Malwarebytes!

Code:
OTL Extras logfile created on: 12.09.2012 21:22:41 - Run 3
OTL by OldTimer - Version 3.2.61.3    Folder = C:\Dokumente und Einstellungen\Hillbilli\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,28 Gb Available Physical Memory | 64,07% Memory free
3,85 Gb Paging File | 3,21 Gb Available in Paging File | 83,47% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 48,83 Gb Total Space | 2,35 Gb Free Space | 4,81% Space Free | Partition Type: NTFS
Drive D: | 97,65 Gb Total Space | 7,25 Gb Free Space | 7,43% Space Free | Partition Type: NTFS
Drive E: | 86,39 Gb Total Space | 3,55 Gb Free Space | 4,11% Space Free | Partition Type: NTFS
 
Computer Name: COMPUTER | User Name: Hillbilli | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l
 
[HKEY_USERS\S-1-5-21-1659004503-1425521274-839522115-1003\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [CEWE FOTOSCHAU] -- "C:\Dokumente und Einstellungen\Hillbilli\Desktop\Vision Board\dm-Fotowelt\CEWE FOTOSCHAU.exe" -d "%1"
Directory [cmd] -- cmd.exe /k cd "%L" (Microsoft Corporation)
Directory [dm-Fotowelt] -- "C:\Dokumente und Einstellungen\Hillbilli\Desktop\Vision Board\dm-Fotowelt\dm-Fotowelt.exe" "%1"
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Mein CEWE FOTOBUCH] -- "C:\Programme\CEWE COLOR\Mein CEWE FOTOBUCH\Mein CEWE FOTOBUCH.exe" "%1" ()
Directory [PlayWithVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"UpdatesDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"5222:TCP" = 5222:TCP:*:Enabled:QUAKE!!!!
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\Google\Google Earth\client\googleearth.exe" = C:\Programme\Google\Google Earth\client\googleearth.exe:*:Enabled:Google Earth -- (Google)
"C:\Programme\RadioRipper\RadioRipper.exe" = C:\Programme\RadioRipper\RadioRipper.exe:*:Enabled:RadioRipper -- ( )
"D:\Quake wars\etqw.exe" = D:\Quake wars\etqw.exe:*:Enabled:Enemy Territory - QUAKE Wars(TM) -- (Splash Damage, Ltd.)
"D:\Quake wars\etqwded.exe" = D:\Quake wars\etqwded.exe:*:Enabled:etqwded.exe -- (Splash Damage, Ltd.)
"D:\Need for Speed\Hot Pursuit\Launcher.exe" = D:\Need for Speed\Hot Pursuit\Launcher.exe:*:Enabled:Need for Speed(TM) Hot Pursuit -- (Electronic Arts)
"D:\Need for Speed\Hot Pursuit\NFS11.exe" = D:\Need for Speed\Hot Pursuit\NFS11.exe:*:Enabled:Need for Speed(TM) Hot Pursuit Application -- (Electronic Arts)
"C:\Programme\VideoLAN\VLC\vlc.exe" = C:\Programme\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player -- ()
"D:\Orbit\orbitdm.exe" = D:\Orbit\orbitdm.exe:*:Enabled:Orbit -- (Orbitdownloader.com)
"D:\Orbit\orbitnet.exe" = D:\Orbit\orbitnet.exe:*:Enabled:Orbit -- (Orbitdownloader.com)
"C:\Programme\Mozilla Firefox\firefox.exe" = C:\Programme\Mozilla Firefox\firefox.exe:*:Enabled:Firefox -- (Mozilla Corporation)
"C:\Programme\SiSoftware\SiSoftware Sandra Lite 2011.SP4c\RpcAgentSrv.exe" = C:\Programme\SiSoftware\SiSoftware Sandra Lite 2011.SP4c\RpcAgentSrv.exe:*:Enabled:SiSoftware Deployment Agent Service -- (SiSoftware)
"C:\Programme\SiSoftware\SiSoftware Sandra Lite 2011.SP4c\WNt500x86\RpcSandraSrv.exe" = C:\Programme\SiSoftware\SiSoftware Sandra Lite 2011.SP4c\WNt500x86\RpcSandraSrv.exe:*:Enabled:SiSoftware Sandra Agent Service -- (SiSoftware)
"C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\WebKit2WebProcess.exe" = C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\WebKit2WebProcess.exe:*:Enabled:WebKit -- (Apple Inc.)
"C:\Programme\Steam\SteamApps\common\fear2\FEAR2.exe" = C:\Programme\Steam\SteamApps\common\fear2\FEAR2.exe:*:Enabled:F.E.A.R. 2: Project Origin -- (Monolith Productions, Inc.)
"C:\Programme\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe" = C:\Programme\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe:*:Enabled:Daemonu.exe -- (NVIDIA Corporation)
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{0819E89D-6214-4B6F-A18D-4633CB4E0E4A}" = Softwareupdate für Webordner
"{1545207E-C6F3-31D7-9918-BDBB65075FBF}" = Microsoft .NET Framework 3.5 Language Pack - deu
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{21FFDD40-F6B9-4609-B1C9-514E0A342BFA}" = MOUSE Editor
"{26A24AE4-039D-4CA4-87B4-2F83217007FF}" = Java 7 Update 7
"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3CD4C30E-BD82-4592-B64A-8AD9784ECA9F}" = BMWi-Softwarepaket 10
"{43E39830-1826-415D-8BAE-86845787B54B}" = Nero Vision
"{49FC50FC-F965-40D9-89B4-CBFF80941031}" = Windows Movie Maker 2.0
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4D43D635-6FDA-4FA5-AA9B-23CF73D058EA}" = Nero StartSmart OEM
"{4EAE665D-957A-4D04-9679-3AD582008877}" = NVIDIA PhysX
"{525BA381-389C-4975-BDD3-C36DCF66D5BD}" = BMWi Updater
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{595A3116-40BB-4E0F-A2E8-D7951DA56270}" = NeroExpress
"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth
"{5D9BE3C1-8BA4-4E7E-82FD-9F74FA6815D1}" = Nero Vision Help
"{5e2f4cce-8d79-4c6e-a7a0-86982b43d2ed}" = Nero 9 Essentials
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{62AC81F6-BDD3-4110-9D36-3E9EAAB40999}" = Nero CoverDesigner
"{6A3F9D74-BB80-4451-8CA1-4B3A857F1359}" = Apple Application Support
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79846AA4-622E-5B48-18B2-02F53F423DFE}" = BMWi-Businessplaner Fuehren
"{7C7F30F4-94E7-4AA8-8941-90C4A80C68BF}" = NVIDIA nTune
"{7E20EFE6-E604-48C6-8B39-BA4742F2CDB4}" = Zune Desktop Theme
"{7EC9E7A1-A576-43C8-9CBB-31BD5625EBCA}" = Fox LiveUpdate
"{83202942-84B3-4C50-8622-B8C0AA2D2885}" = Nero Express Help
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83A606F5-BF6F-42ED-9F33-B9F74297CDED}" = Need for Speed(TM) Hot Pursuit
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{9309DD7E-EBFE-3C95-8B47-30D3A012F606}" = Microsoft .NET Framework 2.0 Service Pack 1 Language Pack - DEU
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9D134213-C5F4-4D55-9E36-FEB4C12FD27A}" = PC-Trainer Kfz-Technik
"{9FD6F1A8-5550-46AF-8509-271DF0E768B5}" = Dual-Core Optimizer
"{A1071AEB-B0EF-3F5F-BC84-83A270EBE496}" = Microsoft .NET Framework 3.0 Service Pack 1 Language Pack - DEU
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A498D9EB-927B-459B-85D6-DD6EF8C2C564}" = erLT
"{A5355F15-F98B-4704-9BAE-E53B9FE48F48}" = SDFormatter
"{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}" = ImagXpress
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.4) - Deutsch
"{B2EC4A38-B545-4A00-8214-13FE0E915E6D}" = Advertising Center
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 295.73
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 295.73
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NView" = NVIDIA nView 136.18
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.12.0209
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.7.11
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B78120A0-CF84-4366-A393-4D0A59BC546C}" = Menu Templates - Starter Kit
"{B7A585C8-CE4E-4150-84C6-A13C3CB1379F}" = Enemy Territory - Quake Wars(TM)
"{B93DCF58-AA57-41EC-8D69-B05C66C6312D}_is1" = SUPER © v2011.build.47 (March 12, 2011) Version v2011.build.47
"{BD5CA0DA-71AD-43DA-B19E-6EEE0C9ADC9A}" = Nero ControlCenter
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C3113E55-7BCB-4de3-8EBF-60E6CE6B2296}_is1" = SiSoftware Sandra Lite 2011.SP4c
"{C81A2FE0-3574-00A9-CED4-BDAA334CBE8E}" = Nero Online Upgrade
"{C9E14402-3631-4182-B377-6B0DFB1C0339}" = QuickTime
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{E24242E3-A4FF-FC3C-05F2-C83A9C821971}" = BMWi-Businessplaner Gruenden
"{E498385E-1C51-459A-B45F-1721E37AA1A0}" = Movie Templates - Starter Kit
"{E59113EB-0285-4BFD-A37A-B79EAC6B8F4B}" = Microsoft SQL Server Compact 3.5 SP1 English
"{E8A80433-302B-4FF1-815D-FCC8EAC482FF}" = Nero Installer
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F4041DCE-3FE1-4E18-8A9E-9DE65231EE36}" = Nero ControlCenter
"{FA66CFD7-0977-4C45-AACD-A8BB994B1A05}" = Quake Live Mozilla Plugin
"{FBCDFD61-7DCF-4E71-9226-873BA0053139}" = Nero InfoTool
"{FE23D063-934D-4829-A0D8-00634CE79B4A}" = Adobe AIR
"7-Zip" = 7-Zip 4.65
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"Audacity_is1" = Audacity 1.2.6
"Avira AntiVir Desktop" = Avira Free Antivirus
"BMWi Updater" = BMWi Updater
"BMWiBusinessplanerFuehren" = BMWi-Businessplaner Fuehren
"BMWiBusinessplanerGruenden" = BMWi-Businessplaner Gruenden
"BMWi-Softwarepaket 10" = BMWi-Softwarepaket 10
"CCleaner" = CCleaner
"ClassicPro" = ClassicPro© v1.14
"DivX Setup" = DivX-Setup
"EADM" = EA Download Manager
"EPSON Printer and Utilities" = EPSON-Drucker-Software
"EPSON Scanner" = EPSON Scan
"ESET Online Scanner" = ESET Online Scanner v3
"FileZilla Client" = FileZilla Client 3.5.3
"Free Studio_is1" = Free Studio version 5.6.1.608
"InstallShield_{21FFDD40-F6B9-4609-B1C9-514E0A342BFA}" = MOUSE Editor
"InstallShield_{7C7F30F4-94E7-4AA8-8941-90C4A80C68BF}" = NVIDIA nTune
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.65.0.1400
"Mein CEWE FOTOBUCH" = Mein CEWE FOTOBUCH
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 Language Pack - deu" = Microsoft .NET Framework 3.5 Language Pack - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mozilla Firefox 15.0.1 (x86 de)" = Mozilla Firefox 15.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"nfsSky01 New Free Screensaver_is1" = NewFreeScreensaver nfsSky01
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"OpenAL" = OpenAL
"Orbit_is1" = Orbit Downloader
"Picasa 3" = Picasa 3
"PunkBusterSvc" = PunkBuster Services
"QLPrism" = QLPrism
"RealPlayer 15.0" = RealPlayer
"SpeedFan" = SpeedFan (remove only)
"Steam App 16450" = F.E.A.R. 2: Project Origin
"VLC media player" = VLC media player 2.0.2
"VSO DivxToDVD_is1" = DivxToDVD 0.5.2
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"WIC" = Windows Imaging Component
"Winamp" = Winamp
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinGimp-2.0_is1" = GIMP 2.6.10
"Xilisoft HD Video Converter" = Xilisoft HD Video Converter
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
"Xvid_is1" = Xvid 1.1.3 final uninstall
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-1659004503-1425521274-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{EE20E438-B675-4421-AB07-928F0EC9FB22}_is1" = Albelli Fotobücher
"Google Chrome" = Google Chrome
"RadioRipper" = RadioRipper 1.1d BETA5
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 15.02.2012 09:56:12 | Computer Name = COMPUTER | Source = .NET Runtime Optimization Service | ID = 1103
Description = .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32)
 - Tried to start a service that wasn't the latest version of CLR Optimization service.
 Will shutdown
 
Error - 11.04.2012 02:33:06 | Computer Name = COMPUTER | Source = .NET Runtime Optimization Service | ID = 1103
Description = .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32)
 - Tried to start a service that wasn't the latest version of CLR Optimization service.
 Will shutdown
 
Error - 08.05.2012 14:08:55 | Computer Name = COMPUTER | Source = crypt32 | ID = 131083
Description = Die Extrahierung der Drittanbieterstammlisten aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
 ist fehlgeschlagen mit dem Fehler: Ein erforderliches Zertifikat befindet sich
nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel
 in der signierten Datei.  .
 
Error - 08.05.2012 14:08:55 | Computer Name = COMPUTER | Source = crypt32 | ID = 131083
Description = Die Extrahierung der Drittanbieterstammlisten aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
 ist fehlgeschlagen mit dem Fehler: Ein erforderliches Zertifikat befindet sich
nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel
 in der signierten Datei.  .
 
Error - 12.05.2012 09:18:05 | Computer Name = COMPUTER | Source = .NET Runtime Optimization Service | ID = 1103
Description = .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32)
 - Tried to start a service that wasn't the latest version of CLR Optimization service.
 Will shutdown
 
Error - 13.06.2012 14:36:38 | Computer Name = COMPUTER | Source = .NET Runtime Optimization Service | ID = 1103
Description = .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32)
 - Tried to start a service that wasn't the latest version of CLR Optimization service.
 Will shutdown
 
[ System Events ]
Error - 09.09.2012 07:05:06 | Computer Name = COMPUTER | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1058" aufgetreten, als der Dienst "helpsvc"
 mit den Argumenten ""  gestartet wurde, um den folgenden Server zu verwenden:  {833E4010-AFF7-4AC3-AAC2-9F24C1457BCE}
 
Error - 09.09.2012 14:52:31 | Computer Name = COMPUTER | Source = Print | ID = 23
Description = Der Drucker Lexmark T420,0 konnte nicht initialisiert werden, da der
 Treiber Lexmark T420 nicht gefunden wurde.
 
Error - 09.09.2012 14:53:48 | Computer Name = COMPUTER | Source = DCOM | ID = 10010
Description = Der Server "{4EB61BAC-A3B6-4760-9581-655041EF4D69}" konnte innerhalb
 des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
 
Error - 09.09.2012 16:48:25 | Computer Name = COMPUTER | Source = Print | ID = 23
Description = Der Drucker Lexmark T420,0 konnte nicht initialisiert werden, da der
 Treiber Lexmark T420 nicht gefunden wurde.
 
Error - 10.09.2012 12:42:32 | Computer Name = COMPUTER | Source = Print | ID = 23
Description = Der Drucker Lexmark T420,0 konnte nicht initialisiert werden, da der
 Treiber Lexmark T420 nicht gefunden wurde.
 
Error - 10.09.2012 12:43:42 | Computer Name = COMPUTER | Source = DCOM | ID = 10010
Description = Der Server "{4EB61BAC-A3B6-4760-9581-655041EF4D69}" konnte innerhalb
 des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
 
Error - 10.09.2012 12:53:26 | Computer Name = COMPUTER | Source = Print | ID = 23
Description = Der Drucker Lexmark T420,0 konnte nicht initialisiert werden, da der
 Treiber Lexmark T420 nicht gefunden wurde.
 
Error - 11.09.2012 12:32:28 | Computer Name = COMPUTER | Source = Print | ID = 23
Description = Der Drucker Lexmark T420,0 konnte nicht initialisiert werden, da der
 Treiber Lexmark T420 nicht gefunden wurde.
 
Error - 11.09.2012 12:56:17 | Computer Name = COMPUTER | Source = Print | ID = 23
Description = Der Drucker Lexmark T420,0 konnte nicht initialisiert werden, da der
 Treiber Lexmark T420 nicht gefunden wurde.
 
Error - 12.09.2012 14:50:43 | Computer Name = COMPUTER | Source = Print | ID = 23
Description = Der Drucker Lexmark T420,0 konnte nicht initialisiert werden, da der
 Treiber Lexmark T420 nicht gefunden wurde.
 
 
< End of report >

cosinus 16.09.2012 13:59
Wieso postest du jetzt ein neues MBAM-Log?!
Was bringt mir eins ohne Funde, kann ich so sehen mit welcher Infektion wir es zu tun haben?
Bitte alle Logs posten!

Hillbilli 16.09.2012 21:32
Sagte ja im Eröffnungspost, dass Malwarebytes nie etwas gefunden hatte. Da es aber nicht ohne logs geht, sollte ich posten :wtf:

Habe Gmer laufen lassen.

Code:
GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-09-16 22:28:00
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\0000006d ST3250410AS rev.3.AAC
Running: qzgtxrfl.exe; Driver: C:\DOKUME~1\GRNERT~1\LOKALE~1\Temp\pgliqpog.sys


---- System - GMER 1.0.15 ----

SSDT  B86F973C                                                                                                  ZwClose
SSDT  B86F96F6                                                                                                  ZwCreateKey
SSDT  B86F9746                                                                                                  ZwCreateSection
SSDT  B86F96EC                                                                                                  ZwCreateThread
SSDT  B86F96FB                                                                                                  ZwDeleteKey
SSDT  B86F9705                                                                                                  ZwDeleteValueKey
SSDT  B86F9737                                                                                                  ZwDuplicateObject
SSDT  B86F970A                                                                                                  ZwLoadKey
SSDT  B86F96D8                                                                                                  ZwOpenProcess
SSDT  B86F96DD                                                                                                  ZwOpenThread
SSDT  B86F975F                                                                                                  ZwQueryValueKey
SSDT  B86F9714                                                                                                  ZwReplaceKey
SSDT  B86F9750                                                                                                  ZwRequestWaitReplyPort
SSDT  B86F970F                                                                                                  ZwRestoreKey
SSDT  B86F974B                                                                                                  ZwSetContextThread
SSDT  B86F9755                                                                                                  ZwSetSecurityObject
SSDT  B86F9700                                                                                                  ZwSetValueKey
SSDT  B86F975A                                                                                                  ZwSystemDebugControl
SSDT  \??\C:\Programme\SUPERAntiSpyware\SASKUTIL.SYS (SASKUTIL.SYS/SUPERAdBlocker.com and SUPERAntiSpyware.com)  ZwTerminateProcess [0xB45B4640]

---- Kernel code sections - GMER 1.0.15 ----

.text  C:\WINDOWS\system32\DRIVERS\nv4_mini.sys                                                                  section is writeable [0xB70C03C0, 0x95AECA, 0xE8000020]

---- User code sections - GMER 1.0.15 ----

.text  C:\Programme\Mozilla Firefox\firefox.exe[1424] ntdll.dll!LdrLoadDll                                        7C92632D 5 Bytes  JMP 011C0C00 C:\Programme\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text  C:\Programme\Mozilla Firefox\firefox.exe[1424] kernel32.dll!lstrlenW + 43                                  7C809AEC 7 Bytes  JMP 013F7B4C C:\Programme\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text  C:\Programme\Mozilla Firefox\firefox.exe[1424] kernel32.dll!MapViewOfFileEx + 6A                          7C80B9A0 7 Bytes  JMP 013F7B29 C:\Programme\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text  C:\Programme\Mozilla Firefox\firefox.exe[1424] kernel32.dll!ValidateLocale + B130                          7C844958 7 Bytes  JMP 011C3FAC C:\Programme\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text  C:\Programme\Mozilla Firefox\firefox.exe[1424] GDI32.dll!SetDIBitsToDevice + 20A                          77EF9E14 7 Bytes  JMP 013F7AAA C:\Programme\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text  C:\programme\real\realplayer\update\realsched.exe[1628] kernel32.dll!SetUnhandledExceptionFilter          7C84495D 5 Bytes  [33, C0, C2, 04, 00] {XOR EAX, EAX; RET 0x4}

---- EOF - GMER 1.0.15 ----
Hoffe, dass wenigstens das was bringt? Sorry, kenne mich mit der Materie nicht aus und weis nicht worauf es ankommt.

Klar, Funde wären toll, aber bis jetzt hat kein Programm was gefunden.

cosinus 17.09.2012 11:18
Zitat:
Sagte ja im Eröffnungspost, dass Malwarebytes nie etwas gefunden hatte.
Nö. Du hast gepostet:

Zitat:
Zitat von Hillbilli
aber z.B. Malwarebytes findet mittlerweile nichts mehr bzw. hat noch nie was befunden
Wenn es mittlerweile nichts mehr findet, dann hat es zuvor schon etwas gefunden.
Was denn nun? :confused:
Etwas widersprüchliche Angaben, hat es also nun nie etwas gefunden?

Hillbilli 17.09.2012 19:58
Entschuldige, stimmt. Meinte, dass die Anderen zwar was gefunden hatten, aber Malwarebytes noch nie.
Die anderen Programme, Esnet z.B. hatten zwar was gefunden, aber ich kann da kein Log finden.

cosinus 18.09.2012 14:42
Meinst du den Online-Scanner von ESET?
Das sollte hier zu finden sein:

Code:
"%PROGRAMFILES%\Eset\Eset Online Scanner\log.txt"
Hinweis: Falls du ein 64-Bit-Windows einsetzt, lautet der Pfad so:

Code:
"%PROGRAMFILES(X86)%\Eset\Eset Online Scanner\log.txt"
Poste nun den Inhalt der log.txt.

Hillbilli 18.09.2012 17:41
Gefunden :daumenhoc
Code:
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=c38dc1315d891246aff32b48fe607260
# end=stopped
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-09-09 09:06:58
# local_time=2012-09-09 11:06:58 (+0100, Westeuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=1792 16777175 100 0 27856932 27856932 0 0
# compatibility_mode=8192 67108863 100 0 103 103 0 0
# scanned=15433
# found=0
# cleaned=0
# scan_time=875
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=c38dc1315d891246aff32b48fe607260
# end=stopped
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-09-10 05:45:50
# local_time=2012-09-10 07:45:50 (+0100, Westeuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=1792 16777175 100 0 27931943 27931943 0 0
# compatibility_mode=8192 67108863 100 0 75114 75114 0 0
# scanned=4494
# found=0
# cleaned=0
# scan_time=196
ESETSmartInstaller@High as downloader log:
all ok
esets_scanner_update returned -1 esets_gle=53251
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=c38dc1315d891246aff32b48fe607260
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-09-10 08:04:57
# local_time=2012-09-10 10:04:57 (+0100, Westeuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=1792 16777175 100 0 27933964 27933964 0 0
# compatibility_mode=8192 67108863 100 0 77135 77135 0 0
# scanned=149458
# found=4
# cleaned=4
# scan_time=6522
C:\System Volume Information\_restore{22144F9A-3E84-45E5-B88A-9894ECBB6335}\RP164\A0069184.exe        a variant of Win32/Somoto.A application (cleaned by deleting - quarantined)        00000000000000000000000000000000        C
E:\Bilder\Bilder etc\Anime pics + pics + walls\Anime Wall's\Weisskreuz\schwarz.exe        Win32/Adware.Gator application (cleaned by deleting - quarantined)        00000000000000000000000000000000        C
E:\Bilder\Bilder etc\Anime pics + pics + walls\Anime Wall's\Weisskreuz\weiss-kreuz.exe        Win32/Adware.Gator application (cleaned by deleting - quarantined)        00000000000000000000000000000000        C
E:\Musik\The Killers - Hot Fuss-APS.-ESC\[PC GAME MULTILANGUAGE] Free Casino Games Simulation - fino a 500 $ gratis sul primo deposito - up to 500 $ for free on first deposit.exe        a variant of Win32/Casino application (cleaned by deleting - quarantined)        00000000000000000000000000000000        C
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=c38dc1315d891246aff32b48fe607260
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2012-09-13 08:28:45
# local_time=2012-09-13 10:28:45 (+0100, Westeuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=1792 16777175 100 0 28194660 28194660 0 0
# compatibility_mode=8192 67108863 100 0 337831 337831 0 0
# scanned=146695
# found=4
# cleaned=4
# scan_time=6454
C:\Programme_Exen\Fertig installiert\winamp5581_full_emusic-7plus_de-de.exe        Win32/OpenCandy application (cleaned by deleting - quarantined)        00000000000000000000000000000000        C
C:\System Volume Information\_restore{22144F9A-3E84-45E5-B88A-9894ECBB6335}\RP161\A0063456.exe        Win32/OpenCandy application (cleaned by deleting - quarantined)        00000000000000000000000000000000        C
C:\System Volume Information\_restore{22144F9A-3E84-45E5-B88A-9894ECBB6335}\RP161\A0063458.exe        Win32/OpenCandy application (cleaned by deleting - quarantined)        00000000000000000000000000000000        C
C:\System Volume Information\_restore{22144F9A-3E84-45E5-B88A-9894ECBB6335}\RP170\A0074234.exe        Win32/OpenCandy application (cleaned by deleting - quarantined)        00000000000000000000000000000000        C
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=c38dc1315d891246aff32b48fe607260
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-09-16 08:23:44
# local_time=2012-09-16 10:23:44 (+0100, Westeuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=1792 16777175 100 0 28410610 28410610 0 0
# compatibility_mode=8192 67108863 100 0 553781 553781 0 0
# scanned=145870
# found=0
# cleaned=0
# scan_time=6203

cosinus 19.09.2012 14:23
adwCleaner - Toolbars und ungewollte Start-/Suchseiten aufspüren

Downloade Dir bitte AdwCleaner auf deinen Desktop.

Falls der adwCleaner schon mal in der runtergeladen wurde, bitte die alte adwcleaner.exe löschen und neu runterladen!!
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Suche.
  • Nach Ende des Suchlaufs öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[Rx].txt. (x=fortlaufende Nummer)


Alle Zeitangaben in WEZ +1. Es ist jetzt 11:05 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131