Trojaner-Board - Abnow.com Weiterleitung von Suchanfragen

Wie schon bei mehreren Leuten hier in letzter Zeit wurde auch ich von diesem Virus infiziert. Zu einem denkbar schlechten Zeitpunkt, da ich gerade eine Projektarbeit verfasse. Deshalb hoffe ich, dass ich vorerst nicht neu aufsetzen muss, da ich auch eine ganze Menge Daten (>500gb ) sichern müsste.

Zu meinem Problem: Seit gestern Abend ca. 22:00 meldet sich ESET NOD32 im Minutentakt und infomiert mich über den Befall mit verschiedenen Trojanern. Das ESET log file habe ich unten gepostet. Im Moment wirkt sich die Infektion so aus, dass Google Suchanfragen zu abnow.com weitergeleitet werden und dass der Web-Schutz von ESET ausgehebelt wurde ("nicht funktional").

Was ich bereits unternommen habe: Systemscan mit NOD32 Antivirus 4 im abgesicherten Modus. Ergebnis: es wurde einiges erkannt und entfernt, aber nicht alles. Beim Neustart erscheint immer eine NOD32 Meldung, dass bestimmte Systemdateien nicht bereinigt werden können, da diese gerade in Verwendung sind...

ad defogger: Programm konnte nicht durchlaufen (hab es eine Stunden laufen lassen), keine Meldung

Hier die logs:
Code:
.

DDS (Ver_2011-08-26.01) - NTFSx86 

Internet Explorer: 8.0.7601.17514  BrowserJavaVersion: 1.6.0_30

Run by Che_Win7 at 15:55:23 on 2012-02-29

Microsoft Windows 7 Ultimate   6.1.7601.1.1252.43.1031.18.2047.1303 [GMT 1:00]

.

AV: ESET NOD32 Antivirus 4.2 *Enabled/Updated* {CB0F8167-5331-BA19-698E-64816B6801A5}

SP: ESET NOD32 Antivirus 4.2 *Enabled/Updated* {706E6083-750B-B597-533E-5FF310EF4B18}

SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\nvvsvc.exe

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe

C:\Windows\system32\nvvsvc.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Windows\system32\svchost.exe -k bthsvcs

C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork

D:\Programme\ESET\ESET NOD32 Antivirus\ekrn.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

D:\Programme\Intelliremote\Intelliservice.exe

C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe

C:\Windows\system32\IoctlSvc.exe

d:\Programme\Sandboxie\SbieSvc.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files\Common Files\VMware\USB\vmware-usbarbitrator.exe

C:\Windows\system32\vmnat.exe

D:\VMWare Player\vmware-authd.exe

C:\Windows\system32\vmnetdhcp.exe

C:\Windows\system32\taskhost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\explorer.exe

C:\Windows\System32\DeltaIITray.exe

D:\Programme\ESET\ESET NOD32 Antivirus\egui.exe

D:\VMWare Player\hqtray.exe

D:\Programme\Adobe\Reader 9.0\Reader\reader_sl.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Windows\System32\StikyNot.exe

C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe

C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Program Files\Common Files\Teleca Shared\logger.exe

C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Program Files\Common Files\Teleca Shared\Generic.exe

C:\Windows\system32\wbem\wmiprvse.exe

D:\Program Files\HTC\HTC Sync\ClientInitiatedStarter\ClientInitiatedStarter.exe

D:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\epmworker.exe

D:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\HTCVBTServer.exe

D:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\FsynSrvStarter.exe

C:\Windows\system32\sppsvc.exe

"C:\Windows\system32\svchost.exe"

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\conhost.exe

.

============== Pseudo HJT Report ===============

.

uInternet Settings,ProxyOverride = *.local;192.168.*.*

uWinlogon: Shell=c:\users\che_win7\appdata\local\951ff772\X

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll

BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

uRun: [RESTART_STICKY_NOTES] c:\windows\system32\StikyNot.exe

uRun: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "c:\program files\common files\nero\lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020

uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun

mRun: [M-Audio Taskbar Icon] c:\windows\system32\DeltaIITray.exe

mRun: [egui] "d:\programme\eset\eset nod32 antivirus\egui.exe" /hide /waitservice

mRun: [NBKeyScan] "c:\program files\nero\nero8\nero backitup\NBKeyScan.exe"

mRun: [Mobile Connectivity Suite] "d:\program files\htc\htc sync\application launcher\Application Launcher.exe" /startoptions

mRun: [VMware hqtray] "d:\vmware player\hqtray.exe"

mRun: [DivXUpdate] "c:\program files\divx\divx update\DivXUpdate.exe" /CHECKNOW

mRun: [Adobe Reader Speed Launcher] "d:\programme\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableLUA = 0 (0x0)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

mPolicies-system: PromptOnSecureDesktop = 0 (0x0)

IE: Nach Microsoft E&xel exportieren - d:\progra~1\micros~1\office12\EXCEL.EXE/3000

LSP: mswsock.dll

LSP: d:\vmware player\vsocklib.dll

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab

TCP: DhcpNameServer = 10.0.0.138 10.0.0.138

TCP: Interfaces\{7A6EF002-C03D-402F-809F-F4FA4E213418} : DhcpNameServer = 172.20.23.254

TCP: Interfaces\{7D72B6D6-E8AB-4233-8471-DD117CE5E1BC} : DhcpNameServer = 10.0.0.138 10.0.0.138

TCP: Interfaces\{CC414F72-53BC-4B5D-AC56-DDCFC67ABD1C} : DhcpNameServer = 10.0.0.138 10.0.0.138

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\users\che_win7\appdata\roaming\mozilla\firefox\profiles\sr0q09q9.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.at/

FF - prefs.js: network.proxy.ftp - 195.138.88.105

FF - prefs.js: network.proxy.ftp_port - 3128

FF - prefs.js: network.proxy.gopher - ec2-46-137-125-64.eu-west-1.compute.amazonaws.com

FF - prefs.js: network.proxy.gopher_port - 3128

FF - prefs.js: network.proxy.http - 195.138.88.105

FF - prefs.js: network.proxy.http_port - 3128

FF - prefs.js: network.proxy.socks - 195.138.88.105

FF - prefs.js: network.proxy.socks_port - 3128

FF - prefs.js: network.proxy.ssl - 195.138.88.105

FF - prefs.js: network.proxy.ssl_port - 3128

FF - prefs.js: network.proxy.type - 0

FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: c:\users\che_win7\appdata\local\google\google earth\plugin\npgeplugin.dll

FF - plugin: d:\programme\adobe\reader 9.0\reader\air\nppdf32.dll

FF - plugin: d:\programme\adobe\reader 9.0\reader\browser\nppdf32.dll

FF - plugin: d:\programme\divx\divx ovs helper\npovshelper.dll

FF - plugin: d:\programme\divx\divx plus web player\npdivx32.dll

FF - plugin: d:\programme\mozilla\firefox\plugins\npdeployJava1.dll

.

============= SERVICES / DRIVERS ===============

.

R0 BtHidBus;Bluetooth HID Bus Service;c:\windows\system32\drivers\BtHidBus.sys [2009-6-17 20744]

R2 eamonm;eamonm;c:\windows\system32\drivers\eamonm.sys [2010-4-7 134024]

R2 ekrn;ESET Service;d:\programme\eset\eset nod32 antivirus\ekrn.exe [2010-4-7 810120]

R2 Intelliservice;Intelliservice;d:\programme\intelliremote\Intelliservice.exe [2011-2-8 118784]

R2 VMUSBArbService;VMware USB Arbitration Service;c:\program files\common files\vmware\usb\vmware-usbarbitrator.exe [2010-11-11 539248]

R3 DELTAII;Service for M-Audio Delta Driver (WDM);c:\windows\system32\drivers\MAudioDelta.sys [2009-7-27 302472]

R3 SbieDrv;SbieDrv;d:\programme\sandboxie\SbieDrv.sys [2010-4-17 115944]

S2 epfwwfpr;epfwwfpr;c:\windows\system32\drivers\epfwwfpr.sys [2010-4-7 96896]

S2 mclserviceatl;Ql12160;c:\windows\system32\svchost.exe -k netsvcs [2009-7-14 20992]

S2 mfeavfk;Cmudau;c:\windows\system32\svchost.exe -k netsvcs [2009-7-14 20992]

S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]

S3 btnetBUs;Bluetooth PAN Bus Service;c:\windows\system32\drivers\btnetBus.sys [2009-6-17 29192]

S3 HTCAND32;HTC Device Driver;c:\windows\system32\drivers\ANDROIDUSB.sys [2009-10-26 25088]

S3 IvtBtBUs;IVT Bluetooth Bus Service;c:\windows\system32\drivers\IvtBtBus.sys [2009-6-17 25480]

S3 MotioninJoyXFilter;MotioninJoy Virtual Xinput device Filter Driver;c:\windows\system32\drivers\MijXfilt.sys [2011-2-6 81168]

S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-2-16 15872]

S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2012-2-16 52224]

S3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\wat\WatAdminSvc.exe [2010-5-20 1343400]

.

=============== Created Last 30 ================

.

2012-02-29 09:53:50        0        --sha-w-        c:\windows\system32\dds_log_trash.cmd

2012-02-28 21:34:45        --------        d-sh--w-        c:\windows\system32\%APPDATA%

2012-02-28 21:03:49        --------        d-sh--w-        c:\users\che_win7\appdata\local\951ff772

2012-02-16 13:29:36        6557240        ----a-w-        c:\programdata\microsoft\windows defender\definition updates\{5a900ece-028e-485e-9f64-1f44c6806e9c}\mpengine.dll

2012-02-16 13:26:28        --------        d-----w-        c:\windows\system32\SPReview

2012-02-16 13:25:26        --------        d-----w-        c:\windows\system32\EventProviders

2012-02-16 13:22:05        1130824        ----a-w-        c:\windows\system32\dfshim.dll

2012-02-16 13:20:59        81920        ----a-w-        c:\windows\system32\userenv.dll

2012-02-16 13:19:59        66048        ----a-w-        c:\windows\system32\w32tm.exe

2012-02-16 13:18:58        65536        ----a-w-        c:\windows\system32\drivers\IPMIDrv.sys

2012-02-16 13:17:45        323072        ----a-w-        c:\windows\system32\drvstore.dll

2012-02-16 13:17:44        257024        ----a-w-        c:\windows\system32\dpx.dll

2012-02-16 12:59:42        393728        ----a-w-        c:\windows\system32\drivers\bthport.sys

2012-02-16 12:59:41        60416        ----a-w-        c:\windows\system32\drivers\BTHUSB.SYS

2012-02-16 12:59:41        219648        ----a-w-        c:\windows\system32\fsquirt.exe

2012-02-16 12:59:30        690688        ----a-w-        c:\windows\system32\msvcrt.dll

2012-02-16 12:59:15        2343424        ----a-w-        c:\windows\system32\win32k.sys

2012-02-16 12:55:17        824144        ----a-w-        c:\programdata\microsoft\ehome\packages\mcespotlight\mcespotlight\SpotlightResources.dll

2012-02-16 11:36:56        48648        ----a-w-        c:\programdata\microsoft\ehome\packages\mceclientux\updateablemarkup\Markup.dll

2012-02-11 08:05:05        --------        d-----w-        c:\program files\Haali

2012-02-10 11:27:48        --------        d-----w-        c:\users\che_win7\appdata\roaming\Intelliremote

2012-02-10 11:27:46        --------        d-----w-        c:\windows\Intelliremote

2012-02-04 16:20:54        --------        d-----w-        c:\users\che_win7\appdata\roaming\Foxit Software

2012-02-04 14:09:25        2048        ----a-w-        c:\windows\system32\tzres.dll

2012-02-04 14:09:11        428032        ----a-w-        c:\windows\system32\vbscript.dll

2012-02-04 14:07:53        96768        ----a-w-        c:\windows\system32\drivers\mrxsmb20.sys

2012-02-04 14:06:56        75776        ----a-w-        c:\windows\system32\psisrndr.ax

2012-02-04 14:06:56        465408        ----a-w-        c:\windows\system32\psisdecd.dll

2012-02-04 14:06:55        204288        ----a-w-        c:\windows\system32\MSNP.ax

2012-02-04 14:06:54        72704        ----a-w-        c:\windows\system32\Mpeg2Data.ax

2012-02-04 14:06:54        59904        ----a-w-        c:\windows\system32\MSDvbNP.ax

2012-02-04 14:06:44        1137664        ----a-w-        c:\windows\system32\mfc42.dll

2012-02-04 14:06:42        1164288        ----a-w-        c:\windows\system32\mfc42u.dll

2012-02-04 14:06:09        67072        ----a-w-        c:\windows\system32\packager.dll

2012-02-04 14:06:06        123904        ----a-w-        c:\windows\system32\poqexec.exe

2012-02-04 14:06:05        34304        ----a-w-        c:\windows\system32\atmlib.dll

2012-02-04 14:06:05        294912        ----a-w-        c:\windows\system32\atmfd.dll

2012-02-04 14:06:01        69632        ----a-w-        c:\windows\system32\drivers\bowser.sys

2012-02-04 14:06:00        38912        ----a-w-        c:\windows\system32\csrsrv.dll

2012-02-01 17:33:49        414368        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl

.

==================== Find3M  ====================

.

2012-02-16 13:40:41        152576        ----a-w-        c:\windows\system32\msclmd.dll

2012-01-29 04:10:42        237072        ------w-        c:\windows\system32\MpSigStub.exe

2009-07-18 14:29:32        5217792        ----a-w-        c:\program files\Proxy Switcher Standard

.

============= FINISH: 15:56:23,76 ===============
danke!