By checking my quarantine manager, I discovered "appconf32.exe" to be quarantined. It is part of a banker trojan. However, the original file had not been moved, but still was in windows\system32.
Additionally, in system32 I found the dll-files of the associated browser addons which read out the urls and passwords. Obviously they had been active for the last 2 weeks, since tons of web addresses and passwords were saved in the particular folders that the trojan had created.
Now I wonder whether the readout data had remained on my harddisk, since appconf.exe had the status of being quarantined, or if they had been sent out.
This thread was automatically locked due to age.
