Trojaner-Board - Verschlüsselungstrojaner mit Zahlungsaufforderung

Hier der Bericht von Combofix:
Combofix Logfile:
Code:
ComboFix 12-04-31.02 - Uli und Johanna 30.04.2012  21:38:04.1.2 - x86

Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.3071.1952 [GMT 2:00]

ausgeführt von:: c:\users\Uli und Johanna\Desktop\ComboFix.exe

AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}

SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\users\Uli und Johanna\AppData\Roaming\Mozilla\Firefox\Profiles\7ph2ckux.default\weave\toFetch

c:\users\Uli und Johanna\AppData\Roaming\Mozilla\Firefox\Profiles\7ph2ckux.default\weave\toFetch\locked-bookmarks.json.alpe

c:\users\Uli und Johanna\AppData\Roaming\Mozilla\Firefox\Profiles\7ph2ckux.default\weave\toFetch\locked-clients.json.kmwp

c:\users\Uli und Johanna\AppData\Roaming\Mozilla\Firefox\Profiles\7ph2ckux.default\weave\toFetch\locked-forms.json.xftd

c:\users\Uli und Johanna\AppData\Roaming\Mozilla\Firefox\Profiles\7ph2ckux.default\weave\toFetch\locked-history.json.ugvr

c:\users\Uli und Johanna\AppData\Roaming\Mozilla\Firefox\Profiles\7ph2ckux.default\weave\toFetch\locked-passwords.json.rinz

c:\users\Uli und Johanna\AppData\Roaming\Mozilla\Firefox\Profiles\7ph2ckux.default\weave\toFetch\locked-prefs.json.gupr

c:\users\Uli und Johanna\AppData\Roaming\Mozilla\Firefox\Profiles\7ph2ckux.default\weave\toFetch\locked-tabs.json.xdtf

.

Infizierte Kopie von c:\windows\system32\userinit.exe wurde gefunden und desinfiziert 

Kopie von - c:\windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe wurde wiederhergestellt 

.

.

(((((((((((((((((((((((   Dateien erstellt von 2012-03-28 bis 2012-04-30  ))))))))))))))))))))))))))))))

.

.

2012-04-30 19:21 . 2012-04-30 19:21        --------        d-----w-        c:\users\Uli und Johanna\AppData\Roaming\Thunderbird

2012-04-30 19:21 . 2012-04-30 19:21        --------        d-----w-        c:\program files\Mozilla Thunderbird

2012-04-30 08:52 . 2012-04-30 08:52        --------        d-----w-        c:\users\Uli und Johanna\AppData\Local\MigWiz

2012-04-29 10:31 . 2012-04-18 01:06        6734704        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{D034DC6D-3A74-49DA-BA51-A0587EB6E3C9}\mpengine.dll

2012-04-28 07:13 . 2012-04-28 07:13        --------        d-----w-        c:\users\Uli und Johanna\AppData\Roaming\Avira

2012-04-28 07:07 . 2012-01-31 06:56        74640        ----a-w-        c:\windows\system32\drivers\avgntflt.sys

2012-04-28 07:07 . 2012-01-31 06:56        137416        ----a-w-        c:\windows\system32\drivers\avipbb.sys

2012-04-28 07:07 . 2011-09-16 14:08        36000        ----a-w-        c:\windows\system32\drivers\avkmgr.sys

2012-04-28 07:07 . 2012-04-28 07:07        --------        d-----w-        c:\programdata\Avira

2012-04-28 07:07 . 2012-04-28 07:07        --------        d-----w-        c:\program files\Avira

2012-04-27 18:41 . 2012-04-27 18:41        637848        ----a-w-        c:\windows\system32\npdeployJava1.dll

2012-04-27 18:41 . 2012-04-27 18:41        567696        ----a-w-        c:\windows\system32\deployJava1.dll

2012-04-27 17:32 . 2012-04-27 17:32        --------        d-----w-        c:\program files\Common Files\Java

2012-04-27 17:30 . 2012-04-27 17:30        --------        d-----w-        c:\program files\Java

2012-04-27 16:12 . 2012-04-27 16:12        --------        d-----w-        c:\users\Uli und Johanna\AppData\Roaming\Malwarebytes

2012-04-27 16:12 . 2012-04-27 16:12        --------        d-----w-        c:\programdata\Malwarebytes

2012-04-27 16:12 . 2012-04-27 18:25        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware

2012-04-25 14:11 . 2012-04-27 17:22        --------        d-----w-        c:\users\Uli und Johanna\AppData\Roaming\Vrugvrueal

2012-04-25 14:11 . 2012-04-27 17:22        --------        d-----w-        c:\users\Uli und Johanna\AppData\Roaming\Realtec

2012-04-12 12:17 . 2012-02-29 15:11        5120        ----a-w-        c:\windows\system32\wmi.dll

2012-04-12 12:17 . 2012-02-29 15:11        172032        ----a-w-        c:\windows\system32\wintrust.dll

2012-04-12 12:17 . 2012-02-29 15:09        157696        ----a-w-        c:\windows\system32\imagehlp.dll

2012-04-12 12:17 . 2012-02-29 13:32        12800        ----a-w-        c:\windows\system32\drivers\fs_rec.sys

2012-04-12 12:16 . 2012-03-06 06:39        3602816        ----a-w-        c:\windows\system32\ntkrnlpa.exe

2012-04-12 12:16 . 2012-03-06 06:39        3550080        ----a-w-        c:\windows\system32\ntoskrnl.exe

2012-04-12 12:05 . 2012-04-12 12:05        --------        d-----w-        c:\users\Default\AppData\Local\Microsoft Help

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-02-23 08:18 . 2009-10-04 11:15        237072        ------w-        c:\windows\system32\MpSigStub.exe

2012-02-14 15:45 . 2012-03-14 16:43        219648        ----a-w-        c:\windows\system32\d3d10_1core.dll

2012-02-14 15:45 . 2012-03-14 16:43        160768        ----a-w-        c:\windows\system32\d3d10_1.dll

2012-02-14 10:09 . 2012-02-14 10:09        1070352        ----a-w-        c:\windows\system32\MSCOMCTL.OCX

2012-02-13 14:12 . 2012-03-14 16:43        1172480        ----a-w-        c:\windows\system32\d3d10warp.dll

2012-02-13 13:47 . 2012-03-14 16:43        683008        ----a-w-        c:\windows\system32\d2d1.dll

2012-02-13 13:44 . 2012-03-14 16:43        1068544        ----a-w-        c:\windows\system32\DWrite.dll

2012-02-02 15:16 . 2012-03-14 16:43        2044416        ----a-w-        c:\windows\system32\win32k.sys

2012-03-26 16:11 . 2011-05-18 14:11        97208        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]

"RtHDVCpl"="RtHDVCpl.exe" [2008-01-07 4853760]

"Skytel"="Skytel.exe" [2007-11-20 1826816]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-12-06 1029416]

"Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdSync.exe" [2008-01-21 215552]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-03-27 37296]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2012-01-31 258512]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]

2008-02-06 19:48        51048        ----a-w-        c:\program files\Common Files\Symantec Shared\ccApp.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus DX7400 Series]

2007-04-12 06:00        182272        ----a-w-        c:\windows\System32\spool\drivers\w32x86\3\E_FATICDE.EXE

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FreePDF Assistant]

2010-06-17 20:56        370176        ----a-w-        c:\program files\FreePDF_XP\fpassist.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\isCfgWiz]

2008-02-23 17:41        611712        ----a-w-        c:\program files\Common Files\Symantec Shared\OPC\{C86EA115-FACD-4aa8-BFA2-398C677D0936}\SYMCUW.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]

2009-04-11 06:28        1233920        ----a-w-        c:\program files\Windows Sidebar\sidebar.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2012-01-17 09:07        252296        ----a-w-        c:\program files\Common Files\Java\Java Update\jusched.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

.

--- Andere Dienste/Treiber im Speicher ---

.

*NewlyCreated* - COMHOST

*NewlyCreated* - WS2IFSL

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceAndNoImpersonation        REG_MULTI_SZ           FontCache

WindowsMobile        REG_MULTI_SZ           wcescomm rapimgr

LocalServiceRestricted        REG_MULTI_SZ           WcesComm RapiMgr

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://www.google.de/

IE: An OneNote s&enden - /105

IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000

IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000

TCP: DhcpNameServer = 192.168.2.1

FF - ProfilePath - c:\users\Uli und Johanna\AppData\Roaming\Mozilla\Firefox\Profiles\7ph2ckux.default\

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/

FF - user.js: yahoo.homepage.dontask - true

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2012-04-30 21:48

Windows 6.0.6002 Service Pack 2 NTFS

.

Scanne versteckte Prozesse... 

.

Scanne versteckte Autostarteinträge... 

.

Scanne versteckte Dateien... 

.

.

c:\users\ULIUND~1\AppData\Local\Temp\ArmUI.ini 163994 bytes

.

Scan erfolgreich abgeschlossen

versteckte Dateien: 1

.

**************************************************************************

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

"MSCurrentCountry"=dword:000000b5

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\windows\system32\Ati2evxx.exe

c:\windows\system32\Ati2evxx.exe

c:\program files\ATK Hotkey\ASLDRSrv.exe

c:\windows\system32\WLANExt.exe

c:\program files\Common Files\Symantec Shared\ccSvcHst.exe

c:\program files\Avira\AntiVir Desktop\sched.exe

c:\windows\system32\agrsmsvc.exe

c:\program files\Avira\AntiVir Desktop\avguard.exe

c:\program files\TeamViewer\Version6\TeamViewer_Service.exe

c:\windows\system32\WUDFHost.exe

c:\program files\Avira\AntiVir Desktop\avshadow.exe

c:\windows\servicing\TrustedInstaller.exe

c:\program files\Wireless Console 2\wcourier.exe

c:\program files\ATK Hotkey\Hcontrol.exe

c:\program files\ATKOSD2\ATKOSD2.exe

c:\program files\ATK Hotkey\ATKOSD.exe

c:\program files\ATK Hotkey\KBFiltr.exe

c:\windows\system32\conime.exe

c:\windows\RtHDVCpl.exe

c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

c:\windows\ehome\ehmsas.exe

c:\program files\Synaptics\SynTP\SynTPHelper.exe

c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2012-04-30  21:54:21 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2012-04-30 19:53

.

Vor Suchlauf: 8 Verzeichnis(se), 99.423.870.976 Bytes frei

Nach Suchlauf: 13 Verzeichnis(se), 99.252.228.096 Bytes frei

.

- - End Of File - - 225C85BC5AA09E7FC57BC1DF7E0AF9D1
--- --- ---