Trojaner-Board - Habe mir Österreich-Version des Polizei-Trojaners eingefangen

Hallo t'john,

hier ist das logfile ComboFix.txt:

Code:

ComboFix 12-08-05.02 - Chris 06.08.2012   8:52.1.2 - x86

Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.43.1031.18.1015.282 [GMT 2:00]

ausgeführt von:: c:\users\Chris\Desktop\ComboFix.exe

AV: BullGuard Antivirus *Disabled/Outdated* {C3CCAC61-52F7-A056-1860-6406566E2578}

FW: BullGuard Firewall *Disabled* {FBF72D44-1898-A10E-333F-CD33A8BD6203}

SP: BullGuard Antispyware *Disabled/Outdated* {78AD4D85-74CD-AFD8-22D0-5F742DE96FC5}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

Die folgenden Dateien wurden während des Laufs deaktiviert:

c:\program files\aon\aonDialerControl\m2dialfunction.dll

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\windows\iun6002.exe

.

.

(((((((((((((((((((((((   Dateien erstellt von 2012-07-06 bis 2012-08-06  ))))))))))))))))))))))))))))))

.

.

2012-08-06 07:03 . 2012-08-06 07:04        --------        d-----w-        c:\users\Chris\AppData\Local\temp

2012-08-06 07:03 . 2012-08-06 07:03        --------        d-----w-        c:\users\Default\AppData\Local\temp

2012-08-03 11:11 . 2012-08-03 11:11        --------        d-----w-        c:\program files\Common Files\Java

2012-08-03 11:10 . 2012-08-03 11:10        --------        d-----w-        c:\program files\Oracle

2012-08-03 11:09 . 2012-07-05 20:06        772544        ----a-w-        c:\windows\system32\npDeployJava1.dll

2012-07-27 14:44 . 2012-07-27 14:44        --------        d-----w-        C:\_OTL

2012-07-25 14:38 . 2012-07-25 14:38        --------        d-----w-        c:\users\Chris\AppData\Roaming\Malwarebytes

2012-07-25 14:38 . 2012-07-25 14:38        --------        d-----w-        c:\programdata\Malwarebytes

2012-07-25 14:38 . 2012-07-26 05:36        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware

2012-07-25 14:38 . 2012-07-03 11:46        22344        ----a-w-        c:\windows\system32\drivers\mbam.sys

2012-07-24 15:13 . 2008-01-02 15:37        192512        ----a-w-        c:\windows\system32\igfxres.dll

2012-07-24 14:40 . 2012-07-24 15:18        --------        d-----w-        c:\users\Chris\AppData\Local\NPE

2012-07-24 14:40 . 2012-07-24 14:40        --------        d-----w-        c:\programdata\Norton

2012-07-23 08:47 . 2012-07-23 08:47        --------        d-----w-        c:\program files\Common Files\BullGuard Ltd

2012-07-23 08:47 . 2012-07-23 08:47        --------        d-----w-        c:\program files\BullGuard Ltd

2012-07-22 03:10 . 2012-06-13 13:40        2047488        ----a-w-        c:\windows\system32\win32k.sys

2012-07-22 00:30 . 2012-07-22 00:30        56200        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{E4C6A3E0-E2B9-42DF-A30C-C83C8D0A7B2D}\offreg.dll

2012-07-21 12:03 . 2012-06-29 08:44        6891424        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{E4C6A3E0-E2B9-42DF-A30C-C83C8D0A7B2D}\mpengine.dll

2012-07-21 11:56 . 2012-06-05 16:47        708608        ----a-w-        c:\program files\Common Files\System\ado\msado15.dll

2012-07-21 11:56 . 2012-06-05 16:47        1401856        ----a-w-        c:\windows\system32\msxml6.dll

2012-07-21 11:56 . 2012-06-05 16:47        1248768        ----a-w-        c:\windows\system32\msxml3.dll

2012-07-21 11:56 . 2012-06-04 15:26        440704        ----a-w-        c:\windows\system32\drivers\ksecdd.sys

2012-07-21 11:56 . 2012-06-02 00:03        204288        ----a-w-        c:\windows\system32\ncrypt.dll

2012-07-21 11:56 . 2012-06-02 00:04        278528        ----a-w-        c:\windows\system32\schannel.dll

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-08-03 07:25 . 2012-04-16 05:56        426184        ----a-w-        c:\windows\system32\FlashPlayerApp.exe

2012-08-03 07:25 . 2011-06-06 06:00        70344        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl

2012-06-15 07:45 . 2012-06-15 07:45        61152        ----a-w-        c:\windows\system32\drivers\BdSpy.sys

2012-06-15 07:45 . 2012-06-15 07:45        308296        ----a-w-        c:\windows\system32\drivers\Trufos.sys

2012-06-15 07:45 . 2012-06-15 07:45        216136        ----a-w-        c:\windows\system32\drivers\NSKernel.sys

2012-06-15 07:45 . 2012-06-15 07:45        20040        ----a-w-        c:\windows\system32\drivers\NSNetmon.sys

2012-06-15 07:44 . 2012-06-15 07:44        339584        ----a-w-        c:\windows\system32\drivers\afwcore.sys

2012-06-15 07:44 . 2012-06-15 07:44        33920        ----a-w-        c:\windows\system32\drivers\afw.sys

2012-06-02 22:19 . 2012-06-21 11:21        53784        ----a-w-        c:\windows\system32\wuauclt.exe

2012-06-02 22:19 . 2012-06-21 11:21        45080        ----a-w-        c:\windows\system32\wups2.dll

2012-06-02 22:19 . 2012-06-21 11:20        35864        ----a-w-        c:\windows\system32\wups.dll

2012-06-02 22:19 . 2012-06-21 11:20        577048        ----a-w-        c:\windows\system32\wuapi.dll

2012-06-02 22:19 . 2012-06-21 11:21        1933848        ----a-w-        c:\windows\system32\wuaueng.dll

2012-06-02 22:12 . 2012-06-21 11:21        2422272        ----a-w-        c:\windows\system32\wucltux.dll

2012-06-02 22:12 . 2012-06-21 11:20        88576        ----a-w-        c:\windows\system32\wudriver.dll

2012-06-02 13:19 . 2012-06-21 11:18        171904        ----a-w-        c:\windows\system32\wuwebv.dll

2012-06-02 13:12 . 2012-06-21 11:18        33792        ----a-w-        c:\windows\system32\wuapp.exe

2012-05-31 10:25 . 2009-10-05 12:05        237072        ------w-        c:\windows\system32\MpSigStub.exe

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]

"aonUpdate"="c:\program files\aon\aonUpdate\aonUpdate.exe" [2005-07-26 4003328]

"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]

"PhonostarAgent"="c:\program files\phonostar\ps_agent.exe" [2008-07-14 98304]

"PhonostarTimer"="c:\program files\phonostar\ps_timer.exe" [2008-07-14 126976]

"acSecurityLayer"="c:\program files\A-Trust GmbH\Bürgerkartensoftware\acSecurityLayer.exe" [2010-05-07 3331232]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-20 39408]

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-12-23 143360]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"1aonmessagecenter"="c:\program files\aon\aonMessageCenter\aonMessageCenter.exe" [2005-02-14 676352]

"aonDialerControl"="c:\program files\aon\aonDialerControl\aonDialerControl.exe" [2005-09-28 2627584]

"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-11-08 220160]

"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-01-02 141848]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-01-02 166424]

"Persistence"="c:\windows\system32\igfxpers.exe" [2008-01-02 133656]

"diagnostics"="c:\program files\Thomson\ST330\diagnostics\diagnostics.exe" [2008-07-21 557149]

"Controller"="c:\program files\A1 Telekom Austria\Controller\Controller.exe" [2011-03-29 13663600]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]

"BullGuard"="c:\program files\BullGuard Ltd\BullGuard\BullGuard.exe" [2012-07-30 1756000]

"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-07-03 462920]

.

c:\users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

a.sign Client.lnk - c:\program files\A-Trust GmbH\a.sign Client\acLauncher.exe [2009-12-22 1008800]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll c:\windows\System32\BgGamingMonitor.dll c:\windows\System32\BgGamingMonitor.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"mixer1"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\BsMain]

@="Service"

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\BsScanner]

@="Service"

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]

@="Service"

.

R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x]

S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [x]

S3 3xHybrid;Philips SAA713x PCI Card;c:\windows\system32\DRIVERS\3xHybrid.sys [x]

.

.

--- Andere Dienste/Treiber im Speicher ---

.

*Deregistered* - BdFileSpy

*Deregistered* - mchInjDrv

*Deregistered* - Reconn

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceAndNoImpersonation        REG_MULTI_SZ           FontCache

BullGuard_Main        REG_MULTI_SZ           BsMain

BullGuard        REG_MULTI_SZ           BsFileScan BsFire

BullGuard_Proxy        REG_MULTI_SZ           BsMailProxy

BullGuard_Backup        REG_MULTI_SZ           BsBackup

.

Inhalt des "geplante Tasks" Ordners

.

2012-08-06 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-16 07:25]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = about:blank

LSP: c:\windows\system32\BGLsp.dll

TCP: DhcpNameServer = 10.0.0.138

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

SafeBoot-WudfPf

SafeBoot-WudfRd

AddRemove-Pixelspeed_LayouterH - c:\windows\iun6002.exe

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net

Rootkit scan 2012-08-06 09:03

Windows 6.0.6002 Service Pack 2 NTFS

.

Scanne versteckte Prozesse... 

.

Scanne versteckte Autostarteinträge... 

.

Scanne versteckte Dateien... 

.

Scan erfolgreich abgeschlossen

versteckte Dateien: 0

.

**************************************************************************

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\aonDialerControll]

"ImagePath"="c:\program files\aon\aonDialerControl\aonDialerControllS.exe /startedbyscm:193B979E-40E2BDD3-NTService1"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\st330service]

"ImagePath"="C:\Program Files/Thomson/ST330/service/st330service.exe -service"

.

--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

.

- - - - - - - > 'winlogon.exe'(668)

c:\program files\aon\aonDialerControl\m2dialfunction.dll

.

- - - - - - - > 'lsass.exe'(624)

c:\program files\aon\aonDialerControl\m2dialfunction.dll

.

Zeit der Fertigstellung: 2012-08-06  09:10:14

ComboFix-quarantined-files.txt  2012-08-06 07:10

.

Vor Suchlauf: 10 Verzeichnis(se), 252.477.661.184 Bytes frei

Nach Suchlauf: 16 Verzeichnis(se), 252.425.531.392 Bytes frei

.

- - End Of File - - 72AC7BD6A59DE99F84E1525F726E42F1

Und hier die zweite Datei:

Code:

Update for Microsoft Office 2007 (KB2508958)

a.sign Bürgerkartensoftware 1.3.0.3c

a.sign Client 1.2.7.5

Activation Assistant for the 2007 Microsoft Office suites

Adobe Flash Player 11 ActiveX

Adobe Flash Player Plugin

Adobe Reader X (10.1.3) - Deutsch

Adobe Shockwave Player 11

aonDialerControl

aonFTP

aonMessageCenter

aonUpdate

asignPDFverify 1.0.5.0

Attansic L2 Fast Ethernet Driver

Bing Bar

BullGuard

Compatibility Pack für 2007 Office System

Controller

D3DX10

Firebird SQL Server - MAGIX Edition 2.0.0.1 (D)

Google Desktop

Google Toolbar for Internet Explorer

Google Update Helper

Haushaltsbuch 2008

Hofer Foto Manager Free 3.4.0.466 (D)

Hofer Foto Service 1.10.1.65 (D)

Hofer Fotobuch und Kalender Druck Service 

Hofer Online Druck Service 3.0.6.0 (D)

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)

Intel(R) Graphics Media Accelerator Driver

Java Auto Updater

Java(TM) 7 Update 5

JavaFX 2.1.1

Junk Mail filter update

LightScribe  1.4.124.1

MakeDisc

Malwarebytes Anti-Malware Version 1.62.0.1300

MCE Software Encoder 1.1

MediaShow

MEDION Fotos auf CD Hofer 6.0.2.0 (D)

Mesh Runtime

Messenger Companion

Microsoft .NET Framework 3.5 Language Pack SP1 - DEU

Microsoft .NET Framework 3.5 SP1

Microsoft .NET Framework 4 Client Profile

Microsoft .NET Framework 4 Client Profile DEU Language Pack

Microsoft Application Error Reporting

Microsoft Mathe 3.0

Microsoft Office 2007 Service Pack 3 (SP3)

Microsoft Office Excel MUI (German) 2007

Microsoft Office File Validation Add-In

Microsoft Office Home and Student 2007

Microsoft Office Live Add-in 1.5

Microsoft Office OneNote MUI (German) 2007

Microsoft Office PowerPoint MUI (German) 2007

Microsoft Office PowerPoint Viewer 2007 (German)

Microsoft Office Proof (English) 2007

Microsoft Office Proof (French) 2007

Microsoft Office Proof (German) 2007

Microsoft Office Proof (Italian) 2007

Microsoft Office Proofing (German) 2007

Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

Microsoft Office Shared MUI (German) 2007

Microsoft Office Visio Viewer 2007

Microsoft Office Word MUI (German) 2007

Microsoft Silverlight

Microsoft SQL Server 2005 Compact Edition [ENU]

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219

Microsoft Works

Microsoft XML Parser

MSVCRT

MSXML 4.0 SP2 (KB925672)

MSXML 4.0 SP2 (KB927978)

MSXML 4.0 SP2 (KB936181)

MSXML 4.0 SP2 (KB941833)

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

Nero 7 Essentials

OGA Notifier 2.0.0048.0

phonostar-Player Version 2.01.4

PhotoNow! 1.0

PowerDirector

PowerDVD

PowerProducer

Realtek High Definition Audio Driver

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)

Security Update for Microsoft .NET Framework 4 Client Profile DEU Language Pack (KB2478663)

Security Update for Microsoft .NET Framework 4 Client Profile DEU Language Pack (KB2518870)

Security Update for Microsoft Office 2007 suites (KB2596672) 32-Bit Edition 

Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition 

Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596880) 32-Bit Edition 

Security Update for Microsoft Office 2007 suites (KB2597162) 32-Bit Edition 

Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2598041) 32-Bit Edition

Security Update for Microsoft Office Excel 2007 (KB2597161) 32-Bit Edition 

Security Update for Microsoft Office InfoPath 2007 (KB2596786) 32-Bit Edition 

Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition

Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition

Security Update for Microsoft Office Word 2007 (KB2596917) 32-Bit Edition 

Segoe UI

SopCast 3.2.4

SpeedTouch 330

Spelling Dictionaries Support For Adobe Reader 8

trustDesk basic

TVUPlayer 2.4.7.2

Ulead PhotoImpact 12

Update für Microsoft Office Excel 2007 Help (KB963678)

Update für Microsoft Office Powerpoint 2007 Help (KB963669)

Update für Microsoft Office Word 2007 Help (KB963665)

Update for 2007 Microsoft Office System (KB967642)

Update for Microsoft .NET Framework 3.5 SP1 (KB963707)

Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

Update for Microsoft .NET Framework 4 Client Profile (KB2600217)

Windows Live Communications Platform

Windows Live Essentials

Windows Live Family Safety

Windows Live Fotogalerie

Windows Live ID Sign-in Assistant

Windows Live Installer

Windows Live Mail

Windows Live Mesh

Windows Live Mesh ActiveX control for remote connections

Windows Live Messenger

Windows Live Messenger Companion Core

Windows Live MIME IFilter

Windows Live Movie Maker

Windows Live Photo Common

Windows Live Photo Gallery

Windows Live PIMT Platform

Windows Live Remote Client

Windows Live Remote Client Resources

Windows Live Remote Service

Windows Live Remote Service Resources

Windows Live SOXE

Windows Live SOXE Definitions

Windows Live UX Platform

Windows Live UX Platform Language Pack

Windows Live Writer

Windows Live Writer Resources

X10 Hardware(TM)

Bitte um weitere Anweisungen - vielen Dank!
mfg Adriano44