Trojaner-Board
Seite 5 von 7 « Erste 34 5 67
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   delayed write failed Virus schwarzer Bildschirm (https://www.trojaner-board.de/107661-delayed-write-failed-virus-schwarzer-bildschirm.html)

Olivia81 10.01.2012 18:08
Ich kann mit rechts nur "Volume löschen", die Option "Partition löschen" finde ich leider nicht!
Grüße,
Olivia

cosinus 10.01.2012 19:57
Partition=Volume
Ist das gleiche mit gemeint

Olivia81 10.01.2012 22:10
Liste der Anhänge anzeigen (Anzahl: 1)
hi Arne,
danke - erhalte wie du auf dem Screenshot sehen kannst Meldungen, dass Programme (zB Avira) versuchen, auf das Internet zuzugreifen (hatte ich vor dem Virus nicht), das Programm facemood ist mir nicht bekannt.
Grüße,
Olivia

Olivia81 10.01.2012 22:11
PS: Kann Avira selbst auch etwas haben - habe soeben eine Meldung erhalten: "Entdecken Sie den neuen konfigurierbaren Spielmodus" - und die Probleme fingen an, als ich bei Avira ein Update durchgeführt habe...

cosinus 10.01.2012 22:26
Nein, das ist bloß ein Hinweis von Avira.

Bitte nun neue Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Mach auch ein neues Log mit aswMBR

Olivia81 11.01.2012 06:51
hi Arne,
GMER hat sich wie angekündigt aufgehängt.

Code:
OSAM Logfile:

       
Code:

       
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 22:42:03 on 10.01.2012

OS: Windows Vista Home Premium Edition Service Pack 1 (Build 6001), 32-bit
Default Browser: Microsoft Corporation Internet Explorer 8.00.6001.18702

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Common]
-----( %SystemRoot%\Tasks )-----
"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"DivXControlPanelApplet.cpl" - "DivX, Inc." - C:\Windows\system32\DivXControlPanelApplet.cpl
"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\Windows\system32\FlashPlayerCPLApp.cpl
"iproset.cpl" - "Intel(R) Corporation" - C:\Windows\system32\iproset.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"Adobe Gamma" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma.cpl
"PROSet Tools" - "Intel(R) Corporation" - C:\Windows\System32\iPROSet.cpl
"QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl
"ToSysCnf" - "Deutsche Telekom AG, Marmiko IT-Solutions GmbH" - C:\Program Files\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToSysCnf.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"Apple Mobile USB Driver" (USBAAPL) - "Apple, Inc." - C:\Windows\System32\Drivers\usbaapl.sys
"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys
"avkmgr" (avkmgr) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avkmgr.sys
"catchme" (catchme) - ? - C:\Users\SCHATZ~1\AppData\Local\Temp\catchme.sys  (File not found)
"ElbyCDIO Driver" (ElbyCDIO) - "Elaborate Bytes AG" - C:\Windows\System32\Drivers\ElbyCDIO.sys
"IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys  (File not found)
"IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys  (File not found)
"IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys  (File not found)
"MTOnlPktAlyX NDIS Protocol Driver" (MTOnlPktAlyX) - "Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH" - C:\PROGRA~1\T-Online\T-ONLI~1\BASIS-~1\Basis1\MTOnlPktAlyX.SYS
"regi" (regi) - "InterVideo" - C:\Windows\system32\drivers\regi.sys
"Sony DMI Call service" (DMICall) - "Sony Corporation" - C:\Windows\System32\DRIVERS\DMICall.sys
"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys
"WimFltr" (WimFltr) - "Microsoft Corporation" - C:\Windows\System32\DRIVERS\wimfltr.sys
"[verify-U]_System" ([verify-U]_System) - ? - C:\Windows\System32\drivers\[verify-U]-driver.sys  (File not found)

[Explorer]
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll
{91774881-D725-4E58-B298-07617B9B86A8} "Skype IE add-on Pluggable Protocol" - ? - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----
{AEB6717E-7E19-11d0-97EE-00C04FD91972} "{AEB6717E-7E19-11d0-97EE-00C04FD91972}" - ? -   (File not found | COM-object registry key not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? -   (File not found | COM-object registry key not found)
{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802} "Acrobat Elements Context Menu" - "Adobe Systems Inc." - C:\Program Files\Adobe\Acrobat 8.0\Acrobat Elements\ContextMenu.dll
{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)
{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)
{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? -   (File not found | COM-object registry key not found)
{94586423-855F-4EB2-9F6A-D9DA5658DBE3} "Context menu" - ? - C:\PROGRA~1\FREEM4~1\m4a_menu.dll  (File found, but it contains no detailed information)
{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? -   (File not found | COM-object registry key not found)
{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? -   (File not found | COM-object registry key not found)
{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Program Files\iTunes\iTunesMiniPlayer.dll
{00020d75-0000-0000-c000-000000000046} "lnkfile" - ? -   (File not found | COM-object registry key not found)
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\msohevi.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\ONFILTER.DLL
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{7842554E-6BED-11D2-8CDB-B05550C10000} "Monitor Class" - "Broadcom Corporation." - C:\Windows\system32\btncopy.dll
{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} "RealOne Player Context Menu Class" - "RealNetworks, Inc." - C:\Program Files\Real\RealPlayer\rpshell.dll
{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)
{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll
{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -   (File not found | COM-object registry key not found)
{E0D79304-84BE-11CE-9641-444553540000} "WinZip" - "WinZip Computing, S.L." - C:\Program Files\WinZip\wzshlstb.dll
{E0D79305-84BE-11CE-9641-444553540000} "WinZip" - "WinZip Computing, S.L." - C:\Program Files\WinZip\wzshlstb.dll
{E0D79306-84BE-11CE-9641-444553540000} "WinZip" - "WinZip Computing, S.L." - C:\Program Files\WinZip\wzshlstb.dll
{E0D79307-84BE-11CE-9641-444553540000} "WinZip" - "WinZip Computing, S.L." - C:\Program Files\WinZip\wzshlstb.dll

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
ITBar7Height "ITBar7Height" - ? -   (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_24" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} "Java Plug-in 1.6.0_24" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_24" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_24.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
{7530BFB8-7293-4D34-9923-61A11451AFC5} "OnlineScanner Control" - "ESET" - C:\PROGRA~1\ESET\ESETON~1\ONLINE~1.OCX / hxxp://download.eset.com/special/eos/OnlineScanner.cab
{0972B098-DEE9-4279-AC7E-4BAAA029102D} "PhotoboxPhotowaysUploader5 Control" - "PhotoBox Photoways" - C:\Windows\Downloaded Program Files\ImageUploader5.ocx / hxxp://assets.photobox.com/assets/aurigma/ImageUploader5.cab?20111123062837
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
{898EA8C8-E7FF-479B-8935-AEC46303B9E5} "Skype Click to Call" - ? - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\Users\Schatzipu\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
"Terminkalender2.lnk" - "softwarenetz.de" - C:\Softwarenetz\Terminkalender2\kalender2.exe  (Shortcut exists | File exists)
-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----
"StartupPrograms" - ? - rdpclip  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"APSDaemon" - "Apple Inc." - "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
"avgnt" - "Avira Operations GmbH & Co. KG" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
"facemoods" - "facemoods.com" - "C:\Program Files\facemoods.com\facemoods\1.4.17.6\facemoodssrv.exe" /md I
"iTunesHelper" - "Apple Inc." - "C:\Program Files\iTunes\iTunesHelper.exe"
"RIMBBLaunchAgent.exe" - "Research In Motion Limited" - C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
"ToADiMon.exe" - "Deutsche Telekom AG, Marmiko IT-Solutions GmbH" - C:\Program Files\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToADiMon.exe -TOnlineAutodialStart

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"Send To Microsoft OneNote Monitor" - "Microsoft Corporation" - C:\Windows\system32\msonpmon.dll

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"Adobe Active File Monitor V6" (AdobeActiveFileMonitor6.0) - ? - C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe  (File found, but it contains no detailed information)
"Akamai NetSession Interface" (Akamai) - ? - c:\program files\common files\akamai\netsession_win_b427739.dll  (File found, but it contains no detailed information)
"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
"Avira Echtzeit Scanner" (AntiVirService) - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
"Avira Planer" (AntiVirSchedulerService) - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\sched.exe
"VAIO Power Management" (VAIO Power Management) - "Sony Corporation" - C:\Program Files\Sony\VAIO Power Management\SPMService.exe
"Bluetooth Service" (btwdins) - "Broadcom Corporation." - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
"Dienst "Bonjour"" (Bonjour Service) - "Apple Inc." - C:\Program Files\Bonjour\mDNSResponder.exe
"FLEXnet Licensing Service" (FLEXnet Licensing Service) - "Acresso Software Inc." - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
"Google Software Updater" (gusvc) - "Google" - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"Intel® PROSet/Wireless Event Log" (EvtEng) - "Intel(R) Corporation" - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
"Intel® PROSet/Wireless Registry Service" (RegSrvc) - "Intel(R) Corporation" - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Program Files\iPod\bin\iPodService.exe
"IviRegMgr" (IviRegMgr) - "InterVideo" - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
"MSCSPTISRV" (MSCSPTISRV) - "Sony Corporation" - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
"NSUService" (NSUService) - "Sony Corporation" - C:\Program Files\Sony\Network Utility\NSUService.exe
"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"PACSPTISVR" (PACSPTISVR) - "Sony Corporation" - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
"Realtek Audio Service" (RtkAudioService) - "Realtek Semiconductor" - C:\Windows\RtkAudioService.exe
"Sony SPTI Service" (SPTISRV) - "Sony Corporation" - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
"VAIO Content Folder Watcher" (VCFw) - "Sony Corporation" - C:\Program Files\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe
"VAIO Content Metadata Intelligent Analyzing Manager" (VcmIAlzMgr) - "Sony Corporation" - C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe
"VAIO Content Metadata XML Interface" (VcmXmlIfHelper) - "Sony Corporation" - C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper.exe
"VAIO Entertainment Database Service" (VzCdbSvc) - "Sony Corporation" - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
"VAIO Entertainment TV Device Arbitration Service" (VAIO Entertainment TV Device Arbitration Service) - "Sony Corporation" - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzHardwareResourceManager\VzHardwareResourceManager\VzHardwareResourceManager.exe
"VAIO Entertainment UPnP Client Adapter" (Vcsw) - "Sony Corporation" - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
"VAIO Event Service" (VAIO Event Service) - "Sony Corporation" - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
"VAIO Media plus Content Importer" (SOHCImp) - "Sony Corporation" - C:\Program Files\Sony\VAIO Media plus\SOHCImp.exe
"VAIO Media plus Device Searcher" (SOHDs) - "Sony Corporation" - C:\Program Files\Sony\VAIO Media plus\SOHDs.exe
"VAIO Media plus Digital Media Server" (SOHDms) - "Sony Corporation" - C:\Program Files\Sony\VAIO Media plus\SOHDms.exe

[Winlogon]
-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )-----
"VESWinlogon" - "Sony Corporation" - C:\Windows\system32\VESWinlogon.dll

[Winsock Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----
"mdnsNSP" - "Apple Inc." - C:\Program Files\Bonjour\mdnsNSP.dll

===[ Logfile end ]=========================================[ Logfile end ]===

--- --- ---

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru
Code:
aswMBR version 0.9.9.1297 Copyright(c) 2011 AVAST Software
Run date: 2012-01-10 14:34:24
-----------------------------
14:34:24.564    OS Version: Windows 6.0.6001 Service Pack 1
14:34:24.564    Number of processors: 2 586 0x1706
14:34:24.564    ComputerName: SCHATZIPU-PC  UserName: Schatzipu
14:34:32.163    Initialze error C000010E - driver not loaded
14:37:33.125    AVAST engine defs: 12011000
14:51:00.609    Scan error: Unzulässige Funktion.
14:51:21.985    The log file has been saved successfully to "C:\Users\Schatzipu\Desktop\aswMBR.txt"


aswMBR version 0.9.9.1297 Copyright(c) 2011 AVAST Software
Run date: 2012-01-10 14:33:52
-----------------------------
14:33:52.812    OS Version: Windows 6.0.6001 Service Pack 1
14:33:52.812    Number of processors: 2 586 0x1706
14:33:52.812    ComputerName: SCHATZIPU-PC  UserName: Schatzipu
14:34:34.886    Initialize success
14:34:35.058    write error "aswCmnB.dll". Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird.
14:54:19.147    AVAST engine defs: 12011000
14:54:21.598    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
14:54:21.598    Disk 0 Vendor: TOSHIBA_ LV01 Size: 305245MB BusType: 3
14:54:21.614    Disk 1  \Device\Harddisk1\DR1 -> \Device\0000006d
14:54:21.630    Disk 1 Vendor: RICOH 01 Size: 305245MB BusType: 0
14:54:21.630    Disk 2  \Device\Harddisk2\DR2 -> \Device\0000006e
14:54:21.645    Disk 2 Vendor: RICOH 02 Size: 305245MB BusType: 0
14:54:21.661    Disk 0 MBR read successfully
14:54:21.676    Disk 0 MBR scan
14:54:21.692    Disk 0 Windows VISTA default MBR code
14:54:21.723    Disk 0 Partition 1 80 (A) 27 Hidden NTFS WinRE NTFS        11485 MB offset 2048
14:54:21.786    Disk 0 Partition 2 00    07    HPFS/NTFS NTFS      293758 MB offset 23523328
14:54:21.801    Disk 0 Partition 3 00    07    HPFS/NTFS NTFS            0 MB offset 625140400
14:54:22.425    Disk 0 Partition 3  **INFECTED** MBR:Alureon-K [Rtk]
14:54:22.441    Disk 0 scanning sectors +625142432
14:54:22.488    Disk 0 scanning C:\Windows\system32\drivers
14:54:55.627    Service scanning
14:54:57.873    Modules scanning
14:55:15.377    Disk 0 trace - called modules:
14:55:15.408    ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll iaStor.sys
14:55:15.423    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8686cac8]
14:55:15.439    3 CLASSPNP.SYS[8a9a5745] -> nt!IofCallDriver -> [0x84d5a318]
14:55:15.455    5 acpi.sys[8068e6a0] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0x84d5d028]
14:55:18.965    AVAST engine scan C:\Windows
14:55:32.289    File: C:\Windows\PEV.exe  **INFECTED** Win32:Rootkit-gen [Rtk]
14:55:41.028    AVAST engine scan C:\Windows\system32
15:03:00.097    AVAST engine scan C:\Windows\system32\drivers
15:03:46.457    AVAST engine scan C:\Users\Schatzipu
15:07:44.615    Disk 0 MBR has been saved successfully to "C:\Users\Schatzipu\Desktop\MBR.dat"
15:07:44.630    The log file has been saved successfully to "C:\Users\Schatzipu\Desktop\aswMBR.txt"


aswMBR version 0.9.9.1297 Copyright(c) 2011 AVAST Software
Run date: 2012-01-10 14:33:52
-----------------------------
14:33:52.812    OS Version: Windows 6.0.6001 Service Pack 1
14:33:52.812    Number of processors: 2 586 0x1706
14:33:52.812    ComputerName: SCHATZIPU-PC  UserName: Schatzipu
14:34:34.886    Initialize success
14:34:35.058    write error "aswCmnB.dll". Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird.
14:54:19.147    AVAST engine defs: 12011000
14:54:21.598    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
14:54:21.598    Disk 0 Vendor: TOSHIBA_ LV01 Size: 305245MB BusType: 3
14:54:21.614    Disk 1  \Device\Harddisk1\DR1 -> \Device\0000006d
14:54:21.630    Disk 1 Vendor: RICOH 01 Size: 305245MB BusType: 0
14:54:21.630    Disk 2  \Device\Harddisk2\DR2 -> \Device\0000006e
14:54:21.645    Disk 2 Vendor: RICOH 02 Size: 305245MB BusType: 0
14:54:21.661    Disk 0 MBR read successfully
14:54:21.676    Disk 0 MBR scan
14:54:21.692    Disk 0 Windows VISTA default MBR code
14:54:21.723    Disk 0 Partition 1 80 (A) 27 Hidden NTFS WinRE NTFS        11485 MB offset 2048
14:54:21.786    Disk 0 Partition 2 00    07    HPFS/NTFS NTFS      293758 MB offset 23523328
14:54:21.801    Disk 0 Partition 3 00    07    HPFS/NTFS NTFS            0 MB offset 625140400
14:54:22.425    Disk 0 Partition 3  **INFECTED** MBR:Alureon-K [Rtk]
14:54:22.441    Disk 0 scanning sectors +625142432
14:54:22.488    Disk 0 scanning C:\Windows\system32\drivers
14:54:55.627    Service scanning
14:54:57.873    Modules scanning
14:55:15.377    Disk 0 trace - called modules:
14:55:15.408    ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll iaStor.sys
14:55:15.423    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8686cac8]
14:55:15.439    3 CLASSPNP.SYS[8a9a5745] -> nt!IofCallDriver -> [0x84d5a318]
14:55:15.455    5 acpi.sys[8068e6a0] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0x84d5d028]
14:55:18.965    AVAST engine scan C:\Windows
14:55:32.289    File: C:\Windows\PEV.exe  **INFECTED** Win32:Rootkit-gen [Rtk]
14:55:41.028    AVAST engine scan C:\Windows\system32
15:03:00.097    AVAST engine scan C:\Windows\system32\drivers
15:03:46.457    AVAST engine scan C:\Users\Schatzipu
15:07:44.615    Disk 0 MBR has been saved successfully to "C:\Users\Schatzipu\Desktop\MBR.dat"
15:07:44.630    The log file has been saved successfully to "C:\Users\Schatzipu\Desktop\aswMBR.txt"
15:07:55.449    Disk 0 MBR has been saved successfully to "C:\Users\Schatzipu\Desktop\MBR.dat"
15:07:55.449    The log file has been saved successfully to "C:\Users\Schatzipu\Desktop\aswMBR.txt"


aswMBR version 0.9.9.1297 Copyright(c) 2011 AVAST Software
Run date: 2012-01-10 22:47:00
-----------------------------
22:47:00.712    OS Version: Windows 6.0.6001 Service Pack 1
22:47:00.712    Number of processors: 2 586 0x1706
22:47:00.712    ComputerName: SCHATZIPU-PC  UserName: Schatzipu
22:47:02.585    Initialize success
22:47:17.545    AVAST engine defs: 12011000
22:47:21.258    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
22:47:21.258    Disk 0 Vendor: TOSHIBA_ LV01 Size: 305245MB BusType: 3
22:47:21.273    Disk 1  \Device\Harddisk1\DR1 -> \Device\0000006c
22:47:21.273    Disk 1 Vendor: RICOH 01 Size: 305245MB BusType: 0
22:47:21.289    Disk 2  \Device\Harddisk2\DR2 -> \Device\0000006d
22:47:21.289    Disk 2 Vendor: RICOH 02 Size: 305245MB BusType: 0
22:47:21.336    Disk 0 MBR read successfully
22:47:21.336    Disk 0 MBR scan
22:47:21.398    Disk 0 Windows VISTA default MBR code
22:47:21.429    Disk 0 Partition 1 80 (A) 27 Hidden NTFS WinRE NTFS        11485 MB offset 2048
22:47:21.461    Disk 0 Partition 2 00    07    HPFS/NTFS NTFS      293758 MB offset 23523328
22:47:21.461    Disk 0 scanning sectors +625140400
22:47:21.507    Disk 0 malicious Win32:MBRoot code @ sector 625140403 !
22:47:21.523    Disk 0 PE file @ sector 625140425 !
22:47:21.570    Disk 0 scanning C:\Windows\system32\drivers
22:47:42.240    Service scanning
22:47:43.987    Modules scanning
22:47:51.725    Disk 0 trace - called modules:
22:47:51.756    ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll iaStor.sys
22:47:51.771    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x861fc780]
22:47:51.787    3 CLASSPNP.SYS[8a9aa745] -> nt!IofCallDriver -> [0x85701408]
22:47:51.787    5 acpi.sys[806876a0] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0x85706028]
22:47:53.597    AVAST engine scan C:\Windows
22:47:55.609    File: C:\Windows\PEV.exe  **INFECTED** Win32:Rootkit-gen [Rtk]
22:48:01.942    AVAST engine scan C:\Windows\system32
22:51:34.141    AVAST engine scan C:\Windows\system32\drivers
22:52:15.467    AVAST engine scan C:\Users\Schatzipu
22:55:25.483    Disk 0 MBR has been saved successfully to "C:\Users\Schatzipu\Desktop\MBR.dat"
22:55:25.515    The log file has been saved successfully to "C:\Users\Schatzipu\Desktop\aswMBR.txt"


aswMBR version 0.9.9.1297 Copyright(c) 2011 AVAST Software
Run date: 2012-01-10 22:57:08
-----------------------------
22:57:08.209    OS Version: Windows 6.0.6001 Service Pack 1
22:57:08.209    Number of processors: 2 586 0x1706
22:57:08.225    ComputerName: SCHATZIPU-PC  UserName: Schatzipu
22:57:09.957    Initialize success
22:57:19.317    AVAST engine defs: 12011000
22:57:36.040    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
22:57:36.055    Disk 0 Vendor: TOSHIBA_ LV01 Size: 305245MB BusType: 3
22:57:36.055    Disk 1  \Device\Harddisk1\DR1 -> \Device\0000006c
22:57:36.071    Disk 1 Vendor: RICOH 01 Size: 305245MB BusType: 0
22:57:36.071    Disk 2  \Device\Harddisk2\DR2 -> \Device\0000006d
22:57:36.087    Disk 2 Vendor: RICOH 02 Size: 305245MB BusType: 0
22:57:36.149    Disk 0 MBR read successfully
22:57:36.165    Disk 0 MBR scan
22:57:36.180    Disk 0 Windows VISTA default MBR code
22:57:36.227    Disk 0 Partition 1 80 (A) 27 Hidden NTFS WinRE NTFS        11485 MB offset 2048
22:57:36.258    Disk 0 Partition 2 00    07    HPFS/NTFS NTFS      293758 MB offset 23523328
22:57:36.274    Disk 0 scanning sectors +625140400
22:57:36.352    Disk 0 malicious Win32:MBRoot code @ sector 625140403 !
22:57:36.367    Disk 0 PE file @ sector 625140425 !
22:57:36.477    Disk 0 scanning C:\Windows\system32\drivers
22:58:00.469    Service scanning
22:58:02.263    Modules scanning
22:58:10.828    Disk 0 trace - called modules:
22:58:10.859   
22:58:12.591    AVAST engine scan C:\Windows
22:58:14.962    File: C:\Windows\PEV.exe  **INFECTED** Win32:Rootkit-gen [Rtk]
22:58:46.491    AVAST engine scan C:\Windows\system32
23:01:44.281    AVAST engine scan C:\Windows\system32\drivers
23:02:06.589    AVAST engine scan C:\Users\Schatzipu
00:25:07.700    AVAST engine scan C:\ProgramData
00:49:54.215    Scan finished successfully
06:49:55.735    Disk 0 MBR has been saved successfully to "C:\Users\Schatzipu\Desktop\MBR.dat"
06:49:55.751    The log file has been saved successfully to "C:\Users\Schatzipu\Desktop\aswMBR.txt"

cosinus 11.01.2012 11:41
Zitat:
22:57:36.274 Disk 0 scanning sectors +625140400
22:57:36.352 Disk 0 malicious Win32:MBRoot code @ sector 625140403 !
22:57:36.367 Disk 0 PE file @ sector 625140425 !
Das sieht schonmal freundlich aus. Die besagten Sektoren zu löschen ist nicht unbedingt erforderlich, können wir aber tun wenn du willst.


Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!


Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Olivia81 12.01.2012 05:51
hi Arne,
würde die Sektoren gerne löschen.
hat zwar ein wenig gedauert, aber hier sind die Logs

Code:
Malwarebytes Anti-Malware 1.60.0.1800
www.malwarebytes.org

Datenbank Version: v2012.01.11.03

Windows Vista Service Pack 1 x86 NTFS
Internet Explorer 8.0.6001.19019
Schatzipu :: SCHATZIPU-PC [Administrator]

11.01.2012 13:10:22
mbam-log-2012-01-11 (13-10-22).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 423582
Laufzeit: 3 Stunde(n), 36 Minute(n), 49 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
Code:
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 01/11/2012 at 08:40 PM

Application Version : 5.0.1142

Core Rules Database Version : 8121
Trace Rules Database Version: 5933

Scan type      : Complete Scan
Total Scan Time : 03:40:15

Operating System Information
Windows Vista Home Premium 32-bit, Service Pack 1 (Build 6.00.6001)
UAC On - Administrator

Memory items scanned      : 891
Memory threats detected  : 0
Registry items scanned    : 38822
Registry threats detected : 0
File items scanned        : 191817
File threats detected    : 11

Adware.Tracking Cookie
        C:\Users\Schatzipu\AppData\Roaming\Microsoft\Windows\Cookies\schatzipu@ads.immobilienscout24[1].txt [ /ads.immobilienscout24 ]
        C:\Users\Schatzipu\AppData\Roaming\Microsoft\Windows\Cookies\schatzipu@doubleclick[1].txt [ /doubleclick ]
        C:\USERS\GAST\AppData\Roaming\Microsoft\Windows\Cookies\gast@advertise[1].txt [ Cookie:gast@advertise.com/ ]
        C:\USERS\GAST\AppData\Roaming\Microsoft\Windows\Cookies\gast@apmebf[1].txt [ Cookie:gast@apmebf.com/ ]
        C:\USERS\GAST\AppData\Roaming\Microsoft\Windows\Cookies\gast@sonyeurope.112.2o7[1].txt [ Cookie:gast@sonyeurope.112.2o7.net/ ]
        C:\USERS\GAST\Cookies\gast@advertise[1].txt [ Cookie:gast@advertise.com/ ]
        C:\USERS\GAST\Cookies\gast@apmebf[1].txt [ Cookie:gast@apmebf.com/ ]
        C:\USERS\GAST\Cookies\gast@sonyeurope.112.2o7[1].txt [ Cookie:gast@sonyeurope.112.2o7.net/ ]
        C:\USERS\GAST\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\GAST@MEDIA6DEGREES[1].TXT [ /MEDIA6DEGREES ]
        cdn5.specificclick.net [ C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\G9M6ZF52 ]

Trojan.Agent/Gen-SoftonicDownloader
        C:\USERS\SCHATZIPU\DOWNLOADS\SOFTONICDOWNLOADER_FUER_GIMP.EXE
Code:
ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK

Grüße,
Olivia

cosinus 12.01.2012 07:50
Zitat:
würde die Sektoren gerne löschen.
Kommst du noch in PartedMagic rein, von der CD booten?

ESET Hast du falsch ausgeführt, so muss es gemacht werden: Anmerkung für Vista und Win7 User: Bitte den Browser unbedingt als Administrator starten.

Olivia81 12.01.2012 15:19
hier einmal esset, parted magic prüf ich gleich.
Code:
ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
esets_scanner_update returned -1 esets_gle=53251
# version=7
# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=12e274edd79ce84d80e4b1c881e9cbb1
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-01-12 12:43:05
# local_time=2012-01-12 01:43:05 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.0.6001 NT Service Pack 1
# compatibility_mode=512 16777215 100 0 26051351 26051351 0 0
# compatibility_mode=1792 16777215 100 0 1952748 1952748 0 0
# compatibility_mode=5892 16776573 100 100 0 163891140 0 0
# compatibility_mode=8192 67108863 100 0 433190 433190 0 0
# scanned=221899
# found=3
# cleaned=0
# scan_time=13794
C:\Program Files\GridinSoft Trojan Killer\trojankiller.exe        a variant of Win32/1AntiVirus application (unable to clean)        00000000000000000000000000000000        I
C:\Users\Schatzipu\Desktop\trojankiller2116-setup.exe        a variant of Win32/1AntiVirus application (unable to clean)        00000000000000000000000000000000        I
C:\Users\Schatzipu\Downloads\SoftonicDownloader_fuer_gimp.exe        a variant of Win32/SoftonicDownloader.A application (unable to clean)        00000000000000000000000000000000        I

cosinus 12.01.2012 15:24
TrojanerKiller kannste deinstalliern, das braucht man nicht.
Die beiden Setups trojankiller2116-setup.exe und SoftonicDownloader_fuer_gimp.exe einfach löschen

Olivia81 12.01.2012 16:16
hallo Arne,
habe alles gelöscht, in PartedMagic komme ich leider nicht mehr rein - erhalte nach wie vor die selbe Fehlermeldung.
Grüße,
Olivia

cosinus 12.01.2012 18:25
Ich kann mir einfach nicht vorstellen, dass das nun nicht mehr funktionieren soll.
Was machst du nun anders? Wie genau bootest du? Hier von Option 1 oder nimmst du als Sprache Deutsch? (Language => German)

http://images.netzwelt.de/thumb/9/20...rted-magic.jpg

Olivia81 12.01.2012 19:09
Liste der Anhänge anzeigen (Anzahl: 1)
hallo Arne,
habe immer Option 1 ausgewaehlt, funktionierte trotzdem nicht, habe daher die CD nochmals gebrannt. Hat geklappt, anbei ein Screenshot von GParted.
Gruesse,
Olivia81

cosinus 12.01.2012 20:18
So ganz wichtig. Versuch mal aus dem unzugeordneten 1MB-Happen eine Partition zu erstellen. Dateisystem ist egal, nimm mal am besten FAT. Übernimm das ganze und schließe die Aktion ab.
Beende GParted und öffne es wieder (du musst NICHT den Rechner neu von der CD booten!)
Mach wieder einen neuen Screenshot und poste den


Alle Zeitangaben in WEZ +1. Es ist jetzt 02:01 Uhr.
Seite 5 von 7 « Erste 34 5 67
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131