| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Eingabe von 40 TAN bei online-banking, Trojaner eingefangenWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
06.01.2011, 22:58
| #1 |
 |  Eingabe von 40 TAN bei online-banking, Trojaner eingefangen Hallo liebes Board, auch ich bin irgendwie an einen Trojaner  geraten, der beim online-banking die Eingabe von 40 TAN verlangt. Habe abgebrochen und das banking sperren lassen. Dann habe ich AntiVir laufen lassen - allerdings hat er mittendrin nicht mehr weitergemacht. Schlussendlich habe ich mich bis spät in die Nacht durch eure Board-Seiten gewühlt, um irgendwelche Hinweise zu bekommen. Erst mal habe ich durch den Tipp eines Bekannten bei AntiVir eine neue Konfiguration gemacht. War aber genau das gleiche wie beim ersten Mal, mittendrin aufgehört. Dann hab ich Malwarebytes runtergeladen. Dort wurden 80 infizierte Dateien gefunden, die ich dann erfolgreich gelöscht habe. Die Log-Datei als Anhang. Da ich nicht wirklich ein Freak bin und von so etwas nicht viel Ahnung habe, hoffe ich, dass ihr mir irgendwie helfen könnt. Vielen Dank schon mal im voraus.Viele Grüße Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org Datenbank Version: 5464 Windows 5.1.2600 Service Pack 2 Internet Explorer 7.0.5730.13 05.01.2011 17:50:15 mbam-log-2011-01-05 (17-50-15).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|) Durchsuchte Objekte: 267434 Laufzeit: 51 Minute(n), 41 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 7 Infizierte Registrierungswerte: 1 Infizierte Dateiobjekte der Registrierung: 1 Infizierte Verzeichnisse: 1 Infizierte Dateien: 70 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: HKEY_CLASSES_ROOT\CLSID\{F22C37FD-2BCB-40b6-A12E-77DDA1FBDD88} (Trojan.Banker) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\linkrdr.AIEbho.1 (Trojan.Banker) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\linkrdr.AIEbho (Trojan.Banker) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F22C37FD-2BCB-40B6-A12E-77DDA1FBDD88} (Trojan.Banker) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{F22C37FD-2BCB-40B6-A12E-77DDA1FBDD88} (Trojan.Banker) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\prh (Trojan.Banker) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\tst (Trojan.Banker) -> Quarantined and deleted successfully. Infizierte Registrierungswerte: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{F5022133-FBEF-129F-A16C-F6CF3B659C98} (Trojan.ZbotR.Gen) -> Value: {F5022133-FBEF-129F-A16C-F6CF3B659C98} -> Delete on reboot. Infizierte Dateiobjekte der Registrierung: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.UserInit) -> Bad: (C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\appconf32.exe,) Good: (userinit.exe) -> Quarantined and deleted successfully. Infizierte Verzeichnisse: c:\WINDOWS\system32\xmldm (Stolen.Data) -> Quarantined and deleted successfully. Infizierte Dateien: c:\system volume information\_restore{e441a6a6-cfaf-4251-962f-c8c35e995178}\RP374\A0065035.dll (Trojan.Banker) -> Quarantined and deleted successfully. c:\system volume information\_restore{e441a6a6-cfaf-4251-962f-c8c35e995178}\RP398\A0067902.exe (Spyware.Zbot) -> Quarantined and deleted successfully. c:\system volume information\_restore{e441a6a6-cfaf-4251-962f-c8c35e995178}\RP399\A0067968.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully. c:\system volume information\_restore{e441a6a6-cfaf-4251-962f-c8c35e995178}\RP400\A0067999.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully. c:\WINDOWS\system32\5008\components\acroff008.dll (Trojan.Banker) -> Quarantined and deleted successfully. c:\WINDOWS\system32\srvblck2.tmp (Malware.Trace) -> Quarantined and deleted successfully. c:\WINDOWS\system32\acroiehelpe.txt (Malware.Trace) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\administrator\anwendungsdaten\Unhys\ciqyy.exe (Trojan.ZbotR.Gen) -> Quarantined and deleted successfully. c:\WINDOWS\system32\xmldm\264_0000000357.pst (Stolen.Data) -> Quarantined and deleted successfully. c:\WINDOWS\system32\xmldm\264_0000000358.key (Stolen.Data) -> Quarantined and deleted successfully. c:\WINDOWS\system32\xmldm\264_0000000359.htm (Stolen.Data) -> Quarantined and deleted successfully. c:\WINDOWS\system32\xmldm\264_0000000360.frm (Stolen.Data) -> Quarantined and deleted successfully. c:\WINDOWS\system32\xmldm\264_0000000361.key (Stolen.Data) -> Quarantined and deleted successfully. c:\WINDOWS\system32\xmldm\264_0000000362.htm (Stolen.Data) -> Quarantined and deleted successfully. c:\WINDOWS\system32\xmldm\264_0000000363.frm (Stolen.Data) -> Quarantined and deleted successfully. c:\WINDOWS\system32\xmldm\264_0000000364.key (Stolen.Data) -> Quarantined and deleted successfully. c:\WINDOWS\system32\xmldm\264_0000000365.htm (Stolen.Data) -> Quarantined and deleted successfully. c:\WINDOWS\system32\xmldm\264_0000000366_ifrm.htm (Stolen.Data) -> Quarantined and deleted successfully. c:\WINDOWS\system32\xmldm\264_0000000367.frm (Stolen.Data) -> Quarantined and deleted successfully. c:\WINDOWS\system32\xmldm\264_0000000368.pst (Stolen.Data) -> Quarantined and deleted successfully. c:\WINDOWS\system32\xmldm\2828_0000000315.pst (Stolen.Data) -> Quarantined and deleted successfully. c:\WINDOWS\system32\xmldm\2828_0000000317.htm (Stolen.Data) -> Quarantined and deleted successfully. c:\WINDOWS\system32\xmldm\2828_0000000318.frm (Stolen.Data) -> Quarantined and deleted successfully. c:\WINDOWS\system32\xmldm\2828_0000000319.pst (Stolen.Data) -> Quarantined and deleted successfully. c:\WINDOWS\system32\xmldm\2828_0000000321.htm (Stolen.Data) -> Quarantined and deleted successfully. c:\WINDOWS\system32\xmldm\2828_0000000322.frm (Stolen.Data) -> Quarantined and deleted successfully. c:\WINDOWS\system32\xmldm\2828_0000000323.pst (Stolen.Data) -> Quarantined and deleted successfully. c:\WINDOWS\system32\xmldm\2828_0000000325.htm (Stolen.Data) -> Quarantined and deleted successfully. c:\WINDOWS\system32\xmldm\2828_0000000326.frm (Stolen.Data) -> Quarantined and deleted successfully. c:\WINDOWS\system32\xmldm\2828_0000000327.pst (Stolen.Data) -> Quarantined and deleted successfully. c:\WINDOWS\system32\xmldm\2828_0000000329.htm (Stolen.Data) -> Quarantined and deleted successfully. c:\WINDOWS\system32\xmldm\2828_0000000330.frm (Stolen.Data) -> Quarantined and deleted successfully. c:\WINDOWS\system32\xmldm\2828_0000000332.htm (Stolen.Data) -> Quarantined and deleted successfully. c:\WINDOWS\system32\xmldm\2828_0000000333_ifrm.htm (Stolen.Data) -> Quarantined and deleted successfully. c:\WINDOWS\system32\xmldm\2828_0000000334.frm (Stolen.Data) -> Quarantined and deleted successfully. c:\WINDOWS\system32\xmldm\2828_0000000336.htm (Stolen.Data) -> Quarantined and deleted successfully. c:\WINDOWS\system32\xmldm\2828_0000000337_ifrm.htm (Stolen.Data) -> Quarantined and deleted successfully. c:\WINDOWS\system32\xmldm\2828_0000000338.frm (Stolen.Data) -> Quarantined and deleted successfully. c:\WINDOWS\system32\xmldm\2828_0000000340.htm (Stolen.Data) -> Quarantined and deleted successfully. c:\WINDOWS\system32\xmldm\2828_0000000341.frm (Stolen.Data) -> Quarantined and deleted successfully. c:\WINDOWS\system32\xmldm\2828_0000000342.pst (Stolen.Data) -> Quarantined and deleted successfully. c:\WINDOWS\system32\xmldm\2828_0000000344.htm (Stolen.Data) -> Quarantined and deleted successfully. c:\WINDOWS\system32\xmldm\2828_0000000345_ifrm.htm (Stolen.Data) -> Quarantined and deleted successfully. c:\WINDOWS\system32\xmldm\2828_0000000346.frm (Stolen.Data) -> Quarantined and deleted successfully. c:\WINDOWS\system32\xmldm\2828_0000000347.frm (Stolen.Data) -> Quarantined and deleted successfully. c:\WINDOWS\system32\xmldm\2828_0000000348.pst (Stolen.Data) -> Quarantined and deleted successfully. c:\WINDOWS\system32\xmldm\2828_0000000350.htm (Stolen.Data) -> Quarantined and deleted successfully. c:\WINDOWS\system32\xmldm\2828_0000000351.frm (Stolen.Data) -> Quarantined and deleted successfully. c:\WINDOWS\system32\xmldm\2828_0000000352.pst (Stolen.Data) -> Quarantined and deleted successfully. c:\WINDOWS\system32\xmldm\2828_0000000354.htm (Stolen.Data) -> Quarantined and deleted successfully. c:\WINDOWS\system32\xmldm\2828_0000000355.frm (Stolen.Data) -> Quarantined and deleted successfully. c:\WINDOWS\system32\xmldm\2828_0000000356.pst (Stolen.Data) -> Quarantined and deleted successfully. c:\WINDOWS\system32\xmldm\iexplore.exe_uas006.dat (Stolen.Data) -> Quarantined and deleted successfully. c:\WINDOWS\system32\xmldm\2828_0000000296.frm (Stolen.Data) -> Quarantined and deleted successfully. c:\WINDOWS\system32\xmldm\2828_0000000297.pst (Stolen.Data) -> Quarantined and deleted successfully. c:\WINDOWS\system32\xmldm\2828_0000000299.htm (Stolen.Data) -> Quarantined and deleted successfully. c:\WINDOWS\system32\xmldm\2828_0000000300.frm (Stolen.Data) -> Quarantined and deleted successfully. c:\WINDOWS\system32\xmldm\2828_0000000302.htm (Stolen.Data) -> Quarantined and deleted successfully. c:\WINDOWS\system32\xmldm\2828_0000000303_ifrm.htm (Stolen.Data) -> Quarantined and deleted successfully. c:\WINDOWS\system32\xmldm\2828_0000000304.frm (Stolen.Data) -> Quarantined and deleted successfully. c:\WINDOWS\system32\xmldm\2828_0000000306.htm (Stolen.Data) -> Quarantined and deleted successfully. c:\WINDOWS\system32\xmldm\2828_0000000307_ifrm.htm (Stolen.Data) -> Quarantined and deleted successfully. c:\WINDOWS\system32\xmldm\2828_0000000308.frm (Stolen.Data) -> Quarantined and deleted successfully. c:\WINDOWS\system32\xmldm\2828_0000000309.frm (Stolen.Data) -> Quarantined and deleted successfully. c:\WINDOWS\system32\xmldm\2828_0000000310.frm (Stolen.Data) -> Quarantined and deleted successfully. c:\WINDOWS\system32\xmldm\2828_0000000311.frm (Stolen.Data) -> Quarantined and deleted successfully. c:\WINDOWS\system32\xmldm\2828_0000000312.frm (Stolen.Data) -> Quarantined and deleted successfully. c:\WINDOWS\system32\xmldm\2828_0000000313.frm (Stolen.Data) -> Quarantined and deleted successfully. c:\WINDOWS\system32\xmldm\2828_0000000295.htm (Stolen.Data) -> Quarantined and deleted successfully. c:\WINDOWS\system32\xmldm\2828_0000000314.frm (Stolen.Data) -> Quarantined and deleted successfully. Ich hoffe, ihr kommt erst mal mit meinen laienhaften Schilderungen zurecht.... |
| Themen zu Eingabe von 40 TAN bei online-banking, Trojaner eingefangen |
| .dll, abgebrochen, administrator, anti-malware, antivir, browser, dateien, e-banking, einstellungen, explorer, gelöscht, helper, iexplore.exe, infizierte, infizierte dateien, log-datei, malwarebytes, microsoft, neue, nicht mehr, software, stolen.data, system, system volume information, system32, tan, trojan.zbotr.gen, trojaner, trojaner eingefangen, userinit, winlogon, xmldm |
Baum-Darstellung