100 Tan Trojaner

uttella

Hallo,

hatte vor zwei Tagen den 100 Tan Trojaner am Laptop. Wurde schon öfter bschrieben. Es erscheint nach Eingabe der Login Daten ein Popup mit der Aufforderung 100 Tans einzugeben. Läöst sich auch nicht wegklicken. Avira Freeware fand ihn nicht.
Habe dann Malewarebytes durchlaufen lassen. Es wurden 7 infizierte Orte gefunden. Nach dem Löschen war der Trojaner dann weg. Inzwischen habe ich sämtliche Passwörter geändert.
Meine Frage: Bin ich nun sicher oder muss ich System neu aufsetzen?

Hier die Log Datei
Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Datenbank Version: 8210

Windows 6.0.6002 Service Pack 2
Internet Explorer 9.0.8112.16421

21.11.2011 20:38:21
mbam-log-2011-11-21 (20-37-41).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 187545
Laufzeit: 8 Minute(n), 43 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 3
Infizierte Registrierungswerte: 2
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 2
Infizierte Dateien: 9

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_CLASSES_ROOT\CLSID\{C689C99E-3A8C-4c87-A79C-C80DC9C81632} (Trojan.Banker) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C689C99E-3A8C-4C87-A79C-C80DC9C81632} (Trojan.Banker) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Free Registry Cleaner for Vista_is1 (Rogue.FreeRegistryCleanerForVista) -> No action taken.

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Userinit (Malware.Gen) -> Value: Userinit -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{5DC3DC96-99A1-7F67-D792-706463EB81AC} (Trojan.Ransom) -> Value: {5DC3DC96-99A1-7F67-D792-706463EB81AC} -> No action taken.

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
c:\program files\free registry cleaner for vista (Rogue.FreeRegistryCleanerForVista) -> No action taken.
c:\programdata\microsoft\Windows\start menu\Programs\free registry cleaner for vista (Rogue.FreeRegistryCleanerForVista) -> No action taken.

Infizierte Dateien:
c:\Users\utti\AppData\Roaming\appconf32.exe (Malware.Gen) -> No action taken.
c:\Users\utti\AppData\Roaming\Babew\udlanoz.exe (Trojan.Ransom) -> No action taken.
c:\Users\utti\AppData\Roaming\acroiehelpe.dll (Trojan.Banker) -> No action taken.
c:\program files\free registry cleaner for vista\backuphkcu.reg (Rogue.FreeRegistryCleanerForVista) -> No action taken.
c:\program files\free registry cleaner for vista\regcleanerforvista.exe (Rogue.FreeRegistryCleanerForVista) -> No action taken.
c:\program files\free registry cleaner for vista\unins000.dat (Rogue.FreeRegistryCleanerForVista) -> No action taken.
c:\program files\free registry cleaner for vista\unins000.exe (Rogue.FreeRegistryCleanerForVista) -> No action taken.
c:\programdata\microsoft\Windows\start menu\Programs\free registry cleaner for vista\free registry cleaner for vista.lnk (Rogue.FreeRegistryCleanerForVista) -> No action taken.
c:\programdata\microsoft\Windows\start menu\Programs\free registry cleaner for vista\uninstall free registry cleaner for vista.lnk (Rogue.FreeRegistryCleanerForVista) -> No action taken.

A fatal error has been detected by the Java Runtime Environment:
#
# EXCEPTION_ACCESS_VIOLATION (0xc0000005) at pc=0x00000005, pid=4988, tid=2796
#
# JRE version: 6.0_26-b03
# Java VM: Java HotSpot(TM) Client VM (20.1-b02 mixed mode, sharing windows-x86 )
# Problematic frame:
# C 0x00000005
#
# If you would like to submit a bug report, please visit:
# hxxp://java.sun.com/webapps/bugreport/crash.jsp
# The crash happened outside the Java Virtual Machine in native code.
# See problematic frame for where to report the bug.
#

--------------- T H R E A D ---------------

Current thread (0x04420c00): JavaThread "AWT-Windows" daemon [_thread_in_native, id=2796, stack(0x047e0000,0x04830000)]

siginfo: ExceptionCode=0xc0000005, reading address 0x00000005

Registers:
EAX=0x0440fe98, EBX=0x00000001, ECX=0x044bbca8, EDX=0x00000004
ESP=0x0482f9bc, EBP=0x0482f9e8, ESI=0x04420d28, EDI=0x044bbca8
EIP=0x00000005, EFLAGS=0x00010293

Top of Stack: (sp=0x0482f9bc)
0x0482f9bc: 6d09cb90 0482fa64 0000981a 00000000
0x0482f9cc: 0482fa64 0482fb1c 04420d28 0482f9c0
0x0482f9dc: 0482fa7c 6d0c04a8 00000001 0482fa14
0x0482f9ec: 772efd72 000f0a7e 0000981a 044bbca8
0x0482f9fc: 00000000 0000981a dcbaabcd 00000000
0x0482fa0c: 0482fa64 0000981a 0482fa8c 772efe4a
0x0482fa1c: 6d09c650 000f0a7e 0000981a 044bbca8
0x0482fa2c: 00000000 be333dcb 0482fb24 0482fb1c

Instructions: (pc=0x00000005)
0xffffffe5:


Register to memory mapping:

EAX=0x0440fe98 is an unknown value
EBX=0x00000001 is an unknown value
ECX=0x044bbca8 is an unknown value
EDX=0x00000004 is an unknown value
ESP=0x0482f9bc is pointing into the stack for thread: 0x04420c00
EBP=0x0482f9e8 is pointing into the stack for thread: 0x04420c00
ESI=0x04420d28 is an unknown value
EDI=0x044bbca8 is an unknown value


Stack: [0x047e0000,0x04830000], sp=0x0482f9bc, free space=318k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
C 0x00000005
C [USER32.dll+0x1fd72] GetWindowLongW+0x4b3
C [USER32.dll+0x1fe4a] GetWindowLongW+0x58b
C [USER32.dll+0x2018d] GetMessageW+0x296
C [USER32.dll+0x2022b] DispatchMessageW+0xf

Java frames: (J=compiled Java code, j=interpreted, Vv=VM code)
j sun.awt.windows.WToolkit.eventLoop()V+0
j sun.awt.windows.WToolkit.run()V+52
j java.lang.Thread.run()V+11
v ~StubRoutines::call_stub

--------------- P R O C E S S ---------------

Java Threads: ( => current thread )
0x0442fc00 JavaThread "Thread-3" daemon [_thread_in_native, id=7800, stack(0x053e0000,0x05430000)]
0x0442c400 JavaThread "Thread-15" [_thread_blocked, id=156, stack(0x052a0000,0x052f0000)]
0x0442d000 JavaThread "Timer-2" [_thread_blocked, id=6700, stack(0x04870000,0x048c0000)]
0x0442f000 JavaThread "AWT-EventQueue-1" [_thread_blocked, id=7424, stack(0x05780000,0x057d0000)]
0x0442ec00 JavaThread "TimerQueue" daemon [_thread_blocked, id=6292, stack(0x05730000,0x05780000)]
0x0442d800 JavaThread "thread applet-com.pfsoft.proftrading.chart.ProQuote.class-1" [_thread_blocked, id=7096, stack(0x05200000,0x05250000)]
0x0442dc00 JavaThread "AWT-EventQueue-2" [_thread_in_native, id=6356, stack(0x05250000,0x052a0000)]
0x0442cc00 JavaThread "Browser Side Object Cleanup Thread" [_thread_blocked, id=8100, stack(0x05160000,0x051b0000)]
0x0442c000 JavaThread "Windows Tray Icon Thread" [_thread_in_native, id=4816, stack(0x04b50000,0x04ba0000)]
0x0442b800 JavaThread "CacheCleanUpThread" daemon [_thread_blocked, id=7656, stack(0x04b00000,0x04b50000)]
0x0442b000 JavaThread "CacheMemoryCleanUpThread" daemon [_thread_blocked, id=2464, stack(0x04ab0000,0x04b00000)]
0x04427000 JavaThread "SysExecutionTheadCreator" daemon [_thread_blocked, id=6728, stack(0x04250000,0x042a0000)]
0x01d36c00 JavaThread "Java Plug-In Heartbeat Thread" [_thread_blocked, id=7380, stack(0x04910000,0x04960000)]
0x04423800 JavaThread "AWT-EventQueue-0" [_thread_blocked, id=3180, stack(0x048c0000,0x04910000)]
=>0x04420c00 JavaThread "AWT-Windows" daemon [_thread_in_native, id=2796, stack(0x047e0000,0x04830000)]
0x0441d000 JavaThread "AWT-Shutdown" [_thread_blocked, id=3400, stack(0x04790000,0x047e0000)]
0x0441c800 JavaThread "Java2D Disposer" daemon [_thread_blocked, id=4040, stack(0x04740000,0x04790000)]
0x01d15400 JavaThread "Timer-0" [_thread_blocked, id=4400, stack(0x04200000,0x04250000)]
0x01ce3400 JavaThread "traceMsgQueueThread" daemon [_thread_blocked, id=7100, stack(0x04020000,0x04070000)]
0x01cc9c00 JavaThread "Low Memory Detector" daemon [_thread_blocked, id=6600, stack(0x03f80000,0x03fd0000)]
0x01cba800 JavaThread "C1 CompilerThread0" daemon [_thread_blocked, id=6340, stack(0x03f30000,0x03f80000)]
0x01cb9400 JavaThread "Attach Listener" daemon [_thread_blocked, id=2624, stack(0x03ee0000,0x03f30000)]
0x01cb6800 JavaThread "Signal Dispatcher" daemon [_thread_blocked, id=7816, stack(0x03e90000,0x03ee0000)]
0x01cb0000 JavaThread "Finalizer" daemon [_thread_blocked, id=3660, stack(0x03e40000,0x03e90000)]
0x01caec00 JavaThread "Reference Handler" daemon [_thread_blocked, id=6456, stack(0x03df0000,0x03e40000)]
0x00b2b000 JavaThread "main" [_thread_blocked, id=6980, stack(0x00330000,0x00380000)]

Other Threads:
0x01c71800 VMThread [stack: 0x03da0000,0x03df0000] [id=6648]
0x01ccb000 WatcherThread [stack: 0x03fd0000,0x04020000] [id=7232]

VM state:not at safepoint (normal execution)

VM Mutex/Monitor currently owned by a thread: None

Heap
def new generation total 4928K, used 2945K [0x24400000, 0x24950000, 0x29950000)
eden space 4416K, 66% used [0x24400000, 0x246dffc0, 0x24850000)
from space 512K, 0% used [0x24850000, 0x24850618, 0x248d0000)
to space 512K, 0% used [0x248d0000, 0x248d0000, 0x24950000)
tenured generation total 10944K, used 7384K [0x29950000, 0x2a400000, 0x34400000)
the space 10944K, 67% used [0x29950000, 0x2a0862c0, 0x2a086400, 0x2a400000)
compacting perm gen total 12288K, used 3311K [0x34400000, 0x35000000, 0x38400000)
the space 12288K, 26% used [0x34400000, 0x3473bfd0, 0x3473c000, 0x35000000)
ro space 10240K, 51% used [0x38400000, 0x3892dff8, 0x3892e000, 0x38e00000)
rw space 12288K, 55% used [0x38e00000, 0x3949c208, 0x3949c400, 0x39a00000)

Code Cache [0x01d40000, 0x01f00000, 0x03d40000)
total_blobs=977 nmethods=765 adapters=147 free_code_cache=31745344 largest_free_block=0

Dynamic libraries:
0x00400000 - 0x00424000 C:\Program Files\Java\jre6\bin\java.exe
0x778e0000 - 0x77a08000 C:\Windows\system32\ntdll.dll
0x76040000 - 0x7611c000 C:\Windows\system32\kernel32.dll
0x77a20000 - 0x77ae6000 C:\Windows\system32\ADVAPI32.dll
0x77810000 - 0x778d3000 C:\Windows\system32\RPCRT4.dll
0x6ea10000 - 0x6ea2e000 C:\Windows\system32\ShimEng.dll
0x75de0000 - 0x75e0c000 C:\Windows\system32\apphelp.dll
0x6afd0000 - 0x6b058000 C:\Windows\AppPatch\AcLayers.DLL
0x772d0000 - 0x7736d000 C:\Windows\system32\USER32.dll
0x77af0000 - 0x77b3b000 C:\Windows\system32\GDI32.dll
0x76120000 - 0x76c31000 C:\Windows\system32\SHELL32.dll
0x774e0000 - 0x7758a000 C:\Windows\system32\msvcrt.dll
0x77480000 - 0x774d9000 C:\Windows\system32\SHLWAPI.dll
0x76f30000 - 0x77075000 C:\Windows\system32\ole32.dll
0x76c40000 - 0x76ccd000 C:\Windows\system32\OLEAUT32.dll
0x75e60000 - 0x75e7e000 C:\Windows\system32\USERENV.dll
0x75e40000 - 0x75e54000 C:\Windows\system32\Secur32.dll
0x6dc90000 - 0x6dcd2000 C:\Windows\system32\WINSPOOL.DRV
0x759e0000 - 0x759f4000 C:\Windows\system32\MPR.dll
0x77280000 - 0x7729e000 C:\Windows\system32\IMM32.DLL
0x76e60000 - 0x76f28000 C:\Windows\system32\MSCTF.dll
0x77a10000 - 0x77a19000 C:\Windows\system32\LPK.DLL
0x77090000 - 0x7710d000 C:\Windows\system32\USP10.dll
0x74d20000 - 0x74ebe000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll
0x7c340000 - 0x7c396000 C:\Program Files\Java\jre6\bin\msvcr71.dll
0x6d7f0000 - 0x6da9f000 C:\Program Files\Java\jre6\bin\client\jvm.dll
0x749b0000 - 0x749e2000 C:\Windows\system32\WINMM.dll
0x74790000 - 0x747ce000 C:\Windows\system32\OLEACC.dll
0x6d7a0000 - 0x6d7ac000 C:\Program Files\Java\jre6\bin\verify.dll
0x6d320000 - 0x6d33f000 C:\Program Files\Java\jre6\bin\java.dll
0x75f10000 - 0x75f17000 C:\Windows\system32\PSAPI.DLL
0x6d7e0000 - 0x6d7ef000 C:\Program Files\Java\jre6\bin\zip.dll
0x6d420000 - 0x6d426000 C:\Program Files\Java\jre6\bin\jp2native.dll
0x6d1d0000 - 0x6d1e3000 C:\Program Files\Java\jre6\bin\deploy.dll
0x758e0000 - 0x759d2000 C:\Windows\system32\CRYPT32.dll
0x75a40000 - 0x75a52000 C:\Windows\system32\MSASN1.dll
0x77110000 - 0x7722a000 C:\Windows\system32\WININET.dll
0x77610000 - 0x77613000 C:\Windows\system32\Normaliz.dll
0x77650000 - 0x77808000 C:\Windows\system32\iertutil.dll
0x77370000 - 0x77480000 C:\Windows\system32\urlmon.dll
0x6d6a0000 - 0x6d6e6000 C:\Program Files\Java\jre6\bin\regutils.dll
0x75640000 - 0x75648000 C:\Windows\system32\VERSION.dll
0x6d600000 - 0x6d613000 C:\Program Files\Java\jre6\bin\net.dll
0x77620000 - 0x7764d000 C:\Windows\system32\WS2_32.dll
0x77080000 - 0x77086000 C:\Windows\system32\NSI.dll
0x755d0000 - 0x7560b000 C:\Windows\system32\mswsock.dll
0x75630000 - 0x75635000 C:\Windows\System32\wship6.dll
0x6d620000 - 0x6d629000 C:\Program Files\Java\jre6\bin\nio.dll
0x6d000000 - 0x6d14b000 C:\Program Files\Java\jre6\bin\awt.dll
0x73880000 - 0x73905000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.6002.18305_none_88f3a38569c2c436\comctl32.dll
0x6e440000 - 0x6e44c000 C:\Windows\system32\DWMAPI.DLL
0x75020000 - 0x7505f000 C:\Windows\system32\uxtheme.dll
0x6d230000 - 0x6d27f000 C:\Program Files\Java\jre6\bin\fontmanager.dll
0x75840000 - 0x75859000 C:\Windows\system32\iphlpapi.dll
0x75800000 - 0x75835000 C:\Windows\system32\dhcpcsvc.DLL
0x75a80000 - 0x75aac000 C:\Windows\system32\DNSAPI.dll
0x757f0000 - 0x757f7000 C:\Windows\system32\WINNSI.DLL
0x757c0000 - 0x757e2000 C:\Windows\system32\dhcpcsvc6.DLL
0x75290000 - 0x75295000 C:\Windows\System32\wshtcpip.dll
0x74610000 - 0x7461f000 C:\Windows\system32\NLAapi.dll
0x6fe00000 - 0x6fe0f000 C:\Windows\system32\napinsp.dll
0x6ee40000 - 0x6ee52000 C:\Windows\system32\pnrpnsp.dll
0x6ee70000 - 0x6ee78000 C:\Windows\System32\winrnr.dll
0x77230000 - 0x77279000 C:\Windows\system32\WLDAP32.dll
0x6f050000 - 0x6f056000 C:\Windows\system32\rasadhlp.dll
0x6d440000 - 0x6d465000 C:\Program Files\Java\jre6\bin\jpeg.dll

VM Arguments:
jvm_args: -D__jvm_launched=33576511845 -Xbootclasspath/a:C:\\PROGRA~1\\Java\\jre6\\lib\\deploy.jar;C:\\PROGRA~1\\Java\\jre6\\lib\\javaws.jar;C:\\PROGRA~1\\Java\\jre6\\lib\\plugin.jar -Dsun.awt.warmup=true -Dsun.plugin2.jvm.args=-D__jvm_launched=33576511845 "-Xbootclasspath/a:C:\\\\PROGRA~1\\\\Java\\\\jre6\\\\lib\\\\deploy.jar;C:\\\\PROGRA~1\\\\Java\\\\jre6\\\\lib\\\\javaws.jar;C:\\\\PROGRA~1\\\\Java\\\\jre6\\\\lib\\\\plu gin.jar" "-Djava.class.path=C:\\\\PROGRA~1\\\\Java\\\\jre6\\\\classes" -Dsun.awt.warmup=true --- --
java_command: sun.plugin2.main.client.PluginMain write_pipe_name=jpi2_pid4948_pipe6,read_pipe_name=jpi2_pid4948_pipe5
Launcher Type: SUN_STANDARD

Environment Variables:
PATH=C:\Program Files\Internet Explorer;;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Program Files\Common Files\Ulead Systems\MPEG;C:\Program Files\Common Files\Apple\Apple Application Support;C:\Program Files\Common Files\Apple\Mobile Device Support;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\Haufe\iDesk\iDeskService\;C:\Program Files\QuickTime\QTSystem\
USERNAME=utti
OS=Windows_NT
PROCESSOR_IDENTIFIER=x86 Family 6 Model 14 Stepping 12, GenuineIntel



--------------- S Y S T E M ---------------

OS: Windows Vista Build 6002 Service Pack 2

CPU:total 2 (2 cores per cpu, 1 threads per core) family 6 model 14 stepping 12, cmov, cx8, fxsr, mmx, sse, sse2, sse3

Memory: 4k page, physical 2086344k(644800k free), swap 4415672k(1109512k free)

vm_info: Java HotSpot(TM) Client VM (20.1-b02) for windows-x86 JRE (1.6.0_26-b03), built on May 4 2011 00:50:59 by "java_re" with MS VC++ 7.1 (VS2003)

time: Wed Nov 09 22:09:50 2011
elapsed time: 4568 seconds