Trojaner-Board - GVU Trojaner

Hallo Cosinus,

danke für deine Antwort.
hier schonmal den Log von Malewarebytes:

Malwarebytes Anti-Malware 1.65.1.1000
Malwarebytes : Free anti-malware download

Datenbank Version: v2012.10.20.05

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Admin :: USER-PC [Administrator]

20.10.2012 17:11:26
mbam-log-2012-10-20 (20-12-31).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 471321
Laufzeit: 1 Stunde(n), 37 Minute(n), 58 Sekunde(n)

Infizierte Speicherprozesse: 1
C:\ProgramData\lsass.exe (Trojan.Delf) -> 3036 -> Keine Aktion durchgeführt.

Infizierte Speichermodule: 1
C:\Users\Admin\AppData\Local\Temp\rundll32.dll (Trojan.Downloader) -> Keine Aktion durchgeführt.

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 7
C:\Users\Admin\AppData\Local\Temp\is1590112554\IWantThis_SRC_ROW.exe (Adware.GamePlayLabs) -> Keine Aktion durchgeführt.
C:\Users\Admin\AppData\Local\Temp\teamviewer.dll (Exploit.Drop.GS) -> Keine Aktion durchgeführt.
C:\ProgramData\lsass.exe (Trojan.Delf) -> Keine Aktion durchgeführt.
C:\Users\Admin\AppData\Local\Temp\rundll32.dll (Trojan.Downloader) -> Keine Aktion durchgeführt.
C:\Users\user\AppData\Roaming\appConf32.exe (Backdoor.Agent) -> Keine Aktion durchgeführt.
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk (Trojan.Ransom.Gen) -> Keine Aktion durchgeführt.
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk (Trojan.Ransom.Gen) -> Keine Aktion durchgeführt.

(Ende)

Hallo nochmals,

und hier de Log von ESET.

Code:

ESETSmartInstaller@High as CAB hook log:

OnlineScanner64.ocx - registred OK

OnlineScanner.ocx - registred OK

esets_scanner_update returned -1 esets_gle=53251

# version=7

# iexplore.exe=9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=a35f57d00cf5664280fe2a9e4d1beef0

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2012-10-21 02:38:19

# local_time=2012-10-21 04:38:19 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1033

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode=1797 16774142 0 5 75 16166950 0 0

# compatibility_mode=5893 16776573 100 94 12992623 102407063 0 0

# compatibility_mode=8192 67108863 100 0 17911 17911 0 0

# scanned=289629

# found=24

# cleaned=0

# scan_time=9906

C:\Program Files (x86)\VideoConverter\VideoConverter.exe        a variant of Win32/InstallCore.A application (unable to clean)        00000000000000000000000000000000        I

C:\Program Files (x86)\Yontoo\YontooIEClient.dll        a variant of Win32/Adware.Yontoo.A application (unable to clean)        00000000000000000000000000000000        I

C:\ProgramData\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll        a variant of Win32/Adware.Yontoo.B application (unable to clean)        00000000000000000000000000000000        I

C:\ProgramData\Tarma Installer\{ED7702F7-093C-4968-8B84-3CF5D1A3F23D}\_Setupx.dll        a variant of Win32/Adware.Yontoo.B application (unable to clean)        00000000000000000000000000000000        I

C:\Users\Admin\AppData\Local\Temp\rundll32.dll        a variant of Win32/Kryptik.ANKX trojan (unable to clean)        00000000000000000000000000000000        I

C:\Users\Admin\AppData\Local\Temp\teamviewer.dll        a variant of Win32/Kryptik.ANKO trojan (unable to clean)        00000000000000000000000000000000        I

C:\Users\Admin\AppData\Local\Temp\YontooIEClient.dll        a variant of Win32/Adware.Yontoo.A application (unable to clean)        00000000000000000000000000000000        I

C:\Users\Admin\AppData\Local\Temp\YontooSetup-Silent.exe        Win32/Adware.Yontoo application (unable to clean)        00000000000000000000000000000000        I

C:\Users\Admin\AppData\Local\Temp\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbar4ie.exe        Win32/Toolbar.Babylon application (unable to clean)        00000000000000000000000000000000        I

C:\Users\Admin\AppData\Local\Temp\is1590112554\ezLookerSilent_DDD_FTT_BG_BD_BVD.exe        multiple threats (unable to clean)        00000000000000000000000000000000        I

C:\Users\Admin\AppData\Local\Temp\is1590112554\IWantThis_SRC_ROW.exe        Win32/Toolbar.CrossRider application (unable to clean)        00000000000000000000000000000000        I

C:\Users\Admin\AppData\Local\Temp\is1590112554\MyBabylonTB.exe        Win32/Toolbar.Babylon application (unable to clean)        00000000000000000000000000000000        I

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk        Win32/Reveton.J trojan (unable to clean)        00000000000000000000000000000000        I

C:\Users\Admin\Downloads\SoftonicDownloader_fuer_photoscape.exe        a variant of Win32/SoftonicDownloader.D application (unable to clean)        00000000000000000000000000000000        I

C:\Users\All Users\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll        a variant of Win32/Adware.Yontoo.B application (unable to clean)        00000000000000000000000000000000        I

C:\Users\All Users\Tarma Installer\{ED7702F7-093C-4968-8B84-3CF5D1A3F23D}\_Setupx.dll        a variant of Win32/Adware.Yontoo.B application (unable to clean)        00000000000000000000000000000000        I

C:\Users\user\AppData\Local\Temp\iexplore.dll        a variant of Win32/Kryptik.ANKX trojan (unable to clean)        00000000000000000000000000000000        I

C:\Users\user\AppData\Local\Temp\jar_cache2052604684857815238.tmp        a variant of Java/Exploit.CVE-2012-1723.CP trojan (unable to clean)        00000000000000000000000000000000        I

C:\Users\user\AppData\Local\Temp\jar_cache4407945785527057830.tmp        a variant of Java/Exploit.CVE-2012-1723.CP trojan (unable to clean)        00000000000000000000000000000000        I

C:\Users\user\AppData\Local\Temp\SAJLFG        a variant of Java/Exploit.CVE-2012-1723.CP trojan (unable to clean)        00000000000000000000000000000000        I

C:\Users\user\AppData\Local\Temp\NERO14688\Toolbar.exe        Win32/Toolbar.AskSBar application (unable to clean)        00000000000000000000000000000000        I

C:\Users\user\AppData\Roaming\appConf32.exe        Win32/Spy.Banker.YIN trojan (unable to clean)        00000000000000000000000000000000        I

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk        Win32/Reveton.J trojan (unable to clean)        00000000000000000000000000000000        I

G:\Privat\Programme\Nero-8.2.8.0_deu_trial.exe        Win32/Toolbar.AskSBar application (unable to clean)        00000000000000000000000000000000        I