Einheit 5.2 Trojaner (Bundespolizei hat Internet gesperrt)!

MediumStmk · 24.07.2012, 11:09

Hallo Liebe Community!

Wie oben beschrieben habe ich ich es irgendwie geschafft diesen blöden Trojaner auf meinem Laptop zu bekommen.
Ich hab mich jetzt schon ein bisschen durch das Forum gewühlt und habe folgende Schritte befolgt.

1. Malewarebytes Anti-Maleware installiert! (Laptop wird gerade gescannt!)
2. OTL auf den Desktop gepackt und Scannen lassen Scripts befinden sich im Anhang!

Was ich so gelesen habe wird da individuell für meinen Laptop ein Script geschrieben das ich dann mit OTL einfügen kann.

Ich bitte um genaue Beschreibung wie ich weiter vorgehen muss und bedanke mich schonmal für die Hilfe.

MFG Marco

Anhang 38666

Anhang 38667

t'john · 25.07.2012, 02:19

Fixen mit OTL

Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).

Deaktiviere etwaige Virenscanner wie Avira, Kaspersky etc.
Starte die OTL.exe.
Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
Kopiere folgendes Skript in das Textfeld unterhalb von Benuterdefinierte Scans/Fixes:

Code:

ATTFilter

:OTL
PRC - C:\Users\breithofer\AppData\Local\Temp\zfguvbsoiblghw.exe (Canon) 

SRV - (TemproMonitoringService) -- C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe (Toshiba Europe GmbH) 
SRV - (WTGService) -- C:\Program Files (x86)\3DataManager\WTGService.exe () 
SRV - (TAGuard) -- C:\Program Files (x86)\Telekom Austria\aonFlex\Guard.exe () 
DRV - (StarOpen) -- C:\Windows\SysWow64\drivers\StarOpen.sys () 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {C73FB607-1877-4150-9506-24983BED8E9B} 
IE:64bit: - HKLM\..\SearchScopes\{C73FB607-1877-4150-9506-24983BED8E9B}: "URL" = http://www.bing.com/search?q={searchTerms}&form=TSHMDF&pc=MATM&src=IE-SearchBox 
IE - HKLM\..\SearchScopes,DefaultScope = {C73FB607-1877-4150-9506-24983BED8E9B} 
IE - HKLM\..\SearchScopes\{C73FB607-1877-4150-9506-24983BED8E9B}: "URL" = http://www.bing.com/search?q={searchTerms}&form=TSHMDF&pc=MATM&src=IE-SearchBox 
IE - HKCU\..\SearchScopes,DefaultScope = {40140B79-066E-4DBA-9D83-6956C575CFA6} 
IE - HKCU\..\SearchScopes\{40140B79-066E-4DBA-9D83-6956C575CFA6}: "URL" = http://www.bing.com/search?q={searchTerms}&form=TSHMDF&pc=MATM&src=IE-SearchBox 
IE - HKCU\..\SearchScopes\{41271385-1972-4FFC-828C-6C3A3494984E}: "URL" = http://www.amazon.de/gp/search?ie=UTF8&keywords={searchTerms}&tag=tochibade-win7-ie-search-21&index=blended&linkCode=ur2 
IE - HKCU\..\SearchScopes\{A19EB671-EBFF-4D56-8035-B8B755568741}: "URL" = http://rover.ebay.com/rover/1/707-44556-9400-9/4?satitle={searchTerms} 
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
FF - prefs.js..browser.startup.homepage: "http://www.google.at/" 
FF - prefs.js..network.proxy.type: 0 
FF - user.js - File not found 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_262.dll File not found 
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found 
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found 
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. 
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. 
O4:64bit: - HKLM..\Run: [Toshiba TEMPRO] C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe (Toshiba Europe GmbH) 
O4 - HKCU..\Run: [] C:\Users\breithofer\AppData\Local\Temp\zfguvbsoiblghw.exe (Canon) 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1 
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found 
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found 
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. 
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. 
O32 - HKLM CDRom: AutoRun - 1 
O33 - MountPoints2\{166d85b0-d96a-11e0-9b27-806e6f6e6963}\Shell - "" = AutoRun 
O33 - MountPoints2\{166d85b0-d96a-11e0-9b27-806e6f6e6963}\Shell\AutoRun\command - "" = E:\Telescope_Driver.exe -- [2009.10.30 12:12:12 | 007,908,629 | R--- | M] (Macrovision Corporation) 
O33 - MountPoints2\{1b12aa12-7d5d-11e1-8982-d0df9aebcc7e}\Shell - "" = AutoRun 
O33 - MountPoints2\{1b12aa12-7d5d-11e1-8982-d0df9aebcc7e}\Shell\AutoRun\command - "" = F:\.\Autorun.exe AUTORUN=1 
O33 - MountPoints2\{e84cfe8b-3613-11e1-86b6-d0df9aebcc7e}\Shell - "" = AutoRun 
O33 - MountPoints2\{e84cfe8b-3613-11e1-86b6-d0df9aebcc7e}\Shell\AutoRun\command - "" = F:\AutoRun.exe 
O33 - MountPoints2\{e84cfe9c-3613-11e1-86b6-d0df9aebcc7e}\Shell - "" = AutoRun 
O33 - MountPoints2\{e84cfe9c-3613-11e1-86b6-d0df9aebcc7e}\Shell\AutoRun\command - "" = F:\AutoRun.exe 
O33 - MountPoints2\F\Shell - "" = AutoRun 
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\.\Autorun.exe AUTORUN=1 


:Files
C:\Users\breithofer\AppData\Local\Temp\zfguvbsoiblghw.exe

ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
[emptyflash]

Schließe alle Programme.
Klicke auf den Fix Button.
Wenn OTL einen Neustart verlangt, bitte zulassen.
Kopiere den Inhalt des Logfiles hier in Code-Tags in Deinen Thread.
Nachträglich kannst Du das Logfile hier einsehen => C:\_OTL\MovedFiles\

Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!

MediumStmk · 25.07.2012, 08:38

Vielen Dank für eure Hilfe!

Hat alles super funktioniert.
Hier noch das Logfile.

MFG
Marco

Code:

ATTFilter

========== OTL ==========
Process zfguvbsoiblghw.exe killed successfully!
Service TemproMonitoringService stopped successfully!
Service TemproMonitoringService deleted successfully!
C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe moved successfully.
Service WTGService stopped successfully!
Service WTGService deleted successfully!
C:\Program Files (x86)\3DataManager\WTGService.exe moved successfully.
Service TAGuard stopped successfully!
Service TAGuard deleted successfully!
C:\Program Files (x86)\Telekom Austria\aonFlex\Guard.exe moved successfully.
Service StarOpen stopped successfully!
Service StarOpen deleted successfully!
C:\Windows\SysWOW64\drivers\StarOpen.sys moved successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{C73FB607-1877-4150-9506-24983BED8E9B}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C73FB607-1877-4150-9506-24983BED8E9B}\ not found.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{C73FB607-1877-4150-9506-24983BED8E9B}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C73FB607-1877-4150-9506-24983BED8E9B}\ not found.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{40140B79-066E-4DBA-9D83-6956C575CFA6}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{40140B79-066E-4DBA-9D83-6956C575CFA6}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{41271385-1972-4FFC-828C-6C3A3494984E}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41271385-1972-4FFC-828C-6C3A3494984E}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{A19EB671-EBFF-4D56-8035-B8B755568741}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A19EB671-EBFF-4D56-8035-B8B755568741}\ not found.
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
Prefs.js: "hxxp://www.google.at/" removed from browser.startup.homepage
Prefs.js: 0 removed from network.proxy.type
64bit-Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@adobe.com/FlashPlayer\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@microsoft.com/GENUINE\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@microsoft.com/GENUINE\ deleted successfully.
64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Toshiba TEMPRO deleted successfully.
C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
C:\Users\breithofer\AppData\Local\Temp\zfguvbsoiblghw.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\EnableLinkedConnections deleted successfully.
64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.
64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{166d85b0-d96a-11e0-9b27-806e6f6e6963}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{166d85b0-d96a-11e0-9b27-806e6f6e6963}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{166d85b0-d96a-11e0-9b27-806e6f6e6963}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{166d85b0-d96a-11e0-9b27-806e6f6e6963}\ not found.
File move failed. E:\Telescope_Driver.exe scheduled to be moved on reboot.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1b12aa12-7d5d-11e1-8982-d0df9aebcc7e}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1b12aa12-7d5d-11e1-8982-d0df9aebcc7e}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1b12aa12-7d5d-11e1-8982-d0df9aebcc7e}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1b12aa12-7d5d-11e1-8982-d0df9aebcc7e}\ not found.
File F:\.\Autorun.exe AUTORUN=1 not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e84cfe8b-3613-11e1-86b6-d0df9aebcc7e}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e84cfe8b-3613-11e1-86b6-d0df9aebcc7e}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e84cfe8b-3613-11e1-86b6-d0df9aebcc7e}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e84cfe8b-3613-11e1-86b6-d0df9aebcc7e}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e84cfe9c-3613-11e1-86b6-d0df9aebcc7e}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e84cfe9c-3613-11e1-86b6-d0df9aebcc7e}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e84cfe9c-3613-11e1-86b6-d0df9aebcc7e}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e84cfe9c-3613-11e1-86b6-d0df9aebcc7e}\ not found.
File F:\AutoRun.exe not found.
 
OTL by OldTimer - Version 3.2.54.1 log created on 07252012_092117

Files\Folders moved on Reboot...
File move failed. E:\Telescope_Driver.exe scheduled to be moved on reboot.

PendingFileRenameOperations files...
[2009.10.30 12:12:12 | 007,908,629 | R--- | M] (Macrovision Corporation) E:\Telescope_Driver.exe : MD5=80484EE8E29F322D3BB74A6483069CA7

Registry entries deleted on Reboot...

t'john · 25.07.2012, 16:17

Sehr gut!

Wie laeuft der Rechner?

1. Schritt

Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Malwarebytes Anti-Malware
- Anwendbar auf Windows 2000, XP, Vista und 7.
- Installiere das Programm in den vorgegebenen Pfad.
- Aktiviere "Komplett Scan durchführen" => Scan.
- Wähle alle verfügbaren Laufwerke (ausser CD/DVD) aus und starte den Scan.
- Funde bitte löschen lassen oder in Quarantäne.
- Wenn der Scan beendet ist, klicke auf "Zeige Resultate".

danach:

2. Schritt

Downloade Dir bitte AdwCleaner auf deinen Desktop.

Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Search.
Nach Ende des Suchlaufs öffnet sich eine Textdatei.
Poste mir den Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.

t'john · 08.08.2012, 03:20

Fehlende Rückmeldung

Gibt es Probleme beim Abarbeiten obiger Anleitung?

Um Kapazitäten für andere Hilfesuchende freizumachen, lösche ich dieses Thema aus meinen Benachrichtigungen.

Solltest Du weitermachen wollen, schreibe mir eine PN oder eröffne ein neues Thema.
http://www.trojaner-board.de/69886-a...-beachten.html

Hinweis: Das Verschwinden der Symptome bedeutet nicht, dass Dein Rechner sauber ist.

Einheit 5.2 Trojaner (Bundespolizei hat Internet gesperrt)!

Log-Analyse und Auswertung: Einheit 5.2 Trojaner (Bundespolizei hat Internet gesperrt)!