| |
| |||||||
Log-Analyse und Auswertung: Trojan.Ransom.Win32.Foreign.kvfa gefunden in C:\Documents and Settings\Carmen\Downloads\2014_05rechnungonline_8290485236sign.zipWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
29.05.2014, 12:23
| #1 |
 |  Trojan.Ransom.Win32.Foreign.kvfa gefunden in C:\Documents and Settings\Carmen\Downloads\2014_05rechnungonline_8290485236sign.zip Hallo, in einem Moment geistiger Umnachtung habe ich gestern den Anhang einer gefälschten Telekom-Rechnung heruntergeladen. Soweit ich weiß, habe ich die Datei aber nicht ausgeführt (aber da ich ein wenig hektisch und panisch war, kann ich das nicht mit absoluter Sicherheit sagen). Da mir das Ganze dann komisch vorkam, habe ich danach Kaspersky über die ganze Platte laufen lassen - Kaspersky hat erst einmal nichts gefunden. Dann habe ich eure Anweisungen befolgt: Hier der Log von defogger: Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 08:50 on 29/05/2014 (Admin)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:25-05-2014 02
Ran by SYSTEM on MINWINPC on 29-05-2014 09:27:31
Running from G:\
Platform: Windows Vista (TM) Home Premium Service Pack 1 (X86) OS Language: English(US)
Internet Explorer Version 9
Boot Mode: Recovery
The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.
The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-20] (Microsoft Corporation)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1029416 2007-12-06] (Synaptics, Inc.)
HKLM\...\Run: [NDSTray.exe] => NDSTray.exe
HKLM\...\Run: [cfFncEnabler.exe] => cfFncEnabler.exe
HKLM\...\Run: [Google Desktop Search] => C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [30192 2010-07-28] (Google)
HKLM\...\Run: [Google EULA Launcher] => c:\Program Files\Google\Google EULA\GoogleEULALauncher.exe [20480 2008-05-28] ( )
HKLM\...\Run: [Toshiba TEMPO] => C:\Program Files\Toshiba TEMPRO\Toshiba.Tempo.UI.TrayApplication.exe [103824 2008-04-24] (Toshiba Europe GmbH)
HKLM\...\Run: [topi] => C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe [581632 2007-07-09] (TOSHIBA)
HKLM\...\Run: [RtHDVCpl] => C:\Windows\RtHDVCpl.exe [6037504 2008-04-08] (Realtek Semiconductor)
HKLM\...\Run: [Skytel] => C:\Windows\Skytel.exe [1826816 2007-11-20] (Realtek Semiconductor Corp.)
HKLM\...\Run: [TPwrMain] => C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [431456 2008-01-17] (TOSHIBA Corporation)
HKLM\...\Run: [HSON] => C:\Program Files\TOSHIBA\TBS\HSON.exe [54608 2007-10-31] (TOSHIBA Corporation)
HKLM\...\Run: [SmoothView] => C:\Program Files\Toshiba\SmoothView\SmoothView.exe [509816 2008-06-24] (TOSHIBA Corporation)
HKLM\...\Run: [00TCrdMain] => C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe [716800 2008-05-09] (TOSHIBA Corporation)
HKLM\...\Run: [Toshiba Registration] => C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe [574864 2008-01-10] (Toshiba)
HKLM\...\Run: [HPPQVideo] => C:\Program Files\HP\ScheduledLaunch\HP Color LaserJet CP1510 Series\bin\hppschlnch.exe [106496 2007-05-07] (Hewlett-Packard)
HKLM\...\Run: [ToolBoxFX] => C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe [53248 2007-08-28] (HP)
HKLM\...\Run: [HP Software Update] => C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [49152 2007-03-11] (Hewlett-Packard Co.)
HKLM\...\Run: [] => [X]
HKLM\...\Run: [HPUsageTracking] => C:\Program Files\HP\HP UT\bin\hppusg.exe [36864 2007-05-08] ()
HKLM\...\Run: [Windows Mobile-based device management] => C:\Windows\WindowsMobile\wmdSync.exe [215552 2008-01-20] (Microsoft Corporation)
HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM\...\Run: [WPCUMI] => C:\Windows\system32\WpcUmi.exe [176128 2006-11-02] (Microsoft Corporation)
HKLM\...\Run: [PCSuiteTrayApplication] => C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe [227328 2007-03-23] (Nokia)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2013-04-30] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2013-11-01] (Apple Inc.)
HKU\Admin\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Admin\...\Run: [TOSCDSPD] => C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe [430080 2008-04-24] (TOSHIBA)
HKU\Admin\...\Policies\system: [LogonHoursAction] 2
HKU\Admin\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\Carmen\...\Run: [TOSCDSPD] => C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe [430080 2008-04-24] (TOSHIBA)
HKU\Carmen\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-20] (Microsoft Corporation)
HKU\Carmen\...\Policies\system: [LogonHoursAction] 2
HKU\Carmen\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\Default\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Default\...\Run: [TOSCDSPD] => C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe [430080 2008-04-24] (TOSHIBA)
HKU\Default User\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Default User\...\Run: [TOSCDSPD] => C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe [430080 2008-04-24] (TOSHIBA)
HKU\Fabian\...\Run: [TOSCDSPD] => C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe [430080 2008-04-24] (TOSHIBA)
HKU\Fabian\...\Policies\system: [LogonHoursAction] 2
HKU\Fabian\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\Ingo\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\Ingo\...\Run: [TOSCDSPD] => C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe [430080 2008-04-24] (TOSHIBA)
HKU\Ingo\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-20] (Microsoft Corporation)
HKU\Ingo\...\Run: [CAHeadless] => C:\Program Files\Adobe\Elements 10 Organizer\CAHeadless\ElementsAutoAnalyzer.exe
HKU\Ingo\...\Run: [WMPNSCFG] => C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-20] (Microsoft Corporation)
HKU\Ingo\...\Policies\system: [LogonHoursAction] 2
HKU\Ingo\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\Lea\...\Run: [TOSCDSPD] => C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe [430080 2008-04-24] (TOSHIBA)
HKU\Lea\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-20] (Microsoft Corporation)
HKU\Lea\...\Run: [WMPNSCFG] => C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-20] (Microsoft Corporation)
HKU\Lea\...\Policies\system: [LogonHoursAction] 2
HKU\Lea\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL => C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll [123392 2010-07-28] (Google)
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Ingo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\Lea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
GroupPolicyUsers\S-1-5-21-1908030813-1555713195-3511680284-1004\User: Group Policy restriction detected <======= ATTENTION
GroupPolicyUsers\S-1-5-21-1908030813-1555713195-3511680284-1003\User: Group Policy restriction detected <======= ATTENTION
GroupPolicyUsers\S-1-5-21-1908030813-1555713195-3511680284-1002\User: Group Policy restriction detected <======= ATTENTION
========================== Services (Whitelisted) =================
S2 avp; C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe [214512 2013-10-17] (Kaspersky Lab ZAO)
S2 ConfigFree Service; C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe [40960 2008-04-16] (TOSHIBA CORPORATION)
S3 GoogleDesktopManager-051210-111108; C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [30192 2010-07-28] (Google)
S2 HTCMonitorService; C:\Program Files\HTC\HTC Sync Manager\HSMServiceEntry.exe [87368 2013-04-12] (Nero AG)
S2 PassThru Service; C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe [167424 2012-12-07] ()
S2 TempoMonitoringService; C:\Program Files\Toshiba TEMPRO\TempoSVC.exe [99720 2008-04-24] (Toshiba Europe GmbH)
S2 TOSHIBA SMART Log Service; C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe [126976 2008-02-06] (TOSHIBA Corporation)
S2 UleadBurningHelper; C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe [49152 2006-08-23] (Ulead Systems, Inc.)
==================== Drivers (Whitelisted) ====================
S3 HPFXBULK; C:\Windows\System32\drivers\hpfxbulk.sys [17432 2007-07-16] (Hewlett Packard)
S3 k750bus; C:\Windows\System32\DRIVERS\k750bus.sys [55216 2005-02-11] (MCCI)
S0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [135776 2014-03-02] (Kaspersky Lab ZAO)
S1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [576608 2014-03-20] (Kaspersky Lab ZAO)
S1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [25696 2013-10-17] (Kaspersky Lab ZAO)
S3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [25184 2014-03-02] (Kaspersky Lab ZAO)
S3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [25696 2013-10-17] (Kaspersky Lab ZAO)
S1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [14432 2013-04-12] (Kaspersky Lab ZAO)
S1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [45024 2013-05-14] (Kaspersky Lab ZAO)
S1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [144992 2014-03-02] (Kaspersky Lab ZAO)
S3 RTL8187B; C:\Windows\System32\DRIVERS\RTL8187B.sys [290304 2007-12-26] (Realtek Semiconductor Corporation )
S1 RtlProt; C:\Windows\System32\DRIVERS\rtlprot.sys [25896 2007-04-23] (Windows (R) Codename Longhorn DDK provider)
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S5 klflt; C:\Windows\System32\Drivers\klflt.sys [94304 2014-03-20] (Kaspersky Lab ZAO)
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-05-29 09:25 - 2014-05-29 09:26 - 00000000 ____D () C:\FRST
2014-05-28 22:50 - 2014-05-28 22:50 - 00000472 _____ () C:\Users\Carmen\Desktop\defogger_disable.log
2014-05-28 22:50 - 2014-05-28 22:50 - 00000000 _____ () C:\Users\Admin\defogger_reenable
2014-05-28 22:49 - 2014-05-28 00:46 - 00380416 _____ () C:\Users\Carmen\Desktop\Gmer-19357.exe
2014-05-28 22:49 - 2014-05-28 00:42 - 00050477 _____ () C:\Users\Carmen\Desktop\Defogger.exe
2014-05-28 22:49 - 2014-05-28 00:28 - 02066944 _____ (Farbar) C:\Users\Carmen\Desktop\FRST64.exe
2014-05-28 22:49 - 2014-05-28 00:26 - 01056256 _____ (Farbar) C:\Users\Carmen\Desktop\FRST.exe
2014-05-27 08:38 - 2014-05-27 08:38 - 00064874 _____ () C:\Users\Carmen\Downloads\2014_05_rechnungonline_8290485236sign.zip
2014-05-16 09:26 - 2014-05-16 09:26 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER
2014-05-16 09:22 - 2014-05-05 15:32 - 12347392 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2014-05-16 09:22 - 2014-05-05 15:14 - 02382848 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2014-05-16 09:22 - 2014-05-05 15:14 - 00073216 _____ (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2014-05-16 05:14 - 2014-05-16 05:14 - 142602520 _____ (Microsoft Corporation) C:\Users\Lea\Downloads\wlsetup-all_16.4.3508.0205.exe
2014-05-16 03:52 - 2014-03-25 05:26 - 11587584 _____ (Microsoft Corporation) C:\Windows\System32\shell32.dll
2014-05-13 20:43 - 2014-05-13 20:43 - 00360954 _____ () C:\Users\Lea\Documents\satyr.jpg.bmp
2014-05-12 00:33 - 2014-05-12 00:33 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-04-30 06:43 - 2014-04-30 06:43 - 00000000 ____D () C:\Users\Fabian\AppData\Local\Microsoft Games
==================== One Month Modified Files and Folders =======
2014-05-29 09:26 - 2014-05-29 09:25 - 00000000 ____D () C:\FRST
2014-05-28 23:19 - 2008-11-23 08:25 - 01825196 _____ () C:\Windows\WindowsUpdate.log
2014-05-28 23:19 - 2006-11-02 04:47 - 00003216 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-28 23:19 - 2006-11-02 04:47 - 00003216 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-28 23:14 - 2008-01-20 23:16 - 00769562 _____ () C:\Windows\System32\PerfStringBackup.INI
2014-05-28 23:07 - 2013-08-05 02:15 - 00000000 ____D () C:\Users\Carmen\AppData\Local\HTC MediaHub
2014-05-28 23:07 - 2013-03-29 01:13 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2014-05-28 22:50 - 2014-05-28 22:50 - 00000472 _____ () C:\Users\Carmen\Desktop\defogger_disable.log
2014-05-28 22:50 - 2014-05-28 22:50 - 00000000 _____ () C:\Users\Admin\defogger_reenable
2014-05-28 22:50 - 2008-11-23 09:46 - 00000000 ____D () C:\users\Admin
2014-05-28 22:48 - 2006-11-02 04:52 - 00167948 _____ () C:\Windows\setupact.log
2014-05-28 00:46 - 2014-05-28 22:49 - 00380416 _____ () C:\Users\Carmen\Desktop\Gmer-19357.exe
2014-05-28 00:42 - 2014-05-28 22:49 - 00050477 _____ () C:\Users\Carmen\Desktop\Defogger.exe
2014-05-28 00:28 - 2014-05-28 22:49 - 02066944 _____ (Farbar) C:\Users\Carmen\Desktop\FRST64.exe
2014-05-28 00:26 - 2014-05-28 22:49 - 01056256 _____ (Farbar) C:\Users\Carmen\Desktop\FRST.exe
2014-05-27 08:38 - 2014-05-27 08:38 - 00064874 _____ () C:\Users\Carmen\Downloads\2014_05_rechnungonline_8290485236sign.zip
2014-05-27 08:28 - 2012-10-21 08:52 - 00000000 ____D () C:\Users\Lea\AppData\Roaming\.minecraft
2014-05-27 06:13 - 2013-08-07 09:17 - 00000000 ____D () C:\Users\Lea\AppData\Local\HTC MediaHub
2014-05-27 03:48 - 2013-08-05 09:14 - 00000000 ____D () C:\Users\Fabian\AppData\Local\HTC MediaHub
2014-05-22 05:00 - 2014-01-12 07:35 - 00021912 _____ () C:\Users\Ingo\Documents\Budgetplanung 2014.xlsx
2014-05-17 07:29 - 2013-08-04 09:16 - 00000000 ____D () C:\Users\Ingo\AppData\Local\HTC MediaHub
2014-05-16 20:43 - 2006-11-02 03:18 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-05-16 09:36 - 2013-07-10 11:26 - 00000000 ____D () C:\Windows\System32\MRT
2014-05-16 09:27 - 2006-11-02 02:24 - 90547776 _____ (Microsoft Corporation) C:\Windows\System32\mrt.exe
2014-05-16 09:26 - 2014-05-16 09:26 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER
2014-05-16 09:26 - 2008-08-11 06:30 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-05-16 05:20 - 2012-09-22 09:45 - 00000000 ____D () C:\Users\Lea\AppData\Local\Apple Computer
2014-05-16 05:19 - 2009-01-08 02:40 - 00032768 _____ () C:\Users\Lea\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-05-16 05:14 - 2014-05-16 05:14 - 142602520 _____ (Microsoft Corporation) C:\Users\Lea\Downloads\wlsetup-all_16.4.3508.0205.exe
2014-05-13 20:43 - 2014-05-13 20:43 - 00360954 _____ () C:\Users\Lea\Documents\satyr.jpg.bmp
2014-05-13 20:40 - 2013-11-25 08:54 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2014-05-13 20:40 - 2013-11-25 08:54 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2014-05-12 01:35 - 2013-11-24 06:05 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-05-12 00:33 - 2014-05-12 00:33 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-05-05 15:32 - 2014-05-16 09:22 - 12347392 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2014-05-05 15:14 - 2014-05-16 09:22 - 02382848 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2014-05-05 15:14 - 2014-05-16 09:22 - 00073216 _____ (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2014-04-30 06:43 - 2014-04-30 06:43 - 00000000 ____D () C:\Users\Fabian\AppData\Local\Microsoft Games
==================== Known DLLs (Whitelisted) ============
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
==================== EXE Association (whitelisted) =============
==================== Restore Points =========================
Restore point made on: 2014-05-20 07:28:32
Restore point made on: 2014-05-21 09:29:23
Restore point made on: 2014-05-23 06:58:33
Restore point made on: 2014-05-26 05:51:27
Restore point made on: 2014-05-27 11:03:52
==================== Memory info ===========================
Percentage of memory in use: 18%
Total physical RAM: 2939.26 MB
Available physical RAM: 2399.42 MB
Total Pagefile: 2637.12 MB
Available Pagefile: 2489.46 MB
Total Virtual: 2047.88 MB
Available Virtual: 1971.52 MB
==================== Drives ================================
Drive c: (Vista) (Fixed) (Total:116.29 GB) (Free:7.53 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (Data) (Fixed) (Total:115.13 GB) (Free:95.37 GB) NTFS
Drive f: (WinRE) (Fixed) (Total:1.46 GB) (Free:1.22 GB) NTFS
Drive g: () (Removable) (Total:1.92 GB) (Free:1.9 GB) FAT
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 233 GB) (Disk ID: 5855FAD5)
Partition 1: (Not Active) - (Size=1 GB) - (Type=27)
Partition 2: (Active) - (Size=116 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=115 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 2 GB) (Disk ID: C3072E18)
Partition 1: (Active) - (Size=2 GB) - (Type=06)
LastRegBack: 2014-05-28 23:14
==================== End Of Log ============================
Und noch mein Log von Gmer: Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-05-29 09:59:47
Windows 6.0.6002 Service Pack 2 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD25 rev.01.0 232,89GB
Running: Gmer-19357.exe; Driver: C:\Users\Admin\AppData\Local\Temp\pwtorpod.sys
---- System - GMER 2.1 ----
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwAdjustPrivilegesToken [0x917A0990]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwAlpcConnectPort [0x917511CE]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwAlpcSendWaitReceivePort [0x91751400]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwConnectPort [0x91750FC8]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwCreateSection [0x917A355C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwCreateThread [0x917A298C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwDebugActiveProcess [0x917A251E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwDeviceIoControlFile [0x91741640]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwDuplicateObject [0x917A0AD2]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwLoadDriver [0x917A05FE]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwMapViewOfSection [0x917A3312]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwOpenProcess [0x917A2052]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwOpenSection [0x917A378C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwOpenThread [0x917A267E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwQueueApcThread [0x917A31C6]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwRequestWaitReplyPort [0x917512D4]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwResumeThread [0x917A2EE2]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwSecureConnectPort [0x917510C8]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwSetContextThread [0x917A3048]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwSetInformationToken [0x91741A5A]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwSetSystemInformation [0x917A0936]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwSuspendProcess [0x917A225A]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwSuspendThread [0x917A2D82]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwSystemDebugControl [0x91741A6C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwTerminateProcess [0x917A23C0]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwTerminateThread [0x917A2882]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwUnmapViewOfSection [0x917A3894]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwWriteVirtualMemory [0x917A361E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwCreateThreadEx [0x917A2BD8]
---- Kernel code sections - GMER 2.1 ----
.text ntkrnlpa.exe!KeSetEvent + 119 842B9764 4 Bytes [90, 09, 7A, 91] {NOP ; OR [EDX-0x6f], EDI}
.text ntkrnlpa.exe!KeSetEvent + 13D 842B9788 4 Bytes [CE, 11, 75, 91] {INTO ; ADC [EBP-0x6f], ESI}
.text ntkrnlpa.exe!KeSetEvent + 181 842B97CC 4 Bytes [00, 14, 75, 91]
.text ntkrnlpa.exe!KeSetEvent + 1C1 842B980C 4 Bytes [C8, 0F, 75, 91] {ENTER 0x750f, 0x91}
.text ntkrnlpa.exe!KeSetEvent + 215 842B9860 4 Bytes [5C, 35, 7A, 91]
.text ...
.text C:\Windows\system32\DRIVERS\tos_sps32.sys section is writeable [0x8CD52480, 0x3C939, 0xE8000020]
.dsrt C:\Windows\system32\DRIVERS\tos_sps32.sys unknown last section [0x8CD93900, 0x3CA, 0x48000040]
---- User code sections - GMER 2.1 ----
.text C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe[3304] kernel32.dll!FindResourceA 769526EB 5 Bytes JMP 0042B6C0 C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe
.text C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe[3304] kernel32.dll!FindResourceW 76978289 5 Bytes JMP 0042B700 C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe
.text C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe[3304] USER32.dll!LoadStringA 761F6243 5 Bytes JMP 0042B990 C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe
.text C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe[3304] USER32.dll!CreateDialogParamW 761F72A2 5 Bytes JMP 0042B7B0 C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe
.text C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe[3304] USER32.dll!LoadMenuW 76201412 5 Bytes JMP 0042B880 C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe
.text C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe[3304] USER32.dll!LoadStringW 76209CCB 5 Bytes JMP 0042B8E0 C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe
.text C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe[3304] USER32.dll!CreateDialogParamA 762117AA 5 Bytes JMP 0042B740 C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe
.text C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe[3304] USER32.dll!LoadMenuA 76237C77 5 Bytes JMP 0042B820 C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe
---- Devices - GMER 2.1 ----
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys
AttachedDevice \Driver\tdx \Device\Tcp kltdi.sys
AttachedDevice \Driver\tdx \Device\Udp kltdi.sys
AttachedDevice \Driver\tdx \Device\RawIp kltdi.sys
AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys
---- EOF - GMER 2.1 ----
 Habe ich soweit alles richtig gemacht? Jetzt weiß ich natürlich nicht, ob der Trojaner sein Unwesen bei mir treibt...und wäre für eure Hilfe wirklich sehr sehr dankbar. Viele Grüße, Trojandepp |
| Themen zu Trojan.Ransom.Win32.Foreign.kvfa gefunden in C:\Documents and Settings\Carmen\Downloads\2014_05rechnungonline_8290485236sign.zip |
| adobe, association, avp, defender, desktop, google, home, kaspersky, logfile, mozilla, realtek, registry, rundll, scan, security, services.exe, sicherheit, software, svchost.exe, system, tcp, telekom-rechnung, trojan.ransom.win32.foreign.kvfa, trojaner, udp, vista, windows, windows xp |
Baum-Darstellung