4.)
SHA256: 7bb8f39c547b43ec3f64cef5120b56ca240a0f00092eef7614e9947974d59ca0
SHA1: b1ab2963d2a73143eacd0f31a6df49e7f2c1dcd9
MD5: 06bb6157cdf162709d42b07a1f41625e
File size: 52.1 KB ( 53328 bytes )
File name: appconf32.exe
File type: Win32 EXE
Detection ratio: 7 / 43
Analysis date: 2012-02-29 11:39:49 UTC ( 0 Minuten ago )
0
0
Antivirus Result Update
AhnLab-V3 - 20120228
AntiVir - 20120229
Antiy-AVL - 20120229
Avast Win32:Crypt-LPU [Trj] 20120228
AVG - 20120229
BitDefender - 20120229
ByteHero - 20120225
CAT-QuickHeal - 20120229
ClamAV - 20120229
Commtouch - 20120229
Comodo TrojWare.Win32.Trojan.Agent.Gen 20120229
DrWeb - 20120229
Emsisoft Trojan-Banker.Win32.Agent!IK 20120229
eSafe - 20120227
eTrust-Vet - 20120229
F-Prot - 20120228
F-Secure - 20120229
Fortinet - 20120229
GData Win32:Crypt-LPU 20120229
Ikarus Trojan-Banker.Win32.Agent 20120229
Jiangmin Trojan/Jorik.awvb 20120228
K7AntiVirus - 20120228
Kaspersky Trojan-Banker.Win32.Agent.hkk 20120229
McAfee - 20120229
McAfee-GW-Edition - 20120229
Microsoft - 20120229
NOD32 - 20120229
Norman - 20120228
nProtect - 20120229
Panda - 20120228
PCTools - 20120228
Prevx - 20120229
Rising - 20120228
Sophos - 20120229
SUPERAntiSpyware - 20120229
Symantec - 20120229
TheHacker - 20120228
TrendMicro - 20120229
TrendMicro-HouseCall - 20120229
VBA32 - 20120228
VIPRE - 20120229
ViRobot - 20120229
VirusBuster - 20120229

* Comments
* Additional information

No comments
More comments
Leave your comment...
?
Rich Text Area
Toolbar
Bold (Ctrl+B) Italic (Ctrl+I) Underline (Ctrl+U) Undo (Ctrl+Z) Redo (Ctrl+Y)
StylesStyles ▼
Remove Formatting
Post comment

You have not signed in. Only registered users can leave comments, sign in and have a voice!
Sign in Join the community
An error occurred
ssdeep
768:jr7zmoPT85Z8w/Plslnn9ARdpHGAXmDCfdaV+72kPVddG9t9dnq4t8CNre:j/BPQSamneRdxBQsce2kV6tTq4t8V
TrID
Generic Win/DOS Executable (49.9%)
DOS Executable Generic (49.8%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%)
ExifTool

MIMEType.................: application/octet-stream
Subsystem................: Windows GUI
MachineType..............: Intel 386 or later, and compatibles
TimeStamp................: 2012:02:28 08:55:06+01:00
FileType.................: Win32 EXE
PEType...................: PE32
CodeSize.................: 1024
LinkerVersion............: 5.12
EntryPoint...............: 0x1000
InitializedDataSize......: 51200
SubsystemVersion.........: 4.0
ImageVersion.............: 0.0
OSVersion................: 4.0
UninitializedDataSize....: 0

Portable Executable structural information

PE Sections...................:

Name Virtual Address Virtual Size Raw Size Entropy MD5
.text 4096 821 1024 5.57 cd37e515e8813778f6f7764a54880210
.data 8192 1024 0 0.00 d41d8cd98f00b204e9800998ecf8427e
ridata 12288 16 512 0.20 5cbe31f6694b1a1b7bd8779246ad0742
rxdata 16384 16 512 0.20 27f08c59164bdca7e23e8d1b7d51afc9
kldata 20480 16 512 0.20 f2d555ce6b629fb7fcab0f49a86e27ed
rvdata 24576 48128 48128 6.46 ca67942fcc9489fb5acdcd96b3650912
.rsrc 73728 16 512 0.00 bf619eac0cdf3f68d496ea9344137e8b

First seen by VirusTotal
2012-02-29 11:39:49 UTC ( 0 Minuten ago )
Last seen by VirusTotal
2012-02-29 11:39:49 UTC ( 0 Minuten ago )
File names (max. 25)

1. appconf32.exe

Ist das okay so? Habe ich alles richtig gemacht?

Hier vom ersten nochmal die komplette Analyse. Ich hatte nur das unter additional info kopiert:

SHA256: aa0a8d34d3721d31429186e842099d378290f8c6bccb6a5ae1859c868cef0937
SHA1: acf4d9fbbd8c79b5da7d91ecdb49743693a1ddc9
MD5: 83cb5caac3c97efc702db47ccb82f31b
File size: 5.4 KB ( 5528 bytes )
File name: BAcroIEHelpe.dll
File type: Win32 DLL
Detection ratio: 0 / 43
Analysis date: 2012-02-29 11:42:51 UTC ( 1 Minute ago )
0
0
Antivirus Result Update
AhnLab-V3 - 20120228
AntiVir - 20120229
Antiy-AVL - 20120229
Avast - 20120228
AVG - 20120229
BitDefender - 20120229
ByteHero - 20120225
CAT-QuickHeal - 20120229
ClamAV - 20120229
Commtouch - 20120229
Comodo - 20120229
DrWeb - 20120229
Emsisoft - 20120229
eSafe - 20120227
eTrust-Vet - 20120229
F-Prot - 20120228
F-Secure - 20120229
Fortinet - 20120229
GData - 20120229
Ikarus - 20120229
Jiangmin - 20120228
K7AntiVirus - 20120228
Kaspersky - 20120229
McAfee - 20120229
McAfee-GW-Edition - 20120229
Microsoft - 20120229
NOD32 - 20120229
Norman - 20120228
nProtect - 20120229
Panda - 20120228
PCTools - 20120228
Prevx - 20120229
Rising - 20120228
Sophos - 20120229
SUPERAntiSpyware - 20120229
Symantec - 20120229
TheHacker - 20120228
TrendMicro - 20120229
TrendMicro-HouseCall - 20120229
VBA32 - 20120228
VIPRE - 20120229
ViRobot - 20120229
VirusBuster - 20120229

* Comments
* Additional information

No comments
More comments
Leave your comment...
?
Rich Text Area
Toolbar
Bold (Ctrl+B) Italic (Ctrl+I) Underline (Ctrl+U) Undo (Ctrl+Z) Redo (Ctrl+Y)
StylesStyles ▼
Remove Formatting
Post comment

You have not signed in. Only registered users can leave comments, sign in and have a voice!
Sign in Join the community
An error occurred
ssdeep
48:yaCoWHpadMvN+xYs9n0cKsBZqCyAXkTgNxHr2360MnanaWmwQOXjTYq:2+dMQxnbjqChUTyHr21MnanaW5jTY
TrID
Generic Win/DOS Executable (49.9%)
DOS Executable Generic (49.8%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%)
ExifTool

MIMEType.................: application/octet-stream
Subsystem................: Windows GUI
MachineType..............: Intel 386 or later, and compatibles
TimeStamp................: 2012:02:27 09:44:53+01:00
FileType.................: Win32 DLL
PEType...................: PE32
CodeSize.................: 1024
LinkerVersion............: 5.12
EntryPoint...............: 0x1000
InitializedDataSize......: 3072
SubsystemVersion.........: 4.0
ImageVersion.............: 0.0
OSVersion................: 4.0
UninitializedDataSize....: 0

Portable Executable structural information

PE Sections...................:

Name Virtual Address Virtual Size Raw Size Entropy MD5
.text 4096 834 1024 5.24 4921302b047da473a10dbbfc5347da68
.rdata 8192 537 1024 2.58 d536aef567291ab00218c0e68677337e
.data 12288 1185 512 2.01 097edba434214dc1467a46eaa7506b69
.reloc 16384 112 512 1.41 882028edddc0a9be61e4094328980ac8

PE Imports....................:

advapi32.dll
RegCloseKey

kernel32.dll
GetModuleFileNameA, GetModuleHandleA, VirtualProtect, lstrcmpiA, lstrlenA

shlwapi.dll
SHCopyKeyW

user32.dll
SetWindowsHookExA, UnhookWindowsHookEx, CallNextHookEx


PE Exports....................:

C, l, o, s, e, G, u, a, r, d, ,, , S, e, t, G, u, a, r, d

First seen by VirusTotal
2012-02-27 13:29:25 UTC ( 1 Tag, 22 Stunden ago )
Last seen by VirusTotal
2012-02-29 11:05:24 UTC ( 37 Minuten ago )
File names (max. 25)

1. BAcroIEHelpe.dll
2. file-3603090_dll
3. BAcroIEHelpe079.dll
4. 8903B96E987B8B1F15C4006A13EF050086200C46.dll

So, bin nun bei Schritt 2. Hier ist das Ergebnis des OTL Scans:

Error: Unable to interpret <SHA256: aa0a8d34d3721d31429186e842099d378290f8c6bccb6a5ae1859c868cef0937> in the current context!
Error: Unable to interpret <SHA1: acf4d9fbbd8c79b5da7d91ecdb49743693a1ddc9> in the current context!
Error: Unable to interpret <MD5: 83cb5caac3c97efc702db47ccb82f31b> in the current context!
Error: Unable to interpret <File size: 5.4 KB ( 5528 bytes )> in the current context!
Error: Unable to interpret <File name: BAcroIEHelpe.dll> in the current context!
Error: Unable to interpret <File type: Win32 DLL> in the current context!
Error: Unable to interpret <Detection ratio: 0 / 43> in the current context!
Error: Unable to interpret <Analysis date: 2012-02-29 11:42:51 UTC ( 1 Minute ago )> in the current context!
Error: Unable to interpret <0> in the current context!
Error: Unable to interpret <0> in the current context!
Error: Unable to interpret <Antivirus Result Update> in the current context!
Error: Unable to interpret <AhnLab-V3 - 20120228> in the current context!
Error: Unable to interpret <AntiVir - 20120229> in the current context!
Error: Unable to interpret <Antiy-AVL - 20120229> in the current context!
Error: Unable to interpret <Avast - 20120228> in the current context!
Error: Unable to interpret <AVG - 20120229> in the current context!
Error: Unable to interpret <BitDefender - 20120229> in the current context!
Error: Unable to interpret <ByteHero - 20120225> in the current context!
Error: Unable to interpret <CAT-QuickHeal - 20120229> in the current context!
Error: Unable to interpret <ClamAV - 20120229> in the current context!
Error: Unable to interpret <Commtouch - 20120229> in the current context!
Error: Unable to interpret <Comodo - 20120229> in the current context!
Error: Unable to interpret <DrWeb - 20120229> in the current context!
Error: Unable to interpret <Emsisoft - 20120229> in the current context!
Error: Unable to interpret <eSafe - 20120227> in the current context!
Error: Unable to interpret <eTrust-Vet - 20120229> in the current context!
Error: Unable to interpret <F-Prot - 20120228> in the current context!
Error: Unable to interpret <F-Secure - 20120229> in the current context!
Error: Unable to interpret <Fortinet - 20120229> in the current context!
Error: Unable to interpret <GData - 20120229> in the current context!
Error: Unable to interpret <Ikarus - 20120229> in the current context!
Error: Unable to interpret <Jiangmin - 20120228> in the current context!
Error: Unable to interpret <K7AntiVirus - 20120228> in the current context!
Error: Unable to interpret <Kaspersky - 20120229> in the current context!
Error: Unable to interpret <McAfee - 20120229> in the current context!
Error: Unable to interpret <McAfee-GW-Edition - 20120229> in the current context!
Error: Unable to interpret <Microsoft - 20120229> in the current context!
Error: Unable to interpret <NOD32 - 20120229> in the current context!
Error: Unable to interpret <Norman - 20120228> in the current context!
Error: Unable to interpret <nProtect - 20120229> in the current context!
Error: Unable to interpret <Panda - 20120228> in the current context!
Error: Unable to interpret <PCTools - 20120228> in the current context!
Error: Unable to interpret <Prevx - 20120229> in the current context!
Error: Unable to interpret <Rising - 20120228> in the current context!
Error: Unable to interpret <Sophos - 20120229> in the current context!
Error: Unable to interpret <SUPERAntiSpyware - 20120229> in the current context!
Error: Unable to interpret <Symantec - 20120229> in the current context!
Error: Unable to interpret <TheHacker - 20120228> in the current context!
Error: Unable to interpret <TrendMicro - 20120229> in the current context!
Error: Unable to interpret <TrendMicro-HouseCall - 20120229> in the current context!
Error: Unable to interpret <VBA32 - 20120228> in the current context!
Error: Unable to interpret <VIPRE - 20120229> in the current context!
Error: Unable to interpret <ViRobot - 20120229> in the current context!
Error: Unable to interpret <VirusBuster - 20120229> in the current context!
Error: Unable to interpret < * Comments> in the current context!
Error: Unable to interpret < * Additional information> in the current context!
Error: Unable to interpret <No comments> in the current context!
Error: Unable to interpret <More comments> in the current context!
Error: Unable to interpret <Leave your comment...> in the current context!
Error: Unable to interpret <?> in the current context!
Error: Unable to interpret <Rich Text Area> in the current context!
Error: Unable to interpret <Toolbar> in the current context!
Error: Unable to interpret < Bold (Ctrl+B) Italic (Ctrl+I) Underline (Ctrl+U) Undo (Ctrl+Z) Redo (Ctrl+Y) > in the current context!
Error: Unable to interpret <StylesStyles ▼> in the current context!
Error: Unable to interpret < Remove Formatting > in the current context!
Error: Unable to interpret <Post comment> in the current context!
Error: Unable to interpret <You have not signed in. Only registered users can leave comments, sign in and have a voice!> in the current context!
Error: Unable to interpret <Sign in Join the community> in the current context!
Error: Unable to interpret <An error occurred> in the current context!
Error: Unable to interpret <ssdeep> in the current context!
Error: Unable to interpret <48:yaCoWHpadMvN+xYs9n0cKsBZqCyAXkTgNxHr2360MnanaWmwQOXjTYq:2+dMQxnbjqChUTyHr21MnanaW5jTY> in the current context!
Error: Unable to interpret <TrID> in the current context!
Error: Unable to interpret <Generic Win/DOS Executable (49.9%)> in the current context!
Error: Unable to interpret <DOS Executable Generic (49.8%)> in the current context!
Error: Unable to interpret <Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%)> in the current context!
Error: Unable to interpret <ExifTool> in the current context!
Error: Unable to interpret <MIMEType.................: application/octet-stream> in the current context!
Error: Unable to interpret <Subsystem................: Windows GUI> in the current context!
Error: Unable to interpret <MachineType..............: Intel 386 or later, and compatibles> in the current context!
Error: Unable to interpret <TimeStamp................: 2012:02:27 09:44:53+01:00> in the current context!
Error: Unable to interpret <FileType.................: Win32 DLL> in the current context!
Error: Unable to interpret <PEType...................: PE32> in the current context!
Error: Unable to interpret <CodeSize.................: 1024> in the current context!
Error: Unable to interpret <LinkerVersion............: 5.12> in the current context!
Error: Unable to interpret <EntryPoint...............: 0x1000> in the current context!
Error: Unable to interpret <InitializedDataSize......: 3072> in the current context!
Error: Unable to interpret <SubsystemVersion.........: 4.0> in the current context!
Error: Unable to interpret <ImageVersion.............: 0.0> in the current context!
Error: Unable to interpret <OSVersion................: 4.0> in the current context!
Error: Unable to interpret <UninitializedDataSize....: 0> in the current context!
Error: Unable to interpret <Portable Executable structural information> in the current context!
Error: Unable to interpret <PE Sections...................:> in the current context!
Error: Unable to interpret <Name Virtual Address Virtual Size Raw Size Entropy MD5> in the current context!
Error: Unable to interpret <.text 4096 834 1024 5.24 4921302b047da473a10dbbfc5347da68> in the current context!
Error: Unable to interpret <.rdata 8192 537 1024 2.58 d536aef567291ab00218c0e68677337e> in the current context!
Error: Unable to interpret <.data 12288 1185 512 2.01 097edba434214dc1467a46eaa7506b69> in the current context!
Error: Unable to interpret <.reloc 16384 112 512 1.41 882028edddc0a9be61e4094328980ac8> in the current context!
Error: Unable to interpret <PE Imports....................:> in the current context!
Error: Unable to interpret <advapi32.dll> in the current context!
Error: Unable to interpret < RegCloseKey> in the current context!
Error: Unable to interpret <kernel32.dll> in the current context!
Error: Unable to interpret < GetModuleFileNameA, GetModuleHandleA, VirtualProtect, lstrcmpiA, lstrlenA> in the current context!
Error: Unable to interpret <shlwapi.dll> in the current context!
Error: Unable to interpret < SHCopyKeyW> in the current context!
Error: Unable to interpret <user32.dll> in the current context!
Error: Unable to interpret < SetWindowsHookExA, UnhookWindowsHookEx, CallNextHookEx> in the current context!
Error: Unable to interpret <PE Exports....................:> in the current context!
Error: Unable to interpret <C, l, o, s, e, G, u, a, r, d, ,, , S, e, t, G, u, a, r, d> in the current context!
Error: Unable to interpret <First seen by VirusTotal> in the current context!
Error: Unable to interpret <2012-02-27 13:29:25 UTC ( 1 Tag, 22 Stunden ago )> in the current context!
Error: Unable to interpret <Last seen by VirusTotal> in the current context!
Error: Unable to interpret <2012-02-29 11:05:24 UTC ( 37 Minuten ago )> in the current context!
Error: Unable to interpret <File names (max. 25)> in the current context!
Error: Unable to interpret < 1. BAcroIEHelpe.dll> in the current context!
Error: Unable to interpret < 2. file-3603090_dll> in the current context!
Error: Unable to interpret < 3. BAcroIEHelpe079.dll> in the current context!
Error: Unable to interpret < 4. 8903B96E987B8B1F15C4006A13EF050086200C46.dll> in the current context!

OTL by OldTimer - Version 3.2.33.2 log created on 02292012_124727

Hi,

der Fix hat nicht funktioniert, du musst den kompletten Inhalt der Codebox in das OTL-Fenster unter Custom Scan/Fixes kopieren und dann den Button Run fix klicken...

:OTL
IE - HKCU\..\URLSearchHook: {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - No CLSID value found
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (no name) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - No CLSID value found.
O4 - HKCU..\Run: [SkypeM] C:\Users\Yahya\AppData\Local\Skype\Skype.exe (Fearghus & Mitchell Co.)
O4 - HKCU..\Run: [Userinit] C:\Users\Yahya\AppData\Roaming\appconf32.exe ()
O32 - AutoRun File - [2008.06.02 23:46:54 | 000,000,049 | -HS- | M] () - S:\AUTORUN.INF -- [ NTFS ]
O33 - MountPoints2\{12e45d0c-aba9-11de-b4c2-82379398e654}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL 
O33 - MountPoints2\{a476124f-9fd1-11de-b1d3-a43c4364def5}\Shell - "" = AutoRun
O33 - MountPoints2\{a476124f-9fd1-11de-b1d3-a43c4364def5}\Shell\AutoRun\command - "" = D:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{a4761271-9fd1-11de-b1d3-a43c4364def5}\Shell - "" = AutoRun
O33 - MountPoints2\{a4761271-9fd1-11de-b1d3-a43c4364def5}\Shell\AutoRun\command - "" = D:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{a476128d-9fd1-11de-b1d3-a43c4364def5}\Shell - "" = AutoRun
O33 - MountPoints2\{a476128d-9fd1-11de-b1d3-a43c4364def5}\Shell\AutoRun\command - "" = D:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{b5f24b19-a826-11de-b93d-d9244b3cf710}\Shell - "" = AutoRun
O33 - MountPoints2\{b5f24b19-a826-11de-b93d-d9244b3cf710}\Shell\AutoRun\command - "" = D:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{b5f24b1c-a826-11de-b93d-d9244b3cf710}\Shell - "" = AutoRun
O33 - MountPoints2\{b5f24b1c-a826-11de-b93d-d9244b3cf710}\Shell\AutoRun\command - "" = D:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{c9157f82-61bb-11df-b85a-b03a80523b67}\Shell\AutoRun\command - "" = D:\Launcher.exe
O33 - MountPoints2\{ccb75be1-9eb4-11de-b5ed-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{ccb75be1-9eb4-11de-b5ed-806e6f6e6963}\Shell\AutoRun\command - "" = D:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{e0daaf0c-dab1-11de-b67f-b8519259bcf8}\Shell - "" = AutoRun
O33 - MountPoints2\{e0daaf0c-dab1-11de-b67f-b8519259bcf8}\Shell\AutoRun\command - "" = D:\setup_vmc_lite.exe /checkApplicationPresence
[2012.02.28 18:49:50 | 000,000,000 | ---D | C] -- C:\Users\Yahya\AppData\Roaming\01009
[2012.02.28 18:49:43 | 000,390,552 | ---- | C] (Adobe Systems, Incorporated) -- C:\Users\Yahya\AppData\Roaming\AcroIEHelpe.dll
[2012.02.28 18:49:43 | 000,390,552 | ---- | C] (Adobe Systems, Incorporated) -- C:\Users\Yahya\AppData\Roaming\AcroIEHelpe.dll
[2012.02.28 18:49:43 | 000,005,528 | ---- | C] () -- C:\Users\Yahya\AppData\Roaming\BAcroIEHelpe.dll
[2012.02.28 18:49:30 | 000,000,000 | ---D | C] -- C:\Users\Yahya\AppData\Roaming\xmldm
[2012.02.28 18:49:25 | 000,000,000 | ---D | C] -- C:\Users\Yahya\AppData\Roaming\kock
[2012.02.28 23:45:40 | 000,000,080 | ---- | M] () -- C:\Users\Yahya\AppData\Roaming\blckdom.res
[2010.09.07 13:06:04 | 000,000,162 | -H-- | M] ()(C:\Users\Yahya\Desktop\~$???????? ??????????? ??????? ??????.docx) -- C:\Users\Yahya\Desktop\~$رَّحِيمِ الرَّحْمَنِ اللَّهِ بِسْمِ.docx
[2010.09.07 13:06:04 | 000,000,162 | -H-- | C] ()(C:\Users\Yahya\Desktop\~$???????? ??????????? ??????? ??????.docx) -- C:\Users\Yahya\Desktop\~$رَّحِيمِ الرَّحْمَنِ اللَّهِ بِسْمِ.docx

:reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = dword:0x00
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = dword:0x00
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = dword:0x00
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = dword:0x00

:Commands
[emptytemp]
[Reboot]
         

chris

Lieber Chris,

ich war schon einen Schritt weiter und habe die Malwarebytes Software installiert und über eine Stunde lang ausgeführt, bis ich deine Nachricht gesehen habe. In dieser Zeit hatte er schon 10 infizierte Dateien entdeckt. Ich musste aber abbrechen, um den Fix zu machen. Muss ich jetzt nochmal den Fullscan mit Malwarebytes machen?

Hier der Report:
All processes killed
========== OTL ==========
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b2e293ee-fd7e-4c71-a714-5f4750d8d7b7}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b2e293ee-fd7e-4c71-a714-5f4750d8d7b7}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\SkypeM deleted successfully.
C:\Users\Yahya\AppData\Local\Skype\Skype.exe moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Userinit deleted successfully.
C:\Users\Yahya\AppData\Roaming\appconf32.exe moved successfully.
S:\AUTORUN.INF moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{12e45d0c-aba9-11de-b4c2-82379398e654}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{12e45d0c-aba9-11de-b4c2-82379398e654}\ not found.
File C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a476124f-9fd1-11de-b1d3-a43c4364def5}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a476124f-9fd1-11de-b1d3-a43c4364def5}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a476124f-9fd1-11de-b1d3-a43c4364def5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a476124f-9fd1-11de-b1d3-a43c4364def5}\ not found.
File D:\setup_vmc_lite.exe /checkApplicationPresence not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a4761271-9fd1-11de-b1d3-a43c4364def5}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a4761271-9fd1-11de-b1d3-a43c4364def5}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a4761271-9fd1-11de-b1d3-a43c4364def5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a4761271-9fd1-11de-b1d3-a43c4364def5}\ not found.
File D:\setup_vmc_lite.exe /checkApplicationPresence not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a476128d-9fd1-11de-b1d3-a43c4364def5}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a476128d-9fd1-11de-b1d3-a43c4364def5}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a476128d-9fd1-11de-b1d3-a43c4364def5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a476128d-9fd1-11de-b1d3-a43c4364def5}\ not found.
File D:\setup_vmc_lite.exe /checkApplicationPresence not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b5f24b19-a826-11de-b93d-d9244b3cf710}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b5f24b19-a826-11de-b93d-d9244b3cf710}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b5f24b19-a826-11de-b93d-d9244b3cf710}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b5f24b19-a826-11de-b93d-d9244b3cf710}\ not found.
File D:\setup_vmc_lite.exe /checkApplicationPresence not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b5f24b1c-a826-11de-b93d-d9244b3cf710}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b5f24b1c-a826-11de-b93d-d9244b3cf710}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b5f24b1c-a826-11de-b93d-d9244b3cf710}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b5f24b1c-a826-11de-b93d-d9244b3cf710}\ not found.
File D:\setup_vmc_lite.exe /checkApplicationPresence not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c9157f82-61bb-11df-b85a-b03a80523b67}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c9157f82-61bb-11df-b85a-b03a80523b67}\ not found.
File D:\Launcher.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ccb75be1-9eb4-11de-b5ed-806e6f6e6963}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ccb75be1-9eb4-11de-b5ed-806e6f6e6963}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ccb75be1-9eb4-11de-b5ed-806e6f6e6963}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ccb75be1-9eb4-11de-b5ed-806e6f6e6963}\ not found.
File D:\setup_vmc_lite.exe /checkApplicationPresence not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e0daaf0c-dab1-11de-b67f-b8519259bcf8}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e0daaf0c-dab1-11de-b67f-b8519259bcf8}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e0daaf0c-dab1-11de-b67f-b8519259bcf8}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e0daaf0c-dab1-11de-b67f-b8519259bcf8}\ not found.
File D:\setup_vmc_lite.exe /checkApplicationPresence not found.
C:\Users\Yahya\AppData\Roaming\01009\components folder moved successfully.
C:\Users\Yahya\AppData\Roaming\01009 folder moved successfully.
C:\Users\Yahya\AppData\Roaming\AcroIEHelpe.dll moved successfully.
File C:\Users\Yahya\AppData\Roaming\AcroIEHelpe.dll not found.
C:\Users\Yahya\AppData\Roaming\BAcroIEHelpe.dll moved successfully.
C:\Users\Yahya\AppData\Roaming\xmldm folder moved successfully.
C:\Users\Yahya\AppData\Roaming\kock folder moved successfully.
C:\Users\Yahya\AppData\Roaming\blckdom.res moved successfully.
C:\Users\Yahya\Desktop\~$رَّحِيمِ الرَّحْمَنِ اللَّهِ بِسْمِ.docx moved successfully.
File C:\Users\Yahya\Desktop\~$رَّحِيمِ الرَّحْمَنِ اللَّهِ بِسْمِ.docx not found.
========== REGISTRY ==========
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\\"DisableMonitoring" |dword:0x00 /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus\\"DisableMonitoring" |dword:0x00 /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall\\"DisableMonitoring" |dword:0x00 /E : value set successfully!
Unable to set value : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\\"AntiVirusOverride" | dword:0x00 /E!
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes

User: Gast
->Temp folder emptied: 547290 bytes
->Flash cache emptied: 571 bytes

User: Public

User: Yahya
->Temp folder emptied: 1350712 bytes
->Java cache emptied: 63333934 bytes
->FireFox cache emptied: 18871901 bytes
->Google Chrome cache emptied: 387638464 bytes
->Apple Safari cache emptied: 11821056 bytes
->Flash cache emptied: 5780 bytes

User: Yahya_2
->Temp folder emptied: 38740349 bytes
->Java cache emptied: 7617554 bytes
->Flash cache emptied: 5299 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 50299154 bytes
RecycleBin emptied: 44180566 bytes

Total Files Cleaned = 595,00 mb


OTL by OldTimer - Version 3.2.33.2 log created on 02292012_143645

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

Hi,

bitte MAM updaten und über Nacht Fullscan, Rechner nach dem Update vom Netz trennen...

Lade Dir vorher noch die beiden Tools (TDSS-Killer und mbrcheck) runter und führe sie nach dem Lauf / reboot von MAM aus, alle Logs dann posten...

TDSS-Killer
Download und Anweisung unter: Wie werden Schadprogramme der Familie Rootkit.Win32.TDSS bekämpft?
Entpacke alle Dateien in einem eigenen Verzeichnis (z. B: C:\TDSS)!
Aufruf über den Explorer duch Doppelklick auf die TDSSKiller.exe.
Stelle den Killer wir folgt ein:

Dann den Scan starten durch (Start Scan).
Wenn der Scan fertig ist bitte "Report" anwählen (eventuelle Funde erstmal mit Skip übergehen). Es öffnet sich ein Fenster, den Text abkopieren und hier posten...

MBR-Check
Lade Dir http://ad13.geekstogo.com/MBRCheck.exe und speichere die Datei auf dem Desktop.

• Doppelklick auf die MBRCheck.exe.

• Vista und Win7 User mit Rechtsklick "als Administrator starten"

• Das Tool braucht nur eine Sekunde.

• Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.

Poste bitte den Inhalt des .txt Dokumentes

chris

Habe den Scan nach über 3 Stunden abgebrochen, weil es schon lief, als deine Antwort kam. Habe nun die anderen Dateien heruntergeladen. Nun bekomme ich von Avira eine Meldung dass, in der Datei C:\tdsskillerTDSSKiller.exe ein Virus oder unerwünschtes Programm 'TR/Crypt.ULPM.Gen' gefunden. Ist das jetzt ein weiterer Virus? Wie sollte ich vorgehen?

Ab und zu brauche ich Photoshop. Kann ich deinstallieren und dann später wieder installieren, wenn es Probleme verursacht. So oft brauche ich es nicht.
Ich mach das gleich mal. Sonst noch etwas?

LG
Lina S.

Hi,

im Moment nicht... Läuft der Rechner ok?

chris

Hi Chris,

ich habe gestern nacht CS deinstalliert. Heute morgen habe ich den Rechner neu gestartet, und die Fehlermeldung beim Starten ist immer noch da. Ich habe dir ein Bild davon im Anhang geschickt.
Ansonsten alles ok, ausser, dass er länger dauert, bis Windows gestartet wird. Ich dachte, er startet gar nicht mehr.

LG
Lina S.

Hi,

hast du was am USB-Port angeschlossen?
Der Fehler besagt, dass ein USB-Port überlastet ist (Over Current)...
Mal alles abhängen und neu Booten...

chris

Hi Chris,
du bist echt ein Genie. Ein USB Port bei mir war immer kapputt, die Pins sind verbogen. Und einer dieser Pins hatte ständig Kontakt mit dem Metallstück (weiß nicht, wie das im Detail heißt). Habe den Pin ein bisschen zurecht gebogen, und siehe da alles geht wieder. Du bist echt ein Schatz. Ich weiß nicht, wie ich dir danken soll. Du hast meinen PC gerettet, meine Daten und mir geholfen, wie es kein anderer getan hätte.
Dafür bin ich dir sehr dankbar.

Um solche Viren früher zu entdecken, bevor sie Schaden anrichten, was würdest du für eine Antivirensoftware und Firewall empfehlen. Ich habe Avira im Einsatz, und wie man sieht, ist einiges durchgegangen.

LG
Lina S.