| moondivers | 29.05.2010 00:13 |
Antispyware Soft entfernen unter Windows 7
Hallo,
irgendwie habe ich mir heute "Antispyware Soft" ein Scheinantivirenprogramm eingefangen. Nach Anleitungen hier im Board habe ich es soweit es geht entfernt. Mir ist es gelungen, den Autostart zu deaktivieren, sodass ich zuerst Avira und dann Malwarebytes installieren konnte.
Aber irgendwie ist der Virus noch nicht ganz weg, obwohl viele Datein entfernt wurden, in der msconfig werden immer noch deaktivierte Prozesse angezeigt, die vorher der Virus waren.
Hier das Logfile von Malwarebytes: Code:
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org
Datenbank Version: 4152
Windows 6.1.7600
Internet Explorer 8.0.7600.16385
29.05.2010 00:52:14
mbam-log-2010-05-29 (00-52-14).txt
Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 128998
Laufzeit: 3 Minute(n), 50 Sekunde(n)
Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 1
Infizierte Registrierungsschlüssel: 16
Infizierte Registrierungswerte: 3
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 13
Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule:
C:\Windows\SysWOW64\fmjveetd.dll (Adware.EZlife) -> Delete on reboot.
Infizierte Registrierungsschlüssel:
HKEY_CLASSES_ROOT\cscrptxt.cscrptxt (Adware.EZlife) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{2d5cf11b-49f4-4f42-a4fa-4a8394a29c27} (Adware.EZlife) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{2d5cf11b-49f4-4f42-a4fa-4a8394a29c27} (Adware.EZlife) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{2d5cf11b-49f4-4f42-a4fa-4a8394a29c27} (Adware.EZlife) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2d5cf11b-49f4-4f42-a4fa-4a8394a29c27} (Adware.EZlife) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{e0ec6fba-f009-3535-95d6-b6390db27da1} (Adware.EZlife) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\cscrptxt.cscrptxt.1.0 (Adware.EZlife) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{38061edc-40bb-4618-a8da-e56353347e6d} (Adware.EZlife) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\adshothlpr.adshothlpr (Adware.Adrotator) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\adshothlpr.adshothlpr.1.0 (Adware.Adrotator) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\avsoft (Trojan.Fraudpack) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\avsuite (Rogue.AntivirusSuite) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\M5T8QL3YW3 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Handle (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\QZAIB7KITK (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> Quarantined and deleted successfully.
Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\winid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\m5t8ql3yw3 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cilifncdxiraiwb (Trojan.Agent) -> Quarantined and deleted successfully.
Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)
Infizierte Dateien:
C:\Windows\SysWOW64\fmjveetd.dll (Adware.EZlife) -> Delete on reboot.
C:\Users\Admin\AppData\Local\Temp\ecpaagh.exe (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\Users\Admin\AppData\Local\Temp\wcernomsax.exe (Rootkit.Dropper) -> Quarantined and deleted successfully.
C:\Users\Admin\AppData\Local\Temp\~TM3BBC.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Users\Admin\AppData\Local\Temp\jisfije9fjoiee.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Users\Admin\AppData\Local\Temp\taskmgr.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Users\Admin\AppData\Local\Temp\win16.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\Admin\AppData\Local\Temp\win32.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Users\Admin\oashdihasidhasuidhiasdhiashdiuasdhasd (Malware.Trace) -> Quarantined and deleted successfully.
C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Windows\Tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Users\Admin\AppData\Local\Temp\Plx.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Windows\System32\eeslrdmshngywnule.dll (Trojan.Agent) -> Delete on reboot.
Und hier OTL: Code:
========== Files - Modified Within 1 Day ==========
[2010.05.29 01:08:55 | 003,670,016 | -HS- | M] () -- C:\Users\Admin\NTUSER.DAT
[2010.05.29 01:01:12 | 000,010,896 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2010.05.29 01:01:12 | 000,010,896 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2010.05.29 00:53:45 | 000,001,102 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010.05.29 00:53:36 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010.05.29 00:53:30 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.05.29 00:53:14 | 3220,627,456 | -HS- | M] () -- C:\hiberfil.sys
[2010.05.29 00:52:38 | 011,433,405 | -H-- | M] () -- C:\Users\Admin\AppData\Local\IconCache.db
[2010.05.29 00:47:07 | 000,001,013 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.05.29 00:34:00 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010.05.28 21:51:02 | 000,002,070 | ---- | M] () -- C:\Users\Public\Desktop\Avira AntiVir Control Center.lnk
[2010.05.28 21:42:20 | 001,472,002 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2010.05.28 21:42:20 | 000,643,628 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2010.05.28 21:42:20 | 000,606,992 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2010.05.28 21:42:20 | 000,126,188 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2010.05.28 21:42:20 | 000,103,370 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2010.05.28 21:09:21 | 000,050,981 | ---- | M] () -- C:\Windows\SysWow64\ngziwjfrpujijto.exe
[2010.05.28 21:09:16 | 000,000,209 | --S- | M] () -- C:\Users\Admin\AppData\Local\3317512929.dat
[5 C:\Users\Admin\Desktop\*.tmp files -> C:\Users\Admin\Desktop\*.tmp -> ]
[4 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]
========== Files Created - No Company Name ==========
[2010.05.29 00:47:07 | 000,001,013 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.05.28 21:51:02 | 000,002,070 | ---- | C] () -- C:\Users\Public\Desktop\Avira AntiVir Control Center.lnk
[2010.05.28 21:09:21 | 000,050,981 | ---- | C] () -- C:\Windows\SysWow64\ngziwjfrpujijto.exe
[2010.05.28 21:08:15 | 000,000,209 | --S- | C] () -- C:\Users\Admin\AppData\Local\3317512929.dat
Ich hoffe ich habe beim OTL Log nichts vergessen!
Ich wäre dankbar, wenn sich jemand anschauen könnte, ob mein Rechner noch infiziert ist.
LG
moondivers |
