LAN IRCbot-verseucht? (PC 2)

diverslung

Hi allerseits,

ich habe ein LAN aus 3 PCs und musste dieses - d.h. jeden der drei PCs - aus gegebenem Anlass heute mal auf Viren etc. scannen.
Dabei hat mir escan einige Ergebnisse ausgespuckt, die ich angesichts meiner sonstigen Schutzmaßnahmen nicht einordnen kann.
Ich habe jeden der drei PCs einmal mit escan gescannt, einmal mit HijackThis und einmal mit avira Premium Security Suite.
Alle drei Hijackthis-Logs haben bei der Online-Prüfung keine Infizierung angezeigt. Auch Avira findet keine Viren.
Dennoch schlägt escan Alarm. Daher wollte ich Euch um Mithilfe bitten. Da es sich um 3 PCs handelt mache ich drei verschiedene Threads auf.

In diesem Thread geht es also um PC 2 - ich poste hier mal a) die Escan-Ergebnisse und b) das Hijack-LOG.

a) die Escan-Ergebnisse:

Sun Jan 27 18:48:13 2008 => System found infected with purityscan Spyware/Adware (usbmonit.exe)! Action taken: No Action Taken.
Sun Jan 27 18:48:18 2008 => System found infected with backdoor (ircbot) trojans Spyware/Adware (hkey_current_user\software\microsoft\windows\currentversion\policies\explorer/norun)! Action taken: No Action Taken.
Sun Jan 27 18:48:23 2008 => System found infected with savenow Adware (C:\WINDOWS\SYSTEM\unrar.dll)! Action taken: No Action Taken.
Sun Jan 27 18:48:25 2008 => System found infected with regsort Corrupted Adware/Spyware (hkey_local_machine\software\microsoft\windows\currentversion\explorer\alwaysunloaddll)! Action taken: No Action Taken.
Sun Jan 27 18:48:25 2008 => System found infected with backdoor (ircbot) trojans Spyware/Adware (hkey_current_user\software\microsoft\windows\currentversion\policies\system/nodispcpl)! Action taken: No Action Taken.
Sun Jan 27 18:48:26 2008 => System found infected with savenow Adware (C:\WINDOWS\SYSTEM\ccrpftv6.ocx)! Action taken: No Action Taken.
Sun Jan 27 18:48:27 2008 => System found infected with backdoor (ircbot) trojans Spyware/Adware (hkey_current_user\software\microsoft\windows\currentversion\policies\explorer/noviewcontextmenu)! Action taken: No Action Taken.
Sun Jan 27 18:48:37 2008 => System found infected with backdoor (ircbot) trojans Spyware/Adware (hkey_current_user\software\microsoft\windows\currentversion\policies\system/noadminpage)! Action taken: No Action Taken.
Sun Jan 27 18:48:37 2008 => System found infected with backdoor (ircbot) trojans Spyware/Adware (hkey_current_user\software\microsoft\windows\currentversion\policies\system/nodispscrsavpage)! Action taken: No Action Taken.
Sun Jan 27 18:48:37 2008 => System found infected with backdoor (ircbot) trojans Spyware/Adware (hkey_current_user\software\microsoft\windows\currentversion\policies\system/nodispbackgroundpage)! Action taken: No Action Taken.
Sun Jan 27 18:48:37 2008 => System found infected with backdoor (ircbot) trojans Spyware/Adware (hkey_current_user\software\microsoft\windows\currentversion\policies\system/nodispsettingspage)! Action taken: No Action Taken.
Sun Jan 27 18:48:37 2008 => System found infected with backdoor (ircbot) trojans Spyware/Adware (hkey_current_user\software\microsoft\windows\currentversion\policies\explorer/noclose)! Action taken: No Action Taken.
Sun Jan 27 18:48:39 2008 => System found infected with backdoor (ircbot) trojans Spyware/Adware (hkey_current_user\software\microsoft\windows\currentversion\policies\explorer/nofind)! Action taken: No Action Taken.
Sun Jan 27 18:48:41 2008 => System found infected with backdoor (ircbot) trojans Spyware/Adware (hkey_users\.default\software\microsoft\internet explorer\main/display inline videos)! Action taken: No Action Taken.
Sun Jan 27 18:48:41 2008 => System found infected with backdoor (ircbot) trojans Spyware/Adware (hkey_users\.default\software\microsoft\windows\currentversion\policies\explorer//nofolderoptions)! Action taken: No Action Taken.
Sun Jan 27 18:48:41 2008 => System found infected with backdoor (ircbot) trojans Spyware/Adware (hkey_current_user\software\microsoft\windows\currentversion\policies\explorer/nowinkeys)! Action taken: No Action Taken.
Sun Jan 27 18:48:41 2008 => System found infected with backdoor (ircbot) trojans Spyware/Adware (hkey_current_user\software\microsoft\windows\currentversion\policies\explorer/nosavesettings)! Action taken: No Action Taken.
Sun Jan 27 18:48:41 2008 => System found infected with backdoor (ircbot) trojans Spyware/Adware (hkey_current_user\software\microsoft\windows\currentversion\policies\explorer/noactivedesktopchanges)! Action taken: No Action Taken.
Sun Jan 27 18:48:41 2008 => System found infected with backdoor (ircbot) trojans Spyware/Adware (hkey_current_user\software\microsoft\windows\currentversion\policies\activedesktop/nocomponents)! Action taken: No Action Taken.
Sun Jan 27 18:48:41 2008 => System found infected with backdoor (ircbot) trojans Spyware/Adware (hkey_current_user\software\microsoft\windows\currentversion\policies\activedesktop/noeditingcomponents)! Action taken: No Action Taken.
Sun Jan 27 18:48:41 2008 => System found infected with backdoor (ircbot) trojans Spyware/Adware (hkey_current_user\software\microsoft\windows\currentversion\policies\activedesktop/nodeletingcomponents)! Action taken: No Action Taken.
Sun Jan 27 18:48:41 2008 => System found infected with backdoor (ircbot) trojans Spyware/Adware (hkey_current_user\software\microsoft\windows\currentversion\policies\activedesktop/noaddingcomponents)! Action taken: No Action Taken.
Sun Jan 27 18:48:41 2008 => System found infected with backdoor (ircbot) trojans Spyware/Adware (hkey_current_user\software\microsoft\windows\currentversion\policies\explorer/noactivedesktop)! Action taken: No Action Taken.
Sun Jan 27 18:48:41 2008 => System found infected with backdoor (ircbot) trojans Spyware/Adware (hkey_current_user\software\microsoft\windows\currentversion\policies\explorer/nosetactivedesktop)! Action taken: No Action Taken.

b) das Hijack-LOG:

Logfile of HijackThis v1.99.1
Scan saved at 20:45:46, on 27.01.08
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\Windows\SYSTEM\KB891711\KB891711.EXE
C:\WINDOWS\SYSTEM\ATI2EVXX.EXE
C:\PROGRAMME\GEMEINSAME DATEIEN\EPSON\EEBAPI\SAGENT4.EXE
C:\WINDOWS\SYSTEM\KB918547\KB918547.EXE
C:\PROGRAMME\SICHERHEIT\PC-CILLIN 9\PCCIOMON.EXE
C:\PROGRAMME\SICHERHEIT\PC-CILLIN 9\PCCPFW.EXE
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAMME\ZUBEHöR\INCD\INCD\INCD.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAMME\TREIBER\MAUS\SYSTEM\EM_EXEC.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SYSTEM\USBMONIT.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAMME\SICHERHEIT\PC-CILLIN 9\PCCGUIDE.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\PROGRAMME\SICHERHEIT\PC-CILLIN 9\PCCCLIENT.EXE
C:\PROGRAMME\SICHERHEIT\PC-CILLIN 9\POP3TRAP.EXE
C:\WINDOWS\RunDLL.exe
E:\ZUBEHOER\UHRERWEITERUNG\TCLOCK.EXE
E:\ZUBEHOER\LAN MONITOR\TRAFFICDETECTOR\TRAFFICDETECTOR3\TRAFFICDETECTORV3.EXE
E:\ZUBEHOER\TRANSPARENTICONTEXTS\TRANSPARENTW.EXE
C:\PROGRAMME\OKIDATA\OKI LPR-DIENSTPROGRAMM\OKILPR.EXE
E:\ZUBEHOER\LAN MONITOR\TRAFFICDETECTOR\TRAFFICDETECTOR3\CATCHER_.EXE
C:\PROGRAMME\REMOTE CONTROL PRO\RCPSERVER.EXE
E:\ZUBEHOER\LAN MONITOR\TRAFFICDETECTOR\TRAFFICDETECTOR3\TD_CATCHER_SN2.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
E:\ZUBEHOER\LAN MONITOR\TRAFFICDETECTOR\TRAFFICDETECTOR3\SPEEDMINIFENSTER.EXE
E:\ZUBEHOER\LAN MONITOR\TRAFFICDETECTOR\TRAFFICDETECTOR3\MINIFENSTER.EXE
C:\PROGRAMME\SICHERHEIT\PC-CILLIN 9\WEBTRAP.EXE
E:\ZUBEHOER\ESCAN\MWAVSCAN.COM
E:\ZUBEHOER\ESCAN\KAVSS.EXE
E:\ZUBEHOER\HIJACKTHIS\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
N1 - Netscape 4: user_pref("browser.startup.homepage", "_blank"); (E:\Internet\Netscape478\Users\default\prefs.js)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: ClickCatcher MSIE handler - {16664845-0E00-11D2-8059-000000000000} - C:\PROGRAMME\GEMEINSAME DATEIEN\REGET SHARED\CATCHER.DLL
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - E:\ZUBEHOER\SPYWAR~1\TOOLS\IESDPB.DLL
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - E:\ZUBEHOER\SPYWAR~1\TOOLS\IESDSG.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar1.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\ZUBEHOER\ACROBAT READER\READER\ACTIVEX\ACROIEHELPER.DLL
O3 - Toolbar: ReGet Bar - {17939A30-18E2-471E-9D3A-56DD725F1215} - E:\INTERNET\REGET DELUXE\IEBAR.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ScanRegistry] C:\Windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [InCD] C:\Programme\Zubehör\InCD\InCD\InCD.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\TREIBER\MAUS\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [CriticalUpdate] C:\Windows\SYSTEM\wucrtupd.exe -startup
O4 - HKLM\..\Run: [EPSON Stylus Photo R240 Series] C:\WINDOWS\SYSTEM\E_S6I0H1.EXE /P30 "EPSON Stylus Photo R240 Series" /O24 "\\MULTIPLIKATER\EPStylus" /M "Stylus Photo R240"
O4 - HKLM\..\Run: [Gene USB Monitor] C:\Windows\SYSTEM\USBMonit.exe
O4 - HKLM\..\Run: [pccguide.exe] "C:\Programme\Sicherheit\PC-cillin 9\pccguide.exe"
O4 - HKLM\..\Run: [PCCIOMON.exe] "C:\Programme\Sicherheit\PC-cillin 9\PCCIOMON.exe"
O4 - HKLM\..\Run: [PCCClient.exe] "C:\Programme\Sicherheit\PC-cillin 9\PCCClient.exe"
O4 - HKLM\..\Run: [Pop3trap.exe] "C:\Programme\Sicherheit\PC-cillin 9\Pop3trap.exe"
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [KB891711] C:\Windows\SYSTEM\KB891711\KB891711.EXE
O4 - HKLM\..\RunServices: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakLogon
O4 - HKLM\..\RunServices: [ATIPOLAB] ati2evxx.exe
O4 - HKLM\..\RunServices: [Path] C:\Programme\Gemeinsame Dateien\EPSON\eEBAPI\SAgent4.exe
O4 - HKLM\..\RunServices: [KB918547] C:\WINDOWS\SYSTEM\KB918547\KB918547.EXE
O4 - HKLM\..\RunServices: [PCCIOMON.exe] "C:\Programme\Sicherheit\PC-cillin 9\PCCIOMON.exe"
O4 - HKLM\..\RunServices: [PCCPFW] C:\Programme\Sicherheit\PC-cillin 9\PCCPFW.exe
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O4 - Startup: tclock.exe.lnk = E:\Zubehoer\Uhrerweiterung\tclock.exe
O4 - Startup: Trafficdetector.lnk = E:\Zubehoer\LAN Monitor\TrafficDetector\Trafficdetector3\TrafficdetectorV3.exe
O4 - Startup: Transparent.lnk = E:\Zubehoer\TransparentIconTexts\TransparentW.exe
O4 - Startup: OKI LPR-Dienstprogramm.lnk = C:\Programme\Okidata\OKI LPR-Dienstprogramm\Okilpr.exe
O4 - Startup: ClearProg.lnk = E:\Zubehoer\Clearprog\ClearProg.exe
O4 - Startup: RCPServer.lnk = C:\Programme\Remote Control Pro\RCPServer.exe
O4 - Startup: Lan.FS Version 2.lnk = E:\Zubehoer\LAN-FS\Lan.FS2\Lan-fs.exe
O4 - User Startup: tclock.exe.lnk = E:\Zubehoer\Uhrerweiterung\tclock.exe
O4 - User Startup: Trafficdetector.lnk = E:\Zubehoer\LAN Monitor\TrafficDetector\Trafficdetector3\TrafficdetectorV3.exe
O4 - User Startup: Transparent.lnk = E:\Zubehoer\TransparentIconTexts\TransparentW.exe
O4 - User Startup: OKI LPR-Dienstprogramm.lnk = C:\Programme\Okidata\OKI LPR-Dienstprogramm\Okilpr.exe
O4 - User Startup: ClearProg.lnk = E:\Zubehoer\Clearprog\ClearProg.exe
O4 - User Startup: RCPServer.lnk = C:\Programme\Remote Control Pro\RCPServer.exe
O4 - User Startup: Lan.FS Version 2.lnk = E:\Zubehoer\LAN-FS\Lan.FS2\Lan-fs.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: A&lles mit ReGet Deluxe herunterladen - C:\PROGRAMME\GEMEINSAME DATEIEN\REGET SHARED\CC_All.htm
O8 - Extra context menu item: Herunterladen mit Re&Get Deluxe - C:\PROGRAMME\GEMEINSAME DATEIEN\REGET SHARED\CC_Link.htm
O8 - Extra context menu item: &Google-Suche - res://C:\PROGRAMME\GOOGLE\GOOGLETOOLBAR1.DLL/cmsearch.html
O8 - Extra context menu item: &Ins Deutsche übersetzen - res://C:\PROGRAMME\GOOGLE\GOOGLETOOLBAR1.DLL/cmwordtrans.html
O8 - Extra context menu item: Im Cache gespeicherte Seite - res://C:\PROGRAMME\GOOGLE\GOOGLETOOLBAR1.DLL/cmcache.html
O8 - Extra context menu item: Ähnliche Seiten - res://C:\PROGRAMME\GOOGLE\GOOGLETOOLBAR1.DLL/cmsimilar.html
O8 - Extra context menu item: Verweisseiten - res://C:\PROGRAMME\GOOGLE\GOOGLETOOLBAR1.DLL/cmbacklinks.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRAMME\JAVA\JRE1.5.0_06\BIN\SSV.DLL
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRAMME\JAVA\JRE1.5.0_06\BIN\SSV.DLL
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - E:\ZUBEHOER\SPYWAR~1\TOOLS\IESDPB.DLL
O12 - Plugin for .pdf: C:\PROGRA~1\INTERN~1\PLUGINS\nppdf32.dll
O15 - Trusted Zone: h**p://w*w.adobe.com
O15 - Trusted Zone: h**p://sdc.shockwave.com
O15 - Trusted Zone: h**p://fpdownload.macromedia.com
O15 - Trusted Zone: h**p://w*w.macromedia.com
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = hansenet.de
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 213.191.74.18


Danke!