Trojaner "TR/Agent.imh" in C:\Windows\xvvutjp.inf

Seppel_2 · 06.05.2009, 12:11

Hallo,
habe von Antivir besagten Trojaner angezeigt bekommen. Die Antivir funktionen helfen nicht. Die Datei lässt sich ebensowenig manuell entfernen.
Bitte helft mir

Hier das Hijack this log:

Zitat:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:17:47, on 06.05.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Avira\AntiVir Desktop\sched.exe
C:\Programme\Avira\AntiVir Desktop\avguard.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
C:\Programme\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\explorer.exe
C:\Programme\Opera\opera.exe
C:\Programme\Mozilla Thunderbird\thunderbird.exe
C:\Programme\Opera\profile\cache4\temporary_download\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Hilfsprogramme\ActiveX\AcroIEHelper.dll
O2 - BHO: Mario Forever Toolbar Helper - {A20854FD-DDB5-4931-8F76-D11EA2364D94} - C:\Programme\Mario Forever Toolbar\v3.2.0.0\MarioForever_Toolbar.dll (file missing)
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\hilfsProgramme\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O3 - Toolbar: Mario Forever Toolbar - {71B6ACF7-4F0F-4FD8-BB69-6D1A4D271CB7} - C:\Programme\Mario Forever Toolbar\v3.2.0.0\MarioForever_Toolbar.dll (file missing)
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Verknüpfung mit der High Definition Audio-Eigenschaftenseite] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Hilfsprogramme\DAEMON Tools Pro\DTProAgent.exe"
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Hilfsprogramme\Alcohol 120\axcmd.exe" /automount
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\HILFSP~1\Office\Office10\EXCEL.EXE/3000
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Hilfsprogramme\Messanger\icq\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Hilfsprogramme\Messanger\icq\ICQ6.5\ICQ.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{761C8184-D209-4874-B6E3-422E3305E840}: NameServer = 195.50.140.114 195.50.140.252
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\avguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Hilfsprogramme\ipod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 4045 bytes

Seppel_2 · 07.05.2009, 07:30

keiner ne ahnung?

Chris4You · 07.05.2009, 07:41

Hi,

HJ-Log ist eher unauffällig, bitte noch den Rest was unter dem Link "Erstbeitrag" steht durcharbeiten (siehe Signatur).

Zusätzlich:
RSIT
Random's System Information Tool (RSIT) von random/random liest Systemdetails aus und erstellt ein aussagekräftiges Logfile.

* Lade Random's System Information Tool (RSIT) herunter http://filepony.de/download-rsit/
* speichere es auf Deinem Desktop.
* Starte mit Doppelklick die RSIT.exe.
* Klicke auf Continue, um die Nutzungsbedingungen zu akzeptieren.
* Wenn Du HijackThis nicht installiert hast, wird RSIT das für Dich herunterladen und installieren.
* In dem Fall bitte auch die Nutzungsbedingungen von Trend Micro (http://de.trendmicro.com/de/home) für HJT akzeptieren "I accept".
* Wenn Deine Firewall fragt, bitte RSIT erlauben, ins Netz zu gehen.
* Der Scan startet automatisch, RSIT checkt nun einige wichtige System-Bereiche und produziert Logfiles als Analyse-Grundlage.
* Wenn der Scan beendet ist, werden zwei Logfiles erstellt und in Deinem Editor geöffnet.
* Bitte poste den Inhalt von C:\rsit\log.txt und C:\rsit\info.txt (<= minimiert) hier in den Thread.

chris

Seppel_2 · 08.05.2009, 08:46

Hallo,
danke erstmal

hab jetz alle besagten Programme durchlaufen lassen und hier sind die logs:
[b]Mbam:[/b[
http://www.trojaner-board.de/attachm...1&d=1241768323
RSIT:
Log.Txt:
http://www.trojaner-board.de/attachm...1&d=1241768478
Info TXT:

Code:

ATTFilter

info.txt logfile of random's system information tool 1.06 2009-05-08 09:42:12

======Uninstall list======

-->C:\hilfsProgramme\DivX\DivXConverterUninstall.exe /CONVERTER
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Adobe Flash Player ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 7.0 - Deutsch-->MsiExec.exe /I{AC76BA86-7AD7-1031-7646-A70000000000}
Adobe Shockwave Player-->C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log
AIM-->C:\Programme\AIM6\uninst.exe
Anno 1701-->"C:\Programme\InstallShield Installation Information\{A2433A63-5F5D-40E5-B529-9123C2B3E734}\setup.exe" -runfromtemp -l0x0007 -removeonly
Apple Software Update-->MsiExec.exe /I{B74F042E-E1B9-4A5B-8D46-387BB172F0A4}
Avira AntiVir Personal - Free Antivirus-->C:\Programme\Avira\AntiVir Desktop\setup.exe /REMOVE
Battlefield 1942: Secret Weapons of WWII-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{B73B4A99-4173-4747-BBEC-0F05E966F9D2}\Setup.exe" -l0x7 
Battlefield 1942-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{698D7E61-E4BF-4CA6-8A09-CF6BDBFDEF65}\setup.exe" -l0x7 
Blizkrieg II: Liberation-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{79ABDCBE-BFF4-4722-850F-D858C10580CE}\setup.exe" -l0x7 
C&C 2005 v0.7.6-->"F:\cnc 1-4\Command & Conquer Tiberium Dawn\unins000.exe"
CCleaner (remove only)-->"C:\hilfsProgramme\CCleaner\uninst.exe"
CIB pdf Plug-in 1.3.25-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{62A5F5BC-CDAC-4F44-A2A9-C30A1BCBCA6B}\setup.exe" -l0x7  -uninst 
Command & Conquer Die ersten 10 Jahre-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{66D6F3BD-CA23-41A4-9FA3-96B26B32528D}\setup.exe" -l0x7  -removeonly
Command & Conquer Tiberian Hell-->F:\CNC 1-4\COMMAND & CONQUER(TM) TIBERIAN SUN(TM)\SUN\Hell-Deinstallation.exe
Command & Conquer Windows 95-->C:\WINDOWS\UNINSTCC.EXE C:\WINDOWS\UNINST.EXE -fF:\COMMAN~2\TIBERI~1\DeIsL1.isu
Command & Conquer-->"F:\cnc 1-4\Command & Conquer Tiberium Dawn\Command & Conquer\unins000.exe"
Command & Conquer™ Red Alert™ 3-->MsiExec.exe /X{296D8550-CB06-48E4-9A8B-E5034FB64715}
Counter-Strike 1.6-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\09\00\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{13B792AA-C078-43A4-8A3A-8B12D629940D}\Setup.exe" -l0x19 
Die Siedler IV-->C:\WINDOWS\IsUn0407.exe -f"f:\Die Siedler IV\Uninst.isu" -c"f:\Die Siedler IV\BBINST.DLL"
Die Sims 2-->F:\Sims 2\EAUninstall.exe
Die Sims™ 2 IKEA® Home-Accessoires-->F:\Sims 2\Expansion\EAUninstall.exe
Die Sims™ 2 Party-Accessoires-->F:\Sims 2\Expansion\party\EAUninstall.exe
dino2-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{1879585A-D70B-4774-8A0A-FCF9763AC7CF}\SETUP.EXE" 
DivX Codec-->C:\hilfsProgramme\DivX\DivXCodecUninstall.exe /CODEC
DivX Converter-->C:\hilfsProgramme\DivX\DivXConverterUninstall.exe /CONVERTER
DivX Player-->C:\hilfsProgramme\DivX\DivXPlayerUninstall.exe /PLAYER
DivX Web Player-->C:\hilfsProgramme\DivX\DivXWebPlayerUninstall.exe /PLUGIN
Dungeon Keeper Gold-->C:\WINDOWS\unin0407.exe -fC:\WINDOWS\SYSTEM\KEEPER\DeIsL1.isu
Earth 2150 Trilogy-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{F6CA3C55-B619-4228-DF23-1C4D896BCF44}\setup.exe" -l0x9  -removeonly
EAX Unified-->C:\WINDOWS\IsUninst.exe -f"C:\Programme\Creative\EAX Unified\Uninst.isu"
EAX(tm) Unified (SHELL)-->C:\WINDOWS\IsUninst.exe -f"C:\Programme\Creative Labs\EAX(tm) Unified (SHELL)\Uninst.isu"
Europa Universalis III-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{59C80C5E-8C92-40FF-B910-2BB5C7281F61}\setup.exe" -l0x7 
EVEREST Home Edition v2.20-->C:\Hilfsprogramme\Everest\unins000.exe
File Deleter version 1.0-->C:\hilfsProgramme\FileDeleter\unins000.exe
FINAL FANTASY VIII-->C:\WINDOWS\IsUn0407.exe -f"f:\final fantasy 8\Uninst.isu"
FlexPoints 2.01-->MsiExec.exe /I{B727BD4D-0C42-43F7-AC60-4AFBDDC732BD}
Free YouTube to Mp3 Converter version 2.5-->"C:\HilfsProgramme\ree YouTube to Mp3 Converter\unins000.exe"
Future Cop-->C:\WINDOWS\UNIN0407.EXE -ff:\futurecop\DeIsL1.isu -c"f:\futurecop\eauninst.dll
Goodnight Timer 1.1-->"C:\Hilfsprogramme\Goodnight Timer\unins000.exe"
Google Earth Pro-->MsiExec.exe /X{9578C0CD-8108-4379-9026-4601F59859A0}
Gothic II-->E:\PROGRA~1\GOTHIC~1\UNWISE.EXE E:\PROGRA~1\GOTHIC~1\INSTALL.LOG
Gothic III Release Update-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{1998BD34-1AAB-4169-ACFF-67342E2AF9B4}\setup.exe" -l0x7  -removeonly
Gothic III-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{02B244A2-7F6A-42E8-A36F-8C385D7A1625}\setup.exe" -l0x7  -removeonly
Hamachi 1.0.1.5-->C:\Hilfsprogramme\hamachi\uninstall.exe
High Definition Audio Driver Package - KB835221-->C:\WINDOWS\$NtUninstallKB835221WXP$\spuninst\spuninst.exe
HijackThis 2.0.2-->"C:\hilfsProgram Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Hotfix for Windows XP (KB926239)-->"C:\WINDOWS\$NtUninstallKB926239$\spuninst\spuninst.exe"
HP USB Disk Storage Format Tool-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{0E0DF90C-D0BA-4C89-9262-AD78D1A3DE51}\Setup.exe" -l0x9  anything
ICQ6.5-->"C:\Programme\InstallShield Installation Information\{60DE4033-9503-48D1-A483-7846BD217CA9}\setup.exe" -runfromtemp -l0x0009 -removeonly
iPod for Windows 2006-03-23-->C:\Programme\Gemeinsame Dateien\InstallShield\Driver\8\Intel 32\IDriver.exe /M{2070F79D-46BC-4EEA-8F02-9B4DCABAE7CB} /l1031 
IrfanView (remove only)-->C:\Hilfsprogramme\IrfanView\iv_uninstall.exe
iTunes-->C:\PROGRA~1\GEMEIN~1\INSTAL~1\Driver\11\INTEL3~1\IDriver.exe /M{59C4F14F-7590-45FC-BE9F-A67AB3590709} /l1031 
Kalo24 - der Freeware-Kaloreinexperte 1.0.0.0 -->C:\WINDOWS\uninstall\Kalo24 - der Freeware-Kaloreinexperte\setup.exe
KaloMa 4.75-->"C:\Hilfsprogramme\KaloMa\unins000.exe"
Mafia-->E:\Mafia\Mafia\MafiaSetup.exe
Malwarebytes' Anti-Malware-->"C:\hilfsProgramme\Malwarebytes' Anti-Malware\unins000.exe"
Mario Forever 4.0-->C:\Dokumente und Einstellungen\Admin\Desktop\SMC_v1.5 incl. Music Addon\Neuer Ordner\Mario Forever\uninst.exe
Mario Forever Toolbar-->"C:\WINDOWS\MarioForever_Toolbar_Uninstaller_906.exe"  _?=C:\Programme\Mario Forever Toolbar
Marvell Miniport Driver-->MsiExec.exe /X{C950420B-4182-49EA-850A-A6A2ABF06C6B}
Medal of Honor Allied Assault(tm) Breakthrough v2.40 Patch-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{DF9046D6-5F1F-40B6-9782-3DC2D902D391}\Setup.exe" -l0x7 
Medal of Honor Allied Assault(tm) Breakthrough-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{823A68CC-3049-4A6B-8F63-7DC85E4BB1C9}\Setup.exe" -l0x7 
Medal of Honor Allied Assault(tm) Spearhead Patch 2.15-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{18EF2DEE-DCB0-466A-ABA5-4C73E508530A}\Setup.exe" -l0x7 
Medal of Honor Allied Assault(tm) Spearhead-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{7914BE1E-F186-4790-B8F4-9F63C52A41C1}\Setup.exe" -l0x7 
Medal of Honor Allied Assault(tm) Spearhead-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{BE699EDC-9E58-4671-A23E-9CDF7F6F42F2}\Setup.exe" -l0x7 
Medal of Honor Allied Assault-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{0DEA94ED-915A-4834-A87E-388D012C8E02}\Setup.exe" -l0x7 
Microsoft .NET Framework 2.0 Language Pack - DEU-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0 Language Pack - DEU\install.exe
Microsoft .NET Framework 2.0-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe
Microsoft Office XP Professional mit FrontPage-->MsiExec.exe /I{90280407-6000-11D3-8CFE-0050048383C9}
Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
MozBackup 1.4.7-->"C:\Hilfsprogramme\MozBackup\unins000.exe"
Mozilla Firefox (3.0.10)-->C:\Programme\Mozilla Firefox\uninstall\helper.exe
Mozilla Thunderbird (2.0.0.21)-->C:\Programme\Mozilla Thunderbird\uninstall\helper.exe
MSXML4 Parser-->MsiExec.exe /I{01501EBA-EC35-4F9F-8889-3BE346E5DA13}
Nero 6 Ultra Edition-->C:\Hilfsprogramme\ahead\nero\uninstall\UNNERO.exe /UNINSTALL
Neverwinter Nights 2-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{F20C1251-1D0A-4944-B2AE-678581B33B19}\setup.exe" -l0x7  -removeonly
Norton PartitionMagic 8.0-->C:\PROGRA~1\GEMEIN~1\INSTAL~1\Driver\9\INTEL3~1\IDriver.exe /M{21DBBDD6-93A5-4326-9A04-C9A5C9148502} 
NVIDIA Drivers-->C:\WINDOWS\system32\nvuninst.exe UninstallGUI
Oblivion - Horse Armor Pack-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{3ABEBD00-299D-4DCA-967F-B912163AB5EA}\setup.exe" -l0x9  -removeonly
Oblivion - Knights of the Nine-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{14C87AA7-08E6-419F-A165-998EBE5023D7}\setup.exe" -l0x9  -removeonly
Oblivion - Mehrunes Razor-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{EF295F5C-7B57-47AA-8889-6B3E8E214E89}\setup.exe" -l0x9  -removeonly
Oblivion - Orrery-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{EC425CFC-EE78-4A91-AA25-3BFA65B75364}\setup.exe" -l0x9  -removeonly
Oblivion - Spell Tomes-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{16D919E6-F019-4E15-BFBE-4A85EF19DA57}\setup.exe" -l0x9  -removeonly
Oblivion - Thieves Den-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{FFFFFD17-B460-41EB-93F1-C48ABAD63828}\setup.exe" -l0x9  -removeonly
Oblivion - Vile Lair-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{520F4B09-3A51-47A2-82B0-9FF1DC2D20FA}\setup.exe" -l0x9  -removeonly
Oblivion - Wizard's Tower-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{2F2E3D62-8B8C-448F-8900-451325E50948}\setup.exe" -l0x9  -removeonly
Oblivion Improved 1.20-->"C:\Programme\Oblivion Improved\unins000.exe"
Oblivion-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{35CB6715-41F8-4F99-8881-6FC75BF054B0}\setup.exe" -l0x7  -removeonly
Opera 9.64-->MsiExec.exe /X{E1BBBAC5-2857-4155-82A6-54492CE88620}
PC Booster-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{BA0601E1-B65C-11D5-80A9-0000B494D9A6}\setup.exe" -l0x7  -removeonly
PDF 2 Word 2-->C:\WINDOWS\cadkasdeinst01.exe "C:\Programme\PDF 2 Word 2\"
pmaCalc-->"C:\HilfsProgramme\pmaCalc\uninstall.exe"
Project64 1.6-->MsiExec.exe /X{9559F7CA-5E34-4237-A2D9-D856464AD727}
QuickTime-->MsiExec.exe /I{1838C5A2-AB32-4145-85C1-BB9B8DFA24CD}
Real Alternative 1.9.0 Lite-->"C:\hilfsProgramme\Real Alternative\unins000.exe"
Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\setup.exe" REMOVE
Recover My Files-->"C:\Hilfsprogramme\Recover My Files\unins000.exe"
Rocket Mania Deluxe-->"C:\Dokumente und Einstellungen\Admin\Desktop\100MSDCF\Rocket Mania Deluxe\unins000.exe"
Schiffe versenken-->C:\WINDOWS\unvise32.exe e:\Schiffe versenken\uninstal.log
Secret Maryo Chronicles Addon : Music-->"C:\Dokumente und Einstellungen\Admin\Desktop\SMC_v1.5 incl. Music Addon\Neuer Ordner\Secret Maryo Chronicles\uninstall_music.exe"
Secret Maryo Chronicles-->"C:\Dokumente und Einstellungen\Admin\Desktop\SMC_v1.5 incl. Music Addon\Secret Maryo Chronicles\uninstall.exe"
Seven Kingdoms II (remove only)-->"F:\Seven Kingdoms II\Uninstall.exe"
Sid Meier's SimGolf-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{8C4504A1-9280-11D5-9F7E-00902712427E}\setup.exe" 
SILENT HILL 4-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{00BD992A-D4C7-447D-8AA1-60B5759EA30D}\setup.exe" -l0x7 
Silent Hunter Wolves of the Pacific-->C:\Programme\InstallShield Installation Information\{0D005F09-A5F4-473B-A901-5735C6AF5628}\setup.exe -runfromtemp -l0x0007 -removeonly
Skype™ 3.8-->MsiExec.exe /X{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}
Sony Ericsson Media Manager 1.2-->MsiExec.exe /X{98EA51C9-B0B0-45BC-8641-3E119EA47D7B}
Spiel Des Lebens-->C:\WINDOWS\unin0407.exe -fe:\sdl\DeIsL4.isu  -ce:\sdl\_ISREG32.DLL
SPORE™-->"C:\Programme\InstallShield Installation Information\{9DF0196F-B6B8-4C3A-8790-DE42AA530101}\SPORESetup.exe" -runfromtemp -l0x0007 -removeonly
Sprengmeister 1.3.11-->"E:\Sprengmeister\unins000.exe"
Spybot - Search & Destroy-->"C:\HilfsProgramme\Spybot - Search & Destroy\unins000.exe"
Starcraft-->C:\WINDOWS\SCunin.exe C:\WINDOWS\SCunin.dat
Stronghold-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{C917BA70-28A3-4C74-B163-41FD8C8E1A5A}\setup.exe" 
Tiberium DeeZire-->F:\COMMAND & CONQUER û DIE ERSTEN 10 JAHRE\COMMAND & CONQUER(TM) TIBERIAN SUN(TM)\SUN\Uninstal.exe
TmNationsForever-->"F:\TrackMania Nations Forever\unins000.exe"
Tropico 2: Pirate Cove (remove only)-->"F:\Tropico 2 Pirate Cove\Uninstall.exe"
Ultimate Motorcross 1.0-->E:\ULTIMA~1\Setup.exe /remove
Uninstall 1.0.0.0-->"C:\Programme\Gemeinsame Dateien\DVDVideoSoft\unins000.exe"
Vampires Dawn 2-->E:\Vampires Dawn 2\Uninstal.exe
VeohTV BETA-->C:\Programme\InstallShield Installation Information\{0405E51E-9582-4207-8F38-AC44201D3808}\setup.exe -runfromtemp -l0x0409
VideoLAN VLC media player 0.8.5-->C:\Programme\VideoLAN\VLC\uninstall.exe
Viewpoint Media Player-->C:\Programme\Viewpoint\Viewpoint Experience Technology\mtsAxInstaller.exe /u
Westwood Chat 4.221-->"C:\Programme\Westwood Chat\Uninstall.exe"
Winamp-->"C:\Hilfsprogramme\Winamp\UninstWA.exe"
Windows Installer 3.1 (KB893803)-->"C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe"
Windows Media Format 11 runtime-->"C:\Programme\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
WinRAR-->C:\Programme\WinRAR\uninstall.exe
ZoneAlarm-->C:\Programme\Zone Labs\ZoneAlarm\zauninst.exe

======Hosts File======

127.0.0.1	www.007guard.com
127.0.0.1	007guard.com
127.0.0.1	008i.com
127.0.0.1	www.008k.com
127.0.0.1	008k.com
127.0.0.1	www.00hq.com
127.0.0.1	00hq.com
127.0.0.1	010402.com
127.0.0.1	www.032439.com
127.0.0.1	032439.com

======Security center information======

AV: AntiVir Desktop
FW: ZoneAlarm Firewall

======System event log======

Computer Name: SELLE-SEINER
Event Code: 20159
Message: Die Verbindung mit "Vodafone", hergestellt durch den Benutzer "vf3017963511" unter Verwendung des Geräts "PPPoE4-0", wurde getrennt.

Record Number: 14050
Source Name: RemoteAccess
Time Written: 20090325223236.000000+060
Event Type: Informationen
User: 

Computer Name: SELLE-SEINER
Event Code: 20158
Message: Der Benutzer "vf3017963511" hat eine Verbindung mit "Vodafone" hergestellt, unter Verwendung des Geräts "PPPoE4-0".

Record Number: 14049
Source Name: RemoteAccess
Time Written: 20090325194455.000000+060
Event Type: Informationen
User: 

Computer Name: SELLE-SEINER
Event Code: 1007
Message: Die IP-Adresse für die Netzwerkkarte mit der Netzwerkadresse 0011D817EB0B
wurde automatisch durch diesen Computer konfiguriert. Die verwendete IP-Adresse ist 169.254.200.23.

Record Number: 14048
Source Name: Dhcp
Time Written: 20090325194345.000000+060
Event Type: Warnung
User: 

Computer Name: SELLE-SEINER
Event Code: 7036
Message: Dienst "Gatewaydienst auf Anwendungsebene" befindet sich jetzt im Status "Ausgeführt".

Record Number: 14047
Source Name: Service Control Manager
Time Written: 20090325194318.000000+060
Event Type: Informationen
User: 

Computer Name: SELLE-SEINER
Event Code: 7035
Message: Der Steuerbefehl "starten" wurde erfolgreich an den Dienst "Gatewaydienst auf Anwendungsebene" gesendet.

Record Number: 14046
Source Name: Service Control Manager
Time Written: 20090325194318.000000+060
Event Type: Informationen
User: NT-AUTORITÄT\SYSTEM

=====Application event log=====

Computer Name: SELLE-SEINER
Event Code: 4096
Message: Der AntiVir Dienst wurde erfolgreich gestartet!

Record Number: 1436
Source Name: Avira AntiVir
Time Written: 20081002130924.000000+120
Event Type: Informationen
User: NT-AUTORITÄT\SYSTEM

Computer Name: SELLE-SEINER
Event Code: 101
Message: wuauclt (2208) Das Datenbankmodul wurde beendet.

Record Number: 1435
Source Name: ESENT
Time Written: 20081001191806.000000+120
Event Type: Informationen
User: 

Computer Name: SELLE-SEINER
Event Code: 103
Message: wuaueng.dll (2208) SUS20ClientDataStore: Das Datenbankmodul hat die Instanz (0) beendet.

Record Number: 1434
Source Name: ESENT
Time Written: 20081001191806.000000+120
Event Type: Informationen
User: 

Computer Name: SELLE-SEINER
Event Code: 102
Message: wuaueng.dll (2208) SUS20ClientDataStore: Das Datenbankmodul hat eine neue Instanz gestartet (0).

Record Number: 1433
Source Name: ESENT
Time Written: 20081001191305.000000+120
Event Type: Informationen
User: 

Computer Name: SELLE-SEINER
Event Code: 100
Message: wuauclt (2208) Das Datenbankmodul 5.01.2600.2180 ist gestartet.

Record Number: 1432
Source Name: ESENT
Time Written: 20081001191305.000000+120
Event Type: Informationen
User: 

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Programme\QuickTime\QTSystem\
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 4 Stepping 1, GenuineIntel
"PROCESSOR_REVISION"=0401
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"CLASSPATH"=.;C:\Programme\QuickTime\QTSystem\QTJava.zip
"QTJAVA"=C:\Programme\QuickTime\QTSystem\QTJava.zip
"DEVMGR_SHOW_NONPRESENT_DEVICES"=1
"DEVMGR_SHOW_DETAILS"=1
"tvdumpflags"=8

-----------------EOF-----------------

Danke Erstmal!
Seppel

Chris4You · 08.05.2009, 10:51

Bitte folgende Files prüfen:

Dateien Online überprüfen lassen:

Als erstes versteckte Dateien anzeigen lassen! (nur Punkt 1 durchführen!)

Suche die Seite Virtustotal auf, klicke auf den Button „Durchsuchen“ und suche folgende Datei/Dateien:

Code:

ATTFilter

C:\WINDOWS\system32\sw20.exe
C:\WINDOWS\system32\sw24.exe
C:\WINDOWS\system32\drivers\a0z8ugn8.sys
C:\WINDOWS\system32\drivers\atu5vawe.sys
C:\DOKUME~1\Admin\LOKALE~1\Temp\efipsk.sys
I:\INSTALL\GMSIPCI.SYS

Lade nun nacheinander jede/alle Datei/Dateien hoch, und warte bis der Scan vorbei ist. (kann bis zu 2 Minuten dauern.)

Poste im Anschluss das Ergebnis der Auswertung, alles abkopieren und in einen Beitrag einfügen.

Wichtig: Auch die Größenangabe sowie den HASH mit kopieren!

Gmer:
http://www.trojaner-board.de/74908-anleitung-gmer-rootkit-scanner.html
Den Downloadlink findest Du links oben (www.gmer.net/files), dort dann
auf den Button "Download EXE", dabei wird ein zufälliger Name generiert (den und den Pfad wo Du sie gespeichert hast bitte merken).
Starte GMER und schaue, ob es schon was meldet. Macht es das, bitte alle Fragen mit "nein" beantworten, auf den Reiter "rootkit" gehen, wiederum die Frage mit "nein" beantworten und mit Hilfe von copy den Bericht in den Thread einfügen. Meldet es so nichts, gehe auf den Reiter Rootkit und mache einen Scan. ist dieser beendet, wähle Copy und füge den Bericht ein.

Prevx:
http://www.prevx.com/freescan.asp
Falls das Tool was findet, nicht das Log posten sondern einen Screenshot des dann angezeigten Fensters...

chris

Seppel_2 · 10.05.2009, 11:31

Huhu,

Also von den aufgelistetetn Dateien habe ich nur 2 gefunden...hier die Berichte:
sw20.exe

Code:

ATTFilter

<table border="1"><tr><td colspan="4">Datei sw20.exe empfangen 2009.05.10 12:25:08 (CET)</td></tr><tr><td>Antivirus</td><td>Version</td><td>letzte aktualisierung</td><td>Ergebnis</td</tr><tr><td>a-squared</td><td>4.0.0.101</td><td>2009.05.10</td><td>-</td</tr><tr><td>AhnLab-V3</td><td>5.0.0.2</td><td>2009.05.09</td><td>-</td</tr><tr><td>AntiVir</td><td>7.9.0.166</td><td>2009.05.08</td><td>-</td</tr><tr><td>Antiy-AVL</td><td>2.0.3.1</td><td>2009.05.08</td><td>-</td</tr><tr><td>Authentium</td><td>5.1.2.4</td><td>2009.05.09</td><td>-</td</tr><tr><td>Avast</td><td>4.8.1335.0</td><td>2009.05.09</td><td>-</td</tr><tr><td>AVG</td><td>8.5.0.327</td><td>2009.05.10</td><td>-</td</tr><tr><td>BitDefender</td><td>7.2</td><td>2009.05.10</td><td>-</td</tr><tr><td>CAT-QuickHeal</td><td>10.00</td><td>2009.05.09</td><td>-</td</tr><tr><td>ClamAV</td><td>0.94.1</td><td>2009.05.10</td><td>-</td</tr><tr><td>Comodo</td><td>1157</td><td>2009.05.08</td><td>-</td</tr><tr><td>DrWeb</td><td>5.0.0.12182</td><td>2009.05.10</td><td>-</td</tr><tr><td>eSafe</td><td>7.0.17.0</td><td>2009.05.07</td><td>-</td</tr><tr><td>eTrust-Vet</td><td>31.6.6497</td><td>2009.05.08</td><td>-</td</tr><tr><td>F-Prot</td><td>4.4.4.56</td><td>2009.05.09</td><td>-</td</tr><tr><td>F-Secure</td><td>8.0.14470.0</td><td>2009.05.09</td><td>-</td</tr><tr><td>Fortinet</td><td>3.117.0.0</td><td>2009.05.10</td><td>-</td</tr><tr><td>GData</td><td>19</td><td>2009.05.10</td><td>-</td</tr><tr><td>Ikarus</td><td>T3.1.1.49.0</td><td>2009.05.10</td><td>-</td</tr><tr><td>K7AntiVirus</td><td>7.10.729</td><td>2009.05.08</td><td>-</td</tr><tr><td>Kaspersky</td><td>7.0.0.125</td><td>2009.05.10</td><td>-</td</tr><tr><td>McAfee</td><td>5610</td><td>2009.05.09</td><td>-</td</tr><tr><td>McAfee+Artemis</td><td>5610</td><td>2009.05.09</td><td>-</td</tr><tr><td>McAfee-GW-Edition</td><td>6.7.6</td><td>2009.05.10</td><td>-</td</tr><tr><td>Microsoft</td><td>1.4602</td><td>2009.05.10</td><td>-</td</tr><tr><td>NOD32</td><td>4063</td><td>2009.05.08</td><td>-</td</tr><tr><td>Norman</td><td>6.01.05</td><td>2009.05.08</td><td>-</td</tr><tr><td>nProtect</td><td>2009.1.8.0</td><td>2009.05.10</td><td>-</td</tr><tr><td>Panda</td><td>10.0.0.14</td><td>2009.05.10</td><td>-</td</tr><tr><td>PCTools</td><td>4.4.2.0</td><td>2009.05.07</td><td>-</td</tr><tr><td>Prevx</td><td>3.0</td><td>2009.05.10</td><td>-</td</tr><tr><td>Rising</td><td>21.28.62.00</td><td>2009.05.10</td><td>-</td</tr><tr><td>Sophos</td><td>4.41.0</td><td>2009.05.10</td><td>-</td</tr><tr><td>Sunbelt</td><td>3.2.1858.2</td><td>2009.05.09</td><td>-</td</tr><tr><td>Symantec</td><td>1.4.4.12</td><td>2009.05.10</td><td>-</td</tr><tr><td>TheHacker</td><td>6.3.4.1.324</td><td>2009.05.09</td><td>-</td</tr><tr><td>TrendMicro</td><td>8.950.0.1092</td><td>2009.05.08</td><td>-</td</tr><tr><td>VBA32</td><td>3.12.10.4</td><td>2009.05.09</td><td>-</td</tr><tr><td>ViRobot</td><td>2009.5.9.1727</td><td>2009.05.09</td><td>-</td</tr><tr><td>VirusBuster</td><td>4.6.5.0</td><td>2009.05.09</td><td>-</td</tr><tr><td colspan="4">&nbsp;</td></tr><tr><td colspan="4">weitere Informationen</td></tr><tr><td colspan="4">File size: 208896 bytes</td></tr><tr><td colspan="4">MD5...: e6fbb2b7ac79380bbe7c16192b919aeb</td></tr><tr><td colspan="4">SHA1..: 21976135e39314b3464978d5d632c006be3994bb</td></tr><tr><td colspan="4">SHA256: beedd053f8824c3bd792fa634c0d7e265d0752ba90e0186e86b13aab2094e1b6</td></tr><tr><td colspan="4">SHA512: 93297d103b2dbff2ca067c222c9e3fef8c03917cd866f4d5c0398a4db61d8c23<BR>43e8085b9e0f7cad2f761d590447d9047ce152387b8a15505f498d55713f3263</td></tr><tr><td colspan="4">ssdeep: 3072:9Ajo0EEgR7teDS338ssZoBHTpNFQpg23zAsN5aqtzTlLgH:ykxE+JeDSH89<BR>ZoBlMg+9DlLs<BR></td></tr><tr><td colspan="4">PEiD..: -</td></tr><tr><td colspan="4">TrID..: File type identification<BR>Win64 Executable Generic (59.6%)<BR>Win32 Executable MS Visual C++ (generic) (26.2%)<BR>Win32 Executable Generic (5.9%)<BR>Win32 Dynamic Link Library (generic) (5.2%)<BR>Generic Win/DOS Executable (1.3%)</td></tr><tr><td colspan="4">PEInfo: PE Structure information<BR><BR>( base data )<BR>entrypointaddress.: 0x104af<BR>timedatestamp.....: 0x446bcaa8 (Thu May 18 01:15:20 2006)<BR>machinetype.......: 0x14c (I386)<BR><BR>( 4 sections )<BR>name        viradd    virsiz   rawdsiz  ntrpy  md5<BR>.text       0x1000   0x21436   0x22000   6.61  bba27e4278eeaa706e3df0d3a30fcdf2<BR>.rdata     0x23000    0x8222    0x9000   4.66  d041f933702a6777dff4e8c22e5b6f7c<BR>.data      0x2c000    0x663c    0x3000   2.87  048e1370aed0da5654c9e7c11ac420fe<BR>.rsrc      0x33000    0x32c0    0x4000   4.55  6c770f72fc6d18005eea72bdd45b5e89<BR><BR>( 7 imports )  <BR>&gt; KERNEL32.dll: HeapAlloc, HeapFree, HeapReAlloc, VirtualAlloc, RtlUnwind, GetCommandLineA, GetProcessHeap, GetStartupInfoA, RaiseException, ExitProcess, HeapSize, VirtualFree, HeapDestroy, HeapCreate, GetStdHandle, TerminateProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, SetHandleCount, GetFileType, QueryPerformanceCounter, GetTickCount, GetSystemTimeAsFileTime, GetACP, GetConsoleCP, GetConsoleMode, LCMapStringA, LCMapStringW, GetStringTypeA, GetStringTypeW, SetStdHandle, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, SetErrorMode, GetOEMCP, GetCPInfo, GetCurrentProcess, GetThreadLocale, FlushFileBuffers, SetFilePointer, ReadFile, GlobalFlags, WritePrivateProfileStringA, InterlockedIncrement, TlsFree, DeleteCriticalSection, LocalReAlloc, TlsSetValue, TlsAlloc, InitializeCriticalSection, GlobalHandle, GlobalReAlloc, EnterCriticalSection, TlsGetValue, LeaveCriticalSection, LocalAlloc, GlobalGetAtomNameA, GlobalFindAtomA, lstrcmpW, GetVersionExA, InterlockedDecrement, GetModuleFileNameW, FreeResource, GetCurrentProcessId, GlobalAddAtomA, GetCurrentThread, GetCurrentThreadId, ConvertDefaultLocale, GetModuleFileNameA, EnumResourceLanguagesA, GetLocaleInfoA, lstrcmpA, GlobalDeleteAtom, GetModuleHandleA, GlobalFree, GlobalAlloc, GlobalLock, GlobalUnlock, FormatMessageA, LocalFree, FindResourceA, LoadResource, LockResource, SizeofResource, MulDiv, SetLastError, CreateFileA, WriteFile, CloseHandle, LoadLibraryA, GetProcAddress, FreeLibrary, lstrlenA, CompareStringA, GetVersion, GetLastError, WideCharToMultiByte, MultiByteToWideChar, Sleep, InterlockedExchange<BR>&gt; USER32.dll: LoadCursorA, GetSysColorBrush, EndPaint, BeginPaint, ReleaseDC, GetDC, ClientToScreen, GrayStringA, DrawTextExA, DrawTextA, TabbedTextOutA, ShowWindow, SetWindowTextA, IsDialogMessageA, RegisterWindowMessageA, SendDlgItemMessageA, WinHelpA, GetCapture, GetClassLongA, GetClassNameA, SetPropA, GetPropA, RemovePropA, SetFocus, GetWindowTextA, GetForegroundWindow, GetTopWindow, GetMessageTime, GetMessagePos, MapWindowPoints, SetForegroundWindow, UpdateWindow, GetMenu, CreateWindowExA, GetClassInfoExA, GetClassInfoA, RegisterClassA, GetSysColor, AdjustWindowRectEx, CopyRect, PtInRect, GetDlgCtrlID, DefWindowProcA, CallWindowProcA, SetWindowLongA, SetWindowPos, SystemParametersInfoA, GetWindowPlacement, GetWindowRect, GetWindow, UnhookWindowsHookEx, GetDesktopWindow, SetActiveWindow, CreateDialogIndirectParamA, DestroyWindow, IsWindow, MessageBoxA, DrawIcon, GetDlgItem, GetNextDlgTabItem, EndDialog, GetWindowThreadProcessId, GetWindowLongA, GetLastActivePopup, IsWindowEnabled, SetCursor, SetWindowsHookExA, CallNextHookEx, GetMessageA, TranslateMessage, DestroyMenu, UnregisterClassA, SendMessageA, IsIconic, GetClientRect, LoadIconA, EnableWindow, GetSystemMetrics, GetSubMenu, GetMenuItemCount, GetMenuItemID, GetMenuState, PostQuitMessage, PostMessageA, CheckMenuItem, EnableMenuItem, DispatchMessageA, GetActiveWindow, IsWindowVisible, GetKeyState, PeekMessageA, GetCursorPos, ValidateRect, SetMenuItemBitmaps, GetMenuCheckMarkDimensions, LoadBitmapA, GetFocus, GetParent, ModifyMenuA<BR>&gt; GDI32.dll: SetWindowExtEx, ScaleWindowExtEx, DeleteDC, GetStockObject, ScaleViewportExtEx, SetViewportExtEx, OffsetViewportOrgEx, SetViewportOrgEx, SelectObject, Escape, ExtTextOutA, TextOutA, RectVisible, PtVisible, GetDeviceCaps, DeleteObject, SetMapMode, RestoreDC, SaveDC, GetObjectA, SetBkColor, SetTextColor, GetClipBox, CreateBitmap<BR>&gt; WINSPOOL.DRV: ClosePrinter, DocumentPropertiesA, OpenPrinterA<BR>&gt; ADVAPI32.dll: RegQueryValueA, RegEnumKeyA, RegDeleteKeyA, RegOpenKeyA, RegOpenKeyExA, RegQueryValueExA, RegCreateKeyExA, RegSetValueExA, RegCloseKey<BR>&gt; SHLWAPI.dll: PathFindFileNameA, PathFindExtensionA<BR>&gt; OLEAUT32.dll: -, -, -<BR><BR>( 0 exports ) <BR></td></tr><tr><td colspan="4">PDFiD.: -</td></tr><tr><td colspan="4">RDS...: NSRL Reference Data Set<BR>-</td></tr><tr><td colspan="4">CWSandbox info: &lt;a href='http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=e6fbb2b7ac79380bbe7c16192b919aeb' target='_blank'&gt;http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=e6fbb2b7ac79380bbe7c16192b919aeb&lt;/a&gt;</td></tr><tr><td colspan="4">ThreatExpert info: &lt;a href='http://www.threatexpert.com/report.aspx?md5=e6fbb2b7ac79380bbe7c16192b919aeb' target='_blank'&gt;http://www.threatexpert.com/report.aspx?md5=e6fbb2b7ac79380bbe7c16192b919aeb&lt;/a&gt;</td></tr></table>

sw24.exe

Code:

ATTFilter

<table border="1"><tr><td colspan="4">Datei sw24.exe empfangen 2009.05.10 12:28:52 (CET)</td></tr><tr><td>Antivirus</td><td>Version</td><td>letzte aktualisierung</td><td>Ergebnis</td</tr><tr><td>a-squared</td><td>4.0.0.101</td><td>2009.05.10</td><td>-</td</tr><tr><td>AhnLab-V3</td><td>5.0.0.2</td><td>2009.05.09</td><td>-</td</tr><tr><td>AntiVir</td><td>7.9.0.166</td><td>2009.05.08</td><td>-</td</tr><tr><td>Antiy-AVL</td><td>2.0.3.1</td><td>2009.05.08</td><td>-</td</tr><tr><td>Authentium</td><td>5.1.2.4</td><td>2009.05.09</td><td>-</td</tr><tr><td>Avast</td><td>4.8.1335.0</td><td>2009.05.09</td><td>-</td</tr><tr><td>AVG</td><td>8.5.0.327</td><td>2009.05.10</td><td>-</td</tr><tr><td>BitDefender</td><td>7.2</td><td>2009.05.10</td><td>-</td</tr><tr><td>CAT-QuickHeal</td><td>10.00</td><td>2009.05.09</td><td>-</td</tr><tr><td>ClamAV</td><td>0.94.1</td><td>2009.05.10</td><td>-</td</tr><tr><td>Comodo</td><td>1157</td><td>2009.05.08</td><td>-</td</tr><tr><td>DrWeb</td><td>5.0.0.12182</td><td>2009.05.10</td><td>-</td</tr><tr><td>eSafe</td><td>7.0.17.0</td><td>2009.05.07</td><td>-</td</tr><tr><td>eTrust-Vet</td><td>31.6.6497</td><td>2009.05.08</td><td>-</td</tr><tr><td>F-Prot</td><td>4.4.4.56</td><td>2009.05.09</td><td>-</td</tr><tr><td>F-Secure</td><td>8.0.14470.0</td><td>2009.05.09</td><td>-</td</tr><tr><td>Fortinet</td><td>3.117.0.0</td><td>2009.05.10</td><td>-</td</tr><tr><td>GData</td><td>19</td><td>2009.05.10</td><td>-</td</tr><tr><td>Ikarus</td><td>T3.1.1.49.0</td><td>2009.05.10</td><td>-</td</tr><tr><td>K7AntiVirus</td><td>7.10.729</td><td>2009.05.08</td><td>-</td</tr><tr><td>Kaspersky</td><td>7.0.0.125</td><td>2009.05.10</td><td>-</td</tr><tr><td>McAfee</td><td>5610</td><td>2009.05.09</td><td>-</td</tr><tr><td>McAfee+Artemis</td><td>5610</td><td>2009.05.09</td><td>-</td</tr><tr><td>McAfee-GW-Edition</td><td>6.7.6</td><td>2009.05.10</td><td>-</td</tr><tr><td>Microsoft</td><td>1.4602</td><td>2009.05.10</td><td>-</td</tr><tr><td>NOD32</td><td>4063</td><td>2009.05.08</td><td>-</td</tr><tr><td>Norman</td><td>6.01.05</td><td>2009.05.08</td><td>-</td</tr><tr><td>nProtect</td><td>2009.1.8.0</td><td>2009.05.10</td><td>-</td</tr><tr><td>Panda</td><td>10.0.0.14</td><td>2009.05.10</td><td>-</td</tr><tr><td>PCTools</td><td>4.4.2.0</td><td>2009.05.07</td><td>-</td</tr><tr><td>Prevx</td><td>3.0</td><td>2009.05.10</td><td>-</td</tr><tr><td>Rising</td><td>21.28.62.00</td><td>2009.05.10</td><td>-</td</tr><tr><td>Sophos</td><td>4.41.0</td><td>2009.05.10</td><td>-</td</tr><tr><td>Sunbelt</td><td>3.2.1858.2</td><td>2009.05.09</td><td>-</td</tr><tr><td>Symantec</td><td>1.4.4.12</td><td>2009.05.10</td><td>-</td</tr><tr><td>TheHacker</td><td>6.3.4.1.324</td><td>2009.05.09</td><td>-</td</tr><tr><td>TrendMicro</td><td>8.950.0.1092</td><td>2009.05.08</td><td>-</td</tr><tr><td>VBA32</td><td>3.12.10.4</td><td>2009.05.09</td><td>-</td</tr><tr><td>ViRobot</td><td>2009.5.9.1727</td><td>2009.05.09</td><td>-</td</tr><tr><td>VirusBuster</td><td>4.6.5.0</td><td>2009.05.09</td><td>-</td</tr><tr><td colspan="4">&nbsp;</td></tr><tr><td colspan="4">weitere Informationen</td></tr><tr><td colspan="4">File size: 69632 bytes</td></tr><tr><td colspan="4">MD5...: 32441ee0606c4e375dc46743489fb817</td></tr><tr><td colspan="4">SHA1..: 6c203ee88bc0cd764212fc55c97425ab10600bd4</td></tr><tr><td colspan="4">SHA256: b2302e333ccef9d6747e1357fb067e4db6ba66b7995a59fc27c273065b7c763d</td></tr><tr><td colspan="4">SHA512: a1c3d8426982c9a3e2395bbcd5cd936dc9eb9bd37362e822679ca72ceb544f70<BR>eeac271be377d448870fbbe061b0bba3da5c577f5c66320ed1c8a8a40752bea8</td></tr><tr><td colspan="4">ssdeep: 1536:eJNVDSxWry8jweqWH3QuinwDpbgkkGRZtwyRQ:SDLf1fZt3a<BR></td></tr><tr><td colspan="4">PEiD..: -</td></tr><tr><td colspan="4">TrID..: File type identification<BR>Win32 Executable MS Visual C++ (generic) (65.2%)<BR>Win32 Executable Generic (14.7%)<BR>Win32 Dynamic Link Library (generic) (13.1%)<BR>Generic Win/DOS Executable (3.4%)<BR>DOS Executable Generic (3.4%)</td></tr><tr><td colspan="4">PEInfo: PE Structure information<BR><BR>( base data )<BR>entrypointaddress.: 0x29a9<BR>timedatestamp.....: 0x446a8c72 (Wed May 17 02:37:38 2006)<BR>machinetype.......: 0x14c (I386)<BR><BR>( 4 sections )<BR>name        viradd    virsiz   rawdsiz  ntrpy  md5<BR>.text       0x1000    0xafa6    0xb000   6.60  28745c612b94f44faba3a818c92fd271<BR>.rdata      0xc000    0x2b1c    0x3000   5.11  a977e342d51b624adf14fd5dc4532460<BR>.data       0xf000    0x2d38    0x1000   2.42  ec5ffa27e3ec1d30fd02c7f95e78a70d<BR>.rsrc      0x12000     0x9f0    0x1000   3.84  9160f7270dbf051381e725cbffc143f7<BR><BR>( 2 imports )  <BR>&gt; KERNEL32.dll: FreeLibrary, GetProcAddress, LoadLibraryA, CloseHandle, WriteFile, CreateFileA, FlushFileBuffers, GetLastError, GetStringTypeW, GetStringTypeA, LCMapStringW, LCMapStringA, WriteConsoleW, GetConsoleOutputCP, WriteConsoleA, SetStdHandle, GetLocaleInfoA, HeapSize, GetOEMCP, GetACP, GetCPInfo, GetConsoleMode, GetConsoleCP, WideCharToMultiByte, MultiByteToWideChar, InterlockedExchange, HeapAlloc, HeapFree, RaiseException, HeapReAlloc, VirtualAlloc, GetModuleHandleA, RtlUnwind, GetCommandLineA, GetVersionExA, GetProcessHeap, GetStartupInfoA, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, VirtualFree, HeapDestroy, HeapCreate, ExitProcess, GetStdHandle, GetModuleFileNameA, SetUnhandledExceptionFilter, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, IsDebuggerPresent, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, InterlockedIncrement, SetLastError, GetCurrentThreadId, InterlockedDecrement, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, SetHandleCount, GetFileType, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, InitializeCriticalSection, Sleep, SetFilePointer, GetThreadLocale<BR>&gt; USER32.dll: LoadAcceleratorsA, GetMessageA, TranslateAcceleratorA, TranslateMessage, DispatchMessageA, CreateWindowExA, ShowWindow, UpdateWindow, SendMessageA, LoadIconA, LoadCursorA, RegisterClassExA, LoadStringA, DefWindowProcA, DestroyWindow, DialogBoxParamA, BeginPaint, EndPaint, PostQuitMessage, EndDialog<BR><BR>( 0 exports ) <BR></td></tr><tr><td colspan="4">PDFiD.: -</td></tr><tr><td colspan="4">RDS...: NSRL Reference Data Set<BR>-</td></tr><tr><td colspan="4">CWSandbox info: &lt;a href='http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=32441ee0606c4e375dc46743489fb817' target='_blank'&gt;http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=32441ee0606c4e375dc46743489fb817&lt;/a&gt;</td></tr><tr><td colspan="4">ThreatExpert info: &lt;a href='http://www.threatexpert.com/report.aspx?md5=32441ee0606c4e375dc46743489fb817' target='_blank'&gt;http://www.threatexpert.com/report.aspx?md5=32441ee0606c4e375dc46743489fb817&lt;/a&gt;</td></tr></table>

Gmer hat mir folgenden Bericht geliefert:

Code:

ATTFilter

Malwarebytes' Anti-Malware 1.36
Datenbank Version: 2087
Windows 5.1.2600 Service Pack 2

07.05.2009 19:23:53
mbam-log-2009-05-07 (19-23-53).txt

Scan-Methode: Vollständiger Scan (C:\|E:\|F:\|G:\|J:\|)
Durchsuchte Objekte: 276232
Laufzeit: 1 hour(s), 35 minute(s), 33 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 4
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 1
Infizierte Verzeichnisse: 0
Infizierte Dateien: 6

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\anti-leech alnn (Trojan.AntiLeechPlugin) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@anti-leech.com/anti-leech plugin,version=1.0.2.3 (Trojan.AntiLeechPlugin) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Anti-Leech (Trojan.AntiLeechPlugin) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\Hilfsprogramme\AL\ALNN\alhlp.exe (Trojan.AntiLeechPlugin) -> Quarantined and deleted successfully.
C:\Hilfsprogramme\AL\ALNN\npalnn.dll (Trojan.AntiLeechPlugin) -> Quarantined and deleted successfully.
C:\Hilfsprogramme\AL\ALNN\setup2.exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\Programme\Opera\Program\Plugins\alhlp.exe (Trojan.AntiLeechPlugin) -> Quarantined and deleted successfully.
C:\Programme\Opera\Program\Plugins\npalnn.dll (Trojan.AntiLeechPlugin) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{1B6B34DC-A755-485F-8F85-2867A8440DB4}\RP271\A0102003.exe (Trojan.AntiLeechPlugin) -> Quarantined and deleted successfully.

Prevx hat auch was gefunden, hier das Bild:

Trojaner "TR/Agent.imh" in C:\Windows\xvvutjp.inf

Log-Analyse und Auswertung: Trojaner "TR/Agent.imh" in C:\Windows\xvvutjp.inf