Trojanerbefall: werde Vundo und Monder nicht los

maddox · 16.12.2008, 23:58

Also hier noch mal Anti-Malware bei deaktiviertem Virenwächter:

Code:

ATTFilter

Malwarebytes' Anti-Malware 1.31
Datenbank Version: 1508
Windows 5.1.2600 Service Pack 2

16.12.2008 23:50:11
mbam-log-2008-12-16 (23-50-11).txt

Scan-Methode: Vollständiger Scan (C:\|D:\|)
Durchsuchte Objekte: 122840
Laufzeit: 37 minute(s), 1 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 4

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\WINDOWS\system32\pjijgxbf.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\fbxgjijp.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\XXX\Lokale Einstellungen\Temp\cbXPiFYo.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\XXX\Lokale Einstellungen\Temporary Internet Files\Content.IE5\OLYNO5AB\zc113432[1] (Trojan.Vundo.H) -> Quarantined and deleted successfully.

Probier als nächstes die mbr-Geschichte im abgesicherten Modus.

maddox · 17.12.2008, 00:01

Hallo john.doe, hier noch der BlackLight-logfile:

Code:

ATTFilter

12/16/08 23:01:01 [Info]: BlackLight Engine 2.2.1092 initialized
12/16/08 23:01:01 [Info]: OS: 5.1 build 2600 (Service Pack 2)
12/16/08 23:01:01 [Note]: 7019 4
12/16/08 23:01:01 [Note]: 7005 0
12/16/08 23:01:06 [Note]: 7006 0
12/16/08 23:01:06 [Note]: 7011 1264
12/16/08 23:01:07 [Note]: 7035 0
12/16/08 23:01:07 [Note]: 7026 0
12/16/08 23:01:07 [Note]: 7026 0
12/16/08 23:01:08 [Note]: FSRAW library version 1.7.1024
12/16/08 23:09:34 [Note]: 7007 0

Gruß, maddox

maddox · 17.12.2008, 00:11

Hier nun das mbr.log aus dem abgesicherten Modus:

Code:

ATTFilter

Stealth MBR rootkit detector 0.2.4 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK

maddox · 17.12.2008, 00:20

Und hier kommt das Silentrunner-log:

Code:

ATTFilter

"Silent Runners.vbs", revision 59, h**p://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS]
"MSMSGS" = ""C:\Programme\Messenger\msmsgs.exe" /background" [MS]
"AnyDVD" = "C:\Programme\SlySoft\AnyDVD\AnyDVDtray.exe" ["SlySoft, Inc."]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"HControl" = "C:\WINDOWS\ATK0100\HControl.exe" [empty string]
"RTHDCPL" = "RTHDCPL.EXE" ["Realtek Semiconductor Corp."]
"Alcmtr" = "ALCMTR.EXE" ["Realtek Semiconductor Corp."]
"ASUS Live Update" = "C:\Programme\ASUS\ASUS Live Update\ALU.exe" [empty string]
"NB Probe" = "(empty string)" [file not found]
"Wireless Console" = "C:\Programme\ASUS\Wireless Console\wcourier.exe" [empty string]
"SynTPLpr" = "C:\Programme\Synaptics\SynTP\SynTPLpr.exe" ["Synaptics, Inc."]
"SynTPEnh" = "C:\Programme\Synaptics\SynTP\SynTPEnh.exe" ["Synaptics, Inc."]
"IntelZeroConfig" = "C:\Programme\Intel\Wireless\bin\ZCfgSvc.exe" ["Intel Corporation"]
"(Default)" = "(empty string)" [file not found]
"IntelWireless" = "C:\Programme\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless" ["Intel Corporation"]
"EOUApp" = "C:\Programme\Intel\Wireless\Bin\EOUWiz.exe" ["Intel Corporation"]
"avgnt" = ""C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min" ["Avira GmbH"]
"NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"]
"SunJavaUpdateSched" = ""C:\Programme\Java\jre1.6.0_05\bin\jusched.exe"" ["Sun Microsystems, Inc."]
"RemoteControl" = "C:\Programme\CyberLink\PowerDVD\PDVDServ.exe" ["Cyberlink Corp."]
"TotalRecorderScheduler" = ""C:\Programme\HighCriteria\TotalRecorder\TotRecSched.exe"" ["High Criteria inc."]
"QuickTime Task" = ""C:\Programme\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."]
"KernelFaultCheck" = "C:\WINDOWS\system32\dumprep 0 -k"
"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS]
"nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]
"Power_Gear" = "C:\Programme\ASUS\Power4 Gear\BatteryLife.exe 1" ["ASUSTeK Computer Inc."]
"Adobe Reader Speed Launcher" = ""C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe"" ["Adobe Systems Incorporated"]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)
  -> {HKLM...CLSID} = "Adobe PDF Reader"
                   \InProcServer32\(Default) = "C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)
  -> {HKLM...CLSID} = "SSVHelper Class"
                   \InProcServer32\(Default) = "C:\Programme\Java\jre1.6.0_05\bin\ssv.dll" ["Sun Microsystems, Inc."]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "CPL-Erweiterung für Anzeigeverschiebung"
  -> {HKLM...CLSID} = "CPL-Erweiterung für Anzeigeverschiebung"
                   \InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Erweiterung für HyperTerminal-Icons"
  -> {HKLM...CLSID} = "HyperTerminal Icon Ext"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]
"{2F603045-309F-11CF-9774-0020AFD0CFF6}" = "Synaptics Control Panel"
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = "C:\Programme\Synaptics\SynTP\SynTPCpl.dll" ["Synaptics, Inc."]
"{45AC2688-0253-4ED8-97DE-B5370FA7D48A}" = "Shell Extension for Malware scanning"
  -> {HKLM...CLSID} = "Shell Extension for Malware scanning"
                   \InProcServer32\(Default) = "C:\Programme\AntiVir PersonalEdition Classic\shlext.dll" ["Avira GmbH"]
"{59850401-6664-101B-B21C-00AA004BA90B}" = "Microsoft Office Binder Unbind"
  -> {HKLM...CLSID} = "Microsoft Office Binder Unbind"
                   \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office\1031\UNBIND.DLL" [MS]
"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler"
  -> {HKLM...CLSID} = "Outlook-Dateisymbolerweiterung"
                   \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office\OLKFSTUB.DLL" [MS]
"{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" = "OpenOffice.org Column Handler"
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = ""C:\Programme\OpenOffice.org 2.0\program\shlxthdl.dll"" ["Sun Microsystems, Inc."]
"{087B3AE3-E237-4467-B8DB-5A38AB959AC9}" = "OpenOffice.org Infotip Handler"
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = ""C:\Programme\OpenOffice.org 2.0\program\shlxthdl.dll"" ["Sun Microsystems, Inc."]
"{63542C48-9552-494A-84F7-73AA6A7C99C1}" = "OpenOffice.org Property Sheet Handler"
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = ""C:\Programme\OpenOffice.org 2.0\program\shlxthdl.dll"" ["Sun Microsystems, Inc."]
"{3B092F0C-7696-40E3-A80F-68D74DA84210}" = "OpenOffice.org Thumbnail Viewer"
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = ""C:\Programme\OpenOffice.org 2.0\program\shlxthdl.dll"" ["Sun Microsystems, Inc."]
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"
  -> {HKLM...CLSID} = "Portable Media Devices Menu"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
"{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"
  -> {HKLM...CLSID} = "DesktopContext Class"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper"
  -> {HKLM...CLSID} = "NVIDIA CPL Extension"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"
  -> {HKLM...CLSID} = "Desktop Explorer"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"
  -> {HKLM...CLSID} = "nView Desktop Context Menu"
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1530F7EE-5128-43BD-9977-84A4B0FAD7DF}" = "PhotoToys"
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = "C:\WINDOWS\system32\phototoys.dll" [MS]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
  -> {HKLM...CLSID} = "WinRAR"
                   \InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data]

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
<<!>> IntelWireless\DLLName = "C:\Programme\Intel\Wireless\Bin\LgNotify.dll" ["Intel Corporation"]

HKLM\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}\(Default) = "OpenOffice.org Column Handler"
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = ""C:\Programme\OpenOffice.org 2.0\program\shlxthdl.dll"" ["Sun Microsystems, Inc."]
{F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info"
  -> {HKLM...CLSID} = "PDF Shell Extension"
                   \InProcServer32\(Default) = "C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."]

HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\
Shell Extension for Malware scanning\(Default) = "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}"
  -> {HKLM...CLSID} = "Shell Extension for Malware scanning"
                   \InProcServer32\(Default) = "C:\Programme\AntiVir PersonalEdition Classic\shlext.dll" ["Avira GmbH"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
  -> {HKLM...CLSID} = "WinRAR"
                   \InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data]

HKLM\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
  -> {HKLM...CLSID} = "WinRAR"
                   \InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data]

HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\
MBAMShlExt\(Default) = "{57CE581A-0CB6-4266-9CA0-19364C90A0B3}"
  -> {HKLM...CLSID} = "MBAMShlExt Class"
                   \InProcServer32\(Default) = "C:\Programme\Malwarebytes' Anti-Malware\mbamext.dll" ["Malwarebytes Corporation"]
Shell Extension for Malware scanning\(Default) = "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}"
  -> {HKLM...CLSID} = "Shell Extension for Malware scanning"
                   \InProcServer32\(Default) = "C:\Programme\AntiVir PersonalEdition Classic\shlext.dll" ["Avira GmbH"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
  -> {HKLM...CLSID} = "WinRAR"
                   \InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data]

HKLM\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\
MBAMShlExt\(Default) = "{57CE581A-0CB6-4266-9CA0-19364C90A0B3}"
  -> {HKLM...CLSID} = "MBAMShlExt Class"
                   \InProcServer32\(Default) = "C:\Programme\Malwarebytes' Anti-Malware\mbamext.dll" ["Malwarebytes Corporation"]


Group Policies {policy setting}:
--------------------------------

Note: detected settings may not have any effect.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\

"shutdownwithoutlogon" = (REG_DWORD) dword:0x00000001
{Shutdown: Allow system to be shut down without having to log on}

"undockwithoutlogon" = (REG_DWORD) dword:0x00000001
{Devices: Allow undock without having to log on}


Active Desktop and Wallpaper:
-----------------------------

Active Desktop may be disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

Displayed if Active Desktop enabled and wallpaper not set by Group Policy:
HKCU\Software\Microsoft\Internet Explorer\Desktop\General\
"Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp"

Displayed if Active Desktop disabled and wallpaper not set by Group Policy:
HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Dokumente und Einstellungen\Admin\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp"


Enabled Screen Saver:
---------------------

HKCU\Control Panel\Desktop\
"SCRNSAVE.EXE" = "C:\WINDOWS\system32\logon.scr" [MS]


Windows Portable Device AutoPlay Handlers
-----------------------------------------

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\

CanonCW50PicturesOnArrival\
"Provider" = "Canon CameraWindow"
"InvokeProgID" = "Cw50.AutoplayHandler"
"InvokeVerb" = "open"
HKLM\SOFTWARE\Classes\Cw50.AutoplayHandler\shell\open\command\(Default) = "C:\Programme\Canon\CameraWindow\CameraWindowMC\CameraLauncher.exe" [file not found]

CanonZB4PicturesOnArrival\
"Provider" = "Canon ZoomBrowser EX"
"InvokeProgID" = "Zb.AutoplayHandler"
"InvokeVerb" = "open"
HKLM\SOFTWARE\Classes\Zb.AutoplayHandler\shell\open\command\(Default) = "C:\Programme\Canon\ZoomBrowser EX MCU\MCULauncher.exe" [null data]

DVDDecrypterPlayDVDMovieOnArrival\
"Provider" = "DVD Decrypter"
"InvokeProgID" = "DVDDecrypter"
"InvokeVerb" = "PlayDVDMovieOnArrival_Decrypt"
HKLM\SOFTWARE\Classes\DVDDecrypter\shell\PlayDVDMovieOnArrival_Decrypt\Command\(Default) = ""C:\Programme\DVD Decrypter\DVDDecrypter.exe" /MODE READ /SOURCE "%1"" ["LIGHTNING UK!"]

NeroAutoPlay2CDAudio\
"Provider" = "Nero Express"
"InvokeProgID" = "Nero.AutoPlay2"
"InvokeVerb" = "HandleCDBurningOnArrival_CDAudio"
HKLM\SOFTWARE\Classes\Nero.AutoPlay2\shell\HandleCDBurningOnArrival_CDAudio\command\(Default) = "C:\Programme\Ahead\nero\nero.exe /w /New:AudioCD /Drive:%L" ["Ahead Software AG"]

NeroAutoPlay2CopyCD\
"Provider" = "Nero Express"
"InvokeProgID" = "Nero.AutoPlay2"
"InvokeVerb" = "PlayCDAudioOnArrival_CopyCD"
HKLM\SOFTWARE\Classes\Nero.AutoPlay2\shell\PlayCDAudioOnArrival_CopyCD\command\(Default) = "C:\Programme\Ahead\nero\nero.exe /w /Dialog:DiscCopy /Drive:%L" ["Ahead Software AG"]

NeroAutoPlay2DataDisc\
"Provider" = "Nero Express"
"InvokeProgID" = "Nero.AutoPlay2"
"InvokeVerb" = "HandleCDBurningOnArrival_DataDisc"
HKLM\SOFTWARE\Classes\Nero.AutoPlay2\shell\HandleCDBurningOnArrival_DataDisc\command\(Default) = "C:\Programme\Ahead\nero\nero.exe /w /New:ISODisc /Drive:%L" ["Ahead Software AG"]

NeroAutoPlay2LaunchNeroStartSmart\
"Provider" = "Nero StartSmart"
"InvokeProgID" = "Nero.AutoPlay2"
"InvokeVerb" = "HandleCDBurningOnArrival_LaunchNeroStartSmart"
HKLM\SOFTWARE\Classes\Nero.AutoPlay2\shell\HandleCDBurningOnArrival_LaunchNeroStartSmart\command\(Default) = "C:\Programme\Ahead\Nero StartSmart\NeroStartSmart.exe /AutoPlay /Drive:%L" ["Ahead Software AG"]

NeroAutoPlay2PlayAudioCD\
"Provider" = "Nero Media Player"
"InvokeProgID" = "Nero.AutoPlay2"
"InvokeVerb" = "PlayMusicFilesOnArrival_PlayAudioCD"
HKLM\SOFTWARE\Classes\Nero.AutoPlay2\shell\PlayMusicFilesOnArrival_PlayAudioCD\command\(Default) = "C:\Programme\Ahead\NeroMediaPlayer\NeroMediaPlayer.exe /Play %L" ["Ahead software"]

NeroAutoPlay2VideoCapture\
"Provider" = "NeroVision Express SE"
"ProgID" = "Shell.HWEventHandlerShellExecute"
"InitCmdLine" = ""C:\Programme\Ahead\NeroVision\NeroVision.exe" /New:VideoCapture"
HKLM\SOFTWARE\Classes\Shell.HWEventHandlerShellExecute\CLSID\(Default) = "{FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}"
  -> {HKLM...CLSID} = "ShellExecute HW Event Handler"
                   \LocalServer32\(Default) = "rundll32.exe shell32.dll,SHCreateLocalServerRunDll {FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}" [MS]

NeroAutoPlay2ViewPhotos\
"Provider" = "Nero PhotoSnap Viewer"
"InvokeProgID" = "Nero.AutoPlay2"
"InvokeVerb" = "ShowPicturesOnArrival_ViewPhotos"
HKLM\SOFTWARE\Classes\Nero.AutoPlay2\shell\ShowPicturesOnArrival_ViewPhotos\command\(Default) = "C:\Programme\Ahead\Nero PhotoSnap\PhotoSnapViewer.exe  /Drive:%L" ["Ahead Software AG"]

PDVDPlayDVDMovieOnArrival\
"Provider" = "PowerDVD"
"InvokeProgID" = "DVD"
"InvokeVerb" = "PlayWithPowerDVD"
HKLM\SOFTWARE\Classes\DVD\shell\PlayWithPowerDVD\Command\(Default) = ""C:\Programme\CyberLink\PowerDVD\PowerDVD.exe" "%l"" ["CyberLink Corp."]

VLCPlayCDAudioOnArrival\
"Provider" = "VideoLAN VLC media player"
"InvokeProgID" = "VLC.CDAudio"
"InvokeVerb" = "play"
HKLM\SOFTWARE\Classes\VLC.CDAudio\shell\play\command\(Default) = "C:\Programme\VideoLAN\VLC\vlc.exe --one-instance-when-started-from-file cdda:%1" ["VideoLAN Team"]

VLCPlayDVDMovieOnArrival\
"Provider" = "VideoLAN VLC media player"
"InvokeProgID" = "VLC.DVDMovie"
"InvokeVerb" = "play"
HKLM\SOFTWARE\Classes\VLC.DVDMovie\shell\play\command\(Default) = "C:\Programme\VideoLAN\VLC\vlc.exe --one-instance-when-started-from-file dvd:%1" ["VideoLAN Team"]


Startup items in "Admin" & "All Users" startup folders:
-------------------------------------------------------

C:\Dokumente und Einstellungen\Admin\Startmenü\Programme\Autostart
"Picture Motion Browser Medien-Prüfung" -> shortcut to: "C:\Programme\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe /nobaloononstart" ["Sony Corporation"]

C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart
"Microsoft Office" -> shortcut to: "C:\Programme\Microsoft Office 2000\Office\OSA9.EXE -b -l" [MS]
"Symantec Fax Starter Edition-Anschluss" -> shortcut to: "C:\Programme\Microsoft Office 2000\Office\1031\OLFSNT40.EXE" [MS]


Enabled Scheduled Tasks:
------------------------

"Low Battery Alarm Program" -> WARNING -- The file "Low Battery Alarm Program.job" is corrupt! (no executable)
"iczxfdbx" -> launches: "C:\WINDOWS\system32\rundll32.exe "C:\DOKUME~1\XXX\LOKALE~1\Temp\jkkJYsTJ.dll",d" [MS]


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 04, 07 - 28
%SystemRoot%\system32\rsvpsp.dll [MS], 05 - 06


Toolbars, Explorer Bars, Extensions:
------------------------------------

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Konsole"
"CLSIDExtension" = "{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC}"
  -> {HKCU...CLSID} = "Java Plug-in 1.6.0_05"
                   \InProcServer32\(Default) = "C:\Programme\Java\jre1.6.0_05\bin\ssv.dll" ["Sun Microsystems, Inc."]
  -> {HKLM...CLSID} = "Java Plug-in 1.6.0_05"
                   \InProcServer32\(Default) = "C:\Programme\Java\jre1.6.0_05\bin\npjpi160_05.dll" ["Sun Microsystems, Inc."]

{E2E2DD38-D088-4134-82B7-F2BA38496583}\
"MenuText" = "@xpsp3res.dll,-20001"
"Exec" = "%windir%\Network Diagnostic\xpnetdiag.exe" [MS]

{FB5F1910-F110-11D2-BB9E-00C04F795683}\
"ButtonText" = "Messenger"
"MenuText" = "Windows Messenger"
"Exec" = "C:\Programme\Messenger\msmsgs.exe" [MS]


Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

AntiVir PersonalEdition Classic Service, AntiVirService, "C:\Programme\AntiVir PersonalEdition Classic\avguard.exe" ["Avira GmbH"]
AntiVir Scheduler, AntiVirScheduler, "C:\Programme\AntiVir PersonalEdition Classic\sched.exe" ["Avira GmbH"]
ATK Keyboard Service, ATKKeyboardService, "C:\WINDOWS\ATKKBService.exe" ["ASUSTeK COMPUTER INC."]
AVM IGD CTRL Service, AVM IGD CTRL Service, "C:\Programme\FRITZ!DSL\IGDCTRL.EXE" ["AVM Berlin"]
Canon Camera Access Library 8, CCALib8, "C:\Programme\Canon\CAL\CALMAIN.exe" ["Canon Inc."]
EvtEng, EvtEng, "C:\Programme\Intel\Wireless\Bin\EvtEng.exe" ["Intel Corporation"]
NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"]
OwnershipProtocol, OwnershipProtocol, "C:\Programme\Intel\Wireless\Bin\OProtSvc.exe" ["Intel Corporation"]
RegSrvc, RegSrvc, "C:\Programme\Intel\Wireless\Bin\RegSrvc.exe" ["Intel Corporation"]
Spectrum24 Event Monitor, S24EventMonitor, "C:\Programme\Intel\Wireless\Bin\S24EvMon.exe" ["Intel Corporation "]
spmgr, spmgr, "C:\Programme\ASUS\NB Probe\SPM\spmgr.exe" [empty string]
Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS]


Print Monitors:
---------------

HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors\
OLFax Ports\Driver = "OLFMNT40.DLL" [MS]


---------- (launch time: 2008-12-17 00:14:35)
<<!>>: Suspicious data at a malware launch point.

+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
  launch it from a command prompt or a shortcut with the -all parameter.
+ The search for DESKTOP.INI DLL launch points on all local fixed drives
  took 130 seconds.
---------- (total run time: 176 seconds)

Setz mich als nächstes an ComboFix. Gruß, maddox

maddox · 17.12.2008, 00:45

System mit dem CCleaner bereinigt, dann ComboFix::

Code:

ATTFilter

ComboFix 08-12-15.08 - Admin 2008-12-17  0:40:09.1 - FAT32x86
Microsoft Windows XP Home Edition  5.1.2600.2.1252.1.1031.18.1023.649 [GMT 1:00]
ausgeführt von:: c:\dokumente und einstellungen\Admin\Desktop\ComboFix.exe
 * Neuer Wiederherstellungspunkt wurde erstellt
.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\dokumente und einstellungen\XXX\Lokale Einstellungen\Temporary Internet Files\fbk.sts
c:\temp\1cb
c:\temp\1cb\syscheck.log
c:\temp\DIV55
c:\temp\DIV55\xDb.log
c:\windows\system32\cuqlecpk.ini
c:\windows\system32\ebrmqemi.ini
c:\windows\system32\eopqykpy.ini
c:\windows\system32\epmmmfxp.ini
c:\windows\system32\fussqvwu.dll
c:\windows\system32\kfwoesrj.ini
c:\windows\system32\mdm.exe
c:\windows\system32\oxdbkdfw.ini
c:\windows\Tasks\iczxfdbx.job

.
(((((((((((((((((((((((   Dateien erstellt von 2008-11-16 bis 2008-12-16  ))))))))))))))))))))))))))))))
.

2008-12-17 00:30 . 2008-12-17 00:30	<DIR>	d--------	c:\programme\CCleaner
2008-12-16 18:12 . 2008-12-16 18:12	<DIR>	d--------	c:\dokumente und einstellungen\XXX\Anwendungsdaten\Malwarebytes
2008-12-16 18:07 . 2008-12-16 18:07	<DIR>	d--------	c:\programme\Malwarebytes' Anti-Malware
2008-12-16 18:07 . 2008-12-16 18:07	<DIR>	d--------	c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes
2008-12-16 18:07 . 2008-12-16 18:07	<DIR>	d--------	c:\dokumente und einstellungen\Admin\Anwendungsdaten\Malwarebytes
2008-12-16 18:07 . 2008-12-03 19:52	38,496	--a------	c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-16 18:07 . 2008-12-03 19:52	15,504	--a------	c:\windows\system32\drivers\mbam.sys
2008-12-16 14:01 . 2008-12-16 14:01	<DIR>	d--------	c:\programme\Trend Micro
2008-12-15 20:49 . 2006-02-01 12:22	<DIR>	d--------	c:\dokumente und einstellungen\Administrator\WINDOWS
2008-12-15 20:49 . 2006-02-01 12:05	<DIR>	d--h-----	c:\dokumente und einstellungen\Administrator\Vorlagen
2008-12-15 20:49 . 2006-02-01 12:05	<DIR>	dr-------	c:\dokumente und einstellungen\Administrator\Startmenü
2008-12-15 20:49 . 2006-02-01 12:05	<DIR>	d--h-----	c:\dokumente und einstellungen\Administrator\Netzwerkumgebung
2008-12-15 20:49 . 2006-02-01 12:05	<DIR>	d--h-----	c:\dokumente und einstellungen\Administrator\Lokale Einstellungen
2008-12-15 20:49 . 2006-02-01 12:33	<DIR>	dr-------	c:\dokumente und einstellungen\Administrator\Favoriten
2008-12-15 20:49 . 2006-02-01 12:33	<DIR>	dr-------	c:\dokumente und einstellungen\Administrator\Eigene Dateien
2008-12-15 20:49 . 2006-02-01 12:05	<DIR>	d--h-----	c:\dokumente und einstellungen\Administrator\Druckumgebung
2008-12-15 20:49 . 2006-02-01 12:30	<DIR>	d--------	c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Symantec
2008-12-15 20:49 . 2006-02-01 12:38	<DIR>	d--------	c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Intel
2008-12-15 20:49 . 2006-02-01 12:05	<DIR>	dr-h-----	c:\dokumente und einstellungen\Administrator\Anwendungsdaten
2008-12-15 20:49 . 2008-12-15 20:49	<DIR>	d--------	c:\dokumente und einstellungen\Administrator
2008-12-12 22:13 . 2008-12-14 18:06	162	--a------	c:\windows\wininit.ini
2008-12-11 22:24 . 2008-12-11 22:24	<DIR>	d--------	c:\windows\system32\LS4
2008-12-11 22:24 . 2008-12-11 22:24	<DIR>	d--------	c:\windows\system32\AT
2008-12-11 22:24 . 2008-12-11 22:24	<DIR>	d--hs----	c:\windows\QWRtaW4
2008-12-11 22:23 . 2008-12-11 22:24	<DIR>	d--------	C:\Temp

.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-24 11:10	453,632	----a-w	c:\windows\system32\drivers\mrxsmb.sys
2008-10-24 11:10	453,632	----a-w	c:\windows\system32\dllcache\mrxsmb.sys
2008-10-23 12:59	283,648	----a-w	c:\windows\system32\gdi32.dll
2008-10-23 12:59	283,648	----a-w	c:\windows\system32\dllcache\gdi32.dll
2008-10-21 21:34	---------	d-----w	c:\programme\Triplot
2008-10-17 00:34	3,593,216	----a-w	c:\windows\system32\dllcache\mshtml.dll
2008-10-16 13:13	202,776	----a-w	c:\windows\system32\wuweb.dll
2008-10-16 13:13	202,776	----a-w	c:\windows\system32\dllcache\wuweb.dll
2008-10-16 13:13	1,809,944	----a-w	c:\windows\system32\wuaueng.dll
2008-10-16 13:13	1,809,944	----a-w	c:\windows\system32\dllcache\wuaueng.dll
2008-10-16 13:12	561,688	----a-w	c:\windows\system32\wuapi.dll
2008-10-16 13:12	561,688	----a-w	c:\windows\system32\dllcache\wuapi.dll
2008-10-16 13:12	323,608	----a-w	c:\windows\system32\wucltui.dll
2008-10-16 13:12	323,608	----a-w	c:\windows\system32\dllcache\wucltui.dll
2008-10-16 13:11	13,824	------w	c:\windows\system32\dllcache\ieudinit.exe
2008-10-16 13:10	70,656	----a-w	c:\windows\system32\dllcache\ie4uinit.exe
2008-10-16 13:09	92,696	----a-w	c:\windows\system32\dllcache\cdm.dll
2008-10-16 13:09	92,696	----a-w	c:\windows\system32\cdm.dll
2008-10-16 13:09	51,224	----a-w	c:\windows\system32\wuauclt.exe
2008-10-16 13:09	51,224	----a-w	c:\windows\system32\dllcache\wuauclt.exe
2008-10-16 13:09	43,544	----a-w	c:\windows\system32\wups2.dll
2008-10-16 13:08	34,328	----a-w	c:\windows\system32\wups.dll
2008-10-16 13:08	34,328	----a-w	c:\windows\system32\dllcache\wups.dll
2008-10-15 17:57	332,800	----a-w	c:\windows\system32\dllcache\netapi32.dll
2008-10-15 07:06	633,632	----a-w	c:\windows\system32\dllcache\iexplore.exe
2008-10-15 07:04	161,792	----a-w	c:\windows\system32\dllcache\ieakui.dll
2008-10-03 10:15	247,326	----a-w	c:\windows\system32\strmdll.dll
2008-10-03 10:15	247,326	----a-w	c:\windows\system32\dllcache\strmdll.dll
2008-09-30 15:43	1,286,152	----a-w	c:\windows\system32\msxml4.dll
1999-03-11 18:22	99,840	----a-w	c:\programme\Gemeinsame Dateien\IRAABOUT.DLL
1998-12-09 03:53	70,144	----a-w	c:\programme\Gemeinsame Dateien\IRAMDMTR.DLL
1998-12-09 03:53	48,640	----a-w	c:\programme\Gemeinsame Dateien\IRALPTTR.DLL
1998-12-09 03:53	31,744	----a-w	c:\programme\Gemeinsame Dateien\IRAWEBTR.DLL
1998-12-09 03:53	186,368	----a-w	c:\programme\Gemeinsame Dateien\IRAREG.DLL
1998-12-09 03:53	17,920	----a-w	c:\programme\Gemeinsame Dateien\IRASRIAL.DLL
2006-05-06 17:42	7,260,160	----a-w	c:\programme\mozilla firefox\plugins\libvlc.dll
2005-07-29 15:24	472	--sha-r	c:\windows\QWRtaW4\kqlQuqb.vbs
.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"MSMSGS"="c:\programme\Messenger\msmsgs.exe" [2004-10-13 1694208]
"AnyDVD"="c:\programme\SlySoft\AnyDVD\AnyDVDtray.exe" [2008-08-22 2173888]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HControl"="c:\windows\ATK0100\HControl.exe" [2005-07-28 102400]
"ASUS Live Update"="c:\programme\ASUS\ASUS Live Update\ALU.exe" [2003-09-19 172032]
"Wireless Console"="c:\programme\ASUS\Wireless Console\wcourier.exe" [2005-07-22 57344]
"SynTPLpr"="c:\programme\Synaptics\SynTP\SynTPLpr.exe" [2005-07-28 82009]
"SynTPEnh"="c:\programme\Synaptics\SynTP\SynTPEnh.exe" [2005-08-01 729177]
"IntelZeroConfig"="c:\programme\Intel\Wireless\bin\ZCfgSvc.exe" [2005-05-31 401408]
"IntelWireless"="c:\programme\Intel\Wireless\Bin\ifrmewrk.exe" [2005-06-03 385024]
"EOUApp"="c:\programme\Intel\Wireless\Bin\EOUWiz.exe" [2005-05-31 356352]
"avgnt"="c:\programme\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-18 266497]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"SunJavaUpdateSched"="c:\programme\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784]
"RemoteControl"="c:\programme\CyberLink\PowerDVD\PDVDServ.exe" [2004-03-17 32768]
"TotalRecorderScheduler"="c:\programme\HighCriteria\TotalRecorder\TotRecSched.exe" [2005-10-13 81920]
"QuickTime Task"="c:\programme\QuickTime\qttask.exe" [2006-03-26 155648]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-12-04 7340032]
"Power_Gear"="c:\programme\ASUS\Power4 Gear\BatteryLife.exe" [2005-06-16 86016]
"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"RTHDCPL"="RTHDCPL.EXE" [2005-09-06 c:\windows\RTHDCPL.EXE]
"nwiz"="nwiz.exe" [2005-12-04 c:\windows\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]

c:\dokumente und einstellungen\XXX\Startmen\Programme\Autostart\
OpenOffice.org 2.0.lnk - c:\programme\OpenOffice.org 2.0\program\quickstart.exe [2005-12-14 61440]

c:\dokumente und einstellungen\Admin\Startmen\Programme\Autostart\
Picture Motion Browser Medien-Prfung.lnk - c:\programme\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe [2007-09-08 344064]

c:\dokumente und einstellungen\All Users\Startmen\Programme\Autostart\
Microsoft Office.lnk - c:\programme\Microsoft Office 2000\Office\OSA9.EXE [1999-02-17 65588]
Symantec Fax Starter Edition-Anschluss.lnk - c:\programme\Microsoft Office 2000\Office\1031\OLFSNT40.EXE [1999-03-11 46080]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
2005-05-31 22:46 110592 c:\programme\Intel\Wireless\Bin\LgNotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.asv2"= asusasv2.dll
"mixer"= DrvTrNTm.dll
"wave"= DrvTrNTm.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programme\\Mustrum\\Mustrum.exe"=
"c:\\Programme\\ASUS\\ASUS Live Update\\LiveUpdt.exe"=
"c:\\Programme\\FRITZ!DSL\\IGDCTRL.EXE"=
"c:\\Programme\\FRITZ!DSL\\FBOXUPD.EXE"=
"c:\\Programme\\Zattoo\\zattood.exe"=
"c:\\Programme\\Zattoo\\Zattoo2.exe"=
"c:\\Programme\\Zattoo\\Zattoo.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programme\\uTorrent\\uTorrent.exe"=
"c:\\Programme\\Malwarebytes' Anti-Malware\\mbam.exe"=

R0 avgntmgr;avgntmgr;c:\windows\system32\drivers\avgntmgr.sys [2006-02-01 22336]
R0 R592;R592;c:\windows\system32\DRIVERS\R592.sys [2006-02-01 57088]
R0 risdpntk;risdpntk;c:\windows\system32\DRIVERS\risdpntk.sys [2006-02-01 27264]
R1 avgntdd;avgntdd;c:\windows\system32\DRIVERS\avgntdd.sys [2006-02-01 45376]
R1 tvtool;tvtool;\??\c:\programme\TVTool\tvtool.sys [1996-04-03 5248]
R3 Video3D;ASUS Video3D Service;c:\windows\system32\Drivers\Video3D.sys [2004-07-06 44544]
S3 AVMUNET;AVM FRITZ!Box;c:\windows\system32\DRIVERS\avmunet.sys [2006-02-26 15104]
.
Inhalt des "geplante Tasks" Ordners
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -

HKLM-Run-NB Probe - (no file)


.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.asus.com
uInternet Connection Wizard,ShellNext = hxxp://www.asus.com/
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
FF - ProfilePath - c:\dokumente und einstellungen\Admin\Anwendungsdaten\Mozilla\Firefox\Profiles\v5ur13me.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.spiegel.de
FF - plugin: c:\programme\Mozilla Firefox\plugins\npvlc.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, h**p://www.gmer.net
Rootkit scan 2008-12-17 00:41:28
Windows 5.1.2600 Service Pack 2 FAT NTAPI

Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

- - - - - - - > 'winlogon.exe'(1056)
c:\programme\Intel\Wireless\Bin\LgNotify.dll
.
Zeit der Fertigstellung: 2008-12-17  0:42:02
ComboFix-quarantined-files.txt  2008-12-16 23:42:02

Vor Suchlauf: 5.992.480.768 Bytes frei
Nach Suchlauf: 6,204,555,264 Bytes frei

WindowsXP-KB310994-SP2-Home-BootDisk-DEU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

195	--- E O F ---	2008-12-15 16:45:15

john.doe · 17.12.2008, 00:46

Gotcha. Direkt nach ComboFix mache folgendes:

Lade LopSD auf den Desktop,
Doppelklick um es zu starten ,Tippe D (Deutsch), [Enter] und tippe 2.
Poste anschliessend die Datei LopR.txt[/QUOTE]

maddox · 17.12.2008, 01:05

Hier noch schnell der Link zum logfile des Skriptes "listing8":
http://www.file-upload.net/download-1321075/listing.txt.html

Und nun zu LopSD:

Code:

ATTFilter

   --------------------\\  Lop S&D 4.2.4-9c   XP/Vista

   Microsoft Windows XP Home Edition ( v5.1.2600 ) Service Pack 2
   X86-based PC ( Uniprocessor Free :         Intel(R) Pentium(R) M processor 1.73GHz )
   BIOS : Default System BIOS
   USER : Admin ( Administrator )
   BOOT : Normal boot
   Antivirus : AntiVir PersonalEdition Classic Virenschutz 0.0.0.0 (Activated)
   C:\ (Local Disk) - FAT32 - Total:32 Go (Free:5 Go)
   D:\ (Local Disk) - FAT32 - Total:21 Go (Free:8 Go)
   E:\ (CD or DVD)
   F:\ (USB)
   G:\ (USB)

   "C:\Lop SD" ( MAJ : 01-11-2008|16:30 )
   Option : [2] ( 17.12.2008| 0:59 )

 
   \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ 

 
   --------------------\\  Ordner Verzeichnis unter ANWEND~1

   [01.02.2006|12:12] C:\DOKUME~1\DEFAUL~1\ANWEND~1\Identities
   [01.02.2006|12:38] C:\DOKUME~1\DEFAUL~1\ANWEND~1\Intel
   [01.02.2006|12:36] C:\DOKUME~1\DEFAUL~1\ANWEND~1\Macromedia
   [01.02.2006|12:04] C:\DOKUME~1\DEFAUL~1\ANWEND~1\Microsoft
   [01.02.2006|12:30] C:\DOKUME~1\DEFAUL~1\ANWEND~1\Symantec
   [0|Datei(en)] C:\DOKUME~1\DEFAUL~1\ANWEND~1\Bytes
   [7|Verzeichnis(se),] C:\DOKUME~1\DEFAUL~1\ANWEND~1\Bytes frei

   [08.09.2007|22:25] C:\DOKUME~1\ALLUSE~1\ANWEND~1\Adobe
   [07.02.2006|22:20] C:\DOKUME~1\ALLUSE~1\ANWEND~1\Ahead
   [01.02.2006|14:20] C:\DOKUME~1\ALLUSE~1\ANWEND~1\AntiVir PersonalEdition Classic
   [26.03.2006|22:51] C:\DOKUME~1\ALLUSE~1\ANWEND~1\Apple Computer
   [08.02.2006|09:04] C:\DOKUME~1\ALLUSE~1\ANWEND~1\CyberLink
   [28.11.2007|14:59] C:\DOKUME~1\ALLUSE~1\ANWEND~1\DVD Shrink
   [01.02.2006|12:37] C:\DOKUME~1\ALLUSE~1\ANWEND~1\Intel
   [16.12.2008|18:07] C:\DOKUME~1\ALLUSE~1\ANWEND~1\Malwarebytes
   [01.02.2006|12:04] C:\DOKUME~1\ALLUSE~1\ANWEND~1\Microsoft
   [29.08.2006|16:36] C:\DOKUME~1\ALLUSE~1\ANWEND~1\nView_Profiles
   [01.02.2006|12:17] C:\DOKUME~1\ALLUSE~1\ANWEND~1\SBSI
   [24.11.2007|19:09] C:\DOKUME~1\ALLUSE~1\ANWEND~1\Skype
   [08.05.2008|22:32] C:\DOKUME~1\ALLUSE~1\ANWEND~1\SlySoft
   [22.05.2008|12:38] C:\DOKUME~1\ALLUSE~1\ANWEND~1\Sony Corporation
   [01.02.2006|12:29] C:\DOKUME~1\ALLUSE~1\ANWEND~1\Symantec
   [23.08.2008|22:17] C:\DOKUME~1\ALLUSE~1\ANWEND~1\TEMP
   [18.03.2008|22:20] C:\DOKUME~1\ALLUSE~1\ANWEND~1\ZoomBrowser
   [0|Datei(en)] C:\DOKUME~1\ALLUSE~1\ANWEND~1\Bytes
   [19|Verzeichnis(se),] C:\DOKUME~1\ALLUSE~1\ANWEND~1\Bytes frei

   [01.02.2006|12:04] C:\DOKUME~1\NETWOR~1\ANWEND~1\Microsoft
   [0|Datei(en)] C:\DOKUME~1\NETWOR~1\ANWEND~1\Bytes
   [3|Verzeichnis(se),] C:\DOKUME~1\NETWOR~1\ANWEND~1\Bytes frei

   [25.08.2008|20:27] C:\DOKUME~1\LOCALS~1\ANWEND~1\Adobe
   [01.02.2006|12:04] C:\DOKUME~1\LOCALS~1\ANWEND~1\Microsoft
   [0|Datei(en)] C:\DOKUME~1\LOCALS~1\ANWEND~1\Bytes
   [4|Verzeichnis(se),] C:\DOKUME~1\LOCALS~1\ANWEND~1\Bytes frei

   [23.08.2008|21:58] C:\DOKUME~1\ADMIN\ANWEND~1\.RawTherapee
   [26.02.2006|22:32] C:\DOKUME~1\ADMIN\ANWEND~1\Adobe
   [26.02.2006|23:36] C:\DOKUME~1\ADMIN\ANWEND~1\AdobeUM
   [26.03.2006|22:53] C:\DOKUME~1\ADMIN\ANWEND~1\Apple Computer
   [09.02.2006|08:14] C:\DOKUME~1\ADMIN\ANWEND~1\Google
   [23.08.2008|21:52] C:\DOKUME~1\ADMIN\ANWEND~1\gtk-2.0
   [29.01.2007|22:57] C:\DOKUME~1\ADMIN\ANWEND~1\Help
   [01.02.2006|12:12] C:\DOKUME~1\ADMIN\ANWEND~1\Identities
   [01.02.2006|12:38] C:\DOKUME~1\ADMIN\ANWEND~1\Intel
   [01.02.2006|12:36] C:\DOKUME~1\ADMIN\ANWEND~1\Macromedia
   [16.12.2008|18:07] C:\DOKUME~1\ADMIN\ANWEND~1\Malwarebytes
   [01.02.2006|12:04] C:\DOKUME~1\ADMIN\ANWEND~1\Microsoft
   [07.02.2006|22:44] C:\DOKUME~1\ADMIN\ANWEND~1\Microsoft Web Folders
   [01.02.2006|14:22] C:\DOKUME~1\ADMIN\ANWEND~1\Mozilla
   [27.05.2006|17:13] C:\DOKUME~1\ADMIN\ANWEND~1\Pixum
   [24.11.2007|20:25] C:\DOKUME~1\ADMIN\ANWEND~1\Skype
   [30.01.2008|22:29] C:\DOKUME~1\ADMIN\ANWEND~1\Sony Corporation
   [24.11.2007|20:43] C:\DOKUME~1\ADMIN\ANWEND~1\Sun
   [01.02.2006|12:30] C:\DOKUME~1\ADMIN\ANWEND~1\Symantec
   [08.04.2006|18:29] C:\DOKUME~1\ADMIN\ANWEND~1\Talkback
   [08.04.2006|18:28] C:\DOKUME~1\ADMIN\ANWEND~1\Thunderbird
   [06.09.2008|17:08] C:\DOKUME~1\ADMIN\ANWEND~1\uTorrent
   [23.05.2006|10:03] C:\DOKUME~1\ADMIN\ANWEND~1\vlc
   [06.09.2008|17:26] C:\DOKUME~1\ADMIN\ANWEND~1\WinRAR
   [23.08.2008|22:09] C:\DOKUME~1\ADMIN\ANWEND~1\ZoomBrowser EX
   [0|Datei(en)] C:\DOKUME~1\ADMIN\ANWEND~1\Bytes
   [27|Verzeichnis(se),] C:\DOKUME~1\ADMIN\ANWEND~1\Bytes frei

   [01.02.2006|16:01] C:\DOKUME~1\XXX\ANWEND~1\Adobe
   [23.05.2006|09:48] C:\DOKUME~1\XXX\ANWEND~1\CyberLink
   [28.11.2007|08:42] C:\DOKUME~1\XXX\ANWEND~1\dvdcss
   [25.11.2006|17:13] C:\DOKUME~1\XXX\ANWEND~1\Google
   [21.09.2008|15:01] C:\DOKUME~1\XXX\ANWEND~1\gtk-2.0
   [21.09.2007|18:34] C:\DOKUME~1\XXX\ANWEND~1\Help
   [01.02.2006|12:12] C:\DOKUME~1\XXX\ANWEND~1\Identities
   [25.11.2006|17:13] C:\DOKUME~1\XXX\ANWEND~1\InstallShield
   [25.11.2006|17:13] C:\DOKUME~1\XXX\ANWEND~1\InstallShield Installation Information
   [01.02.2006|12:38] C:\DOKUME~1\XXX\ANWEND~1\Intel
   [28.11.2007|07:40] C:\DOKUME~1\XXX\ANWEND~1\IrfanView
   [01.02.2006|12:36] C:\DOKUME~1\XXX\ANWEND~1\Macromedia
   [16.12.2008|18:12] C:\DOKUME~1\XXX\ANWEND~1\Malwarebytes
   [01.02.2006|12:04] C:\DOKUME~1\XXX\ANWEND~1\Microsoft
   [01.02.2006|15:10] C:\DOKUME~1\XXX\ANWEND~1\Mozilla
   [08.02.2006|09:37] C:\DOKUME~1\XXX\ANWEND~1\OpenOffice.org2
   [27.05.2006|17:15] C:\DOKUME~1\XXX\ANWEND~1\Pixum
   [07.05.2008|22:41] C:\DOKUME~1\XXX\ANWEND~1\Skype
   [18.03.2008|22:08] C:\DOKUME~1\XXX\ANWEND~1\Sony Corporation
   [03.03.2006|19:26] C:\DOKUME~1\XXX\ANWEND~1\Sun
   [01.02.2006|12:30] C:\DOKUME~1\XXX\ANWEND~1\Symantec
   [08.04.2006|18:38] C:\DOKUME~1\XXX\ANWEND~1\Talkback
   [08.04.2006|18:38] C:\DOKUME~1\XXX\ANWEND~1\Thunderbird
   [23.05.2006|10:27] C:\DOKUME~1\XXX\ANWEND~1\vlc
   [0|Datei(en)] C:\DOKUME~1\XXX\ANWEND~1\Bytes
   [26|Verzeichnis(se),] C:\DOKUME~1\XXX\ANWEND~1\Bytes frei

   [20.02.2006|22:03] C:\DOKUME~1\YYY\ANWEND~1\Adobe
   [12.11.2006|14:17] C:\DOKUME~1\YYY\ANWEND~1\Apple Computer
   [21.02.2006|21:47] C:\DOKUME~1\YYY\ANWEND~1\Help
   [01.02.2006|12:12] C:\DOKUME~1\YYY\ANWEND~1\Identities
   [01.02.2006|12:38] C:\DOKUME~1\YYY\ANWEND~1\Intel
   [01.02.2006|12:36] C:\DOKUME~1\YYY\ANWEND~1\Macromedia
   [01.02.2006|12:04] C:\DOKUME~1\YYY\ANWEND~1\Microsoft
   [01.02.2006|16:17] C:\DOKUME~1\YYY\ANWEND~1\Mozilla
   [13.03.2006|14:45] C:\DOKUME~1\YYY\ANWEND~1\Sun
   [01.02.2006|12:30] C:\DOKUME~1\YYY\ANWEND~1\Symantec
   [03.11.2006|08:27] C:\DOKUME~1\YYY\ANWEND~1\Talkback
   [06.12.2006|12:14] C:\DOKUME~1\YYY\ANWEND~1\vlc
   [0|Datei(en)] C:\DOKUME~1\YYY\ANWEND~1\Bytes
   [14|Verzeichnis(se),] C:\DOKUME~1\YYY\ANWEND~1\Bytes frei

   [01.02.2006|12:12] C:\DOKUME~1\LIEBEL~1\ANWEND~1\Identities
   [01.02.2006|12:38] C:\DOKUME~1\LIEBEL~1\ANWEND~1\Intel
   [01.02.2006|12:36] C:\DOKUME~1\LIEBEL~1\ANWEND~1\Macromedia
   [01.02.2006|12:04] C:\DOKUME~1\LIEBEL~1\ANWEND~1\Microsoft
   [11.02.2006|20:37] C:\DOKUME~1\LIEBEL~1\ANWEND~1\Mozilla
   [01.02.2006|12:30] C:\DOKUME~1\LIEBEL~1\ANWEND~1\Symantec
   [17.04.2007|21:31] C:\DOKUME~1\LIEBEL~1\ANWEND~1\Talkback
   [0|Datei(en)] C:\DOKUME~1\LIEBEL~1\ANWEND~1\Bytes
   [9|Verzeichnis(se),] C:\DOKUME~1\LIEBEL~1\ANWEND~1\Bytes frei

   [01.02.2006|12:12] C:\DOKUME~1\ADMINI~1\ANWEND~1\Identities
   [01.02.2006|12:38] C:\DOKUME~1\ADMINI~1\ANWEND~1\Intel
   [01.02.2006|12:36] C:\DOKUME~1\ADMINI~1\ANWEND~1\Macromedia
   [01.02.2006|12:04] C:\DOKUME~1\ADMINI~1\ANWEND~1\Microsoft
   [01.02.2006|12:30] C:\DOKUME~1\ADMINI~1\ANWEND~1\Symantec
   [0|Datei(en)] C:\DOKUME~1\ADMINI~1\ANWEND~1\Bytes
   [7|Verzeichnis(se),] C:\DOKUME~1\ADMINI~1\ANWEND~1\Bytes frei
 
   --------------------\\  Geplante Aufgaben unter C:\WINDOWS\Tasks

   [20.09.2007 21:32][--a------] C:\WINDOWS\tasks\Low Battery Alarm Program.job
   [17.12.2008 00:42][--ah-----] C:\WINDOWS\tasks\SA.DAT
   [04.08.2004 14:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini

   --------------------\\  Ordner Verzeichnis unter C:\Programme

   [01.02.2006|12:18] C:\Programme\Adobe
   [07.02.2006|22:20] C:\Programme\Ahead
   [01.02.2006|14:20] C:\Programme\AntiVir PersonalEdition Classic
   [01.02.2006|12:22] C:\Programme\ASUS
   [23.08.2008|22:17] C:\Programme\BreezeSys
   [10.05.2006|18:55] C:\Programme\Canon
   [17.12.2008|00:30] C:\Programme\CCleaner
   [16.04.2006|23:52] C:\Programme\CD Audio Reader Filter
   [06.09.2008|15:26] C:\Programme\CD Bremse
   [01.02.2006|12:10] C:\Programme\ComPlus Applications
   [01.02.2006|12:36] C:\Programme\CONEXANT
   [16.08.2006|08:43] C:\Programme\COWON
   [08.02.2006|09:04] C:\Programme\CyberLink
   [01.02.2006|14:43] C:\Programme\Debugging Tools for Windows
   [09.02.2006|09:18] C:\Programme\DeskClock
   [16.04.2006|20:50] C:\Programme\DirectVobSub
   [16.04.2006|23:57] C:\Programme\DivX
   [16.04.2006|23:55] C:\Programme\DivX_311alpha
   [08.05.2008|15:16] C:\Programme\DVD Decrypter
   [28.11.2007|14:59] C:\Programme\DVD Shrink
   [20.09.2007|21:39] C:\Programme\ExplorerXP
   [08.02.2006|00:15] C:\Programme\Freeciv-gtk2-2.0.7
   [30.01.2008|22:30] C:\Programme\FRITZ!Box
   [30.01.2008|22:31] C:\Programme\FRITZ!DSL
   [01.02.2006|12:35] C:\Programme\GameFace Messenger
   [08.02.2006|00:00] C:\Programme\Gekko Mahjongg
   [01.02.2006|12:05] C:\Programme\Gemeinsame Dateien
   [08.02.2006|10:15] C:\Programme\GIMP-2.0
   [08.02.2006|00:04] C:\Programme\gnubackgammon
   [24.06.2007|22:12] C:\Programme\Google
   [08.02.2006|10:13] C:\Programme\GTK
   [05.08.2008|21:07] C:\Programme\Hewlett-Packard
   [09.02.2006|21:13] C:\Programme\HighCriteria
   [05.08.2008|21:07] C:\Programme\hp deskjet 845c series
   [06.02.2007|23:00] C:\Programme\ImageMagick-6.3.2-Q16
   [01.02.2006|12:19] C:\Programme\InstallShield Installation Information
   [01.02.2006|12:25] C:\Programme\Intel
   [01.02.2006|12:10] C:\Programme\Internet Explorer
   [08.02.2006|00:02] C:\Programme\IrfanView
   [07.02.2006|23:39] C:\Programme\Java
   [25.07.2006|11:59] C:\Programme\KeePass Password Safe
   [16.12.2008|18:07] C:\Programme\Malwarebytes' Anti-Malware
   [01.02.2006|12:09] C:\Programme\Messenger
   [01.02.2006|12:12] C:\Programme\microsoft frontpage
   [07.02.2006|22:43] C:\Programme\Microsoft Office 2000
   [07.02.2006|22:52] C:\Programme\Microsoft Visual Studio
   [16.04.2006|23:53] C:\Programme\Monkey Audio Source Filter
   [01.02.2006|12:10] C:\Programme\Movie Maker
   [01.02.2006|14:22] C:\Programme\Mozilla Firefox
   [08.04.2006|18:28] C:\Programme\Mozilla Thunderbird
   [01.02.2006|12:09] C:\Programme\MSN
   [01.02.2006|12:09] C:\Programme\MSN Gaming Zone
   [29.01.2007|23:08] C:\Programme\MSXML 4.0
   [08.02.2006|00:01] C:\Programme\Mustrum
   [07.02.2006|23:43] C:\Programme\NCBuy
   [01.02.2006|12:10] C:\Programme\NetMeeting
   [14.02.2006|23:17] C:\Programme\Network Stumbler
   [01.02.2006|12:09] C:\Programme\Online Services
   [01.02.2006|12:11] C:\Programme\Online-Dienste
   [08.02.2006|00:17] C:\Programme\OpenOffice.org 2.0
   [01.02.2006|12:10] C:\Programme\Outlook Express
   [08.02.2006|00:12] C:\Programme\pathological
   [27.05.2006|17:13] C:\Programme\Pixum
   [01.02.2006|14:34] C:\Programme\ProcessExplorer
   [20.07.2006|09:54] C:\Programme\pscp
   [20.07.2006|09:51] C:\Programme\PuTTY
   [26.03.2006|22:52] C:\Programme\QuickTime
   [01.02.2006|12:19] C:\Programme\Realtek
   [08.02.2006|00:07] C:\Programme\Risiko
   [03.08.2006|09:40] C:\Programme\SigmaTel
   [24.11.2007|19:10] C:\Programme\Skype
   [08.05.2008|22:29] C:\Programme\SlySoft
   [07.02.2006|22:47] C:\Programme\Snapshot Viewer
   [08.09.2007|21:31] C:\Programme\Sony
   [01.02.2006|12:23] C:\Programme\Synaptics
   [08.02.2006|00:08] C:\Programme\Tetris Unlimited
   [09.03.2006|21:34] C:\Programme\TrekStor
   [16.12.2008|14:01] C:\Programme\Trend Micro
   [21.10.2008|22:34] C:\Programme\Triplot
   [29.08.2006|14:14] C:\Programme\TVTool
   [01.02.2006|12:33] C:\Programme\Uninstall Information
   [06.09.2008|17:08] C:\Programme\uTorrent
   [23.05.2006|10:00] C:\Programme\VideoLAN
   [01.02.2006|12:09] C:\Programme\Windows Media Player
   [01.02.2006|12:09] C:\Programme\Windows NT
   [01.02.2006|12:11] C:\Programme\WindowsUpdate
   [06.09.2008|17:26] C:\Programme\WinRAR
   [01.02.2006|12:12] C:\Programme\xerox
   [16.04.2006|23:54] C:\Programme\XVID Decoder
   [18.03.2008|22:18] C:\Programme\Zattoo
   [16.04.2006|20:47] C:\Programme\Zoom Player
   [0|Datei(en)] C:\Programme\Bytes
   [93|Verzeichnis(se),] C:\Programme\Bytes frei

   --------------------\\  Ordner Verzeichnis unter C:\Programme\Gemeinsame Dateien

   [08.09.2007|22:25] C:\Programme\Gemeinsame Dateien\Adobe
   [07.02.2006|22:20] C:\Programme\Gemeinsame Dateien\Ahead
   [30.01.2008|22:31] C:\Programme\Gemeinsame Dateien\AVM
   [18.03.2008|22:19] C:\Programme\Gemeinsame Dateien\Canon
   [07.02.2006|22:52] C:\Programme\Gemeinsame Dateien\Designer
   [01.02.2006|12:10] C:\Programme\Gemeinsame Dateien\Dienste
   [01.02.2006|12:19] C:\Programme\Gemeinsame Dateien\InstallShield
   [07.02.2006|23:39] C:\Programme\Gemeinsame Dateien\Java
   [07.02.2006|22:36] C:\Programme\Gemeinsame Dateien\LightScribe
   [01.02.2006|12:05] C:\Programme\Gemeinsame Dateien\Microsoft Shared
   [01.02.2006|12:10] C:\Programme\Gemeinsame Dateien\MSSoap
   [07.02.2006|22:30] C:\Programme\Gemeinsame Dateien\Nero
   [01.02.2006|12:05] C:\Programme\Gemeinsame Dateien\ODBC
   [24.11.2007|19:10] C:\Programme\Gemeinsame Dateien\Skype
   [01.02.2006|12:05] C:\Programme\Gemeinsame Dateien\SpeechEngines
   [08.02.2006|09:47] C:\Programme\Gemeinsame Dateien\SWF Studio
   [01.02.2006|12:10] C:\Programme\Gemeinsame Dateien\System
   [0|Datei(en)] C:\Programme\Gemeinsame Dateien\Bytes
   [19|Verzeichnis(se),] C:\Programme\Gemeinsame Dateien\Bytes frei

   --------------------\\  Process

   ( 51 Processes )

   ... OK !

   --------------------\\  Ueberpruefung mit S_Lop

   Kein Lop Ordner gefunden !
 
   --------------------\\  Suche nach Lop Dateien - Ordnern

   Kein Lop Ordner gefunden ! 
 
   --------------------\\  Suche innerhalb der Registry
 
   ..... OK !

   --------------------\\  Ueberpruefung der Hosts Datei

   Hosts Datei SAUBER


   --------------------\\  Suche nach verborgenen Dateien mit Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, h**p://www.gmer.net
   Rootkit scan 2008-12-17 01:03:08
   Windows 5.1.2600 Service Pack 2 FAT NTAPI
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 0
 
   --------------------\\  Suche nach anderen Infektionen


   Kein anderen Infektionen gefunden !

   [F:3][D:0]-> C:\DOKUME~1\Admin\LOKALE~1\Temp
   [F:1][D:0]-> C:\DOKUME~1\Admin\Cookies
   [F:2][D:0]-> C:\DOKUME~1\Admin\LOKALE~1\TEMPOR~1\content.IE5
   [F:2][D:0]-> C:\Recycled

   1 - "C:\Lop SD\LopR_1.txt" - 17.12.2008| 1:03 - Option : [2]

   --------------------\\  Scan beendet um  1:03:46

maddox · 17.12.2008, 01:12

Aktueller HJT-log mit der umbenannten Datei:

Code:

ATTFilter

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:10:28, on 17.12.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Intel\Wireless\Bin\EvtEng.exe
C:\Programme\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\ATKKBService.exe
C:\Programme\FRITZ!DSL\IGDCTRL.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Programme\Intel\Wireless\Bin\OProtSvc.exe
C:\Programme\Intel\Wireless\Bin\RegSrvc.exe
C:\Programme\ASUS\NB Probe\SPM\spmgr.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\Intel\Wireless\Bin\ZcfgSvc.exe
C:\Programme\Canon\CAL\CALMAIN.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\WINDOWS\ATK0100\HControl.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Programme\ASUS\Wireless Console\wcourier.exe
C:\Programme\Synaptics\SynTP\SynTPLpr.exe
C:\Programme\Synaptics\SynTP\SynTPEnh.exe
C:\Programme\Intel\Wireless\Bin\ifrmewrk.exe
C:\Programme\Intel\Wireless\Bin\EOUWiz.exe
C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe
C:\Programme\Java\jre1.6.0_05\bin\jusched.exe
C:\Programme\CyberLink\PowerDVD\PDVDServ.exe
C:\Programme\HighCriteria\TotalRecorder\TotRecSched.exe
C:\Programme\QuickTime\qttask.exe
C:\Programme\ASUS\Power4 Gear\BatteryLife.exe
C:\WINDOWS\ATK0100\ATKOSD.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Microsoft Office 2000\Office\1031\OLFSNT40.EXE
C:\Programme\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
C:\Programme\Java\jre1.6.0_05\bin\jucheck.exe
C:\WINDOWS\explorer.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\Dokumente und Einstellungen\Admin\Desktop\qlketzd.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://www.asus.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h**p://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = h**p://www.asus.com/
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_05\bin\ssv.dll
O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [ASUS Live Update] C:\Programme\ASUS\ASUS Live Update\ALU.exe
O4 - HKLM\..\Run: [Wireless Console] C:\Programme\ASUS\Wireless Console\wcourier.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Programme\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IntelZeroConfig] C:\Programme\Intel\Wireless\bin\ZCfgSvc.exe
O4 - HKLM\..\Run: [IntelWireless] C:\Programme\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [EOUApp] C:\Programme\Intel\Wireless\Bin\EOUWiz.exe
O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [RemoteControl] C:\Programme\CyberLink\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [TotalRecorderScheduler] "C:\Programme\HighCriteria\TotalRecorder\TotRecSched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Power_Gear] C:\Programme\ASUS\Power4 Gear\BatteryLife.exe 1
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AnyDVD] C:\Programme\SlySoft\AnyDVD\AnyDVDtray.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Picture Motion Browser Medien-Prüfung.lnk = C:\Programme\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office 2000\Office\OSA9.EXE
O4 - Global Startup: Symantec Fax Starter Edition-Anschluss.lnk = C:\Programme\Microsoft Office 2000\Office\1031\OLFSNT40.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=h**p://www.asus.com
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: AVM IGD CTRL Service - AVM Berlin - C:\Programme\FRITZ!DSL\IGDCTRL.EXE
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Programme\Canon\CAL\CALMAIN.exe
O23 - Service: AVM FRITZ!web Routing Service (de_serv) - AVM Berlin - C:\Programme\Gemeinsame Dateien\AVM\de_serv.exe
O23 - Service: EvtEng - Intel Corporation - C:\Programme\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: OwnershipProtocol - Intel Corporation - C:\Programme\Intel\Wireless\Bin\OProtSvc.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Programme\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation  - C:\Programme\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: spmgr - Unknown owner - C:\Programme\ASUS\NB Probe\SPM\spmgr.exe

--
End of file - 7662 bytes

Gruß, maddox

Trojanerbefall: werde Vundo und Monder nicht los

Log-Analyse und Auswertung: Trojanerbefall: werde Vundo und Monder nicht los