Trojaner-Board - DR/Agent.hua!? Backdoor Generic10.AMTQ

sorry...das fehlte noch:
Code:
Sorry...das fehlte noch:
 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 23:29:07, on 31.01.2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal
 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\Programme\Google\Update\GoogleUpdate.exe

C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe

C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToADiMon.exe

C:\Programme\Java\jre1.6.0_07\bin\jusched.exe

C:\PROGRA~1\AVG\AVG8\avgtray.exe

C:\WINDOWS\system32\ctfmon.exe

C:\a-squared Free\a2service.exe

C:\Spybot - Search & Destroy\TeaTimer.exe

C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

C:\Programme\Gemeinsame Dateien\Marmiko Shared\MZCCntrl.exe

C:\Programme\Gemeinsame Dateien\Nikon\Monitor\NkMonitor.exe

C:\WINDOWS\system32\svchost.exe

C:\PROGRA~1\AVG\AVG8\avgemc.exe

C:\PROGRA~1\AVG\AVG8\avgrsx.exe

C:\PROGRA~1\AVG\AVG8\avgnsx.exe

C:\Programme\AVG\AVG8\avgcsrvx.exe

C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis2\kernel.exe

C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis2\sc_watch.exe

C:\WINDOWS\system32\wuauclt.exe

C:\PROGRA~1\T-Online\T-ONLI~1\BASIS-~1\Basis2\PROFIL~1.EXE

C:\PROGRA~1\T-Online\T-ONLI~1\Notifier\Notifier.exe

C:\DOKUME~1\JORGE&~1\LOKALE~1\Temp\230.exe

C:\DOKUME~1\JORGE&~1\LOKALE~1\Temp\905.exe

C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\DOKUME~1\JORGE&~1\LOKALE~1\Temp\338.exe

C:\DOKUME~1\JORGE&~1\LOKALE~1\Temp\910.exe

C:\DOKUME~1\JORGE&~1\LOKALE~1\Temp\155.exe

C:\DOKUME~1\JORGE&~1\LOKALE~1\Temp\249.exe

C:\PROGRAMME\MOZILLA FIREFOX\FIREFOX.EXE

C:\DOKUME~1\JORGE&~1\LOKALE~1\Temp\197.exe

C:\DOKUME~1\JORGE&~1\LOKALE~1\Temp\931.exe

C:\DOKUME~1\JORGE&~1\LOKALE~1\Temp\078.exe

C:\DOKUME~1\JORGE&~1\LOKALE~1\Temp\259.exe

C:\DOKUME~1\JORGE&~1\LOKALE~1\Temp\211.exe

C:\DOKUME~1\JORGE&~1\LOKALE~1\Temp\396.exe

C:\DOKUME~1\JORGE&~1\LOKALE~1\Temp\309.exe

C:\DOKUME~1\JORGE&~1\LOKALE~1\Temp\594.exe

C:\DOKUME~1\JORGE&~1\LOKALE~1\Temp\133.exe

C:\DOKUME~1\JORGE&~1\LOKALE~1\Temp\220.exe

C:\DOKUME~1\JORGE&~1\LOKALE~1\Temp\734.exe

C:\DOKUME~1\JORGE&~1\LOKALE~1\Temp\970.exe

C:\DOKUME~1\JORGE&~1\LOKALE~1\Temp\419.exe

C:\DOKUME~1\JORGE&~1\LOKALE~1\Temp\063.exe

C:\DOKUME~1\JORGE&~1\LOKALE~1\Temp\494.exe

C:\DOKUME~1\JORGE&~1\LOKALE~1\Temp\267.exe

C:\DOKUME~1\JORGE&~1\LOKALE~1\Temp\994.exe

C:\Programme\Windows Live\Messenger\msnmsgr.exe

C:\Programme\Windows Live\Messenger\usnsvc.exe

C:\DOKUME~1\JORGE&~1\LOKALE~1\Temp\364.exe

C:\DOKUME~1\JORGE&~1\LOKALE~1\Temp\328.exe

C:\DOKUME~1\JORGE&~1\LOKALE~1\Temp\241.exe

C:\DOKUME~1\JORGE&~1\LOKALE~1\Temp\936.exe

C:\DOKUME~1\JORGE&~1\LOKALE~1\Temp\963.exe

C:\DOKUME~1\JORGE&~1\LOKALE~1\Temp\211.exe

C:\DOKUME~1\JORGE&~1\LOKALE~1\Temp\138.exe

C:\Programme\Trend Micro\HijackThis\HijackThis.exe

C:\DOKUME~1\JORGE&~1\LOKALE~1\Temp\747.exe

C:\DOKUME~1\JORGE&~1\LOKALE~1\Temp\493.exe
 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://go.microsoft.com/fwlink/?LinkId=69157

O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Programme\AVG\AVG8\avgssie.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_07\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Gears Helper - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - C:\Programme\Google\Google Gears\Internet Explorer\0.5.4.2\gears.dll

O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKLM\..\Run: [ToADiMon.exe] C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToADiMon.exe -TOnlineAutodialStart

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [NapsterShell] C:\Programme\Napster\napster.exe /systray

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre1.6.0_07\bin\jusched.exe"

O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Dokumente und Einstellungen\xxx\Eigene Dateien\3.2\Apps\apdproxy.exe"

O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe

O4 - HKLM\..\Run: [Microsoft(R) System Manager] C:\WINDOWS\system32\sysmgr.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [msnmsgr] "C:\Programme\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [Windows Service help] C:\RECYCLER\S-1-5-21-9430386259-0209844894-372767933-2144\winservices.exe

O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')

O4 - HKUS\S-1-5-19\..\Run: [InfoCockpit] C:\Programme\T-Online\T-Online_Software_6\Info-Cockpit\IC_START.EXE /nosplash (User 'LOKALER DIENST')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Startup: Nikon Monitor.lnk = ?

O8 - Extra context menu item: Download with Xilisoft YouTube Video Converter - C:\Dokumente und Einstellungen\xxx\Desktop\YouTube Video Converter\upod_link.HTM

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra button: (no name) - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Programme\Google\Google Gears\Internet Explorer\0.5.4.2\gears.dll

O9 - Extra 'Tools' menuitem: &Gears-Einstellungen - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Programme\Google\Google Gears\Internet Explorer\0.5.4.2\gears.dll

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\SPYBOT~1\SDHelper.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe

O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab

O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab

O16 - DPF: {CAC677B6-4963-4305-9066-0BD135CD9233} (IPSUploader4 Control) - https://photoservice.fujicolor.de/ips-opdata/operator/19780613/activex/IPSUploader4.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{4A538459-A884-4D59-8523-86F3DC65DD52}: NameServer = 217.237.151.205 217.237.148.70

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Programme\AVG\AVG8\avgpp.dll

O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll

O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\a-squared Free\a2service.exe

O23 - Service: Avira AntiVir Personal – Free Antivirus Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: Ares Chatroom server (AresChatServer) - Unknown owner - C:\Programme\Ares\chatServer.exe (file missing)

O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe

O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

O23 - Service: Google Update Service (gupdate1c91cc414cd4e30) (gupdate1c91cc414cd4e30) - Google Inc. - C:\Programme\Google\Update\GoogleUpdate.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Unknown owner - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe (file missing)

O23 - Service: T-Online WLAN Adapter Steuerungsdienst (MZCCntrl) - Deutsche Telekom AG, Marmiko IT-Solutions GmbH - C:\Programme\Gemeinsame Dateien\Marmiko Shared\MZCCntrl.exe
 

--

End of file - 9346 bytes