Verschlüsselungstrojaner auf Verzeichnisse kein Zugriff....

 Malwarebytes Anti-Malware  (Test) 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.06.01.05

Windows 7 x86 NTFS (Abgesichertenmodus/Netzwerkfähig)
Internet Explorer 9.0.8112.16421
gabi :: GABI-PC [Administrator]

Schutz: Deaktiviert

01.06.2012 21:14:40
mbam-log-2012-06-01 (21-14-40).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 296580
Laufzeit: 52 Minute(n), 15 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|CC02A9D0 (Trojan.FileLock) -> Daten: C:\Users\gabi\AppData\Roaming\Eplqnjoq\F70F6657CC02A9D052E5.exe -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 8
C:\Users\gabi\AppData\Roaming\Eplqnjoq\F70F6657CC02A9D052E5.exe (Trojan.FileLock) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\gabi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\LV1I0Y68\scandsys211e_8020[1].bat (Trojan.FakeAlert) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\gabi\AppData\Local\Temp\aexdtfxurv.pre (Trojan.FileLock) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\gabi\AppData\Local\Temp\epdtfgurvo.pre (Trojan.FileLock) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\gabi\AppData\Local\Temp\fcihbnimwp.pre (Trojan.FileLock) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\gabi\AppData\Local\Temp\gvtdxftlpe.pre (Trojan.FileLock) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\gabi\AppData\Local\Temp\ihwpkmwzlr.pre (Trojan.FileLock) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\gabi\AppData\Local\Temp\lcyyfcrszl.pre (Trojan.FileLock) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
         

C:\Users\gabi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SBSBQNNS\Inkasso.zip	Win32/Trustezeb.B trojan
         

All processes killed
========== OTL ==========
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{CB001ED9-7309-4469-804D-E7E9D542D355}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CB001ED9-7309-4469-804D-E7E9D542D355}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5786d022-540e-4699-b350-b4be0ae94b79}\ not found.
File C:\Program Files (x86)\Ashampoo_DE\prxtbAsha.dll not found.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0EDB8413-4BDE-4E2C-8B16-A08640E14B1C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EDB8413-4BDE-4E2C-8B16-A08640E14B1C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ not found.
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
Unable to set value : HKU\S-1-5-21-1729895072-3162029508-1750085212-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\Default_Page_URL| /E!
Unable to set value : HKU\S-1-5-21-1729895072-3162029508-1750085212-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E!
Registry key HKEY_USERS\S-1-5-21-1729895072-3162029508-1750085212-1000\Software\Microsoft\Internet Explorer\URLSearchHooks not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{40c3cc16-7269-4b32-9531-17f2950fb06f}\ not found.
Registry key HKEY_USERS\S-1-5-21-1729895072-3162029508-1750085212-1000\Software\Microsoft\Internet Explorer\URLSearchHooks not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5786d022-540e-4699-b350-b4be0ae94b79}\ not found.
File C:\Program Files (x86)\Ashampoo_DE\prxtbAsha.dll not found.
Registry key HKEY_USERS\S-1-5-21-1729895072-3162029508-1750085212-1000\Software\Microsoft\Internet Explorer\URLSearchHooks not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B922D405-6D13-4A2B-AE89-08A030DA4402}\ not found.
File C:\Program Files (x86)\pdfforge Toolbar\IE\5.8\pdfforgeToolbarIE.dll not found.
Unable to set value : HKEY_USERS\S-1-5-21-1729895072-3162029508-1750085212-1000\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E!
Registry key HKEY_USERS\S-1-5-21-1729895072-3162029508-1750085212-1000\Software\Microsoft\Internet Explorer\SearchScopes\{3A8133B4-C22D-4C00-AC2E-9A049C4F9617}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3A8133B4-C22D-4C00-AC2E-9A049C4F9617}\ not found.
Registry key HKEY_USERS\S-1-5-21-1729895072-3162029508-1750085212-1000\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ not found.
Unable to set value : HKU\S-1-5-21-1729895072-3162029508-1750085212-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E!
File C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml not found.
File C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml not found.
File C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml not found.
File C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml not found.
File C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d2ce3e00-f94a-4740-988e-03dc2f38c34f}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d2ce3e00-f94a-4740-988e-03dc2f38c34f}\ not found.
File C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll not found.
64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{8dcb7100-df86-4384-8842-8fa844297b3f} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8dcb7100-df86-4384-8842-8fa844297b3f}\ not found.
File C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked not found.
Registry key HKEY_USERS\S-1-5-21-1729895072-3162029508-1750085212-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{21FA44EF-376D-4D53-9B0F-8A89D3229068}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ not found.
Registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{54c34660-89f2-11e1-909c-f04da24e1863}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{54c34660-89f2-11e1-909c-f04da24e1863}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{54c34660-89f2-11e1-909c-f04da24e1863}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{54c34660-89f2-11e1-909c-f04da24e1863}\ not found.
File E:\LGAutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{74fbf721-0ec9-11e0-afe2-f04da24e1863}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{74fbf721-0ec9-11e0-afe2-f04da24e1863}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{74fbf721-0ec9-11e0-afe2-f04da24e1863}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{74fbf721-0ec9-11e0-afe2-f04da24e1863}\ not found.
File E:\autorun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E\ not found.
File E:\LGAutoRun.exe not found.
========== FILES ==========
File\Folder C:\Users\*****\AppData\Roaming\Fywyrpvnltq not found.
File\Folder C:\Windows\tasks\SystemToolsDailyTest.job not found.
File\Folder C:\Windows\tasks\PCDoctorBackgroundMonitorTask.job not found.
File\Folder C:\Users\*****\Documents\jsEsoluageujtAtoDuTOe not found.
File\Folder C:\Users\*****\TgeTOsAtUAsaOsaOUAsd not found.
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Aufl”sungscache wurde geleert.
C:\Users\gabi\Downloads\cmd.bat deleted successfully.
C:\Users\gabi\Downloads\cmd.txt deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: gabi
->Temp folder emptied: 81230005 bytes
->Temporary Internet Files folder emptied: 525438772 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 12975 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 156972319 bytes
RecycleBin emptied: 81897705 bytes
 
Total Files Cleaned = 806,00 mb
 
 
OTL by OldTimer - Version 3.2.45.0 log created on 06032012_204516

Files\Folders moved on Reboot...
File\Folder C:\Windows\temp\WFVB3C5.tmp not found!

Registry entries deleted on Reboot...