Home » Spyware & Browser Hijacker Support Forum » WARNING!Win32/Adware.Virtumonde detected on you computer-brauche Hilfe! » Themenansicht
WARNING!Win32/Adware.Virtumonde detected on you computer-brauche Hilfe!Thema ist geschlossen! |
||
|---|---|---|
Thema ist geschlossen! |
||
| #0
| ||
|
20.09.2008, 15:17
Ehrenmitglied
 Beiträge: 6028 |
||
 
|
|
|
|
20.09.2008, 21:20
Member
Beiträge: 50 |
#32
Hi und danke für die antwort...sorry das sich jetzt erst schreibe aber mittlerweile war hier di ekacke am dampfen...siehe threat vorher....konnt irgendwann weder mozilla nog explorer nutzen und dann hat sich mein pc ausgeschaltet und lies sich nicht mehr einschalten jetzt gings plötzlich wieder hab dann sofort maleware quick durchscannen lassen der hat auch mal gleich 25 objecte gefunden...hab die gelöscht...so dann hab ich noch CCleaner gemacht danach hijackthis und dann nochmal malwarebytes - hab die logfiles hier drunter gesetzt. danach kommen der Reihe nach die URLs der analysierten dateien:
ComboFix 08-09-19.09 - RAK 2008-10-20 20:02:04.4 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.45.1033.18.1049 [GMT 2:00] Running from: C:\Documents and Settings\RAK\Desktop\ComboFix.exe [color=red]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/color] . - REDUCED FUNCTIONALITY MODE - . ((((((((((((((((((((((((( Files Created from 2008-09-20 to 2008-10-20 ))))))))))))))))))))))))))))))) . 2008-10-20 18:54 . 2008-09-12 14:24 <DIR> d---s---- C:\Documents and Settings\RAK\Application Data\Microsoft 2008-10-20 11:39 . 2008-10-20 11:39 <DIR> d-------- C:\Program Files\CCleaner 2008-10-19 21:58 . 2008-10-19 21:58 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-10-19 21:58 . 2008-10-19 21:58 <DIR> d-------- C:\Documents and Settings\RAK\Application Data\Malwarebytes 2008-10-19 21:58 . 2008-10-19 21:58 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-10-19 21:58 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys 2008-10-19 21:58 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-10-19 20:22 . 2008-10-19 20:22 <DIR> d-------- C:\Documents and Settings\RAK\Application Data\.clamwin 2008-10-19 20:21 . 2008-10-19 20:21 <DIR> d-------- C:\Program Files\ClamWin 2008-10-19 20:21 . 2008-10-19 20:21 <DIR> d-------- C:\Documents and Settings\All Users\.clamwin 2008-10-19 19:11 . 2008-10-19 19:13 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-10-19 19:09 . 2008-10-19 19:09 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-10-19 18:23 . 2008-10-19 18:23 <DIR> d-------- C:\WINDOWS\system32\sog1 2008-10-19 18:23 . 2008-10-19 19:45 <DIR> d-------- C:\WINDOWS\system32\nysl 2008-10-19 18:23 . 2008-10-19 18:23 <DIR> d-------- C:\WINDOWS\system32\kbe 2008-10-19 18:23 . 2008-10-19 18:23 <DIR> d-------- C:\WINDOWS\system32\901 2008-10-19 18:23 . 2008-10-19 18:23 <DIR> d-------- C:\Temp\mtc2 2008-10-17 23:14 . 2008-10-17 23:14 268 --ah----- C:\sqmdata01.sqm 2008-10-17 23:14 . 2008-10-17 23:14 244 --ah----- C:\sqmnoopt01.sqm . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-20 09:50 --------- d-----w C:\Program Files\Trend Micro 2008-10-19 18:03 --------- d-----w C:\Program Files\Spyware Doctor 2008-10-19 17:11 --------- d-----w C:\Program Files\Lavasoft 2008-09-12 19:35 --------- d-----w C:\Documents and Settings\RAK\Application Data\Skype 2008-09-12 14:09 --------- d-----w C:\Documents and Settings\RAK\Application Data\skypePM 2008-09-12 12:29 --------- d-----w C:\Documents and Settings\RAK\Application Data\MSNInstaller 2008-09-12 12:11 --------- d-----w C:\Program Files\Windows Live 2008-09-12 12:10 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller 2008-09-12 11:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller 2008-09-12 11:34 --------- d-----w C:\Program Files\Skype 2008-09-12 11:34 --------- d-----w C:\Program Files\Common Files\Skype 2008-09-12 11:34 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype 2008-09-12 10:57 --------- d-----w C:\Program Files\iTunes 2008-09-12 10:57 --------- d-----w C:\Program Files\iPod 2008-09-12 10:57 --------- d-----w C:\Documents and Settings\RAK\Application Data\Apple Computer 2008-09-12 10:56 --------- d-----w C:\Program Files\QuickTime 2008-09-12 10:56 --------- d-----w C:\Program Files\Bonjour 2008-09-12 10:56 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer 2008-09-12 10:55 --------- d-----w C:\Program Files\Apple Software Update 2008-09-12 10:54 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple 2008-09-12 10:03 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP 2008-09-09 14:41 --------- d-----w C:\Program Files\ICQ6 2008-09-09 14:41 --------- d-----w C:\Documents and Settings\RAK\Application Data\ICQ 2008-09-09 14:40 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-09-09 14:35 --------- d-----w C:\Documents and Settings\RAK\Application Data\vlc 2008-09-09 14:34 --------- d-----w C:\Program Files\VideoLAN . ------- Sigcheck ------- 2004-08-04 14:00 1039872 c7afa0d8c704de1ff569e08f5905eee0 C:\WINDOWS\explorer.exe 2008-04-14 02:12 1041408 c93ff630f758fd3fefc224e3f332eb86 C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\explorer.exe 2008-04-14 02:12 23040 6db539e61429a696826c1e2a67887892 C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\ctfmon.exe 2004-08-04 14:00 23040 c77a29024309359026e1bde524ed273d C:\WINDOWS\system32\ctfmon.exe 2005-06-11 02:17 65536 8624ff86c4fc8664b7ab56f1677787a2 C:\WINDOWS\$hf_mig$\KB896423\SP2QFE\spoolsv.exe 2004-08-04 14:00 65536 65e752cc224a5b13b1e6c8abe529219c C:\WINDOWS\$NtUninstallKB896423$\spoolsv.exe 2008-04-14 02:12 65536 73e9d073cbcc08b39623b547fa7f8a9c C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\spoolsv.exe 2005-06-11 01:53 65536 8aa12067537d7cf4b6102b8822f9ed8a C:\WINDOWS\system32\spoolsv.exe 2008-04-14 02:12 33792 425ec2431f7a6f35a49ae5573d234933 C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\userinit.exe 2004-08-04 14:00 32256 95ae3572f48fce4e1697d18b4c59ec0a C:\WINDOWS\system32\userinit.exe . ((((((((((((((((((((((((((((( snapshot@2008-10-20_15.01.00.13 ))))))))))))))))))))))))))))))))))))))))) . - 2008-10-20 12:53:03 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat + 2008-10-20 17:46:39 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat - 2008-10-20 12:53:03 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat + 2008-10-20 17:46:39 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat - 2008-10-20 12:53:03 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat + 2008-10-20 17:46:39 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat + 2005-03-15 15:52:48 180,291 ----a-w C:\WINDOWS\Temp\UUCC4D.EXE . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ICQ"="C:\PROGRA~1\ICQ6\ICQ.exe" [2008-08-24 173304] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 23040] "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "OfficeScanNT Monitor"="C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe" [2005-03-15 344064] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-05-27 421888] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-30 289064] "ClamWin"="C:\Program Files\ClamWin\bin\ClamTray.exe" [2008-09-05 94208] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 23040] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\loginkey] 2004-08-04 14:00 47104 C:\Program Files\Common Files\Microsoft Shared\Ink\LoginKey.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\TabBtnWL] 2002-08-29 04:41 11776 C:\WINDOWS\system32\tabbtnwl.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpgwlnotify] 2004-08-04 14:00 30208 C:\WINDOWS\system32\tpgwlnot.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=yrolcd.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Authentication Packages REG_MULTI_SZ msv1_0 C:\WINDOWS\system32\cbXRIxUK [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader - Schnellstart.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader - Schnellstart.lnk backup=C:\WINDOWS\pss\Adobe Reader - Schnellstart.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^RAK^Start Menu^Programs^Startup^Hurtig start af Microsoft Office OneNote 2003.lnk] path=C:\Documents and Settings\RAK\Start Menu\Programs\Startup\Hurtig start af Microsoft Office OneNote 2003.lnk backup=C:\WINDOWS\pss\Hurtig start af Microsoft Office OneNote 2003.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck] C:\WINDOWS\system32\dumprep 0 -k [X] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\00THotkey] --a------ 2004-08-23 09:55 262144 C:\WINDOWS\system32\00THotkey.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Apoint] --a------ 2003-07-17 18:38 167936 C:\Program Files\Apoint2K\Apoint.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avgnt] --a------ 2007-03-01 11:24 270376 C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CrossMenu] --a------ 2004-03-09 15:18 806912 C:\Program Files\Toshiba\CrossMenu\CrossMenu.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] --a------ 2004-08-04 14:00 23040 C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] --a------ 2004-04-15 16:05 4866048 C:\WINDOWS\system32\nvcpl.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OfficeScanNT Monitor] --a------ 2005-03-15 17:55 344064 C:\Program Files\Trend Micro\OfficeScan Client\PccNTMon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmoothView] --a------ 2003-12-16 12:11 126976 C:\Program Files\Toshiba\TOSHIBA-zoomfunktion\SmoothView.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAX] --a------ 2004-08-06 09:27 868352 C:\Program Files\Analog Devices\SoundMAX\SMax4.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP] --a------ 2004-04-01 11:52 1376256 C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TabletTip] --a------ 2004-08-04 14:00 279552 C:\Program Files\Common Files\Microsoft Shared\Ink\TabTip.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TAcelMgr] --a------ 2004-08-26 11:54 94208 C:\Program Files\Toshiba\Accelerationsværktøjer\TAcelMgr\TAcelMgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TapButt] --a------ 2004-03-09 15:21 184320 C:\Program Files\Toshiba\TapButton\TapButt.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TAudEffect] --a------ 2004-03-08 12:22 278592 C:\Program Files\Toshiba\TAudEffect\TAudEff.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TMERzCtl.EXE] --a------ 2004-08-19 17:18 94208 C:\Program Files\Toshiba\TME3\TMERzCtl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TMESRV.EXE] --a------ 2004-04-13 12:58 135168 C:\Program Files\Toshiba\TME3\TMESRV31.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TosHKCW.exe] --a------ 2002-09-09 16:07 57344 C:\Program Files\Toshiba\Wireless Hotkey\TosHKCW.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TosRotation] --a------ 2004-03-05 11:45 77824 C:\Program Files\Toshiba\TOSHIBA Rotationshjælpeprogram\TRot.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TouchED] --a------ 2003-03-11 14:50 131072 C:\Program Files\Toshiba\TouchED\TouchED.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TSkrMain] --a------ 2004-08-26 11:55 53248 C:\Program Files\Toshiba\Accelerationsværktøjer\Shaker\TSkrMain.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr] -ra------ 2006-03-30 17:45 313472 C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\000StTHK] --a------ 2001-06-23 21:28 32768 C:\WINDOWS\system32\000StTHK.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AGRSMMSG] --a------ 2004-02-20 16:00 88363 C:\WINDOWS\agrsmmsg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent] --a------ 2004-08-04 14:00 110592 C:\WINDOWS\system32\bthprops.cpl [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] --a------ 2004-04-15 16:05 331776 C:\WINDOWS\system32\nwiz.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TFNF5] --a------ 2003-12-02 15:15 81920 C:\WINDOWS\system32\TFNF5.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TPSMain] --a------ 2004-06-28 14:42 274432 C:\WINDOWS\system32\TPSMain.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\WINDOWS\\system32\\ftp.exe"= "C:\\Program Files\\SonicWALL\\SonicWALL Global VPN Client\\SWGVpnClient.exe"= "C:\\WINDOWS\\explorer.exe"= "C:\\Program Files\\ICQ6\\ICQ.exe"= "C:\\Program Files\\Bonjour\\mDNSResponder.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "4899:TCP"= 4899:TCP:Radmin "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009 R1 RCFOX;SonicWALL IPsec Driver;C:\WINDOWS\system32\Drivers\RCFOX.sys [2004-04-05 81200] R1 TMEI3E;TMEI3E;C:\WINDOWS\system32\Drivers\TMEI3E.SYS [2004-06-16 5888] R3 TBtnKey;TOSHIBA Tablet PC Buttons Type N HID Driver;C:\WINDOWS\system32\DRIVERS\TBtnKey.sys [2002-09-12 8832] R3 TEchoCan;Toshiba Audio Effect;C:\WINDOWS\system32\DRIVERS\TEchoCan.sys [2004-02-04 30720] R3 TMicAry;Toshiba Audio Effect with MicArray;C:\WINDOWS\system32\DRIVERS\TMicAry.sys [2004-02-04 138240] R3 WacomPen;Wacom Serial Pen HID Driver;C:\WINDOWS\system32\DRIVERS\wacompen.sys [2004-08-04 13568] S2 MsaSvc;Microsoft authenticate service;C:\WINDOWS\system32\msasvc.exe [ ] S3 rcvpn;SonicWALL VPN Adapter;C:\WINDOWS\system32\DRIVERS\rcvpn.sys [2003-08-20 23180] S3 TS154_CB;T-Sinus 154card Driver;C:\WINDOWS\system32\DRIVERS\TS154ICB.sys [ ] S3 w32n5223;w32n5223 Protocol Driver;C:\PROGRA~1\T-COM\T-COMW~1\INSTAL~1\WINXP\w32n5223.SYS [ ] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b8784980-66f7-11dd-845e-000e7b32456b}] \Shell\AutoRun\command - D:\SETUP.EXE /AUTORUN \Shell\configure\command - D:\SETUP.EXE \Shell\install\command - D:\SETUP.EXE . - - - - ORPHANS REMOVED - - - - ShellExecuteHooks-{03EC8CE0-E697-4339-8BC2-2DDF72716A42} - (no file) . ------- Supplementary Scan ------- . FireFox -: Profile - C:\Documents and Settings\RAK\Application Data\Mozilla\Firefox\Profiles\5ghayvx5.default\ FF -: plugin - C:\Program Files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll FF -: plugin - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll FF -: plugin - C:\Program Files\Java\j2re1.4.2_05\bin\NPJava11.dll FF -: plugin - C:\Program Files\Java\j2re1.4.2_05\bin\NPJava12.dll FF -: plugin - C:\Program Files\Java\j2re1.4.2_05\bin\NPJava13.dll FF -: plugin - C:\Program Files\Java\j2re1.4.2_05\bin\NPJava14.dll FF -: plugin - C:\Program Files\Java\j2re1.4.2_05\bin\NPJava32.dll FF -: plugin - C:\Program Files\Java\j2re1.4.2_05\bin\NPJPI142_05.dll FF -: plugin - C:\Program Files\Java\j2re1.4.2_05\bin\NPOJI610.dll . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-20 20:02:22 Windows 5.1.2600 Service Pack 2 NTFS detected NTDLL code modification: ZwOpenFile scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-10-20 20:04:08 ComboFix-quarantined-files.txt 2008-10-20 18:04:03 ComboFix2.txt 2008-10-20 13:12:43 ComboFix3.txt 2008-10-20 13:01:34 Pre-Run: 45,399,429,120 bytes free Post-Run: 45,381,533,696 bytes free 236 --- E O F --- 2008-10-19 21:23:10 Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:13:57, on 20.10.2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Microsoft Shared\Ink\KeyboardSurrogate.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\TOSHIBA\TME3\Tmesrv31.exe C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\TEMP\UUCC4D.EXE C:\WINDOWS\SYSTEM32\WISPTIS.EXE C:\WINDOWS\System32\tabbtnu.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Microsoft Shared\Ink\TCServer.exe C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\ClamWin\bin\ClamTray.exe C:\PROGRA~1\ICQ6\ICQ.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\explorer.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\WINDOWS\system32\wbem\wmiprvse.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.t-online.de/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R3 - URLSearchHook: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~2\tools\iesdsg.dll O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe" -HideWindow O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [ClamWin] "C:\Program Files\ClamWin\bin\ClamTray.exe" --logon O4 - HKCU\..\Run: [ICQ] "C:\PROGRA~1\ICQ6\ICQ.exe" silent O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKUS\S-1-5-19\..\Run: [TabletWizard] %windir%\help\wizard.hta (User 'LOKAL TJENESTE') O4 - HKUS\S-1-5-20\..\Run: [TabletWizard] %windir%\help\wizard.hta (User 'NETVÆRKSTJENESTE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: *.amaena.com O15 - Trusted Zone: *.avsystemcare.com O15 - Trusted Zone: *.gomyhit.com O15 - Trusted Zone: *.imagesrvr.com O15 - Trusted Zone: *.onerateld.com O15 - Trusted Zone: *.safetydownload.com O15 - Trusted Zone: *.storageguardsoft.com O15 - Trusted Zone: *.trustedantivirus.com O15 - Trusted Zone: *.virusschlacht.com O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase9602.cab O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1169464580803 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: yrolcd.dll O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Unknown owner - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe (file missing) O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Microsoft authenticate service (MsaSvc) - Unknown owner - C:\WINDOWS\system32\msasvc.exe (file missing) O23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: OfficeScanNT Personal Firewall (OfcPfwSvc) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe O23 - Service: SonicWall VPN Client Service (RampartSvc) - SonicWALL, Inc. - C:\Program Files\SonicWALL\SonicWALL Global VPN Client\RampartSvc.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: Tmesrv3 (Tmesrv) - TOSHIBA - C:\Program Files\TOSHIBA\TME3\Tmesrv31.exe O23 - Service: OfficeScanNT Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe -- End of file - 7893 bytes Malwarebytes' Anti-Malware 1.28 Datenbank Version: 1182 Windows 5.1.2600 Service Pack 2 20.10.2008 20:13:17 mbam-log-2008-10-20 (20-13-17).txt Scan-Methode: Quick-Scan Durchsuchte Objekte: 34789 Laufzeit: 6 minute(s), 23 second(s) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 0 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: (Keine bösartigen Objekte gefunden) hier die URLS: http://www.virustotal.com/de/analisis/8a717bd0a2d02c8a24fd3fcfcba71981 http://www.virustotal.com/de/analisis/b703b9d0d8ac01b4144e79b1c8acb546 http://www.virustotal.com/de/analisis/c3d53c97e864ac066d2f2fbfff9eb08b http://www.virustotal.com/de/analisis/5503e7e551b8eefcafe8e27a5b4a436b http://www.virustotal.com/de/analisis/4432210285e2b6cbd428989cd4e73c0a die datei c:/temp/1cb konte ich nicht finden hab mittlerweile noch einen vollständigen scann mit maleware gemacht der hat schon wieder 3 objecte gefunden die ich dann gelöscht hab...woher kommen die denn immerwieder????geht das jetzt immer so weiter?? hier das logfile: Malwarebytes' Anti-Malware 1.28 Datenbank Version: 1182 Windows 5.1.2600 Service Pack 2 20.10.2008 21:08:20 mbam-log-2008-10-20 (21-08-20).txt Scan-Methode: Vollständiger Scan (C:\|) Durchsuchte Objekte: 85920 Laufzeit: 45 minute(s), 54 second(s) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 3 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: C:\System Volume Information\_restore{9767A1A3-9CC5-4270-9776-7A195A503763}\RP4\A0007286.sys (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{9767A1A3-9CC5-4270-9776-7A195A503763}\RP4\A0007811.exe (Adware.Yazzle) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{9767A1A3-9CC5-4270-9776-7A195A503763}\RP4\A0007850.sys (Trojan.FakeAlert) -> Quarantined and deleted successfully. Vielen dank schonmal! |
|
|
|
|
|
|
20.09.2008, 21:44
Ehrenmitglied
Beiträge: 6028 |
#33
Das sind bei Virustotal ja ganz andere Daten als was ich aufgegeben habe
Woher kommen die __________ MfG Argus |
|
|
|
|
|
|
20.09.2008, 21:47
Member
Beiträge: 50 |
#34
weil die dateieenden wenn ich die gesucht habe also auf arbeitsplatz dann c dann windows dann system32 dann war zb sog1 keine einzelne datei sondern ein ordner und den ordner konnte ich nicht als koplettes ding hochladen, wenn ich dadaruf geklickt hab dann ging der ordner auf und drin war jeweils nur eine datei....und di ehab ich dann halt genommen....so wars bei jeder datei die du mir gesagt hast...aslo der hintere teil war jeweils ein ordner mit einer datei drin , hab extra noch im ordner system32 geschaut obs viell doch ne einzelne datei gibt die so heisst , war aber nix zu finden....schlimm?
|
|
|
|
|
|
|
20.09.2008, 22:17
Ehrenmitglied
Beiträge: 6028 |
#35
Schliesse alle Fenster und starte Hijack This
Klicke: Do a Systemscan only Setze ein Häckchen in das Kästchen vor den genannten Eintrag bei Zitat R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157klicke: Fix checked Dein Internet Explorer muss geschlossen wenn Du Fix Checked klickst cfscript Den folgenden Text in den Editor (Start - Zubehör - Editor) kopieren und als cfscript.txt mit 'Speichern unter' auf dem Desktop. Gebe bei Dateityp 'Alle Dateien' an. Du solltest jetzt auf dem Desktop diese Datei finden. Zitat File::CFScript.txt mit der rechten Maustaste auf das Symbol von Combofix ziehen  Combofix noch mal anwenden poste dann nach Neustart das neue Log __________ MfG Argus |
|
|
|
|
|
|
20.09.2008, 22:42
Member
Beiträge: 50 |
#36
oke ich glaub das hat nicht ganz geklappt...oh man ich weiss bin total der nixblicker-sorry für die vielen unannehmlichkeiten
 also ich hab das gemacht bei hijackthis...also erstmal hab ich auf hijackthis butten geklickt dann auf den button do a systemscan only und dann at das programm gleich angefangen zu scannen...also davor konnt ich die angegeben dinge noch garnet ankreuzen...das hab ich dann danach gemacht, und als ich dann auf fix check clicken wollte kam die warnmeldung dass die se elemente dann entgültig gelöscht werden, ich hab dann mal auf ok geklickt...aber dann kam nix....dann hab ich einfach nochmal nen do an systemscan only gemacht und dann kam auch ein notefile ohne die angegeben dinge von oben...diesen hab ich dann wie gesagt als txt file aufm desktop gespeichert...aber das problem ist jetzt dass die angegebnen dateien die du meintest nicht auf dem desktop sind! hmm...hab ich was falsch gemacht? naja ich zieh jetzt mal den cfscript.txt in das combofix viell kommt ja was bei raus. sorry nochmal so ich hab jetzt das textfile auf das logo von combofix gezogen dann kam gleich die farge ob ich es ausfühern will, dann hab ich auf ja , dann kam das log bei raus(das cfscript.txt steht allerdings immernoch auf desktop, richtig?): ComboFix 08-09-20.02 - RAK 2008-10-20 22:44:38.5 - NTFSx86 Running from: C:\Documents and Settings\RAK\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\RAK\Desktop\cfscript.txt * Created a new restore point [color=red]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/color] . - REDUCED FUNCTIONALITY MODE - . ((((((((((((((((((((((((( Files Created from 2008-09-20 to 2008-10-20 ))))))))))))))))))))))))))))))) . 2008-10-20 18:54 . 2008-09-12 14:24 <DIR> d---s---- C:\Documents and Settings\RAK\Application Data\Microsoft 2008-10-20 11:39 . 2008-10-20 11:39 <DIR> d-------- C:\Program Files\CCleaner 2008-10-19 21:58 . 2008-10-19 21:58 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-10-19 21:58 . 2008-10-19 21:58 <DIR> d-------- C:\Documents and Settings\RAK\Application Data\Malwarebytes 2008-10-19 21:58 . 2008-10-19 21:58 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-10-19 21:58 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys 2008-10-19 21:58 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-10-19 20:22 . 2008-10-19 20:22 <DIR> d-------- C:\Documents and Settings\RAK\Application Data\.clamwin 2008-10-19 20:21 . 2008-10-19 20:21 <DIR> d-------- C:\Program Files\ClamWin 2008-10-19 20:21 . 2008-10-19 20:21 <DIR> d-------- C:\Documents and Settings\All Users\.clamwin 2008-10-19 19:11 . 2008-10-19 19:13 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-10-19 19:09 . 2008-10-19 19:09 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-10-19 18:23 . 2008-10-19 18:23 <DIR> d-------- C:\WINDOWS\system32\sog1 2008-10-19 18:23 . 2008-10-19 19:45 <DIR> d-------- C:\WINDOWS\system32\nysl 2008-10-19 18:23 . 2008-10-19 18:23 <DIR> d-------- C:\WINDOWS\system32\kbe 2008-10-19 18:23 . 2008-10-19 18:23 <DIR> d-------- C:\WINDOWS\system32\901 2008-10-19 18:23 . 2008-10-19 18:23 <DIR> d-------- C:\Temp\mtc2 2008-10-17 23:14 . 2008-10-17 23:14 268 --ah----- C:\sqmdata01.sqm 2008-10-17 23:14 . 2008-10-17 23:14 244 --ah----- C:\sqmnoopt01.sqm . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-20 09:50 --------- d-----w C:\Program Files\Trend Micro 2008-10-19 18:03 --------- d-----w C:\Program Files\Spyware Doctor 2008-10-19 17:11 --------- d-----w C:\Program Files\Lavasoft 2008-09-12 19:35 --------- d-----w C:\Documents and Settings\RAK\Application Data\Skype 2008-09-12 14:09 --------- d-----w C:\Documents and Settings\RAK\Application Data\skypePM 2008-09-12 12:29 --------- d-----w C:\Documents and Settings\RAK\Application Data\MSNInstaller 2008-09-12 12:11 --------- d-----w C:\Program Files\Windows Live 2008-09-12 12:10 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller 2008-09-12 11:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller 2008-09-12 11:34 --------- d-----w C:\Program Files\Skype 2008-09-12 11:34 --------- d-----w C:\Program Files\Common Files\Skype 2008-09-12 11:34 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype 2008-09-12 10:57 --------- d-----w C:\Program Files\iTunes 2008-09-12 10:57 --------- d-----w C:\Program Files\iPod 2008-09-12 10:57 --------- d-----w C:\Documents and Settings\RAK\Application Data\Apple Computer 2008-09-12 10:56 --------- d-----w C:\Program Files\QuickTime 2008-09-12 10:56 --------- d-----w C:\Program Files\Bonjour 2008-09-12 10:56 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer 2008-09-12 10:55 --------- d-----w C:\Program Files\Apple Software Update 2008-09-12 10:54 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple 2008-09-12 10:03 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP 2008-09-09 14:41 --------- d-----w C:\Program Files\ICQ6 2008-09-09 14:41 --------- d-----w C:\Documents and Settings\RAK\Application Data\ICQ 2008-09-09 14:40 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-09-09 14:35 --------- d-----w C:\Documents and Settings\RAK\Application Data\vlc 2008-09-09 14:34 --------- d-----w C:\Program Files\VideoLAN . ------- Sigcheck ------- 2004-08-04 14:00 1039872 c7afa0d8c704de1ff569e08f5905eee0 C:\WINDOWS\explorer.exe 2008-04-14 02:12 1041408 c93ff630f758fd3fefc224e3f332eb86 C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\explorer.exe 2008-04-14 02:12 23040 6db539e61429a696826c1e2a67887892 C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\ctfmon.exe 2004-08-04 14:00 23040 c77a29024309359026e1bde524ed273d C:\WINDOWS\system32\ctfmon.exe 2005-06-11 02:17 65536 8624ff86c4fc8664b7ab56f1677787a2 C:\WINDOWS\$hf_mig$\KB896423\SP2QFE\spoolsv.exe 2004-08-04 14:00 65536 65e752cc224a5b13b1e6c8abe529219c C:\WINDOWS\$NtUninstallKB896423$\spoolsv.exe 2008-04-14 02:12 65536 73e9d073cbcc08b39623b547fa7f8a9c C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\spoolsv.exe 2005-06-11 01:53 65536 8aa12067537d7cf4b6102b8822f9ed8a C:\WINDOWS\system32\spoolsv.exe 2008-04-14 02:12 33792 425ec2431f7a6f35a49ae5573d234933 C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\userinit.exe 2004-08-04 14:00 32256 95ae3572f48fce4e1697d18b4c59ec0a C:\WINDOWS\system32\userinit.exe . ((((((((((((((((((((((((((((( snapshot@2008-10-20_15.01.00.13 ))))))))))))))))))))))))))))))))))))))))) . - 2008-10-20 12:53:03 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat + 2008-10-20 17:46:39 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat - 2008-10-20 12:53:03 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat + 2008-10-20 17:46:39 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat - 2008-10-20 12:53:03 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat + 2008-10-20 17:46:39 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat + 2005-03-15 15:52:48 180,291 ----a-w C:\WINDOWS\Temp\UUCC4D.EXE . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ICQ"="C:\PROGRA~1\ICQ6\ICQ.exe" [2008-08-24 173304] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 23040] "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "OfficeScanNT Monitor"="C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe" [2005-03-15 344064] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-05-27 421888] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-30 289064] "ClamWin"="C:\Program Files\ClamWin\bin\ClamTray.exe" [2008-09-05 94208] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 23040] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\loginkey] 2004-08-04 14:00 47104 C:\Program Files\Common Files\Microsoft Shared\Ink\LoginKey.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\TabBtnWL] 2002-08-29 04:41 11776 C:\WINDOWS\system32\tabbtnwl.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpgwlnotify] 2004-08-04 14:00 30208 C:\WINDOWS\system32\tpgwlnot.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Authentication Packages REG_MULTI_SZ msv1_0 C:\WINDOWS\system32\cbXRIxUK [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader - Schnellstart.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader - Schnellstart.lnk backup=C:\WINDOWS\pss\Adobe Reader - Schnellstart.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^RAK^Start Menu^Programs^Startup^Hurtig start af Microsoft Office OneNote 2003.lnk] path=C:\Documents and Settings\RAK\Start Menu\Programs\Startup\Hurtig start af Microsoft Office OneNote 2003.lnk backup=C:\WINDOWS\pss\Hurtig start af Microsoft Office OneNote 2003.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck] C:\WINDOWS\system32\dumprep 0 -k [X] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\00THotkey] --a------ 2004-08-23 09:55 262144 C:\WINDOWS\system32\00THotkey.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Apoint] --a------ 2003-07-17 18:38 167936 C:\Program Files\Apoint2K\Apoint.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avgnt] --a------ 2007-03-01 11:24 270376 C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CrossMenu] --a------ 2004-03-09 15:18 806912 C:\Program Files\Toshiba\CrossMenu\CrossMenu.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] --a------ 2004-08-04 14:00 23040 C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] --a------ 2004-04-15 16:05 4866048 C:\WINDOWS\system32\nvcpl.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OfficeScanNT Monitor] --a------ 2005-03-15 17:55 344064 C:\Program Files\Trend Micro\OfficeScan Client\PccNTMon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmoothView] --a------ 2003-12-16 12:11 126976 C:\Program Files\Toshiba\TOSHIBA-zoomfunktion\SmoothView.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAX] --a------ 2004-08-06 09:27 868352 C:\Program Files\Analog Devices\SoundMAX\SMax4.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP] --a------ 2004-04-01 11:52 1376256 C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TabletTip] --a------ 2004-08-04 14:00 279552 C:\Program Files\Common Files\Microsoft Shared\Ink\TabTip.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TAcelMgr] --a------ 2004-08-26 11:54 94208 C:\Program Files\Toshiba\Accelerationsværktøjer\TAcelMgr\TAcelMgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TapButt] --a------ 2004-03-09 15:21 184320 C:\Program Files\Toshiba\TapButton\TapButt.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TAudEffect] --a------ 2004-03-08 12:22 278592 C:\Program Files\Toshiba\TAudEffect\TAudEff.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TMERzCtl.EXE] --a------ 2004-08-19 17:18 94208 C:\Program Files\Toshiba\TME3\TMERzCtl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TMESRV.EXE] --a------ 2004-04-13 12:58 135168 C:\Program Files\Toshiba\TME3\TMESRV31.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TosHKCW.exe] --a------ 2002-09-09 16:07 57344 C:\Program Files\Toshiba\Wireless Hotkey\TosHKCW.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TosRotation] --a------ 2004-03-05 11:45 77824 C:\Program Files\Toshiba\TOSHIBA Rotationshjælpeprogram\TRot.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TouchED] --a------ 2003-03-11 14:50 131072 C:\Program Files\Toshiba\TouchED\TouchED.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TSkrMain] --a------ 2004-08-26 11:55 53248 C:\Program Files\Toshiba\Accelerationsværktøjer\Shaker\TSkrMain.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr] -ra------ 2006-03-30 17:45 313472 C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\000StTHK] --a------ 2001-06-23 21:28 32768 C:\WINDOWS\system32\000StTHK.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AGRSMMSG] --a------ 2004-02-20 16:00 88363 C:\WINDOWS\agrsmmsg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent] --a------ 2004-08-04 14:00 110592 C:\WINDOWS\system32\bthprops.cpl [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] --a------ 2004-04-15 16:05 331776 C:\WINDOWS\system32\nwiz.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TFNF5] --a------ 2003-12-02 15:15 81920 C:\WINDOWS\system32\TFNF5.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TPSMain] --a------ 2004-06-28 14:42 274432 C:\WINDOWS\system32\TPSMain.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\WINDOWS\\system32\\ftp.exe"= "C:\\Program Files\\SonicWALL\\SonicWALL Global VPN Client\\SWGVpnClient.exe"= "C:\\WINDOWS\\explorer.exe"= "C:\\Program Files\\ICQ6\\ICQ.exe"= "C:\\Program Files\\Bonjour\\mDNSResponder.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "4899:TCP"= 4899:TCP:Radmin "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009 R1 RCFOX;SonicWALL IPsec Driver;C:\WINDOWS\system32\Drivers\RCFOX.sys [2004-04-05 81200] R1 TMEI3E;TMEI3E;C:\WINDOWS\system32\Drivers\TMEI3E.SYS [2004-06-16 5888] R3 TBtnKey;TOSHIBA Tablet PC Buttons Type N HID Driver;C:\WINDOWS\system32\DRIVERS\TBtnKey.sys [2002-09-12 8832] R3 TEchoCan;Toshiba Audio Effect;C:\WINDOWS\system32\DRIVERS\TEchoCan.sys [2004-02-04 30720] R3 TMicAry;Toshiba Audio Effect with MicArray;C:\WINDOWS\system32\DRIVERS\TMicAry.sys [2004-02-04 138240] R3 WacomPen;Wacom Serial Pen HID Driver;C:\WINDOWS\system32\DRIVERS\wacompen.sys [2004-08-04 13568] S2 MsaSvc;Microsoft authenticate service;C:\WINDOWS\system32\msasvc.exe [ ] S3 rcvpn;SonicWALL VPN Adapter;C:\WINDOWS\system32\DRIVERS\rcvpn.sys [2003-08-20 23180] S3 TS154_CB;T-Sinus 154card Driver;C:\WINDOWS\system32\DRIVERS\TS154ICB.sys [ ] S3 w32n5223;w32n5223 Protocol Driver;C:\PROGRA~1\T-COM\T-COMW~1\INSTAL~1\WINXP\w32n5223.SYS [ ] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b8784980-66f7-11dd-845e-000e7b32456b}] \Shell\AutoRun\command - D:\SETUP.EXE /AUTORUN \Shell\configure\command - D:\SETUP.EXE \Shell\install\command - D:\SETUP.EXE . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-20 22:46:08 Windows 5.1.2600 Service Pack 2 NTFS detected NTDLL code modification: ZwOpenFile scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... ************************************************************************** . Completion time: 2008-10-20 22:49:45 ComboFix-quarantined-files.txt 2008-10-20 20:48:40 ComboFix2.txt 2008-10-20 18:04:09 ComboFix3.txt 2008-10-20 13:12:43 ComboFix4.txt 2008-10-20 13:01:34 Pre-Run: 44.437.266.432 bytes free Post-Run: 44,099,702,784 bytes free 218 --- E O F --- 2008-10-19 21:23:10 solll ich denn die dateien die ich vorher bei virustotal analysiert hab mit malewarebytes löschen? grüsse&daaaaaankeee  Dieser Beitrag wurde am 20.09.2008 um 23:39 Uhr von debbbbbbi editiert.
|
|
|
|
|
|
|
21.09.2008, 00:25
Ehrenmitglied
Beiträge: 6028 |
#37
Avenger nur für 32-bit Windows Vista, XP, und 2000
http://virus-protect.org/artikel/tools/avenger.html Hinweis: "The Avenger" muss mit Administrator-Privilegien ausgeführt werden. In Windows Vista, muss ebenfalls bestätigt werden, dass Adminrechte vorhanden sind." Download Avenger2 zum Desktop Alle Fenster muessen geschlossen sein Starte Avenger Anhaken “ Input script manually Die "Lupe" rechts anklicken - View/edit script (wird sich öffnen) kopiere rein: Files to delete: C:\WINDOWS\system32\sog1 C:\WINDOWS\system32\nysl C:\WINDOWS\system32\kbe C:\WINDOWS\system32\901 C:\WINDOWS\yrolcd.dll C:\WINDOWS\system32\yrolcd.dll Folders to delete: C:\Temp\mtc2 C:\WINDOWS\TEMP\UUCC4D.EXE Registry values to replace with dummy: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows | AppInit_DLLs Klicke die grüne Ampel das Script wird nun ausgeführt, dann wird der PC nach Bestätigung (yes) neustarten nach dem Neustart erscheint ein Log vom Avenger, kopiere es ab - mit rechtem Mausklick - kopieren - einfügen Den folgenden Text in den Editor (Start - Zubehör - Editor) kopieren und als fix.reg mit 'Speichern unter' auf dem Desktop. Gebe bei Dateityp 'Alle Dateien' an. Du solltest jetzt auf dem Desktop diese Datei finden. REGEDIT4 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa] "Authentication Packages"=hex(7):6d,73,76,31,5f,30,00,00 Doppelklick auf fix.reg und fuege es den registry zu __________ MfG Argus |
|
|
|
|
|
|
21.09.2008, 07:30
...neu hier
Beiträge: 1 |
#38
Zitat cfscriptSollte eigentlich erfolchreich sein mussen. |
|
|
|
|
|
|
21.09.2008, 10:46
Member
Beiträge: 50 |
#39
@arnold:
danke nochmal für die hilfe. habe das programm runter geladen und ausgefürt das kam bei raus: Logfile of The Avenger Version 2.0, (c) by Swandog46 http://swandog46.geekstogo.com Platform: Windows XP ******************* Script file opened successfully. Script file read successfully. Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: Rootkit scan active. No rootkits found! Error: "C:\WINDOWS\system32\sog1" is a folder, not a file! Deletion of file "C:\WINDOWS\system32\sog1" failed! Status: 0xc00000ba (STATUS_FILE_IS_A_DIRECTORY) --> use "Folders to delete:" instead of "Files to delete:" to delete a directory Error: "C:\WINDOWS\system32\nysl" is a folder, not a file! Deletion of file "C:\WINDOWS\system32\nysl" failed! Status: 0xc00000ba (STATUS_FILE_IS_A_DIRECTORY) --> use "Folders to delete:" instead of "Files to delete:" to delete a directory Error: "C:\WINDOWS\system32\kbe" is a folder, not a file! Deletion of file "C:\WINDOWS\system32\kbe" failed! Status: 0xc00000ba (STATUS_FILE_IS_A_DIRECTORY) --> use "Folders to delete:" instead of "Files to delete:" to delete a directory Error: "C:\WINDOWS\system32\901" is a folder, not a file! Deletion of file "C:\WINDOWS\system32\901" failed! Status: 0xc00000ba (STATUS_FILE_IS_A_DIRECTORY) --> use "Folders to delete:" instead of "Files to delete:" to delete a directory Error: file "C:\WINDOWS\yrolcd.dll" not found! Deletion of file "C:\WINDOWS\yrolcd.dll" failed! Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND) --> the object does not exist Error: file "C:\WINDOWS\system32\yrolcd.dll" not found! Deletion of file "C:\WINDOWS\system32\yrolcd.dll" failed! Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND) --> the object does not exist Folder "C:\Temp\mtc2" deleted successfully. Error: folder "C:\WINDOWS\TEMP\UUCC4D.EXE" not found! Deletion of folder "C:\WINDOWS\TEMP\UUCC4D.EXE" failed! Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND) --> the object does not exist Registry value "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows|AppInit_DLLs" replaced with dummy successfully. Completed script processing. ******************* Finished! Terminate. ich hab aber ein echtes verständnisproblem....was meinst du mit "kopiere den folgenden text"??? meinst du damit den text den ich hier oben grad eingefügt hab oder den: REGEDIT4 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa] "Authentication Packages"=hex(7):6d,73,76,31,5f,30,00,00 ???? ich habs jetzt malö den oberen sozosagen das logfile von avenger in den editor kopiert und als fix.reg gespeichert....nur sehe ich dann was auch immer du mit "diese" dateien meinst nicht auf dem desktop und als ich dann mit doppelklick auf fix.reg bin kam diese meldung: "cannot import c:/dokuments and settings/RAK/desktop/fix.reg. the specified file is not a registry script. you can only import binary registry files from within the reg.editor"".... ...tut mir echt leid dass ihr soviel geduld mit mir haben müsst, bin wohl ein echtes problemkind hier @smeenk: hi erstmal, aber bei dir habe ich das selbe problem mit dem satz folgenden text. was meinst du damit? den hier: Folder:: C:\WINDOWS\system32\sog1 C:\WINDOWS\system32\nysl C:\WINDOWS\system32\kbe C:\WINDOWS\system32\901 C:\Temp\mtc2 Registry:: [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Authentication Packages"=hex(7):6d,73,76,31,5f,30,00,00 also ich probiers jetzt mal mit dem....und das kam raus: ComboFix 08-09-20.05 - RAK 2008-10-21 11:15:48.7 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.45.1033.18.1092 [GMT 2:00] Running from: C:\Documents and Settings\RAK\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\RAK\Desktop\cfscript.txt * Created a new restore point [color=red]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/color] . - REDUCED FUNCTIONALITY MODE - . ((((((((((((((((((((((((( Files Created from 2008-09-21 to 2008-10-21 ))))))))))))))))))))))))))))))) . 2008-10-20 18:54 . 2008-09-12 14:24 <DIR> d---s---- C:\Documents and Settings\RAK\Application Data\Microsoft 2008-10-20 11:39 . 2008-10-20 11:39 <DIR> d-------- C:\Program Files\CCleaner 2008-10-19 21:58 . 2008-10-19 21:58 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-10-19 21:58 . 2008-10-19 21:58 <DIR> d-------- C:\Documents and Settings\RAK\Application Data\Malwarebytes 2008-10-19 21:58 . 2008-10-19 21:58 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-10-19 21:58 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys 2008-10-19 21:58 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-10-19 20:22 . 2008-10-19 20:22 <DIR> d-------- C:\Documents and Settings\RAK\Application Data\.clamwin 2008-10-19 20:21 . 2008-10-19 20:21 <DIR> d-------- C:\Program Files\ClamWin 2008-10-19 20:21 . 2008-10-19 20:21 <DIR> d-------- C:\Documents and Settings\All Users\.clamwin 2008-10-19 19:11 . 2008-10-19 19:13 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-10-19 19:09 . 2008-10-19 19:09 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-10-19 18:23 . 2008-10-21 10:52 <DIR> d-------- C:\WINDOWS\system32\sog1 2008-10-19 18:23 . 2008-10-21 10:52 <DIR> d-------- C:\WINDOWS\system32\nysl 2008-10-19 18:23 . 2008-10-21 10:51 <DIR> d-------- C:\WINDOWS\system32\kbe 2008-10-19 18:23 . 2008-10-21 10:51 <DIR> d-------- C:\WINDOWS\system32\901 2008-10-17 23:14 . 2008-10-17 23:14 268 --ah----- C:\sqmdata01.sqm 2008-10-17 23:14 . 2008-10-17 23:14 244 --ah----- C:\sqmnoopt01.sqm . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-20 09:50 --------- d-----w C:\Program Files\Trend Micro 2008-10-19 18:03 --------- d-----w C:\Program Files\Spyware Doctor 2008-10-19 17:11 --------- d-----w C:\Program Files\Lavasoft 2008-09-12 19:35 --------- d-----w C:\Documents and Settings\RAK\Application Data\Skype 2008-09-12 14:09 --------- d-----w C:\Documents and Settings\RAK\Application Data\skypePM 2008-09-12 12:29 --------- d-----w C:\Documents and Settings\RAK\Application Data\MSNInstaller 2008-09-12 12:11 --------- d-----w C:\Program Files\Windows Live 2008-09-12 12:10 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller 2008-09-12 11:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller 2008-09-12 11:34 --------- d-----w C:\Program Files\Skype 2008-09-12 11:34 --------- d-----w C:\Program Files\Common Files\Skype 2008-09-12 11:34 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype 2008-09-12 10:57 --------- d-----w C:\Program Files\iTunes 2008-09-12 10:57 --------- d-----w C:\Program Files\iPod 2008-09-12 10:57 --------- d-----w C:\Documents and Settings\RAK\Application Data\Apple Computer 2008-09-12 10:56 --------- d-----w C:\Program Files\QuickTime 2008-09-12 10:56 --------- d-----w C:\Program Files\Bonjour 2008-09-12 10:56 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer 2008-09-12 10:55 --------- d-----w C:\Program Files\Apple Software Update 2008-09-12 10:54 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple 2008-09-12 10:03 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP 2008-09-09 14:41 --------- d-----w C:\Program Files\ICQ6 2008-09-09 14:41 --------- d-----w C:\Documents and Settings\RAK\Application Data\ICQ 2008-09-09 14:40 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-09-09 14:35 --------- d-----w C:\Documents and Settings\RAK\Application Data\vlc 2008-09-09 14:34 --------- d-----w C:\Program Files\VideoLAN . ------- Sigcheck ------- 2004-08-04 14:00 1039872 c7afa0d8c704de1ff569e08f5905eee0 C:\WINDOWS\explorer.exe 2008-04-14 02:12 1041408 c93ff630f758fd3fefc224e3f332eb86 C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\explorer.exe 2008-04-14 02:12 23040 6db539e61429a696826c1e2a67887892 C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\ctfmon.exe 2004-08-04 14:00 23040 c77a29024309359026e1bde524ed273d C:\WINDOWS\system32\ctfmon.exe 2005-06-11 02:17 65536 8624ff86c4fc8664b7ab56f1677787a2 C:\WINDOWS\$hf_mig$\KB896423\SP2QFE\spoolsv.exe 2004-08-04 14:00 65536 65e752cc224a5b13b1e6c8abe529219c C:\WINDOWS\$NtUninstallKB896423$\spoolsv.exe 2008-04-14 02:12 65536 73e9d073cbcc08b39623b547fa7f8a9c C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\spoolsv.exe 2005-06-11 01:53 65536 8aa12067537d7cf4b6102b8822f9ed8a C:\WINDOWS\system32\spoolsv.exe 2008-04-14 02:12 33792 425ec2431f7a6f35a49ae5573d234933 C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\userinit.exe 2004-08-04 14:00 32256 95ae3572f48fce4e1697d18b4c59ec0a C:\WINDOWS\system32\userinit.exe . ((((((((((((((((((((((((((((( snapshot@2008-10-20_15.01.00.13 ))))))))))))))))))))))))))))))))))))))))) . - 2005-10-20 18:02:28 174,592 ----a-w C:\WINDOWS\erdnt\Hiv-backup\ERDNT.EXE + 2005-10-20 18:02:28 163,328 ----a-w C:\WINDOWS\erdnt\Hiv-backup\ERDNT.EXE - 2008-10-20 12:53:03 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat + 2008-10-21 08:59:31 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat - 2008-10-20 12:53:03 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat + 2008-10-21 08:59:31 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat - 2008-10-20 12:53:03 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat + 2008-10-21 08:59:31 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat + 2005-03-15 15:52:48 180,291 ----a-w C:\WINDOWS\Temp\QJFD63.EXE . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ICQ"="C:\PROGRA~1\ICQ6\ICQ.exe" [2008-08-24 173304] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 23040] "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "OfficeScanNT Monitor"="C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe" [2005-03-15 344064] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-05-27 421888] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-30 289064] "ClamWin"="C:\Program Files\ClamWin\bin\ClamTray.exe" [2008-09-05 94208] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 23040] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\loginkey] 2004-08-04 14:00 47104 C:\Program Files\Common Files\Microsoft Shared\Ink\LoginKey.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\TabBtnWL] 2002-08-29 04:41 11776 C:\WINDOWS\system32\tabbtnwl.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpgwlnotify] 2004-08-04 14:00 30208 C:\WINDOWS\system32\tpgwlnot.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader - Schnellstart.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader - Schnellstart.lnk backup=C:\WINDOWS\pss\Adobe Reader - Schnellstart.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^RAK^Start Menu^Programs^Startup^Hurtig start af Microsoft Office OneNote 2003.lnk] path=C:\Documents and Settings\RAK\Start Menu\Programs\Startup\Hurtig start af Microsoft Office OneNote 2003.lnk backup=C:\WINDOWS\pss\Hurtig start af Microsoft Office OneNote 2003.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck] C:\WINDOWS\system32\dumprep 0 -k [X] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\00THotkey] --a------ 2004-08-23 09:55 262144 C:\WINDOWS\system32\00THotkey.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Apoint] --a------ 2003-07-17 18:38 167936 C:\Program Files\Apoint2K\Apoint.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avgnt] --a------ 2007-03-01 11:24 270376 C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CrossMenu] --a------ 2004-03-09 15:18 806912 C:\Program Files\Toshiba\CrossMenu\CrossMenu.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] --a------ 2004-08-04 14:00 23040 C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] --a------ 2004-04-15 16:05 4866048 C:\WINDOWS\system32\nvcpl.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OfficeScanNT Monitor] --a------ 2005-03-15 17:55 344064 C:\Program Files\Trend Micro\OfficeScan Client\PccNTMon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmoothView] --a------ 2003-12-16 12:11 126976 C:\Program Files\Toshiba\TOSHIBA-zoomfunktion\SmoothView.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAX] --a------ 2004-08-06 09:27 868352 C:\Program Files\Analog Devices\SoundMAX\SMax4.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP] --a------ 2004-04-01 11:52 1376256 C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TabletTip] --a------ 2004-08-04 14:00 279552 C:\Program Files\Common Files\Microsoft Shared\Ink\TabTip.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TAcelMgr] --a------ 2004-08-26 11:54 94208 C:\Program Files\Toshiba\Accelerationsværktøjer\TAcelMgr\TAcelMgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TapButt] --a------ 2004-03-09 15:21 184320 C:\Program Files\Toshiba\TapButton\TapButt.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TAudEffect] --a------ 2004-03-08 12:22 278592 C:\Program Files\Toshiba\TAudEffect\TAudEff.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TMERzCtl.EXE] --a------ 2004-08-19 17:18 94208 C:\Program Files\Toshiba\TME3\TMERzCtl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TMESRV.EXE] --a------ 2004-04-13 12:58 135168 C:\Program Files\Toshiba\TME3\TMESRV31.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TosHKCW.exe] --a------ 2002-09-09 16:07 57344 C:\Program Files\Toshiba\Wireless Hotkey\TosHKCW.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TosRotation] --a------ 2004-03-05 11:45 77824 C:\Program Files\Toshiba\TOSHIBA Rotationshjælpeprogram\TRot.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TouchED] --a------ 2003-03-11 14:50 131072 C:\Program Files\Toshiba\TouchED\TouchED.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TSkrMain] --a------ 2004-08-26 11:55 53248 C:\Program Files\Toshiba\Accelerationsværktøjer\Shaker\TSkrMain.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr] -ra------ 2006-03-30 17:45 313472 C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\000StTHK] --a------ 2001-06-23 21:28 32768 C:\WINDOWS\system32\000StTHK.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AGRSMMSG] --a------ 2004-02-20 16:00 88363 C:\WINDOWS\agrsmmsg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent] --a------ 2004-08-04 14:00 110592 C:\WINDOWS\system32\bthprops.cpl [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] --a------ 2004-04-15 16:05 331776 C:\WINDOWS\system32\nwiz.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TFNF5] --a------ 2003-12-02 15:15 81920 C:\WINDOWS\system32\TFNF5.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TPSMain] --a------ 2004-06-28 14:42 274432 C:\WINDOWS\system32\TPSMain.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\WINDOWS\\system32\\ftp.exe"= "C:\\Program Files\\SonicWALL\\SonicWALL Global VPN Client\\SWGVpnClient.exe"= "C:\\WINDOWS\\explorer.exe"= "C:\\Program Files\\ICQ6\\ICQ.exe"= "C:\\Program Files\\Bonjour\\mDNSResponder.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "4899:TCP"= 4899:TCP:Radmin "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009 R1 RCFOX;SonicWALL IPsec Driver;C:\WINDOWS\system32\Drivers\RCFOX.sys [2004-04-05 81200] R1 TMEI3E;TMEI3E;C:\WINDOWS\system32\Drivers\TMEI3E.SYS [2004-06-16 5888] R3 TBtnKey;TOSHIBA Tablet PC Buttons Type N HID Driver;C:\WINDOWS\system32\DRIVERS\TBtnKey.sys [2002-09-12 8832] R3 TEchoCan;Toshiba Audio Effect;C:\WINDOWS\system32\DRIVERS\TEchoCan.sys [2004-02-04 30720] R3 TMicAry;Toshiba Audio Effect with MicArray;C:\WINDOWS\system32\DRIVERS\TMicAry.sys [2004-02-04 138240] R3 WacomPen;Wacom Serial Pen HID Driver;C:\WINDOWS\system32\DRIVERS\wacompen.sys [2004-08-04 13568] S2 MsaSvc;Microsoft authenticate service;C:\WINDOWS\system32\msasvc.exe [ ] S3 rcvpn;SonicWALL VPN Adapter;C:\WINDOWS\system32\DRIVERS\rcvpn.sys [2003-08-20 23180] S3 TS154_CB;T-Sinus 154card Driver;C:\WINDOWS\system32\DRIVERS\TS154ICB.sys [ ] S3 w32n5223;w32n5223 Protocol Driver;C:\PROGRA~1\T-COM\T-COMW~1\INSTAL~1\WINXP\w32n5223.SYS [ ] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b8784980-66f7-11dd-845e-000e7b32456b}] \Shell\AutoRun\command - D:\SETUP.EXE /AUTORUN \Shell\configure\command - D:\SETUP.EXE \Shell\install\command - D:\SETUP.EXE . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-21 11:16:13 Windows 5.1.2600 Service Pack 2 NTFS detected NTDLL code modification: ZwOpenFile scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-10-21 11:18:54 ComboFix-quarantined-files.txt 2008-10-21 09:18:17 ComboFix2.txt 2008-10-21 08:55:58 ComboFix3.txt 2008-10-20 20:49:46 ComboFix4.txt 2008-10-20 18:04:09 ComboFix5.txt 2008-10-21 09:15:17 Pre-Run: 42.439.811.072 bytes free Post-Run: 42,926,927,872 bytes free 221 --- E O F --- 2008-10-19 21:23:10 danke an alle&grüsse Dieser Beitrag wurde am 21.09.2008 um 11:20 Uhr von debbbbbbi editiert.
|
|
|
|
|
|
|
21.09.2008, 11:39
Member
Beiträge: 3716 |
#40
hi, versuch mal das avenger script.
C:\WINDOWS\TEMP\UUCC4D.EXE folders to delete: C:\WINDOWS\system32\sog1 C:\WINDOWS\system32\nysl C:\WINDOWS\system32\kbe C:\WINDOWS\system32\901 C:\WINDOWS\yrolcd.dll C:\WINDOWS\system32\yrolcd.dll |
|
|
|
|
|
|
21.09.2008, 11:41
Member
Beiträge: 3716 |
#41
hallo du sollst den editor öffnen, zu finden unter start programme zubehör.
kopiere dort folgendes rein: REGEDIT4 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa] "Authentication Packages"=hex(7):6d,73,76,31,5f,30,00,00 nun gehe auf datei speichern unter. wähle unten bei dateityp alle aus. schreibe nun als dateinamen fix.reg wähle einen speicherort deiner wahl. klicke nun doppelt auf fix.reg und sie wird in die registry eingetragen |
|
|
|
|
|
|
21.09.2008, 12:37
Member
Beiträge: 50 |
#42
Hi virenfinder,
hab das script bei avenger laufen lassen das kam bei raus: Logfile of The Avenger Version 2.0, (c) by Swandog46 http://swandog46.geekstogo.com Platform: Windows XP ******************* Script file opened successfully. Script file read successfully. Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: Rootkit scan active. No rootkits found! Error: "C:\WINDOWS\system32\sog1" is a folder, not a file! Deletion of file "C:\WINDOWS\system32\sog1" failed! Status: 0xc00000ba (STATUS_FILE_IS_A_DIRECTORY) --> use "Folders to delete:" instead of "Files to delete:" to delete a directory Error: "C:\WINDOWS\system32\nysl" is a folder, not a file! Deletion of file "C:\WINDOWS\system32\nysl" failed! Status: 0xc00000ba (STATUS_FILE_IS_A_DIRECTORY) --> use "Folders to delete:" instead of "Files to delete:" to delete a directory Error: "C:\WINDOWS\system32\kbe" is a folder, not a file! Deletion of file "C:\WINDOWS\system32\kbe" failed! Status: 0xc00000ba (STATUS_FILE_IS_A_DIRECTORY) --> use "Folders to delete:" instead of "Files to delete:" to delete a directory Error: "C:\WINDOWS\system32\901" is a folder, not a file! Deletion of file "C:\WINDOWS\system32\901" failed! Status: 0xc00000ba (STATUS_FILE_IS_A_DIRECTORY) --> use "Folders to delete:" instead of "Files to delete:" to delete a directory Error: file "C:\WINDOWS\yrolcd.dll" not found! Deletion of file "C:\WINDOWS\yrolcd.dll" failed! Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND) --> the object does not exist Error: file "C:\WINDOWS\system32\yrolcd.dll" not found! Deletion of file "C:\WINDOWS\system32\yrolcd.dll" failed! Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND) --> the object does not exist Folder "C:\Temp\mtc2" deleted successfully. Error: folder "C:\WINDOWS\TEMP\UUCC4D.EXE" not found! Deletion of folder "C:\WINDOWS\TEMP\UUCC4D.EXE" failed! Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND) --> the object does not exist Registry value "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows|AppInit_DLLs" replaced with dummy successfully. Completed script processing. ******************* Finished! Terminate. ////////////////////////////////////////// Avenger Pre-Processor log ////////////////////////////////////////// Platform: Windows XP (build 2600, Service Pack 2) Tue Oct 21 12:28:18 2008 12:28:18: Error: Invalid script. A valid script must begin with a command directive. Aborting execution! ////////////////////////////////////////// Logfile of The Avenger Version 2.0, (c) by Swandog46 http://swandog46.geekstogo.com Platform: Windows XP ******************* Script file opened successfully. Script file read successfully. Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: Rootkit scan active. No rootkits found! Error: file "C:\WINDOWS\TEMP\UUCC4D.EXE" not found! Deletion of file "C:\WINDOWS\TEMP\UUCC4D.EXE" failed! Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND) --> the object does not exist Folder "C:\WINDOWS\system32\sog1" deleted successfully. Folder "C:\WINDOWS\system32\nysl" deleted successfully. Folder "C:\WINDOWS\system32\kbe" deleted successfully. Folder "C:\WINDOWS\system32\901" deleted successfully. Error: folder "C:\WINDOWS\yrolcd.dll" not found! Deletion of folder "C:\WINDOWS\yrolcd.dll" failed! Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND) --> the object does not exist Error: folder "C:\WINDOWS\system32\yrolcd.dll" not found! Deletion of folder "C:\WINDOWS\system32\yrolcd.dll" failed! Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND) --> the object does not exist Completed script processing. ******************* Finished! Terminate. ....und jippi das mit dem register hat auch geklappt nun meine letzte frage (hoffentlich): bin ich denn jetzt vierenfrei????und wie um himmelswillen schütze ich mich denn richtig vor so nem neu angriff....damit ich demnächst nicht wieder in der gleichen Schei... sitze??? Lieben dank für die große hilfe an euch alle! |
|
|
|
|
|
|
21.09.2008, 13:04
Member
Beiträge: 3716 |
#43
hi, poste mal ein frisches hijackthis log
|
|
|
|
|
|
|
21.09.2008, 13:10
Member
Beiträge: 50 |
#44
Hier ists:
Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 13:08:05, on 21.10.2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Microsoft Shared\Ink\KeyboardSurrogate.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\SYSTEM32\WISPTIS.EXE C:\WINDOWS\System32\tabbtnu.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Microsoft Shared\Ink\TCServer.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\ClamWin\bin\ClamTray.exe C:\PROGRA~1\ICQ6\ICQ.exe C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\TOSHIBA\TME3\Tmesrv31.exe C:\Program Files\TOSHIBA\TME3\TMETEMNU.EXE C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe C:\WINDOWS\TEMP\EE2B6A.EXE C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\System32\alg.exe C:\Program Files\SonicWALL\SonicWALL Global VPN Client\RampartSvc.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\WINDOWS\system32\wbem\wmiprvse.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.t-online.de/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R3 - URLSearchHook: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~2\tools\iesdsg.dll O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe" -HideWindow O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [ClamWin] "C:\Program Files\ClamWin\bin\ClamTray.exe" --logon O4 - HKCU\..\Run: [ICQ] "C:\PROGRA~1\ICQ6\ICQ.exe" silent O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKUS\S-1-5-19\..\Run: [TabletWizard] %windir%\help\wizard.hta (User 'LOKAL TJENESTE') O4 - HKUS\S-1-5-20\..\Run: [TabletWizard] %windir%\help\wizard.hta (User 'NETVÆRKSTJENESTE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase9602.cab O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1169464580803 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Unknown owner - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe (file missing) O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Microsoft authenticate service (MsaSvc) - Unknown owner - C:\WINDOWS\system32\msasvc.exe (file missing) O23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: OfficeScanNT Personal Firewall (OfcPfwSvc) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe O23 - Service: SonicWall VPN Client Service (RampartSvc) - SonicWALL, Inc. - C:\Program Files\SonicWALL\SonicWALL Global VPN Client\RampartSvc.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: Tmesrv3 (Tmesrv) - TOSHIBA - C:\Program Files\TOSHIBA\TME3\Tmesrv31.exe O23 - Service: OfficeScanNT Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe -- End of file - 7493 bytes hab auch maleware nochmal im quickmodus durchlaufen lassen der hat keine infizierten obj gefunden.(davor hab ich den CCleaner laufen lassen) |
|
|
|
|
|
|
21.09.2008, 13:15
Member
Beiträge: 3716 |
||
|
|
|
|
Um auf dieses Thema zu ANTWORTEN
bitte erst » hier kostenlos registrieren!!
bitte erst » hier kostenlos registrieren!!
Folgende Themen könnten Dich auch interessieren:
Copyright © 2024, Protecus.de - Protecus Team - Impressum / Mediadaten
Prüfe mal diese Datei(en) bei Virustotal http://www.virustotal.com/flash/index_en.html
Zitat
Note: Wenn bei ViruTotal die Meldung kommt ” Die Datei wurde bereits analysiert “wähle „Analysiere die Datei“Und Berichte
Du brauchst hier nicht alle Daten zu posten
Nur die URL kopieren und posten
__________
MfG Argus