"Mediashifting.com" Virus

DanyRibi

Hier die Log-Datei vom ESET Scanner


[SPOILER]ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=8.00.7600.16385 (win7_rtm.090713-1255)
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=a0b567b08b4da24bb41186408435a94a
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-12-31 07:04:18
# local_time=2011-12-31 08:04:18 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7600 NT
# compatibility_mode=3589 16777214 100 84 504171 76012734 0 0
# compatibility_mode=8192 67108863 100 0 3814 3814 0 0
# scanned=146795
# found=8
# cleaned=8
# scan_time=4470
C:\Users\Administrator\AppData\Local\709b8acb\U\80000000.@ a variant of Win32/Sirefef.DV trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Users\Administrator\AppData\Roaming\3642.exe Win32/Agent.TFI trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Users\Administrator\AppData\Roaming\5CB8.exe Win32/CoinMiner.I trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Users\Administrator\AppData\Roaming\6E36.exe Win32/Agent.TFI trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\_OTL\MovedFiles\12292011_220513\C_Users\Administrator\AppData\Roaming\227D.exe Win32/CoinMiner.I trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
E:\programme\SoftonicDownloader66221.exe a variant of Win32/SoftonicDownloader.A application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
E:\programme\nero 8.0\nero 8.0\Nero V.8.0.3.0\Toolbar.exe Win32/Toolbar.AskSBar application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
E:\programme\nero 8.0\nero 8.0\Nero V.8.0.3.0\Nero PhotoShow Express\nero_photoshow_express_5_setup.exe Win32/Toolbar.AskSBar application (deleted - quarantined) 00000000000000000000000000000000 C[/SPOILER]