Windows 7: Postbank Online-Banking Trojaner

Küstenkind · 12.01.2014, 10:57

Guten Morgen

Auch bei mir hat sich der Postbak Trojaner eingenistet, der nach Eingabe meiner Daten die Handynummer erfragt, um eine Nachricht zu schicken mit einem Download-Link.
Malwarebytes hab ich bereits laufen lassen. Es wurden auch 7 verdächtige Dateien gelöscht, der Fehler ist allerdings nicht behoben.

Anbei dann noch meine Logfiles:

Malwarebytes-Log

Code:

ATTFilter

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2014.01.04.04

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 8.0.7601.17514
Lucie543 :: LOTTE [Administrator]

04.01.2014 19:14:53
mbam-log-2014-01-04 (19-14-53).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 291405
Laufzeit: 42 Minute(n), 51 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 7
C:\Users\Lucie543\AppData\Local\Temp\h1dNYFyb.exe.part (PUP.Optional.Installcore) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Lucie543\AppData\Local\Temp\{00005DFD-7B55-BF2D} (Backdoor.Bot.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Lucie543\AppData\Local\Temp\{00008325-3B4D-A795} (Trojan.Zbot) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Lucie543\AppData\Local\Temp\{0000D6A0-E3C8-6550} (Backdoor.Bot.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Lucie543\AppData\Local\Temp\{000118D2-AC8A-67C2} (Trojan.Backdoor.RV) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Lucie543\AppData\Local\Temp\{000123A3-587D-298A} (Spyware.Zbot.ED) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Lucie543\AppData\Local\Temp\uvwknhpamp.pre (Trojan.Agent.GE) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

FRST.txt

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 11-01-2014 03
Ran by Lucie543 (administrator) on LOTTE on 12-01-2014 10:33:27
Running from C:\Users\Lucie543\Downloads
Microsoft Windows 7 Ultimate  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(ASUS) C:\Program Files\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe
(ASUS) C:\Program Files\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
(ASUSTek Computer Inc.) C:\Program Files\ASUS\ATK Package\ATK Hotkey\HControl.exe
(VIA Technologies, Inc.) C:\Windows\System32\ViakaraokeSrv.exe
(ASUSTek Computer Inc.) C:\Program Files\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
(CANON INC.) C:\Program Files\Canon\IJ Network Scanner Selector EX\CNMNSST.exe
(ELAN Microelectronic Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(VIA) C:\Program Files\VIA\VIAudioi\VDeck\VDeck.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Sonix Technology Co., Ltd.) C:\Windows\vsnp2uvc.exe
(ASUS) C:\Program Files\ASUS\ATK Package\ATK Media\DMedia.exe
(ASUS) C:\Program Files\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
(SRS Labs, Inc.) C:\Program Files\SRS Labs\SRS Premium Sound Control Panel\SRSPremiumPanel.exe
(ASUS) C:\Program Files\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe
(ASUS) C:\Program Files\ASUS\ATK Package\ATK Hotkey\WDC.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Windows\System32\audiodg.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [IJNetworkScannerSelectorEX] - C:\Program Files\Canon\IJ Network Scanner Selector EX\CNMNSST.exe [452016 2010-09-09] (CANON INC.)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)
HKLM\...\Run: [ETDCtrl] - C:\Program Files\Elantech\ETDCtrl.exe [497024 2009-07-30] (ELAN Microelectronic Corp.)
HKLM\...\Run: [HDAudDeck] - C:\Program Files\VIA\VIAudioi\VDeck\VDeck.exe [4512432 2013-05-10] (VIA)
HKLM\...\Run: [snp2uvc] - C:\Windows\vsnp2uvc.exe [909824 2010-01-21] (Sonix Technology Co., Ltd.)
HKLM\...\Run: [ATKOSD2] - C:\Program Files\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [318080 2011-12-22] (ASUSTek Computer Inc.)
HKLM\...\Run: [ATKMEDIA] - C:\Program Files\ASUS\ATK Package\ATK Media\DMedia.exe [174720 2011-10-24] (ASUS)
HKLM\...\Run: [HControlUser] - C:\Program Files\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS)
HKLM\...\Run: [ETDWare] - C:\Program Files\Elantech\ETDCtrl.exe [497024 2009-07-30] (ELAN Microelectronic Corp.)
HKLM\...\Run: [mobilegeni daemon] - C:\Program Files\Mobogenie\DaemonProcess.exe
HKLM\...\Runonce: [Del656739093] - cmd.exe /Q /D /c del "C:\Users\Lucie543\AppData\Local\Temp\0.del"
HKLM\...\Runonce: [Del656739997] - cmd.exe /Q /D /c del "C:\Users\Lucie543\AppData\Local\Temp\0.del"
HKCU\...\Run: [tvxwzecu] - C:\Users\Lucie543\AppData\Roaming\Lapyctxn\ekwdfzecu.exe [109568 2014-01-11] ()
HKCU\...\Run: [NextLive] - C:\Users\Lucie543\AppData\Roaming\newnext.me\nengine.dll [1283584 2013-11-14] (NewNextDotMe)
HKCU\...\Runonce: [Del656739093] - cmd.exe /Q /D /c del "C:\Users\Lucie543\AppData\Local\Temp\0.del"
HKCU\...\Runonce: [Del656739997] - cmd.exe /Q /D /c del "C:\Users\Lucie543\AppData\Local\Temp\0.del"

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x7DED8AE96E67CE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Plus-HD-5.0 - {11111111-1111-1111-1111-110411771118} - C:\Program Files\Plus-HD-5.0\Plus-HD-5.0-bho.dll (Plus HD)
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Lucie543\AppData\Roaming\Mozilla\Firefox\Profiles\64r0t1oc.default
FF user.js: detected! => C:\Users\Lucie543\AppData\Roaming\Mozilla\Firefox\Profiles\64r0t1oc.default\user.js
FF Homepage: https://www.google.de/|about:home
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin: @google.com/npPicasa3,version=3.0.0 - C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Plus-HD-5.0 - C:\Users\Lucie543\AppData\Roaming\Mozilla\Firefox\Profiles\64r0t1oc.default\Extensions\8c6c8c15-21d7-4f62-8a57-202aee8f7fb3@6567ba21-e435-4eb0-838d-8395b2265c30.com [2014-01-12]
FF Extension: Foxtab Speed Dial - C:\Users\Lucie543\AppData\Roaming\Mozilla\Firefox\Profiles\64r0t1oc.default\Extensions\{5ebdca98-43b3-45bb-87e0-716029fb42ab} [2014-01-12]

========================== Services (Whitelisted) =================

R2 ASLDRService; C:\Program Files\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe [80512 2011-11-21] (ASUS)
R2 ATKGFNEXSrv; C:\Program Files\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe [96896 2011-11-21] (ASUS)
R2 VIAKaraokeService; C:\Windows\system32\viakaraokesrv.exe [27768 2012-12-11] (VIA Technologies, Inc.)

==================== Drivers (Whitelisted) ====================

R2 ASMMAP; C:\Program Files\ASUS\ATK Package\ATKGFNEX\ASMMAP.sys [13880 2009-07-02] (ASUS)
R3 athr; C:\Windows\System32\DRIVERS\athr.sys [3174912 2013-05-24] (Qualcomm Atheros Communications, Inc.)
R3 ETD; C:\Windows\System32\DRIVERS\ETD.sys [87040 2009-07-29] (ELAN Microelectronic Corp.)
R3 L1E; C:\Windows\System32\DRIVERS\L1E62x86.sys [55848 2010-03-29] (Atheros Communications, Inc.)
R3 MTsensor; C:\Windows\System32\DRIVERS\ATKACPI.sys [14392 2009-05-13] (ASUS)
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1761024 2010-09-07] (Sonix Technology Co., Ltd.)
R3 VIAHdAudAddService; C:\Windows\System32\drivers\viahduaa.sys [1846448 2013-05-10] (VIA Technologies, Inc.)
S3 VGPU; System32\drivers\rdvgkmd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-01-12 10:33 - 2014-01-12 10:33 - 00006804 _____ C:\Users\Lucie543\Downloads\FRST.txt
2014-01-12 10:33 - 2014-01-12 10:33 - 00000000 ____D C:\FRST
2014-01-12 10:32 - 2014-01-12 10:32 - 01220096 _____ (Farbar) C:\Users\Lucie543\Downloads\FRST.exe
2014-01-12 10:29 - 2014-01-12 10:31 - 00000000 ____D C:\Users\Lucie543\AppData\Local\Mobogenie
2014-01-12 10:29 - 2014-01-12 10:30 - 00000000 ____D C:\Users\Lucie543\AppData\Local\genienext
2014-01-12 10:29 - 2014-01-12 10:29 - 00000000 ____D C:\Users\Lucie543\Documents\Mobogenie
2014-01-12 10:29 - 2014-01-12 10:29 - 00000000 ____D C:\Users\Lucie543\AppData\Roaming\newnext.me
2014-01-12 10:29 - 2014-01-12 10:29 - 00000000 ____D C:\Users\Lucie543\AppData\Roaming\0D0S1L2Z1P1B
2014-01-12 10:29 - 2014-01-12 10:29 - 00000000 ____D C:\Users\Lucie543\AppData\Local\cache
2014-01-12 10:29 - 2014-01-12 10:29 - 00000000 ____D C:\Users\Lucie543\.android
2014-01-12 10:29 - 2014-01-12 10:29 - 00000000 _____ C:\Users\Lucie543\daemonprocess.txt
2014-01-12 10:28 - 2014-01-12 10:31 - 00000000 ____D C:\Program Files\Mobogenie
2014-01-12 10:28 - 2014-01-12 10:28 - 00002086 _____ C:\Windows\Tasks\Plus-HD-5.0-firefoxinstaller.job
2014-01-12 10:28 - 2014-01-12 10:28 - 00001954 _____ C:\Windows\Tasks\Plus-HD-5.0-chromeinstaller.job
2014-01-12 10:28 - 2014-01-12 10:28 - 00001322 _____ C:\Windows\Tasks\Plus-HD-5.0-updater.job
2014-01-12 10:28 - 2014-01-12 10:28 - 00001224 _____ C:\Windows\Tasks\Plus-HD-5.0-codedownloader.job
2014-01-12 10:28 - 2014-01-12 10:28 - 00001124 _____ C:\Windows\Tasks\Plus-HD-5.0-enabler.job
2014-01-12 10:28 - 2014-01-12 10:28 - 00000108 _____ C:\Users\Lucie543\AppData\Roaming\WB.CFG
2014-01-12 10:28 - 2014-01-12 10:28 - 00000000 ____D C:\Program Files\Plus-HD-5.0
2014-01-12 10:27 - 2014-01-12 10:27 - 00000304 _____ C:\Windows\Tasks\Digital Sites.job
2014-01-12 10:27 - 2014-01-12 10:27 - 00000300 _____ C:\Windows\Tasks\FoxTab.job
2014-01-12 10:27 - 2014-01-12 10:27 - 00000000 ____D C:\Users\Lucie543\AppData\Roaming\FoxTab
2014-01-12 10:27 - 2014-01-12 10:27 - 00000000 ____D C:\Users\Lucie543\AppData\Roaming\DigitalSites
2014-01-12 10:27 - 2014-01-12 10:27 - 00000000 ____D C:\Program Files\Foxtab
2014-01-12 10:26 - 2014-01-12 10:26 - 00669048 _____ (                                                            ) C:\Users\Lucie543\Downloads\ZipExtractorSetup.exe
2014-01-09 19:51 - 2014-01-09 19:51 - 00000000 ____D C:\Users\Lucie543\Documents\PDFcreator
2014-01-09 19:46 - 2014-01-09 19:46 - 00000989 _____ C:\Users\Public\Desktop\PDFCreator.lnk
2014-01-09 19:46 - 2014-01-09 19:46 - 00000000 ____D C:\Users\Lucie543\AppData\Roaming\pdfforge
2014-01-09 19:46 - 2014-01-09 19:46 - 00000000 ____D C:\Program Files\PDFCreator
2014-01-09 19:46 - 2013-04-09 14:13 - 00095416 _____ (pdfforge GmbH) C:\Windows\system32\pdfcmon.dll
2014-01-09 19:46 - 2012-05-05 10:54 - 00662288 _____ (Microsoft Corporation) C:\Windows\system32\MSCOMCT2.OCX
2014-01-09 19:46 - 2012-05-05 10:54 - 00137000 _____ (Microsoft Corporation) C:\Windows\system32\MSMAPI32.OCX
2014-01-09 19:46 - 2012-05-05 10:54 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\MSMPIDE.DLL
2014-01-09 19:46 - 1998-07-06 17:56 - 00125712 _____ (Microsoft Corporation) C:\Windows\system32\VB6DE.DLL
2014-01-09 19:46 - 1998-07-06 17:55 - 00158208 _____ (Microsoft Corporation) C:\Windows\system32\MSCMCDE.DLL
2014-01-09 19:46 - 1998-07-06 17:55 - 00064512 _____ (Microsoft Corporation) C:\Windows\system32\MSCC2DE.DLL
2014-01-09 19:44 - 2014-01-09 19:45 - 18277248 _____ (pdfforge                                                    ) C:\Users\Lucie543\Downloads\PDFCreator-1_7_2_setup.exe
2014-01-09 19:35 - 2014-01-09 19:36 - 69734576 _____ (pdfforge                                                    ) C:\Users\Lucie543\Downloads\PDFCreator-1_7_2_setup_offline.exe
2014-01-04 15:23 - 2014-01-04 15:23 - 00001067 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-01-04 15:23 - 2014-01-04 15:23 - 00000000 ____D C:\Users\Lucie543\AppData\Roaming\Malwarebytes
2014-01-04 15:23 - 2014-01-04 15:23 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-04 15:23 - 2014-01-04 15:23 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2014-01-04 15:23 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-01-04 15:22 - 2014-01-04 15:22 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Lucie543\Downloads\mbam-setup-1.75.0.1300.exe
2014-01-03 22:19 - 2014-01-03 22:19 - 00000000 ____D C:\Users\Lucie543\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google+ Auto Backup
2014-01-03 22:18 - 2014-01-03 22:22 - 00000000 ____D C:\Users\Lucie543\AppData\Local\Google
2014-01-03 22:18 - 2014-01-03 22:18 - 00000000 ____D C:\Program Files\Google
2014-01-03 22:15 - 2014-01-03 22:16 - 17655760 _____ (Google Inc.) C:\Users\Lucie543\Downloads\picasa3976-setup.exe
2013-12-28 11:47 - 2013-12-28 11:49 - 00000000 ____D C:\Users\Lucie543\Documents\eBook
2013-12-27 12:42 - 2013-12-27 12:42 - 00000000 ____D C:\Users\Lucie543\AppData\Local\calibre-cache
2013-12-27 12:41 - 2013-12-28 12:06 - 00000000 ____D C:\Users\Lucie543\Documents\Calibre-Bibliothek
2013-12-27 12:41 - 2013-12-27 12:42 - 00000000 ____D C:\Users\Lucie543\AppData\Roaming\calibre
2013-12-27 12:40 - 2013-12-27 12:40 - 00000000 ____D C:\Program Files\Calibre2
2013-12-27 12:38 - 2013-12-27 12:39 - 54164992 _____ C:\Users\Lucie543\Downloads\calibre-1.17.0.msi
2013-12-23 20:32 - 2013-12-23 20:32 - 04558848 _____ (Google Inc.) C:\Windows\system32\GPhotos.scr

==================== One Month Modified Files and Folders =======

2014-01-12 10:33 - 2014-01-12 10:33 - 00006804 _____ C:\Users\Lucie543\Downloads\FRST.txt
2014-01-12 10:33 - 2014-01-12 10:33 - 00000000 ____D C:\FRST
2014-01-12 10:32 - 2014-01-12 10:32 - 01220096 _____ (Farbar) C:\Users\Lucie543\Downloads\FRST.exe
2014-01-12 10:31 - 2014-01-12 10:29 - 00000000 ____D C:\Users\Lucie543\AppData\Local\Mobogenie
2014-01-12 10:31 - 2014-01-12 10:28 - 00000000 ____D C:\Program Files\Mobogenie
2014-01-12 10:30 - 2014-01-12 10:29 - 00000000 ____D C:\Users\Lucie543\AppData\Local\genienext
2014-01-12 10:30 - 2009-07-14 05:34 - 00021072 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-12 10:30 - 2009-07-14 05:34 - 00021072 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-12 10:29 - 2014-01-12 10:29 - 00000000 ____D C:\Users\Lucie543\Documents\Mobogenie
2014-01-12 10:29 - 2014-01-12 10:29 - 00000000 ____D C:\Users\Lucie543\AppData\Roaming\newnext.me
2014-01-12 10:29 - 2014-01-12 10:29 - 00000000 ____D C:\Users\Lucie543\AppData\Roaming\0D0S1L2Z1P1B
2014-01-12 10:29 - 2014-01-12 10:29 - 00000000 ____D C:\Users\Lucie543\AppData\Local\cache
2014-01-12 10:29 - 2014-01-12 10:29 - 00000000 ____D C:\Users\Lucie543\.android
2014-01-12 10:29 - 2014-01-12 10:29 - 00000000 _____ C:\Users\Lucie543\daemonprocess.txt
2014-01-12 10:29 - 2013-06-12 14:12 - 00000000 ____D C:\Users\Lucie543
2014-01-12 10:28 - 2014-01-12 10:28 - 00002086 _____ C:\Windows\Tasks\Plus-HD-5.0-firefoxinstaller.job
2014-01-12 10:28 - 2014-01-12 10:28 - 00001954 _____ C:\Windows\Tasks\Plus-HD-5.0-chromeinstaller.job
2014-01-12 10:28 - 2014-01-12 10:28 - 00001322 _____ C:\Windows\Tasks\Plus-HD-5.0-updater.job
2014-01-12 10:28 - 2014-01-12 10:28 - 00001224 _____ C:\Windows\Tasks\Plus-HD-5.0-codedownloader.job
2014-01-12 10:28 - 2014-01-12 10:28 - 00001124 _____ C:\Windows\Tasks\Plus-HD-5.0-enabler.job
2014-01-12 10:28 - 2014-01-12 10:28 - 00000108 _____ C:\Users\Lucie543\AppData\Roaming\WB.CFG
2014-01-12 10:28 - 2014-01-12 10:28 - 00000000 ____D C:\Program Files\Plus-HD-5.0
2014-01-12 10:27 - 2014-01-12 10:27 - 00000304 _____ C:\Windows\Tasks\Digital Sites.job
2014-01-12 10:27 - 2014-01-12 10:27 - 00000300 _____ C:\Windows\Tasks\FoxTab.job
2014-01-12 10:27 - 2014-01-12 10:27 - 00000000 ____D C:\Users\Lucie543\AppData\Roaming\FoxTab
2014-01-12 10:27 - 2014-01-12 10:27 - 00000000 ____D C:\Users\Lucie543\AppData\Roaming\DigitalSites
2014-01-12 10:27 - 2014-01-12 10:27 - 00000000 ____D C:\Program Files\Foxtab
2014-01-12 10:26 - 2014-01-12 10:26 - 00669048 _____ (                                                            ) C:\Users\Lucie543\Downloads\ZipExtractorSetup.exe
2014-01-12 10:06 - 2013-06-12 15:01 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-01-12 10:00 - 2013-06-12 14:10 - 01137367 _____ C:\Windows\WindowsUpdate.log
2014-01-09 19:58 - 2010-11-20 22:01 - 01498506 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-09 19:51 - 2014-01-09 19:51 - 00000000 ____D C:\Users\Lucie543\Documents\PDFcreator
2014-01-09 19:46 - 2014-01-09 19:46 - 00000989 _____ C:\Users\Public\Desktop\PDFCreator.lnk
2014-01-09 19:46 - 2014-01-09 19:46 - 00000000 ____D C:\Users\Lucie543\AppData\Roaming\pdfforge
2014-01-09 19:46 - 2014-01-09 19:46 - 00000000 ____D C:\Program Files\PDFCreator
2014-01-09 19:45 - 2014-01-09 19:44 - 18277248 _____ (pdfforge                                                    ) C:\Users\Lucie543\Downloads\PDFCreator-1_7_2_setup.exe
2014-01-09 19:36 - 2014-01-09 19:35 - 69734576 _____ (pdfforge                                                    ) C:\Users\Lucie543\Downloads\PDFCreator-1_7_2_setup_offline.exe
2014-01-04 23:00 - 2013-11-10 21:01 - 00000000 ____D C:\Users\Lucie543\Desktop\Schreibzeugs
2014-01-04 20:02 - 2012-06-14 12:28 - 00022091 _____ C:\Windows\setupact.log
2014-01-04 20:02 - 2010-11-20 22:48 - 00016086 _____ C:\Windows\PFRO.log
2014-01-04 20:02 - 2009-07-14 05:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-04 20:02 - 2009-07-14 03:37 - 00000000 ____D C:\Program Files\Windows NT
2014-01-04 15:23 - 2014-01-04 15:23 - 00001067 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-01-04 15:23 - 2014-01-04 15:23 - 00000000 ____D C:\Users\Lucie543\AppData\Roaming\Malwarebytes
2014-01-04 15:23 - 2014-01-04 15:23 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-04 15:23 - 2014-01-04 15:23 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2014-01-04 15:22 - 2014-01-04 15:22 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Lucie543\Downloads\mbam-setup-1.75.0.1300.exe
2014-01-03 22:22 - 2014-01-03 22:18 - 00000000 ____D C:\Users\Lucie543\AppData\Local\Google
2014-01-03 22:19 - 2014-01-03 22:19 - 00000000 ____D C:\Users\Lucie543\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google+ Auto Backup
2014-01-03 22:18 - 2014-01-03 22:18 - 00000000 ____D C:\Program Files\Google
2014-01-03 22:16 - 2014-01-03 22:15 - 17655760 _____ (Google Inc.) C:\Users\Lucie543\Downloads\picasa3976-setup.exe
2013-12-28 12:06 - 2013-12-27 12:41 - 00000000 ____D C:\Users\Lucie543\Documents\Calibre-Bibliothek
2013-12-28 11:49 - 2013-12-28 11:47 - 00000000 ____D C:\Users\Lucie543\Documents\eBook
2013-12-27 12:42 - 2013-12-27 12:42 - 00000000 ____D C:\Users\Lucie543\AppData\Local\calibre-cache
2013-12-27 12:42 - 2013-12-27 12:41 - 00000000 ____D C:\Users\Lucie543\AppData\Roaming\calibre
2013-12-27 12:40 - 2013-12-27 12:40 - 00000000 ____D C:\Program Files\Calibre2
2013-12-27 12:39 - 2013-12-27 12:38 - 54164992 _____ C:\Users\Lucie543\Downloads\calibre-1.17.0.msi
2013-12-23 20:32 - 2013-12-23 20:32 - 04558848 _____ (Google Inc.) C:\Windows\system32\GPhotos.scr

Some content of TEMP:
====================
C:\Users\Lucie543\AppData\Local\Temp\fp_pl_pfs_installer-1.exe
C:\Users\Lucie543\AppData\Local\Temp\fp_pl_pfs_installer.exe
C:\Users\Lucie543\AppData\Local\Temp\installapi.exe
C:\Users\Lucie543\AppData\Local\Temp\Uninstall.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-12-31 11:38

==================== End Of Log ============================

Addition.txt

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 11-01-2014 03
Ran by Lucie543 at 2014-01-12 10:33:57
Running from C:\Users\Lucie543\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

Adobe Flash Player 11 ActiveX (Version: 11.9.900.170 - Adobe Systems Incorporated)
Adobe Flash Player 11 Plugin (Version: 11.9.900.170 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.03) - Deutsch (Version: 11.0.03 - Adobe Systems Incorporated)
Atheros Communications Inc.(R) AR8121/AR8113/AR8114 Gigabit/Fast Ethernet Driver (Version: 1.0.0.22 - Atheros Communications Inc.)
ATK Package (Version: 1.0.0015 - ASUS)
calibre (Version: 1.17.0 - Kovid Goyal)
Canon IJ Network Scanner Selector EX (Version:  - )
Canon IJ Network Tool (Version: 3.1.1 - Canon Inc.)
Canon MX420 series MP Drivers (Version:  - Canon Inc.)
Compatibility Pack für 2007 Office System (Version: 12.0.6514.5001 - Microsoft Corporation)
ETDWare PS/2-x86 7.0.5.7_WHQL (Version: 11.7.13.2 - ELAN Microelectronic Corp.)
Foxtab (Version:  - FoxTab) <==== ATTENTION
Google+ Auto Backup (Version: 1.0.19.76 - Google)
Intel(R) Graphics Media Accelerator Driver (Version: 8.15.10.2869 - Intel Corporation)
LucasArts' Monkey4 (Version:  - )
Malwarebytes Anti-Malware Version 1.75.0.1300 (Version: 1.75.0.1300 - Malwarebytes Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Office Professional Edition 2003 (Version: 11.0.7969.0 - Microsoft Corporation)
Microsoft Office Word Viewer 2003 (Version: 11.0.8173.0 - Microsoft Corporation)
Mozilla Firefox 26.0 (x86 de) (Version: 26.0 - Mozilla)
Mozilla Maintenance Service (Version: 26.0 - Mozilla)
Mozilla Thunderbird 17.0.8 (x86 de) (Version: 17.0.8 - Mozilla)
PDFCreator (Version: 1.7.2 - pdfforge)
Picasa 3 (Version: 3.9 - Google, Inc.)
Platform (Version: 1.39 - VIA Technologies, Inc.) Hidden
Plus-HD-5.0 (Version: 1.31.153.3 - Plus HD) <==== ATTENTION
QuickPar 0.9 (Version: 0.9 - Peter B. Clements)
SRS Premium Sound Control Panel (Version: 1.8.2300 - SRS Labs, Inc.)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1 - Microsoft Corporation)
Update for Zip Extractor (Version:  - Update for Zip Extractor)
USB2.0 UVC VGA WebCam (Version: 5.8.55133.208 - Sonix)
VIA Plattform-Geräte-Manager (Version: 1.39 - VIA Technologies, Inc.)
VLC media player 2.0.7 (Version: 2.0.7 - VideoLAN)
Zip Extractor Packages (Version:  - )

==================== Restore Points  =========================

22-11-2013 14:51:08 Windows Update
07-12-2013 19:23:33 Windows Update
21-12-2013 10:23:18 Geplanter Prüfpunkt
27-12-2013 11:40:19 Installed calibre
29-12-2013 17:23:27 Windows Update
06-01-2014 18:00:53 Geplanter Prüfpunkt
09-01-2014 18:43:46 Removed PDF Architect

==================== Hosts content: ==========================

2009-07-14 03:04 - 2009-06-10 22:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {19265D6C-B5EE-4D25-B35D-772768F0D003} - System32\Tasks\ATKOSD2 => C:\Program Files\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [2011-12-22] (ASUSTek Computer Inc.)
Task: {2341C6E4-FEDD-43AC-9465-B59715ED44BE} - System32\Tasks\Plus-HD-5.0-firefoxinstaller => C:\Program Files\Plus-HD-5.0\Plus-HD-5.0-firefoxinstaller.exe [2014-01-12] (Plus HD) <==== ATTENTION
Task: {2DD63027-EAF3-4F9A-AF06-455CC248C223} - System32\Tasks\Plus-HD-5.0-chromeinstaller => C:\Program Files\Plus-HD-5.0\Plus-HD-5.0-chromeinstaller.exe [2014-01-12] (Plus HD) <==== ATTENTION
Task: {66DB8D9C-19F2-48FB-A2DB-0C2CEA7AA46C} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-11] (Adobe Systems Incorporated)
Task: {758A67B1-AFDC-43C5-B082-0AC8F57FA19D} - System32\Tasks\Plus-HD-5.0-enabler => C:\Program Files\Plus-HD-5.0\Plus-HD-5.0-enabler.exe [2014-01-12] (Plus HD) <==== ATTENTION
Task: {76F6128D-1D0D-473E-8D1A-D9FD735B3974} - System32\Tasks\Plus-HD-5.0-updater => C:\Program Files\Plus-HD-5.0\Plus-HD-5.0-updater.exe [2014-01-12] (Plus HD) <==== ATTENTION
Task: {DFDB979F-BC95-4FDF-BC01-7555777AE88D} - System32\Tasks\Plus-HD-5.0-codedownloader => C:\Program Files\Plus-HD-5.0\Plus-HD-5.0-codedownloader.exe [2014-01-12] (Plus HD) <==== ATTENTION
Task: {F9575171-D20A-4B6F-9009-8F1671A2A9F1} - System32\Tasks\Digital Sites => C:\Users\Lucie543\AppData\Roaming\DigitalSites\UpdateProc\UpdateTask.exe [2013-04-12] ()
Task: {FEDAC893-4C1B-4BEC-9A3C-B9107151BC97} - System32\Tasks\FoxTab => C:\Users\Lucie543\AppData\Roaming\FoxTab\UpdateProc\UpdateTask.exe [2013-04-12] () <==== ATTENTION
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\Digital Sites.job => C:\Users\Lucie543\AppData\Roaming\DIGITA~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: C:\Windows\Tasks\FoxTab.job => C:\Users\Lucie543\AppData\Roaming\FoxTab\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: C:\Windows\Tasks\Plus-HD-5.0-chromeinstaller.job => C:\Program Files\Plus-HD-5.0\Plus-HD-5.0-chromeinstaller.exe <==== ATTENTION
Task: C:\Windows\Tasks\Plus-HD-5.0-codedownloader.job => C:\Program Files\Plus-HD-5.0\Plus-HD-5.0-codedownloader.exe <==== ATTENTION
Task: C:\Windows\Tasks\Plus-HD-5.0-enabler.job => C:\Program Files\Plus-HD-5.0\Plus-HD-5.0-enabler.exe <==== ATTENTION
Task: C:\Windows\Tasks\Plus-HD-5.0-firefoxinstaller.job => C:\Program Files\Plus-HD-5.0\Plus-HD-5.0-firefoxinstaller.exe <==== ATTENTION
Task: C:\Windows\Tasks\Plus-HD-5.0-updater.job => C:\Program Files\Plus-HD-5.0\Plus-HD-5.0-updater.exe <==== ATTENTION

==================== Loaded Modules (whitelisted) =============

2013-06-24 16:08 - 2012-12-11 23:01 - 00080504 _____ () C:\Program Files\VIA\VIAudioi\VDeck\QsApoApi.dll
2013-06-24 16:08 - 2012-12-11 23:01 - 00113272 _____ () C:\Program Files\VIA\VIAudioi\VDeck\Dts2ApoApi.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (01/04/2014 08:02:32 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/29/2013 09:51:25 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/15/2013 05:06:11 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/12/2013 05:37:06 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/10/2013 06:30:37 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/09/2013 06:27:23 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/08/2013 07:53:59 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/07/2013 07:01:42 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/05/2013 06:54:10 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/04/2013 06:38:46 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (12/28/2013 11:59:18 AM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR3 gefunden.

Error: (12/28/2013 11:59:17 AM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR3 gefunden.

Error: (12/28/2013 11:59:17 AM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR3 gefunden.

Error: (11/18/2013 05:13:35 PM) (Source: volsnap) (User: )
Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.

Error: (11/15/2013 10:14:22 PM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am ‎15.‎11.‎2013 um 21:20:27 unerwartet heruntergefahren.

Error: (11/14/2013 05:33:23 AM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am ‎13.‎11.‎2013 um 20:29:39 unerwartet heruntergefahren.

Error: (10/17/2013 05:35:51 PM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am ‎17.‎10.‎2013 um 18:33:05 unerwartet heruntergefahren.

Error: (10/17/2013 04:58:14 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Soda PDF 5 Service" wurde mit folgendem Fehler beendet: 
%%-2147467259

Error: (08/15/2013 07:32:30 AM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst Spooler erreicht.

Error: (08/15/2013 07:32:00 AM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst Spooler erreicht.


Microsoft Office Sessions:
=========================
Error: (01/04/2014 08:02:32 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/29/2013 09:51:25 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/15/2013 05:06:11 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/12/2013 05:37:06 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/10/2013 06:30:37 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/09/2013 06:27:23 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/08/2013 07:53:59 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/07/2013 07:01:42 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/05/2013 06:54:10 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/04/2013 06:38:46 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


==================== Memory info =========================== 

Percentage of memory in use: 24%
Total physical RAM: 3037.09 MB
Available physical RAM: 2292.7 MB
Total Pagefile: 6072.46 MB
Available Pagefile: 5025.88 MB
Total Virtual: 2047.88 MB
Available Virtual: 1881.25 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:297.99 GB) (Free:244.99 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298 GB) (Disk ID: CEECCB69)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=298 GB) - (Type=07 NTFS)

==================== End Of Log ============================

Liebe Grüße
Küstenkind

Windows 7: Postbank Online-Banking Trojaner

Log-Analyse und Auswertung: Windows 7: Postbank Online-Banking Trojaner

Windows 7: Postbank Online-Banking Trojaner

Ähnliche Themen: Windows 7: Postbank Online-Banking Trojaner