Trojaner-Board - IE Fenster und trojaner... (.dll's nicht löschbar =(

Guten abend =)
Ich hab folgendes Problem... Seid längerer Zeit kommt immer wenn ich den IE aufmache ein popup fenster indem mir geraten wird nen Virenscanner zu installieren (der viren installiert^^) also die typische pseudo masche... naja hab mir dabei nix geacht und einfach nur die fenster immer schön weggedrückt... nun ja^^ bis heute... da gibs soweit dass ich MSN und co mich anmelden konnte... und auchs chreiben konnte nur ja IE und opera sagte immer, dass ich keien internet verbindung habe und ja... Ich glaube ich hab mir da was eingefangen^^... Währe super wenn mri da wer helfen könnte...

http://wodritsch.wo.ohost.de/b.JPG

Da hab ich zum 1. mal gesehen was denn da so böhsartig sein kann und ja^^ hab dann mal versucht diese mittels HJT zu killn^^ naja ging nicht war immernoch da... so next try ich festplatte ausgebaut, mir die namen aufgeschrieben und die festplatte annen anderen pc gepackt damit ich die Dll's löschen kann... ja ging auch^^ also alle waren weg nur joa^^ jetzt sind sie wieder da^^ alle...

HJT LOG::

Code:



Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 21:53:33, on 22.10.2008

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Boot mode: Normal
 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Programme\Bonjour\mDNSResponder.exe

C:\WINDOWS\system32\CTsvcCDA.exe

C:\WINDOWS\system32\E_S00RP1.EXE

C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\PnkBstrA.exe

C:\Programme\CyberLink\Shared files\RichVideo.exe

C:\Programme\SiSoftware\SiSoftware Sandra Lite XII.SP2c\RpcAgentSrv.exe

C:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\MsPMSPSv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\nvraidservice.exe

C:\Programme\Creative\SBAudigy LS\Surround Mixer\CTSysVol.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\WINDOWS\VM305_STI.EXE

C:\Programme\iTunes\iTunesHelper.exe

C:\WINDOWS\system32\rundll32.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

C:\Programme\Windows Live\Messenger\MsnMsgr.Exe

C:\Programme\Restart\Restart.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\wbem\unsecapp.exe

C:\Programme\iPod\bin\iPodService.exe

C:\Programme\Opera\opera.exe

C:\Programme\Trend Micro\HijackThis\HijackThis.exe
 

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

O2 - BHO: (no name) - {6C350DFC-885F-4296-82E3-6428DD982099} - C:\WINDOWS\system32\khfFWMFV.dll (file missing)

O2 - BHO: (no name) - {70F99466-D2CF-4F4F-B174-4B2265A28907} - C:\WINDOWS\system32\opnkjkkI.dll (file missing)

O2 - BHO: {07024c77-cb70-a359-c1c4-dda5bf25fa57} - {75af52fb-5add-4c1c-953a-07bc77c42070} - C:\WINDOWS\system32\iztjqq.dll (file missing)

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_03\bin\ssv.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll

O4 - HKLM\..\Run: [NVRaidService] C:\WINDOWS\system32\nvraidservice.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [CTSysVol] C:\Programme\Creative\SBAudigy LS\Surround Mixer\CTSysVol.exe /r

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [BigDog305] C:\WINDOWS\VM305_STI.EXE VIMICRO USB PC Camera (ZC0305)

O4 - HKLM\..\Run: [LXCGCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCGtime.dll,_RunDLLEntry@16

O4 - HKLM\..\Run: [NVCLOCK] rundll32 nvclock.dll,fnNvclock

O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Programme\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [acfe35ea] rundll32.exe "C:\WINDOWS\system32\xdiglfpg.dll",b

O4 - HKCU\..\Run: [MsnMsgr] "C:\Programme\Windows Live\Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Programme\Alcohol Soft\Alcohol 120\axcmd.exe" /automount

O4 - HKCU\..\Run: [Restart] C:\Programme\Restart\Restart.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe

O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe

O20 - AppInit_DLLs: C:\WINDOWS\System32\compobj32.dll iztjqq.dll,C:\WINDOWS\System32\compobj32.dll

O20 - Winlogon Notify: acfe3545448 - C:\WINDOWS\System32\compobj32.dll (file missing)

O20 - Winlogon Notify: khfFWMFV - khfFWMFV.dll (file missing)

O20 - Winlogon Notify: __c008738E - C:\WINDOWS\system32\__c008738E.dat

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Programme\Bonjour\mDNSResponder.exe

O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe

O23 - Service: EPSON V3 Service2(03) (EPSON_PM_RPCV2_01) - SEIKO EPSON CORPORATION - C:\WINDOWS\system32\E_S00RP1.EXE

O23 - Service: Google Updater Service (gusvc) - Google - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Programme\iPod\bin\iPodService.exe

O23 - Service: lxcg_device -   - C:\WINDOWS\system32\lxcgcoms.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Programme\CyberLink\Shared files\RichVideo.exe

O23 - Service: SiSoftware Deployment Agent Service (SandraAgentSrv) - SiSoftware - C:\Programme\SiSoftware\SiSoftware Sandra Lite XII.SP2c\RpcAgentSrv.exe

O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
 

--

End of file - 7527 bytes

Die bisherigen "bösen dlls" waren:

Code:



compobj32.dll 

khfFWMFV.dll 

opnkjkkI.dll 

khfFWMFV.dll 

ewxtitbb.dll 

iztjqq.dll

MalewareBytes scannt gerade^^

Wunderschöne Grüße und vielen dank schonmal an denjenigen der sich meiner einer annimmt^^
SImon

Sooo^^
Hier mal das was das TEil MalewareBytes ausspuckte:

Code:

Malwarebytes' Anti-Malware 1.29

Datenbank Version: 1306

Windows 5.1.2600 Service Pack 3
 

23.10.2008 00:27:11

mbam-log-2008-10-23 (00-27-11).txt
 

Scan-Methode: Vollständiger Scan (C:\|)

Durchsuchte Objekte: 277817

Laufzeit: 1 hour(s), 50 minute(s), 18 second(s)
 

Infizierte Speicherprozesse: 0

Infizierte Speichermodule: 2

Infizierte Registrierungsschlüssel: 17

Infizierte Registrierungswerte: 2

Infizierte Dateiobjekte der Registrierung: 0

Infizierte Verzeichnisse: 0

Infizierte Dateien: 30
 

Infizierte Speicherprozesse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule:

C:\WINDOWS\system32\xdiglfpg.dll (Trojan.Vundo) -> Delete on reboot.

C:\WINDOWS\system32\__c008738E.dat (Trojan.Agent) -> Delete on reboot.
 

Infizierte Registrierungsschlüssel:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6c350dfc-885f-4296-82e3-6428dd982099} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\khffwmfv (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{6c350dfc-885f-4296-82e3-6428dd982099} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{75af52fb-5add-4c1c-953a-07bc77c42070} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{75af52fb-5add-4c1c-953a-07bc77c42070} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\bhonew.bho (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\TypeLib\{15c7d7ad-a87a-4c0d-9d8b-637fcd3488ef} (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{cf4bff2b-b9c5-4c11-ab65-b3baccbf2c6e} (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{ecd99db2-abfa-46ae-a7ee-16d0ddb78258} (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{7fbb2d91-9964-4196-bac5-d5e751762ec3} (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\nimo (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c008738e (Trojan.Vundo) -> Delete on reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
 

Infizierte Registrierungswerte:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\acfe35ea (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{6c350dfc-885f-4296-82e3-6428dd982099} (Trojan.Vundo) -> Quarantined and deleted successfully.
 

Infizierte Dateiobjekte der Registrierung:

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien:

C:\WINDOWS\system32\khfFWMFV.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\iztjqq.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\xdiglfpg.dll (Trojan.Vundo.H) -> Delete on reboot.

C:\WINDOWS\system32\gpflgidx.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\dwo32i.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\Dokumente und Einstellungen\Simso\Eigene Dateien\ICQ\309866179\ReceivedFiles\335108677 Pascal S\Sony Vegas 7 + DVD Architect 4 + keygen\DVD Architect 4.0.125\Sony DVD Architect v4.0 Keygen.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\Dokumente und Einstellungen\Simso\Eigene Dateien\ICQ\309866179\ReceivedFiles\335108677 Pascal S\Sony Vegas 7 + DVD Architect 4 + keygen\Vegas 7.0a\Sony Vegas v7.0a Keygen.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\Dokumente und Einstellungen\Simso\Lokale Einstellungen\Temporary Internet Files\Content.IE5\81CDTZ1P\nd82m0[1] (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Dokumente und Einstellungen\Simso\Lokale Einstellungen\Temporary Internet Files\Content.IE5\FVDERS5Y\ico[1] (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Dokumente und Einstellungen\Simso\Lokale Einstellungen\Temporary Internet Files\Content.IE5\OJMI9GV0\upd105320[1] (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Dokumente und Einstellungen\Simso\Lokale Einstellungen\Temporary Internet Files\Content.IE5\UNJEYK5Q\ico[1] (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{1A8B94FA-BDCE-47E3-8A44-CE5433E4B9DB}\RP23\A0002703.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{1A8B94FA-BDCE-47E3-8A44-CE5433E4B9DB}\RP23\A0002704.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{1A8B94FA-BDCE-47E3-8A44-CE5433E4B9DB}\RP23\A0002705.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{1A8B94FA-BDCE-47E3-8A44-CE5433E4B9DB}\RP23\A0002706.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{4DB4B1CF-05F9-4BE2-A61D-D758E37834A3}\RP383\A0168194.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{4DB4B1CF-05F9-4BE2-A61D-D758E37834A3}\RP428\A0187146.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{4DB4B1CF-05F9-4BE2-A61D-D758E37834A3}\RP428\A0187147.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{4DB4B1CF-05F9-4BE2-A61D-D758E37834A3}\RP428\A0188209.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\geBsQkKc.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\pqsqnnps.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\teqayddn.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\__c008738E.dat (Trojan.Vundo) -> Delete on reboot.

C:\WINDOWS\system32\~.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\__c0026D77.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\__c00883A4.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\__c0091A14.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\__c0094AE8.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\__c00BC962.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Dokumente und Einstellungen\Simso\Lokale Einstellungen\Temp\_A00F9E0CF.exe (Trojan.Agent) -> Quarantined and deleted successfully.