Trojaner-Board - Downloader trojaner und rootkits!!!

hi, bin neu hier und hab mir ein par viren eingefangen habe Schritt a) und b) gemacht h**p://www.trojaner-board.de/70018-fuer-alle-hilfesuchenden-muss-ich-vor-der-eroeffnung-eines-themas-beachten.html
mein report hiezu:
mein malwarebytes Anti- Malware Log

Code:

Malwarebytes' Anti-Malware 1.34

Datenbank Version: 1763

Windows 5.1.2600 Service Pack 3
 

15.02.2009 11:28:37

mbam-log-2009-02-15 (11-28-37).txt
 

Scan-Methode: Vollständiger Scan (C:\|D:\|)

Durchsuchte Objekte: 242250

Laufzeit: 2 hour(s), 14 minute(s), 0 second(s)
 

Infizierte Speicherprozesse: 0

Infizierte Speichermodule: 0

Infizierte Registrierungsschlüssel: 0

Infizierte Registrierungswerte: 0

Infizierte Dateiobjekte der Registrierung: 0

Infizierte Verzeichnisse: 0

Infizierte Dateien: 26
 

Infizierte Speicherprozesse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung:

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien:

C:\Dokumente und Einstellungen\Quentin\Lokale Einstellungen\Temp\UACa94.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.

C:\Dokumente und Einstellungen\Quentin\Lokale Einstellungen\Temp\9C.tmp (Rootkit.Rustock) -> Quarantined and deleted successfully.

C:\Dokumente und Einstellungen\Quentin\Lokale Einstellungen\Temp\9D.tmp (Rootkit.Rustock) -> Quarantined and deleted successfully.

C:\Dokumente und Einstellungen\Quentin\Lokale Einstellungen\Temp\UAC23b9.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{F1F0A6D3-F85D-457A-8A5E-8F33CDC84623}\RP165\A0041850.exe (Trojan.BHO) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{F1F0A6D3-F85D-457A-8A5E-8F33CDC84623}\RP166\A0042056.dll (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{F1F0A6D3-F85D-457A-8A5E-8F33CDC84623}\RP166\A0042057.sys (Rootkit.TDSS) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{F1F0A6D3-F85D-457A-8A5E-8F33CDC84623}\RP166\A0042058.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{F1F0A6D3-F85D-457A-8A5E-8F33CDC84623}\RP166\A0042059.dll (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{F1F0A6D3-F85D-457A-8A5E-8F33CDC84623}\RP166\A0042060.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{F1F0A6D3-F85D-457A-8A5E-8F33CDC84623}\RP166\A0042061.dll (Trojan.TDSS) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{F1F0A6D3-F85D-457A-8A5E-8F33CDC84623}\RP166\A0042062.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\UACewqxmobw.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drivers\e8a3cc56.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\sf.ico (Malware.Trace) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\m3.ico (Malware.Trace) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\c.ico (Malware.Trace) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\m.ico (Malware.Trace) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\p.ico (Malware.Trace) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\s.ico (Malware.Trace) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\uacinit.dll (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\system32.exe (Backdoor.Bot) -> Quarantined and deleted successfully.

C:\Dokumente und Einstellungen\Quentin\Favoriten\SMS TRAP.url (Rogue.Link) -> Quarantined and deleted successfully.

C:\WINDOWS\ios.dat (Malware.Trace) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\UACbpcbeynd.dat (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\UACwpjxtlwt.log (Trojan.Agent) -> Quarantined and deleted successfully.

nun zu c) mein HJT log

Code:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 11:34:30, on 15.02.2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16791)

Boot mode: Normal
 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe

C:\Programme\Java\jre6\bin\jqs.exe

C:\Programme\Google\Update\GoogleUpdate.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\PnkBstrA.exe

C:\WINDOWS\system32\PnkBstrB.exe

C:\WINDOWS\system32\svchost.exe

C:\programme\premieropinion\pmropn.exe

C:\WINDOWS\Explorer.EXE

C:\Programme\Razer\Copperhead\razerhid.exe

C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\TBPanel.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\WINDOWS\Twain_32\FlatBed\HotKey.exe

C:\Programme\Java\jre6\bin\jusched.exe

C:\Programme\Razer\Copperhead\razertra.exe

C:\Programme\Razer\Copperhead\razerofa.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\wbem\unsecapp.exe

C:\Programme\Malwarebytes' Anti-Malware\mbam.exe

C:\Programme\AVG\AVG8\avgtray.exe

C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

C:\PROGRA~1\AVG\AVG8\avgrsx.exe

C:\PROGRA~1\AVG\AVG8\avgnsx.exe

C:\PROGRA~1\AVG\AVG8\avgemc.exe

C:\Programme\AVG\AVG8\avgcsrvx.exe

D:\Programme\Google\Picasa3\PicasaUpdater.exe

C:\WINDOWS\system32\LMabcoms.exe

C:\Programme\Mozilla Firefox\firefox.exe

C:\Programme\Trend Micro\HijackThis\HijackThis.exe
 

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Programme\AVG\AVG8\avgssie.dll

O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll

O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O4 - HKLM\..\Run: [razer] C:\Programme\Razer\Copperhead\razerhid.exe

O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [Gainward] C:\WINDOWS\TBPanel.exe /A

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [HotKey] C:\WINDOWS\Twain_32\FlatBed\HotKey.exe

O4 - HKLM\..\Run: [PremierOpinion] C:\programme\premieropinion\pmropn.exe -boot

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe

O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent

O4 - HKLM\..\RunOnce: [NSSInstallation] C:\WINDOWS\system32\Adobe\Shockwave 11\nssstub.exe /RunOnce

O4 - HKLM\..\RunOnce: [Malwarebytes Anti-Malware (reboot)] "C:\Programme\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200

O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: (no name) - {12345678-1234-1234-1234-1234567890AB} - (no file)

O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe

O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Programme\AVG\AVG8\avgpp.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL

O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll

O20 - Winlogon Notify: PremierOpinion - C:\programme\premieropinion\pmls.dll

O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe

O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe

O23 - Service: Google Update Service (gupdate1c987c1ca9ff20c) (gupdate1c987c1ca9ff20c) - Google Inc. - C:\Programme\Google\Update\GoogleUpdate.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe

O23 - Service: lmab_device -   - C:\WINDOWS\system32\LMabcoms.exe

O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
 

--

End of file - 7417 bytes

zu guter letz zu d) meine uninstall list:

Code:

2007 Microsoft Office Suite Service Pack 1 (SP1)

2007 Microsoft Office Suite Service Pack 1 (SP1)

2007 Microsoft Office Suite Service Pack 1 (SP1)

2007 Microsoft Office Suite Service Pack 1 (SP1)

2007 Microsoft Office Suite Service Pack 1 (SP1)

2007 Microsoft Office Suite Service Pack 1 (SP1)

2007 Microsoft Office Suite Service Pack 1 (SP1)

2007 Microsoft Office Suite Service Pack 1 (SP1)

2007 Microsoft Office Suite Service Pack 1 (SP1)

2007 Microsoft Office Suite Service Pack 1 (SP1)

2FlyerPro

Ad-Aware

Adobe Flash Player 10 ActiveX

Adobe Flash Player 10 Plugin

Adobe Reader 9 - Deutsch

Adobe Shockwave Player 11

Alfons Lernwelt

Audio Recorder 1.1

AVG Free 8.0

CCleaner (remove only)

Counter-Strike Source

Cover Commander 2.91 by Insofta Development

ElsterFormular 2007/2008

ElsterFormular 2008/2009

EXPERTool

Free YouTube to Mp3 Converter version 3.1

GIMP 2.6.4

Google Earth

Google Update Helper

Hamachi 1.0.3.0

High Definition Audio Driver Package - KB888111

HijackThis 2.0.2

Hotfix for Windows Media Format 11 SDK (KB929399)

Hotfix für Windows Media Player 11 (KB939683)

Hotfix für Windows XP (KB942288-v3)

Hotfix für Windows XP (KB952287)

ICQ6.5

Java(TM) 6 Update 11

Langenscheidts Vokabeltrainer

Langenscheidts Vokabeltrainer (Demoversion)

LEGO Racers 2

Lexmark Software deinstallieren

LiveUpdate 1.80 (Symantec Corporation)

Malwarebytes' Anti-Malware

Microsoft .NET Framework 2.0

Microsoft Compression Client Pack 1.0 for Windows XP

Microsoft DirectX Transform optional components

Microsoft Internationalized Domain Names Mitigation APIs

Microsoft MPEG-4 VKI Video Codec V1/V2/V3

Microsoft National Language Support Downlevel APIs

Microsoft Office Excel MUI (German) 2007

Microsoft Office Home and Student 2007

Microsoft Office Home and Student 2007

Microsoft Office OneNote MUI (German) 2007

Microsoft Office PowerPoint MUI (German) 2007

Microsoft Office Proof (English) 2007

Microsoft Office Proof (French) 2007

Microsoft Office Proof (German) 2007

Microsoft Office Proof (Italian) 2007

Microsoft Office Proofing (German) 2007

Microsoft Office Shared MUI (German) 2007

Microsoft Office Word MUI (German) 2007

Microsoft User-Mode Driver Framework Feature Pack 1.0

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022

Mozilla Firefox (3.0.6)

Mozilla Thunderbird (2.0.0.18)

MSI v2 to redistribute Rigs of Rods

MSXML 4.0 SP2 (KB954430)

msxml4

Nero 7 Premium

Nokia Series 40 Theme Studio 2.2

NVIDIA Drivers

NVIDIA PhysX

OpenAL

OpenOffice.org 2.4

PC SECURITY TEST 2008

PCI Audio Applications

PCI Audio Driver

Picasa 3

Postal 2 STP - Free Multiplayer Edition

PremierOpinion

QuickTime

Razer Copperhead

Realtek High Definition Audio Driver

Rigs of Rods 0.35

Sam and Max - Season One - Episode 104 - Abe Lincoln Must Die!

Security Update for 2007 Microsoft Office System (KB951550)

Security Update for 2007 Microsoft Office System (KB951944)

Security Update for 2007 Microsoft Office System (KB958439)

Security Update for Microsoft Office Excel 2007 (KB958437)

Security Update for Microsoft Office OneNote 2007 (KB950130)

Security Update for Microsoft Office PowerPoint 2007 (KB951338)

Security Update for Microsoft Office system 2007 (KB954326)

Security Update for Microsoft Office system 2007 (KB956828)

Security Update for Microsoft Office Word 2007 (KB956358)

Series 60 Theme Studio

Sicherheitsupdate für Windows Internet Explorer 7 (KB938127-v2)

Sicherheitsupdate für Windows Internet Explorer 7 (KB956390)

Sicherheitsupdate für Windows Internet Explorer 7 (KB958215)

Sicherheitsupdate für Windows Internet Explorer 7 (KB960714)

Sicherheitsupdate für Windows Internet Explorer 7 (KB961260)

Sicherheitsupdate für Windows Media Player (KB952069)

Sicherheitsupdate für Windows Media Player 11 (KB936782)

Sicherheitsupdate für Windows Media Player 11 (KB954154)

Sicherheitsupdate für Windows XP (KB923789)

Sicherheitsupdate für Windows XP (KB938464)

Sicherheitsupdate für Windows XP (KB941569)

Sicherheitsupdate für Windows XP (KB946648)

Sicherheitsupdate für Windows XP (KB950762)

Sicherheitsupdate für Windows XP (KB950974)

Sicherheitsupdate für Windows XP (KB951066)

Sicherheitsupdate für Windows XP (KB951376-v2)

Sicherheitsupdate für Windows XP (KB951698)

Sicherheitsupdate für Windows XP (KB951748)

Sicherheitsupdate für Windows XP (KB952954)

Sicherheitsupdate für Windows XP (KB954211)

Sicherheitsupdate für Windows XP (KB954459)

Sicherheitsupdate für Windows XP (KB954600)

Sicherheitsupdate für Windows XP (KB955069)

Sicherheitsupdate für Windows XP (KB956391)

Sicherheitsupdate für Windows XP (KB956802)

Sicherheitsupdate für Windows XP (KB956803)

Sicherheitsupdate für Windows XP (KB956841)

Sicherheitsupdate für Windows XP (KB957095)

Sicherheitsupdate für Windows XP (KB957097)

Sicherheitsupdate für Windows XP (KB958215)

Sicherheitsupdate für Windows XP (KB958644)

Sicherheitsupdate für Windows XP (KB958687)

Sicherheitsupdate für Windows XP (KB960714)

Sicherheitsupdate für Windows XP (KB960715)

Sid Meier's Railroad Tycoon

Skype™ 4.0

Symantec AntiVirus Client

TeamViewer 4

Total Commander (Remove or Repair)

UltraStar 0.6.1

Uninstall 1.0.0.1

Update for Office 2007 (KB946691)

Update für Windows XP (KB951978)

Update für Windows XP (KB955839)

USB Scanner

Vokabeltrainer-Update 4.0.11

WeGame Client Beta 1.0.9

Windows Media Format 11 runtime

Windows Media Format 11 runtime

Windows Media Player 11

Windows Media Player 11

Windows XP Service Pack 3

WinRAR

Zattoo 3.3.2 Beta

habt ihr eine Idee wie ich die viren trojaner Rootkits und so weiter wieder weg machen kann??:heulen::heulen::heulen::heulen::heulen::headbang:

EDIT: Ich hoffe ich habe allles richtig gemacht =)