| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: 20 Tan Trojaner - SparkasseWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
13.10.2010, 12:45
| #1 | |||
 |  20 Tan Trojaner - Sparkasse Liebe Leute, habe seit geraumer Zeit den 20 Tan Trojaner (Sparkasse) am Hals. Neues Online Banking wurde beantragt etc.. der Trojaner ist jedoch immer noch drauf.  Was bisher geschah: Antivir, Spyhunter, Malwarebytes, OTL, CCleaner und Hijackthis. Spyhunter  OTL OTL Logfile: Code:
ATTFilter OTL logfile created on: 13.10.2010 13:52:35 - Run 1 OTL by OldTimer - Version 3.2.15.2 Folder = C:\Downloads Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18904) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 30,00% Memory free 6,00 Gb Paging File | 4,00 Gb Available in Paging File | 64,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 298,09 Gb Total Space | 184,88 Gb Free Space | 62,02% Space Free | Partition Type: NTFS Computer Name: TEST-PC | User Name: Test | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Downloads\OTL.exe (OldTimer Tools) PRC - C:\Programme\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.) PRC - C:\Programme\Enigma Software Group\SpyHunter\SpyHunter4.exe (Enigma Software Group USA, LLC.) PRC - C:\Programme\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) PRC - C:\Programme\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation) PRC - C:\Programme\Trend Micro\HijackThis\HijackThis.exe (Trend Micro Inc.) PRC - C:\Programme\Internet Explorer\iexplore.exe (Microsoft Corporation) PRC - C:\Users\Test\Desktop\Musik\Orbitdownloader\orbitdm.exe (Orbitdownloader.com) PRC - C:\Programme\DAEMON Tools Pro\DTProShellHlp.exe (DT Soft Ltd) PRC - C:\Programme\Common Files\Native Instruments\Hardware\NIHardwareService.exe (Native Instruments GmbH) PRC - C:\Users\Test\Desktop\Musik\Orbitdownloader\orbitnet.exe (Orbitdownloader.com) PRC - C:\Programme\Avira\AntiVir Desktop\avcenter.exe (Avira GmbH) PRC - C:\Windows\System32\Macromed\Flash\FlashUtil10d.exe (Adobe Systems, Inc.) PRC - C:\Programme\Avira\AntiVir Desktop\avscan.exe (Avira GmbH) PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH) PRC - C:\Programme\Microsoft Office\Office14\GROOVEMN.EXE (Microsoft Corporation) PRC - C:\Windows\System32\OSPPSVC.EXE (Microsoft Corporation) PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) PRC - C:\Windows\explorer.exe (Microsoft Corporation) PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation) PRC - C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation) PRC - C:\Programme\Synaptics\SynTP\SynTPStart.exe (Synaptics, Inc.) PRC - C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation) PRC - C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation) ========== Modules (SafeList) ========== MOD - C:\Downloads\OTL.exe (OldTimer Tools) MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation) MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18000_none_5cdbaa5a083979cc\comctl32.dll (Microsoft Corporation) ========== Win32 Services (SafeList) ========== SRV - (SpyHunter 4 Service) -- C:\Programme\Enigma Software Group\SpyHunter\SH4Service.exe (Enigma Software Group USA, LLC.) SRV - (Apple Mobile Device) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) SRV - (FLEXnet Licensing Service) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.) SRV - (NIHardwareService) -- C:\Programme\Common Files\Native Instruments\Hardware\NIHardwareService.exe (Native Instruments GmbH) SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH) SRV - (Microsoft SharePoint Workspace Audit Service) -- C:\Program Files\Microsoft Office\Office14\GROOVE.EXE (Microsoft Corporation) SRV - (osppsvc) -- C:\Windows\System32\OSPPSVC.EXE (Microsoft Corporation) SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SRV - (IAANTMON) Intel(R) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation) ========== Driver Services (SafeList) ========== DRV - (NwlnkFwd) -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys File not found DRV - (NwlnkFlt) -- C:\Windows\System32\DRIVERS\nwlnkflt.sys File not found DRV - (IpInIp) -- C:\Windows\System32\DRIVERS\ipinip.sys File not found DRV - (BCASPROT) -- C:\Program Files\Systweak\Advanced System Protector\sasprot32.sys File not found DRV - (MBAMSwissArmy) -- C:\Windows\System32\drivers\mbamswissarmy.sys (Malwarebytes Corporation) DRV - (sptd) -- C:\Windows\System32\Drivers\sptd.sys () DRV - (esgiguard) -- C:\Programme\Enigma Software Group\SpyHunter\esgiguard.sys () DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH) DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH) DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH) DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH) DRV - (ISODrive) -- C:\Programme\UltraISO\drivers\ISODrive.sys (EZB Systems, Inc.) DRV - (SiFilter) -- C:\Windows\system32\DRIVERS\SiWinAcc.sys (Silicon Image, Inc.) DRV - (SiRemFil) -- C:\Windows\system32\DRIVERS\SiRemFil.sys (Silicon Image, Inc.) DRV - (Si3531) -- C:\Windows\system32\DRIVERS\Si3531.sys (Silicon Image, Inc) DRV - (WsAudioDevice_383) -- C:\Windows\System32\drivers\WsAudioDevice_383.sys (Wondershare) DRV - (igfx) -- C:\Windows\System32\drivers\igdkmd32.sys (Intel Corporation) DRV - (MegaSR) -- C:\Windows\system32\drivers\megasr.sys (LSI Corporation, Inc.) DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.) DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Corporation) DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.) DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems) DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company) DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.) DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic) DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation) DRV - (E1G60) Intel(R) -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation) DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.) DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation) DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd) DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.) DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic) DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic) DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.) DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex) DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.) DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation) DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation) DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.) DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.) DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.) DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.) DRV - (ahcix86s) -- C:\Windows\system32\drivers\ahcix86s.sys (AMD Technologies Inc.) DRV - (HdAudAddService) -- C:\Windows\System32\drivers\CHDART.sys (Conexant Systems Inc.) DRV - (nvrd32) -- C:\Windows\system32\drivers\nvrd32.sys (NVIDIA Corporation) DRV - (nvstor32) -- C:\Windows\system32\drivers\nvstor32.sys (NVIDIA Corporation) DRV - (JRAID) -- C:\Windows\system32\drivers\jraid.sys (JMicron Technology Corp.) DRV - (NETw4v32) Intel(R) -- C:\Windows\System32\drivers\NETw4v32.sys (Intel Corporation) DRV - (RTSTOR) -- C:\Windows\System32\drivers\RTSTOR.sys (Realtek Semiconductor Corp.) DRV - (SynTP) -- C:\Windows\System32\drivers\SynTP.sys (Synaptics, Inc.) DRV - (yukonwlh) -- C:\Windows\System32\drivers\yk60x86.sys (Marvell) DRV - (iaNvStor) Intel(R) -- C:\Windows\system32\DRIVERS\iaNvStor.sys (Intel Corporation) DRV - (iaStor) -- C:\Windows\system32\DRIVERS\iaStor.sys (Intel Corporation) DRV - (IntcHdmiAddService) Intel(R) -- C:\Windows\System32\drivers\IntcHdmi.sys (Intel(R) Corporation) DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation) DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.) DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation) DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH) DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.) DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.) DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.) DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic) DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic) DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation) DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic) DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.) DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.) DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.) DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.) DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.) DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.) DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.startup.homepage: "facebook.com" FF - prefs.js..extensions.enabledItems: {a7c6cf7f-112c-4500-a7ea-39801a327e5f}:1.0.7 FF - prefs.js..extensions.enabledItems: {35379F86-8CCB-4724-AE33-4278DE266C70}:1.0.4 FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.8 FF - HKLM\software\mozilla\Mozilla Firefox 3.6.2pre\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.09.10 23:45:27 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.2pre\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.09.15 16:07:28 | 000,000,000 | ---D | M] [2010.02.01 14:54:49 | 000,000,000 | ---D | M] -- C:\Users\Test\AppData\Roaming\mozilla\Extensions [2010.10.12 19:56:30 | 000,000,000 | ---D | M] -- C:\Users\Test\AppData\Roaming\mozilla\Firefox\Profiles\9t8nou9e.default\extensions [2010.02.05 00:07:06 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Test\AppData\Roaming\mozilla\Firefox\Profiles\9t8nou9e.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010.02.01 14:56:03 | 000,000,000 | ---D | M] (FireFTP) -- C:\Users\Test\AppData\Roaming\mozilla\Firefox\Profiles\9t8nou9e.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f} [2010.10.12 19:56:24 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Test\AppData\Roaming\mozilla\Firefox\Profiles\9t8nou9e.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2010.08.14 14:42:50 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions [2010.01.16 03:15:29 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml [2010.01.16 03:15:29 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml [2010.01.16 03:15:29 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml [2010.01.16 03:15:29 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml [2010.01.16 03:15:29 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2010.10.13 10:40:27 | 000,001,243 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O1 - Hosts: 127.0.0.1 activate.adobe.com O1 - Hosts: 127.0.0.1 practivate.adobe.com O1 - Hosts: 127.0.0.1 ereg.adobe.com O1 - Hosts: 127.0.0.1 activate.wip3.adobe.com O1 - Hosts: 127.0.0.1 wip3.adobe.com O1 - Hosts: 127.0.0.1 3dns-3.adobe.com O1 - Hosts: 127.0.0.1 3dns-2.adobe.com O1 - Hosts: 127.0.0.1 adobe-dns.adobe.com O1 - Hosts: 127.0.0.1 adobe-dns-2.adobe.com O1 - Hosts: 127.0.0.1 adobe-dns-3.adobe.com O1 - Hosts: 127.0.0.1 ereg.wip3.adobe.com O1 - Hosts: 127.0.0.1 activate-sea.adobe.com O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com O1 - Hosts: 127.0.0.1 activate-sjc0.adobe.com O2 - BHO: (Octh Class) - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Users\Test\Desktop\Musik\Orbitdownloader\orbitcth.dll (Orbitdownloader.com) O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [BCSSync] C:\Program Files\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation) O4 - HKLM..\Run: [GrooveMonitor] C:\Programme\Microsoft Office\Office14\GROOVEMN.EXE (Microsoft Corporation) O4 - HKLM..\Run: [IAAnotif] C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation) O4 - HKLM..\Run: [IaNvSrv] C:\Programme\Intel\Intel Matrix Storage Manager\OROM\IaNvSrv\IaNvSrv.exe (Intel Corporation) O4 - HKLM..\Run: [SynTPStart] C:\Programme\Synaptics\SynTP\SynTPStart.exe (Synaptics, Inc.) O4 - HKCU..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation) O8 - Extra context menu item: &Download by Orbit - C:\Users\Test\Desktop\Musik\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com) O8 - Extra context menu item: &Grab video by Orbit - C:\Users\Test\Desktop\Musik\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com) O8 - Extra context menu item: Do&wnload selected by Orbit - C:\Users\Test\Desktop\Musik\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com) O8 - Extra context menu item: Down&load all by Orbit - C:\Users\Test\Desktop\Musik\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com) O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O8 - Extra context menu item: S&end to OneNote - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Linked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : &Linked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18) O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation) O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation) O24 - Desktop WallPaper: C:\Users\Test\Pictures\2010-08-23\067.JPG O24 - Desktop BackupWallPaper: C:\Users\Test\Pictures\2010-08-23\067.JPG O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{e61f3165-1abe-11df-acb5-00140b3fe3d4}\Shell - "" = AutoRun O33 - MountPoints2\{e61f3165-1abe-11df-acb5-00140b3fe3d4}\Shell\AutoRun\command - "" = J:\LaunchU3.exe -- File not found O34 - HKLM BootExecute: (autocheck autochk *) - File not found O34 - HKLM BootExecute: (sasnative32) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKCU\...exe [@ = exefile] -- Reg Error: Key error. File not found ========== Files/Folders - Created Within 30 Days ========== [2010.10.13 10:08:16 | 000,000,000 | ---D | C] -- C:\Users\Test\AppData\Roaming\Malwarebytes [2010.10.13 10:08:04 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2010.10.13 10:08:00 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2010.10.13 10:08:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2010.10.13 10:07:59 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware [2010.10.12 23:55:01 | 000,630,784 | ---- | C] (On2.com) -- C:\Windows\System32\vp7vfw.dll [2010.10.12 23:55:01 | 000,039,936 | ---- | C] (Disappearing Inc.) -- C:\Windows\System32\huffyuv.dll [2010.10.12 23:38:27 | 000,839,680 | ---- | C] (hxxp://www.mp3dev.org/) -- C:\Windows\System32\lameACM.acm [2010.10.12 23:38:27 | 000,217,088 | ---- | C] (www.helixcommunity.org) -- C:\Windows\System32\yv12vfw.dll [2010.10.12 23:38:27 | 000,151,552 | ---- | C] (fccHandler) -- C:\Windows\System32\ac3acm.acm [2010.10.12 23:38:25 | 000,000,000 | ---D | C] -- C:\Programme\K-Lite Codec Pack [2010.10.12 20:11:19 | 000,000,000 | ---D | C] -- C:\Users\Test\Documents\Wondershare Streaming Audio Recorder [2010.10.12 20:09:45 | 000,016,640 | ---- | C] (Wondershare) -- C:\Windows\System32\drivers\WsAudioDevice_383.sys [2010.10.12 19:58:09 | 000,000,000 | ---D | C] -- C:\Users\Test\dwhelper [2010.10.12 17:48:28 | 000,000,000 | ---D | C] -- C:\Users\Test\Documents\Skylook [2010.10.10 20:36:27 | 000,000,000 | ---D | C] -- C:\Programme\Lame for Audacity [2010.10.10 20:21:21 | 000,000,000 | ---D | C] -- C:\Programme\Free M4a to MP3 Converter [2010.10.10 20:15:14 | 000,000,000 | ---D | C] -- C:\Users\Test\AppData\Roaming\Audacity [2010.10.10 20:15:00 | 000,000,000 | ---D | C] -- C:\Programme\Audacity 1.3 Beta (Unicode) [2010.10.04 12:18:38 | 000,000,000 | ---D | C] -- C:\Users\Test\Documents\Theater [2010.09.29 15:15:54 | 000,000,000 | ---D | C] -- C:\Users\Test\AppData\Local\Microsoft Games [2010.09.15 16:08:23 | 000,032,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msonpmon.dll [2010.09.15 16:07:25 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft Works [2010.09.15 16:05:47 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft Visual Studio [2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] [1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ] [1 C:\*.tmp files -> C:\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2010.10.13 13:44:01 | 000,001,114 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2577750887-1694976949-513453921-1000UA.job [2010.10.13 13:24:01 | 000,001,092 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2010.10.13 12:24:54 | 000,003,712 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2010.10.13 12:24:54 | 000,003,712 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2010.10.13 11:59:31 | 000,096,696 | ---- | M] () -- C:\Users\Test\Desktop\prozesse.jpg [2010.10.13 11:55:08 | 000,014,460 | ---- | M] () -- C:\Users\Test\Desktop\spyhunter.jpg [2010.10.13 11:41:04 | 000,020,451 | ---- | M] () -- C:\Users\Test\Desktop\20tantrojaner.jpg [2010.10.13 10:26:24 | 000,001,088 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2010.10.13 10:24:49 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2010.10.13 10:24:46 | 3211,173,888 | -HS- | M] () -- C:\hiberfil.sys [2010.10.13 10:23:03 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat [2010.10.13 10:08:08 | 000,000,818 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2010.10.12 22:44:00 | 000,001,062 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2577750887-1694976949-513453921-1000Core.job [2010.10.12 20:01:25 | 000,000,000 | ---- | M] () -- C:\Users\Test\Desktop\Hungarian Dance No. 1 (Brahms) - Raymond Dessaints, Ensemble Amati - Brahms Hungarian Dances for string orchestra.mp3 [2010.10.10 20:15:09 | 000,000,851 | ---- | M] () -- C:\Users\Test\Desktop\Audacity 1.3 Beta (Unicode).lnk [2010.10.07 00:06:25 | 000,621,346 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2010.10.07 00:06:25 | 000,590,082 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2010.10.07 00:06:25 | 000,123,686 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2010.10.07 00:06:25 | 000,102,094 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2010.09.20 17:54:26 | 001,726,968 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2010.09.20 17:38:17 | 000,041,478 | ---- | M] () -- C:\Users\Test\Desktop\outlookaccounts.reg [2010.09.20 17:36:27 | 001,424,281 | ---- | M] () -- C:\Users\Test\inboxmon.CSV [2010.09.20 17:36:22 | 000,009,309 | ---- | M] () -- C:\Users\Test\AppData\Roaming\Comma Separated Values (Windows).EML [2010.09.20 17:34:51 | 000,512,512 | ---- | M] () -- C:\Users\Test\Documents\skizze so36.msg [2010.09.14 10:00:00 | 000,108,032 | ---- | M] () -- C:\Windows\System32\ff_vfw.dll [2010.09.14 10:00:00 | 000,000,038 | ---- | M] () -- C:\Windows\avisplitter.ini [2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] [1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ] [1 C:\*.tmp files -> C:\*.tmp -> ] ========== Files Created - No Company Name ========== [2010.10.13 11:59:31 | 000,096,696 | ---- | C] () -- C:\Users\Test\Desktop\prozesse.jpg [2010.10.13 11:55:07 | 000,014,460 | ---- | C] () -- C:\Users\Test\Desktop\spyhunter.jpg [2010.10.13 11:41:04 | 000,020,451 | ---- | C] () -- C:\Users\Test\Desktop\20tantrojaner.jpg [2010.10.13 10:08:08 | 000,000,818 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2010.10.12 23:38:28 | 000,165,376 | ---- | C] () -- C:\Windows\System32\unrar.dll [2010.10.12 23:38:28 | 000,000,414 | ---- | C] () -- C:\Windows\System32\lame_acm.xml [2010.10.12 23:38:28 | 000,000,038 | ---- | C] () -- C:\Windows\avisplitter.ini [2010.10.12 23:38:27 | 000,790,528 | ---- | C] () -- C:\Windows\System32\xvidcore.dll [2010.10.12 23:38:27 | 000,134,144 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll [2010.10.12 23:38:27 | 000,108,032 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll [2010.10.12 20:01:25 | 000,000,000 | ---- | C] () -- C:\Users\Test\Desktop\Hungarian Dance No. 1 (Brahms) - Raymond Dessaints, Ensemble Amati - Brahms Hungarian Dances for string orchestra.mp3 [2010.10.10 20:15:09 | 000,000,851 | ---- | C] () -- C:\Users\Test\Desktop\Audacity 1.3 Beta (Unicode).lnk [2010.09.20 17:38:17 | 000,041,478 | ---- | C] () -- C:\Users\Test\Desktop\outlookaccounts.reg [2010.09.20 17:36:22 | 000,009,309 | ---- | C] () -- C:\Users\Test\AppData\Roaming\Comma Separated Values (Windows).EML [2010.09.20 17:36:10 | 001,424,281 | ---- | C] () -- C:\Users\Test\inboxmon.CSV [2010.09.20 17:34:50 | 000,512,512 | ---- | C] () -- C:\Users\Test\Documents\skizze so36.msg [2010.03.10 18:11:24 | 000,011,776 | ---- | C] () -- C:\Users\Test\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010.02.02 17:36:29 | 000,001,183 | ---- | C] () -- C:\ProgramData\hpzinstall.log [2010.01.28 14:16:16 | 000,691,696 | ---- | C] () -- C:\Windows\System32\drivers\sptd.sys [2010.01.28 12:50:28 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat [2010.01.18 11:34:57 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll [2010.01.18 11:34:55 | 000,004,608 | ---- | C] () -- C:\Windows\System32\HdmiCoin.dll [2010.01.18 11:34:54 | 000,910,464 | ---- | C] () -- C:\Windows\System32\igmedkrn.dll [2010.01.18 11:34:54 | 000,204,800 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1283.dll [2010.01.18 11:34:51 | 000,167,936 | ---- | C] () -- C:\Windows\System32\nvccoin.dll [2010.01.18 11:28:34 | 000,006,648 | ---- | C] () -- C:\Users\Test\AppData\Local\d3d9caps.dat [2008.02.11 20:55:18 | 000,147,456 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1437.dll [2007.05.10 01:39:28 | 000,003,584 | ---- | C] () -- C:\Windows\System32\CNCFLdNL.DLL [2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll [2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini ========== LOP Check ========== [2010.10.12 23:58:42 | 000,000,000 | ---D | M] -- C:\Users\Test\AppData\Roaming\Audacity [2010.09.04 11:11:49 | 000,000,000 | ---D | M] -- C:\Users\Test\AppData\Roaming\BE931B4CFB1CEE9643432EEA35D0ED34 [2010.01.28 14:54:40 | 000,000,000 | ---D | M] -- C:\Users\Test\AppData\Roaming\DAEMON Tools Pro [2010.08.02 21:43:10 | 000,000,000 | ---D | M] -- C:\Users\Test\AppData\Roaming\Evyt [2010.06.27 12:18:38 | 000,000,000 | ---D | M] -- C:\Users\Test\AppData\Roaming\Facebook [2010.02.01 22:01:08 | 000,000,000 | ---D | M] -- C:\Users\Test\AppData\Roaming\GrabPro [2010.10.04 02:39:15 | 000,000,000 | ---D | M] -- C:\Users\Test\AppData\Roaming\Iphi [2010.08.05 12:23:35 | 000,000,000 | ---D | M] -- C:\Users\Test\AppData\Roaming\Miugix [2010.10.13 13:51:34 | 000,000,000 | ---D | M] -- C:\Users\Test\AppData\Roaming\Orbit [2010.10.05 12:26:18 | 000,000,000 | ---D | M] -- C:\Users\Test\AppData\Roaming\Poim [2010.08.15 11:15:21 | 000,000,000 | ---D | M] -- C:\Users\Test\AppData\Roaming\Systweak [2010.01.18 11:43:00 | 000,000,000 | ---D | M] -- C:\Users\Test\AppData\Roaming\TMP [2010.10.07 18:22:17 | 000,000,000 | ---D | M] -- C:\Users\Test\AppData\Roaming\uTorrent [2010.10.13 10:23:06 | 000,031,798 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== < End of report > Hijackthis Zitat:
Zitat:
Zitat:
Geändert von hamfok (13.10.2010 um 13:02 Uhr) |
| Themen zu 20 Tan Trojaner - Sparkasse |
| 20 tan, 20 tan trojaner, adobe, advanced system protector, antivir, antivir guard, avg, avgntflt.sys, avira, bho, bonjour, browser, components, corp./icp, desktop, document, downloader, enigma, excel, excel.exe, explorer, google, hijack, home premium, iastor.sys, internet, internet explorer, location, musik, nvstor.sys, object, oldtimer, otl.exe, plug-in, programdata, rogue.securitysuite, rundll, searchplugins, service pack 1, software, sptd.sys, spyhunter 4, system, systweak, tan, tan trojaner, trojaner, vista, windows |
Baum-Darstellung