Guten Abend,

Ich bin gerade auf euer Forum gestossen und finde es toll, was ihr hier leistet.

ich habe mir offensichtlich ebenfalls einen Trojaner eingefangen. Mist. Betroffen ist der Benutzer "nas". Dort erscheint nach dem Hochfahren der weisse Bildschrim mit der Meldung "Warten bis Verbindung hergestellt wird...". Lasse den Laptop dann allerdings nicht ins Netz.

Der Benutzer "admin" geht noch.


Ich wäre euch sehr dankbar wenn ihr mir auch helfen könntet. Ich habe bereits:
- Mit OTLPENet.exe gebootet und Scan druchgeführt.
- Das file olt.txt ist angehängt und hier eingefügt:

OTL logfile created on: 5/27/2012 1:08:54 AM - Run 
OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE
Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,023.00 Mb Total Physical Memory | 816.00 Mb Available Physical Memory | 80.00% Memory free
907.00 Mb Paging File | 847.00 Mb Available in Paging File | 93.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 48.83 Gb Total Space | 21.48 Gb Free Space | 44.00% Space Free | Partition Type: NTFS
Drive D: | 1.88 Gb Total Space | 1.63 Gb Free Space | 86.94% Space Free | Partition Type: FAT
Drive E: | 44.32 Gb Total Space | 44.25 Gb Free Space | 99.84% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [Disabled] --  -- (HidServ)
SRV - [2012/04/04 09:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2010/11/24 16:33:26 | 000,921,600 | ---- | M] () [Auto] -- C:\Programme\TVersity\Media Server\MediaServer.exe -- (TVersityMediaServer)
SRV - [2009/10/30 06:09:50 | 000,085,096 | ---- | M] (Autodesk) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Autodesk Shared\Service\AdskScSrv.exe -- (Autodesk Licensing Service)
SRV - [2009/10/30 04:55:26 | 000,651,720 | ---- | M] (Macrovision Europe Ltd.) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2008/12/05 11:11:54 | 000,935,208 | ---- | M] (Nero AG) [Auto] -- C:\Programme\Gemeinsame Dateien\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0)
SRV - [2008/11/03 20:06:28 | 000,441,712 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2008/10/27 07:01:02 | 000,143,360 | ---- | M] (matrix42 AG) [Auto] -- C:\WINDOWS\system32\Empirum\SETUPSVC.EXE -- (SetupService)
SRV - [2008/09/29 03:07:00 | 000,143,088 | ---- | M] (McAfee, Inc.) [Auto] -- C:\Programme\McAfee\VirusScan Enterprise\Mcshield.exe -- (McShield)
SRV - [2008/09/29 03:07:00 | 000,067,904 | ---- | M] (McAfee, Inc.) [Auto] -- C:\WINDOWS\system32\mfevtps.exe -- (mfevtp)
SRV - [2008/09/29 03:07:00 | 000,062,800 | ---- | M] (McAfee, Inc.) [Auto] -- C:\Programme\McAfee\VirusScan Enterprise\VsTskMgr.exe -- (McTaskManager)
SRV - [2008/09/29 03:07:00 | 000,019,456 | ---- | M] (McAfee, Inc.) [Auto] -- C:\Programme\McAfee\VirusScan Enterprise\EngineServer.exe -- (McAfeeEngineService)
SRV - [2008/02/10 03:31:02 | 001,326,232 | ---- | M] (Autodesk, Inc.) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Autodesk Shared\Service\AdskNetSrv.exe -- (Autodesk Network Licensing Service)
SRV - [2007/10/25 10:06:00 | 000,103,744 | ---- | M] (McAfee, Inc.) [Auto] -- C:\Programme\McAfee\Common Framework\FrameworkService.exe -- (McAfeeFramework)
SRV - [2007/07/20 11:53:52 | 000,475,136 | ---- | M] (Dell Inc.) [Auto] -- C:\Programme\Dell\QuickSet\NicConfigSvc.exe -- (NICCONFIGSVC)
SRV - [2007/04/03 11:18:08 | 001,516,584 | ---- | M] (Cisco Systems, Inc.) [Auto] -- C:\Programme\Cisco Systems\VPN Client\cvpnd.exe -- (CVPND)
SRV - [2007/02/21 06:19:40 | 000,294,912 | ---- | M] (Intel(R) Corporation) [Auto] -- C:\Programme\Intel\Wireless\Bin\WLKEEPER.exe -- (WLANKEEPER) Intel(R)
SRV - [2006/10/26 09:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
SRV - [2006/10/26 08:40:34 | 000,335,872 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\mdm.exe -- (MDM)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand] --  -- (WDICA)
DRV - File not found [Kernel | On_Demand] --  -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand] --  -- (PDRELI)
DRV - File not found [Kernel | On_Demand] --  -- (PDFRAME)
DRV - File not found [Kernel | On_Demand] --  -- (PDCOMP)
DRV - File not found [Kernel | System] --  -- (PCIDump)
DRV - File not found [Kernel | On_Demand] --  -- (NETw5x32) Intel(R)
DRV - File not found [Kernel | System] --  -- (lbrtfdc)
DRV - File not found [Kernel | System] --  -- (i2omgmt)
DRV - File not found [Kernel | System] --  -- (Changer)
DRV - [2012/04/04 09:56:40 | 000,022,344 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand] -- C:\WINDOWS\system32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2011/08/17 03:56:22 | 000,018,176 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ccdcmb.sys -- (nmwcd)
DRV - [2009/10/29 13:34:25 | 000,025,828 | R--- | M] (Fujitsu Siemens Computers) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\snidmi.sys -- (SniDmi)
DRV - [2008/09/29 03:07:00 | 000,340,592 | ---- | M] (McAfee, Inc.) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\mfehidk.sys -- (mfehidk)
DRV - [2008/09/29 03:07:00 | 000,090,360 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\mfeavfk.sys -- (mfeavfk)
DRV - [2008/09/29 03:07:00 | 000,074,648 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\mfeapfk.sys -- (mfeapfk)
DRV - [2008/09/29 03:07:00 | 000,064,432 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\mferkdet.sys -- (mferkdet)
DRV - [2008/09/29 03:07:00 | 000,062,704 | ---- | M] (McAfee, Inc.) [Kernel | System] -- C:\WINDOWS\system32\drivers\mfetdik.sys -- (mfetdik)
DRV - [2008/09/29 03:07:00 | 000,042,424 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\mfebopk.sys -- (mfebopk)
DRV - [2007/10/09 19:56:20 | 000,101,120 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ewusbmdm.sys -- (hwdatacard)
DRV - [2007/04/26 19:17:34 | 000,273,168 | ---- | M] (SigmaTel, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\STAC97.sys -- (STAC97)
DRV - [2007/04/26 18:44:12 | 000,080,384 | ---- | M] (Texas Instruments) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\gtipci21.sys -- (GTIPCI21)
DRV - [2007/04/26 17:37:40 | 001,041,536 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\HSF_DP.sys -- (HSF_DP)
DRV - [2007/04/26 17:37:36 | 000,685,056 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)
DRV - [2007/04/26 17:37:32 | 000,200,064 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\HSFHWICH.sys -- (HSFHWICH)
DRV - [2007/04/26 16:13:04 | 000,190,336 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\b57xp32.sys -- (b57w2k)
DRV - [2007/04/26 15:03:24 | 000,800,768 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2007/04/03 11:17:08 | 000,306,295 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\CVPNDRVA.sys -- (CVPNDRVA)
DRV - [2007/02/21 06:16:12 | 000,012,416 | ---- | M] (Intel Corporation) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\s24trans.sys -- (s24trans)
DRV - [2007/02/08 08:51:16 | 002,209,408 | ---- | M] (Intel® Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\w29n51.sys -- (w29n51) Intel(R)
DRV - [2007/01/31 08:45:06 | 000,127,376 | ---- | M] (Deterministic Networks, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\dne2000.sys -- (DNE)
DRV - [2007/01/18 09:28:02 | 000,005,275 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\CVirtA.sys -- (CVirtA)
DRV - [2005/08/12 12:50:46 | 000,016,128 | ---- | M] (Dell Inc) [Kernel | System] -- C:\WINDOWS\SYSTEM32\DRIVERS\APPDRV.SYS -- (APPDRV)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://intranet
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [Binary data over 100 bytes]
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = [Binary data over 100 bytes]
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://intranet
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\admin_ON_C\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://intranet
IE - HKU\admin_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKU\admin_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\admin_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local;<local>
IE - HKU\admin_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = ksi.iml.fhg.de:8080
 
IE - HKU\administrator.iml_fhg_de_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://intranet
IE - HKU\administrator.iml_fhg_de_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKU\administrator.iml_fhg_de_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local;<local>
IE - HKU\administrator.iml_fhg_de_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = ksi.iml.fhg.de:8080
 
IE - HKU\Administrator_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\LocalService_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\NAS_ON_C\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://intranet
IE - HKU\NAS_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKU\NAS_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\NAS_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local;<local>
IE - HKU\NAS_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = ksi.iml.fhg.de:8080
 
 
========== FireFox ==========
 
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}:6.0.29
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.0.19\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012/04/12 14:38:36 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.0.19\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2012/04/12 14:36:46 | 000,000,000 | ---D | M]
 
[2012/01/30 04:40:33 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\admin\Anwendungsdaten\mozilla\Extensions
[2012/05/19 14:43:36 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\admin\Anwendungsdaten\mozilla\Firefox\Profiles\6wgamg0a.default\extensions
[2012/03/21 16:24:59 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\admin\Anwendungsdaten\mozilla\Firefox\Profiles\6wgamg0a.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2012/05/17 16:09:17 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2011/10/24 16:03:11 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}
[2009/10/29 12:47:51 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAMME\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2008/09/29 03:07:00 | 000,022,576 | ---- | M] (McAfee, Inc.) -- C:\Programme\mozilla firefox\components\Scriptff.dll
[2011/10/02 23:06:04 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\mozilla firefox\plugins\npdeployJava1.dll
[2012/04/12 14:36:29 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012/04/12 14:36:29 | 000,002,344 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2012/04/12 14:36:29 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2012/04/12 14:36:29 | 000,000,986 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2012/04/12 14:36:29 | 000,000,801 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2003/01/27 09:18:58 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Programme\McAfee\VirusScan Enterprise\scriptsn.dll (McAfee, Inc.)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKU\admin_ON_C\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKU\NAS_ON_C\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Programme\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [Adobe Acrobat Speed Launcher] C:\Programme\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [BluetoothAuthenticationAgent] C:\WINDOWS\System32\bthprops.cpl (Microsoft Corporation)
O4 - HKLM..\Run: [CertificateRegistration] C:\WINDOWS\System32\aetcrss1.exe (A.E.T. Europe B.V.)
O4 - HKLM..\Run: [Dell QuickSet] C:\Programme\Dell\QuickSet\quickset.exe (Dell Inc.)
O4 - HKLM..\Run: [EPSON Stylus CX3600 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [IntelWireless] C:\Programme\Intel\Wireless\Bin\ifrmewrk.exe (Intel Corporation)
O4 - HKLM..\Run: [IntelZeroConfig] C:\Programme\Intel\Wireless\bin\ZCfgSvc.exe (Intel Corporation)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [McAfeeUpdaterUI] C:\Programme\McAfee\Common Framework\UdaterUI.exe (McAfee, Inc.)
O4 - HKLM..\Run: [RunSWDepot1]  File not found
O4 - HKLM..\Run: [RunSWDepot2]  File not found
O4 - HKLM..\Run: [ShStatEXE] C:\Programme\McAfee\VirusScan Enterprise\SHSTAT.EXE (McAfee, Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKU\admin_ON_C..\Run: [MobileConnect.EXE]  File not found
O4 - HKU\NAS_ON_C..\Run: [B64Fu7wxCKTba7x] C:\Dokumente und Einstellungen\NAS\Anwendungsdaten\ArchiverforWin.exe ()
O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\VPN Client.lnk = C:\WINDOWS\Installer\{CCBAA1F7-E5E1-48B2-9ED9-A79C6A37CE78}\Icon3E5562ED7.ico ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoToolbarCustomize = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoBandCustomize = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\admin_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\administrator.iml_fhg_de_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O7 - HKU\Administrator_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\LocalService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\NAS_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\NetworkService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: An vorhandene PDF-Datei anfügen - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Linkziel in Adobe PDF konvertieren - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office 2007\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office 2007\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office 2007\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office 2007\Office12\REFIEBAR.DLL (Microsoft Corporation)
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} hxxp://www.fotokasten.de/javaapplet/ImageUploader5.cab (Image Uploader Control)
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} hxxp://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab (Symantec RuFSI Utility Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = iml.fhg.de
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKU\NAS_ON_C Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKU\NAS_ON_C Winlogon: UserInit - (C:\Dokumente und Einstellungen\NAS\Anwendungsdaten\ArchiverforWin.exe) - C:\Dokumente und Einstellungen\NAS\Anwendungsdaten\ArchiverforWin.exe ()
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{001f8061-8343-11e1-aed3-0016415b13b1}\Shell\AutoRun\command - "" = H:\PMBP_Win.exe
O33 - MountPoints2\{0589c17c-52e1-11df-b004-0016415b13b1}\Shell - "" = AutoRun
O33 - MountPoints2\{0589c17c-52e1-11df-b004-0016415b13b1}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{0589c17c-52e1-11df-b004-0016415b13b1}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{0589c17d-52e1-11df-b004-0016415b13b1}\Shell - "" = AutoRun
O33 - MountPoints2\{0589c17d-52e1-11df-b004-0016415b13b1}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{0589c17d-52e1-11df-b004-0016415b13b1}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{21e09f10-e8e4-11de-af65-0016415b13b1}\Shell - "" = AutoRun
O33 - MountPoints2\{21e09f10-e8e4-11de-af65-0016415b13b1}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{21e09f10-e8e4-11de-af65-0016415b13b1}\Shell\AutoRun\command - "" = E:\reatogoMenu.exe
O33 - MountPoints2\{6d70d480-bc2f-11df-ab8e-806d6172696f}\Shell - "" = AutoRun
O33 - MountPoints2\{6d70d480-bc2f-11df-ab8e-806d6172696f}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{6d70d480-bc2f-11df-ab8e-806d6172696f}\Shell\AutoRun\command - "" = E:\pcwstart.exe
O33 - MountPoints2\{9cce9786-548c-11df-b005-0016415b13b1}\Shell - "" = AutoRun
O33 - MountPoints2\{9cce9786-548c-11df-b005-0016415b13b1}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{9cce9786-548c-11df-b005-0016415b13b1}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{d82a89ea-2df2-11df-afc6-0016415b13b1}\Shell\AutoRun\command - "" = G:\TrueCrypt\TrueCrypt.exe /q background /e /m rm /v "container44"
O33 - MountPoints2\{d82a89ea-2df2-11df-afc6-0016415b13b1}\Shell\dismount\command - "" = G:\TrueCrypt\TrueCrypt.exe /q /d
O33 - MountPoints2\{d82a89ea-2df2-11df-afc6-0016415b13b1}\Shell\start\command - "" = G:\TrueCrypt\TrueCrypt.exe
O33 - MountPoints2\{faab8ed0-d3db-11df-abb5-0016415b13b1}\Shell\AutoRun\command - "" = F:\TrueCrypt\TrueCrypt.exe /q background /e /m rm /v "container44"
O33 - MountPoints2\{faab8ed0-d3db-11df-abb5-0016415b13b1}\Shell\dismount\command - "" = F:\TrueCrypt\TrueCrypt.exe /q /d
O33 - MountPoints2\{faab8ed0-d3db-11df-abb5-0016415b13b1}\Shell\start\command - "" = F:\TrueCrypt\TrueCrypt.exe
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012/05/26 17:22:04 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\admin\Anwendungsdaten\Malwarebytes
[2012/05/26 17:21:57 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware
[2012/05/26 17:21:50 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2012/05/26 17:21:45 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2012/05/26 17:21:44 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2012/05/26 15:07:44 | 000,000,000 | ---D | C] -- C:\Kaspersky Rescue Disk 10.0
[2012/05/01 15:45:59 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\admin\Desktop\Boqua TN
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012/05/26 17:57:01 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012/05/26 17:21:57 | 000,000,762 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\ Malwarebytes Anti-Malware .lnk
[2012/05/26 17:21:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware
[2012/05/26 17:18:53 | 000,002,423 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\VPN Client.lnk
[2012/05/26 17:16:56 | 1073,143,808 | -HS- | M] () -- C:\hiberfil.sys
[2012/05/26 10:49:48 | 000,207,360 | ---- | M] () -- C:\Dokumente und Einstellungen\NAS\Anwendungsdaten\ArchiverforWin.exe
[2012/05/25 17:37:07 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012/05/26 17:21:57 | 000,000,762 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\ Malwarebytes Anti-Malware .lnk
[2012/05/26 10:49:53 | 000,207,360 | ---- | C] () -- C:\Dokumente und Einstellungen\NAS\Anwendungsdaten\ArchiverforWin.exe
[2012/02/19 06:04:02 | 000,009,216 | ---- | C] () -- C:\Dokumente und Einstellungen\NAS\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/02/11 15:43:56 | 000,000,153 | ---- | C] () -- C:\Dokumente und Einstellungen\admin\Anwendungsdaten\default.rss
[2012/01/30 04:40:42 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2011/07/31 15:12:24 | 000,000,001 | R--- | C] () -- C:\Dokumente und Einstellungen\admin\serverport
[2010/12/26 18:17:51 | 000,085,504 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2010/01/17 17:15:07 | 000,014,336 | ---- | C] () -- C:\Dokumente und Einstellungen\admin\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/12/20 16:58:59 | 000,096,768 | ---- | C] () -- C:\WINDOWS\SlantAdj.dll
[2009/12/20 16:58:59 | 000,003,136 | ---- | C] () -- C:\WINDOWS\Ade001.bin
[2009/12/20 16:58:59 | 000,000,072 | ---- | C] () -- C:\WINDOWS\System32\epDPE.ini
[2009/12/20 16:58:20 | 000,038,028 | ---- | C] () -- C:\WINDOWS\System32\EPPICPrinterDB.dat
[2009/12/20 16:58:20 | 000,027,030 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern1.dat
[2009/12/20 16:58:20 | 000,000,022 | ---- | C] () -- C:\WINDOWS\System32\PICSDK.ini
[2009/12/20 16:54:40 | 000,000,027 | ---- | C] () -- C:\WINDOWS\CDE CX3600FGD.ini
[2009/12/14 16:12:40 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2009/10/30 05:11:10 | 000,000,162 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2009/10/30 02:42:42 | 000,000,848 | RHS- | C] () -- C:\Dokumente und Einstellungen\administrator.iml_fhg_de\ntuser.pol
[2009/10/29 12:50:46 | 000,000,280 | ---- | C] () -- C:\WINDOWS\System32\epoPGPsdk.dll.sig
[2009/10/29 12:38:52 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2009/10/29 12:33:30 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2009/10/29 12:28:23 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2009/10/29 12:27:32 | 000,354,568 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2009/10/29 12:22:56 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\stac97co.dll
[2009/10/29 12:21:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2009/10/29 12:20:41 | 000,445,770 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat
[2009/10/29 12:20:41 | 000,429,308 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2009/10/29 12:20:41 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2009/10/29 12:20:41 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat
[2009/10/29 12:20:41 | 000,079,026 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat
[2009/10/29 12:20:41 | 000,066,258 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2009/10/29 12:20:41 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat
[2009/10/29 12:20:41 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2009/10/29 12:20:36 | 000,004,463 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2009/10/29 12:20:35 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2009/10/29 12:20:29 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2009/10/29 12:19:57 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2009/10/29 12:19:56 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2009/10/29 12:19:18 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2009/10/29 12:19:08 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin
[2008/02/20 04:30:02 | 000,528,384 | ---- | C] () -- C:\WINDOWS\System32\CaeMapi.dll
[2007/04/03 11:18:26 | 000,197,672 | ---- | C] () -- C:\WINDOWS\System32\vpnapi.dll
[2007/04/03 11:18:06 | 000,193,576 | ---- | C] () -- C:\WINDOWS\System32\CSGina.dll
 
========== LOP Check ==========
 
[2011/06/30 16:47:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\admin\Anwendungsdaten\Amazon
[2010/09/09 12:40:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\admin\Anwendungsdaten\Serif
[2010/04/28 12:14:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\admin\Anwendungsdaten\Vodafone
[2009/10/30 06:28:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\administrator.iml_fhg_de\Anwendungsdaten\Autodesk
[2010/04/28 12:08:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\Bytemobile
[2009/10/30 06:05:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Autodesk
[2009/12/20 17:03:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\UDL
[2010/05/02 11:14:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Vodafone
[2009/10/29 13:15:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\WinZip
 
========== Purity Check ==========
 
 
< End of report >
         

Könnt ihr mir bei der Lösung helfen? Vielen Dank im Voraus.

Gruss,
eveactive

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = iml.fhg.de

Könnt ihr mir bei der Lösung helfen? Vielen Dank im Voraus.

Firmenrechner? Werden hier eigentlich nicht bereinigt
Eine Lösung bietet dir deine EDV-Abteilung

Siehe => http://www.trojaner-board.de/108422-...-anfragen.html

3. Grundsätzlich bereinigen wir keine gewerblich genutzten Rechner. Dafür ist die IT Abteilung eurer Firma zuständig.

Bei Kleinunternehmen, welche keinen IT Support haben, machen wir da eine Ausnahme und helfen gerne ( kleine Spende hilft auch uns ).
Voraussetzung: Ihr teilt uns dies in eurer ersten Antwort mit.
Bedenkt jedoch, dass Logfiles viele heikle Informationen enthalten können ( Kundendaten, Bankdaten, etc ) sowie das Malware die Möglichkeit besitzt, diese auszuspähen und zu missbrauchen. Hier legen wir euch ein Formatieren und Neuaufsetzen nahe.