| necro666 | 29.07.2013 22:21 |
GVU/BKA Trojaner Weisser Bildschirm!
Hi! habe mir auf meinem Studio-Rechner beim surfen eine Ransom-Ware eingefangen. Irgendein Urheberrechtsverletzungs-Hinweis, nachm Neustart nur noch ein weisser Bildschirm.
Ebenso im abgesicherten Modus.
Booten von OTL-CD geht nicht, auch nach umstellen der Bootsequenz im BIOS. (springt dann wieder ins Windows Startup von der Festplatte --> weisser Bildschirm)
ACHTUNG: die Infektion fand schon vor ca. eineinhalb Monaten statt, das heisst, es handelt sich hier nicht um eine der aktuellen Versionen des Trojaners. (Hatte während des Semester-Finales ohnehin keine Zeit zum Musikmachen, deshalb bis jetzt kein akuter Handlungsbedarf...)
Hier das FRST-log: Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-07-2013
Ran by SYSTEM on 26-07-2013 14:13:45
Running from J:\
Windows 7 Ultimate (X64) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Recovery
The current controlset is ControlSet001
ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and an extra Addition.txt log.
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [446392 2012-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [StartCCC] - "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [336384 2011-01-26] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [ATICustomerCare] - "C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe" [311296 2010-05-04] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [843712 2012-01-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [WinampAgent] - "C:\Program Files (x86)\Winamp\winampa.exe" [74752 2011-12-09] (Nullsoft, Inc.)
HKLM-x32\...\Run: [avgnt] - "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min [348664 2012-08-16] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] - "C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe" -minimized [527312 2012-01-13] (Cisco Systems, Inc.)
HKLM-x32\...\Run: [APSDaemon] - "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59240 2012-02-20] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] - "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2012-04-18] (Apple Inc.)
HKLM-x32\...\Run: [SwitchBoard] - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] - "C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin [1073312 2012-03-09] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [TrayServer] - C:\Program Files (x86)\MAGIX\Movie_Edit_Pro_MX_Plus_Download_Version\TrayServer_en.exe [90112 2008-11-13] (MAGIX AG)
HKLM-x32\...\Run: [SunJavaUpdateSched] - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [254696 2011-04-08] (Sun Microsystems, Inc.)
HKU\XXXXXX\...\Run: [DAEMON Tools Lite] - "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun [1305408 2011-01-20] (DT Soft Ltd)
HKU\XXXXXX\...\Run: [AdobeBridge] - [x]
HKU\XXXXXX\...\Run: [Gadwin PrintScreen] - C:\Program Files (x86)\Gadwin Systems\PrintScreen\PrintScreen.exe /nosplash [1842384 2012-05-30] (Gadwin Systems, Inc)
HKU\XXXXXX\...\Winlogon: [Shell] explorer.exe,C:\Users\XXXXX\AppData\Roaming\skype.dat <==== ATTENTION
==================== Services (Whitelisted) =================
S2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [86224 2012-05-08] (Avira Operations GmbH & Co. KG)
S2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [110032 2012-05-08] (Avira Operations GmbH & Co. KG)
S2 WSWNA1100; C:\Program Files (x86)\NETGEAR\WNA1100\WifiSvc.exe [266240 2010-08-04] ()
==================== Drivers (Whitelisted) ====================
S3 61883; C:\Windows\System32\DRIVERS\61883.sys [60288 2009-07-14] (Microsoft Corporation)
S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [98848 2012-05-08] (Avira GmbH)
S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132832 2012-05-08] (Avira GmbH)
S1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [27760 2011-09-16] (Avira GmbH)
S1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [254528 2011-08-13] (DT Soft Ltd)
S3 ffSaffireLE_1394; C:\Windows\System32\Drivers\ffSaffireLE_1394_x64.sys [189440 2011-02-11] (Archwave AG)
S3 ffSaffireLE_avs; C:\Windows\System32\Drivers\ffSaffireLE_avs_x64.sys [65024 2011-02-11] (Archwave AG)
S3 hwusbdev; C:\Windows\System32\DRIVERS\ewusbdev.sys [114560 2009-07-24] (Huawei Technologies Co., Ltd.)
S3 irsir; C:\Windows\System32\DRIVERS\irsir.sys [27648 2008-01-19] (Microsoft Corporation)
S3 LoopBe30; C:\Windows\System32\drivers\loopbe30.sys [16896 2011-02-26] (nerds.de)
S3 synusb64; C:\Windows\System32\DRIVERS\synusb64.sys [30352 2010-09-17] (Steinberg Media Technologies GmbH)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-07-26 14:12 - 2013-07-26 14:12 - 00000000 ____D C:\FRST
==================== One Month Modified Files and Folders =======
2013-07-26 14:12 - 2013-07-26 14:12 - 00000000 ____D C:\FRST
2013-07-26 12:53 - 2009-07-14 05:45 - 00014224 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-26 12:53 - 2009-07-14 05:45 - 00014224 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-26 12:52 - 2013-06-14 17:29 - 00000004 _____ C:\Users\XXXXXX\AppData\Roaming\skype.ini
2013-07-26 12:52 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-07-26 12:51 - 2009-07-14 05:51 - 00116639 _____ C:\Windows\setupact.log
Files to move or delete:
====================
C:\Users\XXXXXX\AppData\Roaming\skype.dat
C:\Users\XXXXXX\AppData\Roaming\skype.ini
==================== Known DLLs (Whitelisted) ================
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
==================== EXE ASSOCIATION =====================
HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK
==================== Restore Points =========================
Restore point made on: 2013-06-08 11:25:32
==================== Memory info ===========================
Percentage of memory in use: 14%
Total physical RAM: 4087.05 MB
Available physical RAM: 3481.54 MB
Total Pagefile: 4085.2 MB
Available Pagefile: 3471.34 MB
Total Virtual: 8192 MB
Available Virtual: 8191.85 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:339.53 GB) (Free:110.67 GB) NTFS (Disk=0 Partition=3)
Drive d: (WIN XP KEEPER) (Fixed) (Total:37.73 GB) (Free:0.98 GB) NTFS (Disk=0 Partition=2)
Drive j: () (Removable) (Total:7.49 GB) (Free:7.46 GB) FAT32 (Disk=4 Partition=1)
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS (Disk=0 Partition=1) ==>[System with boot components (obtained from reading drive)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: D8EAD8EA)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=419 GB) - (Type=OF Extended)
========================================================
Disk: 4 (Size: 8 GB) (Disk ID: 3B3E3B3D)
Partition 1: (Not Active) - (Size=8 GB) - (Type=0B)
LastRegBack: 2013-06-11 17:58
==================== End Of Log ============================
Ich bedank mich jetzt schonmal im Voraus, und sicher nicht zum letzten mal ;) | 
+ R Taste und schreibe notepad in das Ausführen Fenster.