Trojaner/Hijacker? Kriege "kbdbob.dll" nicht gelöscht

#1 Hallo!

"HijackThis" war schon sehr hilfreich, ebenso wie einige postings, vielen Dank!!

Leider erscheint immer noch eine Virus-Warnmeldung von Norton, bei sämtlichen Suchfunktionen ist es aber nicht zu finden:
C:\windows\System32\kbdbob.dll

Außerdem kann ich momentan den "CWShredder" nicht herunterladen (?)

Hier mein log, kann mir jemand helfen?

Logfile of HijackThis v1.98.2
Scan saved at 13:41:23, on 17.09.2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\windows\Explorer.EXE
C:\windows\system32\spoolsv.exe
C:\Program Files\FU Hagen\FU Client\cvpnd.exe
C:\Programme\Norton AntiVirus\navapsvc.exe
C:\windows\System32\svchost.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
C:\windows\System32\ctfmon.exe
C:\Programme\OpenOffice.org1.0\program\soffice.exe
C:\Programme\Outlook Express\msimn.exe
C:\Programme\Messenger\msmsgs.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Dokumente und Einstellungen\Besitzer.USER-OKEW0ZWC8M\Eigene Dateien\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.spiegel.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.spiegel.de
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.spiegel.de/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Tiscali Internet Explorer
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ftp=home.tiscali.dk;gopher=proxy.tiscali.dk;http=proxy.tiscali.dk:8080;https=proxy.tiscali.dk
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programme\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programme\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: (no name) - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - (no file)
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Programme\Winamp3\winampa.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\windows\System32\ctfmon.exe
O4 - Startup: OpenOffice.org 1.0.lnk = C:\Programme\OpenOffice.org1.0\program\quickstart.exe
O4 - Global Startup: FernUniHagen FU Client.lnk = C:\Program Files\FU Hagen\FU Client\vpngui.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE
O14 - IERESET.INF: START_PAGE_URL=http://www.tiscali.dk
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O20 - AppInit_DLLs: C:\windows\System32\kbdbob.dll

Vielen Dank

#2 Hallo@grainne

Fixe mit dem HijackThis:
O3 - Toolbar: (no name) - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - (no file)


#FindnFix:
http://www10.brinkster.com/expl0iter/freeatlast/FNF/
1. Entpacken
2. !LOG!.BAT anklicken
3. Log(log.txt) abkopieren und posten (ohne Admin-Namen und andere private Angaben des OS)

.........................................................................................................
#Gehe in die Registry
Start<Ausfuehren<regedit
Navegiere zu diesem Schluessel:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
falls der Wert: "AppInit_DLLs :kbdbob.dll ist, bitte rechts von der Registry loeschen

schliesse die Registry

#Start<Ausfuehren< (reinkopieren)
regsvr32 /u [systemroot]\C:\windows\System32\kbdbob.dll
regsvr32 /u c:\system32\C:\windows\System32\kbdbob.dll

neustarten

#Loesche:
C:\windows\System32\kbdbob.dll
.........................................................................................................

#Das eScan AV Toolkit (mwav.exe) herunterladen,
http://www.mwti.net/antivirus/free_utilities.asp

die Datei in den Ordner "c:\base" (wichtig !) entpacken und danach die "kavupd.exe" (Update) ausführen.

Abgesicherter Modus
http://www.bsi.de/av/texte/winsave.htm

#und den Scanner mit der "mwav.exe" starten. Alle Häkchen setzen und "Scan clean" klicken.

#Dann noch einmal im Normalmodus mit mwav.exe scannen und posten,was als <deleted< und <renamed< und <no action taken< gefunden wurde und das neue Log vom HijackThis

mfg
Sabina
__________
MfG Sabina

rund um die PC-Sicherheit

#3 Hallo Sabina!
Vielen Dank schon einmal! Hatte einiges probiert, dann ging es eine zeitlang ganz gut... aber anscheinend hatte ich ihn nicht ganz wegbekommen :-(

Im Registry ist kbdbob nicht mehr!

HijackThis kann auch nichts mehr finden; Spybot auch nicht - aber wir bekommen eine zusätzliche andere Warnmeldung:
"Schädlicher Code in Datei C:\DOKUMENTE UND EINSTELLUNGEN\BESITZER...\LOKALE EINSTELLUNGEN\TEMP\ISTACTIVEX.0XE gefunden. Infektion: TrojanDownloader.Win32.IstBar.ao Aktion: Fehlgeschlagen"

Hier nun der log von FindnFix; hoffe, Du oder jemand anderes kann etwas damit anfangen!

Vielen Dank auch noch einmal :-)!

***YOU NEED TO DISABLE YOUR ACTIVE ANTI VIRUS PROTECTION TO AVOID CONFLICTS!***
______________________________________________________________________________

......Scanning for file(s)...
*Note! The list(s) may include legitimate files!
»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»

»»»»» (*1*) »»»»» .........
»»Read access error(s)...

C:\WINDOWS\SYSTEM32\KBDBOB.DLL +++ File read error
\\?\C:\windows\System32\KBDBOB.DLL +++ File read error

»»»»» (*2*) »»»»»........
KBDBOB.DLL Can't Open!

»»»»» (*3*) »»»»»........

No matches found.

unknown/hidden files...

No matches found.

»»»»» (*4*) »»»»».........
Sniffing..........
Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.

SNiF 1.34 statistics

Matching files : 0 Amount in bytes : 0
Directories searched : 1 Commands executed : 0

Masks sniffed for: *.DLL

»»»»»(*5*)»»»»»
¯ Access denied ® ..................... KBDBOB.DLL .....57344 26.06.2004

»»»»»(*6*)»»»»»
fgrep: can't open input C:\WINDOWS\SYSTEM32\KBDBOB.DLL

»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»
»»»»»Search by size...
*List of files and specs according to 'size' :
*Note: Not all files listed here are infected, but *may include* the
name and spces of the offending file...
___________________________________________________________________________
Path: C:\WINDOWS\SYSTEM32 Including: *.DLL

410. Kbdbob Dll 57,344 . . . . . 6-26-04 4:54 pm
609. Msasn1 Dll 57,344 . . . . A 8-04-04 8:57 am
635. Mshtmler Dll 57,344 . . . . A 8-04-04 8:55 am
188. Dmloader Dll 35,840 . . . . A 8-04-04 8:57 am
339. Imgutil Dll 35,840 . . . . A 8-04-04 8:57 am
213. Dpvacm Dll 21,504 . . . . A 8-04-04 8:57 am
261. Feclient Dll 21,504 . . . . A 8-04-04 8:57 am

____________________________________________________________________________
*By size and date...


C:\WINDOWS\SYSTEM32\
kbdbob.dll Sat 26 Jun 2004 16:54:02 ..... 57.344 56,00 K
msasn1.dll Wed 4 Aug 2004 8:57:24 A.... 57.344 56,00 K
mshtmler.dll Wed 4 Aug 2004 8:55:32 A.... 57.344 56,00 K

3 items found: 3 files, 0 directories.
Total of file sizes: 172.032 bytes 168,00 K

C:\WINDOWS\SYSTEM32\
dmloader.dll Wed 4 Aug 2004 8:57:18 A.... 35.840 35,00 K
imgutil.dll Wed 4 Aug 2004 8:57:22 A.... 35.840 35,00 K

2 items found: 2 files, 0 directories.
Total of file sizes: 71.680 bytes 70,00 K

C:\WINDOWS\SYSTEM32\
dpvacm.dll Wed 4 Aug 2004 8:57:18 A.... 21.504 21,00 K
feclient.dll Wed 4 Aug 2004 8:57:18 A.... 21.504 21,00 K

2 items found: 2 files, 0 directories.
Total of file sizes: 43.008 bytes 42,00 K

Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.

Sniffed -> C:\WINDOWS\SYSTEM32\KBDBOB.DLL
Sniffed -> C:\WINDOWS\SYSTEM32\MSASN1.DLL
Sniffed -> C:\WINDOWS\SYSTEM32\MSHTMLER.DLL
SNiF 1.34 statistics

Matching files : 3 Amount in bytes : 172032
Directories searched : 1 Commands executed : 0

Masks sniffed for: *.DLL
Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.

Sniffed -> C:\WINDOWS\SYSTEM32\DMLOADER.DLL
Sniffed -> C:\WINDOWS\SYSTEM32\IMGUTIL.DLL
SNiF 1.34 statistics

Matching files : 2 Amount in bytes : 71680
Directories searched : 1 Commands executed : 0

Masks sniffed for: *.DLL
Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.

Sniffed -> C:\WINDOWS\SYSTEM32\DPVACM.DLL
Sniffed -> C:\WINDOWS\SYSTEM32\FECLIENT.DLL
SNiF 1.34 statistics

Matching files : 2 Amount in bytes : 43008
Directories searched : 1 Commands executed : 0

Masks sniffed for: *.DLL

»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»


BHO search and other files...

fgrep: can't open input C:\WINDOWS\SYSTEM32\KBDBOB.DLL


No matches found.

No matches found.

--*sp.html in temp folder was NOT FOUND!--

*Filter keys search...
REGDMP: Unable to open key 'HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/html' (2)

--(*text/html Subkey was NOT FOUND!)--

REGDMP: Unable to open key 'HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/plain' (2)

--(*text/plain Subkey was NOT FOUND!)--

»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»
»»Size of Windows key:
(*Default-450 *No AppInit-398 *fake(infected)-448,504,512...)

Size of HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Windows: 448

»»Checking for AppInit_DLLs (empty) value...
________________________________
!"AppInit_DLLs"=""!

Value does not match
________________________________

»»Comparing *saved* key with *original*...

REGDIFF 2.1 - Freeware written by Gerson Kurz (http://www.p-nand-q.com)

Comparing File #1 (Keys1\winkey.reg) with File #2 (HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows).

Value "AppInit_DLLs" in key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" has different lengths (1 vs 31)

»»Dumping Values........
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\DeviceNotSelectedTimeout SZ 15
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\GDIProcessHandleQuota DWORD 00002710
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Spooler SZ yes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\swapdisk SZ
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\TransmissionRetryTimeout SZ 90
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\USERProcessHandleQuota DWORD 00002710
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs SZ

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
DeviceNotSelectedTimeout = 15
GDIProcessHandleQuota = REG_DWORD 0x00002710
Spooler = yes
swapdisk =
TransmissionRetryTimeout = 90
USERProcessHandleQuota = REG_DWORD 0x00002710
AppInit_DLLs = (*** MISSING TRAILING NULL CHARACTER ***)

»»Security settings for 'Windows' key:


RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows:
(ID-NI) ALLOW Read VORDEFINIERT\Benutzer
(ID-IO) ALLOW Read VORDEFINIERT\Benutzer
(ID-NI) ALLOW Full access VORDEFINIERT\Administratoren
(ID-IO) ALLOW Full access VORDEFINIERT\Administratoren
(ID-NI) ALLOW Full access NT-AUTORITŽT\SYSTEM
(ID-IO) ALLOW Full access NT-AUTORITŽT\SYSTEM
(ID-IO) ALLOW Full access ERSTELLER-BESITZER

Effective permissions for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows:
Read VORDEFINIERT\Benutzer
Full access VORDEFINIERT\Administratoren
Full access NT-AUTORITŽT\SYSTEM



»»Performing string scan....
00001150: vk UDeviceNotSelecte
00001190:dTimeout 1 5 _ h vk ' zGDIProce
000011D0:ssHandleQuota" 9 0 ( vk Spooler2
00001210: y e s vk =pswapdisk h
00001250: X vk R TransmissionRetryTimeout vk
00001290: ' USERProcessHandleQuota h X
000012D0: vk > s AppInit_DLLsm 3 C : \ w i n
00001310:d o w s \ S y s t e m 3 2 \ k b d b o b . d l l - 1 7
00001350:
00001390:
000013D0:
00001410:
00001450:
00001490:
000014D0:
00001510:
00001550:
00001590:
000015D0:

---------- WIN.TXT
AppInit_DLLsm
--------------
--------------
$0117F: UDeviceNotSelectedTimeout
$011C7: zGDIProcessHandleQuota
$01270: TransmissionRetryTimeout
$012A0: USERProcessHandleQuota
$012F0: AppInit_DLLsm
--------------
--------------
C:\windows\System32\kbdbob.dll
--------------
--------------
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"DeviceNotSelectedTimeout"="15"
"GDIProcessHandleQuota"=dword:00002710
"Spooler"="yes"
"swapdisk"=""
"TransmissionRetryTimeout"="90"
"USERProcessHandleQuota"=dword:00002710
"AppInit_DLLs"=""

.............
A handle was successfully obtained for the
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows key.
This key has 0 subkeys.
The AppInitDLLs value exists and reports as 62 bytes, including the 2 for string termination.

[AppInitDLLs]
Ansi string : "C:\windows\System32\kbdbob.dll"
0000 43 00 3a 00 5c 00 77 00 69 00 6e 00 64 00 6f 00 | C.:.\.w.i.n.d.o.
0010 77 00 73 00 5c 00 53 00 79 00 73 00 74 00 65 00 | w.s.\.S.y.s.t.e.
0020 6d 00 33 00 32 00 5c 00 6b 00 62 00 64 00 62 00 | m.3.2.\.k.b.d.b.
0030 6f 00 62 00 2e 00 64 00 6c 00 6c 00 00 00 | o.b...d.l.l...
-----------------------

»»»»»»Backups list...»»»»»»
15:15:15 up 0 days, 2:48:20
-----------------------
Tue 02 Nov 04 15:15:15


C:\FINDNFIX\
keyback.hiv Tue 2 Nov 2004 15:12:14 A.... 8.192 8,00 K

1 item found: 1 file, 0 directories.
Total of file sizes: 8.192 bytes 8,00 K

C:\FINDNFIX\KEYS1\
winkey.reg Tue 2 Nov 2004 15:12:16 A.... 287 0,28 K

1 item found: 1 file, 0 directories.
Total of file sizes: 287 bytes 0,28 K

*Temp backups...

"C:\Dokumente und Einstellungen\Besitzer.USER-OKEW0ZWC8M\Lokale Einstellungen\Temp\Backs2\"
keyback2.hi_ 2 Nov 2004 8192 "keyback2.hi_"
winkey2.re_ 2 Nov 2004 287 "winkey2.re_"

2 items found: 2 files, 0 directories.
Total of file sizes: 8.479 bytes 8,28 K
-D---- JUNKXXX 00000000 15:12.14 02/11/2004
A----- STARTIT .BAT 00000060 15:12.14 02/11/2004

-----END------

#4 Versuch es damit, schreibe, ob es was gefunden/geloescht hat und poste ein neues Log.
http://securityresponse.symantec.com/avcenter/venc/data/backdoor.agent.b.removal.tool.html
__________
MfG Ralf
SEO-Spam Hunter

#5 Hallo@grainne

Wenn das Entfernungstool nichts bringt, mache folgendes:

leere folgende Ordner (nicht die Ordner selbst loeschen)
C:\Dokumente und Einstellungen\Default User\Lokale Einstellungen\Temporary Internet Files\*.*
C:\Dokumente und Einstellungen\Default User\Lokale Einstellungen\Temporary Internet Files\Content.IE5\*.*

C:\DOKUMENTE UND EINSTELLUNGEN\BESITZER...\LOKALE EINSTELLUNGEN\TEMP\ISTACTIVEX.0XE

Oeffne das HijackThis:
HijackThis<Config<Misc Tools<Delete a file on reboot< reinkopieren:
C:\WINDOWS\SYSTEM32\KBDBOB.DLL
PC neustarten

mfg
Sabina
__________
MfG Sabina

rund um die PC-Sicherheit

#6 Hallo @Ralf!

Vielen Dank! Hat tatsächlich einen "Backdoor.Agent.B" Virus gefunden und gelöscht (beim 2. Durchlauf nach restart des Computers nichts mehr!)
Unten der neue log.

Hallo @Sabina
Auch Dir vielen Dank!
Habe leider "Default User" nicht gefunden - dafür ist aber
C:\DOKUMENTE UND EINSTELLUNGEN\BESITZER...\LOKALE EINSTELLUNGEN\TEMP\
leer

HijackThis habe ich noch nicht gemacht - wollte erst einmal Eure Meinung zu den anderen Sachen hören...

Hier der log aus FindnFix:

»»»»» (*1*) »»»»» .........
»»Read access error(s)...


»»»»» (*2*) »»»»»........

»»»»» (*3*) »»»»»........

No matches found.

unknown/hidden files...

No matches found.

»»»»» (*4*) »»»»».........
Sniffing..........
Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.

SNiF 1.34 statistics

Matching files : 0 Amount in bytes : 0
Directories searched : 1 Commands executed : 0

Masks sniffed for: *.DLL

»»»»»(*5*)»»»»»

»»»»»(*6*)»»»»»

»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»
»»»»»Search by size...
*List of files and specs according to 'size' :
*Note: Not all files listed here are infected, but *may include* the
name and spces of the offending file...
___________________________________________________________________________
Path: C:\WINDOWS\SYSTEM32 Including: *.DLL

608. Msasn1 Dll 57,344 . . . . A 8-04-04 8:57 am
634. Mshtmler Dll 57,344 . . . . A 8-04-04 8:55 am
188. Dmloader Dll 35,840 . . . . A 8-04-04 8:57 am
339. Imgutil Dll 35,840 . . . . A 8-04-04 8:57 am
213. Dpvacm Dll 21,504 . . . . A 8-04-04 8:57 am
261. Feclient Dll 21,504 . . . . A 8-04-04 8:57 am

____________________________________________________________________________
*By size and date...


C:\WINDOWS\SYSTEM32\
msasn1.dll Wed 4 Aug 2004 8:57:24 A.... 57.344 56,00 K
mshtmler.dll Wed 4 Aug 2004 8:55:32 A.... 57.344 56,00 K

2 items found: 2 files, 0 directories.
Total of file sizes: 114.688 bytes 112,00 K

C:\WINDOWS\SYSTEM32\
dmloader.dll Wed 4 Aug 2004 8:57:18 A.... 35.840 35,00 K
imgutil.dll Wed 4 Aug 2004 8:57:22 A.... 35.840 35,00 K

2 items found: 2 files, 0 directories.
Total of file sizes: 71.680 bytes 70,00 K

C:\WINDOWS\SYSTEM32\
dpvacm.dll Wed 4 Aug 2004 8:57:18 A.... 21.504 21,00 K
feclient.dll Wed 4 Aug 2004 8:57:18 A.... 21.504 21,00 K

2 items found: 2 files, 0 directories.
Total of file sizes: 43.008 bytes 42,00 K

Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.

Sniffed -> C:\WINDOWS\SYSTEM32\MSASN1.DLL
Sniffed -> C:\WINDOWS\SYSTEM32\MSHTMLER.DLL
SNiF 1.34 statistics

Matching files : 2 Amount in bytes : 114688
Directories searched : 1 Commands executed : 0

Masks sniffed for: *.DLL
Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.

Sniffed -> C:\WINDOWS\SYSTEM32\DMLOADER.DLL
Sniffed -> C:\WINDOWS\SYSTEM32\IMGUTIL.DLL
SNiF 1.34 statistics

Matching files : 2 Amount in bytes : 71680
Directories searched : 1 Commands executed : 0

Masks sniffed for: *.DLL
Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.

Sniffed -> C:\WINDOWS\SYSTEM32\DPVACM.DLL
Sniffed -> C:\WINDOWS\SYSTEM32\FECLIENT.DLL
SNiF 1.34 statistics

Matching files : 2 Amount in bytes : 43008
Directories searched : 1 Commands executed : 0

Masks sniffed for: *.DLL

»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»


BHO search and other files...



No matches found.

No matches found.

--*sp.html in temp folder was NOT FOUND!--

*Filter keys search...
REGDMP: Unable to open key 'HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/html' (2)

--(*text/html Subkey was NOT FOUND!)--

REGDMP: Unable to open key 'HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/plain' (2)

--(*text/plain Subkey was NOT FOUND!)--

»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»
»»Size of Windows key:
(*Default-450 *No AppInit-398 *fake(infected)-448,504,512...)

Size of HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Windows: 450

»»Checking for AppInit_DLLs (empty) value...
________________________________
!"AppInit_DLLs"=""!

Value Matches
________________________________

»»Comparing *saved* key with *original*...

REGDIFF 2.1 - Freeware written by Gerson Kurz (http://www.p-nand-q.com)

Comparing File #1 (Keys1\winkey.reg) with File #2 (HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows).

No differences found.

»»Dumping Values........
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\DeviceNotSelectedTimeout SZ 15
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\GDIProcessHandleQuota DWORD 00002710
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Spooler SZ yes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\swapdisk SZ
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\TransmissionRetryTimeout SZ 90
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\USERProcessHandleQuota DWORD 00002710
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs SZ

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
DeviceNotSelectedTimeout = 15
GDIProcessHandleQuota = REG_DWORD 0x00002710
Spooler = yes
swapdisk =
TransmissionRetryTimeout = 90
USERProcessHandleQuota = REG_DWORD 0x00002710
AppInit_DLLs =

»»Security settings for 'Windows' key:


RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows:
(ID-NI) ALLOW Read VORDEFINIERT\Benutzer
(ID-IO) ALLOW Read VORDEFINIERT\Benutzer
(ID-NI) ALLOW Full access VORDEFINIERT\Administratoren
(ID-IO) ALLOW Full access VORDEFINIERT\Administratoren
(ID-NI) ALLOW Full access NT-AUTORITŽT\SYSTEM
(ID-IO) ALLOW Full access NT-AUTORITŽT\SYSTEM
(ID-IO) ALLOW Full access ERSTELLER-BESITZER

Effective permissions for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows:
Read VORDEFINIERT\Benutzer
Full access VORDEFINIERT\Administratoren
Full access NT-AUTORITŽT\SYSTEM



»»Performing string scan....
00001150: vk UDeviceNotSelecte
00001190:dTimeout 1 5 _ h vk ' zGDIProce
000011D0:ssHandleQuota" 9 0 ( vk Spooler2
00001210: y e s vk =pswapdisk h
00001250: X vk R TransmissionRetryTimeout vk
00001290: ' USERProcessHandleQuota h X
000012D0: vk > s AppInit_DLLsm 3 C : \ w i n
00001310:d o w s \ S y s t e m 3 2 \ k b d b o b . d l l - 1 7
00001350:
00001390:
000013D0:
00001410:
00001450:
00001490:
000014D0:
00001510:
00001550:
00001590:
000015D0:

---------- WIN.TXT
AppInit_DLLsm
--------------
--------------
$0117F: UDeviceNotSelectedTimeout
$011C7: zGDIProcessHandleQuota
$01270: TransmissionRetryTimeout
$012A0: USERProcessHandleQuota
$012F0: AppInit_DLLsm
--------------
--------------
C:\windows\System32\kbdbob.dll
--------------
--------------
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"DeviceNotSelectedTimeout"="15"
"GDIProcessHandleQuota"=dword:00002710
"Spooler"="yes"
"swapdisk"=""
"TransmissionRetryTimeout"="90"
"USERProcessHandleQuota"=dword:00002710
"AppInit_DLLs"=""

.............
A handle was successfully obtained for the
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows key.
This key has 0 subkeys.
The AppInitDLLs value exists and reports as 2 bytes, including the 2 for string termination.

[AppInitDLLs]
Ansi string : ""
0000 00 00 | ..
-----------------------

»»»»»»Backups list...»»»»»»
08:43:39 up 0 days, 0:49:14
-----------------------
Fri 05 Nov 04 08:43:39


C:\FINDNFIX\
keyback.hiv Tue 2 Nov 2004 15:12:14 A.... 8.192 8,00 K

1 item found: 1 file, 0 directories.
Total of file sizes: 8.192 bytes 8,00 K

C:\FINDNFIX\KEYS1\
winkey.reg Fri 5 Nov 2004 8:39:42 A.... 287 0,28 K

1 item found: 1 file, 0 directories.
Total of file sizes: 287 bytes 0,28 K

*Temp backups...

"C:\Dokumente und Einstellungen\Besitzer.USER-OKEW0ZWC8M\Lokale Einstellungen\Temp\Backs2\"
keyback2.hi_ 2 Nov 2004 8192 "keyback2.hi_"
winkey2.re_ 2 Nov 2004 287 "winkey2.re_"

2 items found: 2 files, 0 directories.
Total of file sizes: 8.479 bytes 8,28 K
-D---- JUNKXXX 00000000 08:39.40 05/11/2004
A----- STARTIT .BAT 00000060 08:39.40 05/11/2004

#7 ...so, habe jetzt auch die Sache mit dem HijackThis und dem "Delete a file on reboot" gemacht. Hoffe, ich bin jetzt endlich alles los!

Viele Grüße von Grainne

#8 Hallo@ Grainne

Ist noch da:
C:\WINDOWS\SYSTEM32\KBDBOB.DLL
___________________________________________________________
mache folgendes:

Gehe in die Registry
Start<Ausfuehren<regedit

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
loesche rechts den Wert:
AppInit_DLLs= KBDBOB.DLL

Start<Ausfuehren<cmd: reinkopieren:
attrib -h %systemroot%\system32\KBDBOB.DLL & ren %systemroot%\SYSTEM32\KBDBOB.DLL Badfile.bad

<enter<
PC neustarten

HijackThis<Config<Misc Tools<Delete a file on reboot< reinkopieren:
C:\WINDOWS\SYSTEM32\KBDBOB.DLL
PC neustarten

#Ueberpruefe mit < FindnFix:< ob die dll geloescht ist.

mfg
Sabina
__________
MfG Sabina

rund um die PC-Sicherheit