Win32:Podnuha-BJ [Rtk] gefunden

badhotrod

Hallo!

Melde mich mal wieder, weil mein G DATA AntiVirus 2009 folgenden Fund gemeldet hat:

Trojan.Generic.975968 (Engine A), Win32:Podnuha-BJ [Rtk] (Engine B)

und zwar in einer Datei namens rjgbj.dll im Windows\System32 Ordner.

G DATA hat die Datei in Quarantäne verschoben. Würde gern wissen, ob hier jemand den Virus oder die Datei kennt?? Und ob mein System noch weitere Unannehmlichkeiten bereithält aktuell. Dazu habe ich die Datei bei VirusTotal scannen lassen und ein HijackThis Logfile erstellt, hier die Ergebnisse:

++++++++++++++++++++++++++++++++++++++++
VIRUSTOTAL Scan:

Antivirus Version letzte aktualisierung Ergebnis
a-squared 4.0.0.73 2009.01.06 Virus.Win32.Podnuha!IK
AhnLab-V3 2009.1.5.3 2009.01.06 -
AntiVir 7.9.0.45 2009.01.05 TR/BHO.Gen
Authentium 5.1.0.4 2009.01.05 W32/Trojan2.EWBK
Avast 4.8.1281.0 2009.01.05 Win32:Podnuha-BJ
AVG 8.0.0.199 2009.01.05 BHO.X
BitDefender 7.2 2009.01.06 Trojan.Generic.975968
CAT-QuickHeal 10.00 2009.01.06 Trojan.BHO.hcg
ClamAV 0.94.1 2009.01.06 -
Comodo 878 2009.01.05 TrojWare.Win32.Trojan.BHO.~DE
DrWeb 4.44.0.09170 2009.01.06 Adware.Bho.97
eTrust-Vet 31.6.6293 2009.01.06 Win32/Kvol!generic
Ewido 4.0 2008.12.31 -
F-Prot 4.4.4.56 2009.01.05 W32/Trojan2.EWBK
F-Secure 8.0.14470.0 2009.01.06 Trojan.Win32.BHO.hfn
Fortinet 3.117.0.0 2009.01.06 W32/BHO.HFN!tr
GData 19 2009.01.06 Trojan.Generic.975968
Ikarus T3.1.1.45.0 2009.01.06 Virus.Win32.Podnuha
K7AntiVirus 7.10.576 2009.01.05 Trojan.Win32.BHO.hfn
Kaspersky 7.0.0.125 2009.01.06 Trojan.Win32.BHO.hfn
McAfee 5486 2009.01.05 Boaxxe.dll
McAfee+Artemis 5486 2009.01.05 Boaxxe.dll
Microsoft 1.4205 2009.01.06 Trojan:Win32/Boaxxe.B
NOD32 3741 2009.01.05 a variant of Win32/Rootkit.Podnuha
Norman 5.80.02 2009.01.02 W32/BHO.FXZ
Panda 9.0.0.4 2009.01.05 Generic Malware
PCTools 4.4.2.0 2009.01.05 Rootkit.Podnuha.Gen.2
Rising 21.11.12.00 2009.01.06 -
SecureWeb-Gateway 6.7.6 2009.01.05 Trojan.BHO.Gen
Sophos 4.37.0 2009.01.06 Mal/Generic-A
Sunbelt 3.2.1809.2 2008.12.22 Trojan.Win32.BHO.hfn
Symantec 10 2009.01.06 Trojan Horse
TheHacker 6.3.1.4.205 2009.01.05 Trojan/BHO.hfn
TrendMicro 8.700.0.1004 2009.01.06 -
VBA32 3.12.8.10 2009.01.05 Trojan.Win32.Boaxxe
ViRobot 2009.1.6.1546 2009.01.06 Trojan.Win32.BHO.93184.AE
VirusBuster 4.5.11.0 2009.01.05 Rootkit.Podnuha.Gen.2
weitere Informationen
File size: 93184 bytes
MD5...: b66520b19e49a2729059d6da4ab0b5a7
SHA1..: 6fa5fb648932543309769588a3c2d359f3afa40e
SHA256: 6160c323533aebfa21c13814ee717b9c640658df41cf98ed7d 7426fe4e3864b9
SHA512: 417c314717e8abc96b70d8c156639286091c7aacf162b81925 0f1aaaef0a27e5
154b97e0fd565742956665731420041c7d4a3d3026a4cc474e 1bde161d37a9fa
ssdeep: 1536H+rCSzfM1lM8q4Ue07zAnGrbtpcvKvc3VhKtc8PWvC73 FW9RmiukLDau
ehzUDdlV07zAGrJpcSvc3zhLe1WTmiV
PEiD..: -
TrID..: File type identification
UPX compressed Win32 Executable (42.6%)
Win32 EXE Yoda's Crypter (37.0%)
Win32 Executable Generic (11.8%)
Win16/32 Executable Delphi generic (2.8%)
Generic Win/DOS Executable (2.7%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x43d650
timedatestamp.....: 0x2a425e19 (Fri Jun 19 22:22:17 1992)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
UPX0 0x1000 0x27000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
UPX1 0x28000 0x16000 0x15a00 7.90 b21545e55ec2676f06e88da9363931b1
.rsrc 0x3e000 0x1000 0xe00 3.77 7a988e7f5bef3483e0541660e731d95d

( 7 imports )
> KERNEL32.DLL: LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree
> advapi32.dll: RegCloseKey
> ole32.dll: IsEqualGUID
> oleaut32.dll: LoadTypeLib
> shell32.dll: SHGetMalloc
> user32.dll: SetTimer
> wininet.dll: InternetCrackUrlA

( 5 exports )
DllCanUnloadNow, DllGetClassObject, DllRegisterServer, DllUnregisterServer, InitEntry0
packers (Avast): UPX
packers (Authentium): UPX
packers (F-Prot): UPX
CWSandbox info: <a href='http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=b66520b19e49a2729059d6da4ab0b5a7' target='_blank'>http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=b66520b19e49a2729059d6da4ab0b5a7</a>


+++++++++++++++++++++++++++++++++++++++++++
HJT Logfile:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:30:14, on 06.01.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
C:\Program Files\Common Files\G DATA\AVKProxy\AVKProxy.exe
C:\Program Files\G DATA\AntiVirus\AVK\AVKService.exe
C:\Program Files\G DATA\AntiVirus\AVK\AVKWCtl.exe
C:\WINDOWS\system32\bgsvcgen.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Sandboxie\SbieSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\TUProgSt.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\System32\dmadmin.exe
C:\Program Files\OO Software\DiskImage\oodiag.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\G DATA\AntiVirus\AVKTray\AVKTray.exe
C:\WINDOWS\system32\MAFWTray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\GIGABYTE\GEST\GEST.exe
C:\Program Files\GIGABYTE\GEST\GSvr.exe
D:\MISC\uTorrent\utorrent16.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\G DATA\AntiVirus\AVK\avk.exe
C:\HJT\HJT.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = maxdome - Deutschlands größte Online-Videothek
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Live Search
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Live Search
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = Microsoft Windows Update
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = *.local
O1 - Hosts: # Copyright (c) 1993-1999 Microsoft Corp.
O2 - BHO: G DATA WebFilter Class - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files\G DATA\AntiVirus\Webfilter\AVKWebIE.dll
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: G DATA WebFilter - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files\G DATA\AntiVirus\Webfilter\AVKWebIE.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [G DATA AntiVirus Trayapplication] C:\Program Files\G DATA\AntiVirus\AVKTray\AVKTray.exe
O4 - HKLM\..\Run: [GEST] C:\Program Files\GIGABYTE\GEST\RUN.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [M-Audio Taskbar Icon] C:\WINDOWS\System32\MAFWTray.exe
O4 - HKLM\..\Run: [MAFWTaskbarApp] C:\WINDOWS\system32\MAFWTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe /boot
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: An vorhandenes PDF anfügen - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: In Adobe PDF konvertieren - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - h**p://www.update.microsoft.com/micr...?1226603186125
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - h**ps://fpdownload.macromedia.com/pu...sh/swflash.cab
O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) - h**p://drmlicense.one.microsoft.com/.../en/crlocx.ocx
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft Ad-Aware\aawservice.exe
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Version Cue CS3 {de_DE} (Adobe Version Cue CS3) - Unknown owner - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe (file missing)
O23 - Service: G DATA AntiVirus Proxy (AVKProxy) - G DATA Software AG - C:\Program Files\Common Files\G DATA\AVKProxy\AVKProxy.exe
O23 - Service: G DATA Scheduler (AVKService) - G DATA Software AG - C:\Program Files\G DATA\AntiVirus\AVK\AVKService.exe
O23 - Service: AntiVirus Monitor (AVKWCtl) - G DATA Software AG - C:\Program Files\G DATA\AntiVirus\AVK\AVKWCtl.exe
O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINDOWS\system32\bgsvcgen.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GEST Service for program management. (GEST Service) - Unknown owner - C:\Program Files\GIGABYTE\GEST\GSvr.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: O&O DiskImage - Unknown owner - C:\Program Files\OO Software\DiskImage\oodiag.exe
O23 - Service: Sandboxie Service (SbieSvc) - tzuk - C:\Program Files\Sandboxie\SbieSvc.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\System32\TUProgSt.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe


Malwarebyte und Spybot S&D haben beim letzten Scan nix gefunden, werd aber nochmal nen aktuellen Scan durchführen. Bitte um Feedback.

PS: Achso, ein Hinweis noch: G DATA ist in den letzten 2 Tagen dadurch 2, 3 mal aufgefallen, dass es mir eine Meldung gebracht hat, dass irgendetwas (wurde nicht angegeben) meine host-Datei und Autostart-Einträge ändern wollte, was ich stets verneinte...