| |
| |||||||
Log-Analyse und Auswertung: Verschlüsselungs Trojaner "Trojan.Inject1.2545" Wirklich gelöscht?Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
30.04.2012, 20:00
| #1 |
| |  Verschlüsselungs Trojaner "Trojan.Inject1.2545" Wirklich gelöscht? Hallo, auf dem Rechner meiner Eltern hat sich ein Verschlüsselungs-Trojaner breit gemacht. Er wurde durch unvorsichtiges öffnen eines Emailanhanges installiert. Die Email war eine Telekom-Fake-Rechnungs-Email, mit einer "Rechnung.zip" im Anhang. Nach normalen booten wurde dann ein Fenster angezeigt, auf dem man aufgefordert wurde 50 € in U-Cash zu überweisen. Ich habe dann den Rechner im Abgesicherten Modus gestartet und OTL und Dr. Web laufen lassen. Die Dateien sind auch wieder entschlüsselt mit Hilfe des "matsnu1decrypt". Ich habe OTL einmal vor und einmal nach Dr. Web durchlaufen lassen. Dr.Web hat das hier gefunden: bnmsdfgqwe.pre C:\Users\Daniela\AppData\Local\Temp Trojan.Inject1.2545 Gelöscht. 7fdc4855c0871c930385.exe c:\users\daniela\appdata\roaming\ektvynam Trojan.Inject1.2545 Gelöscht. Hier sind die OTL Logs: Davor: OTL Logfile: Code:
ATTFilter OTL logfile created on: 30.04.2012 19:46:11 - Run 2 OTL by OldTimer - Version 3.2.42.2 Folder = C:\Users\Daniela\Downloads Windows Vista Business Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1,99 Gb Total Physical Memory | 1,32 Gb Available Physical Memory | 66,55% Memory free 4,23 Gb Paging File | 3,72 Gb Available in Paging File | 88,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 241,73 Gb Total Space | 168,51 Gb Free Space | 69,71% Space Free | Partition Type: NTFS Drive E: | 224,03 Gb Total Space | 223,93 Gb Free Space | 99,96% Space Free | Partition Type: NTFS Drive F: | 15,22 Gb Total Space | 15,21 Gb Free Space | 99,92% Space Free | Partition Type: FAT32 Computer Name: SERVER | User Name: Daniela | Logged in as Administrator. Boot Mode: SafeMode with Networking | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.04.30 19:44:05 | 000,595,456 | ---- | M] (OldTimer Tools) -- C:\Users\Daniela\Downloads\OTL.exe PRC - [2012.04.30 17:26:19 | 087,227,952 | ---- | M] () -- C:\Users\Daniela\Downloads\avira_free_antivirus_898de.exe PRC - [2012.03.26 21:29:07 | 000,924,600 | ---- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\firefox.exe PRC - [2012.01.31 08:56:04 | 002,757,584 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Users\Daniela\AppData\Local\Temp\RarSFX0\presetup.exe PRC - [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe ========== Modules (No Company Name) ========== MOD - [2012.04.30 17:26:19 | 087,227,952 | ---- | M] () -- C:\Users\Daniela\Downloads\avira_free_antivirus_898de.exe MOD - [2012.03.26 21:29:07 | 001,969,080 | ---- | M] () -- C:\Programme\Mozilla Firefox\mozjs.dll MOD - [2012.03.02 23:21:57 | 008,527,008 | ---- | M] () -- C:\Windows\System32\Macromed\Flash\NPSWF32.dll MOD - [2007.07.23 16:04:46 | 000,068,080 | ---- | M] () -- C:\Programme\Common Files\Roxio Shared\9.0\DLLShared\dlaapi_w.dll ========== Win32 Services (SafeList) ========== SRV - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService) SRV - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Stopped] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2011.09.22 13:03:30 | 000,974,944 | ---- | M] (ESET) [Auto | Stopped] -- C:\Programme\ESET\ESET NOD32 Antivirus\ekrn.exe -- (ekrn) SRV - [2008.01.21 04:25:56 | 000,896,512 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc) SRV - [2008.01.21 04:23:59 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2003.07.28 13:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp) DRV - [2012.04.04 15:56:40 | 000,022,344 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector) DRV - [2011.08.09 15:24:52 | 000,163,424 | ---- | M] (ESET) [File_System | Auto | Stopped] -- C:\Windows\System32\drivers\eamonm.sys -- (eamonm) DRV - [2011.08.04 10:20:38 | 000,103,112 | ---- | M] (ESET) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\epfwwfpr.sys -- (epfwwfpr) DRV - [2011.08.04 10:20:36 | 000,118,104 | ---- | M] (ESET) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\ehdrv.sys -- (ehdrv) DRV - [2010.10.21 01:51:30 | 001,217,024 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr) DRV - [2007.07.23 16:05:18 | 000,009,104 | ---- | M] (Roxio) [File_System | Auto | Stopped] -- C:\Windows\System32\drivers\DLADResM.SYS -- (DLADResM) DRV - [2007.07.23 16:04:58 | 000,037,360 | ---- | M] (Roxio) [File_System | Auto | Stopped] -- C:\Windows\System32\drivers\DLABMFSM.SYS -- (DLABMFSM) DRV - [2007.07.23 16:04:56 | 000,098,448 | ---- | M] (Roxio) [File_System | Auto | Stopped] -- C:\Windows\System32\drivers\DLAUDF_M.SYS -- (DLAUDF_M) DRV - [2007.07.23 16:04:56 | 000,093,552 | ---- | M] (Roxio) [File_System | Auto | Stopped] -- C:\Windows\System32\drivers\DLAUDFAM.SYS -- (DLAUDFAM) DRV - [2007.07.23 16:04:54 | 000,027,216 | ---- | M] (Roxio) [File_System | Auto | Stopped] -- C:\Windows\System32\drivers\DLAOPIOM.SYS -- (DLAOPIOM) DRV - [2007.07.23 16:04:52 | 000,032,848 | ---- | M] (Roxio) [File_System | Auto | Stopped] -- C:\Windows\System32\drivers\DLABOIOM.SYS -- (DLABOIOM) DRV - [2007.07.23 16:04:52 | 000,016,304 | ---- | M] (Roxio) [File_System | Auto | Stopped] -- C:\Windows\System32\drivers\DLAPoolM.SYS -- (DLAPoolM) DRV - [2007.07.23 16:04:50 | 000,108,752 | ---- | M] (Roxio) [File_System | Auto | Stopped] -- C:\Windows\System32\drivers\DLAIFS_M.SYS -- (DLAIFS_M) DRV - [2007.07.23 15:49:44 | 000,030,064 | ---- | M] (Roxio) [File_System | System | Running] -- C:\Windows\System32\drivers\DLARTL_M.SYS -- (DLARTL_M) DRV - [2007.07.23 15:49:44 | 000,014,576 | ---- | M] (Roxio) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\DLACDBHM.SYS -- (DLACDBHM) DRV - [2006.12.08 11:33:21 | 000,005,120 | ---- | M] (Samsung Electronics) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\SSPORT.sys -- (SSPORT) DRV - [2006.12.08 11:33:20 | 000,041,984 | ---- | M] (Samsung Electronics Co., Ltd.) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\DGIVECP.SYS -- (DgiVecp) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 3D F7 08 90 B6 0A CD 01 [binary data] IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?} IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.03.26 21:29:07 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2012.02.19 11:13:15 | 000,000,000 | ---D | M] [2012.02.12 20:10:35 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Daniela\AppData\Roaming\mozilla\Extensions [2012.04.30 17:04:28 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Daniela\AppData\Roaming\mozilla\Firefox\Profiles\z361o7uv.default\extensions [2012.03.28 21:55:55 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2012.03.28 21:55:55 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} () (No name found) -- C:\USERS\DANIELA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\Z361O7UV.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI [2012.03.26 21:29:07 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2012.02.08 19:36:16 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.02.08 19:21:19 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2012.02.08 19:36:16 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2012.02.08 19:36:16 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2012.02.08 19:36:16 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2012.02.08 19:36:16 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O4 - HKLM..\Run: [egui] C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET) O4 - HKLM..\Run: [FreePDF Assistant] C:\Program Files\FreePDF_XP\fpassist.exe (shbox.de) O4 - HKLM..\Run: [Samsung PanelMgr] C:\Windows\Samsung\PanelMgr\SSMMgr.exe () O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKCU..\Run: [C0871C93] C:\Users\Daniela\AppData\Roaming\Ektvynam\7FDC4855C0871C930385.exe (Pigna colada) O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - Startup: C:\Users\Daniela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office Outlook 2003.lnk = C:\Windows\Installer\{91120407-6000-11D3-8CFE-0150048383C9}\outicon.exe () O8 - Extra context menu item: Nach Microsoft &Excel exportieren - C:\Programme\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation) O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{61D16CFC-AFD0-4CE4-87FB-D1D4BA29E75E}: DhcpNameServer = 192.168.0.1 O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Common Files\microsoft shared\Web Components\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img20.jpg O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img20.jpg O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) ========== Files/Folders - Created Within 30 Days ========== [2012.04.30 15:59:29 | 000,000,000 | ---D | C] -- C:\Users\Daniela\AppData\Roaming\Malwarebytes [2012.04.30 15:59:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012.04.30 15:59:25 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2012.04.30 15:59:25 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2012.04.30 15:59:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2012.04.30 13:36:45 | 000,000,000 | ---D | C] -- C:\Users\Daniela\AppData\Roaming\Ektvynam [2012.04.30 01:39:18 | 000,203,064 | ---- | C] (Doctor Web, Ltd.) -- C:\Users\Daniela\Desktop\matsnu1decrypt.exe [2012.04.29 09:39:03 | 000,000,000 | -H-D | C] -- C:\Program Files\InstallShield Installation Information [2012.04.29 09:39:02 | 000,000,000 | ---D | C] -- C:\Windows\Samsung [2012.04.24 16:49:02 | 000,000,000 | ---D | C] -- C:\Users\Daniela\Documents\***** [2012.04.11 10:50:57 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb [2012.04.11 10:50:56 | 001,799,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll [2012.04.11 10:50:55 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll [2012.04.11 10:50:55 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll [2012.04.11 10:50:54 | 001,427,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl [2012.04.11 10:50:54 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll [2012.04.11 10:45:17 | 000,000,000 | ---D | C] -- C:\Users\Daniela\Documents\SET ========== Files - Modified Within 30 Days ========== [2012.04.30 17:35:08 | 000,001,227 | ---- | M] () -- C:\Users\Daniela\Documents\**** [2012.04.30 17:31:38 | 056,902,656 | ---- | M] () -- C:\Users\Daniela\Documents\Outlook.pst [2012.04.30 17:30:42 | 000,620,956 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2012.04.30 17:30:42 | 000,589,472 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2012.04.30 17:30:42 | 000,123,276 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2012.04.30 17:30:42 | 000,101,484 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2012.04.30 15:59:26 | 000,000,906 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.04.30 15:58:08 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.04.30 15:01:36 | 000,069,087 | ---- | M] () -- C:\Users\Daniela\Desktop\matsnu1decrypt.zip [2012.04.30 14:31:32 | 000,003,712 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2012.04.30 14:31:32 | 000,003,712 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2012.04.30 14:31:30 | 000,002,771 | ---- | M] () -- C:\Users\Daniela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office Outlook 2003.lnk [2012.04.30 13:42:10 | 000,000,400 | ---- | M] () -- C:\Windows\ODBC.INI [2012.04.30 13:37:25 | 000,001,227 | ---- | M] () -- C:\Users\Daniela\Documents\locked-****cpsm [2012.04.30 08:34:30 | 000,002,637 | ---- | M] () -- C:\Users\Daniela\Desktop\Microsoft Office Word 2003.lnk [2012.04.30 01:39:18 | 000,203,064 | ---- | M] (Doctor Web, Ltd.) -- C:\Users\Daniela\Desktop\matsnu1decrypt.exe [2012.04.22 10:13:12 | 000,002,665 | ---- | M] () -- C:\Users\Daniela\Desktop\Microsoft Office Excel 2003.lnk [2012.04.04 15:56:40 | 000,022,344 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys ========== Files Created - No Company Name ========== [2012.04.30 17:35:08 | 000,001,227 | ---- | C] () -- C:\Users\Daniela\Documents\****.htm [2012.04.30 17:33:45 | 003,185,851 | ---- | C] () -- C:\Users\Daniela\Desktop\1.JPG [2012.04.30 16:25:56 | 000,069,087 | ---- | C] () -- C:\Users\Daniela\Desktop\matsnu1decrypt.zip [2012.04.30 15:59:26 | 000,000,906 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.04.29 09:47:24 | 000,001,589 | ---- | C] () -- C:\Users\Daniela\Desktop\Windows Fax and Scan.lnk [2012.04.29 09:39:03 | 000,466,944 | ---- | C] () -- C:\Windows\ssndii.exe [2012.04.24 16:49:02 | 000,001,227 | ---- | C] () -- C:\Users\Daniela\Documents\locked-****.cpsm [2012.02.21 01:11:04 | 000,003,584 | ---- | C] () -- C:\Users\Daniela\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2012.02.20 11:44:55 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin [2012.02.20 11:44:55 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin [2012.02.20 11:44:32 | 000,062,976 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe [2012.02.20 11:44:22 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll [2012.02.15 15:35:07 | 000,116,224 | ---- | C] () -- C:\Windows\System32\redmonnt.dll [2012.02.15 15:35:07 | 000,045,056 | ---- | C] () -- C:\Windows\System32\unredmon.exe [2012.02.14 23:51:02 | 000,000,466 | RHS- | C] () -- C:\ProgramData\ntuser.pol [2012.02.12 22:35:26 | 000,620,956 | ---- | C] () -- C:\Windows\System32\perfh007.dat [2012.02.12 22:35:26 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat [2012.02.12 22:35:26 | 000,123,276 | ---- | C] () -- C:\Windows\System32\perfc007.dat [2012.02.12 22:35:26 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat [2012.02.12 18:57:47 | 000,086,016 | R--- | C] () -- C:\Windows\WiaInst.exe [2012.02.12 18:57:21 | 000,022,723 | ---- | C] () -- C:\Windows\System32\suge1l3.dll [2012.02.12 15:40:06 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI [2012.02.12 15:26:06 | 000,000,234 | ---- | C] () -- C:\Windows\wininit.ini [2012.02.12 15:17:43 | 000,217,088 | ---- | C] () -- C:\Windows\System32\ssminidriver.dll [2012.02.12 15:17:43 | 000,027,136 | ---- | C] () -- C:\Windows\System32\ssimgfilter.dll [2012.02.12 15:17:43 | 000,011,264 | ---- | C] () -- C:\Windows\System32\sssegfilter.dll [2012.02.12 15:17:43 | 000,010,752 | ---- | C] () -- C:\Windows\System32\sserrhandler.dll [2012.02.12 15:08:39 | 000,910,464 | ---- | C] () -- C:\Windows\System32\igmedkrn.dll [2012.02.12 15:08:39 | 000,249,856 | ---- | C] () -- C:\Windows\System32\igfxTMM.dll [2012.02.12 15:08:39 | 000,204,800 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1268.dll [2012.02.12 14:51:32 | 000,000,680 | ---- | C] () -- C:\Users\Daniela\AppData\Local\d3d9caps.dat ========== LOP Check ========== [2012.04.30 13:36:45 | 000,000,000 | ---D | M] -- C:\Users\Daniela\AppData\Roaming\Ektvynam [2012.02.15 15:35:06 | 000,000,000 | ---D | M] -- C:\Users\Daniela\AppData\Roaming\FreePDF [2012.04.30 14:31:58 | 000,032,572 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== < End of report > Danach: OTL Logfile: Code:
ATTFilter OTL logfile created on: 30.04.2012 20:37:37 - Run 3 OTL by OldTimer - Version 3.2.42.2 Folder = C:\Users\Daniela\Downloads Windows Vista Business Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1,99 Gb Total Physical Memory | 1,46 Gb Available Physical Memory | 73,34% Memory free 4,23 Gb Paging File | 3,69 Gb Available in Paging File | 87,10% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 241,73 Gb Total Space | 168,34 Gb Free Space | 69,64% Space Free | Partition Type: NTFS Drive E: | 224,03 Gb Total Space | 223,93 Gb Free Space | 99,96% Space Free | Partition Type: NTFS Drive F: | 15,22 Gb Total Space | 15,21 Gb Free Space | 99,92% Space Free | Partition Type: FAT32 Computer Name: SERVER | User Name: Daniela | Logged in as Administrator. Boot Mode: SafeMode with Networking | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.04.30 19:44:05 | 000,595,456 | ---- | M] (OldTimer Tools) -- C:\Users\Daniela\Downloads\OTL.exe PRC - [2012.04.30 17:26:19 | 087,227,952 | ---- | M] () -- C:\Users\Daniela\Downloads\avira_free_antivirus_898de.exe PRC - [2012.03.26 21:29:07 | 000,924,600 | ---- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\firefox.exe PRC - [2012.01.31 08:56:04 | 002,757,584 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Users\Daniela\AppData\Local\Temp\RarSFX0\presetup.exe PRC - [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe ========== Modules (No Company Name) ========== MOD - [2012.04.30 17:26:19 | 087,227,952 | ---- | M] () -- C:\Users\Daniela\Downloads\avira_free_antivirus_898de.exe MOD - [2012.03.26 21:29:07 | 001,969,080 | ---- | M] () -- C:\Programme\Mozilla Firefox\mozjs.dll MOD - [2012.03.02 23:21:57 | 008,527,008 | ---- | M] () -- C:\Windows\System32\Macromed\Flash\NPSWF32.dll MOD - [2007.07.23 16:04:46 | 000,068,080 | ---- | M] () -- C:\Programme\Common Files\Roxio Shared\9.0\DLLShared\dlaapi_w.dll ========== Win32 Services (SafeList) ========== SRV - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService) SRV - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Stopped] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2011.09.22 13:03:30 | 000,974,944 | ---- | M] (ESET) [Auto | Stopped] -- C:\Programme\ESET\ESET NOD32 Antivirus\ekrn.exe -- (ekrn) SRV - [2008.01.21 04:25:56 | 000,896,512 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc) SRV - [2008.01.21 04:23:59 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2003.07.28 13:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp) DRV - [2012.04.04 15:56:40 | 000,022,344 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector) DRV - [2011.08.09 15:24:52 | 000,163,424 | ---- | M] (ESET) [File_System | Auto | Stopped] -- C:\Windows\System32\drivers\eamonm.sys -- (eamonm) DRV - [2011.08.04 10:20:38 | 000,103,112 | ---- | M] (ESET) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\epfwwfpr.sys -- (epfwwfpr) DRV - [2011.08.04 10:20:36 | 000,118,104 | ---- | M] (ESET) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\ehdrv.sys -- (ehdrv) DRV - [2010.10.21 01:51:30 | 001,217,024 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr) DRV - [2007.07.23 16:05:18 | 000,009,104 | ---- | M] (Roxio) [File_System | Auto | Stopped] -- C:\Windows\System32\drivers\DLADResM.SYS -- (DLADResM) DRV - [2007.07.23 16:04:58 | 000,037,360 | ---- | M] (Roxio) [File_System | Auto | Stopped] -- C:\Windows\System32\drivers\DLABMFSM.SYS -- (DLABMFSM) DRV - [2007.07.23 16:04:56 | 000,098,448 | ---- | M] (Roxio) [File_System | Auto | Stopped] -- C:\Windows\System32\drivers\DLAUDF_M.SYS -- (DLAUDF_M) DRV - [2007.07.23 16:04:56 | 000,093,552 | ---- | M] (Roxio) [File_System | Auto | Stopped] -- C:\Windows\System32\drivers\DLAUDFAM.SYS -- (DLAUDFAM) DRV - [2007.07.23 16:04:54 | 000,027,216 | ---- | M] (Roxio) [File_System | Auto | Stopped] -- C:\Windows\System32\drivers\DLAOPIOM.SYS -- (DLAOPIOM) DRV - [2007.07.23 16:04:52 | 000,032,848 | ---- | M] (Roxio) [File_System | Auto | Stopped] -- C:\Windows\System32\drivers\DLABOIOM.SYS -- (DLABOIOM) DRV - [2007.07.23 16:04:52 | 000,016,304 | ---- | M] (Roxio) [File_System | Auto | Stopped] -- C:\Windows\System32\drivers\DLAPoolM.SYS -- (DLAPoolM) DRV - [2007.07.23 16:04:50 | 000,108,752 | ---- | M] (Roxio) [File_System | Auto | Stopped] -- C:\Windows\System32\drivers\DLAIFS_M.SYS -- (DLAIFS_M) DRV - [2007.07.23 15:49:44 | 000,030,064 | ---- | M] (Roxio) [File_System | System | Running] -- C:\Windows\System32\drivers\DLARTL_M.SYS -- (DLARTL_M) DRV - [2007.07.23 15:49:44 | 000,014,576 | ---- | M] (Roxio) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\DLACDBHM.SYS -- (DLACDBHM) DRV - [2006.12.08 11:33:21 | 000,005,120 | ---- | M] (Samsung Electronics) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\SSPORT.sys -- (SSPORT) DRV - [2006.12.08 11:33:20 | 000,041,984 | ---- | M] (Samsung Electronics Co., Ltd.) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\DGIVECP.SYS -- (DgiVecp) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 3D F7 08 90 B6 0A CD 01 [binary data] IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?} IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.03.26 21:29:07 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2012.02.19 11:13:15 | 000,000,000 | ---D | M] [2012.02.12 20:10:35 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Daniela\AppData\Roaming\mozilla\Extensions [2012.04.30 17:04:28 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Daniela\AppData\Roaming\mozilla\Firefox\Profiles\z361o7uv.default\extensions [2012.03.28 21:55:55 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2012.03.28 21:55:55 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} () (No name found) -- C:\USERS\DANIELA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\Z361O7UV.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI [2012.03.26 21:29:07 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2012.02.08 19:36:16 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.02.08 19:21:19 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2012.02.08 19:36:16 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2012.02.08 19:36:16 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2012.02.08 19:36:16 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2012.02.08 19:36:16 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O4 - HKLM..\Run: [egui] C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET) O4 - HKLM..\Run: [FreePDF Assistant] C:\Program Files\FreePDF_XP\fpassist.exe (shbox.de) O4 - HKLM..\Run: [Samsung PanelMgr] C:\Windows\Samsung\PanelMgr\SSMMgr.exe () O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - Startup: C:\Users\Daniela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office Outlook 2003.lnk = C:\Windows\Installer\{91120407-6000-11D3-8CFE-0150048383C9}\outicon.exe () O8 - Extra context menu item: Nach Microsoft &Excel exportieren - C:\Programme\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation) O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{61D16CFC-AFD0-4CE4-87FB-D1D4BA29E75E}: DhcpNameServer = 192.168.0.1 O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Common Files\microsoft shared\Web Components\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img20.jpg O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img20.jpg O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) ========== Files/Folders - Created Within 30 Days ========== [2012.04.30 20:08:10 | 000,000,000 | ---D | C] -- C:\Users\Daniela\DoctorWeb [2012.04.30 15:59:29 | 000,000,000 | ---D | C] -- C:\Users\Daniela\AppData\Roaming\Malwarebytes [2012.04.30 15:59:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012.04.30 15:59:25 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2012.04.30 15:59:25 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2012.04.30 15:59:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2012.04.30 13:36:45 | 000,000,000 | ---D | C] -- C:\Users\Daniela\AppData\Roaming\Ektvynam [2012.04.30 01:39:18 | 000,203,064 | ---- | C] (Doctor Web, Ltd.) -- C:\Users\Daniela\Desktop\matsnu1decrypt.exe [2012.04.29 09:39:03 | 000,000,000 | -H-D | C] -- C:\Program Files\InstallShield Installation Information [2012.04.29 09:39:02 | 000,000,000 | ---D | C] -- C:\Windows\Samsung [2012.04.24 16:49:02 | 000,000,000 | ---D | C] -- C:\Users\Daniela\Documents\***-Dateien [2012.04.11 10:50:57 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb [2012.04.11 10:50:56 | 001,799,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll [2012.04.11 10:50:55 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll [2012.04.11 10:50:55 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll [2012.04.11 10:50:54 | 001,427,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl [2012.04.11 10:50:54 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll [2012.04.11 10:45:17 | 000,000,000 | ---D | C] -- C:\Users\Daniela\Documents\SET ========== Files - Modified Within 30 Days ========== [2012.04.30 20:33:51 | 000,000,182 | ---- | M] () -- C:\Users\Daniela\Desktop\DrWeb.csv [2012.04.30 19:50:51 | 056,902,656 | ---- | M] () -- C:\Users\Daniela\Documents\Outlook.pst [2012.04.30 17:35:08 | 000,001,227 | ---- | M] () -- C:\Users\Daniela\Documents\****.htm [2012.04.30 17:30:42 | 000,620,956 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2012.04.30 17:30:42 | 000,589,472 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2012.04.30 17:30:42 | 000,123,276 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2012.04.30 17:30:42 | 000,101,484 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2012.04.30 15:59:26 | 000,000,906 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.04.30 15:58:08 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.04.30 15:01:36 | 000,069,087 | ---- | M] () -- C:\Users\Daniela\Desktop\matsnu1decrypt.zip [2012.04.30 14:31:32 | 000,003,712 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2012.04.30 14:31:32 | 000,003,712 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2012.04.30 14:31:30 | 000,002,771 | ---- | M] () -- C:\Users\Daniela\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office Outlook 2003.lnk [2012.04.30 13:42:10 | 000,000,400 | ---- | M] () -- C:\Windows\ODBC.INI [2012.04.30 13:37:25 | 000,001,227 | ---- | M] () -- C:\Users\Daniela\Documents\locked-****.cpsm [2012.04.30 08:34:30 | 000,002,637 | ---- | M] () -- C:\Users\Daniela\Desktop\Microsoft Office Word 2003.lnk [2012.04.30 01:39:18 | 000,203,064 | ---- | M] (Doctor Web, Ltd.) -- C:\Users\Daniela\Desktop\matsnu1decrypt.exe [2012.04.22 10:13:12 | 000,002,665 | ---- | M] () -- C:\Users\Daniela\Desktop\Microsoft Office Excel 2003.lnk [2012.04.04 15:56:40 | 000,022,344 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys ========== Files Created - No Company Name ========== [2012.04.30 20:33:51 | 000,000,182 | ---- | C] () -- C:\Users\Daniela\Desktop\DrWeb.csv [2012.04.30 17:35:08 | 000,001,227 | ---- | C] () -- C:\Users\Daniela\Documents\****.htm [2012.04.30 17:33:45 | 003,185,851 | ---- | C] () -- C:\Users\Daniela\Desktop\1.JPG [2012.04.30 16:25:56 | 000,069,087 | ---- | C] () -- C:\Users\Daniela\Desktop\matsnu1decrypt.zip [2012.04.30 15:59:26 | 000,000,906 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.04.29 09:47:24 | 000,001,589 | ---- | C] () -- C:\Users\Daniela\Desktop\Windows Fax and Scan.lnk [2012.04.29 09:39:03 | 000,466,944 | ---- | C] () -- C:\Windows\ssndii.exe [2012.04.24 16:49:02 | 000,001,227 | ---- | C] () -- C:\Users\Daniela\Documents\****.cpsm [2012.02.21 01:11:04 | 000,003,584 | ---- | C] () -- C:\Users\Daniela\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2012.02.20 11:44:55 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin [2012.02.20 11:44:55 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin [2012.02.20 11:44:32 | 000,062,976 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe [2012.02.20 11:44:22 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll [2012.02.15 15:35:07 | 000,116,224 | ---- | C] () -- C:\Windows\System32\redmonnt.dll [2012.02.15 15:35:07 | 000,045,056 | ---- | C] () -- C:\Windows\System32\unredmon.exe [2012.02.14 23:51:02 | 000,000,466 | RHS- | C] () -- C:\ProgramData\ntuser.pol [2012.02.12 22:35:26 | 000,620,956 | ---- | C] () -- C:\Windows\System32\perfh007.dat [2012.02.12 22:35:26 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat [2012.02.12 22:35:26 | 000,123,276 | ---- | C] () -- C:\Windows\System32\perfc007.dat [2012.02.12 22:35:26 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat [2012.02.12 18:57:47 | 000,086,016 | R--- | C] () -- C:\Windows\WiaInst.exe [2012.02.12 18:57:21 | 000,022,723 | ---- | C] () -- C:\Windows\System32\suge1l3.dll [2012.02.12 15:40:06 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI [2012.02.12 15:26:06 | 000,000,234 | ---- | C] () -- C:\Windows\wininit.ini [2012.02.12 15:17:43 | 000,217,088 | ---- | C] () -- C:\Windows\System32\ssminidriver.dll [2012.02.12 15:17:43 | 000,027,136 | ---- | C] () -- C:\Windows\System32\ssimgfilter.dll [2012.02.12 15:17:43 | 000,011,264 | ---- | C] () -- C:\Windows\System32\sssegfilter.dll [2012.02.12 15:17:43 | 000,010,752 | ---- | C] () -- C:\Windows\System32\sserrhandler.dll [2012.02.12 15:08:39 | 000,910,464 | ---- | C] () -- C:\Windows\System32\igmedkrn.dll [2012.02.12 15:08:39 | 000,249,856 | ---- | C] () -- C:\Windows\System32\igfxTMM.dll [2012.02.12 15:08:39 | 000,204,800 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1268.dll [2012.02.12 14:51:32 | 000,000,680 | ---- | C] () -- C:\Users\Daniela\AppData\Local\d3d9caps.dat ========== LOP Check ========== [2012.04.30 20:30:04 | 000,000,000 | ---D | M] -- C:\Users\Daniela\AppData\Roaming\Ektvynam [2012.02.15 15:35:06 | 000,000,000 | ---D | M] -- C:\Users\Daniela\AppData\Roaming\FreePDF [2012.04.30 14:31:58 | 000,032,572 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== < End of report > Meine Frage ist hier, bin ich jetzt auf der sicheren Seite? Ist dieser Trojaner jetzt entfernt? Vielen Dank für eure Hilfe! Grüße, Smil0don |
| Themen zu Verschlüsselungs Trojaner "Trojan.Inject1.2545" Wirklich gelöscht? |
| 0x00000001, adobe, antivirus, autorun, avira, booten, desktop, dr.web, eset nod32, excel, firefox, format, frage, installation, langs, logfile, microsoft office word, mozilla, opera, plug-in, programme, rarsfx0, registry, scan, searchscopes, software, trojan.inject, trojan.inject1, trojan.inject1.2545, trojaner, vista, wmp |
Baum-Darstellung