WORM/Kido.IX und WORM/Confick.164228 auf externer Festplatte

elefandino

Guten Morgen!

Auf meiner externen Festplatte hat Avira die o.g. Würmer gefunden - ersteren in der autorun.inf sowie den zweiten in einer Datei namens G:\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx. Hier das Logfile von DDS (die weiteren Logfiles der empfohlenen Tools sind angehängt):


.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 8.0.6001.18702
Run by user at 0:27:51 on 2012-04-09
Microsoft Windows XP Home Edition 5.1.2600.3.1252.49.1031.18.1014.452 [GMT 2:00]
.
AV: Avira Desktop *Enabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Avira\AntiVir Desktop\sched.exe
svchost.exe
C:\Programme\Avira\AntiVir Desktop\avguard.exe
C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Programme\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
C:\Programme\Bonjour\mDNSResponder.exe
C:\QSTART.SYS\config\DVMExportService.exe
C:\Programme\SFR\Gestionnaire de Connexion\SFR.DashBoard.Service.exe
C:\WINDOWS\Explorer.EXE
c:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Lenovo\OneKey App\System Repair\UpdateMonitor.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Programme\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Programme\Lenovo\VeriFaceIII\PManage.exe
C:\Program Files\Lenovo\Energy Management\utility.exe
C:\Program Files\Lenovo\Energy Management\Energy Management.exe
C:\Programme\iTunes\iTunesHelper.exe
C:\Programme\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Messenger\msmsgs.exe
C:\Programme\Skype\Phone\Skype.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Programme\Samsung\Samsung PC Studio 7\PCSuite.exe
C:\Programme\Lenovo\Bluetooth Software\BTTray.exe
C:\Programme\congstar\Internet-Manager\Bin\mcserver.exe
C:\Programme\Lenovo\Bluetooth Software\bin\btwdins.exe
C:\Programme\congstar\Internet-Manager\Bin\dbus-daemon.exe
C:\Programme\congstar\Internet-Manager\Bin\db_daemon.exe
C:\PROGRA~1\Lenovo\BLUETO~1\BTSTAC~1.EXE
C:\Programme\Avira\AntiVir Desktop\avshadow.exe
C:\Programme\iPod\bin\iPodService.exe
C:\Programme\PC Connectivity Solution\ServiceLayer.exe
C:\Programme\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Programme\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Programme\PC Connectivity Solution\Transports\NclBCBTSrv.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Programme\Skype\Plugin Manager\skypePM.exe
C:\Programme\congstar\Internet-Manager\Bin\BMController.exe
C:\WINDOWS\system32\dllhost.exe
C:\Programme\congstar\Internet-Manager\Bin\MainApp.exe
C:\Programme\congstar\Internet-Manager\Bin\phoneserver.exe
C:\Programme\congstar\Internet-Manager\Bin\bmctl.exe
C:\Programme\congstar\Internet-Manager\Bin\bmop.exe
C:\Dokumente und Einstellungen\user\Eigene Dateien\Downloads\Defogger.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://lenovo.live.com/
uInternet Connection Wizard,ShellNext = hxxp://lenovo.live.com/
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\programme\gemeinsame dateien\adobe\acrobat\activex\AcroIEHelperShim.dll
uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe
uRun: [MSMSGS] "c:\programme\messenger\msmsgs.exe" /background
uRun: [Skype] "c:\programme\skype\phone\Skype.exe" /nosplash /minimized
uRun: [S60 PC Suite Tray] "c:\programme\samsung\samsung pc studio 7\PCSuite.exe" -onlytray
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [SynTPEnh] c:\programme\synaptics\syntp\SynTPEnh.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [VeriFaceManager] c:\programme\lenovo\verifaceiii\PManage.exe
mRun: [EnergyUtility] c:\program files\lenovo\energy management\utility.exe
mRun: [Energy Management] c:\program files\lenovo\energy management\Energy Management.exe
mRun: [QuickTime Task] "c:\programme\quicktime\QTTask.exe" -atboottime
mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
mRun: [iTunesHelper] "c:\programme\itunes\iTunesHelper.exe"
mRun: [avgnt] "c:\programme\avira\antivir desktop\avgnt.exe" /min
mRun: [Adobe ARM] "c:\programme\gemeinsame dateien\adobe\arm\1.0\AdobeARM.exe"
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
dRun: [Samsung.PCSync] "c:\programme\samsung\samsung pc studio 7\PcSync2.exe" /NoDialog
StartupFolder: c:\dokume~1\alluse~1\startm~1\progra~1\autost~1\bttray.lnk - c:\programme\lenovo\bluetooth software\BTTray.exe
StartupFolder: c:\dokume~1\alluse~1\startm~1\progra~1\autost~1\mctlsvc.lnk - c:\programme\congstar\internet-manager\bin\mcserver.exe
IE: Nach Microsoft E&xel exportieren - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: Senden an &Bluetooth-Gerät... - c:\programme\lenovo\bluetooth software\btsendto_ie_ctx.htm
IE: Senden an Bluetooth - c:\programme\lenovo\bluetooth software\btsendto_ie.htm
IE: {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} - hxxp://www.lenovo.com
IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\programme\lenovo\bluetooth software\btsendto_ie.htm
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\programme\messenger\msmsgs.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
DPF: {75AA409D-05F9-4F27-BD53-C7339D4B1D0A} - hxxps://212.204.101.30/dwa85W.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
TCP: Interfaces\{76671DB7-E181-4A14-B89C-C863B646809F} : NameServer = 10.111.81.129 10.129.32.1
TCP: Interfaces\{8614316A-D149-4515-B7D7-5957D1C9E16C} : DhcpNameServer = 192.168.1.1 193.189.244.194 193.189.244.202
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\gemein~1\skype\SKYPE4~1.DLL
Notify: igfxcui - igfxdev.dll
Notify: PicNotify - PicNotify.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\dokumente und einstellungen\user\anwendungsdaten\mozilla\firefox\profiles\xls8c5b3.default\
FF - plugin: c:\programme\adobe\reader 10.0\reader\air\nppdf32.dll
FF - plugin: c:\programme\adobe\reader 9.0\reader\air\nppdf32.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_2_202_228.dll
.
============= SERVICES / DRIVERS ===============
.
R0 BMLoad;Bytemobile Boot Time Load Driver;c:\windows\system32\drivers\BMLoad.sys [2012-1-29 13184]
R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [2011-10-17 36000]
R1 Ndisprot;GreenPacket NDIS Protocol Driver;c:\windows\system32\drivers\Ndisprot.sys [2010-9-16 21504]
R2 AntiVirSchedulerService;Avira Planer;c:\programme\avira\antivir desktop\sched.exe [2011-10-17 86224]
R2 AntiVirService;Avira Echtzeit Scanner;c:\programme\avira\antivir desktop\avguard.exe [2011-10-17 110032]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2011-10-17 74640]
R2 DvmMDES;DeviceVM Meta Data Export Service;c:\qstart.sys\config\DVMExportService.exe [2009-3-26 315392]
R2 SFR.DashBoard.Service;SFR.DashBoard.Service;c:\programme\sfr\gestionnaire de connexion\SFR.DashBoard.Service.exe [2011-2-7 18272]
R2 System_Repair_UpdateMonitor;System Repair Windows Update Monitor;c:\program files\lenovo\onekey app\system repair\UpdateMonitor.exe [2009-7-3 430080]
R2 tvtumon;tvtumon;c:\windows\system32\drivers\tvtumon.sys [2009-7-3 48192]
R3 ACPIVPC;Lenovo Virtual Power Controller Driver;c:\windows\system32\drivers\AcpiVpc.sys [2009-8-11 9472]
R3 HSPADataCardusbmdm;HSPADataCard Proprietary USB Driver;c:\windows\system32\drivers\HSPADataCardusbmdm.sys [2012-1-29 106880]
R3 HSPADataCardusbnmea;HSPADataCard NMEA Port;c:\windows\system32\drivers\HSPADataCardusbnmea.sys [2012-1-29 106880]
R3 HSPADataCardusbser;HSPADataCard Diagnostic Port;c:\windows\system32\drivers\HSPADataCardusbser.sys [2012-1-29 106880]
R3 usbsmi;Lenovo EasyCamera;c:\windows\system32\drivers\SMIksdrv.sys [2009-8-11 166144]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-4-8 253600]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2009-7-3 1684736]
S3 cmnsusbser;Mobile Connector USB Device for Legacy Serial Communication LCT2053s;c:\windows\system32\drivers\cmnsusbser.sys --> c:\windows\system32\drivers\cmnsusbser.sys [?]
S3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\drivers\ew_hwusbdev.sys --> c:\windows\system32\drivers\ew_hwusbdev.sys [?]
S3 filtertdidriver;filtertdidriver;c:\windows\system32\drivers\ewfiltertdidriver.sys --> c:\windows\system32\drivers\ewfiltertdidriver.sys [?]
S3 huawei_cdcacm;huawei_cdcacm;c:\windows\system32\drivers\ew_jucdcacm.sys --> c:\windows\system32\drivers\ew_jucdcacm.sys [?]
S3 huawei_enumerator;huawei_enumerator;c:\windows\system32\drivers\ew_jubusenum.sys --> c:\windows\system32\drivers\ew_jubusenum.sys [?]
S3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [2012-1-29 10240]
S3 nmwcdsa;Samsung USB Phone Parent;c:\windows\system32\drivers\nmwcdsa.sys [2010-9-3 135680]
S3 nmwcdsac;Samsung USB Generic;c:\windows\system32\drivers\nmwcdsac.sys [2010-9-3 8320]
S3 nmwcdsacj;Samsung USB Port;c:\windows\system32\drivers\nmwcdsacj.sys [2010-9-3 12288]
S3 nmwcdsacm;Samsung USB Modem;c:\windows\system32\drivers\nmwcdsacm.sys [2010-9-3 12288]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\drivers\rtsustor.sys --> c:\windows\system32\drivers\RtsUStor.sys [?]
S3 RtsUIR;Realtek IR Driver;c:\windows\system32\drivers\rts516xir.sys --> c:\windows\system32\drivers\Rts516xIR.sys [?]
S3 WSVD;WSVD;c:\windows\system32\drivers\WSVD.sys [2009-7-3 81192]
S3 ZTEusbnet;ZTE USB-NDIS miniport;c:\windows\system32\drivers\ZTEusbnet.sys [2010-9-3 110080]
S3 ZTEusbvoice;ZTE VoUSB Port;c:\windows\system32\drivers\ZTEusbvoice.sys [2010-9-3 104960]
.
=============== Created Last 30 ================
.
2012-04-08 07:10:35 418464 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-03-15 16:43:35 592824 ----a-w- c:\programme\mozilla firefox\gkmedias.dll
2012-03-15 16:43:35 44472 ----a-w- c:\programme\mozilla firefox\mozglue.dll
.
==================== Find3M ====================
.
2012-04-08 10:47:30 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-02-03 09:57:08 1860224 ----a-w- c:\windows\system32\win32k.sys
2012-01-11 19:06:33 3072 ------w- c:\windows\system32\iacenc.dll
2001-12-19 10:45:04 23552 ----a-w- c:\programme\VCdControlTool.exe
2001-12-19 10:45:00 8576 ----a-w- c:\programme\VCdRom.sys
.
============= FINISH: 0:33:22,90 ===============

Vielen Dank im Voraus für eure Hilfe und Unterstützung! Dennoch einen schönen Feiertag...

Grüße,
elefandino