Trojaner-Board
Seite 2 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Harddrive Error - Fake Trojaner (https://www.trojaner-board.de/99723-harddrive-error-fake-trojaner.html)

DaDude 31.05.2011 20:47
2. OSAM, MBRCheck folgt

OSAM Logfile:
Code:
Report of OSAM: Autorun Manager v5.0.11926.0
Online Solutions. Complex Protection for Information Systems
Saved at 21:45:55 on 31.05.2011

OS: Windows 7 Home Premium Edition (Build 7600), 32-bit
Default Browser: Opera Software Opera Internet Browser 11.11

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"DivXControlPanelApplet.cpl" - "DivX, Inc." - C:\Windows\system32\DivXControlPanelApplet.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"HP 3D DriveGuard" - "Hewlett-Packard" - C:\Program Files\Hewlett-Packard\HP 3D DriveGuard\hpaccelerometercp.CPL
"mlcfg32.cpl" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\MLCFG32.CPL
"NokiaConnectionManager" - "Nokia" - C:\PROGRA~1\Nokia\NOKIAP~1\CONNEC~1.CPL
"QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl
"SoundMAX" - "Analog Devices, Inc." - C:\Program Files\Analog Devices\SoundMAX\soundmax.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"avgio" (avgio) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avgio.sys
"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys
"az1gvk2h" (az1gvk2h) - ? - C:\Windows\system32\drivers\az1gvk2h.sys  (Hidden registry entry, rootkit activity | File not found)
"catchme" (catchme) - ? - C:\Users\Florian\AppData\Local\Temp\catchme.sys  (File not found)
"cpuz132" (cpuz132) - "Windows (R) Codename Longhorn DDK provider" - C:\Windows\system32\drivers\cpuz132_x32.sys
"HTC Device Driver" (HTCAND32) - "HTC, Corporation" - C:\Windows\System32\Drivers\ANDROIDUSB.sys
"Microsoft IntelliPoint Filter Driver" (Point32) - "Microsoft Corporation" - C:\Windows\System32\DRIVERS\point32k.sys
"RTCore32" (RTCore32) - ? - C:\Programme\RMClock\RTCore32.sys  (File found, but it contains no detailed information)
"Speichervolumes" (volsnap) - ? - C:\Windows\System32\DRIVERS\volsnap.sys  (File found, but it contains no detailed information)
"sptd" (sptd) - "Duplex Secure Ltd." - C:\Windows\System32\Drivers\sptd.sys  (File is exclusively opened, access blocked)
"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys
"VMware hcmon" (hcmon) - "VMware, Inc." - C:\Windows\system32\drivers\hcmon.sys
"VMware kbd" (vmkbd) - "VMware, Inc." - C:\Windows\system32\drivers\VMkbd.sys
"VMware Network Application Interface" (VMnetuserif) - "VMware, Inc." - C:\Windows\system32\drivers\vmnetuserif.sys
"VMware vmci" (vmci) - "VMware, Inc." - C:\Windows\system32\Drivers\vmci.sys
"VMware vmx86" (vmx86) - "VMware, Inc." - C:\Windows\system32\Drivers\vmx86.sys
"Vstor2 WS60 Virtual Storage Driver" (vstor2-ws60) - "VMware, Inc." - C:\Program Files\VMware\VMware Player\vstor2-ws60.sys

[Explorer]
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
{828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~1\WIC4A1~1\MESSEN~1\msgrapp.14.0.8117.0416.dll
{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~1\WIC4A1~1\MESSEN~1\msgrapp.14.0.8117.0416.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{D8D1CE8C-B1EB-4E95-B63B-1531BA60E992} "DivX Property Handler" - "DivX, Inc." - C:\Program Files\DivX\DivX Plus Media Foundation Components\DivXPropertyHandler.dll
{83238FAE-D346-4E12-8734-D42F7554B3E6} "DivX Thumbnail Provider" - "DivX, Inc." - C:\Program Files\DivX\DivX Plus Media Foundation Components\DivXThumbnailProvider.dll
{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Program Files\iTunes\iTunesMiniPlayer.dll
{DC70C4A5-2044-4c59-B806-DEFB9AE0DF7C} "KbLogiExt Class" - "Logitech, Inc." - C:\Program Files\Logitech\SetPoint\kbcplext.dll
{B9B9F083-2B04-452A-8691-83694AC1037B} "LogiExt Class" - "Logitech, Inc." - C:\Program Files\Logitech\SetPoint\mcplext.dll
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\msohevi.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\ONFILTER.DLL
{00020D75-0000-0000-C000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\MLSHEXT.DLL
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{416651E4-9C3C-11D9-8BDE-F66BAD1E3F3A} "Nokia Phone Browser" - "Nokia" - C:\Program Files\Nokia\Nokia PC Suite 7\PhoneBrowser.dll
{0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\OLKFSTUB.DLL
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll
{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - "Alexander Roshal" - C:\Programme\WinRAR\rarext.dll

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
ITBar7Height "ITBar7Height" - ? -  (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? -  (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_20" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} "Java Plug-in 1.6.0_20" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_20" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_20.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
"ICQ7.2" - "ICQ, LLC." - C:\Program Files\ICQ7.2\ICQ.exe
{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll
{000123B4-9B42-4900-B3F7-F4B073EFC214} "Octh Class" - "Orbitdownloader.com" - C:\Program Files\Orbitdownloader\orbitcth.dll
{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
{5C255C8A-E604-49b4-9D64-90988571CECB} "{5C255C8A-E604-49b4-9D64-90988571CECB}" - ? -  (File not found | COM-object registry key not found)

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"DAEMON Tools Lite" - "DT Soft Ltd" - "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
"msnmsgr" - "Microsoft Corporation" - "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
"RMClock" - "NGO Science Center "RightMark"" - C:\Programme\RMClock\RMClockLauncher.exe
-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----
"StartupPrograms" - ? - rdpclip  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"Adobe ARM" - "Adobe Systems Incorporated" - "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"avgnt" - "Avira GmbH" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
"FreePDF Assistant" - "shbox.de" - C:\Program Files\FreePDF_XP\fpassist.exe
"iTunesHelper" - "Apple Inc." - "C:\Program Files\iTunes\iTunesHelper.exe"
"Malwarebytes' Anti-Malware (reboot)" - "Malwarebytes Corporation" - "C:\Program Files\Malwarebytes' Anti-Malware\herbert.exe" /runcleanupscript
"QlbCtrl.exe" - " Hewlett-Packard Development Company, L.P." - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
"QuickTime Task" - "Apple Inc." - "C:\Program Files\QuickTime\QTTask.exe" -atboottime
"WirelessAssistant" - "Hewlett-Packard" - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"Redirected Port" - ? - C:\Windows\system32\redmonnt.dll  (File found, but it contains no detailed information)
"Send To Microsoft OneNote Monitor" - "Microsoft Corporation" - C:\Windows\system32\msonpmon.dll

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\sched.exe
"Com4QLBEx" (Com4QLBEx) - "Hewlett-Packard Development Company, L.P." - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
"Dienst "Bonjour"" (Bonjour Service) - "Apple Inc." - C:\Program Files\Bonjour\mDNSResponder.exe
"hpqwmiex" (hpqwmiex) - "Hewlett-Packard Company" - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Program Files\iPod\bin\iPodService.exe
"Logitech Bluetooth Service" (LBTServ) - "Logitech, Inc." - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"OpenVPN Service" (OpenVPNService) - ? - C:\Program Files\OpenVPN\bin\openvpnserv.exe  (File found, but it contains no detailed information)
"ServiceLayer" (ServiceLayer) - "Nokia" - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
"VMware Agent Service" (ufad-ws60) - "VMware, Inc." - C:\Program Files\VMware\VMware Player\vmware-ufad.exe
"VMware Authorization Service" (VMAuthdService) - "VMware, Inc." - C:\Program Files\VMware\VMware Player\vmware-authd.exe
"VMware DHCP Service" (VMnetDHCP) - "VMware, Inc." - C:\Windows\system32\vmnetdhcp.exe
"VMware NAT Service" (VMware NAT Service) - "VMware, Inc." - C:\Windows\system32\vmnat.exe
"VMware USB Arbitration Service" (VMUSBArbService) - "VMware, Inc." - C:\Program Files\Common Files\VMware\USB\vmware-usbarbitrator.exe

[Winlogon]
-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )-----
"LBTWlgn" - "Logitech, Inc." - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll

[Winsock Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----
"mdnsNSP" - "Apple Inc." - C:\Program Files\Bonjour\mdnsNSP.dll
-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries )-----
"VMCI sockets DGRAM" - "VMware, Inc." - C:\Program Files\VMware\VMware Player\vsocklib.dll
"VMCI sockets STREAM" - "VMware, Inc." - C:\Program Files\VMware\VMware Player\vsocklib.dll

===[ Logfile end ]=========================================[ Logfile end ]===
--- --- ---

If You have questions or want to get some help, You can visit Online Solutions :: Index[/QUOTE]

DaDude 31.05.2011 20:48
Und hier nun der MBRCheck

Zitat:
MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows 7 Home Premium Edition
Windows Information: (build 7600), 32-bit
Base Board Manufacturer: Hewlett-Packard
BIOS Manufacturer: Hewlett-Packard
System Manufacturer: Hewlett-Packard
System Product Name: HP EliteBook 6930p
Logical Drives Mask: 0x0000001c

Kernel Drivers (total 228):
0x82C0A000 \SystemRoot\system32\ntoskrnl.exe
0x8300B000 \SystemRoot\system32\halmacpi.dll
0x80BD2000 \SystemRoot\system32\kdcom.dll
0x8B818000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x8B890000 \SystemRoot\system32\PSHED.dll
0x8B8A1000 \SystemRoot\system32\BOOTVID.dll
0x8B8A9000 \SystemRoot\system32\CLFS.SYS
0x8B8EB000 \SystemRoot\system32\CI.dll
0x8B996000 \SystemRoot\system32\drivers\Wdf01000.sys
0x8BA07000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x8BA15000 \SystemRoot\System32\Drivers\spdo.sys
0x8BB08000 \SystemRoot\System32\Drivers\WMILIB.SYS
0x8BB11000 \SystemRoot\System32\Drivers\SCSIPORT.SYS
0x8BB37000 \SystemRoot\system32\DRIVERS\ACPI.sys
0x8BB7F000 \SystemRoot\system32\DRIVERS\msisadrv.sys
0x8BB87000 \SystemRoot\system32\DRIVERS\vdrvroot.sys
0x8BB92000 \SystemRoot\system32\DRIVERS\pci.sys
0x8BBBC000 \SystemRoot\System32\drivers\partmgr.sys
0x8BBCD000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x8BBD5000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x8BBE0000 \SystemRoot\system32\DRIVERS\volmgr.sys
0x8BC27000 \SystemRoot\System32\drivers\volmgrx.sys
0x8BC72000 \SystemRoot\System32\drivers\mountmgr.sys
0x8BC88000 \SystemRoot\system32\DRIVERS\atapi.sys
0x8BC91000 \SystemRoot\system32\DRIVERS\ataport.SYS
0x8BCB4000 \SystemRoot\system32\DRIVERS\msahci.sys
0x8BCBE000 \SystemRoot\system32\DRIVERS\PCIIDEX.SYS
0x8BCCC000 \SystemRoot\system32\DRIVERS\amdxata.sys
0x8BCD5000 \SystemRoot\system32\drivers\fltmgr.sys
0x8BD09000 \SystemRoot\system32\drivers\fileinfo.sys
0x8BD1A000 \SystemRoot\System32\Drivers\Ntfs.sys
0x8BE49000 \SystemRoot\System32\Drivers\msrpc.sys
0x8BE74000 \SystemRoot\System32\Drivers\ksecdd.sys
0x8BE87000 \SystemRoot\System32\Drivers\cng.sys
0x8BEE4000 \SystemRoot\System32\drivers\pcw.sys
0x8BEF2000 \SystemRoot\System32\Drivers\Fs_Rec.sys
0x8BEFB000 \SystemRoot\system32\drivers\ndis.sys
0x8BFB2000 \SystemRoot\system32\drivers\NETIO.SYS
0x8BC00000 \SystemRoot\System32\Drivers\ksecpkg.sys
0x8C013000 \SystemRoot\System32\drivers\tcpip.sys
0x8C15C000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x8C18D000 \SystemRoot\system32\DRIVERS\volsnap.sys
0x8C1CC000 \SystemRoot\System32\Drivers\spldr.sys
0x8C1D4000 \SystemRoot\System32\drivers\rdyboost.sys
0x8C201000 \SystemRoot\System32\Drivers\mup.sys
0x8C211000 \SystemRoot\System32\drivers\hwpolicy.sys
0x8C219000 \SystemRoot\system32\DRIVERS\hpdskflt.sys
0x8C222000 \SystemRoot\System32\DRIVERS\fvevol.sys
0x8C254000 \SystemRoot\system32\DRIVERS\disk.sys
0x8C265000 \SystemRoot\system32\DRIVERS\CLASSPNP.SYS
0x8C2BD000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x8C2DC000 \SystemRoot\System32\Drivers\Null.SYS
0x8C2E3000 \SystemRoot\System32\Drivers\Beep.SYS
0x8C2EA000 \SystemRoot\System32\drivers\vga.sys
0x8C2F6000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x8C317000 \SystemRoot\System32\drivers\watchdog.sys
0x8C324000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x8C32C000 \SystemRoot\system32\drivers\rdpencdd.sys
0x8C334000 \SystemRoot\system32\drivers\rdprefmp.sys
0x8C33C000 \SystemRoot\System32\Drivers\Msfs.SYS
0x8C347000 \SystemRoot\System32\Drivers\Npfs.SYS
0x8C355000 \SystemRoot\system32\DRIVERS\tdx.sys
0x8C36C000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x8C377000 \SystemRoot\system32\drivers\afd.sys
0x9203B000 \SystemRoot\System32\DRIVERS\netbt.sys
0x9206D000 \SystemRoot\system32\drivers\ws2ifsl.sys
0x92076000 \SystemRoot\system32\DRIVERS\wfplwf.sys
0x9207D000 \SystemRoot\system32\DRIVERS\pacer.sys
0x9209C000 \SystemRoot\system32\DRIVERS\vwififlt.sys
0x920AD000 \SystemRoot\system32\DRIVERS\netbios.sys
0x920BB000 \SystemRoot\system32\DRIVERS\dtsoftbus01.sys
0x920F6000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x92109000 \SystemRoot\system32\DRIVERS\termdd.sys
0x92119000 \SystemRoot\system32\DRIVERS\ssmdrv.sys
0x9211F000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x92160000 \SystemRoot\system32\drivers\nsiproxy.sys
0x9216A000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x92174000 \SystemRoot\System32\drivers\discache.sys
0x92180000 \SystemRoot\System32\Drivers\dfsc.sys
0x92198000 \SystemRoot\system32\DRIVERS\blbdrive.sys
0x921A6000 \SystemRoot\system32\DRIVERS\avipbb.sys
0x921C2000 \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys
0x921C4000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x921E5000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x95421000 \SystemRoot\system32\DRIVERS\igdkmd32.sys
0x95D41000 \SystemRoot\System32\Drivers\fastfat.SYS
0x95D6B000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x95E22000 \SystemRoot\System32\drivers\dxgmms1.sys
0x95E5B000 \SystemRoot\system32\DRIVERS\e1y6232.sys
0x95E95000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0x95EA0000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x95EEB000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x95EFA000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x96806000 \SystemRoot\system32\DRIVERS\NETw5s32.sys
0x96E82000 \SystemRoot\system32\DRIVERS\vwifibus.sys
0x96E8C000 \SystemRoot\system32\drivers\sdbus.sys
0x96EA5000 \SystemRoot\system32\DRIVERS\rimmptsk.sys
0x96EB6000 \SystemRoot\system32\drivers\tpm.sys
0x96EC2000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x96EDA000 \SystemRoot\system32\DRIVERS\HpqKbFiltr.sys
0x96EE3000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x96EF0000 \??\C:\Windows\system32\drivers\VMkbd.sys
0x921F7000 \SystemRoot\system32\DRIVERS\SynTP.sys
0x96EF5000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x96EF7000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x96F04000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
0x96F0A000 \SystemRoot\system32\DRIVERS\Accelerometer.sys
0x96F15000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0x96F19000 \SystemRoot\system32\DRIVERS\cpqbttn.sys
0x96F1C000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x96F2F000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x96F36000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0x96F3F000 \SystemRoot\system32\DRIVERS\CompositeBus.sys
0x96F4C000 \SystemRoot\system32\DRIVERS\AgileVpn.sys
0x96F5E000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x96F76000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x96F81000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x96FA3000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x96FBB000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x96FD2000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x96FE9000 \SystemRoot\system32\DRIVERS\tap0901.sys
0x96FF0000 \SystemRoot\system32\DRIVERS\swenum.sys
0x95F19000 \SystemRoot\system32\DRIVERS\ks.sys
0x96FF2000 \SystemRoot\system32\DRIVERS\umbus.sys
0x95F4D000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x95F91000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0x95F9D000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x92334000 \SystemRoot\system32\drivers\ADIHdAud.sys
0x95FAE000 \SystemRoot\system32\drivers\portcls.sys
0x95FDD000 \SystemRoot\system32\drivers\drmk.sys
0x95400000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x92397000 \SystemRoot\system32\DRIVERS\hidusb.sys
0x95417000 \SystemRoot\System32\Drivers\LEqdUsb.Sys
0x923A2000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x96800000 \SystemRoot\System32\Drivers\LHidEqd.Sys
0x95FF6000 \SystemRoot\system32\DRIVERS\LHidFilt.Sys
0x923AD000 \SystemRoot\system32\DRIVERS\LMouFilt.Sys
0x923B5000 \SystemRoot\System32\Drivers\BTHUSB.sys
0x82016000 \SystemRoot\System32\Drivers\bthport.sys
0x98110000 \SystemRoot\System32\win32k.sys
0x8207A000 \SystemRoot\System32\drivers\Dxapi.sys
0x82084000 \SystemRoot\System32\Drivers\crashdmp.sys
0x82091000 \SystemRoot\System32\Drivers\dump_dumpata.sys
0x8209C000 \SystemRoot\System32\Drivers\dump_msahci.sys
0x820A6000 \SystemRoot\System32\Drivers\dump_dumpfve.sys
0x820B7000 \SystemRoot\system32\DRIVERS\rfcomm.sys
0x820DB000 \SystemRoot\system32\DRIVERS\BthEnum.sys
0x820E8000 \SystemRoot\system32\DRIVERS\bthpan.sys
0x82103000 \SystemRoot\system32\DRIVERS\bthmodem.sys
0x82115000 \SystemRoot\system32\drivers\modem.sys
0x82122000 \SystemRoot\system32\DRIVERS\hidbth.sys
0x8213D000 \SystemRoot\system32\DRIVERS\snp2uvc.sys
0x822F6000 \SystemRoot\system32\DRIVERS\STREAM.SYS
0x82304000 \SystemRoot\system32\DRIVERS\sncduvc.SYS
0x8230B000 \SystemRoot\System32\Drivers\ATSwpWDF.sys
0x823A8000 \SystemRoot\system32\DRIVERS\monitor.sys
0x98370000 \SystemRoot\System32\TSDDD.dll
0x983A0000 \SystemRoot\System32\cdd.dll
0x98000000 \SystemRoot\System32\ATMFD.DLL
0x823B3000 \SystemRoot\system32\drivers\luafv.sys
0x823CE000 \SystemRoot\system32\DRIVERS\avgntflt.sys
0x823E2000 \SystemRoot\system32\drivers\WudfPf.sys
0x82000000 \SystemRoot\system32\DRIVERS\vmnetbridge.sys
0x8200E000 \SystemRoot\system32\DRIVERS\VMNET.SYS
0x923C7000 \SystemRoot\system32\DRIVERS\lltdio.sys
0xAD833000 \SystemRoot\system32\DRIVERS\nwifi.sys
0xAD879000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xAD889000 \SystemRoot\system32\DRIVERS\rspndr.sys
0xAD89C000 \SystemRoot\system32\drivers\HTTP.sys
0xAD921000 \SystemRoot\System32\drivers\mpsdrv.sys
0xAD94B000 \??\C:\Windows\system32\drivers\hcmon.sys
0xAD955000 \??\C:\Windows\system32\Drivers\vmci.sys
0xAD965000 \??\C:\Windows\system32\Drivers\vmx86.sys
0xADA34000 \??\C:\Windows\system32\drivers\cpuz132_x32.sys
0xADA38000 \SystemRoot\system32\drivers\peauth.sys
0xADACF000 \SystemRoot\System32\Drivers\secdrv.SYS
0xADAD9000 \SystemRoot\System32\DRIVERS\srvnet.sys
0xADAFA000 \SystemRoot\System32\drivers\tcpipreg.sys
0xADB07000 \??\C:\Windows\system32\drivers\vmnetuserif.sys
0xADB0C000 \??\C:\Program Files\VMware\VMware Player\vstor2-ws60.sys
0xADB10000 \SystemRoot\System32\DRIVERS\srv2.sys
0xADB5F000 \SystemRoot\System32\DRIVERS\srv.sys
0xADBB1000 \SystemRoot\system32\DRIVERS\vwifimp.sys
0xADBBA000 \SystemRoot\system32\DRIVERS\bowser.sys
0xADBD3000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0x92000000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0xAD800000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0xAD81B000 \??\C:\Programme\RMClock\RTCore32.sys
0xBAC79000 \SystemRoot\system32\DRIVERS\asyncmac.sys
0x777A0000 \Windows\System32\ntdll.dll
0x47A10000 \Windows\System32\smss.exe
0x779E0000 \Windows\System32\apisetschema.dll
0x005C0000 \Windows\System32\autochk.exe
0x779C0000 \Windows\System32\lpk.dll
0x779A0000 \Windows\System32\imm32.dll
0x77900000 \Windows\System32\advapi32.dll
0x77710000 \Windows\System32\clbcatq.dll
0x76AC0000 \Windows\System32\shell32.dll
0x768C0000 \Windows\System32\iertutil.dll
0x767F0000 \Windows\System32\user32.dll
0x767A0000 \Windows\System32\Wldap32.dll
0x766D0000 \Windows\System32\msctf.dll
0x76650000 \Windows\System32\comdlg32.dll
0x778F0000 \Windows\System32\psapi.dll
0x76630000 \Windows\System32\sechost.dll
0x765D0000 \Windows\System32\shlwapi.dll
0x76580000 \Windows\System32\gdi32.dll
0x778E0000 \Windows\System32\nsi.dll
0x764E0000 \Windows\System32\usp10.dll
0x76430000 \Windows\System32\msvcrt.dll
0x762F0000 \Windows\System32\urlmon.dll
0x76210000 \Windows\System32\kernel32.dll
0x761D0000 \Windows\System32\ws2_32.dll
0x761C0000 \Windows\System32\normaliz.dll
0x76130000 \Windows\System32\oleaut32.dll
0x75F90000 \Windows\System32\setupapi.dll
0x75F30000 \Windows\System32\difxapi.dll
0x75DD0000 \Windows\System32\ole32.dll
0x75D20000 \Windows\System32\rpcrt4.dll
0x75C20000 \Windows\System32\wininet.dll
0x75BF0000 \Windows\System32\imagehlp.dll
0x75B60000 \Windows\System32\comctl32.dll
0x75B30000 \Windows\System32\cfgmgr32.dll
0x75A10000 \Windows\System32\crypt32.dll
0x759C0000 \Windows\System32\KernelBase.dll
0x75990000 \Windows\System32\wintrust.dll
0x75970000 \Windows\System32\devobj.dll
0x75960000 \Windows\System32\msasn1.dll

Processes (total 68):
0 System Idle Process
4 System
300 C:\Windows\System32\smss.exe
424 csrss.exe
480 C:\Windows\System32\wininit.exe
492 csrss.exe
536 C:\Windows\System32\services.exe
552 C:\Windows\System32\lsass.exe
560 C:\Windows\System32\lsm.exe
680 C:\Windows\System32\svchost.exe
728 C:\Windows\System32\winlogon.exe
820 C:\Windows\System32\svchost.exe
872 C:\Windows\System32\svchost.exe
968 C:\Windows\System32\svchost.exe
1008 C:\Windows\System32\svchost.exe
1140 C:\Windows\System32\svchost.exe
1188 C:\Windows\System32\hpservice.exe
1288 C:\Windows\System32\svchost.exe
1400 C:\Windows\System32\spoolsv.exe
1476 C:\Program Files\Avira\AntiVir Desktop\sched.exe
1500 C:\Windows\System32\svchost.exe
1612 C:\Windows\System32\AEADISRV.EXE
1640 C:\Program Files\Avira\AntiVir Desktop\avguard.exe
1660 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
1692 C:\Program Files\Bonjour\mDNSResponder.exe
1740 C:\Windows\System32\svchost.exe
1828 C:\Windows\System32\svchost.exe
1880 C:\Program Files\Common Files\VMware\USB\vmware-usbarbitrator.exe
1924 C:\Windows\System32\vmnat.exe
1960 C:\Windows\System32\vmnetdhcp.exe
320 C:\Program Files\VMware\VMware Player\vmware-authd.exe
2304 C:\Windows\System32\svchost.exe
2468 C:\Windows\System32\svchost.exe
2592 WmiPrvSE.exe
2880 C:\Windows\System32\taskhost.exe
2932 C:\Windows\System32\dwm.exe
2976 C:\Windows\explorer.exe
3120 C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
3132 C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
3140 C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCtrl.exe
3148 C:\Program Files\Analog Devices\Core\smax4pnp.exe
3176 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
3204 C:\Program Files\FreePDF_XP\fpassist.exe
3336 C:\Program Files\iTunes\iTunesHelper.exe
3388 C:\Windows\System32\igfxtray.exe
3432 C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\VolCtrl.exe
3444 C:\Windows\System32\hkcmd.exe
3452 C:\Windows\System32\igfxpers.exe
3564 C:\Program Files\Windows Live\Messenger\msnmsgr.exe
3620 C:\Program Files\DAEMON Tools Lite\DTLite.exe
3656 C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
3800 C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
3924 C:\Program Files\iPod\bin\iPodService.exe
2580 C:\Program Files\RMClock\RMClock.exe
216 C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
2772 C:\Windows\System32\svchost.exe
3088 C:\Program Files\RMClock\RMClockHLT.exe
3100 C:\Program Files\RMClock\RMClockHLT.exe
3880 C:\Program Files\Windows Media Player\wmpnetwk.exe
1680 C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
920 C:\Program Files\Hewlett-Packard\Shared\hpCaslNotification.exe
3764 C:\Program Files\Windows Live\Contacts\wlcomm.exe
4420 C:\Windows\System32\svchost.exe
5028 C:\Program Files\Opera\opera.exe
4312 C:\Windows\System32\wuauclt.exe
3948 C:\Downloads\osam_autorun_manager_5_0_portable\osam.exe
5928 C:\Users\Florian\Desktop\MBRCheck.exe
5936 C:\Windows\System32\conhost.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00100000 (NTFS)

PhysicalDrive0 Model Number: ST9160823AS, Rev: 3.AHE

Size Device Name MBR Status
--------------------------------------------
149 GB \\.\PhysicalDrive0 Windows 7 MBR code detected
SHA1: 4379A3D43019B46FA357F7DD6A53B45A3CA8FB79


Done!

cosinus 31.05.2011 21:14
Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!


Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


DaDude 01.06.2011 20:24
1. SuperAntiSpyware:

Zitat:
SUPERAntiSpyware Scan Log
SUPERAntiSpyware.com | Remove Malware | Remove Spyware - AntiMalware, AntiSpyware, AntiAdware!

Generated 06/01/2011 at 09:22 PM

Application Version : 4.53.1000

Core Rules Database Version : 7171
Trace Rules Database Version: 4983

Scan type : Complete Scan
Total Scan Time : 01:16:21

Memory items scanned : 809
Memory threats detected : 0
Registry items scanned : 9832
Registry threats detected : 0
File items scanned : 97944
File threats detected : 6

Adware.Tracking Cookie
C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Cookies\florian@adtech[1].txt
C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Cookies\florian@www.active-tracking[1].txt
C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Cookies\florian@atdmt.combing[2].txt
C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Cookies\florian@atdmt[1].txt
C:\Users\Florian\AppData\Roaming\Microsoft\Windows\Cookies\florian@tracking.mecum[2].txt
media.rofl.to [ C:\Users\Florian\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\AVVUS96T ]

DaDude 01.06.2011 21:13
2. Malwarebytes Anti-Malware

Zitat:
Malwarebytes' Anti-Malware 1.51.0.1200
Malwarebytes : Free anti-malware, anti-virus and spyware removal download

Datenbank Version: 6747

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

01.06.2011 22:13:11
mbam-log-2011-06-01 (22-13-11).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Durchsuchte Objekte: 247406
Laufzeit: 42 Minute(n), 46 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\downloads\installer_kaspersky_tdsskiller_2_4_1_2_deutsch.exe (PUP.SmsPay.PGen) -> Quarantined and deleted successfully.

cosinus 01.06.2011 22:09
Zitat:
Infizierte Dateien:
c:\downloads\installer_kaspersky_tdsskiller_2_4_1_2_deutsch.exe (PUP.SmsPay.PGen) -> Quarantined and deleted successfully.
Woher hast du diesen angeblichen tdsskiller?

DaDude 01.06.2011 22:59
Kann dir nicht sagen woher ich den hab. Bei der Recherche nach dem Fehler warum es nicht laufen könnte im Web auf einem Software-Portal gefunden...

EDIT dazu: War bei phpnuke.org, aber die Downloadseite existiert nicht mehr... mit dem Link ausm Downloadmanager kann man es immernoch runterladen. Den werde ich aber besser nicht öffentlich posten...

Hier der ESET:

Zitat:
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6427
# api_version=3.0.2
# EOSSerial=e20151d9e9ef204b9476069060b5d77f
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-06-01 09:54:20
# local_time=2011-06-01 11:54:20 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7600 NT
# compatibility_mode=1797 16775165 100 100 287231 82472211 8655 0
# compatibility_mode=5893 16776573 100 94 4072222 59399247 0 0
# compatibility_mode=8192 67108863 100 0 999 999 0 0
# scanned=105123
# found=11
# cleaned=0
# scan_time=4764
C:\Qoobox\Quarantine\C\Windows\System32\drivers\volsnap.sys.vir Win32/Olmasco.E trojan (unable to clean) 00000000000000000000000000000000 I
C:\Users\Florian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0\51063600-767ae9cf multiple threats (unable to clean) 00000000000000000000000000000000 I
C:\Users\Florian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0\6685d300-16d2fb53 Java/Exploit.CVE-2010-4452.A trojan (unable to clean) 00000000000000000000000000000000 I
C:\Users\Florian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28\6d441f9c-2f7484ec multiple threats (unable to clean) 00000000000000000000000000000000 I
C:\Users\Florian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\30\361be31e-4226dced multiple threats (unable to clean) 00000000000000000000000000000000 I
C:\Users\Florian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36\20281164-433f1dfd multiple threats (unable to clean) 00000000000000000000000000000000 I
C:\Users\Florian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\4\509f69c4-35db5444 multiple threats (unable to clean) 00000000000000000000000000000000 I
C:\Users\Florian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\51\6c087473-7aeaeba6 multiple threats (unable to clean) 00000000000000000000000000000000 I
C:\Users\Florian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61\48a5427d-7d35226b multiple threats (unable to clean) 00000000000000000000000000000000 I
C:\Users\Florian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\8\2d89d408-51e78bbd multiple threats (unable to clean) 00000000000000000000000000000000 I
C:\Windows\System32\drivers\volsnap.sys Win32/Olmasco.E trojan (unable to clean) 00000000000000000000000000000000 I

cosinus 02.06.2011 00:26
Zitat:
C:\Windows\System32\drivers\volsnap.sys Win32/Olmasco.E trojan (unable to clean)
Oh nö, CF hatte den doch so schön "geheilt" :headbang:

Starte Windows neu, lösch die alte cofi.exe, lade CF neu als cofi.exe runter und mach einen neuen Durchgang mit CF

DaDude 02.06.2011 13:22
Hier nochmal cofi:

Combofix Logfile:
Code:
ComboFix 11-06-01.07 - Florian 02.06.2011  14:10:59.2.2 - x86
Microsoft Windows 7 Home Premium  6.1.7600.0.1252.49.1031.18.2972.2054 [GMT 2:00]
ausgeführt von:: c:\users\Florian\Desktop\cofi.exe
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
(((((((((((((((((((((((  Dateien erstellt von 2011-05-02 bis 2011-06-02  ))))))))))))))))))))))))))))))
.
.
2011-06-02 12:15 . 2011-06-02 12:15        --------        d-----w-        c:\users\Default\AppData\Local\temp
2011-06-01 20:18 . 2011-06-01 20:18        --------        d-----w-        c:\program files\ESET
2011-06-01 20:16 . 2011-06-01 20:16        404640        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2011-05-31 20:20 . 2011-05-31 20:20        --------        d-----w-        c:\users\Florian\AppData\Roaming\SUPERAntiSpyware.com
2011-05-31 20:20 . 2011-05-31 20:20        --------        d-----w-        c:\programdata\SUPERAntiSpyware.com
2011-05-31 20:20 . 2011-05-31 20:21        --------        d-----w-        c:\program files\SUPERAntiSpyware
2011-05-31 17:59 . 2011-05-31 17:59        --------        d-----w-        c:\users\Florian\AppData\Local\ElevatedDiagnostics
2011-05-30 19:18 . 2011-05-30 19:18        --------        d-----w-        C:\_OTL
2011-05-29 12:33 . 2011-05-29 12:33        --------        d-----w-        c:\users\Florian\AppData\Roaming\Malwarebytes
2011-05-29 12:33 . 2011-05-29 07:11        39984        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys
2011-05-29 12:33 . 2011-05-29 12:33        --------        d-----w-        c:\programdata\Malwarebytes
2011-05-29 12:33 . 2011-06-01 19:27        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware
2011-05-15 11:31 . 2011-05-15 11:31        --------        d-----w-        c:\windows\Sun
2011-05-15 11:30 . 2011-05-15 11:34        --------        d-----w-        c:\users\Florian\AppData\Local\FLVService
2011-05-15 11:30 . 2011-05-15 11:30        --------        d-----w-        c:\windows\Freecorder
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-22 13:19 . 2011-04-22 13:19        218688        ----a-w-        c:\windows\system32\drivers\dtsoftbus01.sys
2011-04-14 14:30 . 2011-04-15 17:24        6792528        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{4D0AD09C-481A-4000-A3B1-9058CB8AAE4C}\mpengine.dll
2011-03-11 05:40 . 2011-04-15 17:08        1164288        ----a-w-        c:\windows\system32\mfc42u.dll
2011-03-11 05:40 . 2011-04-15 17:08        1137664        ----a-w-        c:\windows\system32\mfc42.dll
2011-03-08 05:38 . 2011-04-15 17:08        740864        ----a-w-        c:\windows\system32\inetcomm.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2010-04-16 3872080]
"RMClock"="c:\programme\RMClock\RMClockLauncher.exe" [2008-02-29 61440]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2011-01-20 1305408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"WirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2009-09-01 499768]
"QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2009-11-11 287800]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2010-01-16 1314816]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2009-06-17 55824]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2010-06-04 1791272]
"FreePDF Assistant"="c:\program files\FreePDF_XP\fpassist.exe" [2010-06-17 370176]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
"Logitech Download Assistant"="c:\windows\System32\LogiLDA.dll" [2010-11-03 1246544]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-03-07 421160]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-02-11 137752]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-02-11 171032]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-02-11 172568]
"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2011-05-29 1047656]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2009-07-20 11:28        72208        ----a-w-        c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\startupfolder\C:^Users^Florian^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk]
path=c:\users\Florian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
backup=c:\windows\pss\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-09-20 22:07        932288        ----a-r-        c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-01-31 08:44        35760        ----a-w-        c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2010-09-16 20:04        1164584        ----a-w-        c:\program files\DivX\DivX Update\DivXUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2011-03-07 13:33        421160        ----a-w-        c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
2010-05-14 08:32        1479680        ----a-w-        c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 15:38        421888        ----a-w-        c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]
2009-07-14 01:14        1173504        ----a-w-        c:\program files\Windows Sidebar\sidebar.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-02-18 09:43        248040        ----a-w-        c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VMware hqtray]
2009-09-30 19:20        64048        ----a-w-        c:\program files\VMware\VMware Player\hqtray.exe
.
R3 HTCAND32;HTC Device Driver;c:\windows\system32\Drivers\ANDROIDUSB.sys [2009-10-26 25088]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2011-05-29 39984]
R3 netw5v32;Intel(R) Wireless WiFi Link 5000-Serie - Adaptertreiber für Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [2009-07-13 4231168]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-01-16 691696]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2011-04-22 218688]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2010-02-17 12872]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2010-05-10 67656]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2010-01-16 108289]
S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [2009-07-08 26168]
S2 vmci;VMware vmci;c:\windows\system32\Drivers\vmci.sys [2009-09-30 70704]
S2 VMUSBArbService;VMware USB Arbitration Service;c:\program files\Common Files\VMware\USB\vmware-usbarbitrator.exe [2009-09-30 563760]
S3 ATSwpWDF;AuthenTec TruePrint USB WBF WDF Driver;c:\windows\system32\Drivers\ATSwpWDF.sys [2009-12-03 625224]
S3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2010-01-12 227896]
S3 e1yexpress;Intel(R) Gigabit Network Connections Driver;c:\windows\system32\DRIVERS\e1y6232.sys [2009-06-12 221912]
S3 LEqdUsb;Logitech SetPoint Unifying KMDF USB Filter;c:\windows\system32\Drivers\LEqdUsb.Sys [2009-06-17 40720]
S3 LHidEqd;Logitech SetPoint Unifying KMDF HID Filter;c:\windows\system32\Drivers\LHidEqd.Sys [2009-06-17 10384]
S3 NETw5s32;Intel(R) Wireless WiFi Link Adaptertreiber für Windows 7 32-Bit;c:\windows\system32\DRIVERS\NETw5s32.sys [2010-01-13 6755840]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-13 14336]
.
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de
uInternet Settings,ProxyOverride = *.local
IE: &Download by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204
IE: Do&wnload selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
LSP: c:\program files\VMware\VMware Player\vsocklib.dll
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\5r8bm6t8.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2117678&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - hxxp://search.conduit.com/?ctid=CT2319825&SearchSource=13
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: PC Sync 2 Synchronisation Extension: bkmrksync@nokia.com - c:\program files\Nokia\Nokia PC Suite 7\bkmrksync
FF - Ext: Ant Video Downloader: anttoolbar@ant.com - %profile%\extensions\anttoolbar@ant.com
FF - Ext: DownThemAll!: {DDC359D1-844A-42a7-9AA1-88A850A938A8} - %profile%\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}
FF - Ext: Conduit Engine : engine@conduit.com - %profile%\extensions\engine@conduit.com
FF - Ext: YouTube Video Download Wizard: ytvdw@pgport.com - %profile%\extensions\ytvdw@pgport.com
.
.
------- Dateityp-Verknüpfung -------
.
.scr=MicroStation Resource
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'Explorer.exe'(4760)
c:\program files\Nokia\Nokia PC Suite 7\PhoneBrowser.dll
c:\program files\Nokia\Nokia PC Suite 7\NGSCM.DLL
c:\program files\Nokia\Nokia PC Suite 7\Lang\PhoneBrowser_ger.nlr
c:\program files\Nokia\Nokia PC Suite 7\Resource\PhoneBrowser_Nokia.ngr
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\AEADISRV.EXE
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\vmnat.exe
c:\windows\system32\vmnetdhcp.exe
c:\program files\VMware\VMware Player\vmware-authd.exe
c:\windows\system32\taskhost.exe
c:\windows\System32\rundll32.exe
c:\windows\system32\conhost.exe
c:\windows\system32\consent.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Hewlett-Packard\Shared\hpqToaster.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\Hewlett-Packard\Shared\hpCaslNotification.exe
c:\program files\Windows Live\Contacts\wlcomm.exe
c:\windows\system32\sppsvc.exe
c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
.
**************************************************************************
.
Zeit der Fertigstellung: 2011-06-02  14:21:13 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2011-06-02 12:21
ComboFix2.txt  2011-05-31 16:13
.
Vor Suchlauf: 16 Verzeichnis(se), 17.358.684.160 Bytes frei
Nach Suchlauf: 17 Verzeichnis(se), 17.186.836.480 Bytes frei
.
- - End Of File - - F407582AE8B92B366ACECC20BC8AFE7B
--- --- ---

cosinus 03.06.2011 09:57
Ist unuaffällig. :dummguck:
Lass ESET bitte nochmal durchlaufen.

DaDude 23.06.2011 13:34
So, bin wieder da. War im Urlaub und ansonsten auch sehr busy. Bin gerade dabei den Eset durchlaufen zu lassen. Hab den Laptop zwar eher seltener verwendet, hoffe aber dass sich da nicht wieder etwas ausgebreitet hat... oO Wobei ich im Moment eine Neuinstallation doch schon als am sinnvollsten in Erwägung ziehe. Mal sehen.

Bislang 9 gefundene Objekte.

DaDude 23.06.2011 14:32
So, hier der neue ESET:

Zitat:
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6427
# api_version=3.0.2
# EOSSerial=e20151d9e9ef204b9476069060b5d77f
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-06-01 09:54:20
# local_time=2011-06-01 11:54:20 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7600 NT
# compatibility_mode=1797 16775165 100 100 287231 82472211 8655 0
# compatibility_mode=5893 16776573 100 94 4072222 59399247 0 0
# compatibility_mode=8192 67108863 100 0 999 999 0 0
# scanned=105123
# found=11
# cleaned=0
# scan_time=4764
C:\Qoobox\Quarantine\C\Windows\System32\drivers\volsnap.sys.vir Win32/Olmasco.E trojan (unable to clean) 00000000000000000000000000000000 I
C:\Users\Florian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0\51063600-767ae9cf multiple threats (unable to clean) 00000000000000000000000000000000 I
C:\Users\Florian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0\6685d300-16d2fb53 Java/Exploit.CVE-2010-4452.A trojan (unable to clean) 00000000000000000000000000000000 I
C:\Users\Florian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28\6d441f9c-2f7484ec multiple threats (unable to clean) 00000000000000000000000000000000 I
C:\Users\Florian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\30\361be31e-4226dced multiple threats (unable to clean) 00000000000000000000000000000000 I
C:\Users\Florian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36\20281164-433f1dfd multiple threats (unable to clean) 00000000000000000000000000000000 I
C:\Users\Florian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\4\509f69c4-35db5444 multiple threats (unable to clean) 00000000000000000000000000000000 I
C:\Users\Florian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\51\6c087473-7aeaeba6 multiple threats (unable to clean) 00000000000000000000000000000000 I
C:\Users\Florian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61\48a5427d-7d35226b multiple threats (unable to clean) 00000000000000000000000000000000 I
C:\Users\Florian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\8\2d89d408-51e78bbd multiple threats (unable to clean) 00000000000000000000000000000000 I
C:\Windows\System32\drivers\volsnap.sys Win32/Olmasco.E trojan (unable to clean) 00000000000000000000000000000000 I
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6427
# api_version=3.0.2
# EOSSerial=e20151d9e9ef204b9476069060b5d77f
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-06-23 01:28:09
# local_time=2011-06-23 03:28:09 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7600 NT
# compatibility_mode=1797 16775165 100 100 45478 83718156 38271 0
# compatibility_mode=5893 16776573 100 94 1807687 61263935 0 0
# compatibility_mode=8192 67108863 100 0 1865687 1865687 0 0
# scanned=112209
# found=10
# cleaned=0
# scan_time=10496
C:\Qoobox\Quarantine\C\Windows\System32\drivers\volsnap.sys.vir Win32/Olmasco.E trojan (unable to clean) 00000000000000000000000000000000 I
C:\Users\Florian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0\51063600-767ae9cf multiple threats (unable to clean) 00000000000000000000000000000000 I
C:\Users\Florian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28\6d441f9c-2f7484ec multiple threats (unable to clean) 00000000000000000000000000000000 I
C:\Users\Florian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\30\361be31e-4226dced multiple threats (unable to clean) 00000000000000000000000000000000 I
C:\Users\Florian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36\20281164-433f1dfd multiple threats (unable to clean) 00000000000000000000000000000000 I
C:\Users\Florian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\4\509f69c4-35db5444 multiple threats (unable to clean) 00000000000000000000000000000000 I
C:\Users\Florian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\51\6c087473-7aeaeba6 multiple threats (unable to clean) 00000000000000000000000000000000 I
C:\Users\Florian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61\48a5427d-7d35226b multiple threats (unable to clean) 00000000000000000000000000000000 I
C:\Users\Florian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\8\2d89d408-51e78bbd multiple threats (unable to clean) 00000000000000000000000000000000 I
C:\Windows\System32\drivers\volsnap.sys Win32/Olmasco.E trojan (unable to clean) 00000000000000000000000000000000 I

cosinus 23.06.2011 15:06
Bitte mal runterladen => File-Upload.net - volsnap.sys
(direkt nach c: ins Hauptverzeichnis)

Dann gehts so weiter:

PartedMagic
  • Lade Dir das ISO-Image von PartedMagic herunter, müssten ca. 150 MB sein
  • Brenn die ISO-Datei per Imagebrennfunktion auf CD, geht zB mit ImgBurn oder Nero per Imagebrennfunktion unter Windows
  • Boote den Rechner (mit defektem/infizierten) Windows von der gebrannten CD, im Bootmenü von Option 1 starten und warten bis der Linux-Desktop oben ist


    http://partedmagic.com/lib/exe/fetch...bootscreen.png


  • Du müsstest ein Symbol Mount Devices finden, das doppelklicken



    http://partedmagic.com/lib/exe/fetch...ia=desktop.png

  • Mounte die Partition wo Windows installiert ist, meistens ist es /dev/sda1
  • Benenne auf sda1 (bzw. die Partition wo Windows ist, falls es nicht sda1 sein sollte) folgende Datei um, einfach ein .vir dranhängen:

    Code:
    /media/[LW C]/windows/system32/drivers/volsnap.sys.vir
  • Die saubere Datei volsnap.sys nach system32 kopieren:

    Code:
    /media/[LW C]/volsnap.sys => /media/[LW C]/windows/system32/drivers/volsnap.sys
    (müsste eigentlich alles ganz easy über den graphischen Dateibrowser in Linux gehen)

  • Starte den Rechner neu und boote Windows
  • Falls Windows wieder normal bootet => die in Linux umbenannte Datei (die mit .vir) bei uns hochladen => http://www.trojaner-board.de/54791-a...ner-board.html

Gib Bescheid wenn alles durch ist. Mach am besten auch nochmal einen Durchgang mit ESET.


Alle Zeitangaben in WEZ +1. Es ist jetzt 19:34 Uhr.
Seite 2 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19