Trojaner-Board - Verschlüsselungstrojaner Bsp: locked-DSC01806.JPG.anuq

Malwarebytes Log:

Code:

Malwarebytes Anti-Malware (Test) 1.61.0.1400

www.malwarebytes.org
 

Datenbank Version: v2012.06.17.03
 

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 9.0.8112.16421

Zeff :: HÖLLENMASCHINE [Administrator]
 

Schutz: Aktiviert
 

17.06.2012 21:41:49

mbam-log-2012-06-17 (21-41-49).txt
 

Art des Suchlaufs: Vollständiger Suchlauf

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 414077

Laufzeit: 42 Minute(n), 36 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 1

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Userinit (Backdoor.Agent) -> Daten: C:\Users\Zeff\AppData\Roaming\appconf32.exe -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 5

C:\Program Files\irc\RA-Script\Programme\mirc-keygen.exe (Malware.Packer.Gen) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Zeff\Documents\irc-key\mIRC 6.31\Patch & KeyGen\mirc.6.3-patch.exe (PUP.Hacktool.Patcher) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Zeff\Documents\irc-key\mIRC 6.31\Patch & KeyGen\mIRC 6.31\Patch & KeyGen\mirc.6.3-patch.exe (PUP.Hacktool.Patcher) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Zeff\Documents\irc1.5\RAScript_v1.5\RAScript v1.5\mirc-keygen.exe (Malware.Packer.Gen) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Zeff\AppData\Roaming\appconf32.exe (Backdoor.Agent) -> Löschen bei Neustart.
 

(Ende)

ESET:

Code:

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=a8bb6f71156b3a4482d14ae11049520e

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2012-06-17 09:41:57

# local_time=2012-06-17 11:41:57 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1033

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode=5893 16776574 100 94 1776851 91595558 0 0

# compatibility_mode=8192 67108863 100 0 142 142 0 0

# scanned=180430

# found=22

# cleaned=0

# scan_time=3610

C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarApp.dll        a variant of Win32/Toolbar.Babylon application (unable to clean)        00000000000000000000000000000000        I

C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarEng.dll        Win32/Toolbar.Babylon application (unable to clean)        00000000000000000000000000000000        I

C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarsrv.exe        probably a variant of Win32/Toolbar.Babylon application (unable to clean)        00000000000000000000000000000000        I

C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll        Win32/Toolbar.Babylon application (unable to clean)        00000000000000000000000000000000        I

C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll        Win32/Toolbar.Babylon application (unable to clean)        00000000000000000000000000000000        I

C:\Program Files (x86)\Yontoo\YontooIEClient.dll        a variant of Win32/Adware.Yontoo.A application (unable to clean)        00000000000000000000000000000000        I

C:\ProgramData\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll        a variant of Win32/Adware.Yontoo.B application (unable to clean)        00000000000000000000000000000000        I

C:\ProgramData\Tarma Installer\{ED7702F7-093C-4968-8B84-3CF5D1A3F23D}\_Setupx.dll        a variant of Win32/Adware.Yontoo.B application (unable to clean)        00000000000000000000000000000000        I

C:\Users\All Users\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll        a variant of Win32/Adware.Yontoo.B application (unable to clean)        00000000000000000000000000000000        I

C:\Users\All Users\Tarma Installer\{ED7702F7-093C-4968-8B84-3CF5D1A3F23D}\_Setupx.dll        a variant of Win32/Adware.Yontoo.B application (unable to clean)        00000000000000000000000000000000        I

C:\Users\Zeff\AppData\Local\Temp\jar_cache5894034325277383620.tmp        a variant of Java/Exploit.CVE-2012-0507.AH trojan (unable to clean)        00000000000000000000000000000000        I

C:\Users\Zeff\AppData\Local\Temp\YontooIEClient.dll        a variant of Win32/Adware.Yontoo.A application (unable to clean)        00000000000000000000000000000000        I

C:\Users\Zeff\AppData\Local\Temp\YontooSetup-Silent.exe        Win32/Adware.Yontoo application (unable to clean)        00000000000000000000000000000000        I

C:\Users\Zeff\AppData\Local\Temp\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbar4ie.exe        Win32/Toolbar.Babylon application (unable to clean)        00000000000000000000000000000000        I

C:\Users\Zeff\AppData\Local\Temp\is1590112554\ezLookerSilent_DDD_FTT_BG_BD_BVD.exe        probably a variant of Win32/Adware.HLQFYSH application (unable to clean)        00000000000000000000000000000000        I

C:\Users\Zeff\AppData\Local\Temp\is1590112554\MyBabylonTB.exe        Win32/Toolbar.Babylon application (unable to clean)        00000000000000000000000000000000        I

C:\Users\Zeff\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\10\7cc0de4a-202e7a6b        Java/Exploit.CVE-2011-3544.AV trojan (unable to clean)        00000000000000000000000000000000        I

C:\Users\Zeff\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12\3a7b428c-5fc8e0e0        Java/Exploit.CVE-2012-0507.BN trojan (unable to clean)        00000000000000000000000000000000        I

C:\Users\Zeff\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\25\39741719-3967731e        Java/Exploit.Agent.NBJ trojan (unable to clean)        00000000000000000000000000000000        I

C:\Users\Zeff\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\46\57ac526e-178de8bc        Java/Exploit.Agent.NBR trojan (unable to clean)        00000000000000000000000000000000        I

C:\Users\Zeff\Music\SoftonicDownloader14316.exe        a variant of Win32/SoftonicDownloader.A application (unable to clean)        00000000000000000000000000000000        I

${Memory}        probably a variant of Win32/Spy.Banker.WBU trojan        00000000000000000000000000000000        I

Dank Dir Arne!