Hallo,

der IE zeigt bei mir beim Laden von Webseitenm selbstständig Werbung in neuen Browserfenstern an. Dabei crashed oft auch der iexplore.exe oder gleich der explorer.exe Prozess. Scans mit diversen Anti-Virus, -Malware, -Spyware Programmen bachte keinen Erfolg. Anbei mein Log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:29:43, on 19.12.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nslsvice.exe
C:\WINDOWS\system32\nsl.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\iPass\iPassConnect\iPassConnectGUI.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\a-squared Anti-Malware\a2service.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Apoint\HidFind.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\iPass\iPassConnect\iPassPeriodicUpdateService.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\OO Software\CleverCache\ooccctrl.exe
C:\WINDOWS\system32\igfxsrvc.exe
c:\program files\ipass\epm\marchost.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\Program Files\a-squared Anti-Malware\a2guard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe
c:\program files\ipass\epm\rstate.exe
C:\PROGRA~1\ipass\epm\rstate.exe
C:\Program Files\TrueCrypt\TrueCrypt.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Rainlendar2\Rainlendar2.exe
C:\Program Files\notes\ntmulti.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\Program Files\OO Software\CleverCache\ooccag.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\VMware\VMware Server\vmware-authd.exe
C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
C:\WINDOWS\system32\vmnat.exe
C:\WINDOWS\system32\vmnetdhcp.exe
C:\Program Files\VMware\VMware Server\vmserverdWin32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\iPass\iPassConnect\iPassPeriodicUpdateApp.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\iPass\iPassConnect\iPassConnectEngine.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = h**p://update.microsoft.com/microsoftupdate
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = isa9901.suvanet.ch:8080
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: del.icio.us - {981FE6A8-260C-4930-960F-C3BC82746CB0} - C:\Program Files\del.icio.us\Internet Explorer Buttons\dlcsIE.dll
O3 - Toolbar: Google Notebook - {CCCCCCDB-4DDB-4703-95D4-DD2C526397BF} - C:\Program Files\Google\Google Notebook\gnotes1.0.2.19--1413200799.dll
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Live Support Host] "c:\program files\ipass\epm\marchost.exe" -servicehelper
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [iPassConnect] "C:\Program Files\iPass\iPassConnect\iPassConnectGUI.exe" /S
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [ooccctrl.exe] C:\Program Files\OO Software\CleverCache\ooccctrl.exe /tasktray
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\mrofinu1044.exe 61A847B5BBF72813329F3C466188719AB689201522886B092CBD44BD8689220221DD3257
O4 - HKLM\..\Run: [eb2f9266] rundll32.exe "C:\WINDOWS\system32\xpudgiql.dll",b
O4 - HKLM\..\Run: [a-squared] "C:\Program Files\a-squared Anti-Malware\a2guard.exe" /d=60
O4 - HKLM\..\Run: [DM Agent] c:\PROGRA~1\ipass\epm\rstate.exe /LOGON
O4 - HKCU\..\Run: [TrueCrypt] "C:\Program Files\TrueCrypt\TrueCrypt.exe" /q preferences
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Rainlendar2] C:\Program Files\Rainlendar2\Rainlendar2.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Startup: Task Manager.lnk = C:\WINDOWS\system32\taskmgr.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Note this (Google Notebook) - res://C:\Program Files\Google\Google Notebook\gnotes1.0.2.19--1413200799.dll/gn_menu1.html
O8 - Extra context menu item: Note this item (Google Notebook) - res://C:\Program Files\Google\Google Notebook\gnotes1.0.2.19--1413200799.dll/gn_menu2.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: imaged.img.com
O15 - Trusted Zone: imgbiw.img.com
O15 - Trusted Zone: imgcrm.img.com
O15 - Trusted Zone: imgid3.img.com
O15 - Trusted Zone: imgisc.img.com
O15 - Trusted Zone: imgit2.img.com
O15 - Trusted Zone: imgits.img.com
O15 - Trusted Zone: imgplm.img.com
O15 - Trusted Zone: imgres.img.com
O15 - Trusted Zone: imgsem.img.com
O15 - Trusted Zone: imgvms2.img.com
O15 - Trusted Zone: h**p://help.sap.com
O15 - Trusted Zone: h**p://service.sap.com
O15 - Trusted Zone: h**p://www.sapinfo.de
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - h**p://go.microsoft.com/fwlink/?linkid=67633
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - h**p://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1EF9F042-C2EB-4293-8213-474CAEEF531D} (TmHcmsX Control) - h**p://www.trendsecure.com/framework/control/en-US/activex/TmHcmsX.CAB
O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - h**ps://imgln2.img.com/iNotes6W.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - h**p://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1189635028562
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - h**p://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1189635015343
O16 - DPF: {82774781-8F4E-11D1-AB1C-0000F8773BF0} (DLC Class) - h**ps://transfers.ds.microsoft.com/FTM/TransferSource/grTransferCtrl.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = domimg.com
O17 - HKLM\Software\..\Telephony: DomainName = domimg.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = domimg.com
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Malware\a2service.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPassConnectEngine - iPass, Inc. - C:\Program Files\iPass\iPassConnect\iPassConnectEngine.exe
O23 - Service: iPassPeriodicUpdateApp - iPass, Inc. - C:\Program Files\iPass\iPassConnect\iPassPeriodicUpdateApp.exe
O23 - Service: iPassPeriodicUpdateService - iPass, Inc. - C:\Program Files\iPass\iPassConnect\iPassPeriodicUpdateService.exe
O23 - Service: Lotus Notes Single Logon - IBM Corp - C:\WINDOWS\system32\nslsvice.exe
O23 - Service: Live Support Host (marchost) - iPass Inc. - c:\program files\ipass\epm\marchost.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: iPass EPM Agent (MobileAutmationAgentService) - iPass Inc. - c:\program files\ipass\epm\rstate.exe
O23 - Service: Multi-user Cleanup Service - IBM Corp - C:\Program Files\notes\ntmulti.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: O&O CleverCache Agent (OOCleverCacheAgent) - O&O Software GmbH - C:\Program Files\OO Software\CleverCache\ooccag.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XIIc\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XIIc\RpcSandraSrv.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Server\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe
O23 - Service: VMware Virtual Mount Manager Extended (vmount2) - VMware, Inc. - C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
O23 - Service: VMware Registration Service (vmserverdWin32) - VMware, Inc. - C:\Program Files\VMware\VMware Server\vmserverdWin32.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

--
End of file - 13008 bytes


Danke für eure Hilfe!

Hallo und Herzlich Willkommen im Trojaner-Board

Ich könnte mir schon vorstellen, was du unter anderem
auf deinem System sitzen hast, aber lass uns erst mal
überprüfen, wie schlimm die Lage deines Rechner's wirklich ist.

* Dateien Online Überprüfen
(versteckte Ordner und Dateien anzeigen lassen)
1. Im Explorer im Menü Extras -> Ordneroptionen -> Ansicht setze folgende Einstellungen:
2. Erweiterungen bei bekannten Dateitypen ausblenden -> Haken weg
3. Geschützte Systemdateien ausblenden -> Haken weg
4. Inhalte von Systemordnern anzeigen -> Haken setzen
(diese Option ist bei Windows 2000 nicht vorhanden)
5. Versteckte Dateien und Ordner -> Alle Dateien und Ordner anzeigen
(Dateien online überprüfen)
6. Speicher dir die unten angebenen Dateien auf einen externen Datenträger,
falls du keine Internetverbindung hast.
7. lade die Seite von Virustotal (alternativ Jotti)
8. lade in der dafür vorgesehen Box folgende Datei(en) hoch

C:\WINDOWS\mrofinu1044.exe
C:\WINDOWS\system32\xpudgiql.dll

9. Warte die Auswertung ab
10. Poste das komplett Ergebnis mit Hash und Dateigröße hier rein

* MWAV (eScan) - Free Antivirus
1. Lies dir folgende Anleitung genau durch und arbeite sie ab
-> Anleitung eScan
(Bei Updateproblemen -> Updateprobleme beheben
(Sollte der Hinweis erscheinen, dass du nur mit der Vollversion
die Funde löschen kannst, breche den Scan NICHT ab)
2. Poste im Anschluss das Ergebnis mit Hilfe der *find.bat'.
- rechte Maustaste auf den LINK 'find.bat' , dann "Ziel Speichern unter" -> Desktop)
- führe die find.bat aus
- das erstellte Log kopierst du ab und postest in deinen nächsten Beitrag
3. Entferne bitte nicht selber von escan alarmierte Funde.
Es sind erfahrungsgemäß viele Fehlalarme dabei

mfg Cleriker

Hi,

danke für die Hilfe! Es sieht nach einem Volltreffer aus:

1.0) Virustotal Ergebnisse:

1.1) C:\WINDOWS\mrofinu1044.exe:

Antivirus Version letzte aktualisierung Ergebnis
AhnLab-V3 2007.12.20.10 2007.12.19 -
AntiVir 7.6.0.45 2007.12.19 TR/Crypt.ULPM.Gen
Authentium 4.93.8 2007.12.19 -
Avast 4.7.1098.0 2007.12.18 Win32:Agent-NMX
AVG 7.5.0.503 2007.12.19 Downloader.Generic6.ZUK
BitDefender 7.2 2007.12.19 Trojan.Downloader.Agent.YWO
CAT-QuickHeal 9.00 2007.12.19 TrojanDownloader.Agent.gat
ClamAV 0.91.2 2007.12.19 -
DrWeb 4.44.0.09170 2007.12.19 Trojan.DownLoader.38055
eSafe 7.0.15.0 2007.12.18 suspicious Trojan/Worm
eTrust-Vet 31.3.5387 2007.12.19 -
Ewido 4.0 2007.12.19 Downloader.Agent.gat
FileAdvisor 1 2007.12.19 -
Fortinet 3.14.0.0 2007.12.19 W32/Dloader.QQN!tr
F-Prot 4.4.2.54 2007.12.18 -
F-Secure 6.70.13030.0 2007.12.19 Trojan-Downloader.Win32.Agent.gat
Ikarus T3.1.1.15 2007.12.19 Trojan-Downloader.Win32.Agent.bls
Kaspersky 7.0.0.125 2007.12.19 Trojan-Downloader.Win32.Agent.gat
McAfee 5188 2007.12.18 Downloader.gen.a
Microsoft 1.3109 2007.12.19 TrojanDropper:Win32/Agent.UJ
NOD32v2 2733 2007.12.19 Win32/TrojanDownloader.Agent.BLS
Norman 5.80.02 2007.12.19 W32/DLoader.ERBV
Panda 9.0.0.4 2007.12.18 Adware/Borlander
Prevx1 V2 2007.12.19 Heuristic: Suspicious File With Outbound Communications
Rising 20.23.22.00 2007.12.19 Trojan.Win32.Undef.ael
Sophos 4.24.0 2007.12.19 Mal/HckPk-D
Sunbelt 2.2.907.0 2007.12.19 Trojan.Crypt.ULPM.Gen
Symantec 10 2007.12.19 Trojan Horse
TheHacker 6.2.9.164 2007.12.18 Trojan/Downloader.Agent.gat
VBA32 3.12.2.5 2007.12.19 Trojan.DownLoader.38055
VirusBuster 4.3.26:9 2007.12.18 -
Webwasher-Gateway 6.6.2 2007.12.19 Trojan.Crypt.ULPM.Gen
weitere Informationen
File size: 39936 bytes
MD5: ea132b3aedbef5cd918c147581242889
SHA1: b8dec1fae44e7bbd8d9f23a8bc2d632544f615e4
PEiD: -
packers: UPX
packers: UPX
packers: UPX
packers: PE_Patch.Upolyx, PE_Patch.UPX, UPX
Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=634FF2A00098D55F9C58006A64CF7100C4E4CF13


1.2) C:\WINDOWS\system32\xpudgiql.dll

Antivirus Version letzte aktualisierung Ergebnis
AhnLab-V3 2007.12.20.10 2007.12.19 Win-AppCare/Virtumonde.86080.B
AntiVir 7.6.0.45 2007.12.19 ADSPY/Virtumonde.bhu
Authentium 4.93.8 2007.12.19 -
Avast 4.7.1098.0 2007.12.18 -
AVG 7.5.0.503 2007.12.19 Lop
BitDefender 7.2 2007.12.19 Trojan.Vundo.DRQ
CAT-QuickHeal 9.00 2007.12.19 AdWare.Virtumonde.bjl (Not a Virus)
ClamAV 0.91.2 2007.12.19 Adware.Virtumonde-452
DrWeb 4.44.0.09170 2007.12.19 -
eSafe 7.0.15.0 2007.12.18 -
eTrust-Vet 31.3.5387 2007.12.19 -
Ewido 4.0 2007.12.19 -
FileAdvisor 1 2007.12.19 -
Fortinet 3.14.0.0 2007.12.19 -
F-Prot 4.4.2.54 2007.12.18 W32/Virtumonde.G.gen!Eldorado
F-Secure 6.70.13030.0 2007.12.19 -
Ikarus T3.1.1.15 2007.12.19 -
Kaspersky 7.0.0.125 2007.12.19 -
McAfee 5188 2007.12.18 -
Microsoft 1.3109 2007.12.19 -
NOD32v2 2733 2007.12.19 a variant of Win32/Adware.Virtumonde
Norman 5.80.02 2007.12.19 W32/Virtumonde.JHB
Panda 9.0.0.4 2007.12.18 Suspicious file
Prevx1 V2 2007.12.19 Lop
Rising 20.23.22.00 2007.12.19 -
Sophos 4.24.0 2007.12.19 -
Sunbelt 2.2.907.0 2007.12.19 -
Symantec 10 2007.12.19 Trojan.Vundo
TheHacker 6.2.9.164 2007.12.18 Adware/Virtumonde.big
VBA32 3.12.2.5 2007.12.19 AdWare.Win32.Virtumonde.bjl
VirusBuster 4.3.26:9 2007.12.18 Adware.Vundo.V.Gen
Webwasher-Gateway 6.6.2 2007.12.19 Ad-Spyware.Virtumonde.bhu
weitere Informationen
File size: 86080 bytes
MD5: d665c54b4f988f433442331de4eddd2c
SHA1: 515a7ef4b9447674c9378de168170f33343fcc6a
PEiD: -
Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=6952C27240E9862C50B601127F21A70033A3253C

2.0) eScan Ergebnisse

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Header
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
find.bat Version 2007.06.16.01

Microsoft Windows XP [Version 5.1.2600]
Bootmodus: NETWORK

eScan Version: 9.6.2
Sprache: English
Virus Database Date: 19.12.2007

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Infektionsmeldungen
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
System found infected with istbar Spyware/Adware (imgconv.dll)! Action taken: No Action Taken.
System found infected with istbar Spyware/Adware (imgconv.dll)! Action taken: No Action Taken.
System found infected with savenow Adware (C:\WINDOWS\system32\unrar.dll)! Action taken: No Action Taken.
System found infected with backdoor (ircbot) trojans Spyware/Adware (hkey_local_machine\software\microsoft\windows\currentversion\run/runner1)! Action taken: No Action Taken.
Object "NULLBYTE Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "grokster Spyware/Adware" found in File System! Action Taken: No Action Taken.
~~~~~~~~~~~
Dateien
~~~~~~~~~~~
~~~~ Infected files
~~~~~~~~~~~
File C:\WINDOWS\mrofinu1044.exe//PE_Patch.Upolyx//PE_Patch.UPX//UPX infected by "Trojan-Downloader.Win32.Agent.gat" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\mrofinu1044.exe//PE_Patch.Upolyx//PE_Patch.UPX//UPX infected by "Trojan-Downloader.Win32.Agent.gat" Virus! Action Taken: No Action Taken.
File C:\Temp\Temporary Internet Files\Content.IE5\8VK2T2LW\17PHolmes[1].cmt//PE_Patch.Upolyx//PE_Patch.UPX//UPX infected by "Trojan-Downloader.Win32.Agent.gat" Virus! Action Taken: No Action Taken.
File C:\Temp\Temporary Internet Files\Content.IE5\CDO5QF8X\a8f5a020e4b833865a1034489887c8b9[1].zip/b122.exe infected by "Trojan-Downloader.Win32.Agent.erf" Virus! Action Taken: No Action Taken.
File C:\Temp\TEMPOR~1\Content.IE5\8VK2T2LW\17PHolmes[1].cmt//PE_Patch.Upolyx//PE_Patch.UPX//UPX infected by "Trojan-Downloader.Win32.Agent.gat" Virus! Action Taken: No Action Taken.
File C:\Temp\TEMPOR~1\Content.IE5\CDO5QF8X\a8f5a020e4b833865a1034489887c8b9[1].zip/b122.exe infected by "Trojan-Downloader.Win32.Agent.erf" Virus! Action Taken: No Action Taken.
File C:\Dell\Drivers\R122161\HDAQFE\win2k3\jpn\qfe.exe infected by "Exe.Corrupted" Virus! Action Taken: No Action Taken.
File C:\Dell\Drivers\R122161\HDAQFE\win2k3\us\qfe.exe infected by "Exe.Corrupted" Virus! Action Taken: No Action Taken.
File C:\Dell\Drivers\R122161\HDAQFE\win2k_xp\us\qfe.exe infected by "Exe.Corrupted" Virus! Action Taken: No Action Taken.
File C:\Program Files\SigmaTel\C-Major Audio\HDAQFE\win2k3\jpn\qfe.exe infected by "Exe.Corrupted" Virus! Action Taken: No Action Taken.
File C:\Program Files\SigmaTel\C-Major Audio\HDAQFE\win2k3\us\qfe.exe infected by "Exe.Corrupted" Virus! Action Taken: No Action Taken.
File C:\Program Files\SigmaTel\C-Major Audio\HDAQFE\win2k_xp\us\qfe.exe infected by "Exe.Corrupted" Virus! Action Taken: No Action Taken.
File C:\Temp\Temporary Internet Files\Content.IE5\8VK2T2LW\17PHolmes[1].cmt//PE_Patch.Upolyx//PE_Patch.UPX//UPX infected by "Trojan-Downloader.Win32.Agent.gat" Virus! Action Taken: No Action Taken.
File C:\Temp\Temporary Internet Files\Content.IE5\CDO5QF8X\a8f5a020e4b833865a1034489887c8b9[1].zip/b122.exe infected by "Trojan-Downloader.Win32.Agent.erf" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\Drivers\D420\03_Sound_v.A06\HDAQFE\win2k3\jpn\qfe.exe infected by "Exe.Corrupted" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\Drivers\D420\03_Sound_v.A06\HDAQFE\win2k3\us\qfe.exe infected by "Exe.Corrupted" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\Drivers\D420\03_Sound_v.A06\HDAQFE\win2k_xp\us\qfe.exe infected by "Exe.Corrupted" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\Drivers\D620\03_Sound_v.A06\HDAQFE\win2k3\jpn\qfe.exe infected by "Exe.Corrupted" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\Drivers\D620\03_Sound_v.A06\HDAQFE\win2k3\us\qfe.exe infected by "Exe.Corrupted" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\Drivers\D620\03_Sound_v.A06\HDAQFE\win2k_xp\us\qfe.exe infected by "Exe.Corrupted" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\Drivers\D820\03_Sound_v.A06\HDAQFE\win2k3\jpn\qfe.exe infected by "Exe.Corrupted" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\Drivers\D820\03_Sound_v.A06\HDAQFE\win2k3\us\qfe.exe infected by "Exe.Corrupted" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\Drivers\D820\03_Sound_v.A06\HDAQFE\win2k_xp\us\qfe.exe infected by "Exe.Corrupted" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\mrofinu1044.exe//PE_Patch.Upolyx//PE_Patch.UPX//UPX infected by "Trojan-Downloader.Win32.Agent.gat" Virus! Action Taken: No Action Taken.
~~~~~~~~~~~
~~~~ Tagged files
~~~~~~~~~~~
File C:\WINDOWS\system32\jkhgdaw.dll tagged as "not-a-virus:AdWare.Win32.Virtumonde.byl". Action Taken: No Action Taken.
File C:\WINDOWS\system32\jkhgdaw.dll tagged as "not-a-virus:AdWare.Win32.Virtumonde.byl". Action Taken: No Action Taken.
File C:\WINDOWS\system32\jkhgdaw.dll tagged as "not-a-virus:AdWare.Win32.Virtumonde.byl". Action Taken: No Action Taken.
File C:\WINDOWS\system32\jkhgdaw.dll tagged as "not-a-virus:AdWare.Win32.Virtumonde.byl". Action Taken: No Action Taken.
File C:\Temp\Temporary Internet Files\Content.IE5\DFMGH21N\ggdll[1] tagged as "not-a-virus:AdWare.Win32.Virtumonde.bjl". Action Taken: No Action Taken.
File C:\Temp\TEMPOR~1\Content.IE5\DFMGH21N\ggdll[1] tagged as "not-a-virus:AdWare.Win32.Virtumonde.bjl". Action Taken: No Action Taken.
File C:\Temp\Temporary Internet Files\Content.IE5\DFMGH21N\ggdll[1] tagged as "not-a-virus:AdWare.Win32.Virtumonde.bjl". Action Taken: No Action Taken.
File C:\WINDOWS\system32\jkhgdaw.dll tagged as "not-a-virus:AdWare.Win32.Virtumonde.byl". Action Taken: No Action Taken.
File D:\USER Data\Software\Burning\Nero 6 Reloaded\Nero-6.6.1.15a.exe/Toolbar.exe tagged as "not-a-virus:AdTool.Win32.MyWebSearch.bm". Action Taken: No Action Taken.
~~~~~~~~~~~
~~~~ Offending files
~~~~~~~~~~~
Offending file found: D:\USER Data\temp\nti386\imgconv.dll
Offending file found: D:\USER Data\temp\nti386\imgconv.dll
Offending file found: C:\WINDOWS\system32\unrar.dll
~~~~~~~~~~~
Ordner
~~~~~~~~~~~
~~~~~~~~~~~
Registry
~~~~~~~~~~~
Offending Key found: HKCR\magnet !!!


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Diverses
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~
Prozesse und Module
~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~
Scanfehler
~~~~~~~~~~~~~~~~~~~~~~
C:\Temp\Temporary Internet Files\Content.IE5\UZW1AFL5\HiJackThis[1].zip not Scanned. Possibly password protected...
C:\Temp\TEMPOR~1\Content.IE5\UZW1AFL5\HiJackThis[1].zip not Scanned. Possibly password protected...
C:\Temp\Temporary Internet Files\Content.IE5\UZW1AFL5\HiJackThis[1].zip not Scanned. Possibly password protected...
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP133.tmp\mscorlib.dll not Scanned. Possibly password protected...
D:\Documents and Settings\AKs\Local Settings\Application Data\Trend Micro\HCMS\checkup\en-US\checkup.zip.tmp not Scanned. Possibly password protected...
~~~~~~~~~~~~~~~~~~~~~~
Hosts-Datei
~~~~~~~~~~~~~~~~~~~~~~
DataBasePath: %SystemRoot%\System32\drivers\etc
C:\WINDOWS\System32\drivers\etc\hosts :
C:\WINDOWS\System32\drivers\etc\hosts :192.168.184.128 nw70-j-sp9-sp.local.net
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Statistiken:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Total Critical Objects: 39
Total Disinfected Objects: 0
Total Objects Renamed: 0
Total Deleted Objects: 0
Total Errors: 60
Time Elapsed: 01:10:15
Total Objects Scanned: 119687
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan-Optionen
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Memory Check: Enabled
Registry Check: Enabled
System Folder Check: Enabled
System Area Check: Disabled
Services Check: Enabled
Drive Check: Disabled
All Drive Check :Enabled
All Drive Check :Enabled

Batchstart: 16:33:21,53
Batchende: 16:33:42,15


Sieht wohl übel aus, oder?

Beste Grüße!