Trojaner-Board - System neu aufsetzen nach Trojanerbefall

Hallo ryder,

Browserreset mit ZOEK ist erledigt. Dies ist das LOG-File:
Code:
Zoek.exe Version 4.0.0.4 Updated 10-July-2013

Tool run by XXX on 14.07.2013 at 16:38:26,25.

Microsoft Windows 7 Professional  6.1.7601 Service Pack 1 x64

Running in: Normal Mode No Internet Access Detected
 

==== System Restore Info ======================
 

Failed to create System Restore Point
 

==== Reset Hosts File ======================
 

# Copyright (c) 1993-2006 Microsoft Corp. 

# 

# This is a sample HOSTS file used by Microsoft TCP/IP for Windows. 

# 

# This file contains the mappings of IP addresses to host names. Each 

# entry should be kept on an individual line. The IP address should 

# be placed in the first column followed by the corresponding host name. 

# The IP address and the host name should be separated by at least one 

# space. 

# 

# Additionally, comments (such as these) may be inserted on individual 

# lines or following the machine name denoted by a '#' symbol. 

# 

# For example: 

# 

#      102.54.94.97     rhino.acme.com          # source server 

#       38.25.63.10     x.acme.com              # x client host 

 

# localhost name resolution is handle within DNS itself. 

127.0.0.1       localhost 

::1             localhost 
 

==== Creating Sample__1641.zip ======================

 

Process rundll32.exe killed

Copied file C:\Users\XXX\AppData\Roaming\Network_Driver_YYDDV_WN_15.03.1000.1637_A03.EXE to sample\Network_Driver_YYDDV_WN_15.03.1000.1637_A03.EXE

sample\Network_Driver_YYDDV_WN_15.03.1000.1637_A03.EXE renamed to C299E0752672556018BDCA62CCF1F4C6
 

C:\Users\Public\Desktop\sample__1641.zip created successfully
 

==== Deleting CLSID Registry Keys ======================
 
 

==== Deleting CLSID Registry Values ======================
 
 

==== Deleting Services ======================
 
 

==== FireFox Fix ======================
 

Deleted from C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\ahlmj72i.default\prefs.js:

user_pref("browser.startup.homepage", "chrome://foxtab/content/homepage.html");

user_pref("browser.search.useDBForOrder", true);
 

Added to C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\ahlmj72i.default\prefs.js:

user_pref("browser.startup.homepage", "hxxp://www.google.com");

user_pref("browser.search.defaulturl", "hxxp://www.google.com/search?btnG=Google+Search&q=");

user_pref("browser.newtab.url", "hxxp://www.google.com/");

user_pref("browser.search.defaultengine", "Google");

user_pref("browser.search.defaultenginename", "Google");

user_pref("browser.search.selectedEngine", "Google");

user_pref("browser.search.order.1", "Google");

user_pref("keyword.URL", "hxxp://www.google.com/search?btnG=Google+Search&q=");

user_pref("browser.search.suggest.enabled", true);

user_pref("browser.search.useDBForOrder", true);
 

ProfilePath: C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\ahlmj72i.default
 

user.js not found

---- Lines delta removed from prefs.js ----
 

user_pref("extensions.sitedelta@schierla.de.highlightOnLoad", true);

user_pref("extensions.sitedelta@schierla.de.install-event-fired", true);

user_pref("extensions.sitedelta@schierla.de.notifySound", "_moz_mailbeep");

user_pref("extensions.sitedelta@schierla.de.watchScanDelay", -1);
 

---- Lines delta modified from prefs.js ----
 
 

---- FireFox user.js and prefs.js backups ---- 
 

prefs__1641_.backup
 

==== Deleting Files \ Folders ======================
 

"C:\Users\XXX\AppData\Roaming\FRITZ" not found 

"C:\ProgramData\60a7806a-0eea-424c-a464-20f4730cd631" deleted

"C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\ahlmj72i.default\sitedelta.rdf" deleted

"C:\Users\XXX\AppData\Local\dfl28z32.dll" deleted

"C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\ahlmj72i.default\searchplugins\imedisearch.xml" deleted

"C:\Users\XXX\AppData\Roaming\Network_Driver_YYDDV_WN_15.03.1000.1637_A03.EXE" deleted

"C:\Users\XXX\AppData\Roaming\Tobit" deleted

"C:\ProgramData\APN" deleted

"C:\Windows\SysWow64\AI_RecycleBin" deleted

"C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\ahlmj72i.default\jetpack" deleted

"C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\ahlmj72i.default\sitedelta" deleted
 

==== Firefox Extensions ======================
 

ProfilePath: C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\ahlmj72i.default

- FRITZBox AddOn - %ProfilePath%\extensions\fb_add_on@avm.de

- DownloadHelper - %ProfilePath%\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}

- . - %ProfilePath%\extensions\{ec9032c7-c20a-464f-7b0e-13a3a9e97385}

- HON Toolbar - %ProfilePath%\extensions\hontoolbar@hon.ch.xpi

- DuckDuckGo Plus - %ProfilePath%\extensions\jid1-ZAdIEUB7XOzOJw@jetpack.xpi

- Image Zoom - %ProfilePath%\extensions\{1A2D0EC4-75F5-4c91-89C4-3656F6E44B68}.xpi

- Update Scanner - %ProfilePath%\extensions\{c07d1a49-9894-49ff-a594-38960ede8fb9}.xpi

- Adblock Plus - %ProfilePath%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
 

AppDir: C:\Program Files (x86)\Mozilla Firefox

- Java Console - %AppDir%\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
 

==== Firefox Plugins ======================
 

Profilepath: C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\ahlmj72i.default

3D76B5C0E02ECC19C1F5756E8FD97F72        - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll -        Shockwave Flash

5CFAE4C01C044DCC77771E46E2B3544A        - C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll -        PDF-XChange Viewer

6CD3A99DCEDE9C2D7D3BFBF6D4902F5F        - C:\Windows\SysWOW64\npdeployJava1.dll -        Java Deployment Toolkit 6.0.350.10

15E298B5EC5B89C5994A59863969D9FF        - C:\Windows\SysWOW64\npmproxy.dll -        Microsoft® Windows® Operating System
 
 

==== Set IE to Default ======================
 

Old Values:

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

"Start Page"="hxxp://www.google.de/"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]

"DefaultScope"="{096D4820-6B8C-4F55-9232-E44DFB57509C}"
 

New Values:

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

"Start Page"="hxxp://www.google.de/"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]

"DefaultScope"="{6A1806CD-94D4-4689-BA73-E35EA1EA9990}"
 

==== All HKCU SearchScopes ======================
 

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes

{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing  Url="hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"

{096D4820-6B8C-4F55-9232-E44DFB57509C} Unknown  Url="Not_Found"

{6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google  Url="hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}"

{8A063911-67C5-4115-A8F1-BFA39772118F} Google  Url="hxxp://www.google.com/search?q={searchTerms}&amp;sourceid=ie7&amp;rls=com.microsoft:{language}:{referrer:source}&amp;ie={inputEncoding?}&oe={outputEncoding?}"

{9C937954-F68E-4A78-8DAD-A27EB41C421E} Unknown  Url="Not_Found"
 

==== Reset Google Chrome ======================
 

Nothing found to reset
 

==== Deleting CLSID Registry Keys ======================
 

HKEY_USERS\S-1-5-21-3932702968-264759943-478244544-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1CA1377B-DC1D-4A52-9585-6E06050FAC53} deleted successfully

HKEY_USERS\S-1-5-21-3932702968-264759943-478244544-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{1CA1377B-DC1D-4A52-9585-6E06050FAC53} deleted successfully

HKEY_USERS\S-1-5-21-3932702968-264759943-478244544-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8E5E2654-AD2D-48BF-AC2D-D17F00898D06} deleted successfully

HKEY_USERS\S-1-5-21-3932702968-264759943-478244544-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{8E5E2654-AD2D-48BF-AC2D-D17F00898D06} deleted successfully

HKEY_USERS\S-1-5-21-3932702968-264759943-478244544-1000\Software\Microsoft\Internet Explorer\SearchScopes\{096D4820-6B8C-4F55-9232-E44DFB57509C} deleted successfully

HKEY_USERS\S-1-5-21-3932702968-264759943-478244544-1000\Software\Microsoft\Internet Explorer\SearchScopes\{9C937954-F68E-4A78-8DAD-A27EB41C421E} deleted successfully

HKEY_CLASSES_ROOT\CLSID\{1CA1377B-DC1D-4A52-9585-6E06050FAC53} deleted successfully

HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{1CA1377B-DC1D-4A52-9585-6E06050FAC53} deleted successfully

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1CA1377B-DC1D-4A52-9585-6E06050FAC53} deleted successfully

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1CA1377B-DC1D-4A52-9585-6E06050FAC53} deleted successfully

HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{8E5E2654-AD2D-48BF-AC2D-D17F00898D06} deleted successfully
 

==== Deleting CLSID Registry Values ======================
 
 

==== shortcuts in Users Start Menu ======================
 

C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk - C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE /tsr
 

==== shortcuts in All Users Start Menu ======================
 

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk - C:\Users\XXX\AppData\Local\Mozilla Firefox\firefox.exe 

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira\Avira Desktop\Avira Free Antivirus Hilfe.lnk - C:\Program Files (x86)\Avira\AntiVir Desktop\avwin.chm 

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira\Avira Desktop\Avira Free Antivirus starten.lnk - C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe 

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira\Avira Desktop\Avira im Internet.lnk - C:\Program Files (x86)\Avira\AntiVir Desktop\weblink.url 

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira\Avira Desktop\Readme anzeigen.lnk - C:\Program Files (x86)\Avira\AntiVir Desktop\readme.txt 

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware\Malwarebytes Anti-Malware entfernen.lnk - C:\Program Files (x86)\Malwarebytes' Anti-Malware\unins000.exe 

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware\Malwarebytes Anti-Malware Help.lnk - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.chm 

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware\Malwarebytes Anti-Malware.lnk - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe 

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware\Tools\Malwarebytes Anti-Malware Chameleon.lnk - C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\chameleon.chm 

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight\Microsoft Silverlight.lnk - C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\Silverlight.Configuration.exe 
 

==== shortcuts in Quick Launch ======================
 

C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -  

C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -  

C:\Users\Default User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -  

C:\Users\Default User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -  

C:\Users\XXX\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk - C:\Program Files (x86)\Internet Explorer\iexplore.exe 

C:\Users\XXX\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Outlook.lnk - C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE /recycle

C:\Users\XXX\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk - C:\Program Files (x86)\Mozilla Firefox\firefox.exe 

C:\Users\XXX\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -  

C:\Users\XXX\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -  

C:\Users\XXX\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Wireshark.lnk - C:\Program Files\Wireshark\wireshark.exe 

C:\Users\XXX\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Internet Explorer.lnk - C:\Program Files (x86)\Internet Explorer\iexplore.exe 

C:\Users\XXX\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Microsoft Word 2010.lnk - C:\Windows\Installer\{90140000-003D-0000-0000-0000000FF1CE}\wordicon.exe 

C:\Users\XXX\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\MindManager X5.lnk - C:\Windows\Installer\{23355AD7-F773-4419-971D-1577A793D4B5}\ARPPRODUCTICON.exe 

C:\Users\XXX\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Pegasus Mail.DE.lnk - C:\PMAIL\Programs\winpm-32.exe -X DE -A

C:\Users\XXX\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Radiotracker.lnk - C:\Program Files (x86)\RapidSolution\Radiotracker\Radiotracker.exe 

C:\Users\XXX\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Adobe Photoshop Lightroom 4.4 64-bit.lnk - C:\Program Files (x86)\Adobe\Adobe Photoshop Lightroom 4.4\lightroom.exe 

C:\Users\XXX\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Audials 10.lnk - C:\Program Files (x86)\Audials\Audials 10\AudialsStarter.exe 

C:\Users\XXX\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Create Synchronicity.lnk - C:\Program Files (x86)\Create Software\Create Synchronicity\Create Synchronicity.exe 

C:\Users\XXX\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\IDLE (Python GUI).lnk - C:\Windows\Installer\{31800004-6386-4999-A519-518F2D78D8F0}\python_icon.exe "C:\Python25\Lib\idlelib\idle.pyw"

C:\Users\XXX\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk - C:\Program Files (x86)\Internet Explorer\iexplore.exe 

C:\Users\XXX\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft OneNote 2010.lnk - C:\Windows\Installer\{90140000-003D-0000-0000-0000000FF1CE}\joticon.exe 

C:\Users\XXX\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\MindManager X5.lnk - C:\Windows\Installer\{23355AD7-F773-4419-971D-1577A793D4B5}\ARPPRODUCTICON.exe 

C:\Users\XXX\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk - C:\Program Files (x86)\Mozilla Firefox\firefox.exe 

C:\Users\XXX\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Pegasus Mail.DE.lnk - C:\PMAIL\Programs\winpm-32.exe -X DE -A

C:\Users\XXX\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\TeXstudio.lnk - C:\Program Files (x86)\TeXstudio\texstudio.exe 

C:\Users\XXX\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\TrueCrypt.lnk - C:\Program Files\TrueCrypt\TrueCrypt.exe 

C:\Users\XXX\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Explorer.lnk - C:\Windows\explorer.exe 

C:\Users\XXX\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Media Player.lnk - C:\Program Files (x86)\Windows Media Player\wmplayer.exe /prefetch:1
 

==== Empty IE Cache ======================
 

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

C:\Users\XXX\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

C:\Users\XXX\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully

C:\Users\XXX\AppData\Local\Temp\acro_rd_dir\Temporary Internet Files\Content.IE5 emptied successfully

C:\Users\XXX\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully

C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

C:\Windows\serviceprofiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

C:\Windows\serviceprofiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
 

==== Empty FireFox Cache ======================
 

C:\users\XXX\AppData\Local\Mozilla\Firefox\Profiles\ahlmj72i.default\Cache emptied successfully

C:\users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\ahlmj72i.default\alertbox\sites\b75daedbebe7815c430ced09ace6e52a4029e47d\cache emptied successfully
 

==== Empty Chrome Cache ======================
 

No Chrome User Data found
 

==== Empty All Flash Cache ======================
 

Flash Cache Emptied Successfully
 

==== Empty All Java Cache ======================
 

Java Cache cleared successfully
 

==== After Reboot ======================
 

==== Empty Temp Folders ======================
 

C:\Windows\Temp successfully emptied

C:\Users\XXX\AppData\Local\Temp successfully emptied
 

==== Empty Recycle Bin ======================
 

C:\$RECYCLE.BIN successfully emptied
 

==== EOF on 14.07.2013 at 17:07:45,04 ======================