| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Trojaner "flirt-fever" Verschlüsselungs-TrojanerWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
14.07.2012, 01:23
| #1 |
| |  Trojaner "flirt-fever" Verschlüsselungs-Trojaner Habe ein Notebook und habe beim Start einen schwarzen Bildschirm. Habe mit OTL einen Scan durchgeführt und eine Datei OTL.txt erhalten. Eine extra "olt" Datei wurde nicht erstellt. Hier der Inhalt der Datei. Wer kann mir bitte helfen damit ich den Computer wieder in den Griff bekommen? Oder Wie kann ich den Trojaner entfernen? OTL logfile created on: 7/12/2012 8:42:20 PM - Run OTLPE by OldTimer - Version 3.1.48.0 Folder = X:\Programs\OTLPE Windows 7 Professional Service Pack 1 (Version = 6.1.7601) - Type = System Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 83.00% Memory free 1.00 Gb Paging File | 1.00 Gb Available in Paging File | 96.00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 147.04 Gb Total Space | 112.04 Gb Free Space | 76.20% Space Free | Partition Type: NTFS Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS Computer Name: REATOGO | User Name: SYSTEM Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days Using ControlSet: ControlSet001 ========== Win32 Services (SafeList) ========== SRV - [2012/06/24 12:20:15 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2012/05/08 14:19:34 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2012/05/08 14:19:33 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2009/07/13 21:16:15 | 000,016,384 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Windows\System32\StorSvc.dll -- (StorSvc) SRV - [2009/07/13 21:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc) SRV - [2009/07/13 21:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc) SRV - [2009/07/13 21:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2009/02/19 08:46:26 | 000,341,264 | ---- | M] (Fujitsu Technology Solutions) [Auto] -- C:\Program Files\Fujitsu\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe -- (TestHandler) ========== Driver Services (SafeList) ========== DRV - [2012/05/08 14:19:34 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb) DRV - [2012/05/08 14:19:34 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt) DRV - [2011/09/16 11:08:07 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr) DRV - [2010/11/20 08:30:15 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | Boot] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus) DRV - [2010/11/20 08:30:15 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt) DRV - [2010/11/20 08:30:15 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\system32\drivers\storvsc.sys -- (storvsc) DRV - [2010/11/20 06:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV - [2010/11/20 05:14:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\system32\drivers\VMBusHID.sys -- (VMBusHID) DRV - [2010/11/20 05:14:41 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\system32\drivers\vms3cap.sys -- (s3cap) DRV - [2010/07/28 10:03:03 | 000,691,696 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot] -- C:\Windows\System32\drivers\sptd.sys -- (sptd) DRV - [2009/10/08 11:55:33 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2009/07/13 18:02:52 | 000,347,264 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\nvm62x32.sys -- (NVENETFD) DRV - [2009/07/13 18:02:46 | 001,096,704 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\athr.sys -- (athr) DRV - [2009/03/13 22:23:00 | 007,549,152 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm) DRV - [2009/03/12 09:16:24 | 000,016,384 | ---- | M] (Fujitsu) [Kernel | On_Demand] -- C:\Windows\System32\drivers\FSCSLII.sys -- (FSCSLII) DRV - [2008/11/12 11:02:46 | 000,133,152 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled] -- C:\Windows\system32\drivers\nvrd32.sys -- (nvrd32) DRV - [2008/11/12 11:02:18 | 000,146,464 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled] -- C:\Windows\system32\drivers\nvstor32.sys -- (nvstor32) DRV - [2008/08/24 20:22:52 | 000,015,872 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\nvsmu.sys -- (nvsmu) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.ts.fujitsu.com/index2 IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\Celina_ON_C\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.ts.fujitsu.com/index2 IE - HKU\Celina_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.arcor.de/ IE - HKU\Celina_ON_C\Software\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKU\Celina_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\Celina_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.startup.homepage: "hxxp://www.arcor.de" FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\System32\Macromed\Flash\NPSWF32_11_3_300_257.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/06/24 12:20:16 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/10/18 15:00:20 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 12.0.1\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2012/05/08 10:48:53 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 12.0.1\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/06/24 12:20:16 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/10/18 15:00:20 | 000,000,000 | ---D | M] [2010/09/10 10:17:47 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Celina\AppData\Roaming\Mozilla\Extensions [2010/09/10 10:17:47 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Celina\AppData\Roaming\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6} [2012/05/02 10:12:00 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Celina\AppData\Roaming\Mozilla\Firefox\Profiles\po0mtjj2.default\extensions [2010/07/23 09:54:05 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Celina\AppData\Roaming\Mozilla\Firefox\Profiles\po0mtjj2.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010/01/19 14:07:14 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions File not found (No name found) -- [2012/06/24 12:20:16 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2011/10/03 05:14:54 | 000,083,456 | ---- | M] (vShare.tv ) -- C:\Program Files\mozilla firefox\plugins\npvsharetvplg.dll [2012/06/24 12:20:13 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2012/06/24 12:20:13 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2012/06/24 12:20:13 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2012/06/24 12:20:13 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2012/06/24 12:20:13 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2012/06/24 12:20:13 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2006/09/18 17:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (IE5BarLauncherBHO Class) - {78F3A323-798E-4AEA-9A57-88F4B05FD5DD} - C:\Program Files\vShare.tv plugin\BarLcher.dll (VShare Inc.) O3 - HKLM\..\Toolbar: (VShareToolBar) - {7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} - C:\Program Files\vShare.tv plugin\BarLcher.dll (VShare Inc.) O3 - HKU\Celina_ON_C\..\Toolbar\WebBrowser: (VShareToolBar) - {7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} - C:\Program Files\vShare.tv plugin\BarLcher.dll (VShare Inc.) O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [Camera Hotkey] C:\Program Files\Fujitsu\Wireless_Utility\Camera Hotkey.exe (Inventec Corp.) O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation) O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) O4 - HKU\Celina_ON_C..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd) O4 - HKU\LocalService_ON_C..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation) O4 - HKU\NetworkService_ON_C..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation) O4 - Startup: C:\Users\Celina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ubisoft register.lnk () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O7 - HKU\Celina_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files\ICQ7.5\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files\ICQ7.5\ICQ.exe (ICQ, LLC.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O13 - gopher Prefix: missing O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 195.50.140.116 195.50.140.180 O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. O24 - Desktop WallPaper: O24 - Desktop BackupWallPaper: O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009/06/10 17:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ] O33 - MountPoints2\{9886aa1e-b59c-11df-9011-001e330e898c}\Shell - "" = AutoRun O33 - MountPoints2\{9886aa1e-b59c-11df-9011-001e330e898c}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a O33 - MountPoints2\F\Shell - "" = AutoRun O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2012/07/10 17:46:53 | 000,000,000 | ---D | C] -- C:\Users\Celina\AppData\Local\Microsoft_Corporation [2012/06/21 08:49:42 | 002,422,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wucltux.dll [2012/06/21 08:49:42 | 000,045,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wups2.dll [2012/06/21 08:49:21 | 000,088,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wudriver.dll [2012/06/21 08:49:21 | 000,035,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wups.dll [2012/06/21 08:49:20 | 000,577,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wuapi.dll [2012/06/21 08:49:05 | 000,171,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wuwebv.dll [2012/06/21 08:49:05 | 000,033,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wuapp.exe [2012/06/15 11:17:36 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb [2012/06/15 11:17:34 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll [2012/06/15 11:17:34 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe [2012/06/15 11:17:32 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll [2012/06/15 11:17:31 | 001,800,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll [2012/06/15 11:17:31 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript.dll [2012/06/15 11:17:30 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl [2012/06/15 11:17:30 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll [2012/06/14 14:05:47 | 000,129,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpcorekmts.dll [2012/06/14 14:05:47 | 000,058,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpwsx.dll [2012/06/14 14:05:47 | 000,008,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdrmemptylst.exe [2012/06/14 14:05:45 | 002,343,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys [2012/06/14 13:54:22 | 000,000,000 | ---D | C] -- C:\Users\Celina\AppData\Local\Macromedia ========== Files - Modified Within 30 Days ========== [2012/07/12 13:32:21 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012/07/12 13:31:07 | 1206,718,464 | -HS- | M] () -- C:\hiberfil.sys [2012/07/11 17:32:20 | 000,015,248 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012/07/11 17:32:20 | 000,015,248 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012/07/10 17:25:20 | 004,503,728 | ---- | M] () -- C:\ProgramData\0tbpw.pad [2012/06/15 11:50:48 | 000,409,760 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2012/06/15 11:25:25 | 000,654,166 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2012/06/15 11:25:25 | 000,616,008 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2012/06/15 11:25:25 | 000,130,006 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2012/06/15 11:25:25 | 000,106,388 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2012/06/14 13:53:54 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe [2012/06/14 13:53:54 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl ========== Files Created - No Company Name ========== [2012/07/09 07:13:16 | 004,503,728 | ---- | C] () -- C:\ProgramData\0tbpw.pad [2012/01/12 11:42:16 | 001,467,898 | ---- | C] () -- C:\Users\Celina\AppData\Roaming\UserTile.png [2011/05/25 13:40:33 | 000,252,928 | ---- | C] () -- C:\Windows\System32\DShowRdpFilter.dll [2011/05/25 13:39:18 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe [2010/08/01 12:01:12 | 000,069,632 | R--- | C] () -- C:\Windows\System32\xmltok.dll [2010/08/01 12:01:12 | 000,036,864 | R--- | C] () -- C:\Windows\System32\xmlparse.dll [2010/05/29 08:27:59 | 000,000,712 | ---- | C] () -- C:\Windows\disney.ini [2009/12/25 01:18:28 | 000,654,166 | ---- | C] () -- C:\Windows\System32\perfh007.dat [2009/12/25 01:18:28 | 000,295,922 | ---- | C] () -- C:\Windows\System32\perfi007.dat [2009/12/25 01:18:28 | 000,130,006 | ---- | C] () -- C:\Windows\System32\perfc007.dat [2009/12/25 01:18:28 | 000,038,104 | ---- | C] () -- C:\Windows\System32\perfd007.dat [2009/12/24 16:38:35 | 000,021,532 | ---- | C] () -- C:\Windows\System32\emptyregdb.dat [2009/10/31 06:27:18 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat [2009/07/14 00:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat [2009/07/14 00:33:53 | 000,409,760 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT [2009/07/13 22:05:48 | 000,616,008 | ---- | C] () -- C:\Windows\System32\perfh009.dat [2009/07/13 22:05:48 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat [2009/07/13 22:05:48 | 000,106,388 | ---- | C] () -- C:\Windows\System32\perfc009.dat [2009/07/13 22:05:48 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat [2009/07/13 22:05:05 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT [2009/07/13 22:04:11 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat [2009/07/13 19:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin [2009/07/13 19:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll [2009/07/13 19:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll [2009/06/10 17:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat [2009/04/17 04:10:51 | 000,040,448 | ---- | C] () -- C:\Windows\REGOBJ.DLL ========== LOP Check ========== [2010/07/28 10:44:03 | 000,000,000 | ---D | M] -- C:\Users\Celina\AppData\Roaming\DAEMON Tools Lite [2012/07/10 17:31:01 | 000,000,000 | ---D | M] -- C:\Users\Celina\AppData\Roaming\ICQ [2010/09/10 10:17:46 | 000,000,000 | ---D | M] -- C:\Users\Celina\AppData\Roaming\Thunderbird [2009/12/24 16:53:08 | 000,000,000 | -HSD | M] -- C:\ProgramData\Anwendungsdaten [2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Application Data [2010/07/28 10:02:24 | 000,000,000 | ---D | M] -- C:\ProgramData\DAEMON Tools Lite [2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Desktop [2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Documents [2009/12/24 16:53:08 | 000,000,000 | -HSD | M] -- C:\ProgramData\Dokumente [2009/12/24 16:53:08 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favoriten [2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favorites [2009/12/24 16:28:54 | 000,000,000 | ---D | M] -- C:\ProgramData\Fujitsu [2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Start Menu [2009/12/24 16:53:09 | 000,000,000 | -HSD | M] -- C:\ProgramData\Startmenü [2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Templates [2009/12/24 16:53:09 | 000,000,000 | -HSD | M] -- C:\ProgramData\Vorlagen [2011/05/22 09:47:06 | 000,000,000 | ---D | M] -- C:\ProgramData\{429CAD59-35B1-4DBC-BB6D-1DB246563521} [2009/12/24 16:28:58 | 000,000,000 | ---D | M] -- C:\ProgramData\{623D32E9-0C62-4453-AD44-98B31F52A5E1} [2012/05/24 11:52:26 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== < End of report > |
|
15.07.2012, 20:16
| #2 |
| /// Malware-holic   | Trojaner "flirt-fever" Verschlüsselungs-Trojaner auf deinem zweiten pc gehe auf start, programme zubehör editor, kopiere dort
__________________rein: Code:
ATTFilter :OTL
[2012/07/10 17:25:20 | 004,503,728 | ---- | M] () -- C:\ProgramData\0tbpw.pad
:Files
:Commands
[purity]
[EMPTYFLASH]
[emptytemp]
[Reboot]
dieses speicherst du auf nem usb stick als fix.txt nutze nun wieder OTLPENet.exe (starte also von der erstellten cd) und hake alles an, wie es bereits im post zu OTLPENet.exe beschrieben ist. • Klicke nun bitte auf den Fix Button. es sollte nun eine meldung ähnlich dieser: "load fix from file" erscheinen, lade also die fix.txt von deinem stick. wenn dies nicht funktioniert, bitte den fix manuell eintragen. dann klicke erneut den fix buton. pc startet evtl. neu. wenn ja, nimm die cd aus dem laufwerk, windows sollte nun normal starten und die otl.txt öffnen, log posten bitte.
__________________ |
|
20.07.2012, 23:06
| #3 |
| | Trojaner "flirt-fever" Verschlüsselungs-Trojaner Hallo, besten Dank für die schnelle Antwort. Habe den fix so durchlaufen lassen, aber das Notebook startet nicht normal sondern es kommt das Trojaner "Windows Update" Fenster. Also gleich wie vorher. Habe OTL nochmals durchlaufen lassen und habe jetzt eine OTL.txt und EXTRAS.txt erhalten.
__________________Wäre toll wenn wir hier eine Lösung finden würden. Vielen Dank. Gruß Joachim |
|
24.07.2012, 08:49
| #4 |
| | Trojaner "flirt-fever" Verschlüsselungs-Trojaner Hallo, nochmal an alle. Wer könnte mir bitte helfen. Müsste den Computer wieder zum laufen bekommen. Gruß Joachim |
|
24.07.2012, 17:50
| #5 |
| /// Malware-holic | Trojaner "flirt-fever" Verschlüsselungs-Trojaner startest du otl von cd? denn laut log siehts so aus als hättest du nach der otl cd noch Malwarebytes laden können
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
| Themen zu Trojaner "flirt-fever" Verschlüsselungs-Trojaner |
| antivir, avira, bho, bonjour, computer, defender, desktop, entfernen, explorer, firefox, format, hotkey, icq, logfile, microsoft, mozilla, notebook, nvidia, object, opera, realtek, registry, scan, software, trojaner |
Linear-Darstellung
