Trojaner-Board - Sparkassen Trojaner die nächste...

Hier noch einige Infos:

dds

[QUOTE].DDS Logfile:
Code:
DDS (Ver_2011-08-26.01) - NTFSx86 

Internet Explorer: 8.0.6001.18702  BrowserJavaVersion: 1.6.0_29

Run by DJ at 20:14:40 on 2012-04-03

Microsoft Windows XP Home Edition  5.1.2600.3.1252.49.1031.18.3327.2354 [GMT 2:00]

.

AV: Avira Desktop *Enabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}

.

============== Running Processes ===============

.

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost -k DcomLaunch

C:\WINDOWS\system32\svchost -k rpcss

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k NetworkService

C:\WINDOWS\system32\svchost.exe -k LocalService

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Programme\Avira\AntiVir Desktop\sched.exe

C:\WINDOWS\system32\svchost.exe -k LocalService

C:\Programme\AAVUpdateManager\aavus.exe

C:\Programme\Avira\AntiVir Desktop\avguard.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\runservice.exe

C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Programme\Spyware Terminator\st_rsser.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Programme\Gemeinsame Dateien\Pure Networks Shared\Platform\nmsrvc.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Programme\Avira\AntiVir Desktop\avshadow.exe

C:\WINDOWS\System32\alg.exe

C:\Programme\Gemeinsame Dateien\Pure Networks Shared\Platform\nmctxth.exe

C:\Programme\Linksys\Linksys Wireless Manager\LinksysWirelessManager.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe

C:\Programme\Spyware Terminator\SpywareTerminatorShield.exe

C:\Programme\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\Programme\Avira\AntiVir Desktop\avgnt.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Programme\Windows Live\Messenger\msnmsgr.exe

C:\Programme\Messenger\msmsgs.exe

C:\Programme\Gemeinsame Dateien\Ahead\lib\NMBgMonitor.exe

C:\Programme\Spybot - Search & Destroy\TeaTimer.exe

C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe

C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe

C:\Programme\ATI Technologies\ATI.ACE\Core-Static\ccc.exe

C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe

C:\Programme\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Programme\Mozilla Firefox\firefox.exe

C:\Programme\Mozilla Firefox\plugin-container.exe

\\?\C:\WINDOWS\system32\WBEM\WMIADAP.EXE

C:\WINDOWS\system32\wbem\wmiprvse.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = about:blank

mSearchAssistant = about:blank

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\programme\gemeinsame dateien\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\programme\spybot - search & destroy\SDHelper.dll

BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File

BHO: IE5BarLauncherBHO Class: {78f3a323-798e-4aea-9a57-88f4b05fd5dd} - c:\programme\vshare.tv plugin\BarLcher.dll

BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\programme\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\programme\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: VShareToolBar: {7ac3e13b-3bca-4158-b330-f66dbb03c1b5} - c:\programme\vshare.tv plugin\BarLcher.dll

uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe

uRun: [msnmsgr] "c:\programme\windows live\messenger\msnmsgr.exe" /background

uRun: [Spiele Post] c:\programme\oxxogames\gplayer\GameCenterNotifier.exe

uRun: [MSMSGS] "c:\programme\messenger\msmsgs.exe" /background

uRun: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "c:\programme\gemeinsame dateien\ahead\lib\NMBgMonitor.exe"

uRun: [SpybotSD TeaTimer] c:\programme\spybot - search & destroy\TeaTimer.exe

uRun: [SpybotSD TeaTimer] c:\programme\spybot - search & destroy\TeaTimer.exe

mRun: [nmctxth] "c:\programme\gemeinsame dateien\pure networks shared\platform\nmctxth.exe"

mRun: [Linksys Wireless Manager] "c:\programme\linksys\linksys wireless manager\LinksysWirelessManager.exe" /cm /min /lcid 1031

mRun: [RTHDCPL] RTHDCPL.EXE

mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe

mRun: [StartCCC] "c:\programme\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun

mRun: [Adobe ARM] "c:\programme\gemeinsame dateien\adobe\arm\1.0\AdobeARM.exe"

mRun: [SunJavaUpdateSched] "c:\programme\gemeinsame dateien\java\java update\jusched.exe"

mRun: [SpywareTerminatorShield] c:\programme\spyware terminator\SpywareTerminatorShield.exe

mRun: [avgnt] "c:\programme\avira\antivir desktop\avgnt.exe" /min

dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE

StartupFolder: c:\dokume~1\alluse~1\startm~1\progra~1\autost~1\hppsc2~1.lnk - c:\programme\hewlett-packard\digital imaging\bin\hpobnz08.exe

StartupFolder: c:\dokume~1\alluse~1\startm~1\progra~1\autost~1\hpoddt~1.lnk - c:\programme\hewlett-packard\digital imaging\bin\hpotdd01.exe

StartupFolder: c:\dokume~1\alluse~1\startm~1\progra~1\autost~1\wisome~1.lnk - c:\programme\wiso\steuersoftware 2012\mshaktuell.exe

IE: Nach Microsoft &Excel exportieren - c:\progra~1\micros~2\office11\EXCEL.EXE/3000

IE: {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\programme\icq7.5\ICQ.exe

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\programme\messenger\msmsgs.exe

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL

IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\programme\spybot - search & destroy\SDHelper.dll

DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

TCP: DhcpNameServer = 192.168.178.1

TCP: Interfaces\{F8AAB931-DF1D-4E94-8145-3A9F5989AA37} : DhcpNameServer = 192.168.178.1

Handler: pure-go - {4746C79A-2042-4332-8650-48966E44ABA8} - c:\programme\gemeinsame dateien\pure networks shared\platform\puresp4.dll

Notify: AtiExtEvent - Ati2evxx.dll

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\dokumente und einstellungen\dj\anwendungsdaten\mozilla\firefox\profiles\qlxk46r3.default\

FF - prefs.js: browser.search.selectedEngine - Google Deutschland - aus Deutschland

FF - prefs.js: browser.startup.homepage - hxxp://startsear.ch/?aff=1

FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=

FF - plugin: c:\programme\adobe\reader 10.0\reader\air\nppdf32.dll

FF - plugin: c:\programme\google\update\1.3.21.111\npGoogleUpdate3.dll

FF - plugin: c:\programme\java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: c:\programme\microsoft silverlight\5.0.61118.0\npctrlui.dll

FF - plugin: c:\programme\mozilla firefox\plugins\npdeployJava1.dll

FF - plugin: c:\programme\mozilla firefox\plugins\npvsharetvplg.dll

FF - plugin: c:\programme\veetle\player\npvlc.dll

FF - plugin: c:\programme\veetle\plugins\npVeetle.dll

.

============= SERVICES / DRIVERS ===============

.

R0 mrdd;Marvell Removable Disk Control Driver;c:\windows\system32\drivers\mrdd.sys [2011-5-27 18984]

R0 mv61xx;mv61xx;c:\windows\system32\drivers\mv61xx.sys [2011-5-27 152616]

R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [2012-4-3 36000]

R1 sp_rsdrv2;Spyware Terminator 2012 Realtime Shield Driver;c:\windows\system32\drivers\sp_rsdrv2.sys [2011-10-13 32768]

R2 AAV UpdateService;AAV UpdateService;c:\programme\aavupdatemanager\aavus.exe [2008-10-24 128296]

R2 acedrv11;acedrv11;c:\windows\system32\drivers\acedrv11.sys [2010-2-24 185472]

R2 AntiVirSchedulerService;Avira Planer;c:\programme\avira\antivir desktop\sched.exe [2012-4-3 86224]

R2 AntiVirService;Avira Echtzeit Scanner;c:\programme\avira\antivir desktop\avguard.exe [2012-4-3 110032]

R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2012-4-3 74640]

R2 LicCtrlService;LicCtrl Service;c:\windows\Runservice.exe [2011-7-25 2560]

R2 ST2012_Svc;Spyware Terminator 2012 Realtime Shield Service;c:\programme\spyware terminator\st_rsser.exe [2011-10-13 482992]

R3 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [2012-1-29 242240]

R3 rt2870;Linksys 802.11n USB Wireless LAN Card Driver;c:\windows\system32\drivers\rt2870.sys [2011-5-27 816672]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 gupdate;Google Update-Dienst (gupdate);c:\programme\google\update\GoogleUpdate.exe [2011-12-29 136176]

S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2011-5-27 1691480]

S3 cpuz134;cpuz134;c:\programme\cpuid\pc wizard 2010\pcwiz_x32.sys [2011-5-27 20328]

S3 gupdatem;Google Update-Dienst (gupdatem);c:\programme\google\update\GoogleUpdate.exe [2011-12-29 136176]

S3 gUSBSTOi;gUSBSTOi;\??\c:\dokume~1\dj\lokale~1\temp\gusbstoi.sys --> c:\dokume~1\dj\lokale~1\temp\gUSBSTOi.sys [?]

S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]

S4 a347bus;a347bus;c:\windows\system32\drivers\a347bus.sys [2011-5-27 160640]

S4 a347scsi;a347scsi;c:\windows\system32\drivers\a347scsi.sys [2011-5-27 5248]

.

=============== Created Last 30 ================

.

2012-04-03 16:51:09        --------        d-----w-        c:\programme\Spybot - Search & Destroy

2012-04-03 16:51:09        --------        d-----w-        c:\dokumente und einstellungen\all users\anwendungsdaten\Spybot - Search & Destroy

2012-04-03 16:37:11        --------        dc-h--w-        c:\windows\ie8

2012-04-03 16:29:15        --------        d-sh--w-        c:\dokumente und einstellungen\dj\IETldCache

2012-04-03 16:23:37        --------        d-----w-        c:\windows\ie8updates

2012-04-03 16:13:31        6144        -c----w-        c:\windows\system32\dllcache\iecompat.dll

2012-04-03 16:13:07        602112        -c----w-        c:\windows\system32\dllcache\msfeeds.dll

2012-04-03 16:13:07        55296        -c----w-        c:\windows\system32\dllcache\msfeedsbs.dll

2012-04-03 16:13:04        743424        -c----w-        c:\windows\system32\dllcache\iedvtool.dll

2012-04-03 16:13:04        247808        -c----w-        c:\windows\system32\dllcache\ieproxy.dll

2012-04-03 16:13:04        12800        -c----w-        c:\windows\system32\dllcache\xpshims.dll

2012-04-03 16:13:03        2000384        -c----w-        c:\windows\system32\dllcache\iertutil.dll

2012-04-03 16:12:59        11082240        -c----w-        c:\windows\system32\dllcache\ieframe.dll

2012-04-03 13:27:16        --------        d-----w-        c:\dokumente und einstellungen\dj\anwendungsdaten\Avira

2012-04-03 13:23:28        74640        ----a-w-        c:\windows\system32\drivers\avgntflt.sys

2012-04-03 13:23:28        36000        ----a-w-        c:\windows\system32\drivers\avkmgr.sys

2012-04-03 13:23:27        --------        d-----w-        c:\programme\Avira

2012-04-03 13:23:27        --------        d-----w-        c:\dokumente und einstellungen\all users\anwendungsdaten\Avira

2012-03-20 08:01:38        --------        d-----w-        C:\BraCa Soft

2012-03-18 06:03:20        592824        ----a-w-        c:\programme\mozilla firefox\gkmedias.dll

2012-03-18 06:03:20        44472        ----a-w-        c:\programme\mozilla firefox\mozglue.dll

.

==================== Find3M  ====================

.

2012-04-03 18:10:29        1241        --sha-w-        c:\windows\system32\mmf.sys

2012-02-23 10:41:55        414368        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl

2012-01-29 12:16:53        473656        ----a-w-        c:\windows\system32\drivers\sptd.sys

2012-01-29 11:29:22        242240        ----a-w-        c:\windows\system32\drivers\dtsoftbus01.sys

2012-01-29 10:53:45        271360        ----a-w-        c:\windows\system32\drivers\atksgt.sys

2012-01-29 10:53:45        18048        ----a-w-        c:\windows\system32\drivers\lirsgt.sys

2012-01-12 17:20:28        1860096        ----a-w-        c:\windows\system32\win32k.sys

2012-01-11 19:06:33        3072        ------w-        c:\windows\system32\iacenc.dll

.

============= FINISH: 20:16:11,34 ===============
--- --- ---

alles anderes ist im Anhang: otl, attach usw