Trojaner-Board
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Neuer Trend: der 50€ Virus / Trojaner - Jetzt leider auch bei mir... (https://www.trojaner-board.de/112797-neuer-trend-50-virus-trojaner-leider-mir.html)

zoolander 31.03.2012 19:19
Neuer Trend: der 50€ Virus / Trojaner - Jetzt leider auch bei mir...
 
Hallo liebes Trojaner Board...leider bin auch ich eher aus traurigen Umständen hier.
Hab mich in den anderen Threads eingelesen und mich an der Anleitung des Hilfethreads orientiert - hoffe, die Vorarbeit hilft weiter...

Eckdaten: Win7 64 Bit, Dell Notebook, avast free antivirus
Windows startet ohne Probleme abgesichert mit Netzwerk, normaler Zugang nicht möglich, nach wenigen Sekunden poppt die bekannte Aufforderung auf.
Scans wurden im abgesicherten Modus ausgeführt.
DDS:
Code:
.
DDS (Ver_2011-08-26.01) - NTFSAMD64 NETWORK
Internet Explorer: 9.0.8112.16421
Run by dosenbier at 14:41:59 on 2012-03-31
Microsoft Windows 7 Ultimate  6.1.7601.1.1252.49.1031.18.2046.1148 [GMT 2:00]
.
AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\Explorer.EXE
C:\Windows\system32\ctfmon.exe
C:\Windows\helppane.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\conhost.exe
C:\Windows\SysWOW64\cscript.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://startpage.com/babylon/deu/
uInternet Settings,ProxyOverride = local
mWinlogon: Userinit=userinit.exe,
BHO: CescrtHlpr Object: {64182481-4f71-486b-a045-b233bd0da8fc} - C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\bh\facemoods.dll
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
TB: facemoods Toolbar: {db4e9724-f518-4dfd-9c7c-78b52103cab9} - C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodsTlbr.dll
uRun: [AVMUSBFernanschluss] "C:\Users\dosenbier\AppData\Local\Apps\2.0\C9B1NDR9.N0J\2C79C08D.QX7\frit..tion_8488884cfbcefd60_0002.0002_8541bf1f4a1c673d\AVMAutoStart.exe"
uRun: [SkypePM] C:\Users\dosenbier\AppData\Local\Skype\SkypePM.exe
mRun: [OEM02Mon.exe] C:\Windows\OEM02Mon.exe
mRun: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
mRun: [facemoods] "C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodssrv.exe" /md I
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
StartupFolder: C:\Users\DOSENB~1\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\OPENOF~1.LNK - C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Add to Google Photos Screensa&ver - C:\Windows\system32\GPhotos.scr/200
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
TCP: Interfaces\{4BCBD830-6CB1-417F-AF20-8897E68BE9FB} : NameServer = 192.168.2.1
{64182481-4F71-486b-A045-B233BD0DA8FC}
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}
{DBC80044-A445-435b-BC74-9C25C1C588A9}
{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}
{DB4E9724-F518-4dfd-9C7C-78B52103CAB9}
mRun-x64: [OEM02Mon.exe] C:\Windows\OEM02Mon.exe
mRun-x64: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
mRun-x64: [facemoods] "C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodssrv.exe" /md I
mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun-x64: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
.
============= SERVICES / DRIVERS ===============
.
R0 oem-drv64;OEM-SLP2.1 Driver (HPD64);C:\Windows\system32\DRIVERS\oem-drv64.sys --> C:\Windows\system32\DRIVERS\oem-drv64.sys [?]
R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]
R3 bcm44amd64;Broadcom 440x 10/100-integrierter Controller-XP-Treiber;C:\Windows\system32\DRIVERS\b44amd64.sys --> C:\Windows\system32\DRIVERS\b44amd64.sys [?]
R3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series - Adaptertreiber für Windows Vista 64 Bit;C:\Windows\system32\DRIVERS\netw5v64.sys --> C:\Windows\system32\DRIVERS\netw5v64.sys [?]
S1 aswSnx;aswSnx;C:\Windows\system32\drivers\aswSnx.sys --> C:\Windows\system32\drivers\aswSnx.sys [?]
S1 aswSP;aswSP;C:\Windows\system32\drivers\aswSP.sys --> C:\Windows\system32\drivers\aswSP.sys [?]
S2 aswFsBlk;aswFsBlk;C:\Windows\system32\drivers\aswFsBlk.sys --> C:\Windows\system32\drivers\aswFsBlk.sys [?]
S2 aswMonFlt;aswMonFlt;\??\C:\Windows\system32\drivers\aswMonFlt.sys --> C:\Windows\system32\drivers\aswMonFlt.sys [?]
S2 avast! Antivirus;avast! Antivirus;C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2012-3-22 44768]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 gupdate;Google Update-Dienst (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-3-23 136176]
S2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-3-30 652360]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-8-3 379496]
S3 avmaudio;AVM Audio;C:\Windows\system32\DRIVERS\avmaudio.sys --> C:\Windows\system32\DRIVERS\avmaudio.sys [?]
S3 dmvsc;dmvsc;C:\Windows\system32\drivers\dmvsc.sys --> C:\Windows\system32\drivers\dmvsc.sys [?]
S3 EverestDriver;Lavalys EVEREST Kernel Driver;C:\Users\DOSENB~1\AppData\Local\Temp\EverestDriver.sys [2011-10-13 9728]
S3 gupdatem;Google Update-Dienst (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-3-23 136176]
S3 MBAMProtector;MBAMProtector;\??\C:\Windows\system32\drivers\mbam.sys --> C:\Windows\system32\drivers\mbam.sys [?]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\system32\drivers\rdpvideominiport.sys --> C:\Windows\system32\drivers\rdpvideominiport.sys [?]
S3 SrvHsfHDA;SrvHsfHDA;C:\Windows\system32\DRIVERS\VSTAZL6.SYS --> C:\Windows\system32\DRIVERS\VSTAZL6.SYS [?]
S3 SrvHsfV92;SrvHsfV92;C:\Windows\system32\DRIVERS\VSTDPV6.SYS --> C:\Windows\system32\DRIVERS\VSTDPV6.SYS [?]
S3 SrvHsfWinac;SrvHsfWinac;C:\Windows\system32\DRIVERS\VSTCNXT6.SYS --> C:\Windows\system32\DRIVERS\VSTCNXT6.SYS [?]
S3 Synth3dVsc;Microsoft Virtual 3D Video Transport Driver;C:\Windows\system32\drivers\Synth3dVsc.sys --> C:\Windows\system32\drivers\Synth3dVsc.sys [?]
S3 terminpt;Microsoft Remote Desktop Input Driver;C:\Windows\system32\drivers\terminpt.sys --> C:\Windows\system32\drivers\terminpt.sys [?]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]
S3 TsUsbGD;%TsUsbGD.DeviceDesc.Generic%;C:\Windows\system32\drivers\TsUsbGD.sys --> C:\Windows\system32\drivers\TsUsbGD.sys [?]
S3 tsusbhub;Remote Deskotop USB Hub;C:\Windows\system32\drivers\tsusbhub.sys --> C:\Windows\system32\drivers\tsusbhub.sys [?]
.
=============== Created Last 30 ================
.
2012-03-30 20:35:53        --------        d-----w-        C:\Program Files (x86)\ESET
2012-03-30 19:12:49        --------        d-----w-        C:\Users\dosenbier\AppData\Roaming\Malwarebytes
2012-03-30 19:12:44        23152        ----a-w-        C:\Windows\System32\drivers\mbam.sys
2012-03-30 19:12:44        --------        d-----w-        C:\ProgramData\Malwarebytes
2012-03-30 19:12:44        --------        d-----w-        C:\Program Files (x86)\Malwarebytes' Anti-Malware
2012-03-30 08:58:37        8669240        ----a-w-        C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{9556C1BC-94EC-4069-B0A0-8E5B20086865}\mpengine.dll
2012-03-22 17:38:39        53080        ----a-w-        C:\Windows\System32\drivers\aswRdr2.sys
2012-03-14 12:03:31        3145728        ----a-w-        C:\Windows\System32\win32k.sys
2012-03-14 12:03:29        1544192        ----a-w-        C:\Windows\System32\DWrite.dll
2012-03-14 12:03:28        1077248        ----a-w-        C:\Windows\SysWow64\DWrite.dll
2012-03-14 12:02:13        9216        ----a-w-        C:\Windows\System32\rdrmemptylst.exe
2012-03-14 12:02:13        77312        ----a-w-        C:\Windows\System32\rdpwsx.dll
2012-03-14 12:02:13        149504        ----a-w-        C:\Windows\System32\rdpcorekmts.dll
2012-03-14 12:02:12        1112064        ----a-w-        C:\Windows\System32\rdpcorets.dll
2012-03-14 12:02:11        826880        ----a-w-        C:\Windows\SysWow64\rdpcore.dll
2012-03-14 12:02:11        23552        ----a-w-        C:\Windows\System32\drivers\tdtcp.sys
2012-03-14 12:02:11        210944        ----a-w-        C:\Windows\System32\drivers\rdpwd.sys
2012-03-14 12:02:11        1031680        ----a-w-        C:\Windows\System32\rdpcore.dll
.
==================== Find3M  ====================
.
2012-03-31 09:41:02        42496        ----a-w-        C:\Windows\System32\drivers\oem-drv64.sys
2012-03-25 11:16:46        414368        ----a-w-        C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2012-03-23 22:29:13        472808        ----a-w-        C:\Windows\SysWow64\deployJava1.dll
2012-03-07 00:15:19        41184        ----a-w-        C:\Windows\avastSS.scr
2012-03-07 00:04:06        819032        ----a-w-        C:\Windows\System32\drivers\aswSnx.sys
2012-03-07 00:01:52        69976        ----a-w-        C:\Windows\System32\drivers\aswMonFlt.sys
2012-02-23 08:18:36        279656        ------w-        C:\Windows\System32\MpSigStub.exe
2012-01-20 01:13:07        4022504        ----a-w-        C:\Windows\SysWow64\SpoonUninstall.exe
2011-04-23 20:10:03        22333089        ----a-w-        C:\Program Files\Nero.Burning.ROM.v.10.6.3.100.exe
2010-07-29 10:57:00        2983429        ----a-w-        C:\Program Files\Winamp_2.95_mini_portable.exe
2010-07-29 10:57:00        2983429        ----a-w-        C:\Program Files (x86)\Winamp_2.95_mini_portable.exe
.
============= FINISH: 14:42:28,51 ===============

Code:
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows 7 Ultimate
Boot Device: \Device\HarddiskVolume3
Install Date: 13.10.2011 19:55:40
System Uptime: 31.03.2012 11:40:58 (3 hours ago)
.
Motherboard: Dell Inc. |  | 0FP441
Processor: Intel(R) Core(TM)2 Duo CPU    T7300  @ 2.00GHz | Microprocessor | 1994/200mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 99 GiB total, 5,327 GiB free.
D: is FIXED (NTFS) - 112 GiB total, 5,036 GiB free.
E: is FIXED (NTFS) - 10 GiB total, 6,233 GiB free.
F: is CDROM ()
.
==== Disabled Device Manager Items =============
.
Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Description: Security Processor Loader Driver
Device ID: ROOT\LEGACY_SPLDR\0000
Manufacturer:
Name: Security Processor Loader Driver
PNP Device ID: ROOT\LEGACY_SPLDR\0000
Service: spldr
.
Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Description: avast! Network Shield Support
Device ID: ROOT\LEGACY_ASWTDI\0000
Manufacturer:
Name: avast! Network Shield Support
PNP Device ID: ROOT\LEGACY_ASWTDI\0000
Service: aswTdi
.
==== System Restore Points ===================
.
No restore point in system.
.
==== Installed Programs ======================
.
7-Zip 9.20
Audacity 1.3.14 (Unicode)
avast! Free Antivirus
AVM FRITZ!Box USB-Fernanschluss
Biet-O-Matic v2.14.8
CDBurnerXP
dBpoweramp DSP Effects
dBpoweramp Music Converter
DVD-lab PRO 2.51
DVD Flick 1.3.0.7
DVDStyler v2.1
ESET Online Scanner v3
EVEREST Home Edition v2.20
Facemoods Toolbar
FileZilla Client 3.5.1
Foxit Reader 5.0
Google Chrome
Google Update Helper
ID3-TagIT 3
Image Resizer for Windows
ImageShack Uploader 2.2.0
IrfanView (remove only)
Java Auto Updater
Java(TM) 6 Update 31
JDownloader 0.9
Light Image Resizer 4.0.9.8
Malwarebytes Anti-Malware Version 1.60.1.1000
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319
NVIDIA 3D Vision Controller Driver
NVIDIA PhysX
NVIDIA Stereoscopic 3D Driver
Nvu 0.8.1
OpenOffice.org 3.3
Picasa 3
RICOH R5C83x/84x Flash Media Controller Driver Ver.3.57.01
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile DEU Language Pack (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile DEU Language Pack (KB2518870)
SRWare Iron 14.0.850.0
STOIK Smart Resizer 3
UltraStar Deluxe
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
VLC media player 1.1.11
XBMC
.
==== End Of File ===========================

MALWAREBYTES:
Code:
Malwarebytes Anti-Malware (Test) 1.60.1.1000
www.malwarebytes.org

Datenbank Version: v2012.03.31.05

Windows 7 Service Pack 1 x64 NTFS (Abgesichertenmodus/Netzwerkfähig)
Internet Explorer 9.0.8112.16421
dosenbier :: LAPTOP [Administrator]

Schutz: Deaktiviert

31.03.2012 12:05:58
mbam-log-2012-03-31 (12-05-58).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 438755
Laufzeit: 1 Stunde(n), 2 Minute(n),

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

ESET:
Code:
ESETSmartInstaller@High as CAB hook log:
OnlineScanner64.ocx - registred OK
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=d064ed7023c2814f8a7d4876cbddb606
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-03-30 10:27:01
# local_time=2012-03-31 12:27:01 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776573 100 94 42391 84770158 0 0
# compatibility_mode=8192 67108863 100 0 555 555 0 0
# scanned=265321
# found=3
# cleaned=0
# scan_time=4140
C:\Users\dosenbier\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J3TY201U\697463092ebcda42a52f83e306a7c1e3[1].htm        HTML/ScrInject.B.Gen virus (unable to clean)        00000000000000000000000000000000        I
C:\Users\dosenbier\AppData\Local\Temp\jar_cache6261645628767445033.tmp        Java/Exploit.CVE-2012-0507.D trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\dosenbier\AppData\Local\TempDIR\BetterInstaller.exe        Win32/Adware.Somoto.A application (unable to clean)        00000000000000000000000000000000        I
esets_scanner_update returned -1 esets_gle=53251
# version=7
# iexplore.exe=9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-03-31 05:06:35
# local_time=2012-03-31 07:06:35 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776573 100 94 111106 84838873 0 0
# compatibility_mode=8192 67108863 100 0 69270 69270 0 0
# scanned=264372
# found=3
# cleaned=0
# scan_time=4572
C:\Users\dosenbier\AppData\Local\Skype\SkypePM.exe        Win32/LockScreen.AIG trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\dosenbier\AppData\Local\Temp\jar_cache6261645628767445033.tmp        Java/Exploit.CVE-2012-0507.D trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\dosenbier\AppData\Local\Temp\jar_cache6392414300976716270.tmp        Java/TrojanDownloader.Agent.NDR trojan (unable to clean)        00000000000000000000000000000000        I
Hab die 3 Funde erst mal nicht entfernt.
Hoffe, ich habe für den Anfang nichts wichtiges vergessen und freue mich auf Euere Hilfe :-)

Grüße, zoolander

markusg 02.04.2012 10:48
sorry für die wartezeit.
starte neu drücke f8 wähle abgesicherter modus mit netzwerk, melde dich im betroffenen konto an.
Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
activex
netsvcs
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%USERPROFILE%\*.*
%USERPROFILE%\Local Settings\Temp\*.exe
%USERPROFILE%\Local Settings\Temp\*.dll
%USERPROFILE%\Application Data\*.exe
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs
CREATERESTOREPOINT
  • Schliesse bitte nun alle Programme. (Wichtig)
  • Klicke nun bitte auf den Quick Scan Button.
  • Kopiere
    nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread

zoolander 02.04.2012 20:51
Hi! Bin doch dankbar, dass ich überhaupt Hilfe bekomme.
Bekomme bei OTL leider eine "out of memory" Meldung beim manual file scan...auch beim zweiten Mal - Ram ist fast komplett frei, alle anderen Programme beendet.
Woran liegt´s?

Grüße, zoolander

markusg 03.04.2012 12:18
versuche es bitte mal ohne mein script, dann gehts.

zoolander 03.04.2012 13:36
So hat es funktioniert.
Danke.

OTL Logfile:
Code:
OTL logfile created on: 03.04.2012 14:24:17 - Run 2
OTL by OldTimer - Version 3.2.39.2    Folder = C:\Users\dosenbier\Desktop\logs virencheck
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,54 Gb Available Physical Memory | 77,06% Memory free
4,00 Gb Paging File | 3,56 Gb Available in Paging File | 89,20% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 99,20 Gb Total Space | 5,16 Gb Free Space | 5,20% Space Free | Partition Type: NTFS
Drive D: | 111,79 Gb Total Space | 1,20 Gb Free Space | 1,08% Space Free | Partition Type: NTFS
Drive E: | 10,00 Gb Total Space | 6,23 Gb Free Space | 62,33% Space Free | Partition Type: NTFS
 
Computer Name: LAPTOP | User Name: dosenbier | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\dosenbier\Desktop\logs virencheck\OTL.exe (OldTimer Tools)
 
 
========== Modules (No Company Name) ==========
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV - (avast! Antivirus) -- C:\Programme\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (oem-drv64) OEM-SLP2.1 Driver (HPD64) -- C:\Windows\SysNative\drivers\oem-drv64.sys (secr9tos)
DRV:64bit: - (aswSnx) -- C:\Windows\SysNative\drivers\aswSnx.sys (AVAST Software)
DRV:64bit: - (aswSP) -- C:\Windows\SysNative\drivers\aswSP.sys (AVAST Software)
DRV:64bit: - (aswRdr) -- C:\Windows\SysNative\drivers\aswRdr2.sys (AVAST Software)
DRV:64bit: - (aswTdi) -- C:\Windows\SysNative\drivers\aswTdi.sys (AVAST Software)
DRV:64bit: - (aswMonFlt) -- C:\Windows\SysNative\drivers\aswMonFlt.sys (AVAST Software)
DRV:64bit: - (aswFsBlk) -- C:\Windows\SysNative\drivers\aswFsBlk.sys (AVAST Software)
DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (avmaudio) -- C:\Windows\SysNative\drivers\avmaudio.sys (AVM Berlin)
DRV:64bit: - (athr) -- C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)
DRV:64bit: - (RdpVideoMiniport) -- C:\Windows\SysNative\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (tsusbhub) -- C:\Windows\SysNative\drivers\tsusbhub.sys (Microsoft Corporation)
DRV:64bit: - (Synth3dVsc) -- C:\Windows\SysNative\drivers\Synth3dVsc.sys (Microsoft Corporation)
DRV:64bit: - (dmvsc) -- C:\Windows\SysNative\drivers\dmvsc.sys (Microsoft Corporation)
DRV:64bit: - (terminpt) -- C:\Windows\SysNative\drivers\terminpt.sys (Microsoft Corporation)
DRV:64bit: - (sdbus) -- C:\Windows\SysNative\drivers\sdbus.sys (Microsoft Corporation)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbGD) -- C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (SrvHsfV92) -- C:\Windows\SysNative\drivers\VSTDPV6.SYS (Conexant Systems, Inc.)
DRV:64bit: - (SrvHsfWinac) -- C:\Windows\SysNative\drivers\VSTCNXT6.SYS (Conexant Systems, Inc.)
DRV:64bit: - (SrvHsfHDA) -- C:\Windows\SysNative\drivers\VSTAZL6.SYS (Conexant Systems, Inc.)
DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)
DRV:64bit: - (netw5v64) Intel(R) -- C:\Windows\SysNative\drivers\netw5v64.sys (Intel Corporation)
DRV:64bit: - (bcm44amd64) -- C:\Windows\SysNative\drivers\b44amd64.sys (Broadcom Corporation)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (rimmptsk) -- C:\Windows\SysNative\drivers\rimmpx64.sys (REDC)
DRV:64bit: - (rimsptsk) -- C:\Windows\SysNative\drivers\rimspx64.sys (REDC)
DRV:64bit: - (OEM02Dev) -- C:\Windows\SysNative\drivers\OEM02Dev.sys (Creative Technology Ltd.)
DRV:64bit: - (rismxdp) -- C:\Windows\SysNative\drivers\rixdpx64.sys (REDC)
DRV:64bit: - (OEM02Vfx) -- C:\Windows\SysNative\drivers\OEM02Vfx.sys (EyePower Games Pte. Ltd.)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
DRV - (EverestDriver) -- C:\Users\DOSENB~1\AppData\Local\Temp\EverestDriver.sys ()
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://startpage.com/babylon/deu/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = B7 1C 3E 86 9D 92 CC 01  [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/web/{searchTerms}?babsrc=browsersearch&AF=100581&tt=110911_startpage
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = local
 
========== FireFox ==========
 
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
 
 
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - Extension: YouTube = C:\Users\dosenbier\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2_0\
CHR - Extension: Google-Suche = C:\Users\dosenbier\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.14_0\
CHR - Extension: avast! WebRep = C:\Users\dosenbier\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1426_0\
CHR - Extension: Facemoods = C:\Users\dosenbier\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihflimipbcaljfnojhhknppphnnciiif\1.4.1_0\
CHR - Extension: Google Mail = C:\Users\dosenbier\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\6.1.3_0\
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Programme\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O2 - BHO: (CescrtHlpr Object) - {64182481-4F71-486b-A045-B233BD0DA8FC} - C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\bh\facemoods.dll (facemoods.com BHO)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3:64bit: - HKLM\..\Toolbar: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Programme\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (facemoods Toolbar) - {DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodsTlbr.dll (facemoods.com)
O4:64bit: - HKLM..\Run: [NVHotkey] C:\Windows\SysNative\nvHotkey.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [facemoods] C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodssrv.exe (facemoods.com)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [OEM02Mon.exe] C:\Windows\OEM02Mon.exe (Creative Technology Ltd.)
O4 - HKCU..\Run: [AVMUSBFernanschluss] C:\Users\dosenbier\AppData\Local\Apps\2.0\C9B1NDR9.N0J\2C79C08D.QX7\frit..tion_8488884cfbcefd60_0002.0002_8541bf1f4a1c673d\AVMAutoStart.exe (AVM Berlin)
O4 - HKCU..\Run: [SkypePM] C:\Users\dosenbier\AppData\Local\Skype\SkypePM.exe ()
O4 - HKCU..\RunOnce: [FlashPlayerUpdate] C:\Windows\system32\Macromed\Flash\FlashUtil64_11_1_102_ActiveX.exe -update activex File not found
O4 - Startup: C:\Users\dosenbier\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200 File not found
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\SysWow64\GPhotos.scr (Google Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O16 - DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4BCBD830-6CB1-417F-AF20-8897E68BE9FB}: NameServer = 192.168.2.1
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{f53f1695-fef2-11e0-a913-00197eda1d37}\Shell - "" = AutoRun
O33 - MountPoints2\{f53f1695-fef2-11e0-a913-00197eda1d37}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.03.31 14:29:59 | 000,000,000 | ---D | C] -- C:\Users\dosenbier\Desktop\logs virencheck
[2012.03.30 22:35:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2012.03.30 21:12:49 | 000,000,000 | ---D | C] -- C:\Users\dosenbier\AppData\Roaming\Malwarebytes
[2012.03.30 21:12:44 | 000,023,152 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.03.30 21:12:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012.03.30 21:12:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.03.24 00:29:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
[2012.03.24 00:29:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java
[2012.03.23 16:56:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2012.03.22 19:38:39 | 000,053,080 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswRdr2.sys
[2012.03.10 00:30:39 | 000,000,000 | ---D | C] -- C:\Users\dosenbier\Desktop\Neuer Ordner (2)
[2012.03.09 00:33:46 | 000,000,000 | ---D | C] -- C:\Users\dosenbier\Desktop\EBAY BILDER
[2011.10.15 00:01:55 | 022,333,089 | ---- | C] (PortableAppZ.blogspot.com) -- C:\Program Files\Nero.Burning.ROM.v.10.6.3.100.exe
[2011.10.14 00:34:02 | 002,983,429 | ---- | C] (Nullsoft) -- C:\Program Files (x86)\Winamp_2.95_mini_portable.exe
[2011.10.14 00:31:49 | 002,983,429 | ---- | C] (Nullsoft) -- C:\Program Files\Winamp_2.95_mini_portable.exe
 
========== Files - Modified Within 30 Days ==========
 
[2012.04.03 14:17:43 | 000,028,707 | ---- | M] () -- C:\Users\dosenbier\Desktop\snoopy2504_01.JPG
[2012.04.03 14:17:04 | 000,026,285 | ---- | M] () -- C:\Users\dosenbier\Desktop\snoopy5440.JPG
[2012.04.03 11:14:52 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.04.03 11:14:35 | 1609,187,328 | -HS- | M] () -- C:\hiberfil.sys
[2012.04.03 11:14:31 | 000,042,496 | ---- | M] (secr9tos) -- C:\Windows\SysNative\drivers\oem-drv64.sys
[2012.04.02 14:18:36 | 000,003,400 | ---- | M] () -- C:\Users\dosenbier\Desktop\Neues RTF-Dokument (2).rtf
[2012.04.02 00:57:10 | 001,498,506 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.04.02 00:57:10 | 000,653,928 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.04.02 00:57:10 | 000,615,810 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.04.02 00:57:10 | 000,129,800 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.04.02 00:57:10 | 000,106,190 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.04.01 20:07:26 | 000,948,917 | ---- | M] () -- C:\Users\dosenbier\Desktop\DSCF1750.jpg
[2012.04.01 20:07:13 | 000,964,234 | ---- | M] () -- C:\Users\dosenbier\Desktop\DSCF1745.jpg
[2012.04.01 20:07:04 | 001,071,099 | ---- | M] () -- C:\Users\dosenbier\Desktop\DSCF1744.jpg
[2012.04.01 20:06:16 | 000,765,981 | ---- | M] () -- C:\Users\dosenbier\Desktop\DSCF1812.jpg
[2012.04.01 17:08:19 | 000,024,949 | ---- | M] () -- C:\Users\dosenbier\Desktop\midnightrose01.JPG
[2012.04.01 17:08:03 | 000,027,995 | ---- | M] () -- C:\Users\dosenbier\Desktop\midnightrose.JPG
[2012.04.01 12:11:15 | 000,001,112 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.03.31 14:38:55 | 000,000,000 | ---- | M] () -- C:\Users\dosenbier\defogger_reenable
[2012.03.31 02:12:05 | 000,026,080 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.03.31 02:12:05 | 000,026,080 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.03.30 16:17:02 | 000,001,116 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.03.29 21:21:44 | 000,002,344 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2012.03.29 20:53:53 | 000,220,831 | ---- | M] () -- C:\Users\dosenbier\Desktop\Studienplan BA - Seite 1_kl.jpg
[2012.03.29 19:59:52 | 000,087,196 | ---- | M] () -- C:\Users\dosenbier\Desktop\Zielvereinbarung_Holweg.pdf
[2012.03.29 14:01:23 | 000,703,089 | ---- | M] () -- C:\Users\dosenbier\Desktop\taxi_ws0506.pdf
[2012.03.29 13:18:42 | 000,002,332 | ---- | M] () -- C:\Users\dosenbier\Desktop\Rechnung 04 - 2012.pdf
[2012.03.29 13:14:53 | 000,535,985 | ---- | M] () -- C:\Users\dosenbier\Desktop\zeit12-v1.0.ods
[2012.03.29 12:05:36 | 000,031,932 | ---- | M] () -- C:\Users\dosenbier\Desktop\stundenzettel.pdf
[2012.03.29 12:03:38 | 000,038,291 | ---- | M] () -- C:\Users\dosenbier\Desktop\dezimalstunden-tabelle.pdf
[2012.03.29 11:28:17 | 000,632,115 | ---- | M] () -- C:\Users\dosenbier\Desktop\zeit12-v1.0oo.zip
[2012.03.22 19:38:38 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\config.nt
[2012.03.22 13:38:46 | 000,042,821 | ---- | M] () -- C:\Users\dosenbier\Desktop\duoh.jpg
[2012.03.22 01:24:17 | 000,007,374 | ---- | M] () -- C:\Users\dosenbier\Desktop\SharePodSettings.xml
[2012.03.20 23:25:24 | 000,003,824 | ---- | M] () -- C:\Users\dosenbier\Desktop\dlc.dlc
[2012.03.20 15:03:10 | 000,024,866 | ---- | M] () -- C:\Users\dosenbier\Desktop\fehlebeschreibung philips kaffee.odt
[2012.03.19 01:38:46 | 000,001,324 | ---- | M] () -- C:\Users\dosenbier\Desktop\Neues RTF-Dokument.rtf
[2012.03.16 16:48:30 | 002,341,287 | ---- | M] () -- C:\Users\dosenbier\Desktop\philips 04.jpg
[2012.03.16 16:48:20 | 002,212,071 | ---- | M] () -- C:\Users\dosenbier\Desktop\philips 03.jpg
[2012.03.16 16:48:10 | 002,177,932 | ---- | M] () -- C:\Users\dosenbier\Desktop\philips 02.jpg
[2012.03.16 16:47:35 | 002,291,638 | ---- | M] () -- C:\Users\dosenbier\Desktop\philips 01.jpg
[2012.03.14 22:35:06 | 000,000,084 | ---- | M] () -- C:\Windows\winamp.ini
[2012.03.14 21:58:15 | 000,292,872 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.03.07 02:15:19 | 000,041,184 | ---- | M] (AVAST Software) -- C:\Windows\avastSS.scr
[2012.03.07 02:15:14 | 000,201,352 | ---- | M] (AVAST Software) -- C:\Windows\SysWow64\aswBoot.exe
[2012.03.07 02:15:03 | 000,258,520 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\aswBoot.exe
[2012.03.07 02:04:06 | 000,819,032 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswSnx.sys
[2012.03.07 02:04:04 | 000,337,240 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswSP.sys
[2012.03.07 02:02:20 | 000,053,080 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswRdr2.sys
[2012.03.07 02:01:57 | 000,059,224 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswTdi.sys
[2012.03.07 02:01:52 | 000,069,976 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswMonFlt.sys
[2012.03.07 02:01:32 | 000,024,408 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswFsBlk.sys
[2012.03.06 17:51:59 | 000,014,145 | ---- | M] () -- C:\Users\dosenbier\Desktop\gek hitop schreiben.odt
[2012.03.06 15:36:42 | 000,032,670 | ---- | M] () -- C:\Users\dosenbier\Desktop\StudFB.pdf
[2012.03.06 15:04:25 | 000,017,534 | ---- | M] () -- C:\Users\dosenbier\Desktop\GEK HiTop Anforderung.odt
[2012.03.06 14:43:35 | 000,014,065 | ---- | M] () -- C:\Users\dosenbier\Desktop\GEK Zuzahlungsbefreiung.odt
[2012.03.05 15:34:22 | 000,012,185 | ---- | M] () -- C:\Users\dosenbier\Desktop\Alu Bücher.odt
[2012.03.05 15:00:32 | 000,013,951 | ---- | M] () -- C:\Users\dosenbier\Desktop\Stifte 01.odt
[2012.03.05 15:00:16 | 000,014,023 | ---- | M] () -- C:\Users\dosenbier\Desktop\Stifte 02.odt
 
========== Files Created - No Company Name ==========
 
[2012.04.03 14:17:43 | 000,028,707 | ---- | C] () -- C:\Users\dosenbier\Desktop\snoopy2504_01.JPG
[2012.04.03 14:17:03 | 000,026,285 | ---- | C] () -- C:\Users\dosenbier\Desktop\snoopy5440.JPG
[2012.04.02 14:17:45 | 000,003,400 | ---- | C] () -- C:\Users\dosenbier\Desktop\Neues RTF-Dokument (2).rtf
[2012.04.01 20:07:25 | 000,948,917 | ---- | C] () -- C:\Users\dosenbier\Desktop\DSCF1750.jpg
[2012.04.01 20:07:13 | 000,964,234 | ---- | C] () -- C:\Users\dosenbier\Desktop\DSCF1745.jpg
[2012.04.01 20:07:04 | 001,071,099 | ---- | C] () -- C:\Users\dosenbier\Desktop\DSCF1744.jpg
[2012.04.01 20:06:15 | 000,765,981 | ---- | C] () -- C:\Users\dosenbier\Desktop\DSCF1812.jpg
[2012.04.01 17:08:19 | 000,024,949 | ---- | C] () -- C:\Users\dosenbier\Desktop\midnightrose01.JPG
[2012.04.01 17:08:03 | 000,027,995 | ---- | C] () -- C:\Users\dosenbier\Desktop\midnightrose.JPG
[2012.03.31 14:38:55 | 000,000,000 | ---- | C] () -- C:\Users\dosenbier\defogger_reenable
[2012.03.29 21:03:05 | 000,220,831 | ---- | C] () -- C:\Users\dosenbier\Desktop\Studienplan BA - Seite 1_kl.jpg
[2012.03.29 20:00:00 | 000,087,196 | ---- | C] () -- C:\Users\dosenbier\Desktop\Zielvereinbarung_***.pdf
[2012.03.29 13:57:13 | 000,703,089 | ---- | C] () -- C:\Users\dosenbier\Desktop\taxi_ws0506.pdf
[2012.03.29 13:18:42 | 000,002,332 | ---- | C] () -- C:\Users\dosenbier\Desktop\Rechnung 04 - 2012.pdf
[2012.03.29 12:05:36 | 000,031,932 | ---- | C] () -- C:\Users\dosenbier\Desktop\stundenzettel.pdf
[2012.03.29 12:03:38 | 000,038,291 | ---- | C] () -- C:\Users\dosenbier\Desktop\dezimalstunden-tabelle.pdf
[2012.03.29 11:30:35 | 000,535,985 | ---- | C] () -- C:\Users\dosenbier\Desktop\zeit12-v1.0.ods
[2012.03.29 11:28:16 | 000,632,115 | ---- | C] () -- C:\Users\dosenbier\Desktop\zeit12-v1.0oo.zip
[2012.03.23 16:56:17 | 000,002,344 | ---- | C] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2012.03.23 16:50:22 | 000,001,116 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.03.23 16:50:13 | 000,001,112 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.03.22 13:39:02 | 000,042,821 | ---- | C] () -- C:\Users\dosenbier\Desktop\duoh.jpg
[2012.03.20 23:25:24 | 000,003,824 | ---- | C] () -- C:\Users\dosenbier\Desktop\dlc.dlc
[2012.03.20 01:09:10 | 000,024,866 | ---- | C] () -- C:\Users\dosenbier\Desktop\fehlebeschreibung philips kaffee.odt
[2012.03.18 21:11:07 | 000,001,324 | ---- | C] () -- C:\Users\dosenbier\Desktop\Neues RTF-Dokument.rtf
[2012.03.16 16:59:30 | 002,255,371 | ---- | C] () -- C:\Users\dosenbier\Desktop\philips Boden.JPG
[2012.03.16 16:48:34 | 002,341,287 | ---- | C] () -- C:\Users\dosenbier\Desktop\philips 04.jpg
[2012.03.16 16:48:24 | 002,212,071 | ---- | C] () -- C:\Users\dosenbier\Desktop\philips 03.jpg
[2012.03.16 16:48:14 | 002,177,932 | ---- | C] () -- C:\Users\dosenbier\Desktop\philips 02.jpg
[2012.03.16 16:47:54 | 002,291,638 | ---- | C] () -- C:\Users\dosenbier\Desktop\philips 01.jpg
[2012.03.06 15:36:52 | 000,032,670 | ---- | C] () -- C:\Users\dosenbier\Desktop\StudFB.pdf
[2012.03.06 14:44:53 | 000,017,534 | ---- | C] () -- C:\Users\dosenbier\Desktop\GEK HiTop Anforderung.odt
[2012.03.06 14:35:44 | 000,014,065 | ---- | C] () -- C:\Users\dosenbier\Desktop\GEK Zuzahlungsbefreiung.odt
[2012.03.05 15:34:20 | 000,012,185 | ---- | C] () -- C:\Users\dosenbier\Desktop\Alu Bücher.odt
[2012.03.05 15:00:01 | 000,014,023 | ---- | C] () -- C:\Users\dosenbier\Desktop\Stifte 02.odt
[2012.03.05 14:40:44 | 000,013,951 | ---- | C] () -- C:\Users\dosenbier\Desktop\Stifte 01.odt
[2012.01.20 03:13:16 | 000,013,082 | ---- | C] () -- C:\Windows\SysWow64\SpoonUninstall-dBpoweramp DSP Effects.dat
[2012.01.20 03:13:05 | 004,022,504 | ---- | C] () -- C:\Windows\SysWow64\SpoonUninstall.exe
[2012.01.20 03:13:05 | 000,017,950 | ---- | C] () -- C:\Windows\SysWow64\SpoonUninstall-dBpoweramp Music Converter.dat
[2011.12.18 19:04:49 | 000,000,012 | ---- | C] () -- C:\ProgramData\8680
[2011.12.18 19:04:49 | 000,000,012 | ---- | C] () -- C:\ProgramData\4794
[2011.12.18 19:04:49 | 000,000,012 | ---- | C] () -- C:\Users\dosenbier\AppData\Local\4662
[2011.12.18 19:04:49 | 000,000,012 | ---- | C] () -- C:\Users\dosenbier\AppData\Roaming\3888
[2011.12.18 19:04:49 | 000,000,012 | ---- | C] () -- C:\ProgramData\1374
[2011.12.17 02:16:01 | 000,007,680 | ---- | C] () -- C:\Users\dosenbier\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.11.04 17:14:50 | 000,000,061 | ---- | C] () -- C:\Users\dosenbier\AppData\Local\Images.fl
[2011.10.31 01:50:10 | 000,015,873 | ---- | C] () -- C:\Windows\SysWow64\Inetde.dll
[2011.10.14 00:37:55 | 000,000,084 | ---- | C] () -- C:\Windows\winamp.ini
[2011.08.03 03:31:54 | 000,311,912 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe
 
========== LOP Check ==========
 
[2012.02.26 00:41:34 | 000,000,000 | ---D | M] -- C:\Users\dosenbier\AppData\Roaming\Audacity
[2011.10.15 00:09:25 | 000,000,000 | ---D | M] -- C:\Users\dosenbier\AppData\Roaming\Canneverbe Limited
[2012.02.26 22:35:38 | 000,000,000 | ---D | M] -- C:\Users\dosenbier\AppData\Roaming\DesktopIconForAmazon
[2012.01.02 16:53:46 | 000,000,000 | ---D | M] -- C:\Users\dosenbier\AppData\Roaming\FileZilla
[2011.11.02 17:31:56 | 000,000,000 | ---D | M] -- C:\Users\dosenbier\AppData\Roaming\Foxit Software
[2012.02.09 19:34:01 | 000,000,000 | ---D | M] -- C:\Users\dosenbier\AppData\Roaming\gtk-2.0
[2011.11.05 03:15:34 | 000,000,000 | ---D | M] -- C:\Users\dosenbier\AppData\Roaming\ID3-TagIT 3
[2011.10.17 12:06:00 | 000,000,000 | ---D | M] -- C:\Users\dosenbier\AppData\Roaming\IrfanView
[2012.01.13 17:08:05 | 000,000,000 | ---D | M] -- C:\Users\dosenbier\AppData\Roaming\jpg-Illuminator
[2012.02.26 22:37:57 | 000,000,000 | ---D | M] -- C:\Users\dosenbier\AppData\Roaming\Nvu
[2011.11.04 17:50:45 | 000,000,000 | ---D | M] -- C:\Users\dosenbier\AppData\Roaming\ObviousIdea
[2011.11.10 00:34:24 | 000,000,000 | ---D | M] -- C:\Users\dosenbier\AppData\Roaming\OpenOffice.org
[2011.10.22 00:24:30 | 000,000,000 | ---D | M] -- C:\Users\dosenbier\AppData\Roaming\SharePod
[2012.01.05 23:51:10 | 000,000,000 | ---D | M] -- C:\Users\dosenbier\AppData\Roaming\ultrastardx
[2012.03.30 01:17:19 | 000,000,000 | ---D | M] -- C:\Users\dosenbier\AppData\Roaming\XBMC
[2012.03.02 21:21:51 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 

< End of report >
--- --- ---

[/spoiler]

markusg 03.04.2012 19:12
hi

dieses script sowie evtl. folgende scripts sind nur für den jeweiligen user.
wenn ihr probleme habt, eröffnet eigene topics und wartet auf, für euch angepasste scripts.


• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.



[CODE]
:OTL
O4 - HKCU..\Run: [SkypePM] C:\Users\dosenbier\AppData\Local\Skype\SkypePM.exe ()
:Files
C:\Users\dosenbier\AppData\Local\Skype
:Commands
[purity]
[EMPTYFLASH]
[emptytemp]
[Reboot]



• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren.
starte in den normalen modus.

falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden

Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang
in den Thread posten!



Drücke bitte die http://larusso.trojaner-board.de/Images/windows.jpg + E Taste.
  • Öffne dein Systemlaufwerk ( meistens C: )
  • Suche nun
    folgenden Ordner: _OTL und öffne diesen.
  • Mache einen Rechtsklick auf den Ordner Movedfiles --> Senden an --> Zip-Komprimierter Ordner

  • Dies wird eine Movedfiles.zip Datei in _OTL erstellen
  • Lade diese bitte in unseren Uploadchannel
    hoch. ( Durchsuchen --> C:\_OTL\Movedfiles.zip )
Teile mir mit ob der Upload problemlos geklappt hat. Danke im voraus :)

zoolander 03.04.2012 20:24
Danke markus - das hat soweit geklappt - Schreibe jetzt im "normalen Windows Modus"

Folgendes hat OTL nach Neustart ausgespuckt:
[CODE]
All processes killed
Error: Unable to interpret <
Code:
> in the current context!
========== OTL ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\SkypePM deleted successfully.
C:\Users\dosenbier\AppData\Local\Skype\SkypePM.exe moved successfully.
========== FILES ==========
C:\Users\dosenbier\AppData\Local\Skype folder moved successfully.
========== COMMANDS ==========
 
[EMPTYFLASH]
 
User: All Users
 
User: Default
 
User: Default User
 
User: dosenbier
->Flash cache emptied: 5215 bytes
 
User: Public
 
Total Flash Files Cleaned = 0,00 mb
 
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: dosenbier
->Temp folder emptied: 1178570537 bytes
->Temporary Internet Files folder emptied: 298618663 bytes
->Java cache emptied: 17960 bytes
->Google Chrome cache emptied: 6191359 bytes
->Flash cache emptied: 0 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 55924190 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 67832 bytes
RecycleBin emptied: 1459926148 bytes
 
Total Files Cleaned = 2.860,00 mb
 
 
OTL by OldTimer - Version 3.2.39.2 log created on 04032012_210236

Files\Folders moved on Reboot...
C:\Users\dosenbier\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

Registry entries deleted on Reboot...
Upload des zip files hat problemlos funktioniert - ich hab zu danken.

Was muss ich als nächstes checken? malwarebytes?

markusg 04.04.2012 13:06
Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.
Downloade dir bitte Combofix von einem dieser Downloadspiegel

Link 1
Link 2


WICHTIG - Speichere Combofix auf deinem Desktop
  • Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.
Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.


Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

zoolander 04.04.2012 21:19
Hi Markus, im abgesicherten Modus ging´s nicht, dafür aber im normalen - Hoffe das war ok so.

Nach dem Scan konnte ich erstmal leine Programme ausführen

"Es wurde versucht, einem Regschlüssel einen unzulässigen Vorgang zu unterziehen..."
und
"dieses Element kann nicht geöffnet werden...möglicherweise verschoben, gelöscht..."

Was meinst Du - Kann man ohne Neuaufsetzen des Systems wieder online banking betreiben?
Soweit ich lesen konnte, vervielfältigt sich der Virus nicht - kann ich bedenkenlos wieder die externe Platte anschließen?

Hier die Log_Datei:


Combofix Logfile:
Code:
ComboFix 12-04-04.02 - dosenbier 04.04.2012  21:50:11.1.2 - x64
Microsoft Windows 7 Ultimate  6.1.7601.1.1252.49.1031.18.2046.1194 [GMT 2:00]
ausgeführt von:: c:\users\dosenbier\Desktop\logs virencheck\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\prefs.js
c:\program files (x86)\facemoods.com
c:\program files (x86)\facemoods.com\facemoods\1.4.17.11\bh\facemoods.dll
c:\program files (x86)\facemoods.com\facemoods\1.4.17.11\facemoods.crx
c:\program files (x86)\facemoods.com\facemoods\1.4.17.11\facemoods.png
c:\program files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodsApp.dll
c:\program files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodsEng.dll
c:\program files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodssrv.exe
c:\program files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodsTlbr.dll
c:\program files (x86)\facemoods.com\facemoods\1.4.17.11\uninstall.exe
c:\users\dosenbier\AppData\Local\TempDIR
c:\windows\XSxS
D:\install.exe
.
Infizierte Kopie von c:\windows\SysWow64\userinit.exe wurde gefunden und desinfiziert
Kopie von - c:\windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe wurde wiederhergestellt
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-03-04 bis 2012-04-04  ))))))))))))))))))))))))))))))
.
.
2012-04-04 19:59 . 2012-04-04 19:59        --------        d-----w-        c:\users\Default\AppData\Local\temp
2012-04-04 10:02 . 2012-04-04 10:02        --------        d-----w-        c:\windows\Sun
2012-04-03 19:15 . 2012-03-14 03:27        8669240        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{7D8250CF-4386-4FC5-89D1-B72BB7C17546}\mpengine.dll
2012-04-03 19:02 . 2012-04-03 19:16        --------        d-----w-        C:\_OTL
2012-03-30 20:35 . 2012-03-30 20:35        --------        d-----w-        c:\program files (x86)\ESET
2012-03-30 19:12 . 2012-03-30 19:12        --------        d-----w-        c:\users\dosenbier\AppData\Roaming\Malwarebytes
2012-03-30 19:12 . 2012-03-30 19:12        --------        d-----w-        c:\program files (x86)\Malwarebytes' Anti-Malware
2012-03-30 19:12 . 2012-03-30 19:12        --------        d-----w-        c:\programdata\Malwarebytes
2012-03-30 19:12 . 2011-12-10 13:24        23152        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-03-23 22:29 . 2012-03-23 22:29        --------        d-----w-        c:\program files (x86)\Common Files\Java
2012-03-23 22:29 . 2012-03-23 22:29        --------        d-----w-        c:\program files (x86)\Java
2012-03-22 17:38 . 2012-03-07 00:02        53080        ----a-w-        c:\windows\system32\drivers\aswRdr2.sys
2012-03-14 12:03 . 2012-02-03 04:34        3145728        ----a-w-        c:\windows\system32\win32k.sys
2012-03-14 12:03 . 2012-02-10 06:36        1544192        ----a-w-        c:\windows\system32\DWrite.dll
2012-03-14 12:03 . 2012-02-10 05:38        1077248        ----a-w-        c:\windows\SysWow64\DWrite.dll
2012-03-14 12:02 . 2012-01-25 06:38        77312        ----a-w-        c:\windows\system32\rdpwsx.dll
2012-03-14 12:02 . 2012-01-25 06:38        149504        ----a-w-        c:\windows\system32\rdpcorekmts.dll
2012-03-14 12:02 . 2012-01-25 06:33        9216        ----a-w-        c:\windows\system32\rdrmemptylst.exe
2012-03-14 12:02 . 2012-02-17 06:38        1112064        ----a-w-        c:\windows\system32\rdpcorets.dll
2012-03-14 12:02 . 2012-02-17 06:38        1031680        ----a-w-        c:\windows\system32\rdpcore.dll
2012-03-14 12:02 . 2012-02-17 05:34        826880        ----a-w-        c:\windows\SysWow64\rdpcore.dll
2012-03-14 12:02 . 2012-02-17 04:58        210944        ----a-w-        c:\windows\system32\drivers\rdpwd.sys
2012-03-14 12:02 . 2012-02-17 04:57        23552        ----a-w-        c:\windows\system32\drivers\tdtcp.sys
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-04-04 19:59 . 2011-10-13 17:55        42496        ----a-w-        c:\windows\system32\drivers\oem-drv64.sys
2012-03-25 11:16 . 2011-10-24 22:30        414368        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-03-23 22:29 . 2011-11-09 22:30        472808        ----a-w-        c:\windows\SysWow64\deployJava1.dll
2012-03-07 00:15 . 2011-10-13 21:40        41184        ----a-w-        c:\windows\avastSS.scr
2012-03-07 00:15 . 2011-10-13 21:40        201352        ----a-w-        c:\windows\SysWow64\aswBoot.exe
2012-03-07 00:15 . 2011-10-13 21:41        258520        ----a-w-        c:\windows\system32\aswBoot.exe
2012-03-07 00:04 . 2011-10-13 21:41        819032        ----a-w-        c:\windows\system32\drivers\aswSnx.sys
2012-03-07 00:04 . 2011-10-13 21:41        337240        ----a-w-        c:\windows\system32\drivers\aswSP.sys
2012-03-07 00:01 . 2011-10-13 21:41        59224        ----a-w-        c:\windows\system32\drivers\aswTdi.sys
2012-03-07 00:01 . 2011-10-13 21:41        69976        ----a-w-        c:\windows\system32\drivers\aswMonFlt.sys
2012-03-07 00:01 . 2011-10-13 21:41        24408        ----a-w-        c:\windows\system32\drivers\aswFsBlk.sys
2012-02-23 08:18 . 2010-11-21 03:27        279656        ------w-        c:\windows\system32\MpSigStub.exe
2012-01-20 01:13 . 2012-01-20 01:13        4022504        ----a-w-        c:\windows\SysWow64\SpoonUninstall.exe
2011-04-23 20:10 . 2011-10-14 22:01        22333089        ----a-w-        c:\program files\Nero.Burning.ROM.v.10.6.3.100.exe
2010-07-29 10:57 . 2011-10-13 22:34        2983429        ----a-w-        c:\program files (x86)\Winamp_2.95_mini_portable.exe
2010-07-29 10:57 . 2011-10-13 22:31        2983429        ----a-w-        c:\program files\Winamp_2.95_mini_portable.exe
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVMUSBFernanschluss"="c:\users\dosenbier\AppData\Local\Apps\2.0\C9B1NDR9.N0J\2C79C08D.QX7\frit..tion_8488884cfbcefd60_0002.0002_8541bf1f4a1c673d\AVMAutoStart.exe" [2011-11-15 147456]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"OEM02Mon.exe"="c:\windows\OEM02Mon.exe" [2007-05-09 36864]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-03-07 4241512]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-01-13 460872]
.
c:\users\dosenbier\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.3.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update-Dienst (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-03-23 136176]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [x]
R3 EverestDriver;Lavalys EVEREST Kernel Driver;c:\users\DOSENB~1\AppData\Local\Temp\EverestDriver.sys [x]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-03-23 136176]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x]
R3 Synth3dVsc;Microsoft Virtual 3D Video Transport Driver;c:\windows\system32\drivers\Synth3dVsc.sys [x]
R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 TsUsbGD;%TsUsbGD.DeviceDesc.Generic%;c:\windows\system32\drivers\TsUsbGD.sys [x]
R3 tsusbhub;Remote Deskotop USB Hub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
S0 oem-drv64;OEM-SLP2.1 Driver (HPD64);c:\windows\system32\DRIVERS\oem-drv64.sys [x]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [x]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-01-13 652360]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-08-03 379496]
S3 avmaudio;AVM Audio;c:\windows\system32\DRIVERS\avmaudio.sys [x]
S3 bcm44amd64;Broadcom 440x 10/100-integrierter Controller-XP-Treiber;c:\windows\system32\DRIVERS\b44amd64.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
S3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series - Adaptertreiber für Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys [x]
S3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [x]
S3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [x]
S3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2012-04-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-03-23 14:49]
.
2012-04-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-03-23 14:49]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-03-07 00:15        135408        ----a-w-        c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NVHotkey"="c:\windows\system32\nvHotkey.dll" [2011-08-03 335976]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://startpage.com/babylon/deu/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = local
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
TCP: Interfaces\{4BCBD830-6CB1-417F-AF20-8897E68BE9FB}: NameServer = 192.168.2.1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKLM-Run-facemoods - c:\program files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodssrv.exe
AddRemove-dBpoweramp DSP Effects - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp Music Converter - c:\windows\system32\SpoonUninstall.exe
AddRemove-facemoods - c:\program files (x86)\facemoods.com\facemoods\1.4.17.11\uninstall.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11g_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11g_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11g.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11g.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11g.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11g.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files\AVAST Software\Avast\AvastSvc.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-04-04  22:06:54 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2012-04-04 20:06
.
Vor Suchlauf: 6.899.490.816 Bytes frei
Nach Suchlauf: 6.753.480.704 Bytes frei
.
- - End Of File - - D9627D62C1648D99C69EB71BF6018B6D
--- --- ---



Grüße, zoolander

markusg 05.04.2012 12:28
steht doch eig da, unter combofix, wenn diese meldung auftritt, neustarten.
öffne computer, c: qoobox rechtsklick quarantain, bitte packen, und im upload channel hochladen, wenn fertig, bescheid geben

zoolander 05.04.2012 14:28
ok - ist untergegangen...quarantain ist hochgeladen.

markusg 05.04.2012 16:13
sieht gut aus.
lade den CCleaner standard:
CCleaner Download - CCleaner 3.17.1689
falls der CCleaner
bereits instaliert, überspringen.
instalieren, öffnen, extras, liste der instalierten programme, als txt speichern. öffnen.
hinter, jedes von dir benötigte programm, schreibe notwendig.
hinter, jedes, von dir nicht benötigte, unnötig.
hinter, dir unbekannte, unbekannt.
liste posten.

zoolander 05.04.2012 18:49
Hi - eben geschehen, soweit nichts unbekanntes zu finden.
MS framework / ms visual sind bzw. waren für irgendein Programm nötig - weiß aber nicht mehr für welches

Code:
7-Zip 9.20                12.10.2011 - notw.               
Adobe Flash Player 11 ActiveX 64-bit        Adobe Systems Incorporated        24.03.2012        6,00MB        11.1.102.63 - notw.
Adobe Flash Player 11 Plugin 64-bit        Adobe Systems Incorporated        15.11.2011        6,00MB        11.1.102.55 - notw.
Audacity 1.3.14 (Unicode)        Audacity Team        24.02.2012        40,5MB - notw.       
avast! Free Antivirus        AVAST Software        21.03.2012                7.0.1426.0 - notw.
AVM FRITZ!Box USB-Fernanschluss        AVM Berlin        14.11.2011                2.2.1.0 - unnötig
Biet-O-Matic v2.14.8        BOM Development Team        30.10.2011        6,84MB        2.14.8 - notw.
Canon Inkjet Printer Driver Add-On Module                13.12.2011 - notw.               
CCleaner        Piriform        04.04.2012                3.17 - notw.
CDBurnerXP        CDBurnerXP        14.10.2011        12,0MB        4.3.8.2631 - notw.
CDBurnerXP        CDBurnerXP        02.11.2011        17,2MB        4.3.9.2762 - notw.
dBpoweramp DSP Effects        Illustrate        19.01.2012        9.323MB        Release 7 - notw.
dBpoweramp Music Converter        Illustrate        19.01.2012        16.692MB        Release 14.2 - notw.
Desktop Icon für Amazon                25.02.2012                1.0.1 (de) - unnötig
DVD Flick 1.3.0.7        Dennis Meuwissen        18.02.2012                1.3.0.7 - unnötig
DVD-lab PRO 2.51        Mediachance        18.02.2012 - unnötig               
DVDStyler v2.1                18.02.2012        27,1MB        - unnötig
ESET Online Scanner v3                29.03.2012 - notw.               
EVEREST Home Edition v2.20        Lavalys Inc        12.10.2011                2.20 - notw.
Facemoods Toolbar                13.10.2011 - unnötig               
FileZilla Client 3.5.1        FileZilla Project        12.10.2011        16,6MB        3.5.1 - notw.
Foxit Reader 5.0        Foxit Corporation        23.10.2011        24,9MB        5.0.2.718 - notw.
GIMP 2.6.8                07.11.2011 - notw.
Google Chrome        Google Inc.        22.03.2012                18.0.1025.142 - unnötig
ID3-TagIT 3        Michael Pluemper        04.11.2011 - notw.               
Image Resizer for Windows        Brice Lambson        03.11.2011        1,90MB        3.0.4319.33193 - notw.
Image Resizer for Windows (64 bit)        Brice Lambson        03.11.2011        0,59MB        3.0.4319.33193 - notw.
ImageShack Uploader 2.2.0        ImageShack Corp.        25.10.2011        26,4MB        2.2.0 - notw.
IrfanView (remove only)        Irfan Skiljan        16.10.2011        1,50MB        4.30 - notw.
Java(TM) 6 Update 27 (64-bit)        Oracle        13.10.2011        91,6MB        6.0.270 - notw.
Java(TM) 6 Update 31        Oracle        22.03.2012        95,1MB        6.0.310 - notw.
JDownloader 0.9        AppWork GmbH        13.10.2011                0.9 - notw.
Laptop Integrated Webcam Driver (1.04.01.1011)                18.07.2007 - notw.               
Light Image Resizer 4.0.9.8        ObviousIdea        03.11.2011        35,1MB        4.0.9.8 - notw.
Malwarebytes Anti-Malware Version 1.60.1.1000        Malwarebytes Corporation        29.03.2012        17,4MB        1.60.1.1000 - notw.
Microsoft .NET Framework 4 Client Profile        Microsoft Corporation        12.04.2011        38,8MB        4.0.30319 - notw.
Microsoft .NET Framework 4 Client Profile DEU Language Pack        Microsoft Corporation        12.04.2011        2,94MB        4.0.30319 - notw.
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148        Microsoft Corporation        08.11.2011        0,77MB        9.0.30729.4148 - notw.
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17        Microsoft Corporation        01.12.2011        0,23MB        9.0.30729 - notw.
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148        Microsoft Corporation        12.10.2011        0,58MB        9.0.30729.4148 - notw.
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319        Microsoft Corporation        01.12.2011        11,0MB        10.0.30319 - notw.
NVIDIA 3D Vision Controller-Treiber 280.19        NVIDIA Corporation        12.10.2011                280.19
NVIDIA 3D Vision Treiber 280.26        NVIDIA Corporation        12.10.2011                280.26 - notw.
NVIDIA Grafiktreiber 280.26        NVIDIA Corporation        12.10.2011                280.26 - notw.
NVIDIA PhysX-Systemsoftware 9.10.0514        NVIDIA Corporation        12.10.2011                9.10.0514 - notw.
Nvu 0.8.1        Thorsten Fritz        25.02.2012                0.8.1 - notw.
OpenOffice.org 3.3        OpenOffice.org        08.11.2011        415MB        3.3.9567 - notw.
Picasa 3        Google, Inc.        07.11.2011                3.8 - unnötig
RICOH R5C83x/84x Flash Media Controller Driver Ver.3.57.01        RICOH        13.10.2011                3.57.01 - notw.
SRWare Iron 14.0.850.0        SRWare        12.10.2011        74,2MB - notw.       
STOIK Smart Resizer 3        STOIK Technology        17.12.2011        2,52MB        3.0.0 - notw.
UltraStar Deluxe        USDX Team        04.01.2012                1.1 - notw.
VLC media player 1.1.11        VideoLAN        13.10.2011                1.1.11 - notw.
WinRAR 4.01 (64-bit)        win.rar GmbH        14.10.2011                4.01.0 - notw.
XBMC        Team XBMC        01.12.2011

markusg 06.04.2012 16:14
deinstalire:
ESET Online
Facemoods
Google
Java(TM) 6 Update 27
Picasa
Desktop Icon
DVD Flick
DVD-lab
DVDStyler

öffne otl bereinigen neustart.
öffne ccleaner analysieren, ccleaner starten.
pc neustarten testen wie das gerät läuft

zoolander 06.04.2012 17:36
Bad news:
Scheine mir den Trojaner wieder über den internet explorer eingefangen zu haben (leider funktioniert iron mom. nicht richtig)...

Kann ich Deine Anleitung noch einmal 1: 1 anwenden?

Hab heute erst noch einmal alle scans durchlaufen lassen:

DDS:
attach file:
Code:
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.DDS Logfile:
DDS Logfile:
DDS Logfile:

       
Code:

       
DDS (Ver_2011-08-26.01)
.
Microsoft Windows 7 Ultimate
Boot Device: \Device\HarddiskVolume3
Install Date: 13.10.2011 19:55:40
System Uptime: 06.04.2012 12:50:22 (2 hours ago)
.
Motherboard: Dell Inc. |  | 0FP441
Processor: Intel(R) Core(TM)2 Duo CPU     T7300  @ 2.00GHz | Microprocessor | 1994/200mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 99 GiB total, 6,37 GiB free.
D: is FIXED (NTFS) - 112 GiB total, 4,419 GiB free.
E: is FIXED (NTFS) - 10 GiB total, 6,233 GiB free.
F: is CDROM ()
.
==== Disabled Device Manager Items =============
.
Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Description: Security Processor Loader Driver
Device ID: ROOT\LEGACY_SPLDR\0000
Manufacturer:
Name: Security Processor Loader Driver
PNP Device ID: ROOT\LEGACY_SPLDR\0000
Service: spldr
.
Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Description: avast! Network Shield Support
Device ID: ROOT\LEGACY_ASWTDI\0000
Manufacturer:
Name: avast! Network Shield Support
PNP Device ID: ROOT\LEGACY_ASWTDI\0000
Service: aswTdi
.
==== System Restore Points ===================
.
RP126: 03.04.2012 21:14:08 - Windows Update
.
==== Installed Programs ======================
.
7-Zip 9.20
Audacity 1.3.14 (Unicode)
avast! Free Antivirus
Biet-O-Matic v2.14.8
CDBurnerXP
dBpoweramp DSP Effects
dBpoweramp Music Converter
DVD-lab PRO 2.51
DVD Flick 1.3.0.7
DVDStyler v2.1
ESET Online Scanner v3
EVEREST Home Edition v2.20
Facemoods Toolbar
FileZilla Client 3.5.1
Foxit Reader 5.0
Google Chrome
Google Update Helper
ID3-TagIT 3
Image Resizer for Windows
ImageShack Uploader 2.2.0
IrfanView (remove only)
Java Auto Updater
Java(TM) 6 Update 31
JDownloader 0.9
Light Image Resizer 4.0.9.8
Malwarebytes Anti-Malware Version 1.60.1.1000
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319
NVIDIA 3D Vision Controller Driver
NVIDIA PhysX
NVIDIA Stereoscopic 3D Driver
Nvu 0.8.1
OpenOffice.org 3.3
Picasa 3
RICOH R5C83x/84x Flash Media Controller Driver Ver.3.57.01
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile DEU Language Pack (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile DEU Language Pack (KB2518870)
SRWare Iron 14.0.850.0
STOIK Smart Resizer 3
UltraStar Deluxe
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
VLC media player 1.1.11
XBMC
.
==== End Of File ===========================


DDS:

       
Code:

       
.
DDS (Ver_2011-08-26.01) - NTFSAMD64 NETWORK
Internet Explorer: 9.0.8112.16421
Run by dosenbier at 14:09:20 on 2012-04-06
Microsoft Windows 7 Ultimate   6.1.7601.1.1252.49.1031.18.2046.1547 [GMT 2:00]
.
AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\Explorer.EXE
C:\Windows\system32\ctfmon.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\conhost.exe
C:\Windows\SysWOW64\cscript.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://startpage.com/babylon/deu/
uInternet Settings,ProxyOverride = local
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
uRun: [SkypePM] C:\Users\dosenbier\AppData\Local\Skype\SkypePM.exe
mRun: [OEM02Mon.exe] C:\Windows\OEM02Mon.exe
mRun: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
StartupFolder: C:\Users\DOSENB~1\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\OPENOF~1.LNK - C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Add to Google Photos Screensa&ver - C:\Windows\system32\GPhotos.scr/200
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
TCP: Interfaces\{4BCBD830-6CB1-417F-AF20-8897E68BE9FB} : NameServer = 192.168.2.1
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}
{DBC80044-A445-435b-BC74-9C25C1C588A9}
{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}
mRun-x64: [OEM02Mon.exe] C:\Windows\OEM02Mon.exe
mRun-x64: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun-x64: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
.
============= SERVICES / DRIVERS ===============
.
R0 oem-drv64;OEM-SLP2.1 Driver (HPD64);C:\Windows\system32\DRIVERS\oem-drv64.sys --> C:\Windows\system32\DRIVERS\oem-drv64.sys [?]
R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]
R3 bcm44amd64;Broadcom 440x 10/100-integrierter Controller-XP-Treiber;C:\Windows\system32\DRIVERS\b44amd64.sys --> C:\Windows\system32\DRIVERS\b44amd64.sys [?]
R3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series - Adaptertreiber für Windows Vista 64 Bit;C:\Windows\system32\DRIVERS\netw5v64.sys --> C:\Windows\system32\DRIVERS\netw5v64.sys [?]
S1 aswSnx;aswSnx;C:\Windows\system32\drivers\aswSnx.sys --> C:\Windows\system32\drivers\aswSnx.sys [?]
S1 aswSP;aswSP;C:\Windows\system32\drivers\aswSP.sys --> C:\Windows\system32\drivers\aswSP.sys [?]
S2 aswFsBlk;aswFsBlk;C:\Windows\system32\drivers\aswFsBlk.sys --> C:\Windows\system32\drivers\aswFsBlk.sys [?]
S2 aswMonFlt;aswMonFlt;\??\C:\Windows\system32\drivers\aswMonFlt.sys --> C:\Windows\system32\drivers\aswMonFlt.sys [?]
S2 avast! Antivirus;avast! Antivirus;C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2012-3-22 44768]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 gupdate;Google Update-Dienst (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-3-23 136176]
S2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-3-30 652360]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-8-3 379496]
S3 avmaudio;AVM Audio;C:\Windows\system32\DRIVERS\avmaudio.sys --> C:\Windows\system32\DRIVERS\avmaudio.sys [?]
S3 dmvsc;dmvsc;C:\Windows\system32\drivers\dmvsc.sys --> C:\Windows\system32\drivers\dmvsc.sys [?]
S3 gupdatem;Google Update-Dienst (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-3-23 136176]
S3 MBAMProtector;MBAMProtector;\??\C:\Windows\system32\drivers\mbam.sys --> C:\Windows\system32\drivers\mbam.sys [?]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\system32\drivers\rdpvideominiport.sys --> C:\Windows\system32\drivers\rdpvideominiport.sys [?]
S3 SrvHsfHDA;SrvHsfHDA;C:\Windows\system32\DRIVERS\VSTAZL6.SYS --> C:\Windows\system32\DRIVERS\VSTAZL6.SYS [?]
S3 SrvHsfV92;SrvHsfV92;C:\Windows\system32\DRIVERS\VSTDPV6.SYS --> C:\Windows\system32\DRIVERS\VSTDPV6.SYS [?]
S3 SrvHsfWinac;SrvHsfWinac;C:\Windows\system32\DRIVERS\VSTCNXT6.SYS --> C:\Windows\system32\DRIVERS\VSTCNXT6.SYS [?]
S3 Synth3dVsc;Microsoft Virtual 3D Video Transport Driver;C:\Windows\system32\drivers\Synth3dVsc.sys --> C:\Windows\system32\drivers\Synth3dVsc.sys [?]
S3 terminpt;Microsoft Remote Desktop Input Driver;C:\Windows\system32\drivers\terminpt.sys --> C:\Windows\system32\drivers\terminpt.sys [?]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]
S3 TsUsbGD;%TsUsbGD.DeviceDesc.Generic%;C:\Windows\system32\drivers\TsUsbGD.sys --> C:\Windows\system32\drivers\TsUsbGD.sys [?]
S3 tsusbhub;Remote Deskotop USB Hub;C:\Windows\system32\drivers\tsusbhub.sys --> C:\Windows\system32\drivers\tsusbhub.sys [?]
.
=============== Created Last 30 ================
.
2012-04-05 17:21:55        --------        d-----w-        C:\Program Files\CCleaner
2012-04-04 20:12:20        --------        d-sh--w-        C:\$RECYCLE.BIN
2012-04-04 19:47:46        98816        ----a-w-        C:\Windows\sed.exe
2012-04-04 19:47:46        518144        ----a-w-        C:\Windows\SWREG.exe
2012-04-04 19:47:46        256000        ----a-w-        C:\Windows\PEV.exe
2012-04-04 19:47:46        208896        ----a-w-        C:\Windows\MBR.exe
2012-04-03 19:15:15        8669240        ----a-w-        C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{7D8250CF-4386-4FC5-89D1-B72BB7C17546}\mpengine.dll
2012-04-03 19:02:36        --------        d-----w-        C:\_OTL
2012-03-30 20:35:53        --------        d-----w-        C:\Program Files (x86)\ESET
2012-03-30 19:12:49        --------        d-----w-        C:\Users\dosenbier\AppData\Roaming\Malwarebytes
2012-03-30 19:12:44        23152        ----a-w-        C:\Windows\System32\drivers\mbam.sys
2012-03-30 19:12:44        --------        d-----w-        C:\ProgramData\Malwarebytes
2012-03-30 19:12:44        --------        d-----w-        C:\Program Files (x86)\Malwarebytes' Anti-Malware
2012-03-22 17:38:39        53080        ----a-w-        C:\Windows\System32\drivers\aswRdr2.sys
2012-03-14 12:03:31        3145728        ----a-w-        C:\Windows\System32\win32k.sys
2012-03-14 12:03:29        1544192        ----a-w-        C:\Windows\System32\DWrite.dll
2012-03-14 12:03:28        1077248        ----a-w-        C:\Windows\SysWow64\DWrite.dll
2012-03-14 12:02:13        9216        ----a-w-        C:\Windows\System32\rdrmemptylst.exe
2012-03-14 12:02:13        77312        ----a-w-        C:\Windows\System32\rdpwsx.dll
2012-03-14 12:02:13        149504        ----a-w-        C:\Windows\System32\rdpcorekmts.dll
2012-03-14 12:02:12        1112064        ----a-w-        C:\Windows\System32\rdpcorets.dll
2012-03-14 12:02:11        826880        ----a-w-        C:\Windows\SysWow64\rdpcore.dll
2012-03-14 12:02:11        23552        ----a-w-        C:\Windows\System32\drivers\tdtcp.sys
2012-03-14 12:02:11        210944        ----a-w-        C:\Windows\System32\drivers\rdpwd.sys
2012-03-14 12:02:11        1031680        ----a-w-        C:\Windows\System32\rdpcore.dll
.
==================== Find3M  ====================
.
2012-04-06 10:50:28        42496        ----a-w-        C:\Windows\System32\drivers\oem-drv64.sys
2012-03-25 11:16:46        414368        ----a-w-        C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2012-03-23 22:29:13        472808        ----a-w-        C:\Windows\SysWow64\deployJava1.dll
2012-03-07 00:15:19        41184        ----a-w-        C:\Windows\avastSS.scr
2012-03-07 00:04:06        819032        ----a-w-        C:\Windows\System32\drivers\aswSnx.sys
2012-03-07 00:01:52        69976        ----a-w-        C:\Windows\System32\drivers\aswMonFlt.sys
2012-02-23 08:18:36        279656        ------w-        C:\Windows\System32\MpSigStub.exe
2012-01-20 01:13:07        4022504        ----a-w-        C:\Windows\SysWow64\SpoonUninstall.exe
2011-04-23 20:10:03        22333089        ----a-w-        C:\Program Files\Nero.Burning.ROM.v.10.6.3.100.exe
2010-07-29 10:57:00        2983429        ----a-w-        C:\Program Files\Winamp_2.95_mini_portable.exe
2010-07-29 10:57:00        2983429        ----a-w-        C:\Program Files (x86)\Winamp_2.95_mini_portable.exe
.
============= FINISH: 14:10:21,92 ===============

--- --- ---

--- --- ---

--- --- ---
Malwarebytes:
Code:

Malwarebytes Anti-Malware (Test) 1.60.1.1000
www.malwarebytes.org

Datenbank Version: v2012.04.06.02

Windows 7 Service Pack 1 x64 NTFS (Abgesichertenmodus/Netzwerkfähig)
Internet Explorer 9.0.8112.16421
dosenbier :: LAPTOP [Administrator]

Schutz: Deaktiviert

06.04.2012 14:53:11
mbam-log-2012-04-06 (16-06-54) - fullscan

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 438152
Laufzeit: 1 Stunde(n), 6 Minute(n), 18 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 2
C:\_OTL\MovedFiles\04032012_210236\C_Users\dosenbier\AppData\Local\Skype\SkypePM.exe (Trojan.Ransom) -> Keine Aktion durchgeführt.
C:\Users\dosenbier\AppData\Local\Temp\ch8l0.exe (Exploit.Drop) -> Keine Aktion durchgeführt.

(Ende)
ESET:

Code:

[coESETSmartInstaller@High as CAB hook log:
OnlineScanner64.ocx - registred OK
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=d064ed7023c2814f8a7d4876cbddb606
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-03-30 10:27:01
# local_time=2012-03-31 12:27:01 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776573 100 94 42391 84770158 0 0
# compatibility_mode=8192 67108863 100 0 555 555 0 0
# scanned=265321
# found=3
# cleaned=0
# scan_time=4140
C:\Users\dosenbier\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J3TY201U\697463092ebcda42a52f83e306a7c1e3[1].htm        HTML/ScrInject.B.Gen virus (unable to clean)        00000000000000000000000000000000        I
C:\Users\dosenbier\AppData\Local\Temp\jar_cache6261645628767445033.tmp        Java/Exploit.CVE-2012-0507.D trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\dosenbier\AppData\Local\TempDIR\BetterInstaller.exe        Win32/Adware.Somoto.A application (unable to clean)        00000000000000000000000000000000        I
esets_scanner_update returned -1 esets_gle=53251
# version=7
# iexplore.exe=9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-03-31 05:06:35
# local_time=2012-03-31 07:06:35 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776573 100 94 111106 84838873 0 0
# compatibility_mode=8192 67108863 100 0 69270 69270 0 0
# scanned=264372
# found=3
# cleaned=0
# scan_time=4572
C:\Users\dosenbier\AppData\Local\Skype\SkypePM.exe        Win32/LockScreen.AIG trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\dosenbier\AppData\Local\Temp\jar_cache6261645628767445033.tmp        Java/Exploit.CVE-2012-0507.D trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\dosenbier\AppData\Local\Temp\jar_cache6392414300976716270.tmp        Java/TrojanDownloader.Agent.NDR trojan (unable to clean)        00000000000000000000000000000000        I
# version=7
# iexplore.exe=9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-04-06 04:09:21
# local_time=2012-04-06 06:09:21 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776573 100 94 2455 85353982 0 0
# compatibility_mode=8192 67108863 100 0 584379 584379 0 0
# scanned=263056
# found=2
# cleaned=0
# scan_time=4431
C:\Users\dosenbier\AppData\Local\Skype\SkypePM.exe        Win32/LockScreen.AIG trojan (unable to clean)        00000000000000000000000000000000        I
C:\_OTL\MovedFiles.zip        Win32/LockScreen.AIG trojan (unable to clean)        00000000000000000000000000000000        I
de]


Alle Zeitangaben in WEZ +1. Es ist jetzt 08:21 Uhr.
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131