Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Trojaner "Antivirus XP 2008" (https://www.trojaner-board.de/57583-trojaner-antivirus-xp-2008-a.html)

ArtOnTheWeb 10.08.2008 02:23
Trojaner "Antivirus XP 2008"
 
Hallo,

leider habe ich mir gestern den Trojaner "Antivirus XP 2008" eingefangen und seit dem kann ich mein WinXP nur im abgesicherten Modus hochfahren. Das Internet ist im abgesicherten Modus auch verfügbar.

Ich wäre für Ihre Hilfe dankbar. Ihre Malwarebytes Anti-Malware Anleitung habe ich gelesen.

Hier ist also der Logfile:

Code:
Malwarebytes' Anti-Malware 1.24
Datenbank Version: 1036
Windows 5.1.2600 Service Pack 2

22:54:52 09.08.2008
mbam-log-8-9-2008 (22-54-52).txt

Scan-Methode: Vollständiger Scan (C:\|E:\|F:\|H:\|I:\|L:\|)
Durchsuchte Objekte: 492622
Laufzeit: 1 hour(s), 16 minute(s), 11 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 33
Infizierte Registrierungswerte: 18
Infizierte Dateiobjekte der Registrierung: 23
Infizierte Verzeichnisse: 15
Infizierte Dateien: 46

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_CLASSES_ROOT\Interface\{967a494a-6aec-4555-9caf-fa6eb00acf91} (Rogue.PestPatrol) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{9692be2f-eb8f-49d9-a11c-c24c1ef734d5} (Rogue.PestPatrol) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{a8954909-1f0f-41a5-a7fa-3b376d69e226} (Rogue.PestPatrol) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a3628b71-12f5-82e7-9b56-0d7e91241adb} (Rogue.PestPatrol) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a3628b71-12f5-82e7-9b56-0d7e91241adb} (Rogue.PestPatrol) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{b69a9db4-d0a1-4722-b56b-f20757a29cdf} (Adware.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b69a9db4-d0a1-4722-b56b-f20757a29cdf} (Adware.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{36dbc179-a19f-48f2-b16a-6a3e19b42a87} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{a93a1ba9-9ee8-469f-a9fe-fd1c26700bda} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\alewinsecure.winsecure (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\alewinsecure.winsecure.1 (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a1789eb6-b263-4bd6-8830-d3daaf78949a} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{7be6b643-6201-4cf7-b8b1-d79ffae57cba} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{58696980-c6b3-4ad2-ab53-718f1c3c57ca} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8A61098D-612B-4EF2-943D-64E920684061} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{09f1adac-76d8-4d0f-99a5-5c907dadb988} (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{5adf3862-9e2e-4ad3-86f7-4510e6550cd0} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5adf3862-9e2e-4ad3-86f7-4510e6550cd0} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{e12bff69-38a7-406e-a8ef-2738107a7831} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\tcpsr (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tcpsr (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\altcompare (Dialer) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\rhcnfjj0et3e (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\rhcnfjj0et3e (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Live_TV (Adware.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\msvcl1.bhoapp (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\msvcl1.bhoapp.1 (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\WR (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Juan (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\webHancer (Adware.WebHancer) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\AleWinSecure.EXE (Adware.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\WUSN.1 (Adware.WhenUSave) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{b69a9db4-d0a1-4722-b56b-f20757a29cdf} (Adware.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{02ffac45-0b10-5633-4296-1801f1a36678} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{f710fa10-2031-3106-8872-93a2b5c5c620} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DriverLoad (Trojan.Clicker) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DriverCheck (Trojan.Clicker) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\SystemDriverLoad (Trojan.Clicker) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winhost (Trojan.Clicker) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winhost1 (Trojan.Clicker) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winhost2 (Trojan.Clicker) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winhost3 (Trojan.Clicker) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winhost4 (Trojan.Clicker) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\FDriver (Trojan.Clicker) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ADriver (Trojan.Clicker) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\SystemDriver (Trojan.Clicker) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\wallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\originalwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\convertedwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\scrnsave.exe (Hijack.Wallpaper) -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.115.83 85.255.112.206 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{638753c0-bf3c-4f8e-8a53-ff7184946675}\NameServer (Trojan.DNSChanger) -> Data: 85.255.115.83,85.255.112.206 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{6672e2f4-4513-40d4-8108-cb3697fd3a78}\NameServer (Trojan.DNSChanger) -> Data: 85.255.115.83,85.255.112.206 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{8fe473ac-28e2-4d15-a25a-562a01b07a6c}\NameServer (Trojan.DNSChanger) -> Data: 85.255.115.83,85.255.112.206 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{c801fa85-f755-45f4-b14b-06f37d6146a1}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.115.83,85.255.112.206 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.115.83 85.255.112.206 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{638753c0-bf3c-4f8e-8a53-ff7184946675}\NameServer (Trojan.DNSChanger) -> Data: 85.255.115.83,85.255.112.206 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{6672e2f4-4513-40d4-8108-cb3697fd3a78}\NameServer (Trojan.DNSChanger) -> Data: 85.255.115.83,85.255.112.206 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{8fe473ac-28e2-4d15-a25a-562a01b07a6c}\NameServer (Trojan.DNSChanger) -> Data: 85.255.115.83,85.255.112.206 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{c801fa85-f755-45f4-b14b-06f37d6146a1}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.115.83,85.255.112.206 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.115.83 85.255.112.206 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\Interfaces\{638753c0-bf3c-4f8e-8a53-ff7184946675}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.115.83,85.255.112.206 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\Interfaces\{638753c0-bf3c-4f8e-8a53-ff7184946675}\NameServer (Trojan.DNSChanger) -> Data: 85.255.115.83,85.255.112.206 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\Interfaces\{6672e2f4-4513-40d4-8108-cb3697fd3a78}\NameServer (Trojan.DNSChanger) -> Data: 85.255.115.83,85.255.112.206 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\Interfaces\{8fe473ac-28e2-4d15-a25a-562a01b07a6c}\NameServer (Trojan.DNSChanger) -> Data: 85.255.115.83,85.255.112.206 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\Interfaces\{c801fa85-f755-45f4-b14b-06f37d6146a1}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.115.83,85.255.112.206 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.115.83 85.255.112.206 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\Tcpip\Parameters\Interfaces\{638753c0-bf3c-4f8e-8a53-ff7184946675}\NameServer (Trojan.DNSChanger) -> Data: 85.255.115.83,85.255.112.206 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\Tcpip\Parameters\Interfaces\{6672e2f4-4513-40d4-8108-cb3697fd3a78}\NameServer (Trojan.DNSChanger) -> Data: 85.255.115.83,85.255.112.206 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\Tcpip\Parameters\Interfaces\{8fe473ac-28e2-4d15-a25a-562a01b07a6c}\NameServer (Trojan.DNSChanger) -> Data: 85.255.115.83,85.255.112.206 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\Tcpip\Parameters\Interfaces\{c801fa85-f755-45f4-b14b-06f37d6146a1}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.115.83,85.255.112.206 -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispBackgroundPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispScrSavPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Infizierte Verzeichnisse:
E:\Programme\Live_TV (Adware.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\wsnpoem (Trojan.Agent) -> Quarantined and deleted successfully.
E:\Programme\altcmd (Trojan.Agent) -> Quarantined and deleted successfully.
E:\Programme\rhcnfjj0et3e (Rogue.Multiple) -> Quarantined and deleted successfully.
E:\Dokumente und Einstellungen\a*** ****t\Anwendungsdaten\rhcnfjj0et3e (Rogue.Multiple) -> Quarantined and deleted successfully.
E:\Dokumente und Einstellungen\a*** ****t\Anwendungsdaten\rhcnfjj0et3e\Quarantine (Rogue.Multiple) -> Quarantined and deleted successfully.
E:\Dokumente und Einstellungen\a*** ****t\Anwendungsdaten\rhcnfjj0et3e\Quarantine\Autorun (Rogue.Multiple) -> Quarantined and deleted successfully.
E:\Dokumente und Einstellungen\a*** ****t\Anwendungsdaten\rhcnfjj0et3e\Quarantine\Autorun\HKCU (Rogue.Multiple) -> Quarantined and deleted successfully.
E:\Dokumente und Einstellungen\a*** ****t\Anwendungsdaten\rhcnfjj0et3e\Quarantine\Autorun\HKCU\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.
E:\Dokumente und Einstellungen\a*** ****t\Anwendungsdaten\rhcnfjj0et3e\Quarantine\Autorun\HKLM (Rogue.Multiple) -> Quarantined and deleted successfully.
E:\Dokumente und Einstellungen\a*** ****t\Anwendungsdaten\rhcnfjj0et3e\Quarantine\Autorun\HKLM\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.
E:\Dokumente und Einstellungen\a*** ****t\Anwendungsdaten\rhcnfjj0et3e\Quarantine\Autorun\StartMenuAllUsers (Rogue.Multiple) -> Quarantined and deleted successfully.
E:\Dokumente und Einstellungen\a*** ****t\Anwendungsdaten\rhcnfjj0et3e\Quarantine\Autorun\StartMenuCurrentUser (Rogue.Multiple) -> Quarantined and deleted successfully.
E:\Dokumente und Einstellungen\a*** ****t\Anwendungsdaten\rhcnfjj0et3e\Quarantine\BrowserObjects (Rogue.Multiple) -> Quarantined and deleted successfully.
E:\Dokumente und Einstellungen\a*** ****t\Anwendungsdaten\rhcnfjj0et3e\Quarantine\Packages (Rogue.Multiple) -> Quarantined and deleted successfully.

Infizierte Dateien:
E:\Programme\altcmd\altcmd32.dll (Rogue.PestPatrol) -> Quarantined and deleted successfully.
E:\Programme\Live_TV\tbLiv1.dll (Adware.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\b129.exe (Adware.Webhancer) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\tcpsr.sys (Trojan.Agent) -> Quarantined and deleted successfully.
E:\Azureus\Download2\ACDSee.Pro.v8.1.99.Incl.Keymaker-CORE\CORE10k.EXE (Trojan.Agent) -> Quarantined and deleted successfully.
E:\Programme\Online_TV\tbOnl0.dll (Adware.Shopper) -> Quarantined and deleted successfully.
H:\UseNext_Download\Tools\Driver.Magician.v3.27.Incl.Keymaker-CORE\CORE10k.EXE (Trojan.Agent) -> Quarantined and deleted successfully.
H:\UseNext_Download\Tools\Fine.Software.Fine.Metronome.v3.4.1.Incl.Keygen-ViRiLiTY\keygen.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
H:\UseNext_Download\wizard\Incomedia - Website X5 - Designer\keygen-CORE\CORE10k.EXE (Trojan.Agent) -> Quarantined and deleted successfully.
I:\Temporary Internet Files\Content.IE5\YYJB5W3V\dnlsvc[1].exe (Proxy.Agent) -> Quarantined and deleted successfully.
I:\UseNext_Download\Software\Multilizer 2007 Enterprise v7.0.14.243\CORE10k.EXE (Trojan.Agent) -> Quarantined and deleted successfully.
I:\UseNext_Download\wizard\Windows XP Professional 100 % Original m (Windows\KeyGen.exe (Malware.Tool) -> Quarantined and deleted successfully.
E:\Programme\Live_TV\INSTALL.LOG (Adware.Agent) -> Quarantined and deleted successfully.
E:\Programme\Live_TV\tbLive.dll (Adware.Agent) -> Quarantined and deleted successfully.
E:\Programme\Live_TV\toolbar.cfg (Adware.Agent) -> Quarantined and deleted successfully.
E:\Programme\Live_TV\UNWISE.EXE (Adware.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\wsnpoem\audio.dll.cla (Trojan.Agent) -> Quarantined and deleted successfully.
E:\Programme\altcmd\altcmd.inf (Trojan.Agent) -> Quarantined and deleted successfully.
E:\Programme\altcmd\uninstall.bat (Trojan.Agent) -> Quarantined and deleted successfully.
E:\Programme\rhcnfjj0et3e\database.dat (Rogue.Multiple) -> Quarantined and deleted successfully.
E:\Programme\rhcnfjj0et3e\license.txt (Rogue.Multiple) -> Quarantined and deleted successfully.
E:\Programme\rhcnfjj0et3e\MFC71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
E:\Programme\rhcnfjj0et3e\MFC71ENU.DLL (Rogue.Multiple) -> Quarantined and deleted successfully.
E:\Programme\rhcnfjj0et3e\msvcp71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
E:\Programme\rhcnfjj0et3e\msvcr71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
E:\Programme\rhcnfjj0et3e\rhcnfjj0et3e.exe (Rogue.Multiple) -> Quarantined and deleted successfully.
E:\Programme\rhcnfjj0et3e\rhcnfjj0et3e.exe.local (Rogue.Multiple) -> Quarantined and deleted successfully.
E:\Programme\rhcnfjj0et3e\Uninstall.exe (Rogue.Multiple) -> Quarantined and deleted successfully.
E:\Dokumente und Einstellungen\axel hundt\Anwendungsdaten\Microsoft\Internet Explorer\Quick Launch\Antivirus XP 2008.lnk (Rogue.Antivirus2008) -> Quarantined and deleted successfully.
C:\WINDOWS\neos.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\back.exe.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\alt.exe.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\0xf9.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\regscan.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\WINDOWS\crock+mock.config (Worm.Zhelatin) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\blphcjfjj0et3e.scr (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\lphcjfjj0et3e.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\phcjfjj0et3e.bmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\pphcjfjj0et3e.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\winsub.xml (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\svcp.csv (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\wr.txt (Malware.Trace) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\All Users\Desktop\Antivirus XP 2008.lnk (Rogue.Antivirus) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\a*** ****t\Lokale Einstellungen\TEMP\.tt1.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\a*** ****t\Lokale Einstellungen\TEMP\.tt3.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\a*** ****t\Lokale Einstellungen\TEMP\dnlsvc.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

ArtOnTheWeb 10.08.2008 02:26
und hier der Hijack Logfile:

Code:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:34:30, on 10.08.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\GEMEIN~1\Stardock\SDMCP.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
I:\Programme\Opera\opera.exe
C:\WINDOWS\system32\LVComsX.exe
H:\Trojaner-Board\Malwarebytes' Anti-Malware\mbam.exe
C:\WINDOWS\system32\notepad.exe
H:\Trojaner-Board\HiJackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://securityresponse.symantec.com/avcenter/fix_homepage/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://de.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h**p://de.rd.yahoo.com/customize/ie/defaults/su/msgr8/*h**p://de.search.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://de.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*h**p://de.search.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://de.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = h**p://www.smartftp.com/expiration.php
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Online TV Toolbar - {40d1c3a7-4ffb-4443-b3a0-a64b2df7fc3b} - E:\Programme\Online_TV\tbOnl1.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - H:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: CmjBrowserHelperObject Object - {AC41D38F-B56D-40AD-94E0-B493D130C959} - F:\Programme\MindManager 6\Mm6InternetExplorer.dll
O2 - BHO: (no name) - {B4FE1901-2CF2-477F-98C5-67C3CD8761D9} - (no file)
O2 - BHO: CoTGT_BHO Class - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Programme\TGTSoft\StyleXP\TGT_BHO.dll
O2 - BHO: CutePDF Form Filler - {D41289F2-69C6-417B-897E-C653D677CBAF} - F:\Programme\Cute-PDF Pro\CPFillerCo.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Online TV Toolbar - {40d1c3a7-4ffb-4443-b3a0-a64b2df7fc3b} - E:\Programme\Online_TV\tbOnl1.dll
O3 - Toolbar: Babylon - {965B54B0-71E0-4611-8DE7-F73FA0B20E26} - E:\Programme\Babylon\Babylon Toolbar\BabylonIEToolBar.dll
O4 - HKLM\..\Run: [Babylon Client] I:\Programme\Babylon Pro\Babylon.exe -AutoStart
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKLM\..\Policies\Explorer\Run: [CDriver] c:\google.com\svchost.exe
O4 - HKLM\..\Policies\Explorer\Run: [DDriver] c:\google.com\svchost.exe
O4 - HKLM\..\Policies\Explorer\Run: [alpha] c:\google.com\svchost.exe
O4 - HKLM\..\Policies\Explorer\Run: [beta] c:\google.com\svchost.exe
O4 - HKLM\..\Policies\Explorer\Run: [gamma] c:\google.com\svchost.exe
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] E:\PROGRA~1\AVGANT~1.1\avgw.exe /RUNONCE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-20\..\Run: [InfoCockpit] C:\Programme\T-Online\T-Online_Software_6\Info-Cockpit\IC_START.EXE /nosplash (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [T-Online_Software_6\WLAN-Access Finder] C:\Programme\T-Online\WLAN-Access Finder\ToWLaAcF.exe /StartMinimized (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Logitech SetPoint.lnk = L:\Programme\Logitech\SetPoint\SetPoint.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: Mit &Google suchen - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TuneUp Software\TuneUp Utilities\Web\gsearch.htm
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://H:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Seite aus dem &Cache anzeigen - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TuneUp Software\TuneUp Utilities\Web\gcache.htm
O8 - Extra context menu item: Seite mit Google übersetzen - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TuneUp Software\TuneUp Utilities\Web\gtranslate.htm
O8 - Extra context menu item: Translate with &Babylon - res://I:\Programme\Babylon Pro\Utils\BabylonIEPI.dll/Translate.htm
O8 - Extra context menu item: Zurückführende &Links - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TuneUp Software\TuneUp Utilities\Web\gbacklinks.htm
O8 - Extra context menu item: Äh&nliche Seiten - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TuneUp Software\TuneUp Utilities\Web\gsimilar.htm
O8 - Extra context menu item: Übersetzen mit &dict.leo.org - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TuneUp Software\TuneUp Utilities\Web\tutrans.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: BlogThis - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - I:\Programme\BroadcastBuilder\bbuilder.exe
O9 - Extra 'Tools' menuitem: Blog this with Broadcast Builder - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - I:\Programme\BroadcastBuilder\bbuilder.exe
O9 - Extra button: WebPod Studio - {193B17B0-7C9F-4D5B-AEAB-8D3605EFAAA} - I:\PROGRA~1\WEBPOD~2\wpc.exe
O9 - Extra 'Tools' menuitem: Launch WebPod Studio - {193B17B0-7C9F-4D5B-AEAB-8D3605EFAAA} - I:\PROGRA~1\WEBPOD~2\wpc.exe
O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - H:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - H:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - E:\PROGRA~1\Yahoo!\Common\yhexbmesde.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - E:\PROGRA~1\Yahoo!\Common\yhexbmesde.dll
O9 - Extra button: Send to Mindjet MindManager - {531B9DC0-D8EE-4c76-A6EE-6C1E50569655} - F:\Programme\MindManager 6\Mm6InternetExplorer.dll
O9 - Extra button: PartyGammon.com - {59A861EE-32B3-42cd-8CCA-FC130EDF3A44} - E:\Programme\PartyGaming\PartyGammon\RunBackGammon.exe
O9 - Extra 'Tools' menuitem: PartyGammon.com - {59A861EE-32B3-42cd-8CCA-FC130EDF3A44} - E:\Programme\PartyGaming\PartyGammon\RunBackGammon.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - H:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {B4B52284-A248-4c51-9F7C-F0A0C67FCC9D} - (no file)
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - E:\Programme\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - E:\Programme\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - E:\Programme\ICQLite\ICQLite.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - E:\Programme\ICQLite\ICQLite.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O10 - Broken Internet access because of LSP provider 'e:\programme\bonjour\mdnsnsp.dll' missing
O15 - Trusted Zone: h**p://linktrader.cyberspacehq.com
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - E:\Programme\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - h***s://www-secure.symantec.com/techsupp/asa/ss/sa/sa_cabs/tgctlsr.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - H:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: awtttqq - awtttqq.dll (file missing)
O20 - Winlogon Notify: efcdedb - efcdedb.dll (file missing)
O20 - Winlogon Notify: vtutt - C:\WINDOWS\
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Active File Monitor V6 (AdobeActiveFileMonitor6.0) - Unknown owner - I:\Programme\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - H:\Programme\Satelit\Software\Ares\chatServer.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - E:\PROGRA~1\AVGANT~1.1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - E:\PROGRA~1\AVGANT~1.1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - E:\PROGRA~1\AVGANT~1.1\avgemc.exe
O23 - Service: AVM WLAN Connection Service - AVM Berlin - E:\Programme\avmwlanstick\WlanNetService.exe
O23 - Service: Bluetooth Autolaunch Service (BtAutoLaunch) - COM One - C:\WINDOWS\System32\BtAutoLaunch.exe
O23 - Service: DATA BECKER Update Service (DBService) - DATA BECKER GmbH & Co KG - C:\Programme\Gemeinsame Dateien\DATA BECKER Shared\DBService.exe
O23 - Service: AVM FRITZ!web Routing Service (de_serv) - Unknown owner - C:\Programme\Gemeinsame Dateien\AVM\de_serv.exe (file missing)
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - H:\Programme\Common\Database\bin\fbserver.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - E:\Programme\Nero 7\InCD\InCDsrv.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: Label Services (LabelServices) - Euro Plus d.o.o. - C:\Programme\Gemeinsame Dateien\EuroPlus Shared\LblServices.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Programme\Gemeinsame Dateien\Logitech\Bluetooth\LBTServ.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
O23 - Service: T-Online WLAN Adapter Steuerungsdienst (MZCCntrl) - Deutsche Telekom AG, Marmiko IT-Solutions GmbH - C:\Programme\Gemeinsame Dateien\Marmiko Shared\MZCCntrl.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Programme\Gemeinsame Dateien\NMSAccessU.exe
O23 - Service: Sandra Agent Service (SandraAgentSrv) - SiSoftware - C:\WINDOWS\System32\RpcAgentSrv.exe
O23 - Service: ServiceLayer - Nokia. - E:\Programme\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - I:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: StyleXPService - Unknown owner - C:\Programme\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: SurfStats Scheduler Ver 8.4.0.0 (SurfServer8400) - Unknown owner - I:\Programme\Surfstats8400\SurfServ8400.exe
O23 - Service: TuneUp Drive Defrag-Dienst (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

--
End of file - 12646 bytes

nochdigger 10.08.2008 05:55
Moin

wie so eine verkeimte Kiste noch laufen kann, sind mir gleich mehrere Rätsel.
Du hast dir einige gefährliche Dinger eingefangen, auch wenn Malwarebytes einiges gelöscht haben sollte, bleibt das System nicht mehr Vertrauenswürdig.

Solltest du Onlinebanking betreiben setze dich mit deiner Bank in Verbindung wegen eventueller Unregelmäßigkeiten.
Ändere unbedingt alle Pass- und Kennwörter von einem sauberen System aus oder nach der Neuinstallation von Windows.
Sichere keine ausführbaren und Dateien aus unsicheren Quellen.

MFG


Alle Zeitangaben in WEZ +1. Es ist jetzt 08:29 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19