Trojaner-Board - Infiziert?

Hier die neue Liste von HJT:

Code:

Logfile of HijackThis v1.99.1

Scan saved at 19:49:32, on 09.03.2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

E:\Eigene Programme\Sonstiges\Avast\aswUpdSv.exe

E:\Eigene Programme\Sonstiges\Avast\ashServ.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\Programme\Synaptics\SynTP\SynTPLpr.exe

C:\Programme\Synaptics\SynTP\SynTPEnh.exe

C:\WINDOWS\AGRSMMSG.exe

C:\Programme\Samsung\AVStation premium\bin\AVStation agent.exe

E:\Eigene Programme\Sonstiges\SVN Tortoise\bin\TSVNCache.exe

C:\Programme\Samsung\Samsung Battery Manager\BatteryManager.exe

C:\Programme\Analog Devices\SoundMAX\SMax4PNP.exe

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAHE.EXE

C:\Programme\Java\jre1.6.0_03\bin\jusched.exe

E:\EIGENE~1\SONSTI~1\Avast\ashDisp.exe

C:\Programme\SAMSUNG\MagicKBD\MagicKBD.exe

E:\Server\Apache2\bin\Apache.exe

E:\Eigene Programme\Sonstiges\Sophos Antivirus\AutoUpdate\ALMon.exe

E:\Server\apache2\bin\ApacheMonitor.exe

C:\WINDOWS\system32\Brmfrmps.exe

E:\Eigene Programme\Sonstiges\Cisco VPN Client\cvpnd.exe

C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe

E:\Server\mysql\bin\mysqld-nt.exe

C:\Programme\Sophos\Sophos Anti-Virus\SAVAdminService.exe

C:\Programme\samsung\Samsung Network Manager\SNMWLANService.exe

E:\Eigene Programme\Sonstiges\Sophos Antivirus\AutoUpdate\ALsvc.exe

C:\Programme\Analog Devices\SoundMAX\SMAgent.exe

C:\WINDOWS\system32\svchost.exe

E:\Eigene Programme\Sonstiges\Ashampoo Magic Defrag\bin\aDefragService.exe

E:\Server\Apache2\bin\Apache.exe

E:\Eigene Programme\Sonstiges\Avast\ashMaiSv.exe

E:\Eigene Programme\Sonstiges\Avast\ashWebSv.exe

C:\WINDOWS\system32\wuauclt.exe

E:\NetCologne\signup\wlanmon.exe

E:\Eigene Programme\Sonstiges\Miranda\miranda32.exe

C:\WINDOWS\TEMP\sophos_autoupdate1.dir\alupdate.exe

E:\Eigene Programme\Sonstiges\Mozilla Firefox\firefox.exe

E:\Eigene Programme\Sonstiges\Hijack This\hijackthis\hjt.exe
 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://google.icq.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.netcologne.de

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.netcologne.de

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer bereitgestellt von NetCologne

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - e:\eigene programme\sonstiges\adobe acrobat\Acrobat\ActiveX\AcroIEHelper.ocx

O2 - BHO: ClickCatcher MSIE handler - {16664845-0E00-11D2-8059-000000000000} - C:\Programme\Gemeinsame Dateien\ReGet Shared\Catcher.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_03\bin\ssv.dll

O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - E:\Eigene Programme\Sonstiges\Free Download Manager\iefdmcks.dll

O2 - BHO: Google.Awards - {D5E929E5-6B86-401F-A478-95205721B202} - C:\Dokumente und Einstellungen\Olli.RUNNNINGMOOSE\Anwendungsdaten\Microsoft\PrintHood\msndpcatl.gl1

O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Programme\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll

O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Programme\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll

O3 - Toolbar: ReGet Bar - {17939A30-18E2-471E-9D3A-56DD725F1215} - E:\Eigene Programme\Sonstiges\ReGet\iebar.dll

O4 - HKLM\..\Run: [ATIPTA] "C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe"

O4 - HKLM\..\Run: [SynTPLpr] C:\Programme\Synaptics\SynTP\SynTPLpr.exe

O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe

O4 - HKLM\..\Run: [MagicKeyboard] C:\Programme\SAMSUNG\MagicKBD\PreMKBD.exe

O4 - HKLM\..\Run: [AVStation premium] "C:\Programme\Samsung\AVStation premium\bin\AVStation agent.exe"

O4 - HKLM\..\Run: [BatteryManager] C:\Programme\Samsung\Samsung Battery Manager\BatteryManager.exe

O4 - HKLM\..\Run: [SoundMAXPnP] C:\Programme\Analog Devices\SoundMAX\SMax4PNP.exe

O4 - HKLM\..\Run: [EPSON Stylus Photo R240 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAHE.EXE /P30 "EPSON Stylus Photo R240 Series" /O6 "USB002" /M "Stylus Photo R240"

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre1.6.0_03\bin\jusched.exe"

O4 - HKLM\..\Run: [avast!] E:\EIGENE~1\SONSTI~1\Avast\ashDisp.exe

O4 - Global Startup: AutoUpdate Monitor.lnk = E:\Eigene Programme\Sonstiges\Sophos Antivirus\AutoUpdate\ALMon.exe

O4 - Global Startup: Monitor Apache Servers.lnk = E:\Server\apache2\bin\ApacheMonitor.exe

O8 - Extra context menu item: A&lles mit ReGet Deluxe herunterladen - C:\Programme\Gemeinsame Dateien\ReGet Shared\CC_All.htm

O8 - Extra context menu item: Download all with Free Download Manager - file://E:\Eigene Programme\Sonstiges\Free Download Manager\dlall.htm

O8 - Extra context menu item: Download selected with Free Download Manager - file://E:\Eigene Programme\Sonstiges\Free Download Manager\dlselected.htm

O8 - Extra context menu item: Download with Free Download Manager - file://E:\Eigene Programme\Sonstiges\Free Download Manager\dllink.htm

O8 - Extra context menu item: Herunterladen mit Re&Get Deluxe - C:\Programme\Gemeinsame Dateien\ReGet Shared\CC_Link.htm

O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://E:\OFFICE~1\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\OFFICE~1\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe

O12 - Plugin for .spop: C:\Programme\Internet Explorer\Plugins\NPDocBox.dll

O17 - HKLM\System\CCS\Services\Tcpip\..\{4476AB14-D812-4E53-B0D0-FE3C13D0E283}: NameServer = 213.168.112.60 194.8.194.60

O20 - AppInit_DLLs: C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL

O23 - Service: Apache2 - Unknown owner - E:\Server\Apache2\bin\Apache.exe" -k runservice (file missing)

O23 - Service: AshampooDefragService -   - E:\Eigene Programme\Sonstiges\Ashampoo Magic Defrag\bin\aDefragService.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - E:\Eigene Programme\Sonstiges\Avast\aswUpdSv.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: avast! Antivirus - ALWIL Software - E:\Eigene Programme\Sonstiges\Avast\ashServ.exe

O23 - Service: avast! Mail Scanner - Unknown owner - E:\Eigene Programme\Sonstiges\Avast\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - E:\Eigene Programme\Sonstiges\Avast\ashWebSv.exe" /service (file missing)

O23 - Service: Brother Popup Suspend service for Resource manager (brmfrmps) - Unknown owner - C:\WINDOWS\system32\Brmfrmps.exe" -service (file missing)

O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - E:\Eigene Programme\Sonstiges\Cisco VPN Client\cvpnd.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe

O23 - Service: MySQL - Unknown owner - E:\Server\mysql\bin\mysqld-nt".exe (file missing)

O23 - Service: NBService - Nero AG - E:\Eigene Programme\Sonstiges\Nero 7 Essentials\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Unknown owner - C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe (file missing)

O23 - Service: Sophos Anti-Virus Statusreporter (SAVAdminService) - Sophos Plc - C:\Programme\Sophos\Sophos Anti-Virus\SAVAdminService.exe

O23 - Service: Sophos Anti-Virus (SAVService) - Sophos Plc - C:\Programme\Sophos\Sophos Anti-Virus\SavService.exe

O23 - Service: ServiceLayer - Nokia. - C:\Programme\PC Connectivity Solution\ServiceLayer.exe

O23 - Service: SNM WLAN Service - Unknown owner - C:\Programme\samsung\Samsung Network Manager\SNMWLANService.exe

O23 - Service: Sophos AutoUpdate Service - Sophos Plc - E:\Eigene Programme\Sonstiges\Sophos Antivirus\AutoUpdate\ALsvc.exe

O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programme\Analog Devices\SoundMAX\SMAgent.exe

Und auch eine neue FileList:

Code:

----- System32 ------------------------- 

 Datentr„ger in Laufwerk C: ist System

 Volumeseriennummer: 7478-AB3B
 

 Verzeichnis von C:\WINDOWS\system32
 

09.03.2008  19:43             1.543 Olli_KBD.ini

09.03.2008  19:43             2.422 wpa.dbl

09.03.2008  15:07         1.308.101 frtrkbeg.ini

06.03.2008  13:18             3.001 CONFIG.NT

26.02.2008  09:41           192.976 FNTCACHE.DAT

05.02.2008  00:09        18.214.008 MRT.exe

14.12.2007  08:52           387.268 TZLog.log

04.12.2007  19:40           550.912 oleaut32.dll

04.12.2007  14:04           837.496 aswBoot.exe

04.12.2007  13:54            95.608 AvastSS.scr

14.11.2007  08:26           450.560 jscript.dll

13.11.2007  12:31            60.416 tzchange.exe

07.11.2007  10:27           729.600 lsasrv.dll

30.10.2007  11:15         3.079.680 mshtml.dll

29.10.2007  23:42         1.293.312 quartz.dll

29.10.2007  16:35           123.904 xpsp3res.dll

28.10.2007  10:01            48.552 perfc007.dat

28.10.2007  10:01            40.326 perfc009.dat

28.10.2007  10:01           317.168 perfh007.dat

28.10.2007  10:01           311.938 perfh009.dat

28.10.2007  10:01           723.744 PerfStringBackup.INI

25.10.2007  17:55         8.495.616 shell32.dll

20.10.2007  06:01           227.328 wmasf.dll

11.10.2007  16:06            98.304 CmdLineExt.dll

11.10.2007  07:12           474.624 shlwapi.dll

11.10.2007  07:12           617.472 urlmon.dll

11.10.2007  07:12         1.494.528 shdocvw.dll

11.10.2007  07:12           665.088 wininet.dll

11.10.2007  07:12            39.424 pngfilt.dll

11.10.2007  07:12           449.024 mshtmled.dll

11.10.2007  07:12           146.432 msrating.dll

11.10.2007  07:12           532.480 mstime.dll

11.10.2007  07:12            16.384 jsproxy.dll

11.10.2007  07:12            96.768 inseng.dll

11.10.2007  07:12           251.392 iepeers.dll

11.10.2007  07:12         1.023.488 browseui.dll

11.10.2007  07:12         1.056.256 danim.dll

11.10.2007  07:12            55.808 extmgr.dll

11.10.2007  07:12           357.888 dxtmsft.dll

11.10.2007  07:12           205.312 dxtrans.dll

11.10.2007  07:12           152.064 cdfview.dll

05.10.2007  01:32             5.686 jupdate-1.6.0_03-b05.log

24.09.2007  22:31            69.632 javacpl.cpl

24.09.2007  22:31           139.264 javaws.exe

24.09.2007  21:30           135.168 javaw.exe

24.09.2007  21:30           135.168 java.exe

21.08.2007  07:16           683.520 inetcomm.dll

02.08.2007  12:31             5.214 jupdate-1.6.0_02-b06.log

30.07.2007  18:20            30.040 wuaucpl.cpl.mui

30.07.2007  18:20            30.040 wuapi.dll.mui

30.07.2007  18:19         1.712.984 wuaueng.dll

30.07.2007  18:19           549.720 wuapi.dll

30.07.2007  18:19           325.976 wucltui.dll

30.07.2007  18:19           203.096 wuweb.dll

30.07.2007  18:19           216.408 wuaucpl.cpl

30.07.2007  18:19            92.504 cdm.dll

30.07.2007  18:19            53.080 wuauclt.exe

30.07.2007  18:19            43.352 wups2.dll

30.07.2007  18:18            34.136 wucltui.dll.mui

30.07.2007  18:18            33.624 wups.dll

30.07.2007  18:18            20.824 wuaueng.dll.mui

28.07.2007  16:13            17.920 sophosboottasks.exe

09.07.2007  14:11           584.192 rpcrt4.dll

06.07.2007  13:49            48.640 mqupgrd.dll

06.07.2007  13:49           138.240 mqad.dll

06.07.2007  13:49           660.992 mqqm.dll

06.07.2007  13:49            16.896 mqise.dll

06.07.2007  13:49            47.104 mqdscli.dll

06.07.2007  13:49            95.744 mqsec.dll

06.07.2007  13:49           533.504 mqutil.dll

06.07.2007  13:49           177.152 mqrt.dll

28.06.2007  18:55            77.824 xvid.ax

28.06.2007  18:54           180.224 xvidvfw.dll

28.06.2007  18:52           765.952 xvidcore.dll

26.06.2007  07:08         1.104.896 msxml3.dll

19.06.2007  14:31           282.112 gdi32.dll