TR/Dldr.Small.ayl.0 (log)

R.E.M. · 23.02.2006, 19:38

Code:

ATTFilter

Logfile of HijackThis v1.99.1
Scan saved at 19:33:52, on 23.02.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\ATI Technologies\ATI.ACE\cli.exe
C:\Programme\ICQLite\ICQLite.exe
H:\Programme\DAEMON Tools\daemon.exe
C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe
H:\Programme\VirtualCloneDrive\VCDDaemon.exe
C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
C:\Programme\DT\T-Sinus 130data 11Mbps WLAN USB Adapter\monitordt.exe
C:\Programme\Analog Devices\SoundMAX\spkrmon.exe
C:\Programme\ATI Technologies\ATI.ACE\cli.exe
C:\Programme\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\TEMP\winCD7.tmp.exe
C:\WINDOWS\TEMP\winBFB.tmp.exe
H:\Programme\Mozilla Firefox\firefox.exe
C:\WINDOWS\TEMP\winCD7.tmp.exe
C:\WINDOWS\TEMP\winBFB.tmp.exe
C:\WINDOWS\TEMP\winCD7.tmp.exe
C:\Dokumente und Einstellungen\****\Desktop\hijackthis_199\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - h:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O4 - HKLM\..\Run: [ATICCC] "C:\Programme\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -minimize
O4 - HKLM\..\Run: [DAEMON Tools] "h:\Programme\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [VirtualCloneDrive] "h:\Programme\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -trayboot
O4 - HKCU\..\RunOnce: [MPlayer2_FixUp] C:\WINDOWS\inf\unregmp2.exe /Fixups
O4 - Global Startup: T-Sinus 130data WLAN USB Monitor.lnk = ?
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://H:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - H:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O20 - Winlogon Notify: winrvc32 - C:\WINDOWS\SYSTEM32\winrvc32.dll
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - H+BEDV Datentechnik GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe
O23 - Service: spkrmon - Unknown owner - C:\Programme\Analog Devices\SoundMAX\spkrmon.exe

Hier mein Logfile. Antivir XP meldet TR/Dldr.Small.ayl.0

Danke für eure Hilfe

R.E.M.

Black Wolf · 23.02.2006, 19:54

n dem Thread haben wirs grad schon von diesem Trojaner: hier

Wildone · 23.02.2006, 20:25

Hallo,
jetzt machen wir mal das ganze Programm.

1.) Poste ein Log von Silentrunners

2.) Lösche deine Temp Dateien mit cleanup und mache danach folgendes und poste die vier Logfiles, nur die Dateien der letzten drei Monate abkopieren.

3.) Besorge dir F-Secure Blacklight und scanne damit dein System, danach wird automatisch ein Logfile im selben Pfad erstellt, poste es.

Ob dich allerdings der gesammte Aufwand vor einer Neuinstallation bewahren wird ist mehr als fraglich.

Grüße Wildone

R.E.M. · 23.02.2006, 21:00

Danke!

Silentrunners Log:

Code:

ATTFilter

"Silent Runners.vbs", revision 43, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ {++}
"ICQ Lite" = "C:\Programme\ICQLite\ICQLite.exe -trayboot" ["ICQ Ltd."]
"MPlayer2_FixUp" = "C:\WINDOWS\inf\unregmp2.exe /Fixups" [MS]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"ATICCC" = ""C:\Programme\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay" [null data]
"AtiPTA" = "atiptaxx.exe" ["ATI Technologies, Inc."]
"ICQ Lite" = "C:\Programme\ICQLite\ICQLite.exe -minimize" ["ICQ Ltd."]
"DAEMON Tools" = ""h:\Programme\DAEMON Tools\daemon.exe" -lang 1033" ["DT Soft Ltd."]
"avgnt" = ""C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min" ["H+BEDV Datentechnik GmbH"]
"VirtualCloneDrive" = ""h:\Programme\VirtualCloneDrive\VCDDaemon.exe" /s" ["Elaborate Bytes AG"]

HKLM\Software\Microsoft\Active Setup\Installed Components\
>{26923b43-4d38-484f-9b9e-de460746276c}\(Default) = "Internet Explorer"
                                        \StubPath   = "C:\WINDOWS\system32\shmgrate.exe OCInstallUserConfigIE" [MS]
>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}\(Default) = "Outlook Express"
                                        \StubPath   = "C:\WINDOWS\system32\shmgrate.exe OCInstallUserConfigOE" [MS]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = "AcroIEHlprObj Class" [from CLSID]
  -> {CLSID}\InProcServer32\(Default) = "h:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx" [empty string]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "CPL-Erweiterung für Anzeigeverschiebung"
  -> {CLSID}\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Erweiterung für HyperTerminal-Icons"
  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]
"{5E2121EE-0300-11D4-8D3B-444553540000}" = "Catalyst Context Menu extension"
  -> {CLSID}\InProcServer32\(Default) = "C:\Programme\ATI Technologies\ATI.ACE\atiacmxx.dll" [empty string]
"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
  -> {CLSID}\InProcServer32\(Default) = "H:\Programme\Microsoft Office\OFFICE11\msohev.dll" [MS]
"{73B24247-042E-4EF5-ADC2-42F62E6FD654}" = "ICQ Lite Shell Extension"
  -> {CLSID}\InProcServer32\(Default) = "C:\Programme\ICQLite\ICQLiteShell.dll" [empty string]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
  -> {CLSID}\InProcServer32\(Default) = "h:\Programme\WinRAR\rarext.dll" [null data]
"{45AC2688-0253-4ED8-97DE-B5370FA7D48A}" = "Shell Extension for Malware scanning"
  -> {CLSID}\InProcServer32\(Default) = "C:\Programme\AntiVir PersonalEdition Classic\shlext.dll" ["H+BEDV Datentechnik GmbH"]
"{B7056B8E-4F99-44f8-8CBD-282390FE5428}" = "VirtualCloneDrive"
  -> {CLSID}\InProcServer32\(Default) = "h:\Programme\VirtualCloneDrive\ElbyVCDShell.dll" ["Elaborate Bytes AG"]
"{21569614-B795-46b1-85F4-E737A8DC09AD}" = "Shell Search Band"
  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\browseui.dll" [MS]
"{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"
  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"
  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
"{e82a2d71-5b2f-43a0-97b8-81be15854de8}" = "ShellLink for Application References"
  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\dfshim.dll" [MS]
"{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75}" = "Shell Icon Handler for Application References"
  -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\dfshim.dll" [MS]
"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player"
  -> {CLSID}\InProcServer32\(Default) = "h:\Programme\RealPlayer\rpshell.dll" ["RealNetworks, Inc."]

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
INFECTION WARNING! AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."]

HKLM\Software\Classes\PROTOCOLS\Filter\
INFECTION WARNING! text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}"
  -> {CLSID}\InProcServer32\(Default) = "C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
ICQLiteMenu\(Default) = "{73B24247-042E-4EF5-ADC2-42F62E6FD654}"
  -> {CLSID}\InProcServer32\(Default) = "C:\Programme\ICQLite\ICQLiteShell.dll" [empty string]
Shell Extension for Malware scanning\(Default) = "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}"
  -> {CLSID}\InProcServer32\(Default) = "C:\Programme\AntiVir PersonalEdition Classic\shlext.dll" ["H+BEDV Datentechnik GmbH"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
  -> {CLSID}\InProcServer32\(Default) = "h:\Programme\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
ICQLiteMenu\(Default) = "{73B24247-042E-4EF5-ADC2-42F62E6FD654}"
  -> {CLSID}\InProcServer32\(Default) = "C:\Programme\ICQLite\ICQLiteShell.dll" [empty string]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
  -> {CLSID}\InProcServer32\(Default) = "h:\Programme\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
Shell Extension for Malware scanning\(Default) = "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}"
  -> {CLSID}\InProcServer32\(Default) = "C:\Programme\AntiVir PersonalEdition Classic\shlext.dll" ["H+BEDV Datentechnik GmbH"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
  -> {CLSID}\InProcServer32\(Default) = "h:\Programme\WinRAR\rarext.dll" [null data]


Active Desktop and Wallpaper:
-----------------------------

Active Desktop is disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp"


Enabled Screen Saver:
---------------------

HKCU\Control Panel\Desktop\
"SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS]


Startup items in "REM²" & "All Users" startup folders:
------------------------------------------------------

C:\Dokumente und Einstellungen\All Users.WINDOWS\Startmenü\Programme\Autostart
"T-Sinus 130data WLAN USB Monitor" -> shortcut to: "C:\Programme\DT\T-Sinus 130data 11Mbps WLAN USB Adapter\monitordt.exe" ["Deutsche Telekom"]


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 17
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05


Toolbars, Explorer Bars, Extensions:
------------------------------------

Explorer Bars

Dormant Explorer Bars in "View, Explorer Bar" menu

HKLM\Software\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\ = "&Recherchieren"
Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
InProcServer32\(Default) = "H:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL" [MS]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{92780B25-18CC-41C8-B9BE-3C9C571A8263}\
"ButtonText" = "Recherchieren"

{B863453A-26C3-4E1F-A54D-A2CD196348E9}\
"ButtonText" = "ICQ Lite"
"MenuText" = "ICQ Lite"
"Exec" = "C:\Programme\ICQLite\ICQLite.exe" ["ICQ Ltd."]

{FB5F1910-F110-11D2-BB9E-00C04F795683}\
"ButtonText" = "Messenger"
"MenuText" = "Windows Messenger"
"Exec" = "C:\Programme\Messenger\msmsgs.exe" [MS]


Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

AntiVir PersonalEdition Classic Service, AntiVirService, "C:\Programme\AntiVir PersonalEdition Classic\avguard.exe" ["H+BEDV Datentechnik GmbH"]
Ati HotKey Poller, Ati HotKey Poller, "C:\WINDOWS\System32\Ati2evxx.exe" ["ATI Technologies Inc."]
spkrmon, spkrmon, "C:\Programme\Analog Devices\SoundMAX\spkrmon.exe" [empty string]


----------
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
  launch it from a command prompt or a shortcut with the -all parameter.
+ The search for DESKTOP.INI DLL launch points on all local fixed drives
  took 614 seconds.
+ The search for all Registry CLSIDs containing dormant Explorer Bars
  took 8 seconds.
---------- (total run time: 656 seconds)

Die vier Logfiles:

Code:

ATTFilter

 Datentr„ger in Laufwerk C: ist Master
 Volumeseriennummer: 043D-ADA5

 Verzeichnis von C:\WINDOWS\SYSTEM32

23.02.2006  18:42            16.832 amcompat.tlb
23.02.2006  18:42            23.392 nscompat.tlb
23.02.2006  17:45           176.167 rmoc3260.dll
23.02.2006  17:45             5.632 pndx5032.dll
23.02.2006  17:45             6.656 pndx5016.dll
23.02.2006  17:45           278.528 pncrt.dll
23.02.2006  17:25           401.064 perfh009.dat
23.02.2006  17:25            62.344 perfc009.dat
23.02.2006  17:25           415.470 perfh007.dat
23.02.2006  17:25            74.996 perfc007.dat
23.02.2006  17:25           966.250 PerfStringBackup.INI
23.02.2006  17:05             2.206 wpa.dbl
20.02.2006  16:49                90 spupdwxp.log
20.02.2006  16:48           114.176 FNTCACHE.DAT
18.02.2006  23:29            43.520 CmdLineExt03.dll
18.02.2006  14:24                 2 wintsu.exe
18.02.2006  12:44            19.456 winrvc32.dll
17.02.2006  19:23            25.065 wmpscheme.xml
17.02.2006  19:19               237 $winnt$.inf
17.02.2006  19:13             2.951 CONFIG.NT
17.02.2006  19:12               488 WindowsLogon.manifest
17.02.2006  19:12               488 logonui.exe.manifest
17.02.2006  19:11               749 sapi.cpl.manifest
17.02.2006  19:11               749 wuaucpl.cpl.manifest
17.02.2006  19:11               749 cdplayer.exe.manifest
17.02.2006  19:11               749 nwc.cpl.manifest
17.02.2006  19:11               749 ncpa.cpl.manifest
17.02.2006  19:10            21.740 emptyregdb.dat
17.02.2006  19:07                 0 h323log.txt
14.02.2006  16:01            73.728 ElbyVCD.dll
07.02.2006  21:28         4.513.120 MRT.exe
18.01.2006  13:05            57.344 avsda.dll
17.01.2006  22:36            69.632 ElbyCDIO.dll
12.01.2006  11:32           543.496 LegitCheckControl.DLL
05.01.2006  04:46           252.928 ati2dvag.dll
05.01.2006  04:41           110.592 atipdlxx.dll
05.01.2006  04:41            77.824 Oemdspif.dll
05.01.2006  04:41            26.112 Ati2mdxx.exe
05.01.2006  04:41            40.960 ati2edxx.dll
05.01.2006  04:40            61.440 ati2evxx.dll
05.01.2006  04:39           405.504 ati2evxx.exe
05.01.2006  04:39            53.248 ATIDDC.DLL
05.01.2006  04:31         2.518.176 ati3duag.dll
05.01.2006  04:25           862.336 ativvaxx.dll
05.01.2006  04:20         6.684.672 atioglx1.dll
05.01.2006  04:19           307.200 atiiiexx.dll
05.01.2006  04:11           151.552 atikvmag.dll
05.01.2006  04:10            17.408 atitvo32.dll
05.01.2006  04:05           237.568 ati2cqag.dll
05.01.2006  04:01         4.968.448 atioglxx.dll
05.01.2006  03:22           258.048 ATIDEMGR.dll
04.01.2006  04:35            68.096 webclnt.dll
30.12.2005  20:16            77.824 xvid.ax
30.12.2005  20:10           761.856 xvidcore.dll
29.12.2005  03:54           280.064 gdi32.dll

Code:

ATTFilter

 Datentr„ger in Laufwerk C: ist Master
 Volumeseriennummer: 043D-ADA5

 Verzeichnis von C:\DOKUME~1\REM~1\LOKALE~1\Temp

23.02.2006  20:44            16.384 Perflib_Perfdata_a6c.dat
23.02.2006  20:44            16.384 Perflib_Perfdata_a74.dat
23.02.2006  20:43            16.384 ~DFE30A.tmp
23.02.2006  20:43               512 ~DFA9CF.tmp
23.02.2006  20:43            16.384 ~DFA9C3.tmp
23.02.2006  20:43            16.384 Perflib_Perfdata_26c.dat
               6 Datei(en)         82.432 Bytes
               0 Verzeichnis(se), 15.765.921.792 Bytes frei

Code:

ATTFilter

 Datentr„ger in Laufwerk C: ist Master
 Volumeseriennummer: 043D-ADA5

 Verzeichnis von C:\WINDOWS

23.02.2006  20:43            70.691 wmsetup.log
23.02.2006  20:43                 0 0.log
23.02.2006  20:43         1.552.702 WindowsUpdate.log
23.02.2006  20:42             2.048 bootstat.dat
23.02.2006  20:42             7.690 SchedLgU.Txt
23.02.2006  18:52           559.987 setupapi.log
23.02.2006  18:43               237 wmsetup10.log
23.02.2006  18:36            32.635 spupdsvc.log
23.02.2006  18:34            18.634 KB911565.log
23.02.2006  17:53               227 system.ini
23.02.2006  17:53               487 win.ini
23.02.2006  17:23             2.896 COM+.log
23.02.2006  17:20           123.063 comsetup.log
23.02.2006  17:20            76.800 ntdtcsetup.log
23.02.2006  17:20            77.771 iis6.log
23.02.2006  17:20             1.917 imsins.log
23.02.2006  17:20           201.922 tsoc.log
23.02.2006  17:20            14.666 ocmsn.log
23.02.2006  17:20           275.489 ocgen.log
23.02.2006  17:20            26.247 msgsocm.log
23.02.2006  17:20           504.083 FaxSetup.log
23.02.2006  17:17             9.775 WMCSetup.log
23.02.2006  17:16             6.622 basecsp.log
23.02.2006  17:16             7.855 KB891122.log
23.02.2006  17:16           316.640 WMSysPr9.prx
23.02.2006  17:13            16.014 KB900930.log
23.02.2006  17:13            15.787 KB887797.log
21.02.2006  22:47            16.288 KB885250.log
21.02.2006  22:47            16.425 KB887742.log
21.02.2006  22:47            19.689 KB905915.log
21.02.2006  22:47            28.069 updspapi.log
21.02.2006  22:46             7.990 KB886185.log
20.02.2006  21:40           209.425 KB904706.log
20.02.2006  19:23             4.096 d3dx.dat
20.02.2006  18:35             1.174 OEWABLog.txt
20.02.2006  18:35           736.519 setuplog.txt
20.02.2006  16:49               360 DtcInstall.log
20.02.2006  15:58           432.681 svcpack.log
20.02.2006  15:58           199.509 KB913446.log
20.02.2006  15:57           210.000 KB912919.log
20.02.2006  15:57           216.174 KB911927.log
20.02.2006  15:56           220.545 KB910437.log
20.02.2006  15:55           207.632 KB908519.log
20.02.2006  15:54           208.922 KB905749.log
20.02.2006  15:54           218.471 KB905414.log
20.02.2006  15:53           237.195 KB902400.log
20.02.2006  15:52           216.791 KB901214.log
20.02.2006  15:52           210.320 KB901017.log
20.02.2006  15:51           216.428 KB900725.log
20.02.2006  15:50           211.220 KB899591.log
20.02.2006  15:50           217.520 KB899587.log
20.02.2006  15:49           205.967 KB896428.log
20.02.2006  15:49           211.856 KB896424.log
20.02.2006  15:48           223.428 KB896423.log
20.02.2006  15:47           216.034 KB896422.log
20.02.2006  15:47           229.153 KB896358.log
20.02.2006  15:46           223.538 KB893756.log
20.02.2006  15:46           216.111 KB891781.log
20.02.2006  15:45           212.310 KB890859.log
20.02.2006  15:45           217.961 KB890046.log
20.02.2006  15:44           210.552 KB888302.log
20.02.2006  15:44           224.925 KB888113.log
20.02.2006  15:43           211.211 KB885836.log
20.02.2006  15:43           215.897 KB885835.log
20.02.2006  15:42           218.230 KB873339.log
20.02.2006  15:37               200 cmsetacl.log
20.02.2006  15:36           299.552 WMSysPrx.prx
20.02.2006  15:36             1.330 sessmgr.setup.log
18.02.2006  13:40           382.141 DirectX.log
18.02.2006  10:16             4.493 xpsp1hfm.log
18.02.2006  10:16             9.003 KB835732.log
18.02.2006  10:14             4.618 KB833407.log
18.02.2006  10:00            37.276 KB905495.log
18.02.2006  09:59            26.703 KB911564.log
18.02.2006  09:57            16.813 KB905915-IE6SP1-20051122.175908.log
18.02.2006  09:54            18.223 KB835409.log
17.02.2006  22:34               400 ODBC.INI
17.02.2006  22:26            40.263 Codec Pack - All In 1 Setup Log.txt
17.02.2006  22:25           737.280 iun6002.exe
17.02.2006  22:20               349 vtplus32.ini
17.02.2006  22:19             1.832 HCWPNP.INI
17.02.2006  22:17            10.347 KB842773.log
17.02.2006  22:17           175.395 setupact.log
17.02.2006  22:17             6.850 KB893803v2.log
17.02.2006  22:17            11.711 KB898461.log
17.02.2006  22:16         1.207.839 setupapi.log.0.old
17.02.2006  22:02           123.796 Omega Drivers v3.8.205.log
17.02.2006  21:59           451.072 Radeon Omega Drivers v3.8.205 Uninstall.exe
17.02.2006  21:42            32.831 Radeon Omega Drivers v3.8.205 Uninstall Log.txt
17.02.2006  21:41                10 WININIT.INI
17.02.2006  21:08                 0 nsreg.dat
17.02.2006  20:55               558 Windows Update.log
17.02.2006  19:20             8.192 REGLOCS.OLD
17.02.2006  19:17            48.694 Q331953.log
17.02.2006  19:16            45.997 Q327979.log
17.02.2006  19:16            42.319 Q816979.log
17.02.2006  19:16            38.990 Q329048.log
17.02.2006  19:15            34.956 Q329909.log
17.02.2006  19:15            32.353 Q816982.log
17.02.2006  19:15            29.622 Q815485.log
17.02.2006  19:14            23.403 Q811789.log
17.02.2006  19:14            20.947 Q816981.log
17.02.2006  19:14            17.292 Q813862.log
17.02.2006  19:14            14.564 Q328213.log
17.02.2006  19:13            11.293 Q810890.log
17.02.2006  19:13                 0 control.ini
17.02.2006  19:13             4.161 ODBCINST.INI
17.02.2006  19:11               749 WindowsShell.Manifest
17.02.2006  19:10                36 vb.ini
17.02.2006  19:10                37 vbaddin.ini
17.02.2006  19:06             1.920 regopt.log
17.02.2006  19:06                50 wiaservc.log
17.02.2006  19:06               509 wiadebug.log
17.02.2006  19:06                 0 Sti_Trace.log
17.02.2006  19:00                 0 setuperr.log

Code:

ATTFilter

 Datentr„ger in Laufwerk C: ist Master
 Volumeseriennummer: 043D-ADA5

 Verzeichnis von C:\

23.02.2006  20:47                 0 sys.txt
23.02.2006  20:47             7.698 system.txt
23.02.2006  20:47               569 systemtemp.txt
23.02.2006  20:45           100.599 system32.txt
23.02.2006  20:42     1.610.612.736 pagefile.sys
23.02.2006  17:53               217 boot.ini
20.02.2006  15:29            47.564 NTDETECT.COM
20.02.2006  15:29           251.184 ntldr
17.02.2006  22:11               102 hcwclear.txt
17.02.2006  19:13                 0 AUTOEXEC.BAT
17.02.2006  18:36                 0 iwctrllog.txt
10.02.2006  21:02             2.176 ZbThumbnail.info

Der F-Secure Log (der hat nix gefunden):

Code:

ATTFilter

02/23/06 20:54:14 [Info]: BlackLight Engine 1.0.32 initialized
02/23/06 20:54:14 [Info]: OS: 5.1 build 2600 (Service Pack 2)
02/23/06 20:54:14 [Note]: 7019 4
02/23/06 20:54:14 [Note]: 7005 0
02/23/06 20:54:22 [Note]: 7006 0
02/23/06 20:54:22 [Note]: 7011 488
02/23/06 20:54:23 [Note]: FSRAW library version 1.7.1015
02/23/06 20:56:40 [Note]: 7007 0

Hoffentlich kannste mir weiterhelfen, wäre echt nett!

R.E.M.

Wildone · 23.02.2006, 21:22

Hallo,
ich kann erstaunlicherweise nicht so viel schädliches erkennen.
Lösche mal mit killbox follgende Dateien on reboot:

C:\WINDOWS\TEMP\winCD7.tmp.exe
C:\WINDOWS\TEMP\winBFB.tmp.exe
C:\WINDOWS\TEMP\winCD7.tmp.exe
C:\WINDOWS\TEMP\winBFB.tmp.exe
C:\WINDOWS\TEMP\winCD7.tmp.exe
C:\Windows\System32\wintsu.exe
C:\Windows\System32\winrvc32.dll

dann postest du mal ein neues HijackThis Log.

Grüße Wildone

R.E.M. · 24.02.2006, 12:45

Danke für die geile Hilfe!

Scheint nicht mehr da zu sein, schon ne halbe Stunde ohne Antivir Fund

Im den verschiedenen verdächtigten Verzeichnissen ist jetzt auch nichts mehr zu sehen

Danke für diese schnelle und professionelle Hilfe. Hier nochmal einen HijackThis Log:

Code:

ATTFilter

Logfile of HijackThis v1.99.1
Scan saved at 12:42:24, on 24.02.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Analog Devices\SoundMAX\spkrmon.exe
C:\Programme\ATI Technologies\ATI.ACE\cli.exe
C:\Programme\ICQLite\ICQLite.exe
H:\Programme\DAEMON Tools\daemon.exe
C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe
H:\Programme\VirtualCloneDrive\VCDDaemon.exe
C:\Programme\DT\T-Sinus 130data 11Mbps WLAN USB Adapter\monitordt.exe
C:\Programme\ATI Technologies\ATI.ACE\cli.exe
C:\Programme\ATI Technologies\ATI.ACE\cli.exe
H:\Programme\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Dokumente und Einstellungen\REM²\Desktop\hijackthis_199\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - h:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O4 - HKLM\..\Run: [ATICCC] "C:\Programme\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -minimize
O4 - HKLM\..\Run: [DAEMON Tools] "h:\Programme\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [VirtualCloneDrive] "h:\Programme\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -trayboot
O4 - Global Startup: T-Sinus 130data WLAN USB Monitor.lnk = ?
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://H:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - H:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O20 - Winlogon Notify: winrvc32 - winrvc32.dll (file missing)
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - H+BEDV Datentechnik GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe
O23 - Service: spkrmon - Unknown owner - C:\Programme\Analog Devices\SoundMAX\spkrmon.exe

R.E.M.

Wildone · 24.02.2006, 13:16

Hallo,
das kannst du noch mit HijackThis fixen (Haken davor und auf "fix checked"):
O20 - Winlogon Notify: winrvc32 - winrvc32.dll (file missing)

Ansonsten bleibt zu sagen das du die Finger von unseriöser Software lassen solltest, bzw. von Software aus unseriösen Quellen (P2P, Crackseiten usw.)

Grüße Wildone

TR/Dldr.Small.ayl.0 (log)

Log-Analyse und Auswertung: TR/Dldr.Small.ayl.0 (log)