| |
| |||||||
Log-Analyse und Auswertung: Polizei-Trojaner ("Swiss Edition") / Trojan.Ransom / Trojan.AgentWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
20.11.2012, 21:56
| #1 |
| |  Polizei-Trojaner ("Swiss Edition") / Trojan.Ransom / Trojan.Agent Hallo zusammen Mein Laptop ist mit dem Polizei-Trojaner infiziert und wenn ich mit dem einen Benutzerkonto anmelde wird die Seite mit der "Zahlungaufforderung" angezeigt.  Ich bin Euch sehr dankbar, wenn Ihr mir bei der Beseitigung helfen könnt! Angaben zu System:Windows Vista (32 Bit) / SP 2 Antivir: "Avira Antivir" (Gratis-Software) Das hab ich zwischenzeitlich getan: - Neues Benutzerkonto erstellt (Standardbenutzer), damit ich nicht den Admin benutzen muss - kompletter Scan mit Malwarebytes Anti-Malware 1.65.1.1000 Code:
ATTFilter Malwarebytes Anti-Malware 1.65.1.1000 www.malwarebytes.org Datenbank Version: v2012.11.19.08 Windows Vista Service Pack 2 x86 NTFS (Abgesichertenmodus/Netzwerkfähig) Internet Explorer 9.0.8112.16421 happyaldo :: MARISOL-PC [Administrator] 19.11.2012 20:57:00 mbam-log-2012-11-19 (22-06-25).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 425545 Laufzeit: 1 Stunde(n), 8 Minute(n), 38 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 3 C:\Users\default.MARISOL-PC\AppData\Local\Temp\ppyazdpajmcj71.exe (Trojan.Ransom) -> Keine Aktion durchgeführt. C:\Users\default.MARISOL-PC\AppData\Roaming\msconfig.dat (Trojan.Ransom) -> Keine Aktion durchgeführt. C:\Users\default.MARISOL-PC\AppData\Roaming\msconfig.ini (Trojan.Agent) -> Keine Aktion durchgeführt. (Ende) - Defogger Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 20:33 on 20/11/2012 (happyaldo)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Code:
ATTFilter OTL logfile created on: 20.11.2012 20:34:40 - Run 9 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\MaCaSAu\Desktop Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000807 | Country: Schweiz | Language: DES | Date Format: dd.MM.yyyy 2.99 Gb Total Physical Memory | 2.30 Gb Available Physical Memory | 76.88% Memory free 6.18 Gb Paging File | 5.79 Gb Available in Paging File | 93.73% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 69.32 Gb Total Space | 25.96 Gb Free Space | 37.45% Space Free | Partition Type: NTFS Drive D: | 154.78 Gb Total Space | 103.37 Gb Free Space | 66.78% Space Free | Partition Type: NTFS Computer Name: MARISOL-PC | User Name: happyaldo | Logged in as Administrator. Boot Mode: SafeMode with Networking | Scan Mode: All users | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.11.20 19:33:13 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\MaCaSAu\Desktop\OTL.exe PRC - [2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe ========== Modules (No Company Name) ========== MOD - [2011.07.18 22:04:08 | 000,296,448 | ---- | M] () -- C:\Program Files\Notepad++\NppShell_04.dll ========== Services (SafeList) ========== SRV - File not found [Auto | Stopped] -- C:\Program Files\MySQL\MySQL Server 5.1\bin\mysqld -- (MySQL5) SRV - File not found [Disabled | Stopped] -- D:\Programme\MySQL\MySQL Server 5.1\bin\mysqld -- (MySQL) SRV - [2012.07.13 12:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2011.07.05 06:13:05 | 000,428,200 | ---- | M] (Avira GmbH) [Auto | Stopped] -- C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE -- (AntiVirWebService) SRV - [2011.07.05 06:13:04 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Stopped] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2011.06.01 13:44:54 | 002,337,144 | ---- | M] (TeamViewer GmbH) [Auto | Stopped] -- C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe -- (TeamViewer6) SRV - [2011.04.29 05:56:23 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Stopped] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2010.01.15 13:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService) SRV - [2009.10.20 19:19:48 | 000,117,264 | ---- | M] (CACE Technologies, Inc.) [On_Demand | Stopped] -- C:\Program Files\WinPcap\rpcapd.exe -- (rpcapd) SRV - [2008.04.25 13:23:36 | 000,303,104 | ---- | M] (Fujitsu Siemens Computers) [Auto | Stopped] -- C:\Program Files\Fujitsu Siemens Computers\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe -- (TestHandler) SRV - [2008.01.21 03:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend) SRV - [2006.11.18 04:45:26 | 000,118,784 | ---- | M] (Wistron Corp.) [On_Demand | Stopped] -- C:\Program Files\Launch Manager\WisLMSvc.exe -- (WisLMSvc) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt) DRV - File not found [Kernel | On_Demand | Unknown] -- C:\Users\HAPPYA~1\AppData\Local\Temp\kwtiifod.sys -- (kwtiifod) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp) DRV - [2011.07.25 13:12:06 | 000,231,248 | ---- | M] (TrueCrypt Foundation) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\truecrypt.sys -- (truecrypt) DRV - [2011.07.05 06:13:08 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb) DRV - [2011.07.05 06:13:08 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Stopped] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt) DRV - [2009.10.20 19:19:44 | 000,050,704 | ---- | M] (CACE Technologies, Inc.) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\npf.sys -- (NPF) DRV - [2009.05.11 09:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2009.02.13 11:35:01 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys -- (avgio) DRV - [2008.04.03 13:58:46 | 000,076,688 | ---- | M] (JMicron Technology Corp.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\jraid.sys -- (JRAID) DRV - [2008.01.09 11:28:34 | 000,027,632 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\seehcri.sys -- (seehcri) DRV - [2007.12.19 18:45:00 | 000,170,000 | ---- | M] (AMD Technologies Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\ahcix86s.sys -- (ahcix86s) DRV - [2007.08.03 09:44:58 | 000,091,648 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169) DRV - [2007.06.18 17:03:32 | 000,737,280 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr) DRV - [2005.02.11 10:19:20 | 000,055,216 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\k750bus.sys -- (k750bus) DRV - [2003.04.28 19:27:06 | 000,009,867 | ---- | M] () [Kernel | System | Stopped] -- C:\Windows\System32\drivers\HOTKEY.sys -- (Hotkey) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\..\URLSearchHook: {9d81af43-de53-48d0-a199-42c2a226b24c} - C:\Program Files\Softonic_Deutsch_FF\tbSoft.dll (Conduit Ltd.) IE - HKLM\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2206084 IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-4114458166-3482682908-2653977345-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2206084 IE - HKU\S-1-5-21-4114458166-3482682908-2653977345-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKU\S-1-5-21-4114458166-3482682908-2653977345-1000\..\URLSearchHook: {9d81af43-de53-48d0-a199-42c2a226b24c} - C:\Program Files\Softonic_Deutsch_FF\tbSoft.dll (Conduit Ltd.) IE - HKU\S-1-5-21-4114458166-3482682908-2653977345-1000\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b} IE - HKU\S-1-5-21-4114458166-3482682908-2653977345-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC IE - HKU\S-1-5-21-4114458166-3482682908-2653977345-1000\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2206084 IE - HKU\S-1-5-21-4114458166-3482682908-2653977345-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-4114458166-3482682908-2653977345-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local IE - HKU\S-1-5-21-4114458166-3482682908-2653977345-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultthis.engineName: "Softonic Deutsch FF Customized Web Search" FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2206084&SearchSource=3&q={searchTerms}" FF - prefs.js..browser.search.selectedEngine: "Softonic Deutsch FF Customized Web Search" FF - prefs.js..browser.startup.homepage: "hxxp://www.bluewin.ch/" FF - prefs.js..extensions.enabledAddons: {0538E3E3-7E9B-4d49-8831-A227C80A7AD3}:2.2.2 FF - prefs.js..extensions.enabledItems: {0538E3E3-7E9B-4d49-8831-A227C80A7AD3}:2.0.2 FF - prefs.js..extensions.enabledItems: {d40f5e7b-d2cf-4856-b441-cc613eeffbe3}:1.50 FF - prefs.js..extensions.enabledItems: netviewero2o@netviewero2o:1.0 FF - prefs.js..keyword.URL: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2206084&q=" FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: D:\Programme\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa2,version=2.0.0: D:\Programme\Picasa2\npPicasa2.dll File not found FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: D:\Programme\Google\Picasa3\npPicasa3.dll (Google, Inc.) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.02.20 20:46:01 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.05.14 19:23:35 | 000,000,000 | ---D | M] [2008.10.17 12:44:14 | 000,000,000 | ---D | M] (No name found) -- C:\Users\happyaldo\AppData\Roaming\mozilla\Extensions [2012.11.09 09:55:25 | 000,000,000 | ---D | M] (No name found) -- C:\Users\happyaldo\AppData\Roaming\mozilla\Firefox\Profiles\urnwj76l.default\extensions [2012.10.13 09:14:21 | 000,000,000 | ---D | M] (Forecastfox) -- C:\Users\happyaldo\AppData\Roaming\mozilla\Firefox\Profiles\urnwj76l.default\extensions\{0538E3E3-7E9B-4d49-8831-A227C80A7AD3} [2010.08.04 00:48:17 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\happyaldo\AppData\Roaming\mozilla\Firefox\Profiles\urnwj76l.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2012.11.09 09:55:25 | 000,000,000 | ---D | M] (ST Deutsch FF Community Toolbar) -- C:\Users\happyaldo\AppData\Roaming\mozilla\Firefox\Profiles\urnwj76l.default\extensions\{9d81af43-de53-48d0-a199-42c2a226b24c} [2011.06.03 08:27:18 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\happyaldo\AppData\Roaming\mozilla\Firefox\Profiles\urnwj76l.default\extensions\engine@conduit.com [2011.12.16 13:05:14 | 000,000,000 | ---D | M] (Ask Toolbar) -- C:\Users\happyaldo\AppData\Roaming\mozilla\Firefox\Profiles\urnwj76l.default\extensions\toolbar@ask.com [2012.01.21 08:30:20 | 000,138,614 | ---- | M] () (No name found) -- C:\Users\happyaldo\AppData\Roaming\mozilla\firefox\profiles\urnwj76l.default\extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi [2011.03.21 16:08:00 | 000,000,941 | ---- | M] () -- C:\Users\happyaldo\AppData\Roaming\mozilla\firefox\profiles\urnwj76l.default\searchplugins\conduit.xml [2011.12.11 19:44:07 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions [2011.02.04 12:39:17 | 000,000,000 | ---D | M] (Skype extension) -- C:\Program Files\mozilla firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} [2012.02.20 20:46:00 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2012.02.20 20:45:57 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.02.20 20:45:57 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2012.02.20 20:45:57 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2012.02.20 20:45:57 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2012.02.20 20:45:57 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2012.02.20 20:45:57 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.) O2 - BHO: (Softonic Deutsch FF Toolbar) - {9d81af43-de53-48d0-a199-42c2a226b24c} - C:\Program Files\Softonic_Deutsch_FF\tbSoft.dll (Conduit Ltd.) O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.) O3 - HKLM\..\Toolbar: (Softonic Deutsch FF Toolbar) - {9d81af43-de53-48d0-a199-42c2a226b24c} - C:\Program Files\Softonic_Deutsch_FF\tbSoft.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask) O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe ({StringFileInfo_CompanyName}) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [CtrlVol] C:\Program Files\Launch Manager\CtrlVol.exe File not found O4 - HKLM..\Run: [EEventManager] C:\PROGRA~1\EPSONS~1\EVENTM~1\EEventManager.exe (SEIKO EPSON CORPORATION) O4 - HKLM..\Run: [HotkeyApp] C:\Program Files\Launch Manager\HotkeyApp.exe (Wistron) O4 - HKLM..\Run: [LaunchAp] C:\Program Files\Launch Manager\LaunchAp.exe File not found O4 - HKLM..\Run: [NPCTray] C:\Program Files\Norman\npc\bin\npc_tray.exe /LOAD File not found O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) O4 - HKLM..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe (Synaptics, Inc.) O4 - HKLM..\Run: [Wbutton] C:\Program Files\Launch Manager\WButton.exe File not found O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation) O4 - HKU\S-1-5-21-4114458166-3482682908-2653977345-1000..\Run: [EPSON SX110 Series] C:\Windows\System32\spool\DRIVERS\W32X86\3\E_FATIFBE.EXE (SEIKO EPSON CORPORATION) O4 - HKU\S-1-5-21-4114458166-3482682908-2653977345-1000..\Run: [Picasa Media Detector] D:\Programme\Picasa2\PicasaMediaDetector.exe File not found O4 - HKU\S-1-5-21-4114458166-3482682908-2653977345-1000..\Run: [recinfo] c:\RecInfo\recinfo.exe (fsc) O4 - HKU\S-1-5-21-4114458166-3482682908-2653977345-1003..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation) O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - Startup: C:\Users\default.MARISOL-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.1.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe () O4 - Startup: C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote Inhaltsverzeichnis.onetoc2 () O4 - Startup: C:\Users\happyaldo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.1.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe () O7 - HKU\S-1-5-21-4114458166-3482682908-2653977345-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.) O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 File not found O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira GmbH) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira GmbH) O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira GmbH) O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Reg Error: Value error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{AEE128B6-FBF6-48E4-9EF3-34E14FBBAEE2}: DhcpNameServer = 192.168.1.1 O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk /r \??\F:) O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) ========== Files/Folders - Created Within 30 Days ========== [2012.11.19 22:07:19 | 000,000,000 | ---D | C] -- D:\Admin_Sandro\Dokumente\trojan-board [2012.11.19 22:06:47 | 000,000,000 | ---D | C] -- D:\Admin_Sandro\Desktop\Neuer Ordner (4) [2012.11.19 22:06:46 | 000,000,000 | ---D | C] -- D:\Admin_Sandro\Desktop\Neuer Ordner (3) [2012.11.19 22:06:36 | 000,000,000 | ---D | C] -- D:\Admin_Sandro\Desktop\Neuer Ordner (2) [2012.11.19 22:06:32 | 000,000,000 | ---D | C] -- D:\Admin_Sandro\Desktop\Neuer Ordner [2012.11.19 20:54:51 | 000,000,000 | ---D | C] -- C:\Users\happyaldo\AppData\Roaming\Malwarebytes [2012.11.19 20:54:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012.11.19 20:54:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2012.11.19 20:54:36 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2012.11.19 20:54:36 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2012.11.10 08:42:00 | 000,000,000 | ---D | C] -- C:\Users\happyaldo\AppData\Local\Wondershare [2012.11.10 08:41:59 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Wondershare [2012.11.10 08:41:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wondershare [2012.11.10 08:41:31 | 000,000,000 | ---D | C] -- C:\Users\happyaldo\AppData\Roaming\Wondershare [2012.11.10 08:41:15 | 000,000,000 | ---D | C] -- C:\Program Files\Wondershare [2012.11.10 08:23:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Free PDF to Word Doc Converter [2012.11.10 08:23:47 | 000,000,000 | ---D | C] -- C:\Program Files\Free PDF to Word Doc Converter [1 C:\*.tmp files -> C:\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.11.20 18:16:29 | 000,670,448 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2012.11.20 18:16:29 | 000,631,514 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2012.11.20 18:16:29 | 000,143,986 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2012.11.20 18:16:29 | 000,118,140 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2012.11.20 18:12:13 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.11.19 22:13:39 | 000,000,000 | ---- | M] () -- C:\Users\happyaldo\defogger_reenable [2012.11.19 20:54:37 | 000,000,912 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.11.19 19:58:13 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2012.11.19 19:58:13 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2012.11.19 19:34:48 | 000,001,100 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2012.11.19 19:00:00 | 000,000,340 | ---- | M] () -- C:\Windows\tasks\Sicherung «Meine Sicherung».job [2012.11.18 21:25:11 | 000,001,104 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2012.11.17 13:20:40 | 000,219,648 | ---- | M] () -- C:\Users\happyaldo\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2012.11.17 03:34:21 | 000,322,648 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2012.11.10 08:41:35 | 000,000,970 | ---- | M] () -- C:\Users\Public\Desktop\Wondershare PDF Editor.lnk [2012.11.10 08:30:33 | 000,001,977 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk [2012.11.10 08:23:48 | 000,000,734 | ---- | M] () -- D:\Admin_Sandro\Desktop\Free PDF to Word Doc Converter.lnk [1 C:\*.tmp files -> C:\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.11.19 22:13:39 | 000,000,000 | ---- | C] () -- C:\Users\happyaldo\defogger_reenable [2012.11.19 20:54:37 | 000,000,912 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.11.10 08:43:30 | 000,075,264 | ---- | C] () -- C:\Windows\System32\WSMonEditor.dll [2012.11.10 08:41:35 | 000,000,970 | ---- | C] () -- C:\Users\Public\Desktop\Wondershare PDF Editor.lnk [2012.11.10 08:23:48 | 000,000,734 | ---- | C] () -- D:\Admin_Sandro\Desktop\Free PDF to Word Doc Converter.lnk [2011.12.11 19:00:23 | 000,000,680 | ---- | C] () -- C:\Users\happyaldo\AppData\Local\d3d9caps.dat [2011.02.04 12:42:35 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat [2009.12.26 16:57:31 | 000,000,306 | RHS- | C] () -- C:\ProgramData\ntuser.pol [2009.03.07 22:56:37 | 000,219,648 | ---- | C] () -- C:\Users\happyaldo\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2007.03.12 18:59:00 | 000,299,008 | ---- | C] () -- C:\Program Files\navigram_register.exe ========== ZeroAccess Check ========== [2006.11.02 13:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012.06.08 18:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2009.04.11 07:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = %systemroot%\system32\wbem\wbemess.dll -- [2009.04.11 07:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both ========== LOP Check ========== [2012.02.16 12:37:11 | 000,000,000 | ---D | M] -- C:\Users\default.MARISOL-PC\AppData\Roaming\.Kanton SH [2011.03.19 12:41:10 | 000,000,000 | ---D | M] -- C:\Users\default.MARISOL-PC\AppData\Roaming\Epson [2009.09.19 12:14:01 | 000,000,000 | ---D | M] -- C:\Users\default.MARISOL-PC\AppData\Roaming\fotobuch.de AG [2008.10.20 18:53:46 | 000,000,000 | ---D | M] -- C:\Users\default.MARISOL-PC\AppData\Roaming\ifolor [2012.04.14 11:11:34 | 000,000,000 | ---D | M] -- C:\Users\default.MARISOL-PC\AppData\Roaming\Information Factory [2010.03.19 09:55:46 | 000,000,000 | ---D | M] -- C:\Users\default.MARISOL-PC\AppData\Roaming\Juniper Networks [2009.06.28 09:56:01 | 000,000,000 | ---D | M] -- C:\Users\default.MARISOL-PC\AppData\Roaming\OpenOffice.org [2011.06.01 17:55:49 | 000,000,000 | ---D | M] -- C:\Users\default.MARISOL-PC\AppData\Roaming\QuickZip [2011.06.27 19:34:14 | 000,000,000 | ---D | M] -- C:\Users\default.MARISOL-PC\AppData\Roaming\TeamViewer [2012.11.10 08:44:17 | 000,000,000 | ---D | M] -- C:\Users\default.MARISOL-PC\AppData\Roaming\Wondershare [2012.03.26 20:16:10 | 000,000,000 | ---D | M] -- C:\Users\happyaldo\AppData\Roaming\.jfwupdate [2012.01.21 08:37:24 | 000,000,000 | ---D | M] -- C:\Users\happyaldo\AppData\Roaming\.Kanton SH [2010.08.06 15:02:12 | 000,000,000 | ---D | M] -- C:\Users\happyaldo\AppData\Roaming\Epson [2009.07.03 07:19:22 | 000,000,000 | ---D | M] -- C:\Users\happyaldo\AppData\Roaming\Juniper Networks [2011.11.12 19:28:55 | 000,000,000 | ---D | M] -- C:\Users\happyaldo\AppData\Roaming\Notepad++ [2009.06.27 22:08:20 | 000,000,000 | ---D | M] -- C:\Users\happyaldo\AppData\Roaming\OpenOffice.org [2012.03.11 20:33:15 | 000,000,000 | ---D | M] -- C:\Users\happyaldo\AppData\Roaming\TeamViewer [2011.07.25 13:23:44 | 000,000,000 | ---D | M] -- C:\Users\happyaldo\AppData\Roaming\TrueCrypt [2012.11.10 08:43:39 | 000,000,000 | ---D | M] -- C:\Users\happyaldo\AppData\Roaming\Wondershare [2012.11.19 19:36:31 | 000,000,000 | ---D | M] -- C:\Users\MaCaSAu\AppData\Roaming\Epson ========== Purity Check ========== < End of report > Code:
ATTFilter GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-11-20 21:19:05
Windows 6.0.6002 Service Pack 2
Running: klnbjvvy.exe; Driver: C:\Users\HAPPYA~1\AppData\Local\Temp\kwtiifod.sys
---- Devices - GMER 1.0.15 ----
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
---- Registry - GMER 1.0.15 ----
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\CompatibilityAdapter\Signatures@Sicherung \xabMeine Sicherung\xbb.job.fp 1127743358
---- EOF - GMER 1.0.15 ----
Ansonsten schon im Voraus recht herzlichen Dank für Eure Arbeit und Unterstützung!  : |
| Themen zu Polizei-Trojaner ("Swiss Edition") / Trojan.Ransom / Trojan.Agent |
| 32 bit, administrator, avira, beseitigung, bho, bonjour, checkliste, defender, error, explorer, firefox, format, home, hotkey.sys, infiziert, launch, logfile, norman, plug-in, realtek, registry, scan, security, senden, server, softonic deutsch ff toolbar, system, tr/inject.ewmm, vista, windows |
Baum-Darstellung