Hijackthis auswertung!! Hilfe bei Auswertung

 :'( keiner da? 

Du kanns das auch selber auswerten lassen bei http://hijackthis.de

Und die Auswertung sagt, dass du al2dll.dll - Malware aufm Rechner hast.

Hey hab schon die automatische auswertung gemacht und dieses al2spy ist nix  das ist von meinem prgramm fingerprint reader! fps ist okay .

Ansonsten siehts ganz OK aus. Ein paar unnötige Einträge sind noch da, die kannste noch fixen.

Okay danke.
Hoffe trotzdem das Sir Reklov sich das ma anschaut  .


gruß deniz

Hallo,

probiere mal das und poste das Log !
http://people.freenet.de/rene-gad/AVZAnleitung/AVZ4.html

Normalerweise schaue ich mir keine Logs zum Spaß an.Im Gegensatz zur automatischen Auswertung brauche ich dafür ein wenig Zeit und Hirnschmalz..
Ohne eine vernünftige Fehlerbeschreibung schon gar nicht.Dafür ist so ein Log zu lang...

Wenn du aber als Versuchskaninchen mal den Testhasen machst,siehe oben,dann schau ich auch mal...

Deiner Kiste passiert nix..
Ist eine andere, möglicherweise bessere Form, von Hijackthis.Zumindest ist dieses AVZ nicht so leicht sich davor zu verstecken.
Sir Reklov

Hallo,
hab mal nen logfile gemacht,und den log von hijackthis hab ich hier gepostet,weil ich ich vermute das sich gestern jemand bei mir eingehäckt hat!!Auf einmal haben sich ein paar prgramme geschlossen und der pc hing total dann hab ich das lan kaben gezogen und alles war wieder okay  ??? .

Log:

1. Searching for rootkits and programs intercepting API functions
1.1 Searching for user-mode API hooks
 Analysis: kernel32.dll, export table found in section: .text
Function kernel32.dll:GetProcAddress (408) intercepted, method ProcAddressHijack.GetProcAddress ->7C80AC28->7C882FEC
Hook kernel32.dll:GetProcAddress (408) blocked
Function kernel32.dll:LoadLibraryA (578) intercepted, method ProcAddressHijack.GetProcAddress ->7C801D77->7C882F9C
Hook kernel32.dll:LoadLibraryA (578) blocked
 >>> Functions LoadLibraryA - preventing the AVZ process from being intercepted by address replacement  !!)
Function kernel32.dll:LoadLibraryExA (579) intercepted, method ProcAddressHijack.GetProcAddress ->7C801D4F->7C882FB0
Hook kernel32.dll:LoadLibraryExA (579) blocked
 >>> Functions LoadLibraryExA - preventing the AVZ process from being intercepted by address replacement !!)
Function kernel32.dll:LoadLibraryExW (580) intercepted, method ProcAddressHijack.GetProcAddress ->7C801AF1->7C882FD8
Hook kernel32.dll:LoadLibraryExW (580) blocked
Function kernel32.dll:LoadLibraryW (581) intercepted, method ProcAddressHijack.GetProcAddress ->7C80ACD3->7C882FC4
Hook kernel32.dll:LoadLibraryW (581) blocked
 Analysis: ntdll.dll, export table found in section: .text
 Analysis: user32.dll, export table found in section: .text
 Analysis: advapi32.dll, export table found in section: .text
 Analysis: ws2_32.dll, export table found in section: .text
 Analysis: wininet.dll, export table found in section: .text
 Analysis: rasapi32.dll, export table found in section: .text
 Analysis: urlmon.dll, export table found in section: .text
 Analysis: netapi32.dll, export table found in section: .text
1.4 Searching for masking processes and drivers
 The extended monitoring driver (AVZPM) is not installed, examination is not performed
2. Scanning memory
 Number of processes found: 30
Analyzer - the process under analysis is 604 C:\WINDOWS\System32\smss.exe
[ES]:Application has no visible windows
[ES]:Located in system folder
Analyzer - the process under analysis is 684 C:\WINDOWS\system32\csrss.exe
[ES]:Application has no visible windows
[ES]:Located in system folder
Analyzer - the process under analysis is 708 C:\WINDOWS\system32\winlogon.exe
[ES]:Contains network functionality
[ES]:Application has no visible windows
[ES]:Located in system folder
Process c:\windows\system32\winlogon.exe contains network functionality (netapi32.dll,ws2_32.dll,ws2help.dll)
Analyzer - the process under analysis is 752 C:\WINDOWS\system32\services.exe
[ES]:Contains network functionality
[ES]:Application has no visible windows
[ES]:Located in system folder
Process c:\windows\system32\services.exe contains network functionality (netapi32.dll,ws2_32.dll,ws2help.dll)
Analyzer - the process under analysis is 764 C:\WINDOWS\system32\lsass.exe
[ES]:Contains network functionality
[ES]:Application has no visible windows
[ES]:Located in system folder
Process c:\windows\system32\lsass.exe contains network functionality (ws2_32.dll,ws2help.dll,netapi32.dll)
Analyzer - the process under analysis is 924 C:\WINDOWS\system32\svchost.exe
[ES]:Contains network functionality
[ES]:Application has no visible windows
[ES]:Located in system folder
Process c:\windows\system32\svchost.exe contains network functionality (ws2_32.dll,ws2help.dll,netapi32.dll)
Analyzer - the process under analysis is 980 C:\WINDOWS\system32\svchost.exe
[ES]:Contains network functionality
[ES]:Listens TCP ports !
[ES]:Application has no visible windows
[ES]:Located in system folder
[ES]:Loads RASAPI DLL - may use dialing?
Process c:\windows\system32\svchost.exe contains network functionality (ws2_32.dll,ws2help.dll)
Analyzer - the process under analysis is 1124 C:\WINDOWS\System32\svchost.exe
[ES]:Contains network functionality
[ES]:Application has no visible windows
[ES]:Located in system folder
[ES]:Loads RASAPI DLL - may use dialing?
Process c:\windows\system32\svchost.exe contains network functionality (netapi32.dll,ws2_32.dll,ws2help.dll,wininet.dll,rasapi32.dll,tapi32.dll,es.dll,urlmon.dll)
Analyzer - the process under analysis is 1192 C:\WINDOWS\system32\svchost.exe
[ES]:Contains network functionality
[ES]:Application has no visible windows
[ES]:Located in system folder
Process c:\windows\system32\svchost.exe contains network functionality (ws2_32.dll,ws2help.dll)
Analyzer - the process under analysis is 1368 C:\WINDOWS\system32\svchost.exe
[ES]:Contains network functionality
[ES]:Application has no visible windows
[ES]:Located in system folder
Process c:\windows\system32\svchost.exe contains network functionality (ws2_32.dll,ws2help.dll,wininet.dll,urlmon.dll)
Analyzer - the process under analysis is 1524 C:\WINDOWS\system32\spoolsv.exe
[ES]:Contains network functionality
[ES]:Application has no visible windows
[ES]:Located in system folder
[ES]:Loads RASAPI DLL - may use dialing?
Process c:\windows\system32\spoolsv.exe contains network functionality (ws2_32.dll,ws2help.dll,netapi32.dll)
Process c:\windows\explorer.exe contains network functionality (netapi32.dll,wininet.dll,urlmon.dll,ws2_32.dll,ws2help.dll)
Analyzer - the process under analysis is 1804 C:\Programme\Lavasoft\Ad-Aware 2007\aawservice.exe
[ES]:Contains network functionality
[ES]:Application has no visible windows
Process c:\programme\lavasoft\ad-aware 2007\aawservice.exe contains network functionality (wininet.dll,ws2_32.dll,ws2help.dll)
c:\programme\gemeinsame dateien\apple\mobile device support\bin\applemobiledeviceservice.exe >>> suspicion for Trojan-Downloader.Win32.Agent.alu ( 0057B1AC 08CD5FC5 001E52D2 001E5272 106496)
Process c:\programme\gemeinsame dateien\apple\mobile device support\bin\applemobiledeviceservice.exe contains network functionality (ws2_32.dll,ws2help.dll)
Analyzer - the process under analysis is 1992 C:\WINDOWS\system32\nvsvc32.exe
[ES]:Contains network functionality
[ES]:Application has no visible windows
[ES]:Located in system folder
Process c:\windows\system32\nvsvc32.exe contains network functionality (netapi32.dll,ws2_32.dll,ws2help.dll)
Analyzer - the process under analysis is 308 C:\Programme\Java\jre1.6.0_02\bin\jusched.exe
[ES]:Contains network functionality
[ES]:Application has no visible windows
[ES]:Registered in autoruns !!
Process c:\programme\java\jre1.6.0_02\bin\jusched.exe contains network functionality (wininet.dll)
Analyzer - the process under analysis is 324 C:\WINDOWS\system32\ctfmon.exe
[ES]:Application has no visible windows
[ES]:Located in system folder
[ES]:Registered in autoruns !!
>>> The real size is supposed to be  2494464
Analyzer - the process under analysis is 332 C:\Programme\FPSoftware\FPFiles\FPQuickBar.exe
[ES]:Contains network functionality
[ES]:Application has no visible windows
[ES]:EXE runtime packer ?
[ES]:Registered in autoruns !!
Process c:\programme\fpsoftware\fpfiles\fpquickbar.exe contains network functionality (netapi32.dll,urlmon.dll)
Analyzer - the process under analysis is 416 C:\WINDOWS\Alt+Q Hotkey.exe
[ES]:Application has no visible windows
[ES]:Located in system folder
[ES]:Registered in autoruns !!
>>> The real size is supposed to be  2158592
Analyzer - the process under analysis is 556 C:\Programme\FPSoftware\FPFiles\BioManager\BioLogin\Autologin.exe
[ES]:Application has no visible windows
[ES]:EXE runtime packer ?
Analyzer - the process under analysis is 564 C:\Programme\FPSoftware\FPFiles\BioManager\FPLock\FPLock.exe
[ES]:Application has no visible windows
[ES]:EXE runtime packer ?
Process c:\programme\fpsoftware\fpfiles\biomanager\fplock\fplock.exe contains network functionality (netapi32.dll)
Analyzer - the process under analysis is 1712 C:\WINDOWS\System32\alg.exe
[ES]:Contains network functionality
[ES]:Listens TCP ports !
[ES]:Application has no visible windows
[ES]:Located in system folder
Process c:\windows\system32\alg.exe contains network functionality (ws2_32.dll,ws2help.dll)
Analyzer - the process under analysis is 1020 C:\WINDOWS\System32\svchost.exe
[ES]:Contains network functionality
[ES]:Application has no visible windows
[ES]:Located in system folder
Process c:\windows\system32\svchost.exe contains network functionality (ws2_32.dll,ws2help.dll)
Process c:\programme\mozilla firefox\firefox.exe contains network functionality (ws2_32.dll,ws2help.dll,netapi32.dll,urlmon.dll)
Analyzer - the process under analysis is 1056 C:\WINDOWS\system32\wuauclt.exe
[ES]:Application has no visible windows
[ES]:Located in system folder
Process c:\programme\icqlite\icqlite.exe contains network functionality (ws2_32.dll,ws2help.dll,wininet.dll,netapi32.dll,rasapi32.dll,tapi32.dll,urlmon.dll)
Analyzer - the process under analysis is 2408 C:\Programme\Windows Media Player\wmplayer.exe
[ES]:Contains network functionality
[ES]:Loads RASAPI DLL - may use dialing?
Process c:\programme\windows media player\wmplayer.exe contains network functionality (wininet.dll,urlmon.dll,rasapi32.dll,ws2_32.dll,ws2help.dll,netapi32.dll,tapi32.dll)
Analyzer - the process under analysis is 3788 C:\Programme\CCleaner\ccleaner.exe
[ES]:Contains network functionality
[ES]:Loads RASAPI DLL - may use dialing?
Process c:\programme\ccleaner\ccleaner.exe contains network functionality (wininet.dll,urlmon.dll,rasapi32.dll,ws2_32.dll,ws2help.dll,netapi32.dll,tapi32.dll)
 Number of modules loaded: 308
Memory checking - complete
3. Scanning disks
C:\WINDOWS\TEMP\avz_3012_1.tmp Spanning not supported by this Archive type
C:\Dokumente und Einstellungen\Deniz\Desktop\Kiss-Bot.rar/{RAR}/Kiss-Bot\Knuddels Kiss-Bot.exe >>> suspicion for IM-Worm.Win32.VB.ao ( 0043F699 00131D11 001264F8 002B7C69 20480)
C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe >>> suspicion for Trojan-Downloader.Win32.Agent.alu ( 0057B1AC 08CD5FC5 001E52D2 001E5272 106496)
C:\WINDOWS\system32\chcp.com - PE file with modified extension, allowing its launch (often typical for viruses)(danger level 35%)
File "C:\WINDOWS\system32\chcp.com" quarantined succesfully
C:\WINDOWS\system32\diskcomp.com - PE file with modified extension, allowing its launch (often typical for viruses)(danger level 35%)
File "C:\WINDOWS\system32\diskcomp.com" quarantined succesfully
C:\WINDOWS\system32\diskcopy.com - PE file with modified extension, allowing its launch (often typical for viruses)(danger level 35%)
File "C:\WINDOWS\system32\diskcopy.com" quarantined succesfully
C:\WINDOWS\system32\edit.com - PE file with modified extension, allowing its launch (often typical for viruses)(danger level 35%)
File "C:\WINDOWS\system32\edit.com" quarantined succesfully
C:\WINDOWS\system32\format.com - PE file with modified extension, allowing its launch (often typical for viruses)(danger level 35%)
File "C:\WINDOWS\system32\format.com" quarantined succesfully
C:\WINDOWS\system32\graftabl.com - PE file with modified extension, allowing its launch (often typical for viruses)(danger level 35%)
File "C:\WINDOWS\system32\graftabl.com" quarantined succesfully
C:\WINDOWS\system32\mode.com - PE file with modified extension, allowing its launch (often typical for viruses)(danger level 35%)
File "C:\WINDOWS\system32\mode.com" quarantined succesfully
C:\WINDOWS\system32\more.com - PE file with modified extension, allowing its launch (often typical for viruses)(danger level 35%)
File "C:\WINDOWS\system32\more.com" quarantined succesfully
C:\WINDOWS\system32\tree.com - PE file with modified extension, allowing its launch (often typical for viruses)(danger level 35%)
File "C:\WINDOWS\system32\tree.com" quarantined succesfully
C:\WINDOWS\system32\win.com - PE file with modified extension, allowing its launch (often typical for viruses)(danger level 35%)
File "C:\WINDOWS\system32\win.com" quarantined succesfully
C:\WINDOWS\Temp\Rar$EX01.907\Kiss-Bot\Knuddels Kiss-Bot.exe >>> suspicion for IM-Worm.Win32.VB.ao ( 0043F699 00131D11 001264F8 002B7C69 20480)
Direct reading C:\WINDOWS\Temp\~DF6D11.tmp
Direct reading C:\WINDOWS\Temp\~DF6D24.tmp
Direct reading C:\WINDOWS\Temp\~DF6D37.tmp
Direct reading C:\WINDOWS\Temp\~DF6D4A.tmp
Direct reading C:\WINDOWS\Temp\~DF6F0.tmp
Direct reading C:\WINDOWS\Temp\~DF707.tmp
Direct reading C:\WINDOWS\Temp\~DF71E.tmp
Direct reading C:\WINDOWS\Temp\~DF737.tmp
Direct reading C:\WINDOWS\Temp\~DF81AD.tmp
Direct reading C:\WINDOWS\Temp\~DF81C0.tmp
Direct reading C:\WINDOWS\Temp\~DF81D3.tmp
Direct reading C:\WINDOWS\Temp\~DF81E6.tmp
Direct reading C:\WINDOWS\Temp\~DFC9C0.tmp
Direct reading C:\WINDOWS\Temp\~DFCE88.tmp
 

der rest:

4. Checking  Winsock Layered Service Provider (SPI/LSP)
 LSP settings checked. No errors detected
5. Searching for keyboard/mouse/windows events hooks (Keyloggers, Trojan DLLs)
C:\WINDOWS\system32\winspool.drv --> Suspicion for a Keylogger or Trojan DLL
C:\WINDOWS\system32\winspool.drv>>> Behavioral analysis:
 Behaviour typical for keyloggers not detected
File "C:\WINDOWS\system32\winspool.drv" quarantined succesfully
C:\WINDOWS\system32\RICHED32.DLL --> Suspicion for a Keylogger or Trojan DLL
C:\WINDOWS\system32\RICHED32.DLL>>> Behavioral analysis:
 Behaviour typical for keyloggers not detected
File "C:\WINDOWS\system32\RICHED32.DLL" quarantined succesfully
C:\WINDOWS\system32\RICHED20.dll --> Suspicion for a Keylogger or Trojan DLL
C:\WINDOWS\system32\RICHED20.dll>>> Behavioral analysis:
  1. Reacts to events: keyboard
  2. Polls the keys state
C:\WINDOWS\system32\RICHED20.dll>>> Neural net: file with probability of 50,00% like a typical keyboard/mouse events interceptor
File "C:\WINDOWS\system32\RICHED20.dll" quarantined succesfully
C:\WINDOWS\system32\mstask.dll --> Suspicion for a Keylogger or Trojan DLL
C:\WINDOWS\system32\mstask.dll>>> Behavioral analysis:
 Behaviour typical for keyloggers not detected
C:\WINDOWS\system32\NTDSAPI.dll --> Suspicion for a Keylogger or Trojan DLL
C:\WINDOWS\system32\NTDSAPI.dll>>> Behavioral analysis:
 Behaviour typical for keyloggers not detected
File "C:\WINDOWS\system32\NTDSAPI.dll" quarantined succesfully
C:\WINDOWS\system32\WLDAP32.dll --> Suspicion for a Keylogger or Trojan DLL
C:\WINDOWS\system32\WLDAP32.dll>>> Behavioral analysis:
 Behaviour typical for keyloggers not detected
File "C:\WINDOWS\system32\WLDAP32.dll" quarantined succesfully
C:\WINDOWS\system32\ntshrui.dll --> Suspicion for a Keylogger or Trojan DLL
C:\WINDOWS\system32\ntshrui.dll>>> Behavioral analysis:
 Behaviour typical for keyloggers not detected
File "C:\WINDOWS\system32\ntshrui.dll" quarantined succesfully
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.2180_x-ww_522f9f82\gdiplus.dll --> Suspicion for a Keylogger or Trojan DLL
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.2180_x-ww_522f9f82\gdiplus.dll>>> Behavioral analysis:
 Behaviour typical for keyloggers not detected
File "C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.2180_x-ww_522f9f82\gdiplus.dll" quarantined succesfully
C:\WINDOWS\system32\shgina.dll --> Suspicion for a Keylogger or Trojan DLL
C:\WINDOWS\system32\shgina.dll>>> Behavioral analysis:
 Behaviour typical for keyloggers not detected
File "C:\WINDOWS\system32\shgina.dll" quarantined succesfully
C:\WINDOWS\system32\MSGINA.dll --> Suspicion for a Keylogger or Trojan DLL
C:\WINDOWS\system32\MSGINA.dll>>> Behavioral analysis:
 Behaviour typical for keyloggers not detected
File "C:\WINDOWS\system32\MSGINA.dll" quarantined succesfully
C:\WINDOWS\system32\WINSTA.dll --> Suspicion for a Keylogger or Trojan DLL
C:\WINDOWS\system32\WINSTA.dll>>> Behavioral analysis:
 Behaviour typical for keyloggers not detected
File "C:\WINDOWS\system32\WINSTA.dll" quarantined succesfully
C:\WINDOWS\system32\ODBC32.dll --> Suspicion for a Keylogger or Trojan DLL
C:\WINDOWS\system32\ODBC32.dll>>> Behavioral analysis:
 Behaviour typical for keyloggers not detected
File "C:\WINDOWS\system32\ODBC32.dll" quarantined succesfully
C:\WINDOWS\system32\odbcint.dll --> Suspicion for a Keylogger or Trojan DLL
C:\WINDOWS\system32\odbcint.dll>>> Behavioral analysis:
 Behaviour typical for keyloggers not detected
File "C:\WINDOWS\system32\odbcint.dll" quarantined succesfully
C:\WINDOWS\system32\Audiodev.dll --> Suspicion for a Keylogger or Trojan DLL
C:\WINDOWS\system32\Audiodev.dll>>> Behavioral analysis:
 Behaviour typical for keyloggers not detected
File "C:\WINDOWS\system32\Audiodev.dll" quarantined succesfully
Note: Do NOT delete suspicious files, send them for analysis  (see FAQ for more details),  because there are lots of useful hooking DLLs
6. Searching for opened TCP/UDP ports used by malicious programs
 checking disabled by user
7. Heuristic system check

gruß deniz

auswerten ohne das komplette Logfile (Kopf) find ich absolut albern.

Wie ohne den kompkletten log file is doch alle komplett!

Hallo,
ich würde von einem sauberen System ausgehen..
Das hier liegt in den temporären Dateien und kann bei Gelegenheit mal mit "CCleaner" geputzt werden...

 

C:\WINDOWS\Temp\Rar$EX01.907\Kiss-Bot\Knuddels Kiss-Bot.exe >>> suspicion for IM-Worm.Win32.VB.ao ( 0043F699 00131D11 001264F8 002B7C69 20480)
 

Okay danke!!
Den kiss bot hat bei mir g-data auch gefunden :-) hab ihn somit gelöscht!


gruß deniz