Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Ich habe auch TR/Kazy/mekl.1 (https://www.trojaner-board.de/98204-habe-tr-kazy-mekl-1-a.html)

Codexxx 26.04.2011 17:58
Ich habe auch TR/Kazy/mekl.1
 
Hallo,

das System hat heute morgen einen Festplattenfehler fest gestellt und nach einem Neustart verlangt, danach ist alles das Gleiche, wie mit den anderen Betroffenen auch,
-Privatedaten weg (Dank euer Tip mit unhide sind sie wieder da :) )
-Fehlermeldungen, mit Kritischerfehler, private Daten in Gefahr usw....

Hier die Quickscan-Daten:


Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6448

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

26.04.2011 18:39:30
mbam-log-2011-04-26 (18-39-30).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 149369
Laufzeit: 8 Minute(n), 30 Sekunde(n)

Infizierte Speicherprozesse: 1
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 12
Infizierte Registrierungswerte: 2
Infizierte Dateiobjekte der Registrierung: 2
Infizierte Verzeichnisse: 5
Infizierte Dateien: 20

Infizierte Speicherprozesse:
c:\dokumente und einstellungen\all users\anwendungsdaten\jhbhqbuadnkpg.exe (Trojan.FakeAlert) -> 980 -> Unloaded process successfully.

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_CLASSES_ROOT\CLSID\{5c026fd8-4021-75c5-673f-f6b4d1c16a04} (Adware.LoudMo) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127AD2-394B-70F5-C650-B97867BAA1F7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127AD2-394B-70F5-C650-B97867BAA1F7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43BF8CD1-C5D5-2230-7BB2-98F22C2B7DC6} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43BF8CD1-C5D5-2230-7BB2-98F22C2B7DC6} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{494E6CEC-7483-A4EE-0938-895519A84BC7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{494E6CEC-7483-A4EE-0938-895519A84BC7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\FLV Direct Player (Adware.FLVPlayer) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FLV Direct Player (Adware.FLVPlayer) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{475b71ec-0bcb-1ae4-f46f-4f97d9853c64} (Adware.AdRotator) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{475b71ec-0bcb-1ae4-f46f-4f97d9853c64} (Adware.AdRotator) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{475B71EC-0BCB-1AE4-F46F-4F97D9853C64} (Adware.AdRotator) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jhbHQbuAdnkPg (Trojan.FakeAlert) -> Value: jhbHQbuAdnkPg -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\UID (Malware.Trace) -> Value: UID -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoChangingWallPaper (PUM.Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (PUM.Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Infizierte Verzeichnisse:
c:\programme\flv direct player (Adware.BHO.FL) -> Quarantined and deleted successfully.
c:\programme\flv direct player\Skin (Adware.BHO.FL) -> Quarantined and deleted successfully.
c:\programme\flv direct player\Skin\directflv (Adware.BHO.FL) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\startmenü\programme\flv direct player (Adware.FLVPlayer) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\lowsec (Stolen.data) -> Quarantined and deleted successfully.

Infizierte Dateien:
c:\dokumente und einstellungen\all users\anwendungsdaten\jhbhqbuadnkpg.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\k.demirci\eigene dateien\downloads\whitesmokeinstaller_9139.exe (PUP.WhiteSmoke) -> Not selected for removal.
c:\dokumente und einstellungen\k.demirci\lokale einstellungen\Temp\nsn61.tmp\downloads\4040625.ex_ (Adware.FLVPlayer) -> Quarantined and deleted successfully.
c:\programme\flv direct player\downloading.swf (Adware.BHO.FL) -> Quarantined and deleted successfully.
c:\programme\flv direct player\flvplayer.exe (Adware.BHO.FL) -> Quarantined and deleted successfully.
c:\programme\flv direct player\player.swf (Adware.BHO.FL) -> Quarantined and deleted successfully.
c:\programme\flv direct player\preload.swf (Adware.BHO.FL) -> Quarantined and deleted successfully.
c:\programme\flv direct player\uninstall.exe (Adware.BHO.FL) -> Quarantined and deleted successfully.
c:\programme\flv direct player\Skin\directflv\Button.bmp (Adware.BHO.FL) -> Quarantined and deleted successfully.
c:\programme\flv direct player\Skin\directflv\Logo.bmp (Adware.BHO.FL) -> Quarantined and deleted successfully.
c:\programme\flv direct player\Skin\directflv\skin.xml (Adware.BHO.FL) -> Quarantined and deleted successfully.
c:\programme\flv direct player\Skin\directflv\sysclosebutton.bmp (Adware.BHO.FL) -> Quarantined and deleted successfully.
c:\programme\flv direct player\Skin\directflv\sysmaxbutton.bmp (Adware.BHO.FL) -> Quarantined and deleted successfully.
c:\programme\flv direct player\Skin\directflv\sysminbutton.bmp (Adware.BHO.FL) -> Quarantined and deleted successfully.
c:\programme\flv direct player\Skin\directflv\Window.bmp (Adware.BHO.FL) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\startmenü\programme\flv direct player\flv direct player.lnk (Adware.FLVPlayer) -> Quarantined and deleted successfully.
c:\dokumente und einstellungen\all users\startmenü\programme\flv direct player\uninstall flv direct player.lnk (Adware.FLVPlayer) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\lowsec\local.ds (Stolen.data) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\lowsec\user.ds (Stolen.data) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\lowsec\user.ds.lll (Stolen.data) -> Quarantined and deleted successfully.


Grüsse,

Codexxx

Will mir denn keiner helfen :(

cosinus 06.05.2011 11:46
Hallo und :hallo:

Bitte routinemäßig einen Vollscan mit malwarebytes machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!


Danach OTL-Custom:


CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT


Alle Zeitangaben in WEZ +1. Es ist jetzt 12:48 Uhr.

Copyright ©2000-2024, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28