TR/Vundo.Gen, TR/Crypt.ULPM.Gen, DR/Agent.BHO....

Centaurus

Hallo Leute,

ich habe ein GROßES Problem mit dem scheiss Vundo Virus...

Habe mir diese drecksau durch einen dummen fehler geholt! Bekomme ihn aber jetzt wohl nicht mehr weg. Habe schon einige sachen probiert wie, VundoFix, VirtumondeBeGone... Zurzeit läuft der AVZ gerade...

Der VBG hat einiges gefunden und behoben, dachte ich zumindest...
Hier mal das Log;

[07/01/2008, 17:09:20] - VirtumundoBeGone v1.5 ( "C:\Dokumente und Einstellungen\PC\Desktop\VirtumundoBeGone.exe" )
[07/01/2008, 17:09:29] - Detected System Information:
[07/01/2008, 17:09:29] - Windows Version: 5.1.2600, Service Pack 2
[07/01/2008, 17:09:29] - Current Username: PC (Admin)
[07/01/2008, 17:09:29] - Windows is in NORMAL mode.
[07/01/2008, 17:09:29] - Searching for Browser Helper Objects:
[07/01/2008, 17:09:29] - BHO 1: {02478D38-C3F9-4EFB-9B51-7695ECA05670} ()
[07/01/2008, 17:09:29] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/01/2008, 17:09:29] - No filename found. Continuing.
[07/01/2008, 17:09:29] - BHO 2: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader)
[07/01/2008, 17:09:29] - BHO 3: {07AA283A-43D7-4CBE-A064-32A21112D94D} (Seekmo)
[07/01/2008, 17:09:29] - BHO 4: {19C8E43B-07B3-49CB-BFFC-6777B593E6F8} (Download Manager Browser Helper Object)
[07/01/2008, 17:09:29] - BHO 5: {3049C3E9-B461-4BC5-8870-4C09146192CA} (RealPlayer Download and Record Plugin for Internet Explorer)
[07/01/2008, 17:09:29] - BHO 6: {53707962-6f74-2d53-2644-206d7942484f} (Spybot-S&D IE Protection)
[07/01/2008, 17:09:29] - BHO 7: {565e374a-23fd-4fa2-aed5-5209a37a544b} ()
[07/01/2008, 17:09:29] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/01/2008, 17:09:29] - Checking for HKLM\...\Winlogon\Notify\ssqNDVoO
[07/01/2008, 17:09:29] - Found: HKLM\...\Winlogon\Notify\ssqNDVoO - This is probably Virtumundo.
[07/01/2008, 17:09:29] - Assigning {565e374a-23fd-4fa2-aed5-5209a37a544b} MSEvents Object
[07/01/2008, 17:09:29] - BHO list has been changed! Starting over...
[07/01/2008, 17:09:29] - BHO 1: {02478D38-C3F9-4EFB-9B51-7695ECA05670} ()
[07/01/2008, 17:09:29] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/01/2008, 17:09:29] - No filename found. Continuing.
[07/01/2008, 17:09:29] - BHO 2: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader)
[07/01/2008, 17:09:29] - BHO 3: {07AA283A-43D7-4CBE-A064-32A21112D94D} (Seekmo)
[07/01/2008, 17:09:29] - BHO 4: {19C8E43B-07B3-49CB-BFFC-6777B593E6F8} (Download Manager Browser Helper Object)
[07/01/2008, 17:09:29] - BHO 5: {3049C3E9-B461-4BC5-8870-4C09146192CA} (RealPlayer Download and Record Plugin for Internet Explorer)
[07/01/2008, 17:09:29] - BHO 6: {53707962-6f74-2d53-2644-206d7942484f} (Spybot-S&D IE Protection)
[07/01/2008, 17:09:29] - BHO 7: {565e374a-23fd-4fa2-aed5-5209a37a544b} (MSEvents Object)
[07/01/2008, 17:09:29] - ALERT: Found MSEvents Object!
[07/01/2008, 17:09:29] - BHO 8: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[07/01/2008, 17:09:29] - BHO 9: {7bc9c2e2-73a6-4fcf-b73d-cbaa20b31c9b} (788877 Class)
[07/01/2008, 17:09:29] - Finished Searching Browser Helper Objects
[07/01/2008, 17:09:29] - *** Detected MSEvents Object
[07/01/2008, 17:09:29] - Trying to remove MSEvents Object...
[07/01/2008, 17:09:30] - Terminating Process: IEXPLORE.EXE
[07/01/2008, 17:09:31] - Terminating Process: RUNDLL32.EXE
[07/01/2008, 17:09:31] - Disabling Automatic Shell Restart
[07/01/2008, 17:09:31] - Terminating Process: EXPLORER.EXE
[07/01/2008, 17:09:32] - Suspending the NT Session Manager System Service
[07/01/2008, 17:09:32] - Terminating Windows NT Logon/Logoff Manager
[07/01/2008, 17:09:32] - Re-enabling Automatic Shell Restart
[07/01/2008, 17:09:32] - File to disable: C:\WINDOWS\system32\ssqNDVoO.dll
[07/01/2008, 17:09:32] - Renaming C:\WINDOWS\system32\ssqNDVoO.dll -> C:\WINDOWS\system32\ssqNDVoO.dll.vir
[07/01/2008, 17:09:33] - File successfully renamed!
[07/01/2008, 17:09:33] - Removing HKLM\...\Browser Helper Objects\{565e374a-23fd-4fa2-aed5-5209a37a544b}
[07/01/2008, 17:09:33] - Removing HKCR\CLSID\{565e374a-23fd-4fa2-aed5-5209a37a544b}
[07/01/2008, 17:09:33] - Adding Kill Bit for ActiveX for GUID: {565e374a-23fd-4fa2-aed5-5209a37a544b}
[07/01/2008, 17:09:33] - Deleting ATLEvents/MSEvents Registry entries
[07/01/2008, 17:09:33] - Removing HKLM\...\Winlogon\Notify\ssqNDVoO
[07/01/2008, 17:09:33] - Searching for Browser Helper Objects:
[07/01/2008, 17:09:33] - BHO 1: {02478D38-C3F9-4EFB-9B51-7695ECA05670} ()
[07/01/2008, 17:09:33] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/01/2008, 17:09:33] - No filename found. Continuing.
[07/01/2008, 17:09:33] - BHO 2: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader)
[07/01/2008, 17:09:33] - BHO 3: {07AA283A-43D7-4CBE-A064-32A21112D94D} (Seekmo)
[07/01/2008, 17:09:33] - BHO 4: {19C8E43B-07B3-49CB-BFFC-6777B593E6F8} (Download Manager Browser Helper Object)
[07/01/2008, 17:09:33] - BHO 5: {3049C3E9-B461-4BC5-8870-4C09146192CA} (RealPlayer Download and Record Plugin for Internet Explorer)
[07/01/2008, 17:09:33] - BHO 6: {53707962-6f74-2d53-2644-206d7942484f} (Spybot-S&D IE Protection)
[07/01/2008, 17:09:33] - BHO 7: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[07/01/2008, 17:09:33] - BHO 8: {7bc9c2e2-73a6-4fcf-b73d-cbaa20b31c9b} (788877 Class)
[07/01/2008, 17:09:33] - Finished Searching Browser Helper Objects
[07/01/2008, 17:09:33] - Finishing up...
[07/01/2008, 17:09:33] - A restart is needed.
[07/01/2008, 17:09:33] - Automatic Reboot on STOP Error is not set. User will have to manually restart.
[07/01/2008, 17:09:46] - Attempting to Restart via STOP error (Blue Screen!)


Hier nun das Log von Hijack;

Logfile of Trend Micro HijackThis v2.0.2

[edit]
Bitte editiere zukünftig deine Links, wie es dir u.a. hier angezeigt wird:
http://www.trojaner-board.de/22771-a...tml#post171958

Danke.
Sunny
[/edit]
Habe diese Online auswerten lassen und da wurde alles für gut befunden !?!

Mein Avira zeigt mir aber ständig diese sachen an und kann sie nicht löschen,
In der Datei 'C:\RECYCLER\S-1-5-21-790525478-115176313-725345543-1004\Dc1096.exe'
wurde ein Virus oder unerwünschtes Programm 'DR/Agent.BHO.I' [dropper] gefunden.
In der Datei 'C:\Programme\Mozilla Firefox\keygen.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Crypt.XPACK.Gen' [trojan] gefunden.
Ausgeführte Aktion: Datei löschen
In der Datei 'C:\System Volume Information\_restore{BFA5BFEA-146E-47FA-A66C-71ED334CB143}\RP514\A0078876.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Crypt.ULPM.Gen' [trojan] gefunden.
Ausgeführte Aktion: Datei löschen
In der Datei 'C:\WINDOWS\system32\ssqNDVoO.dll.vir'
wurde ein Virus oder unerwünschtes Programm 'TR/Vundo.Gen' [trojan] gefunden.
Ausgeführte Aktion: Datei löschen



Vundofix findet bei mir nichts mehr aber die sachen sind eindeutig noch da!

Was soll ich denn jetzt nur machen, VERDAMMT ?!?

Muss ich Neuaufsetzten???

Ich bitte um schnelle HILFE!!!