Police Central e-crime Unit Trojaner
Hallo Leute
hab es heute geschafft mir auch einen von diesen hässlichen Screen-Blocker Trojanern ein zu fangen.
Scans mit Malwarebytes und ESET habe ich gemacht, wobei MWB nichts gefunden hat: Code:
Malwarebytes Anti-Malware (Trial) 1.62.0.1300
www.malwarebytes.org
Database version: v2012.07.13.07
Windows 7 Service Pack 1 x64 NTFS (Safe Mode/Networking)
Internet Explorer 9.0.8112.16421
h3R0in :: H3R0IN-PC [administrator]
Protection: Disabled
13.07.2012 18:38:59
mbam-log-2012-07-13 (18-38-59).txt
Scan type: Full scan (C:\|D:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 414151
Time elapsed: 12 minute(s), 25 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
(end)
Eine ältere Log von MWB bei der ein Eintrag gefunden wurde: Code:
Malwarebytes Anti-Malware (Trial) 1.61.0.1400
www.malwarebytes.org
Database version: v2012.07.02.02
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
h3R0in :: H3R0IN-PC [administrator]
Protection: Enabled
02.07.2012 13:50:52
mbam-log-2012-07-02 (13-50-52).txt
Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 257433
Time elapsed: 1 minute(s), 24 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 1
C:\Users\schrottuser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0.15724013281501314.exe.lnk (Backdoor.Agent) -> Quarantined and deleted successfully.
(end)
und hier noch die Log-Datei von ESET: Code:
C:\Users\h3R0in\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EU59S23L\get[1].htm HTML/Ransom.A trojan
C:\Users\h3R0in\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EX793KCJ\get[1].htm HTML/Ransom.A trojan
C:\Users\h3R0in\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IFLYL809\get[1].htm HTML/Ransom.A trojan
C:\Users\h3R0in\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U10PNT5E\get[1].htm HTML/Ransom.A trojan
C:\Users\h3R0in\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U10PNT5E\get[2].htm HTML/Ransom.A trojan
C:\Users\h3R0in\AppData\Local\Temp\bkfxvmfzbkpsajwotyymtmhfk.exe Win32/LockScreen.AKU trojan
C:\Users\h3R0in\AppData\Local\Temp\jar_cache8985389325844669534.tmp Java/Exploit.CVE-2012-0507.CU trojan
C:\Users\h3R0in\AppData\Local\Temp\nlbsmkxperkyvbgtrnebhxq.exe Win32/LockScreen.AKU trojan
C:\Users\h3R0in\AppData\Local\Temp\ojgzjhjoefajectuvter.exe Win32/LockScreen.AKU trojan
C:\Users\h3R0in\AppData\Local\Temp\ypgkjtspejdopdx.exe Win32/LockScreen.AKU trojan
C:\Users\h3R0in\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16\1ac39b10-16ce0dea Java/Exploit.CVE-2012-0507.BR trojan
C:\Users\h3R0in\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\2\3ea25642-286ed75f Java/Exploit.Agent.NCD trojan
C:\Users\h3R0in\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\20\19a3ccd4-38727e6d multiple threats
C:\Users\h3R0in\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\21\d2f3e15-18a2d9f6 Java/Exploit.CVE-2012-0507.CU trojan
C:\Users\h3R0in\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\32\63d16c20-4ffbd6ab multiple threats
C:\Users\h3R0in\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34\30bd28e2-6afdc032 multiple threats
C:\Users\h3R0in\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\42\610cc76a-3ad99b93 Java/Exploit.Agent.NCI trojan
C:\Users\h3R0in\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56\4bb16378-4b9a157b a variant of Java/Exploit.CVE-2012-0507.CC trojan
C:\Users\h3R0in\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62\1d2f093e-2afa9d27 Java/Exploit.Agent.NCK trojan
C:\Users\h3R0in\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9\498d5549-280313a4 Java/Exploit.CVE-2012-0507.BT trojan
Was sollte ich als nächstes machen um mich von dem Trojaner zu lösen?
Danke für eure Mühe! | 