TR/Dropper.Gen

hollywoodhank · Jun 11, 2009

ich habe gerade antivir laufen lassen und auf meinem rechner wurde 9-mal dieser virus gefunden

was muss ich machen, um ihn wieder los zu werden?

Babu1940 · Jun 11, 2009

Mach mal das hier und dann hier posten!

http://www.pcwelt.de/forum/sicherhe...12-malwarebefall-posten-bitte-abarbeiten.html

hollywoodhank · Jun 11, 2009

Logfile of random's system information tool 1.06 (written by random/random)
Run by Patrick Maas at 2009-06-11 13:22:57
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 126 GB (53%) free of 238 GB
Total RAM: 2047 MB (60% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:23:26, on 11.06.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16850)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\iTunes\iTunesHelper.exe
C:\Programme\RocketDock\RocketDock.exe
C:\Programme\ICQ6.5\ICQ.exe
C:\WINDOWS\system32\ctfmon.exe
C:\dokumente und einstellungen\patrick maas\lokale einstellungen\anwendungsdaten\wmoqc.exe
C:\Programme\Avira\AntiVir Desktop\avguard.exe
C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programme\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\TUProgSt.exe
C:\Programme\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\Programme\Avira\AntiVir Desktop\avscan.exe
C:\Programme\Winamp\winamp.exe
C:\Dokumente und Einstellungen\Patrick Maas\Desktop\RSIT.exe
C:\Programme\trend micro\Patrick Maas.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Programme\Winamp Toolbar\winamptb.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: TBSB03968 - {AA61DE26-FA67-4575-9033-918671094293} - C:\Dokumente und Einstellungen\Patrick Maas\Anwendungsdaten\Toolbars\Toolbar fuer eBay\ebay.dll
O3 - Toolbar: &TerraTec Home Cinema - {AD6E6555-FB2C-47D4-8339-3E2965509877} - C:\PROGRA~1\TerraTec\TERRAT~1\THCDES~1.DLL
O3 - Toolbar: Toolbar fuer eBay - {000E148C-F7A7-445A-9044-93BF6CE09ECB} - C:\Dokumente und Einstellungen\Patrick Maas\Anwendungsdaten\Toolbars\Toolbar fuer eBay\ebay.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Programme\Winamp Toolbar\winamptb.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programme\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [RocketDock] "C:\Programme\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [ICQ] "C:\Programme\ICQ6.5\ICQ.exe" silent
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [wmoqc] "c:\dokumente und einstellungen\patrick maas\lokale einstellungen\anwendungsdaten\wmoqc.exe" wmoqc
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Winamp Search - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://static.pe.schuelervz.net/photouploader/ImageUploader5.cab?nocache=1227642102
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Programme\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: NBService - Nero AG - C:\Programme\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: SeekeenSrch Service - Unknown owner - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SeekeenSrch\seekeen147.exe (file missing)
O23 - Service: TuneUp Drive Defrag-Dienst (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\System32\TUProgSt.exe
O24 - Desktop Component 0: (no name) - http://board.aggroberlin.de/images/smiles/icon_biggrin.gif
O24 - Desktop Component 1: (no name) - http://board.aggroberlin.de/images/smiles/icon_razz.gif
O24 - Desktop Component 2: (no name) - http://board.aggroberlin.de/images/smiles/icon_cool.gif
O24 - Desktop Component 3: (no name) - http://board.aggroberlin.de/images/smiles/icon_exclaim.gif
O24 - Desktop Component 4: (no name) - http://board.aggroberlin.de/images/smiles/icon_rolleyes.gif

--
End of file - 7783 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\1-Klick-Wartung.job
C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\Norton Security Scan for Patrick Maas.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-23 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}]
Winamp Toolbar Loader - C:\Programme\Winamp Toolbar\winamptb.dll [2009-02-19 1262888]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
RealPlayer Download and Record Plugin for Internet Explorer - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll [2008-02-23 370296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Programme\Java\jre1.6.0_02\bin\ssv.dll [2007-07-12 501136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA61DE26-FA67-4575-9033-918671094293}]
TBSB03968 Class - C:\Dokumente und Einstellungen\Patrick Maas\Anwendungsdaten\Toolbars\Toolbar fuer eBay\ebay.dll [2008-08-14 2484224]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{AD6E6555-FB2C-47D4-8339-3E2965509877} - &TerraTec Home Cinema - C:\PROGRA~1\TerraTec\TERRAT~1\THCDES~1.DLL [2008-04-16 536576]
{000E148C-F7A7-445A-9044-93BF6CE09ECB} - Toolbar fuer eBay - C:\Dokumente und Einstellungen\Patrick Maas\Anwendungsdaten\Toolbars\Toolbar fuer eBay\ebay.dll [2008-08-14 2484224]
{EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - Winamp Toolbar - C:\Programme\Winamp Toolbar\winamptb.dll [2009-02-19 1262888]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2006-01-05 7323648]
"QuickTime Task"=C:\Programme\QuickTime\qttask.exe [2009-05-26 413696]
"AppleSyncNotifier"=C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [2009-05-13 177472]
"iTunesHelper"=C:\Programme\iTunes\iTunesHelper.exe [2009-05-30 292136]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"RocketDock"=C:\Programme\RocketDock\RocketDock.exe [2007-09-02 495616]
"ICQ"=C:\Programme\ICQ6.5\ICQ.exe [2009-03-01 172792]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"wmoqc"=c:\dokumente und einstellungen\patrick maas\lokale einstellungen\anwendungsdaten\wmoqc.exe [2009-06-03 277504]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-10-15 39792]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeBridge]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS4ServiceManager]
C:\Programme\Gemeinsame Dateien\Adobe\CS4ServiceManager\CS4ServiceManager.exe [2008-08-14 611712]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
C:\WINDOWS\ALCMTR.EXE [2005-05-03 69632]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Amazing3DAquariumWallpaper]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [2009-05-13 177472]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avgnt]
C:\Programme\Avira\AntiVir Desktop\avgnt.exe [2009-03-02 209153]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe [2007-03-12 153136]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent]
bthprops.cpl,,BluetoothAuthenticationAgent []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EleFunAnimatedWallpaper]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\emkaomu]
c:\dokumente und einstellungen\patrick maas\lokale einstellungen\anwendungsdaten\emkaomu.exe emkaomu []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Firefox Installer]
C:\Programme\DivX\Google\Firefox\ffinstaller.exe [2006-07-12 76186]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H2O]
C:\Programme\SyncroSoft\Pos\H2O\cledx.exe [2005-10-23 385024]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\High Definition Audio Property Page Shortcut]
C:\WINDOWS\system32\HDAShCut.exe [2004-10-27 61952]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iconcache]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
C:\Programme\iTunes\iTunesHelper.exe [2009-05-30 292136]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Programme\Messenger\msmsgs.exe /background []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
C:\Programme\Windows Live\Messenger\msnmsgr.exe /background []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
C:\Programme\Nero\Nero8\Nero BackItUp\NBKeyScan.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroCheck.exe [2007-03-09 153136]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
C:\WINDOWS\system32\NvCpl.dll [2006-01-05 7323648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
C:\WINDOWS\system32\NvMcTray.dll [2006-01-05 86016]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Programme\QuickTime\qttask.exe [2009-05-26 413696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
C:\WINDOWS\RTHDCPL.EXE [2006-01-11 15961088]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\STYLEXP]
C:\Programme\TGTSoft\StyleXP\StyleXP.exe -Hide []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Programme\Java\jre1.6.0_02\bin\jusched.exe [2007-07-12 132496]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe [2008-02-23 185896]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ucgiikc]
c:\dokumente und einstellungen\patrick maas\lokale einstellungen\anwendungsdaten\ucgiikc.exe ucgiikc []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
C:\Programme\Winamp\winampa.exe [2009-04-10 37888]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Adobe Reader - Schnellstart.lnk]
C:\PROGRA~1\Adobe\READER~1.0\Reader\READER~1.EXE [2008-10-15 39792]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Adobe Reader Synchronizer.lnk]
C:\PROGRA~1\Adobe\READER~1.0\Reader\ADOBEC~1.EXE [2007-05-11 738968]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Microsoft Office.lnk]
C:\PROGRA~1\MICROS~4\Office\OSA9.EXE [1999-02-17 65588]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Dokumente und Einstellungen^Patrick Maas^Startmenü^Programme^Autostart^Adobe Gamma.lnk]
C:\PROGRA~1\GEMEIN~1\Adobe\CALIBR~1\ADOBEG~1.EXE []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Dokumente und Einstellungen^Patrick Maas^Startmenü^Programme^Autostart^Office-Start.lnk]
C:\PROGRA~1\MICROS~4\Office\OSA.EXE [1996-12-14 51984]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Programme\Mozilla Firefox\firefox.exe"="C:\Programme\Mozilla Firefox\firefox.exe:*:Enabled:Firefox"
"C:\Programme\Gemeinsame Dateien\Ahead\Nero Web\SetupX.exe"="C:\Programme\Gemeinsame Dateien\Ahead\Nero Web\SetupX.exe:*:Enabled:Nero ProductSetup"
"C:\Programme\mIRC\mirc.exe"="C:\Programme\mIRC\mirc.exe:*:Enabled:mIRC"
"C:\Programme\Internet Explorer\IEXPLORE.EXE"="C:\Programme\Internet Explorer\IEXPLORE.EXE:*:Enabled:Internet Explorer"
"D:\Need for Speed - Pro Street\nfs.exe"="D:\Need for Speed - Pro Street\nfs.exe:*:Enabled:nfs"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\WINDOWS\system32\dplaysvr.exe"="C:\WINDOWS\system32\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper"
"C:\Programme\TerraTec\TerraTec Home Cinema\tvtvSetup\tvtv_Wizard.exe"="C:\Programme\TerraTec\TerraTec Home Cinema\tvtvSetup\tvtv_Wizard.exe:*:Enabled:TerraTec tvtv Setup"
"C:\Programme\TerraTec\TerraTec Home Cinema\CinergyDvr.exe"="C:\Programme\TerraTec\TerraTec Home Cinema\CinergyDvr.exe:*:Enabled:TerraTec Home Cinema"
"C:\Programme\TerraTec\TerraTec Home Cinema\VersionCheck\VersionCheck.exe"="C:\Programme\TerraTec\TerraTec Home Cinema\VersionCheck\VersionCheck.exe:*:Enabled:TerraTec Home Cinema (Auto Update)"
"C:\Programme\Gemeinsame Dateien\Adobe\CS4ServiceManager\CS4ServiceManager.exe"="C:\Programme\Gemeinsame Dateien\Adobe\CS4ServiceManager\CS4ServiceManager.exe:*:Enabled:Adobe CSI CS4"
"C:\Programme\Bonjour\mDNSResponder.exe"="C:\Programme\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Dokumente und Einstellungen\Patrick Maas\Desktop\Weisseradler-Script 1.071\Weisseradler-Script.exe"="C:\Dokumente und Einstellungen\Patrick Maas\Desktop\Weisseradler-Script 1.071\Weisseradler-Script.exe:*:Enabled:mIRC"
"D:\TmNationsForever\TmForever.exe"="D:\TmNationsForever\TmForever.exe:*:Enabled:TmForever"
"C:\Programme\TerraTec\TerraTec Home Cinema\InstTool.exe"="C:\Programme\TerraTec\TerraTec Home Cinema\InstTool.exe:*:Enabled:TerraTec Home Cinema Classic (Setup)"
"C:\Programme\ICQ6.5\ICQ.exe"="C:\Programme\ICQ6.5\ICQ.exe:*:Enabled:ICQ6"
"C:\Programme\iTunes\iTunes.exe"="C:\Programme\iTunes\iTunes.exe:*:Enabled:iTunes"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Programme\Windows Live\Messenger\msnmsgr.exe"="C:\Programme\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Programme\Windows Live\Messenger\livecall.exe"="C:\Programme\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

======File associations======

.reg - open - "regedit.exe" "%1"

======List of files/folders created in the last 1 months======

2009-06-11 13:22:59 ----D---- C:\Programme\trend micro
2009-06-11 13:22:57 ----D---- C:\rsit
2009-06-10 21:28:31 ----HDC---- C:\WINDOWS\$NtUninstallKB961501$
2009-06-10 21:28:24 ----HDC---- C:\WINDOWS\$NtUninstallKB969898$
2009-06-10 21:26:44 ----HDC---- C:\WINDOWS\$NtUninstallKB970238$
2009-06-10 21:26:02 ----HDC---- C:\WINDOWS\$NtUninstallKB968537$
2009-06-03 20:43:27 ----D---- C:\Programme\QuickTime
2009-05-15 19:56:25 ----D---- C:\Programme\ICQ6.5

======List of files/folders modified in the last 1 months======

2009-06-11 13:22:59 ----RD---- C:\Programme
2009-06-11 13:22:56 ----D---- C:\WINDOWS\Prefetch
2009-06-11 11:35:41 ----D---- C:\Programme\Mozilla Firefox
2009-06-11 10:08:27 ----D---- C:\WINDOWS\Temp
2009-06-11 10:08:25 ----D---- C:\WINDOWS\system32\CatRoot2
2009-06-11 00:26:22 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-06-10 21:46:07 ----D---- C:\WINDOWS
2009-06-10 21:45:38 ----D---- C:\WINDOWS\system32
2009-06-10 21:28:34 ----HD---- C:\WINDOWS\inf
2009-06-10 21:28:33 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-06-10 21:28:27 ----A---- C:\WINDOWS\imsins.BAK
2009-06-10 21:28:23 ----HD---- C:\WINDOWS\$hf_mig$
2009-06-10 21:26:32 ----D---- C:\WINDOWS\system32\de-de
2009-06-10 21:26:32 ----D---- C:\Programme\Internet Explorer
2009-06-10 20:41:53 ----SHD---- C:\WINDOWS\Installer
2009-06-10 20:41:09 ----D---- C:\Programme\Safari
2009-06-10 18:00:26 ----D---- C:\Programme\Gemeinsame Dateien\Symantec Shared
2009-06-10 18:00:01 ----D---- C:\Programme\Norton Security Scan
2009-06-08 18:59:25 ----A---- C:\WINDOWS\NeroDigital.ini
2009-06-03 20:50:48 ----D---- C:\WINDOWS\system32\drivers
2009-06-03 20:50:48 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Apple
2009-06-03 20:46:05 ----D---- C:\Programme\iTunes
2009-06-03 20:45:45 ----D---- C:\Programme\iPod
2009-06-03 20:45:44 ----D---- C:\Programme\Gemeinsame Dateien\Apple
2009-06-03 20:41:28 ----DC---- C:\WINDOWS\system32\DRVSTORE
2009-06-03 14:43:07 ----D---- C:\Programme\RocketDock
2009-06-02 22:53:32 ----RSD---- C:\WINDOWS\Fonts
2009-06-01 18:51:12 ----A---- C:\WINDOWS\system32\MRT.exe
2009-05-29 17:08:40 ----RASH---- C:\boot.ini
2009-05-29 17:08:40 ----A---- C:\WINDOWS\win.ini
2009-05-29 17:08:40 ----A---- C:\WINDOWS\system.ini
2009-05-29 13:36:16 ----A---- C:\WINDOWS\system32\usbaaplrc.dll
2009-05-15 20:07:12 ----D---- C:\WINDOWS\Downloaded Installations

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 avgio;avgio; \??\C:\Programme\Avira\AntiVir Desktop\avgio.sys []
R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2009-04-27 96104]
R1 intelppm;Intel-Prozessortreiber; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40448]
R1 kbdhid;Tastatur-HID-Treiber; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14720]
R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2009-06-10 28520]
R2 adfs;adfs; C:\WINDOWS\system32\drivers\adfs.sys [2008-08-14 74720]
R2 avgntflt;avgntflt; C:\WINDOWS\system32\DRIVERS\avgntflt.sys [2009-04-27 55640]
R3 Arp1394;1394-ARP-Clientprotokoll; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-14 60800]
R3 Cap7146_DVB;Cinergy 1200 DVB-S Capture (BDA); C:\WINDOWS\System32\Drivers\TTCinCap.sys [2007-09-17 62976]
R3 CLEDX;Team H2O CLEDX service; C:\WINDOWS\system32\DRIVERS\cledx.sys [2005-05-09 33792]
R3 E100B;Intel(R) PRO Network Connection Driver; C:\WINDOWS\system32\DRIVERS\e100b325.sys [2005-06-13 162816]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2009-03-19 23400]
R3 HDAudBus;Microsoft UAA-Bustreiber für High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 hidusb;Microsoft HID Class-Treiber; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2006-01-13 4137984]
R3 mouhid;Maus-HID-Treiber; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2004-08-04 12288]
R3 NIC1394;1394-Netzwerktreiber; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-14 61824]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2006-01-05 3580416]
R3 PTDVB;Cinergy 1200 DVB-S Tuner (BDA); C:\WINDOWS\System32\Drivers\TTCinTun.sys [2007-09-17 117120]
R3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2009-05-29 39424]
R3 usbccgp;Microsoft Standard-USB-Haupttreiber; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
R3 usbehci;Miniporttreiber für erweiterten Microsoft USB 2.0-Hostcontroller; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-14 30208]
R3 usbhub;USB2-aktivierter Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-14 59520]
R3 usbstor;USB-Massenspeichertreiber; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
R3 usbuhci;Miniporttreiber für universellen Microsoft USB-Hostcontroller; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-14 20608]
S3 BthEnum;Bluetooth-Auflistungsdienst; C:\WINDOWS\system32\DRIVERS\BthEnum.sys [2008-04-14 17024]
S3 BthPan;Bluetooth-Gerät (PAN); C:\WINDOWS\system32\DRIVERS\bthpan.sys [2008-04-14 101120]
S3 BTHPORT;Bluetooth-Porttreiber; C:\WINDOWS\System32\Drivers\BTHport.sys [2008-06-14 273024]
S3 BTHUSB;USB-Treiber für Bluetooth-Funkgerät; C:\WINDOWS\System32\Drivers\BTHUSB.sys [2008-04-14 18944]
S3 BVRPMPR5;BVRPMPR5 NDIS Protocol Driver; \??\C:\WINDOWS\system32\drivers\BVRPMPR5.SYS []
S3 CCDECODE;Untertiteldecoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-14 17024]
S3 DVBLLC;Cinergy 1200 DVB Service; C:\WINDOWS\System32\Drivers\DVBLLC32.sys [2005-09-29 58112]
S3 HdAudAddService;Microsoft UAA Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\HdAudio.sys [2004-10-27 145920]
S3 MPE;BDA MPE-Filter; C:\WINDOWS\system32\DRIVERS\MPE.sys [2008-04-14 15232]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink-Konvertierung; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-14 5504]
S3 NABTSFEC;NABTS/FEC VBI-Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-14 85248]
S3 NdisIP;Microsoft TV-/Videoverbindung; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-14 10880]
S3 RFCOMM;Bluetooth-Gerät (RFCOMM-Protokoll-TDI); C:\WINDOWS\system32\DRIVERS\rfcomm.sys [2008-04-14 59136]
S3 S6U12Scanner;MUSTEK 1200 CU Still Image Device Service; C:\WINDOWS\system32\drivers\usbscan.sys [2008-04-14 15104]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-14 11136]
S3 streamip;BDA-IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-14 15232]
S3 usbprint;Microsoft USB-Druckerklasse; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-14 25856]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WSTCODEC;World Standard Teletext-Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-14 19200]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AntiVirSchedulerService;Avira AntiVir Planer; C:\Programme\Avira\AntiVir Desktop\sched.exe [2009-06-10 108289]
R2 AntiVirService;Avira AntiVir Guard; C:\Programme\Avira\AntiVir Desktop\avguard.exe [2009-06-10 185089]
R2 Apple Mobile Device;Apple Mobile Device; C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-05-29 144712]
R2 Bonjour Service;Bonjour-Dienst; C:\Programme\Bonjour\mDNSResponder.exe [2008-12-12 238888]
R2 BthServ;Bluetooth Support Service; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2006-01-05 143427]
R2 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2007-12-15 66872]
R2 ProtexisLicensing;ProtexisLicensing; C:\WINDOWS\system32\PSIService.exe [2006-11-02 174656]
R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service; C:\WINDOWS\System32\TUProgSt.exe [2009-01-10 603904]
R2 UxTuneUp;TuneUp Designerweiterung; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R3 iPod Service;iPod-Dienst; C:\Programme\iPod\bin\iPodService.exe [2009-05-30 541992]
S2 SeekeenSrch Service;SeekeenSrch Service; C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SeekeenSrch\seekeen147.exe C:\Programme\SeekeenSrch\seekeen.dll Service []
S3 Adobe LM Service;Adobe LM Service; C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe [2007-07-31 72704]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2008-11-23 655624]
S3 IDriverT;InstallDriver Table Manager; C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 NBService;NBService; C:\Programme\Nero\Nero 7\Nero BackItUp\NBService.exe [2007-03-14 779824]
S3 NMIndexingService;NMIndexingService; C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe [2007-03-12 271920]
S3 TuneUp.Defrag;TuneUp Drive Defrag-Dienst; C:\WINDOWS\System32\TuneUpDefragService.exe [2009-01-10 360192]
S3 WMPNetworkSvc;Windows Media Player-Netzwerkfreigabedienst; C:\Programme\Windows Media Player\WMPNetwk.exe [2006-11-03 920576]

-----------------EOF-----------------
Click to expand...

edit: war doch nicht nur der virus, der wurde 7-mal gefunden
und 1-mal ADSPY/OneStep.AF
und 1-mal TR/ATRAPS.Gen

-humi- · Jun 11, 2009

das Log von MBAM fehlt

dein System ist infiziert

lass bitte folgendes auf Virustotal bzw Jotti scannen und poste hier das Ergebnis:
Code:
C:\dokumente und einstellungen\patrick maas\lokale einstellungen\anwendungsdaten\wmoqc.exe

hollywoodhank · Jun 12, 2009

hier ist das ergebnis

Antivirus Version letzte aktualisierung Ergebnis

a-squared 4.5.0.18 2009.06.12 -
AhnLab-V3 5.0.0.2 2009.06.12 -
AntiVir 7.9.0.187 2009.06.12 -
Antiy-AVL 2.0.3.1 2009.06.12 -
Authentium 5.1.2.4 2009.06.12 -
Avast 4.8.1335.0 2009.06.11 -
AVG 8.5.0.339 2009.06.12 NaviPromo.AA
BitDefender 7.2 2009.06.12 -
CAT-QuickHeal 10.00 2009.06.12 -
ClamAV 0.94.1 2009.06.12 -
Comodo 1322 2009.06.12 -
DrWeb 5.0.0.12182 2009.06.12 -
eSafe 7.0.17.0 2009.06.11 -
eTrust-Vet 31.6.6555 2009.06.12 -
F-Prot 4.4.4.56 2009.06.12 -
F-Secure 8.0.14470.0 2009.06.12 -
Fortinet 3.117.0.0 2009.06.12 -
GData 19 2009.06.12 -
Ikarus T3.1.1.59.0 2009.06.12 -
K7AntiVirus 7.10.762 2009.06.12 -
Kaspersky 7.0.0.125 2009.06.12 -
McAfee 5644 2009.06.12 -
McAfee+Artemis 5644 2009.06.12 -
McAfee-GW-Edition 6.7.6 2009.06.12 -
Microsoft 1.4701 2009.06.12 -
NOD32 4151 2009.06.12 -
Norman 6.01.09 2009.06.12 -
nProtect 2009.1.8.0 2009.06.12 -
Panda 10.0.0.14 2009.06.12 -
PCTools 4.4.2.0 2009.06.12 -
Prevx 3.0 2009.06.12 -
Rising 21.33.44.00 2009.06.12 -
Sophos 4.42.0 2009.06.12 -
Sunbelt 3.2.1858.2 2009.06.12 -
Symantec 1.4.4.12 2009.06.12 -
TheHacker 6.3.4.3.344 2009.06.11 -
TrendMicro 8.950.0.1092 2009.06.12 -
VBA32 3.12.10.7 2009.06.12 -
ViRobot 2009.6.12.1783 2009.06.12 -

weitere Informationen
File size: 3148 bytes
MD5...: 16fd0624b80a571324a75784aa7011f4
SHA1..: 132ebcd863f33b083789130ae7568d27b36a9104
SHA256: adacadbb095c600e285508995214e2656ce07face6dc8db6e23113aae606ed20
ssdeep: -
PEiD..: -
TrID..: File type identification
Unknown!
PEInfo: -
PDFiD.: -
RDS...: NSRL Reference Data Set
-
Click to expand...

Nevok · Jun 12, 2009

@ hollywoodhank

Java Runtime Environment ist veraltet. Bitte deinstallieren und die aktuelle Version 6.0 Update 14 besorgen und installieren.

Gruß
Nevok

hollywoodhank · Jun 12, 2009

ok, hab ich
und jetzt?

deoroller · Jun 12, 2009

Poste doch mal den Bericht von Antivir über die Funde.

Zu NaviPromo:
Navipromo installiert man sich üblicherweise unfreiwillig mit. Beispiele sind InternetGameBox, WebMediaPlayer, Messenger Plus, ...
http://www.pcadept.de/news/navipromo-ist-zurueck-16.html

-humi- · Jun 13, 2009

wie Deo sagt, bitte den Bericht posten,

anschl. Navilog ausführen, bereinigen und Log posten
http://virus-protect.org/artikel/tools/navilog.html

hollywoodhank · Jun 13, 2009

hier mal der antivir bericht

ist schon weniger geworden

der log von navilog nach dem search - durchlauf

Search Navipromo version 3.7.7 began on 13.06.2009 at 20:47:35,57

!!! Warning, this report may include legitimate files/programs !!!
!!! Post this report on the forum you are being helped !!!
!!! Don't continue with removal unless instructed by an authorized helper !!!

Fix running from C:\Programme\navilog1

Updated on 12.05.2009 at 18h00 by IL-MAFIOSO

Microsoft Windows XP Home Edition ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) D CPU 2.80GHz )
BIOS : Award Modular BIOS v6.00PG
USER : Patrick Maas ( Administrator )
BOOT : Normal boot

Antivirus : AntiVir Desktop 9.0.1.30 (Activated)

C:\ (Local Disk) - NTFS - Total:232 Go (Free:127 Go)
D:\ (Local Disk) - NTFS - Total:232 Go (Free:219 Go)
E:\ (CD or DVD)
F:\ (CD or DVD)
G:\ (USB)
H:\ (USB)
I:\ (USB)
J:\ (USB)
K:\ (USB)

Search done in normal mode

*** Search folders in "C:\WINDOWS" ***

*** Search folders in "C:\Programme" ***

*** Search folders in "C:\Dokumente und Einstellungen\All Users\startm~1\progra~1" ***

*** Search folders in "C:\Dokumente und Einstellungen\All Users\startm~1" ***

*** Search folders in "c:\dokume~1\alluse~1\anwend~1" ***

*** Search folders in "C:\Dokumente und Einstellungen\Patrick Maas\anwend~1" ***

*** Search folders in "C:\Dokumente und Einstellungen\Patrick Maas\lokale~1\anwend~1" ***

*** Search folders in "C:\Dokumente und Einstellungen\Patrick Maas\startm~1\progra~1" ***

*** Search with Catchme-rootkit/stealth malware detector by gmer ***
for more info : http://www.gmer.net

*** Search with GenericNaviSearch ***
!!! Possibility of legitimate files in the result !!!
!!! Must always be checked before manually deleting !!!

* Scan in "C:\WINDOWS\system32" *

* Scan in "C:\Dokumente und Einstellungen\Patrick Maas\lokale~1\anwend~1" *

*** Search files ***

*** Search specific Registry keys ***
!! Following keys are not certainly all infected !!

*** Complementary Search ***
(Search specific files)

1)Search new Instant Access files :

2)Heuristic Search :

* In "C:\WINDOWS\system32" :

* In "C:\Dokumente und Einstellungen\Patrick Maas\lokale~1\anwend~1" :

wmoqc.dat found !
wmoqc_nav.dat found !
wmoqc_navps.dat found !

3)Certificates Search :

Egroup certificate not found !
Electronic-Group certificate not found !
Montorgueil certificate not found !
OOO-Favorit certificate not found !
Sunny-Day-Design-Ltd certificate not found !

4)Search others known folders and files :

*** Search completed on 13.06.2009 at 21:00:46,26 ***
Click to expand...

und hier der log nach dem bereinigungs - durchlauf

Navipromo Removal version 3.7.7 started on 13.06.2009 at 21:03:09,62

Fix running from C:\Programme\navilog1

Updated on 12.05.2009 at 18h00 by IL-MAFIOSO

Microsoft Windows XP Home Edition ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) D CPU 2.80GHz )
BIOS : Award Modular BIOS v6.00PG
USER : Patrick Maas ( Administrator )
BOOT : Normal boot

Antivirus : AntiVir Desktop 9.0.1.30 (Activated)

C:\ (Local Disk) - NTFS - Total:232 Go (Free:127 Go)
D:\ (Local Disk) - NTFS - Total:232 Go (Free:219 Go)
E:\ (CD or DVD)
F:\ (CD or DVD)
G:\ (USB)
H:\ (USB)
I:\ (USB)
J:\ (USB)
K:\ (USB)

Automatic removal
with Catchme and GNS results

Cleanning stage done on Reboot

*** fsbl1.txt not found ***
(Check that Catchme found nothing in Search Mode)

*** Deleting with Backups GenericNaviSearch results ***

* Deletion in "C:\WINDOWS\System32" *

* Deletion in "C:\Dokumente und Einstellungen\Patrick Maas\lokale~1\anwend~1" *

*** Deleting folders in "C:\WINDOWS" ***

*** Deleting folders in "C:\Programme" ***

*** Deleting folders in "C:\Dokumente und Einstellungen\All Users\startm~1\progra~1" ***

*** Deleting folders in "C:\Dokumente und Einstellungen\All Users\startm~1" ***

*** Deleting folders in "c:\dokume~1\alluse~1\anwend~1" ***

*** Deleting folders in "C:\Dokumente und Einstellungen\Patrick Maas\anwend~1" ***

*** Deleting folders in "C:\Dokumente und Einstellungen\Patrick Maas\lokale~1\anwend~1" ***

*** Deleting folders in "C:\Dokumente und Einstellungen\Patrick Maas\startm~1\progra~1" ***

*** Deleting files ***

*** Deleting temporary files ***

Cleaning of C:\WINDOWS\Temp done !
Cleaning of C:\Dokumente und Einstellungen\Patrick Maas\lokale~1\Temp done !

*** Complementary Search ***
(Search specific files)

1)Deletion with backups new Instant Access files:

2)Heuristic search and deletion with backups :

* In "C:\WINDOWS\system32" *

* In "C:\Dokumente und Einstellungen\Patrick Maas\lokale~1\anwend~1" *

wmoqc.dat found !
Copy wmoqc.dat done !
wmoqc.dat deleted !

wmoqc_nav.dat found !
Copy wmoqc_nav.dat done !
wmoqc_nav.dat deleted !

wmoqc_navps.dat found !
Copy wmoqc_navps.dat done !
wmoqc_navps.dat deleted !

C:\WINDOWS\prefetch\wmoqc*.pf found !
Copy C:\WINDOWS\prefetch\wmoqc*.pf done !
C:\WINDOWS\prefetch\wmoqc*.pf deleted !

*** Copy Registry to Safebackup folder ***

Backing up Registry done !

*** Cleaning Registry ***

Registry cleaned

*** Certificates ***

Egroup Certificate not found !
Electronic-Group Certificate not found !
Montorgueil Certificate not found !
OOO-Favorit Certificate not found !
Sunny-Day-Design-Ltd Certificate not found !

*** Search others known folders and files ***

*** Cleaning stage complete on 13.06.2009 at 21:08:21,00 ***
Click to expand...

deoroller · Jun 13, 2009

hollywoodhank said: ↑

hier mal der antivir bericht

ist schon weniger geworden
Click to expand...

Wenn du die Systemwiederherstellung mal vorübergehend deaktivierst, wird es noch weniger.

hollywoodhank · Jun 13, 2009

deoroller said: ↑

Wenn du die Systemwiederherstellung mal vorübergehend deaktivierst, wird es noch weniger.
Click to expand...

wenn ich die dann wieder aktivier, sind dann die viren trotzdem noch weg?

Nevok · Jun 13, 2009

Ja, sind sie.

Gruß
Nevok

hollywoodhank · Jun 13, 2009

jetzt wurde gar kein virus mehr gefunden, danke an alle für die hilfe

deoroller · Jun 13, 2009

~phoenix~ wird vielleicht noch etwas zu dem Navilog sagen.
Damit kenne ich mich nicht aus.

hollywoodhank · Jun 14, 2009

ok, dann lasst den thread bitte noch so lange offen, bis das geklärt ist

-humi- · Jun 14, 2009

der Navipromo und was dazu gehört wurde beseitigt:

wmoqc.dat found !
Copy wmoqc.dat done !
wmoqc.dat deleted !

wmoqc_nav.dat found !
Copy wmoqc_nav.dat done !
wmoqc_nav.dat deleted !

wmoqc_navps.dat found !
Copy wmoqc_navps.dat done !
wmoqc_navps.dat deleted !

C:\WINDOWS\prefetch\wmoqc*.pf found !
Copy C:\WINDOWS\prefetch\wmoqc*.pf done !
C:\WINDOWS\prefetch\wmoqc*.pf deleted !
Click to expand...

Du kannst dein System noch mittels Bitdefender onlins Scan durchsuchen lassen:
falls was gefunden wird: posten
wenn nicht, dann habe fertig
http://www.bitdefender.de/scan_de/scan8/ie.html

Um einen Befall künftig zu vermeiden:
http://www.pcwelt.de/forum/sicherhe...-zusammenstellung-mache-meinen-pc-sicher.html

hollywoodhank · Jun 14, 2009

da wurde nichts mehr gefunden
danke nochmal an alle

Log in or Sign up

TR/Dropper.Gen

hollywoodhank Byte

Babu1940 Viertel Gigabyte

hollywoodhank Byte

-humi- Joker

hollywoodhank Byte

Nevok Ganzes Gigabyte

hollywoodhank Byte

deoroller Wandelndes Forum

-humi- Joker

hollywoodhank Byte

deoroller Wandelndes Forum

hollywoodhank Byte

Nevok Ganzes Gigabyte

hollywoodhank Byte

deoroller Wandelndes Forum

hollywoodhank Byte

-humi- Joker

hollywoodhank Byte

Share This Page