Win32/cycbot.B

Trendy

habe seit gestern dauernt eine fehlermeldung vom Windows Defender bekommen mit Win 32/Cycbot.B.
Hab dann mal im Netz geGOOGELT und bin dann auf eure seite gestoßen hab mir euer Malwarebytes runtergeladen und mal durchlaufen lassen und das kam dabei raus


Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 5828

Windows 6.0.6002 Service Pack 2
Internet Explorer 7.0.6002.18005

21.02.2011 12:58:25
mbam-log-2011-02-21 (12-58-25).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 141686
Laufzeit: 4 Minute(n), 51 Sekunde(n)

Infizierte Speicherprozesse: 4
Infizierte Speichermodule: 1
Infizierte Registrierungsschlüssel: 5
Infizierte Registrierungswerte: 7
Infizierte Dateiobjekte der Registrierung: 1
Infizierte Verzeichnisse: 0
Infizierte Dateien: 13

Infizierte Speicherprozesse:
c:\Users\jimmy\AppData\Roaming\dwm.exe (Trojan.Downloader) -> 1944 -> Unloaded process successfully.
c:\Users\jimmy\AppData\Roaming\microsoft\conhost.exe (Backdoor.Bot) -> 2980 -> Unloaded process successfully.
c:\Users\jimmy\AppData\Local\Temp\csrss.exe (Backdoor.Bot) -> 4128 -> Unloaded process successfully.
c:\Users\jimmy\AppData\Local\Temp\Xqr.exe (Trojan.FakeAlert) -> 4436 -> Unloaded process successfully.

Infizierte Speichermodule:
c:\Windows\System32\sshnas21.dll (Trojan.Agent) -> Delete on reboot.

Infizierte Registrierungsschlüssel:
HKEY_CURRENT_USER\SOFTWARE\JP595IR86O (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\NtWqIVLZEWZU (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Handle (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\ (Hijack.Zones) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Metropolis (Trojan.Agent) -> Value: Metropolis -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost (Backdoor.Bot) -> Value: conhost -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost (Backdoor.Bot) -> Value: conhost -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Load (Trojan.Agent) -> Value: Load -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\JP595IR86O (Trojan.FakeAlert) -> Value: JP595IR86O -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell (Hijack.Shell) -> Value: Shell -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer (PUM.Bad.Proxy) -> Value: ProxyServer -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Load (Backdoor.Bot) -> Bad: (C:\Users\jimmy\AppData\Local\Temp\csrss.exe) Good: () -> Quarantined and deleted successfully.

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\Users\jimmy\AppData\Roaming\dwm.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Windows\System32\sshnas21.dll (Trojan.Agent) -> Delete on reboot.
c:\Users\jimmy\AppData\Roaming\microsoft\conhost.exe (Backdoor.Bot) -> Delete on reboot.
c:\Users\jimmy\AppData\Local\Temp\csrss.exe (Backdoor.Bot) -> Delete on reboot.
c:\Users\jimmy\AppData\Local\Temp\7027.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
c:\Users\jimmy\AppData\Local\Temp\Xqp.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\jimmy\AppData\Local\Temp\EULA.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\jimmy\AppData\Local\Temp\controla.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Users\jimmy\AppData\Local\Temp\D001.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
c:\Windows\Tasks\{22116563-108c-42c0-a7ce-60161b75e508}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Windows\Tasks\{62c40aa6-4406-467a-a5a5-dfdf1b559b7a}.job (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\Windows\Tasks\{bbaeaeaf-1275-40e2-bd6c-bc8f88bd114a}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Users\jimmy\AppData\Local\Temp\Xqr.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.