Trojaner-Board - wcs.exe

Hallo
ich habe vor kurzem per Zufall auf meinem Rechner die Datei "wcs.exe" gefunden, da ich diese Datei nich kannte und sich immer beim Abmelden bzw. Ausschalten eine Fehlermeldung mit eben dieser Datei zeigte habe ich sie bei Google gesucht und bin auf dieses Forum gestoßen.
Hier hab ich mir dan HJT herruntergeladen und bin der Anleitung bis zum Schritt "Einsetzen von HJT - Auswertung" gefolgt. Nun bin ich jedoch komplett Planlos und weis nicht weiter. Ich bitte um Eure Hilfe und hoffe auf schnelle Antwort.
MFG Anubis

PS.: anbei das erste Log was ich mit HJT gemacht hat

Code:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 11:52:08, on 18.10.2008

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)

Boot mode: Normal
 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\acs.exe

C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\Acer\Empowering Technology\admServ.exe

C:\Programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe

C:\WINDOWS\Explorer.EXE

C:\Programme\Applications\iebtm.exe

C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe

C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe

C:\Program Files\Atheros\ACU.exe

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\system32\igfxsrvc.exe

C:\Programme\Launch Manager\LManager.exe

C:\Programme\Applications\iebtmm.exe

C:\Programme\Gemeinsame Dateien\Logitech\LComMgr\LVComSX.exe

C:\Programme\Synaptics\SynTP\SynTPEnh.exe

C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe

C:\Acer\Empowering Technology\admtray.exe

C:\Programme\Hewlett-Packard\HP Software Update\HPWuSchd.exe

C:\Programme\HP\hpcoretech\hpcmpmgr.exe

C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe

C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Programme\Messenger\msmsgs.exe

C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\system32\igfxext.exe

C:\DOKUME~1\WINKLE~1.WIN\LOKALE~1\Temp\RtkBtMnt.exe

C:\Programme\Applications\wcm.exe

C:\Programme\Applications\wcs.exe

C:\Programme\Internet Explorer\iexplore.exe

C:\Programme\Internet Explorer\iexplore.exe

C:\Programme\Internet Explorer\iexplore.exe

C:\Dokumente und Einstellungen\XXX\Desktop\HiJackThis.exe
 

R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = h**p://windiwsfsearch.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://de.intl.acer.yahoo.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = h**p://windiwsfsearch.com/ie6.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://windiwsfsearch.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://de.intl.acer.yahoo.com

O2 - BHO: 675873 helper - {030A0F33-5B99-482E-83F5-2EEB8457878B} - C:\WINDOWS\system32\675873\675873.dll

O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: VirRLWarningBHO Class - {A81EBFD7-0FA3-41ec-B60D-6DAE78B4D31A} - C:\Programme\VirRL2009\VirRLWarning.dll (file missing)

O2 - BHO: (no name) - {BE1A344F-9FF5-4024-949B-52205E6DB2D0} - C:\Programme\Applications\iebt.dll

O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll

O3 - Toolbar: Internet Service - {144A6B24-0EBC-4D89-BF09-A06A718E57B5} - C:\Programme\Applications\iebr.dll

O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Programme\isuspm.exe" -startup

O4 - HKLM\..\Run: [ISUSScheduler] "C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe" -start

O4 - HKLM\..\Run: [Acer Assist Launcher] C:\Programme\Acer Assist\launcher.exe

O4 - HKLM\..\Run: [ACU] "C:\Program Files\Atheros\ACU.exe" -nogui

O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [AzMixerSel] C:\Programme\Realtek\InstallShield\AzMixerSel.exe

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [LManager] C:\Programme\Launch Manager\LManager.exe

O4 - HKLM\..\Run: [LVCOMSX] "C:\Programme\Gemeinsame Dateien\Logitech\LComMgr\LVComSX.exe"

O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe

O4 - HKLM\..\Run: [ADMTray.exe] "C:\Acer\Empowering Technology\admtray.exe"

O4 - HKLM\..\Run: [HP Software Update] "C:\Programme\Hewlett-Packard\HP Software Update\HPWuSchd.exe"

O4 - HKLM\..\Run: [HP Component Manager] "C:\Programme\HP\hpcoretech\hpcmpmgr.exe"

O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe

O4 - HKLM\..\Run: [DeviceDiscovery] C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background

O4 - HKLM\..\Policies\Explorer\Run: [smile] C:\Programme\Applications\wcs.exe

O4 - HKLM\..\Policies\Explorer\Run: [start] C:\Programme\Applications\iebtm.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: BTTray.lnk = ?

O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\Programme\Microsoft Office\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Senden an &Bluetooth-Gerät... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

O9 - Extra button: (no name) - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.howtoiexplorer.com/redirect.php (file missing)

O9 - Extra 'Tools' menuitem: IE Anti-Spyware - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.howtoiexplorer.com/redirect.php (file missing)

O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\OFFICE11\REFIEBAR.DLL

O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe

O22 - SharedTaskScheduler: amenity - {fef6ace8-bb45-4009-8342-63415164d691} - C:\WINDOWS\system32\bmztmss.dll

O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe

O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: AdminWorks Agent X6 (AWService) - Avocent Inc. - C:\Acer\Empowering Technology\admServ.exe

O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe

O23 - Service: hpdj - HP - C:\DOKUME~1\WINKLE~1.WIN\LOKALE~1\Temp\hpdj.exe

O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Programme\Gemeinsame Dateien\Logitech\SrvLnch\SrvLnch.exe

O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\Windows\System32\ZoneLabs\vsmon.exe
 

--

End of file - 8266 bytes

Danke für die Informationen
ich hatte gehofft das es nich so schlimm ist ich hatte vor kurzer zeit(so ca. vor fünf Tagen) schon mal CCleaner und Avira AntiVir drüber laufen lassen und Avira hatte nur 2 verdächtige Dateien und 12 Warnungen gehabt.

Na ja aber nun auch egal
also hier die logs

von SmitfraudFix

Code:

SmitFraudFix v2.364
 

Scan done at 21:34:48,76, 18.10.2008

Run from C:\Dokumente und Einstellungen\XXX\Desktop\SmitfraudFix

OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT

The filesystem type is NTFS

Fix run in normal mode
 

»»»»»»»»»»»»»»»»»»»»»»»» Process
 

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\acs.exe

C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\Acer\Empowering Technology\admServ.exe

C:\Programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe

C:\WINDOWS\Explorer.EXE

C:\Programme\Applications\iebtm.exe

C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe

C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe

C:\Program Files\Atheros\ACU.exe

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\system32\igfxsrvc.exe

C:\Programme\Launch Manager\LManager.exe

C:\Programme\Applications\iebtmm.exe

C:\Programme\Gemeinsame Dateien\Logitech\LComMgr\LVComSX.exe

C:\Programme\Synaptics\SynTP\SynTPEnh.exe

C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe

C:\Acer\Empowering Technology\admtray.exe

C:\Programme\Hewlett-Packard\HP Software Update\HPWuSchd.exe

C:\Programme\HP\hpcoretech\hpcmpmgr.exe

C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe

C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Programme\Messenger\msmsgs.exe

C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\system32\igfxext.exe

C:\DOKUME~1\WINKLE~1.WIN\LOKALE~1\Temp\RtkBtMnt.exe

C:\Programme\Applications\wcm.exe

C:\Programme\Applications\wcs.exe

C:\Programme\Internet Explorer\iexplore.exe

C:\Dokumente und Einstellungen\Winkler.WINKLER-PC\Desktop\HiJackThis.exe

C:\Programme\Internet Explorer\iexplore.exe

C:\WINDOWS\system32\cmd.exe
 

»»»»»»»»»»»»»»»»»»»»»»»» hosts
 
 

»»»»»»»»»»»»»»»»»»»»»»»» C:\
 
 

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS
 
 

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system
 
 

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web
 
 

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32
 

C:\WINDOWS\system32\algg.exe FOUND !
 

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles
 
 

»»»»»»»»»»»»»»»»»»»»»»»» C:\Dokumente und Einstellungen\XXX
 
 

»»»»»»»»»»»»»»»»»»»»»»»» C:\Dokumente und Einstellungen\XXX\Application Data
 
 

»»»»»»»»»»»»»»»»»»»»»»»» Start Menu
 

C:\DOKUME~1\ALLUSE~1.WIN\STARTM~1\Antivirus Scan.url FOUND !

C:\DOKUME~1\ALLUSE~1.WIN\STARTM~1\Online Spyware Test.url FOUND !
 

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOKUME~1\WINKLE~1.WIN\FAVORI~1
 
 

»»»»»»»»»»»»»»»»»»»»»»»» Desktop
 
 

»»»»»»»»»»»»»»»»»»»»»»»» C:\Programme 
 
 

»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys
 
 

»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

 

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]

"Source"="About:Home"

"SubscribedURL"="About:Home"

"FriendlyName"="Die derzeitige Homepage"

 
 

»»»»»»»»»»»»»»»»»»»»»»»» o4Patch

!!!Attention, following keys are not inevitably infected!!!
 

o4Patch

Credits: Malware Analysis & Diagnostic

Code: S!Ri
 
 
 

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

!!!Attention, following keys are not inevitably infected!!!
 

IEDFix

Credits: Malware Analysis & Diagnostic

Code: S!Ri
 
 
 

»»»»»»»»»»»»»»»»»»»»»»»» VACFix

!!!Attention, following keys are not inevitably infected!!!
 

VACFix

Credits: Malware Analysis & Diagnostic

Code: S!Ri
 
 

»»»»»»»»»»»»»»»»»»»»»»»» 404Fix

!!!Attention, following keys are not inevitably infected!!!
 

404Fix

Credits: Malware Analysis & Diagnostic

Code: S!Ri

+--------------------------------------------------+

[!] Suspicious: 675873.dll

BHO: 675873 Class - {030A0F33-5B99-482E-83F5-2EEB8457878B}

BHO CLSID TypeLib: {E63648F7-3933-440E-AAAA-A8584DD7B7EB}

Corrected TypeLib: {E63648F7-3933-440E-B4F6-A8584DD7B7EB}

Interface: {F7D09218-46D7-4D3D-9B7F-315204CD0836}
 
 

»»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix

!!!Attention, following keys are not inevitably infected!!!
 

AntiXPVSTFix

Credits: Malware Analysis & Diagnostic

Code: S!Ri
 
 
 

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler

!!!Attention, following keys are not inevitably infected!!!
 

SrchSTS.exe by S!Ri

Search SharedTaskScheduler's .dll
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]

"{fef6ace8-bb45-4009-8342-63415164d691}"="amenity"
 

[HKEY_CLASSES_ROOT\CLSID\{fef6ace8-bb45-4009-8342-63415164d691}\InProcServer32]

@="C:\WINDOWS\system32\bmztmss.dll"
 

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{fef6ace8-bb45-4009-8342-63415164d691}\InProcServer32]

@="C:\WINDOWS\system32\bmztmss.dll"
 
 
 

»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs

!!!Attention, following keys are not inevitably infected!!!
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"AppInit_DLLs"=""
 
 

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon

!!!Attention, following keys are not inevitably infected!!!
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]

"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"

"System"=""
 
 

»»»»»»»»»»»»»»»»»»»»»»»» RK
 
 
 

»»»»»»»»»»»»»»»»»»»»»»»» DNS
 

Description: Atheros AR5005G Wireless Network Adapter - Paketplaner-Miniport

DNS Server Search Order: 192.168.1.254
 

HKLM\SYSTEM\CCS\Services\Tcpip\..\{F60EE6D3-C42F-4095-9DAD-3C145475031B}: DhcpNameServer=192.168.1.254

HKLM\SYSTEM\CS1\Services\Tcpip\..\{F60EE6D3-C42F-4095-9DAD-3C145475031B}: DhcpNameServer=192.168.1.254

HKLM\SYSTEM\CS3\Services\Tcpip\..\{F60EE6D3-C42F-4095-9DAD-3C145475031B}: DhcpNameServer=192.168.1.254

HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.254

HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.254

HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.254
 
 

»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection
 
 

»»»»»»»»»»»»»»»»»»»»»»»» End

von Malwarebytes' Anti-Malware

Code:

Malwarebytes' Anti-Malware 1.29

Datenbank Version: 1286

Windows 5.1.2600 Service Pack 3
 

19.10.2008 09:00:43

mbam-log-2008-10-19 (09-00-43).txt
 

Scan-Methode: Vollständiger Scan (C:\|D:\|)

Durchsuchte Objekte: 218937

Laufzeit: 2 hour(s), 29 minute(s), 59 second(s)
 

Infizierte Speicherprozesse: 4

Infizierte Speichermodule: 3

Infizierte Registrierungsschlüssel: 26

Infizierte Registrierungswerte: 5

Infizierte Dateiobjekte der Registrierung: 5

Infizierte Verzeichnisse: 3

Infizierte Dateien: 26
 

Infizierte Speicherprozesse:

C:\Programme\Applications\iebtm.exe (Trojan.Zlob) -> Unloaded process successfully.

C:\Programme\Applications\iebtmm.exe (Trojan.Zlob) -> Unloaded process successfully.

C:\Programme\Applications\wcm.exe (Trojan.Zlob) -> Unloaded process successfully.

C:\Programme\Applications\wcs.exe (Trojan.Zlob) -> Unloaded process successfully.
 

Infizierte Speichermodule:

C:\Windows\System32\675873\675873.dll (Trojan.BHO) -> Delete on reboot.

C:\Windows\System32\bmztmss.dll (Trojan.Zlob) -> Delete on reboot.

C:\Programme\Applications\iebt.dll (Trojan.Zlob) -> Delete on reboot.
 

Infizierte Registrierungsschlüssel:

HKEY_CLASSES_ROOT\CLSID\{fef6ace8-bb45-4009-8342-63415164d691} (Trojan.Zlob.H) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\TypeLib\{e63648f7-3933-440e-b4f6-a8584dd7b7eb} (Trojan.BHO) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{f7d09218-46d7-4d3d-9b7f-315204cd0836} (Trojan.BHO) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{030a0f33-5b99-482e-83f5-2eeb8457878b} (Trojan.BHO) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{030a0f33-5b99-482e-83f5-2eeb8457878b} (Trojan.BHO) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\virrlwarning.warningbho (Trojan.Zlob) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\virrlwarning.warningbho.1 (Trojan.Zlob) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\z444.z444mgr (Trojan.BHO) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\z444.z444mgr.1 (Trojan.BHO) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{967a494a-6aec-4555-9caf-fa6eb00acf91} (Rogue.PestPatrol) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{9692be2f-eb8f-49d9-a11c-c24c1ef734d5} (Rogue.PestPatrol) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{144a6b24-0ebc-4d89-bf09-a06a718e57b5} (Trojan.Zlob) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{be1a344f-9ff5-4024-949b-52205e6db2d0} (Trojan.Zlob) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{be1a344f-9ff5-4024-949b-52205e6db2d0} (Trojan.Zlob) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{a81ebfd7-0fa3-41ec-b60d-6dae78b4d31a} (Trojan.Zlob) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{F5734812-E6A1-8833-ECA9-949B5B8A88BF} (Trojan.Zlob) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Typelib\{a8954909-1f0f-41a5-a7fa-3b376d69e226} (Rogue.PestPatrol) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{daed9266-8c28-4c1c-8b58-5c66eff1d302} (Search.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a81ebfd7-0fa3-41ec-b60d-6dae78b4d31a} (Trojan.Zlob) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{9034a523-d068-4be8-a284-9df278be776e} (Trojan.Zlob) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Windows Safety Alert (Trojan.Zlob) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\e405.e405mgr (Trojan.Zlob) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEBrowse Tool (Trojan.Zlob) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IExplorer Bar (Trojan.Zlob) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Warning Center (Trojan.Zlob) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\multimediaControls.chl (Trojan.Zlob) -> Quarantined and deleted successfully.
 

Infizierte Registrierungswerte:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{fef6ace8-bb45-4009-8342-63415164d691} (Trojan.Zlob.H) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{144a6b24-0ebc-4d89-bf09-a06a718e57b5} (Trojan.Zlob) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{9034a523-d068-4be8-a284-9df278be776e} (Trojan.Zlob) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\start (Trojan.Zlob) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\smile (Trojan.Zlob) -> Quarantined and deleted successfully.
 

Infizierte Dateiobjekte der Registrierung:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchURL (Hijack.Search) -> Bad: (h**p://windiwsfsearch.com) Good: (h**p://www.google.com/) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page (Hijack.Search) -> Bad: (h**p://windiwsfsearch.com) Good: (h**p://www.google.com/) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Search Bar (Hijack.Search) -> Bad: (h**p://windiwsfsearch.com/ie6.html) Good: (h**p://www.google.com/) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\SearchMigratedDefaultURL (Hijack.Search) -> Bad: (h**p://windiwsfsearch.com/search?q={searchTerms}) Good: (h**p://www.google.com/) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchUrl\w\ (Hijack.Search) -> Bad: (h**p://windiwsfsearch.com/search?q=%s) Good: (h**p://www.google.com/) -> Quarantined and deleted successfully.
 

Infizierte Verzeichnisse:

C:\Programme\VirRL2009 (Rogue.AntiVirusLab) -> Quarantined and deleted successfully.

C:\Programme\VideoAccessCodec (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\Windows\System32\675873 (Trojan.BHO) -> Delete on reboot.
 

Infizierte Dateien:

C:\Windows\System32\bmztmss.dll (Trojan.Zlob.H) -> Delete on reboot.

C:\Windows\System32\675873\675873.dll (Trojan.BHO) -> Delete on reboot.

C:\Programme\Applications\iebr.dll (Trojan.Zlob) -> Quarantined and deleted successfully.

C:\Programme\Applications\iebt.dll (Trojan.Zlob) -> Delete on reboot.

C:\System Volume Information\_restore{14C46F5A-3CDA-4288-944E-7A390B2E91B1}\RP61\A0010187.exe (Rogue.Installer) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{14C46F5A-3CDA-4288-944E-7A390B2E91B1}\RP62\A0010260.exe (Rogue.Installer) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{14C46F5A-3CDA-4288-944E-7A390B2E91B1}\RP62\A0010261.exe (Rogue.Installer) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{14C46F5A-3CDA-4288-944E-7A390B2E91B1}\RP64\A0010600.exe (Rogue.Installer) -> Quarantined and deleted successfully.

C:\Programme\VideoAccessCodec\install.ico (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\Programme\VideoAccessCodec\Uninstall.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\Windows\System32\algg.exe (Trojan.Zlob) -> Quarantined and deleted successfully.

C:\Dokumente und Einstellungen\All Users.WINDOWS\Startmenü\Antivirus Scan.url (Trojan.Zlob) -> Quarantined and deleted successfully.

C:\Dokumente und Einstellungen\All Users.WINDOWS\Startmenü\Online Spyware Test.url (Trojan.Zlob) -> Quarantined and deleted successfully.

C:\Programme\Applications\iebtm.exe (Trojan.Zlob) -> Quarantined and deleted successfully.

C:\Programme\Applications\iebtmm.exe (Trojan.Zlob) -> Quarantined and deleted successfully.

C:\Programme\Applications\iebtu.exe (Trojan.Zlob) -> Quarantined and deleted successfully.

C:\Programme\Applications\iebu.exe (Trojan.Zlob) -> Quarantined and deleted successfully.

C:\Programme\Applications\myd.ico (Trojan.Zlob) -> Quarantined and deleted successfully.

C:\Programme\Applications\mym.ico (Trojan.Zlob) -> Quarantined and deleted successfully.

C:\Programme\Applications\myp.ico (Trojan.Zlob) -> Quarantined and deleted successfully.

C:\Programme\Applications\myv.ico (Trojan.Zlob) -> Quarantined and deleted successfully.

C:\Programme\Applications\ot.ico (Trojan.Zlob) -> Quarantined and deleted successfully.

C:\Programme\Applications\ts.ico (Trojan.Zlob) -> Quarantined and deleted successfully.

C:\Programme\Applications\wcm.exe (Trojan.Zlob) -> Quarantined and deleted successfully.

C:\Programme\Applications\wcs.exe (Trojan.Zlob) -> Quarantined and deleted successfully.

C:\Programme\Applications\wcu.exe (Trojan.Zlob) -> Quarantined and deleted successfully.

und von SUPERAntiSpyware

Code:

SUPERAntiSpyware Scan Log

http://www.superantispyware.com
 

Generated 10/19/2008 at 11:40 AM
 

Application Version : 4.21.1004
 

Core Rules Database Version : 3602

Trace Rules Database Version: 1588
 

Scan type       : Custom Scan

Total Scan Time : 01:58:12
 

Memory items scanned      : 402

Memory threats detected   : 0

Registry items scanned    : 4511

Registry threats detected : 6

File items scanned        : 176246

File threats detected     : 23
 

Rootkit.Rustock/Variant

        HKLM\System\ControlSet001\Services\winequfm

        C:\WINDOWS\SYSTEM32\DRIVERS\WINEQUFM.SYS

        HKLM\System\ControlSet001\Enum\Root\LEGACY_winequfm

        HKLM\System\ControlSet003\Services\winequfm

        HKLM\System\ControlSet003\Enum\Root\LEGACY_winequfm

        HKLM\System\CurrentControlSet\Services\winequfm

        HKLM\System\CurrentControlSet\Enum\Root\LEGACY_winequfm
 

Adware.Tracking Cookie

        C:\Dokumente und Einstellungen\XXX\Cookies\XXX@exoclick[1].txt

        C:\Dokumente und Einstellungen\XXX\Cookies\XXX@doubleclick[1].txt

        C:\Dokumente und Einstellungen\XXX\Cookies\XXX@cgi-bin[2].txt

        C:\Dokumente und Einstellungen\XXX\Cookies\XXX@12finder[1].txt

        C:\Dokumente und Einstellungen\XXX\Cookies\XXX@advertising[2].txt

        C:\Dokumente und Einstellungen\XXX\Cookies\XXX@tacoda[2].txt

        C:\Dokumente und Einstellungen\XXX\Cookies\XXX@ad.yieldmanager[1].txt

        C:\Dokumente und Einstellungen\XXX\Cookies\XXX@webmasterplan[2].txt

        C:\Dokumente und Einstellungen\XXX\Cookies\XXX@de.pcvirusremover2008[1].txt

        C:\Dokumente und Einstellungen\XXX\Cookies\XXX@komtrack[2].txt

        C:\Dokumente und Einstellungen\XXX\Cookies\XXX@adtrafficstats[2].txt
 

Adware.Media-Codec/ZLob

        C:\Programme\Applications
 

Trojan.FakeAlert-IEBT

        C:\SYSTEM VOLUME INFORMATION\_RESTORE{14C46F5A-3CDA-4288-944E-7A390B2E91B1}\RP61\A0010197.DLL

        C:\SYSTEM VOLUME INFORMATION\_RESTORE{14C46F5A-3CDA-4288-944E-7A390B2E91B1}\RP62\A0010245.DLL

        C:\SYSTEM VOLUME INFORMATION\_RESTORE{14C46F5A-3CDA-4288-944E-7A390B2E91B1}\RP63\A0010375.DLL

        C:\SYSTEM VOLUME INFORMATION\_RESTORE{14C46F5A-3CDA-4288-944E-7A390B2E91B1}\RP63\A0010543.DLL

        C:\SYSTEM VOLUME INFORMATION\_RESTORE{14C46F5A-3CDA-4288-944E-7A390B2E91B1}\RP63\A0010594.DLL

        C:\SYSTEM VOLUME INFORMATION\_RESTORE{14C46F5A-3CDA-4288-944E-7A390B2E91B1}\RP64\A0010609.DLL

        C:\SYSTEM VOLUME INFORMATION\_RESTORE{14C46F5A-3CDA-4288-944E-7A390B2E91B1}\RP65\A0010656.DLL
 

Trojan.Unclassified-Packed/Suspicious

        C:\SYSTEM VOLUME INFORMATION\_RESTORE{14C46F5A-3CDA-4288-944E-7A390B2E91B1}\RP65\A0010613.DLL
 

Rogue.Windows AntiVirus 2008-Installer

        C:\USERS\XXX\LOKALE EINSTELLUNGEN\TEMPORARY INTERNET FILES\CONTENT.IE5\LMT19SE2\WAV2008SETUP[1].EXE

        C:\USERS\XXX\LOKALE EINSTELLUNGEN\TEMPORARY INTERNET FILES\CONTENT.IE5\KBWLYN8J\WAV2008SETUP[1].EXE