Trojaner-Board - Trojan.Banker

Anbei!

Malwarebytes:

Code:

Malwarebytes Anti-Malware (Test) 1.61.0.1400

www.malwarebytes.org
 

Datenbank Version: v2012.06.13.05
 

Windows Vista Service Pack 2 x86 NTFS

Internet Explorer 9.0.8112.16421

Boludo :: BOLUDO-PC [Administrator]
 

Schutz: Deaktiviert
 

13.06.2012 17:05:46

mbam-log-2012-06-13 (17-05-46).txt
 

Art des Suchlaufs: Vollständiger Suchlauf

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 365435

Laufzeit: 1 Stunde(n), 27 Minute(n), 19 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

SuperAntiSpyware:

Code:

SUPERAntiSpyware Scan Log

hxxp://www.superantispyware.com
 

Generated 06/13/2012 at 09:06 PM
 

Application Version : 5.0.1150
 

Core Rules Database Version : 8726

Trace Rules Database Version: 6538
 

Scan type       : Complete Scan

Total Scan Time : 02:11:08
 

Operating System Information

Windows Vista Home Premium 32-bit, Service Pack 2 (Build 6.00.6002)

UAC On - Administrator
 

Memory items scanned      : 694

Memory threats detected   : 0

Registry items scanned    : 34906

Registry threats detected : 0

File items scanned        : 194574

File threats detected     : 97
 

Adware.Tracking Cookie

        C:\Users\Boludo\AppData\Roaming\Microsoft\Windows\Cookies\boludo@adx.chip[2].txt [ /adx.chip ]

        C:\Users\Boludo\AppData\Roaming\Microsoft\Windows\Cookies\boludo@atdmt[1].txt [ /atdmt ]

        C:\Users\Boludo\AppData\Roaming\Microsoft\Windows\Cookies\boludo@content.yieldmanager[1].txt [ /content.yieldmanager ]

        C:\Users\Boludo\AppData\Roaming\Microsoft\Windows\Cookies\boludo@doubleclick[1].txt [ /doubleclick ]

        C:\Users\Boludo\AppData\Roaming\Microsoft\Windows\Cookies\2F8LM31K.txt [ /ad.zanox.com ]

        C:\Users\Boludo\AppData\Roaming\Microsoft\Windows\Cookies\MCFZUBXW.txt [ /tracking.quisma.com ]

        C:\Users\Boludo\AppData\Roaming\Microsoft\Windows\Cookies\IM5GU3TZ.txt [ /mediaplex.com ]

        C:\Users\Boludo\AppData\Roaming\Microsoft\Windows\Cookies\VEOW4HSZ.txt [ /zanox.com ]

        C:\Users\Boludo\AppData\Roaming\Microsoft\Windows\Cookies\HUJ5PGUZ.txt [ /doubleclick.net ]

        C:\Users\Boludo\AppData\Roaming\Microsoft\Windows\Cookies\HZPK2MB6.txt [ /adfarm1.adition.com ]

        C:\Users\Boludo\AppData\Roaming\Microsoft\Windows\Cookies\ZMBQEGRU.txt [ /zanox-affiliate.de ]

        C:\Users\Boludo\AppData\Roaming\Microsoft\Windows\Cookies\KORDP33S.txt [ /www.zanox-affiliate.de ]

        C:\Users\Boludo\AppData\Roaming\Microsoft\Windows\Cookies\AGYHUSPM.txt [ /fastclick.net ]

        C:\Users\Boludo\AppData\Roaming\Microsoft\Windows\Cookies\UB7FWP4M.txt [ /apmebf.com ]

        C:\USERS\BOLUDO\AppData\Roaming\Microsoft\Windows\Cookies\Low\0A1Y2RHW.txt [ Cookie:boludo@ad.zanox.com/ ]

        C:\USERS\BOLUDO\AppData\Roaming\Microsoft\Windows\Cookies\Low\T05A52UX.txt [ Cookie:boludo@olympiaverlag.122.2o7.net/ ]

        C:\USERS\BOLUDO\AppData\Roaming\Microsoft\Windows\Cookies\Low\ZZZK21CI.txt [ Cookie:boludo@adviva.net/ ]

        C:\USERS\BOLUDO\AppData\Roaming\Microsoft\Windows\Cookies\Low\G5CMUPQJ.txt [ Cookie:boludo@yadro.ru/ ]

        C:\USERS\BOLUDO\AppData\Roaming\Microsoft\Windows\Cookies\Low\E5CUS7KE.txt [ Cookie:boludo@ad3.adfarm1.adition.com/ ]

        C:\USERS\BOLUDO\AppData\Roaming\Microsoft\Windows\Cookies\Low\8LMEP46Z.txt [ Cookie:boludo@advertstream.com/a ]

        C:\USERS\BOLUDO\AppData\Roaming\Microsoft\Windows\Cookies\Low\FTOMPZBS.txt [ Cookie:boludo@histats.com/ ]

        C:\USERS\BOLUDO\AppData\Roaming\Microsoft\Windows\Cookies\Low\1EOJKFTN.txt [ Cookie:boludo@clicksor.com/ ]

        C:\USERS\BOLUDO\AppData\Roaming\Microsoft\Windows\Cookies\Low\U0INPXQG.txt [ Cookie:boludo@www.pixeltrack66.com/ ]

        C:\USERS\BOLUDO\AppData\Roaming\Microsoft\Windows\Cookies\Low\OZA186WP.txt [ Cookie:boludo@publishers.domainadvertising.com/ ]

        C:\USERS\BOLUDO\AppData\Roaming\Microsoft\Windows\Cookies\Low\boludo@track.effiliation[2].txt [ Cookie:boludo@track.effiliation.com/servlet/ ]

        C:\USERS\BOLUDO\AppData\Roaming\Microsoft\Windows\Cookies\Low\P8QF0548.txt [ Cookie:boludo@myroitracking.com/ ]

        C:\USERS\BOLUDO\AppData\Roaming\Microsoft\Windows\Cookies\Low\KNUSKWSV.txt [ Cookie:boludo@ad4.adfarm1.adition.com/ ]

        C:\USERS\BOLUDO\AppData\Roaming\Microsoft\Windows\Cookies\Low\boludo@pro-market[1].txt [ Cookie:boludo@pro-market.net/ ]

        C:\USERS\BOLUDO\AppData\Roaming\Microsoft\Windows\Cookies\Low\boludo@advertising[2].txt [ Cookie:boludo@advertising.com/ ]

        C:\USERS\BOLUDO\AppData\Roaming\Microsoft\Windows\Cookies\Low\6NJLAIJM.txt [ Cookie:boludo@adx.chip.de/ ]

        C:\USERS\BOLUDO\AppData\Roaming\Microsoft\Windows\Cookies\Low\ARTAZDP7.txt [ Cookie:boludo@content.yieldmanager.com/ ]

        C:\USERS\BOLUDO\AppData\Roaming\Microsoft\Windows\Cookies\Low\boludo@www9.addfreestats[1].txt [ Cookie:boludo@www9.addfreestats.com/cgi-bin ]

        C:\USERS\BOLUDO\AppData\Roaming\Microsoft\Windows\Cookies\Low\boludo@zedo[2].txt [ Cookie:boludo@zedo.com/ ]

        C:\USERS\BOLUDO\AppData\Roaming\Microsoft\Windows\Cookies\Low\boludo@server.cpmstar[1].txt [ Cookie:boludo@server.cpmstar.com/ ]

        C:\USERS\BOLUDO\AppData\Roaming\Microsoft\Windows\Cookies\Low\DQN6PL7M.txt [ Cookie:boludo@liveperson.net/hc/86867628 ]

        C:\USERS\BOLUDO\AppData\Roaming\Microsoft\Windows\Cookies\Low\boludo@yieldmanager[1].txt [ Cookie:boludo@yieldmanager.net/ ]

        C:\USERS\BOLUDO\AppData\Roaming\Microsoft\Windows\Cookies\Low\6UYAMBL1.txt [ Cookie:boludo@mediaplex.com/ ]

        C:\USERS\BOLUDO\AppData\Roaming\Microsoft\Windows\Cookies\Low\AJKIQX6D.txt [ Cookie:boludo@c.gigcount.com/ ]

        C:\USERS\BOLUDO\AppData\Roaming\Microsoft\Windows\Cookies\Low\boludo@adtech[1].txt [ Cookie:boludo@adtech.de/ ]

        C:\USERS\BOLUDO\AppData\Roaming\Microsoft\Windows\Cookies\Low\ONOKWST2.txt [ Cookie:boludo@cofidis2.solution.weborama.fr/ ]

        C:\USERS\BOLUDO\AppData\Roaming\Microsoft\Windows\Cookies\Low\boludo@weborama[1].txt [ Cookie:boludo@weborama.fr/ ]

        C:\USERS\BOLUDO\AppData\Roaming\Microsoft\Windows\Cookies\Low\boludo@adbrite[1].txt [ Cookie:boludo@adbrite.com/ ]

        C:\USERS\BOLUDO\AppData\Roaming\Microsoft\Windows\Cookies\Low\boludo@tradedoubler[2].txt [ Cookie:boludo@tradedoubler.com/ ]

        C:\USERS\BOLUDO\AppData\Roaming\Microsoft\Windows\Cookies\Low\I00FYFX5.txt [ Cookie:boludo@zanox.com/ ]

        C:\USERS\BOLUDO\AppData\Roaming\Microsoft\Windows\Cookies\Low\YFURHJXD.txt [ Cookie:boludo@serving-sys.com/ ]

        C:\USERS\BOLUDO\AppData\Roaming\Microsoft\Windows\Cookies\Low\2ZJHRSKM.txt [ Cookie:boludo@server.lon.liveperson.net/ ]

        C:\USERS\BOLUDO\AppData\Roaming\Microsoft\Windows\Cookies\Low\Z8I0ZAWE.txt [ Cookie:boludo@www.findpalace.com/ ]

        C:\USERS\BOLUDO\AppData\Roaming\Microsoft\Windows\Cookies\Low\9PT31EFL.txt [ Cookie:boludo@revsci.net/ ]

        C:\USERS\BOLUDO\AppData\Roaming\Microsoft\Windows\Cookies\Low\YCF42CNH.txt [ Cookie:boludo@adfarm1.adition.com/ ]

        C:\USERS\BOLUDO\AppData\Roaming\Microsoft\Windows\Cookies\Low\boludo@media6degrees[1].txt [ Cookie:boludo@media6degrees.com/ ]

        C:\USERS\BOLUDO\AppData\Roaming\Microsoft\Windows\Cookies\Low\4WNHD6KG.txt [ Cookie:boludo@ad1.adfarm1.adition.com/ ]

        C:\USERS\BOLUDO\AppData\Roaming\Microsoft\Windows\Cookies\Low\boludo@r1-ads.ace.advertising[2].txt [ Cookie:boludo@r1-ads.ace.advertising.com/ ]

        C:\USERS\BOLUDO\AppData\Roaming\Microsoft\Windows\Cookies\Low\RVOMUCV5.txt [ Cookie:boludo@statse.webtrendslive.com/ ]

        C:\USERS\BOLUDO\AppData\Roaming\Microsoft\Windows\Cookies\Low\SHSG6JII.txt [ Cookie:boludo@specificclick.net/ ]

        C:\USERS\BOLUDO\AppData\Roaming\Microsoft\Windows\Cookies\Low\XDO7P8HT.txt [ Cookie:boludo@zanox-affiliate.de/ ]

        C:\USERS\BOLUDO\AppData\Roaming\Microsoft\Windows\Cookies\Low\S9U1BCVZ.txt [ Cookie:boludo@server.adform.net/ ]

        C:\USERS\BOLUDO\AppData\Roaming\Microsoft\Windows\Cookies\Low\WJYZQZ5T.txt [ Cookie:boludo@click.icetraffic.com/ ]

        C:\USERS\BOLUDO\AppData\Roaming\Microsoft\Windows\Cookies\Low\4OFMML3G.txt [ Cookie:boludo@atdmt.com/ ]

        C:\USERS\BOLUDO\AppData\Roaming\Microsoft\Windows\Cookies\Low\BZ85YNED.txt [ Cookie:boludo@xm.xtendmedia.com/ ]

        C:\USERS\BOLUDO\AppData\Roaming\Microsoft\Windows\Cookies\Low\Z660AAG1.txt [ Cookie:boludo@sonyeurope.112.2o7.net/ ]

        C:\USERS\BOLUDO\Cookies\2F8LM31K.txt [ Cookie:boludo@ad.zanox.com/ ]

        C:\USERS\BOLUDO\Cookies\IM5GU3TZ.txt [ Cookie:boludo@mediaplex.com/ ]

        C:\USERS\BOLUDO\Cookies\VEOW4HSZ.txt [ Cookie:boludo@zanox.com/ ]

        C:\USERS\BOLUDO\Cookies\HZPK2MB6.txt [ Cookie:boludo@adfarm1.adition.com/ ]

        C:\USERS\BOLUDO\Cookies\ZMBQEGRU.txt [ Cookie:boludo@zanox-affiliate.de/ ]

        C:\USERS\BOLUDO\Cookies\KORDP33S.txt [ Cookie:boludo@www.zanox-affiliate.de/ ]

        C:\USERS\CATJA MOBIL\AppData\Roaming\Microsoft\Windows\Cookies\RE58F2HI.txt [ Cookie:catja mobil@ad.zanox.com/ ]

        C:\USERS\CATJA MOBIL\AppData\Roaming\Microsoft\Windows\Cookies\NDBOU92Y.txt [ Cookie:catja mobil@mediaplex.com/ ]

        C:\USERS\CATJA MOBIL\AppData\Roaming\Microsoft\Windows\Cookies\4O4FA1MC.txt [ Cookie:catja mobil@smartadserver.com/ ]

        C:\USERS\CATJA MOBIL\AppData\Roaming\Microsoft\Windows\Cookies\3KK14D28.txt [ Cookie:catja mobil@zanox.com/ ]

        C:\USERS\CATJA MOBIL\AppData\Roaming\Microsoft\Windows\Cookies\Low\EP6F5E8Y.txt [ Cookie:catja mobil@2o7.net/ ]

        C:\USERS\CATJA MOBIL\AppData\Roaming\Microsoft\Windows\Cookies\Low\75I3QF2F.txt [ Cookie:catja mobil@fl01.ct2.comclick.com/ ]

        C:\USERS\CATJA MOBIL\AppData\Roaming\Microsoft\Windows\Cookies\Low\H9KN78AF.txt [ Cookie:catja mobil@mediaplex.com/ ]

        C:\USERS\CATJA MOBIL\AppData\Roaming\Microsoft\Windows\Cookies\Low\79WF2EC9.txt [ Cookie:catja mobil@adfarm1.adition.com/ ]

        C:\USERS\CATJA MOBIL\AppData\Roaming\Microsoft\Windows\Cookies\Low\Q0N6EXWE.txt [ Cookie:catja mobil@smartadserver.com/ ]

        C:\USERS\CATJA MOBIL\AppData\Roaming\Microsoft\Windows\Cookies\Low\S3WI3HE3.txt [ Cookie:catja mobil@zanox.com/ ]

        C:\USERS\CATJA MOBIL\AppData\Roaming\Microsoft\Windows\Cookies\Low\6UFSBZF1.txt [ Cookie:catja mobil@adtech.de/ ]

        C:\USERS\CATJA MOBIL\AppData\Roaming\Microsoft\Windows\Cookies\Low\424P7PRX.txt [ Cookie:catja mobil@zanox-affiliate.de/ ]

        C:\USERS\CATJA MOBIL\AppData\Roaming\Microsoft\Windows\Cookies\Low\TULYSVG8.txt [ Cookie:catja mobil@tracking.quisma.com/ ]

        C:\USERS\CATJA MOBIL\AppData\Roaming\Microsoft\Windows\Cookies\Low\GJN4FSEW.txt [ Cookie:catja mobil@ad.yieldmanager.com/ ]

        C:\USERS\CATJA MOBIL\AppData\Roaming\Microsoft\Windows\Cookies\Low\6H74E278.txt [ Cookie:catja mobil@track.webtrekk.net/523478367474333/ ]

        C:\USERS\CATJA MOBIL\AppData\Roaming\Microsoft\Windows\Cookies\Low\61TONLM6.txt [ Cookie:catja mobil@imrworldwide.com/cgi-bin ]

        C:\USERS\CATJA MOBIL\AppData\Roaming\Microsoft\Windows\Cookies\Low\AE9E6GLN.txt [ Cookie:catja mobil@ad2.adfarm1.adition.com/ ]

        C:\USERS\CATJA MOBIL\AppData\Roaming\Microsoft\Windows\Cookies\Low\E8SB6FN7.txt [ Cookie:catja mobil@c.atdmt.com/ ]

        C:\USERS\CATJA MOBIL\AppData\Roaming\Microsoft\Windows\Cookies\Low\IUQFXADB.txt [ Cookie:catja mobil@bs.serving-sys.com/ ]

        C:\USERS\CATJA MOBIL\Cookies\RE58F2HI.txt [ Cookie:catja mobil@ad.zanox.com/ ]

        C:\USERS\CATJA MOBIL\Cookies\NDBOU92Y.txt [ Cookie:catja mobil@mediaplex.com/ ]

        C:\USERS\CATJA MOBIL\Cookies\4O4FA1MC.txt [ Cookie:catja mobil@smartadserver.com/ ]

        C:\USERS\CATJA MOBIL\Cookies\3KK14D28.txt [ Cookie:catja mobil@zanox.com/ ]

        C:\USERS\BOLUDO\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\BOLUDO@TRACK.EFFILIATION[1].TXT [ /TRACK.EFFILIATION ]

        C:\USERS\BOLUDO\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\BOLUDO@PAYPAL.112.2O7[1].TXT [ /PAYPAL.112.2O7 ]

        C:\USERS\BOLUDO\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\BOLUDO@ADS.CREATIVE-SERVING[2].TXT [ /ADS.CREATIVE-SERVING ]

        C:\USERS\BOLUDO\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\BOLUDO@CASALEMEDIA[2].TXT [ /CASALEMEDIA ]

        C:\USERS\BOLUDO\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\BOLUDO@XITI[2].TXT [ /XITI ]

        C:\USERS\BOLUDO\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\BOLUDO@IMRWORLDWIDE[2].TXT [ /IMRWORLDWIDE ]

        C:\USERS\BOLUDO\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\BOLUDO@DOUBLECLICK[1].TXT [ /DOUBLECLICK ]
 

Trojan.Agent/Gen-Yoddos

        C:\PROGRAM FILES\DIRSYNC\DIRSYNC.SFX.EXE

Gruß
Boludo