Trojaner-Board - tr/patched.gen

Hallo, heute AntiVir rüberlaufen lassen und diesen Trojaner gefunden. Und zwar in diesen Exe-Dateien

Isass.exe
services.exe
svchost.exe
winlogon.exe

Hier mein hijackthis.log
Code:
Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 19:42:26, on 18.6.2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.21045)

Boot mode: Normal
 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Programme\Avira\AntiVir Desktop\sched.exe

C:\Programme\Avira\AntiVir Desktop\avguard.exe

C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe

C:\Programme\Google\Update\GoogleUpdate.exe

C:\Programme\Nero\Nero8\Nero BackItUp\NBService.exe

C:\WINDOWS\system32\PnkBstrA.exe

C:\WINDOWS\system32\PnkBstrB.exe

C:\WINDOWS\system32\SearchIndexer.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\RTHDCPL.EXE

C:\Programme\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe

C:\WINDOWS\system32\devldr32.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Programme\Avira\AntiVir Desktop\avgnt.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Programme\Eraser\eraser.exe

C:\Programme\Logitech\SetPoint\SetPoint.exe

C:\Programme\PerSono\perstray.exe

C:\Programme\Gemeinsame Dateien\Teleca Shared\CapabilityManager.exe

C:\Programme\Gemeinsame Dateien\Logishrd\KHAL2\KHALMNPR.EXE

C:\Programme\Gemeinsame Dateien\Teleca Shared\Generic.exe

C:\Programme\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe

C:\Programme\Avira\AntiVir Desktop\avscan.exe

C:\Programme\Steam\Steam.exe

C:\Programme\Internet Explorer\iexplore.exe

C:\Programme\Trend Micro\HijackThis\HijackThis.exe
 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://w*w.google.at/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h*tp://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = ht*p://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = ht*p://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = ht*p://go.microsoft.com/fwlink/?LinkId=69157

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_07\bin\ssv.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Programme\Google\Google Toolbar\GoogleToolbar.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll

O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Programme\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll

O2 - BHO: Google Gears Helper - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - C:\Programme\Google\Google Gears\Internet Explorer\0.5.21.0\gears.dll

O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar.dll

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Programme\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Eraser] C:\Programme\Eraser\eraser.exe -hide

O4 - HKLM\..\Policies\Explorer\Run: [Sidebar] C:\Temp\sidebar.exe

O4 - HKUS\S-1-5-20\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETZWERKDIENST')

O4 - HKUS\S-1-5-18\..\RunOnce: [IE7] rundll32 advpack.dll,LaunchINFSection IE7.inf,FirstUserStart (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\RunOnce: [IE7] rundll32 advpack.dll,LaunchINFSection IE7.inf,FirstUserStart (User 'Default user')

O4 - Global Startup: Logitech SetPoint.lnk = C:\Programme\Logitech\SetPoint\SetPoint.exe

O4 - Global Startup: Perstray.lnk = ?

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra button: (no name) - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Programme\Google\Google Gears\Internet Explorer\0.5.21.0\gears.dll

O9 - Extra 'Tools' menuitem: &Gears-Einstellungen - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Programme\Google\Google Gears\Internet Explorer\0.5.21.0\gears.dll

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL

O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programme\PartyGaming\PartyPoker\RunApp.exe (file missing)

O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programme\PartyGaming\PartyPoker\RunApp.exe (file missing)

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe

O9 - Extra button: Klicke hier um das Projekt xp-AntiSpy zu unterstützen - {0e921e80-267a-42aa-aee4-60b9a1222a44} - C:\Programme\xp-AntiSpy\sponsoring\sponsor.html (HKCU)

O9 - Extra 'Tools' menuitem: Unterstützung für xp-AntiSpy - {0e921e80-267a-42aa-aee4-60b9a1222a44} - C:\Programme\xp-AntiSpy\sponsoring\sponsor.html (HKCU)

O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://w*w.kaspersky.com/kos/german/partner/de/kavwebscan_unicode.cab

O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.srtest.com/srl_bin/sysreqlab_srl.cab

O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - ht*p://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL

O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Programme\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll

O20 - AppInit_DLLs: C:\Temp\346531127mxx.dll

O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\sched.exe

O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\avguard.exe

O23 - Service: Anwendungsverwaltung (AppMgmt) - Unknown owner - C:\WINDOWS\system32\svchost.exe

O23 - Service: Windows Audio (AudioSrv) - Unknown owner - C:\WINDOWS\System32\svchost.exe

O23 - Service: Intelligenter Hintergrundübertragungsdienst (BITS) - Unknown owner - C:\WINDOWS\system32\svchost.exe

O23 - Service: Computerbrowser (Browser) - Unknown owner - C:\WINDOWS\system32\svchost.exe

O23 - Service: Kryptografiedienste (CryptSvc) - Unknown owner - C:\WINDOWS\system32\svchost.exe

O23 - Service: DCOM-Server-Prozessstart (DcomLaunch) - Unknown owner - C:\WINDOWS\system32\svchost.exe

O23 - Service: DHCP-Client (Dhcp) - Unknown owner - C:\WINDOWS\system32\svchost.exe

O23 - Service: Verwaltung logischer Datenträger (dmserver) - Unknown owner - C:\WINDOWS\System32\svchost.exe

O23 - Service: DNS-Client (Dnscache) - Unknown owner - C:\WINDOWS\system32\svchost.exe

O23 - Service: Automatische Konfiguration (verkabelt) (Dot3svc) - Unknown owner - C:\WINDOWS\System32\svchost.exe

O23 - Service: Extensible Authentication-Protokolldienst (EapHost) - Unknown owner - C:\WINDOWS\System32\svchost.exe

O23 - Service: Ereignisprotokoll (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe

O23 - Service: COM+-Ereignissystem (EventSystem) - Unknown owner - C:\WINDOWS\system32\svchost.exe

O23 - Service: Kompatibilität für schnelle Benutzerumschaltung (FastUserSwitchingCompatibility) - Unknown owner - C:\WINDOWS\System32\svchost.exe

O23 - Service: Google Update Service (gupdate1c98b632db1972a) (gupdate1c98b632db1972a) - Google Inc. - C:\Programme\Google\Update\GoogleUpdate.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Hilfe und Support (helpsvc) - Unknown owner - C:\WINDOWS\System32\svchost.exe

O23 - Service: HID Input Service (HidServ) - Unknown owner - C:\WINDOWS\System32\svchost.exe

O23 - Service: Integritätsschlüssel- und Zertifikatverwaltungsdienst (hkmsvc) - Unknown owner - C:\WINDOWS\System32\svchost.exe

O23 - Service: HTTP-SSL (HTTPFilter) - Unknown owner - C:\WINDOWS\System32\svchost.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Server (LanmanServer) - Unknown owner - C:\WINDOWS\system32\svchost.exe

O23 - Service: Arbeitsstationsdienst (lanmanworkstation) - Unknown owner - C:\WINDOWS\system32\svchost.exe

O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Programme\Gemeinsame Dateien\Logitech\Bluetooth\LBTServ.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe

O23 - Service: TCP/IP-NetBIOS-Hilfsprogramm (LmHosts) - Unknown owner - C:\WINDOWS\system32\svchost.exe

O23 - Service: NAP-Agent (Network Access Protection) (napagent) - Unknown owner - C:\WINDOWS\System32\svchost.exe

O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Programme\Nero\Nero8\Nero BackItUp\NBService.exe

O23 - Service: Anmeldedienst (Netlogon) - Unknown owner - C:\WINDOWS\system32\lsass.exe

O23 - Service: Netzwerkverbindungen (Netman) - Unknown owner - C:\WINDOWS\System32\svchost.exe

O23 - Service: NLA (Network Location Awareness) (Nla) - Unknown owner - C:\WINDOWS\system32\svchost.exe

O23 - Service: NMIndexingService - Nero AG - C:\Programme\Gemeinsame Dateien\Nero\Lib\NMIndexingService.exe

O23 - Service: NT-LM-Sicherheitsdienst (NtLmSsp) - Unknown owner - C:\WINDOWS\system32\lsass.exe

O23 - Service: Wechselmedien (NtmsSvc) - Unknown owner - C:\WINDOWS\system32\svchost.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Plug & Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe

O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe

O23 - Service: IPSEC-Dienste (PolicyAgent) - Unknown owner - C:\WINDOWS\system32\lsass.exe

O23 - Service: Geschützter Speicher (ProtectedStorage) - Unknown owner - C:\WINDOWS\system32\lsass.exe

O23 - Service: Verwaltung für automatische RAS-Verbindung (RasAuto) - Unknown owner - C:\WINDOWS\system32\svchost.exe

O23 - Service: RAS-Verbindungsverwaltung (RasMan) - Unknown owner - C:\WINDOWS\system32\svchost.exe

O23 - Service: Remote-Registrierung (RemoteRegistry) - Unknown owner - C:\WINDOWS\system32\svchost.exe

O23 - Service: Remoteprozeduraufruf (RPC) (RpcSs) - Unknown owner - C:\WINDOWS\system32\svchost.exe

O23 - Service: Sicherheitskontenverwaltung (SamSs) - Unknown owner - C:\WINDOWS\system32\lsass.exe

O23 - Service: Taskplaner (Schedule) - Unknown owner - C:\WINDOWS\System32\svchost.exe

O23 - Service: Sekundäre Anmeldung (seclogon) - Unknown owner - C:\WINDOWS\System32\svchost.exe

O23 - Service: Systemereignisbenachrichtigung (SENS) - Unknown owner - C:\WINDOWS\system32\svchost.exe

O23 - Service: Windows-Firewall/Gemeinsame Nutzung der Internetverbindung (SharedAccess) - Unknown owner - C:\WINDOWS\system32\svchost.exe

O23 - Service: Shellhardwareerkennung (ShellHWDetection) - Unknown owner - C:\WINDOWS\System32\svchost.exe

O23 - Service: Systemwiederherstellungsdienst (srservice) - Unknown owner - C:\WINDOWS\system32\svchost.exe

O23 - Service: Windows-Bilderfassung (WIA) (stisvc) - Unknown owner - C:\WINDOWS\system32\svchost.exe

O23 - Service: Telefonie (TapiSrv) - Unknown owner - C:\WINDOWS\System32\svchost.exe

O23 - Service: Terminaldienste (TermService) - Unknown owner - C:\WINDOWS\System32\svchost.exe

O23 - Service: Designs (Themes) - Unknown owner - C:\WINDOWS\System32\svchost.exe

O23 - Service: Überwachung verteilter Verknüpfungen (Client) (TrkWks) - Unknown owner - C:\WINDOWS\system32\svchost.exe

O23 - Service: TuneUp Drive Defrag-Dienst (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

O23 - Service: TuneUp Designerweiterung (UxTuneUp) - Unknown owner - C:\WINDOWS\System32\svchost.exe

O23 - Service: Webclient (WebClient) - Unknown owner - C:\WINDOWS\system32\svchost.exe

O23 - Service: Windows-Verwaltungsinstrumentation (winmgmt) - Unknown owner - C:\WINDOWS\system32\svchost.exe

O23 - Service: Windows Remote Management (WS-Management) (WinRM) - Unknown owner - C:\WINDOWS\system32\svchost.exe

O23 - Service: Portable Media Serial Number Service (WmdmPmSN) - Unknown owner - C:\WINDOWS\System32\svchost.exe

O23 - Service: Treibererweiterungen für Windows-Verwaltungsinstrumentation (Wmi) - Unknown owner - C:\WINDOWS\System32\svchost.exe

O23 - Service: Automatische Updates (wuauserv) - Unknown owner - C:\WINDOWS\system32\svchost.exe

O23 - Service: Windows Driver Foundation - User-mode Driver Framework (WudfSvc) - Unknown owner - C:\WINDOWS\system32\svchost.exe

O23 - Service: Konfigurationsfreie drahtlose Verbindung (WZCSVC) - Unknown owner - C:\WINDOWS\System32\svchost.exe

O23 - Service: Netzwerkversorgungsdienst (xmlprov) - Unknown owner - C:\WINDOWS\System32\svchost.exe
 

--

End of file - 14988 bytes
Ich bin kein Computerexperte, desshalb bitte Schritt für Schritt erklären.
Danke