Trojaner-Board - Antivir hat TR/Drop.Delf.dxc gefunden

Hallo,

Antivir hat bei einem Routine-Suchlauf auf meinem Firmen-Laptop folgenden Fund gemacht, obwohl ich nichts runterlade und auch keine Emails mit Anhängen öffne:

Code:

C:\System Volume Information\_restore{568C5D6D-6E98-43B3-AD6D-9886079E5076}\RP110\A0049204.exe

    [FUND]      Ist das Trojanische Pferd TR/Drop.Delf.dxc

Die Suche über Google hat keine effektive Lösung ergeben. Vielleicht kann mir hier ja jemand helfen?

Hier das Logfile von Hijackthis:

Code:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 02:08:38, on 17.11.2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16762)

Boot mode: Normal
 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Programme\Lenovo\Bluetooth Software\bin\btwdins.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Programme\Avira\AntiVir Desktop\sched.exe

C:\Programme\Avira\AntiVir Desktop\avguard.exe

C:\Programme\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe

C:\WINDOWS\system32\agrsmsvc.exe

C:\WINDOWS\system32\CSHelper.exe

C:\WINDOWS\system32\FpLogonServ.exe

C:\Programme\LENOVO\HOTKEY\FNF5SVC.exe

C:\Programme\Java\jre6\bin\jqs.exe

C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Programme\Lenovo\PM Driver\PMSveH.exe

C:\Programme\Advanced Registry Doctor\RegManServ.exe

C:\WINDOWS\system32\svchost.exe

C:\Programme\Gemeinsame Dateien\Lenovo\tvt_reg_monitor_svc.exe

C:\Programme\Lenovo\Rescue and Recovery\rrpservice.exe

C:\Programme\Lenovo\Rescue and Recovery\rrservice.exe

C:\Programme\Gemeinsame Dateien\Lenovo\Scheduler\tvtsched.exe

C:\Programme\Lenovo\Rescue and Recovery\UpdateMonitor.exe

C:\Programme\ThinkPad\ConnectUtilities\AcSvc.exe

c:\programme\lenovo\system update\suservice.exe

C:\WINDOWS\Explorer.EXE

C:\PROGRA~1\Lenovo\PMDRIV~1\PMHandler.exe

C:\WINDOWS\system32\wbem\wmiapsrv.exe

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\Programme\pdf24\PDFBackend.exe

C:\Programme\Lenovo\HOTKEY\TpWAudAp.exe

C:\Programme\ThinkPad\ConnectUtilities\ACWLIcon.exe

C:\Programme\Synaptics\SynTP\SynTPEnh.exe

C:\Programme\Seagate\SystemTray\StxMenuMgr.exe

C:\Programme\Gemeinsame Dateien\Lenovo\Scheduler\scheduler_proxy.exe

C:\PROGRA~1\Lenovo\LENOVO~1\LPMGR.exe

C:\Programme\Lenovo\NPDIRECT\TPFNF7SP.exe

C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe

C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtProc.exe

C:\Programme\Avira\AntiVir Desktop\avgnt.exe

C:\Programme\Java\jre6\bin\jusched.exe

C:\Programme\NetRatingsNetSight\NetSight\NielsenOnline.exe

C:\Programme\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe

C:\Programme\NetRatingsNetSight\NetSight\NielsenOnline.exe

C:\Programme\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe

C:\Programme\Spybot - Search & Destroy\TeaTimer.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Programme\iPrint\iPrint.exe

C:\Programme\Seagate\AutoBackup\MemeoBackup.exe

C:\Programme\Mozilla Firefox\firefox.exe

C:\Programme\Outlook Express\msimn.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Programme\Gemeinsame Dateien\Lenovo\Logger\logmon.exe

C:\Programme\Trend Micro\HijackThis\HijackThis.exe
 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://woe.arcor.net/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = 
 

h**p://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = 
 

h**p://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = 
 

h**p://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = 
 

h**p://go.microsoft.com/fwlink/?LinkId=69157

R3 - URLSearchHook: (no name) -  - (no file)

O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - 
 

C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - 
 

{3049C3E9-B461-4BC5-8870-4C09146192CA} - c:\program 
 

files\real\realplayer\rpbrowserrecordplugin.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - 
 

C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: RoboForm - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Programme\Siber 
 

Systems\AI RoboForm\roboform.dll

O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - 
 

C:\Programme\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - 
 

C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Programme\Siber 
 

Systems\AI RoboForm\roboform.dll

O4 - HKLM\..\Run: [PMHandler] C:\PROGRA~1\Lenovo\PMDRIV~1\PMHandler.exe

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [AzMixerSel] C:\Programme\Realtek\InstallShield\AzMixerSel.exe

O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [PDFPrint] "C:\Programme\pdf24\PDFBackend.exe"

O4 - HKLM\..\Run: [TPWAUDAP] C:\Programme\Lenovo\HOTKEY\TpWAudAp.exe

O4 - HKLM\..\Run: [ACWLIcon] C:\Programme\ThinkPad\ConnectUtilities\ACWLIcon.exe

O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [StxTrayMenu] "C:\Programme\Seagate\SystemTray\StxMenuMgr.exe"

O4 - HKLM\..\Run: [FingerPrintSoftware] "C:\Programme\Lenovo Fingerprint Software\fpapp.exe" 
 

\s

O4 - HKLM\..\Run: [TVT Scheduler Proxy] C:\Programme\Gemeinsame 
 

Dateien\Lenovo\Scheduler\scheduler_proxy.exe

O4 - HKLM\..\Run: [LPManager] C:\PROGRA~1\Lenovo\LENOVO~1\LPMGR.exe

O4 - HKLM\..\Run: [TPFNF7] C:\Programme\Lenovo\NPDIRECT\TPFNF7SP.exe /r

O4 - HKLM\..\Run: [WrtMon.exe] C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programme\Adobe\Reader 
 

8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Programme\Malwarebytes' 
 

Anti-Malware\mbam.exe" /runcleanupscript

O4 - HKCU\..\Run: [RoboForm] "C:\Programme\Siber Systems\AI 
 

RoboForm\RoboTaskBarIcon.exe"

O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & 
 

Destroy\TeaTimer.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - Startup: AutoBackup Launcher.lnk = 
 

C:\Programme\Seagate\AutoBackup\MemeoLauncher.exe

O4 - Global Startup: BTTray.lnk.disabled

O4 - Global Startup: iPrint.lnk = C:\Programme\iPrint\iPrint.exe

O8 - Extra context menu item: Nach Microsoft &Excel exportieren - 
 

res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: RF - Formular ausfüllen - file://C:\Programme\Siber Systems\AI 
 

RoboForm\RoboFormComFillForms.html

O8 - Extra context menu item: RF - Formular speichern - file://C:\Programme\Siber Systems\AI 
 

RoboForm\RoboFormComSavePass.html

O8 - Extra context menu item: RF - Menü anpassen - file://C:\Programme\Siber Systems\AI 
 

RoboForm\RoboFormComCustomizeIEMenu.html

O8 - Extra context menu item: RF - RoboForm-Leiste ein/aus - file://C:\Programme\Siber 
 

Systems\AI RoboForm\RoboFormComShowToolbar.html

O8 - Extra context menu item: Senden an &Bluetooth-Gerät... - C:\Programme\Lenovo\Bluetooth 
 

Software\btsendto_ie_ctx.htm

O9 - Extra button: Ausfüllen - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - 
 

file://C:\Programme\Siber Systems\AI RoboForm\RoboFormComFillForms.html

O9 - Extra 'Tools' menuitem: RF - Formular ausfüllen - 
 

{320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Programme\Siber Systems\AI 
 

RoboForm\RoboFormComFillForms.html

O9 - Extra button: Speichern - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - 
 

file://C:\Programme\Siber Systems\AI RoboForm\RoboFormComSavePass.html

O9 - Extra 'Tools' menuitem: RF - Formular speichern - 
 

{320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Programme\Siber Systems\AI 
 

RoboForm\RoboFormComSavePass.html

O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - 
 

file://C:\Programme\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html

O9 - Extra 'Tools' menuitem: RF - RoboForm-Leiste ein/aus - 
 

{724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Programme\Siber Systems\AI 
 

RoboForm\RoboFormComShowToolbar.html

O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - 
 

C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - 
 

C:\Programme\Lenovo\Bluetooth Software\btsendto_ie.htm

O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - 
 

C:\Programme\Lenovo\Bluetooth Software\btsendto_ie.htm

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - 
 

C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - 
 

{DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - 
 

C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - 
 

C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O20 - Winlogon Notify: ACNotify - ACNotify.dll (file missing)

O20 - Winlogon Notify: ATFUS - C:\WINDOWS\system32\FpWinLogonNp.dll

O23 - Service: Ac Profile Manager Service (AcPrfMgrSvc) - Lenovo  - 
 

C:\Programme\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe

O23 - Service: Access Connections Main Service (AcSvc) - Lenovo  - 
 

C:\Programme\ThinkPad\ConnectUtilities\AcSvc.exe

O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - 
 

C:\WINDOWS\system32\agrsmsvc.exe

O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - 
 

C:\Programme\Avira\AntiVir Desktop\sched.exe

O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir 
 

Desktop\avguard.exe

O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - 
 

C:\Programme\Lenovo\Bluetooth Software\bin\btwdins.exe

O23 - Service: CopySafe Helper Service (CSHelper) - Unknown owner - 
 

C:\WINDOWS\system32\CSHelper.exe

O23 - Service: Fingerprint Server (FingerprintServer) - AuthenTec,Inc - 
 

C:\WINDOWS\system32\FpLogonServ.exe

O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - 
 

C:\Programme\MAGIX\Common\Database\bin\fbserver.exe

O23 - Service: Fn+F5 Service (FNF5SVC) - Lenovo. - 
 

C:\Programme\LENOVO\HOTKEY\FNF5SVC.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - 
 

C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - 
 

C:\Programme\Java\jre6\bin\jqs.exe

O23 - Service: PMSveH - Lenovo - C:\Programme\Lenovo\PM Driver\PMSveH.exe

O23 - Service: Registry Management Service (RegManServ) - Unknown owner - 
 

C:\Programme\Advanced Registry Doctor\RegManServ.exe

O23 - Service: System Update (SUService) - Lenovo Group Limited - 
 

c:\programme\lenovo\system update\suservice.exe

O23 - Service: ThinkVantage Registry Monitor Service - Lenovo Group Limited - 
 

C:\Programme\Gemeinsame Dateien\Lenovo\tvt_reg_monitor_svc.exe

O23 - Service: TVT Backup Protection Service - Unknown owner - C:\Programme\Lenovo\Rescue 
 

and Recovery\rrpservice.exe

O23 - Service: TVT Backup Service - Lenovo Group Limited - C:\Programme\Lenovo\Rescue and 
 

Recovery\rrservice.exe

O23 - Service: TVT Scheduler - Lenovo Group Limited - C:\Programme\Gemeinsame 
 

Dateien\Lenovo\Scheduler\tvtsched.exe

O23 - Service: TVT Windows Update Monitor (TVT_UpdateMonitor) - Lenovo Group Limited - 
 

C:\Programme\Lenovo\Rescue and Recovery\UpdateMonitor.exe
 

--

End of file - 11794 bytes