Forum
Tipps
News
Frage stellen
search
Menu-Icon
search

Hilfe Malware: Hab die Anweisungen durchgeführt / bitte Reports ankugen

Hallo,
hab mir antscheinend was eingefangen und nun aus dem Forum die Anweisungen durchgeführt.
Kann sich bitte jemand diese Reports ankugen?

 Malware:

Malwarebytes' Anti-Malware 1.37
Datenbank Version: 2238
Windows 6.0.6001 Service Pack 1

06.06.2009 23:42:28
mbam-log-2009-06-06 (23-42-28).txt

Scan-Methode: Vollständiger Scan (C:\|)
Durchsuchte Objekte: 203396
Laufzeit: 2 hour(s), 10 minute(s), 37 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 1
Infizierte Registrierungswerte: 1
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_CURRENT_USER\SOFTWARE\fcn (Rogue.Residue) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iuigyio (Trojan.Agent.H) -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\Users\Anita\AppData\Local\iuigyio.exe (Trojan.Agent.H) -> Delete on reboot.


Die 30 neuesten Dateien im Ordner Windows:
 
***** ***** ***** ***** ***** 
***** Scanning C:\Windows ***** 
***** ***** ***** ***** ***** 
 
 07.06.2009 WindowsUpdate.log 10 38:1.903.918 
 07.06.2009 bootstat.dat 10 34:67.584 
 06.06.2009 PFRO.log 23 46:844 
 16.04.2009 win.ini 14 53:240 
 25.11.2008 VPNInstall.MIF 10 21:1.593 
 29.10.2008 explorer.exe 08 29:2.927.104 
 14.10.2008 primopdf.ini 16 30:310 
 07.08.2008 WindowsShell.Manifest 18 20:749 
 24.07.2008 DIFxAPI.dll 19 31:319.456 
 24.07.2008 HideWin.exe 19 30:315.392 
 09.07.2008 ODBC.INI 14 58:400 
 09.07.2008 diagwrn.xml 14 02:1.905 
 09.07.2008 diagerr.xml 14 02:1.905 
 19.01.2008 regedit.exe 09 33:134.656 
 19.01.2008 notepad.exe 09 33:151.040 
 19.01.2008 HelpPane.exe 09 33:498.176 
 19.01.2008 fveupdate.exe 09 33:13.312 
 19.01.2008 bfsvc.exe 09 33:58.880 
 30.08.2007 SkyTel.exe 20 09:1.822.720 
 30.08.2007 RtlUpd.exe 20 09:1.191.936 
 30.08.2007 RtHDVCpl.exe 20 09:4.431.872 
 30.08.2007 RtlExUpd.dll 20 09:520.192 
 30.08.2007 RtDefLvl.ini 20 09:1.132 
 03.07.2007 super.chm 07 59:9.292 
 02.11.2006 WMSysPr9.prx 14 35:316.640 
 02.11.2006 twunk_16.exe 14 34:49.680 
 02.11.2006 twain_32.dll 14 34:50.688 


V/W-Scan
 
Die 50 neuesten Dateien im Ordner Windows\system32:
 
***** ***** ***** ***** ***** 
***** Scanning C:\Windows\system32 ***** 
***** ***** ***** ***** ***** 
 
 07.06.2009 perfh009.dat 10 40:590.082 
 07.06.2009 perfh007.dat 10 40:621.942 
 07.06.2009 perfc007.dat 10 40:123.666 
 07.06.2009 perfc009.dat 10 40:102.094 
 07.06.2009 PerfStringBackup.INI 10 40:1.427.210 
 07.06.2009 7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 10 35:4.048 
 07.06.2009 7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 10 35:4.048 
 02.06.2009 FNTCACHE.DAT 12 02:310.416 
 14.05.2009 javaws.exe 20 12:148.888 
 14.05.2009 javaw.exe 20 12:144.792 
 14.05.2009 java.exe 20 12:144.792 
 14.05.2009 deploytk.dll 20 12:410.984 
 07.05.2009 mrt.exe 09 16:24.699.336 
 30.04.2009 maplecompat.dll 17 19:20.480 
 30.04.2009 WMIMPLEX.dll 17 19:212.992 
 30.04.2009 maplec.dll 17 19:40.960 
 27.04.2009 asdjfhla.txt 15 31:39 
 21.04.2009 SearchRequire.tlb 22 25:2.804 
 15.04.2009 dpl100.dll 22 24:90.112 
 15.04.2009 divx_xx0c.dll 22 24:823.296 
 15.04.2009 divx_xx11.dll 22 24:802.816 
 15.04.2009 divx_xx0a.dll 22 24:815.104 
 15.04.2009 DivX.dll 22 24:684.032 
 15.04.2009 divx_xx07.dll 22 24:823.296 
 14.04.2009 searchrequire.cfg 21 02:8 
 09.04.2009 SearchRequire.dll 12 38:53.248 
 09.04.2009 Interop.SHDocVw.dll 12 38:126.976 
 17.03.2009 apilogen.dll 05 38:13.824 
 17.03.2009 amxread.dll 05 38:24.064 
 08.03.2009 iedkcs32.dll 23 09:391.536 
 08.03.2009 mshtml.dll 13 41:5.937.152 
 08.03.2009 ieframe.dll 13 39:11.063.808 
 08.03.2009 html.iec 13 35:385.024 
 08.03.2009 wininet.dll 13 34:914.944 
 08.03.2009 urlmon.dll 13 34:1.206.784 
 08.03.2009 inetcpl.cpl 13 34:1.469.440 
 08.03.2009 WinFXDocObj.exe 13 34:208.384 
 08.03.2009 webcheck.dll 13 34:236.544 
 08.03.2009 licmgr10.dll 13 34:43.008 
 08.03.2009 url.dll 13 34:105.984 
 08.03.2009 msrating.dll 13 34:193.536 
 08.03.2009 occache.dll 13 34:109.568 
 08.03.2009 corpol.dll 13 33:18.944 
 08.03.2009 jsproxy.dll 13 33:25.600 
 08.03.2009 iesysprep.dll 13 33:109.056 
 08.03.2009 PDMSetup.exe 13 33:109.568 
 08.03.2009 RegisterIEPKEYs.exe 13 33:107.520 
 
 
***** ***** ***** ***** ***** 
***** Scanning C:\Windows\system32\drivers\etc\hosts ***** 
***** ***** ***** ***** ***** 
 
# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
#      102.54.94.97     rhino.acme.com          # source server
#       38.25.63.10     x.acme.com              # x client host

127.0.0.1       localhost
::1             localhost
 
 

***** ***** ***** ***** ***** 
***** Scanning Processe ***** 
***** ***** ***** ***** ***** 
 

Abbildname                     PID Sitzungsname       Sitz.-Nr. Speichernutzung
========================= ======== ================ =========== ===============
System Idle Process              0 Services                   0            24 K
System                           4 Services                   0         2.408 K
smss.exe                       480 Services                   0           576 K
csrss.exe                      612 Services                   0         4.680 K
wininit.exe                    664 Services                   0         3.280 K
csrss.exe                      676 Console                    1         9.664 K
services.exe                   708 Services                   0         5.888 K
lsass.exe                      720 Services                   0         3.412 K
lsm.exe                        728 Services                   0         3.336 K
svchost.exe                    864 Services                   0         5.236 K
svchost.exe                    952 Services                   0         6.016 K
svchost.exe                    988 Services                   0        15.864 K
svchost.exe                   1040 Services                   0        11.852 K
winlogon.exe                  1076 Console                    1         4.296 K
svchost.exe                   1124 Services                   0        59.852 K
svchost.exe                   1156 Services                   0        53.008 K
audiodg.exe                   1220 Services                   0        12.032 K
svchost.exe                   1240 Services                   0         3.788 K
SLsvc.exe                     1256 Services                   0         3.496 K
svchost.exe                   1280 Services                   0         9.472 K
svchost.exe                   1420 Services                   0        10.176 K
wlanext.exe                   1568 Services                   0         8.456 K
spoolsv.exe                   1700 Services                   0         7.284 K
sched.exe                     1724 Services                   0         1.644 K
svchost.exe                   1736 Services                   0        10.520 K
dwm.exe                        600 Console                    1        55.248 K
taskeng.exe                    756 Console                    1         9.084 K
explorer.exe                  1168 Console                    1        27.944 K
MSASCui.exe                   2120 Console                    1         5.276 K
RtHDVCpl.exe                  2136 Console                    1         5.172 K
rundll32.exe                  2212 Console                    1         3.848 K
SynTPStart.exe                2232 Console                    1         4.164 K
avgnt.exe                     2268 Console                    1         3.164 K
jusched.exe                   2300 Console                    1         6.644 K
rundll32.exe                  2320 Console                    1         4.724 K
sidebar.exe                   2328 Console                    1        21.560 K
PRINTKEY2000.EXE              2372 Console                    1         4.264 K
avguard.exe                   2448 Services                   0        12.660 K
cvpnd.exe                     2484 Services                   0         5.160 K
EvtEng.exe                    2516 Services                   0         7.916 K
svchost.exe                   2572 Services                   0         4.008 K
RegSrvc.exe                   2704 Services                   0         3.840 K
svchost.exe                   2748 Services                   0         4.736 K
svchost.exe                   2804 Services                   0         1.848 K
SearchIndexer.exe             2840 Services                   0        24.040 K
WmiPrvSE.exe                  3400 Services                   0         5.116 K
RtkBtMnt.exe                  3520 Console                    1         3.248 K
SynTPEnh.exe                  1988 Console                    1         3.712 K
taskeng.exe                   4048 Services                   0         5.624 K
ICQ.exe                        348 Console                    1        80.664 K
SearchProtocolHost.exe        1344 Services                   0         9.044 K
EXCEL.EXE                     3328 Console                    1        32.984 K
taskeng.exe                   4012 Services                   0         3.980 K
Skype.exe                     3304 Console                    1        51.496 K
skypePM.exe                   3732 Console                    1        23.472 K
firefox.exe                   3900 Console                    1        57.380 K
iTunes.exe                     592 Console                    1        62.920 K
iPodService.exe               2112 Services                   0         5.208 K
SearchFilterHost.exe          3056 Services                   0         5.232 K
SearchProtocolHost.exe        3008 Console                    1         6.420 K
cmd.exe                       3496 Console                    1         3.264 K
conime.exe                    1584 Console                    1         3.220 K
tasklist.exe                  3316 Console                    1         4.700 K
WmiPrvSE.exe                   576 Services                   0         5.956 K
 
 

Microsoft Windows [Version 6.0.6001]
 
 
http://www.paules-pc-forum.de 
***** Malware Team ***** 
 
 
***** Ende des Scans 07.06.2009 um 10:53:16,94 *** 


 Vielen Lieben Dank schonmal

 

Moderator informieren  


Antworten zu Hilfe Malware: Hab die Anweisungen durchgeführt / bitte Reports ankugen:

 Hier noch den Hijackthis Bericht

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:44:22, on 06.06.2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Users\Anita\AppData\Local\iuigyio.exe
C:\Users\Anita\Downloads\Setup\PRINTKEY2000\PRINTKEY2000.EXE
C:\Users\Anita\AppData\Local\Temp\RtkBtMnt.exe
C:\Windows\system32\wermgr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\firefox.exe
C:\Program Files\ICQ6.5\ICQ.exe
C:\Program Files\iTunes\iTunes.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) -  - (no file)
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {8a194578-81ea-4850-9911-13ba2d71efbd}  - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [iuigyio] "c:\users\anita\appdata\local\iuigyio.exe" iuigyio
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O4 - Startup: PRINTKEY2000 - Verknüpfung.lnk = C:\Users\Anita\Downloads\Setup\PRINTKEY2000\PRINTKEY2000.EXE
O4 - Global Startup: VPN Client.lnk = ?
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O13 - Gopher Prefix:
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = olydorf.swh.mhn.de
O17 - HKLM\Software\..\Telephony: DomainName = olydorf.swh.mhn.de
O17 - HKLM\System\CCS\Services\Tcpip\..\{5C4CC7D5-DA61-4E4C-9552-8C080E1D7B42}: NameServer = 10.150.128.2
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = olydorf.swh.mhn.de
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: AVM FRITZ!web Routing Service (de_serv) - Unknown owner - C:\Program Files\Common Files\AVM\de_serv.exe (file missing)
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MDESIGN License Manager - Macrovision Corporation - C:\Program Files\FLEXlm\MDESIGN\lmgrd.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe

--
End of file - 6426 bytes

 Danke nochmal  :)

Moderator informieren  

Wurde das Hijackthis vor oder nach dem Scan mit Malwarebytes gemacht ??

Bitte neues anfertigen.

Moderator informieren  

Dachte eigentlich schon nachher. Aber egal, hier nochmal.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:16:57, on 07.06.2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Users\Anita\Downloads\Setup\PRINTKEY2000\PRINTKEY2000.EXE
C:\Users\Anita\AppData\Local\Temp\RtkBtMnt.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ICQ6.5\ICQ.exe
C:\Program Files\Microsoft Office\Office12\EXCEL.EXE
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\firefox.exe
C:\Program Files\iTunes\iTunes.exe
C:\Windows\system32\conime.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O4 - Startup: PRINTKEY2000 - Verknüpfung.lnk = C:\Users\Anita\Downloads\Setup\PRINTKEY2000\PRINTKEY2000.EXE
O4 - Global Startup: VPN Client.lnk = ?
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O13 - Gopher Prefix:
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = olydorf.swh.mhn.de
O17 - HKLM\Software\..\Telephony: DomainName = olydorf.swh.mhn.de
O17 - HKLM\System\CCS\Services\Tcpip\..\{5C4CC7D5-DA61-4E4C-9552-8C080E1D7B42}: NameServer = 10.150.128.2
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = olydorf.swh.mhn.de
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: AVM FRITZ!web Routing Service (de_serv) - Unknown owner - C:\Program Files\Common Files\AVM\de_serv.exe (file missing)
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe

--
End of file - 6174 bytes

 

Moderator informieren  

Okay mache bitte weiter mit Combofix:

http://virus-protect.org/artikel/tools/combofix.html

logfile hier posten.

Moderator informieren  

Hier das Logfile:

ComboFix 09-06-06.03 - Anita 07.06.2009 11:28.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium   6.0.6001.1.1252.49.1031.18.2046.1232 [GMT 2:00]
ausgeführt von:: c:\users\Anita\Downloads\ComboFix.exe
SP: Windows-Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\INSTALL.LOG
c:\users\Anita\AppData\Local\iuigyio.dat
c:\users\Anita\AppData\Local\iuigyio_nav.dat
c:\users\Anita\AppData\Local\iuigyio_navps.dat
c:\windows\system32\drivers\Msft_Kernel_SynTP_01000.Wdf
c:\windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf

.
(((((((((((((((((((((((   Dateien erstellt von 2009-05-07 bis 2009-06-07  ))))))))))))))))))))))))))))))
.

2009-06-07 09:27 . 2009-06-07 09:27   --------   d-----w-   \Qoobox
2009-06-06 19:27 . 2009-06-06 19:27   --------   d-----w-   c:\users\Anita\AppData\Roaming\Malwarebytes
2009-06-06 19:27 . 2009-05-26 11:20   40160   ----a-w-   c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-06 19:27 . 2009-06-06 19:27   --------   d-----w-   c:\program files\Malwarebytes' Anti-Malware
2009-06-06 19:27 . 2009-06-06 19:27   --------   d-----w-   c:\programdata\Malwarebytes
2009-06-06 19:27 . 2009-05-26 11:19   19096   ----a-w-   c:\windows\system32\drivers\mbam.sys
2009-06-06 19:20 . 2009-06-06 19:20   --------   d-----w-   c:\program files\CCleaner
2009-06-06 18:43 . 2009-06-06 18:43   --------   d-----w-   c:\program files\Trend Micro
2009-05-14 18:13 . 2009-05-14 18:12   410984   ----a-w-   c:\windows\system32\deploytk.dll
2009-05-14 18:12 . 2009-05-14 18:12   --------   d-----w-   c:\program files\Java
2009-05-14 15:15 . 2009-05-14 15:15   --------   d-----w-   c:\users\Anita\Setup Programme

.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-07 09:23 . 2008-10-09 17:00   --------   d-----w-   c:\users\Anita\AppData\Roaming\Skype
2009-06-07 08:51 . 2008-10-09 17:02   --------   d-----w-   c:\users\Anita\AppData\Roaming\skypePM
2009-06-07 08:40 . 2006-11-02 15:33   621942   ----a-w-   c:\windows\system32\perfh007.dat
2009-06-07 08:40 . 2006-11-02 15:33   123666   ----a-w-   c:\windows\system32\perfc007.dat
2009-06-07 08:34 . 2008-07-08 20:46   2145837056   --sha-w-   \hiberfil.sys
2009-06-07 08:34 . 2008-07-08 20:40   2459627520   --sha-w-   \pagefile.sys
2009-06-06 21:46 . 2008-07-09 15:43   83907   ----a-w-   c:\users\Anita\AppData\Roaming\nvModes.dat
2009-06-06 19:13 . 2009-05-01 16:47   90   ----a-w-   c:\users\Anita\AppData\Local\ysoaqee.bat
2009-06-02 10:02 . 2008-07-08 20:51   77624   ----a-w-   c:\users\Anita\AppData\Local\GDIPFONTCACHEV1.DAT
2009-06-01 15:33 . 2009-04-16 13:32   --------   d-----w-   c:\programdata\Autodesk
2009-05-30 09:08 . 2008-07-09 14:55   --------   d-----w-   c:\programdata\Microsoft Help
2009-05-30 09:06 . 2008-07-09 14:58   --------   d-----w-   c:\program files\Microsoft Works
2009-05-14 18:13 . 2008-07-15 16:39   --------   d-----w-   c:\program files\extensions
2009-05-14 18:13 . 2008-07-15 16:39   --------   d-----w-   c:\program files\plugins
2009-05-14 12:27 . 2006-11-02 11:18   --------   d-----w-   c:\program files\Windows Mail
2009-05-10 12:53 . 2009-05-10 12:53   93685   ----a-w-   c:\programdata\tmp403D.tmp
2009-05-05 15:44 . 2009-05-05 15:44   332067   ----a-w-   c:\programdata\tmp4817.tmp
2009-05-03 17:38 . 2009-05-03 17:38   236369   ----a-w-   c:\programdata\tmp4BA4.tmp
2009-05-03 17:34 . 2009-05-03 17:34   32931   ----a-w-   c:\programdata\tmpA7E7.tmp
2009-05-01 17:00 . 2009-05-01 17:00   994   ----a-w-   c:\program files\active-update.xml
2009-05-01 17:00 . 2008-07-23 17:21   --------   d-----w-   c:\program files\DivX
2009-05-01 15:24 . 2008-07-08 20:51   680   ----a-w-   c:\users\Anita\AppData\Local\d3d9caps.dat
2009-05-01 14:02 . 2009-05-01 14:02   --------   d-----w-   c:\program files\Common Files\DivX Shared
2009-05-01 13:21 . 2009-05-01 13:21   --------   d-----w-   c:\program files\Xvid
2009-05-01 13:18 . 2009-05-01 13:18   --------   d-----w-   c:\program files\AC3Filter
2009-04-30 15:24 . 2009-04-30 15:14   --------   d-----w-   c:\program files\Maple 12
2009-04-30 15:19 . 2009-04-30 15:19   20480   ----a-w-   c:\windows\system32\maplecompat.dll
2009-04-30 15:19 . 2009-04-30 15:14   --------   d--h--w-   c:\program files\Zero G Registry
2009-04-30 15:19 . 2009-04-30 15:19   40960   ----a-w-   c:\windows\system32\maplec.dll
2009-04-30 15:19 . 2009-04-30 15:19   212992   ----a-w-   c:\windows\system32\WMIMPLEX.dll
2009-04-27 13:37 . 2009-04-27 13:37   --------   d-----w-   c:\programdata\Macrovision
2009-04-27 13:34 . 2009-04-27 13:34   --------   d-----w-   c:\program files\FLEXlm
2009-04-27 13:34 . 2008-07-09 14:25   --------   d--h--w-   c:\program files\InstallShield Installation Information
2009-04-27 13:20 . 2009-04-27 13:18   --------   d-----w-   c:\program files\Formelsammlung
2009-04-27 12:38 . 2009-03-19 15:14   96104   ----a-w-   c:\windows\system32\drivers\avipbb.sys
2009-04-27 12:38 . 2009-03-19 15:14   55640   ----a-w-   c:\windows\system32\drivers\avgntflt.sys
2009-04-22 19:36 . 2009-04-16 13:32   --------   d-----w-   c:\users\Anita\AppData\Roaming\Autodesk
2009-04-22 19:35 . 2009-04-22 19:35   10134   ----a-r-   c:\users\Anita\AppData\Roaming\Microsoft\Installer\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}\ARPPRODUCTICON.exe
2009-04-22 19:35 . 2009-04-22 19:35   --------   d-----w-   c:\program files\Microsoft WSE
2009-04-21 20:25 . 2009-04-21 20:25   --------   d-----w-   c:\program files\downloaden
2009-04-16 14:04 . 2009-04-16 14:04   36864   ----a-w-   c:\users\Anita\AppData\Roaming\Autodesk\AutoCAD 2010\R18.0\enu\ContextualTabSelectorRules.dll
2009-04-16 13:51 . 2009-04-16 13:51   --------   d-----w-   c:\programdata\FLEXnet
2009-04-16 13:36 . 2009-04-16 13:36   --------   d-----w-   c:\program files\Common Files\Macrovision Shared
2009-04-15 20:24 . 2009-04-15 20:24   90112   ----a-w-   c:\windows\system32\dpl100.dll
2009-04-15 20:24 . 2009-04-15 20:24   823296   ----a-w-   c:\windows\system32\divx_xx0c.dll
2009-04-15 20:24 . 2009-04-15 20:24   823296   ----a-w-   c:\windows\system32\divx_xx07.dll
2009-04-15 20:24 . 2009-04-15 20:24   815104   ----a-w-   c:\windows\system32\divx_xx0a.dll
2009-04-15 20:24 . 2009-04-15 20:24   802816   ----a-w-   c:\windows\system32\divx_xx11.dll
2009-04-15 20:24 . 2009-04-15 20:24   684032   ----a-w-   c:\windows\system32\DivX.dll
2009-04-09 10:38 . 2009-04-09 10:38   53248   ----a-w-   c:\windows\system32\SearchRequire.dll
2009-04-09 10:38 . 2009-04-09 10:38   126976   ----a-w-   c:\windows\system32\Interop.SHDocVw.dll
2009-03-17 16:48 . 2009-03-17 16:48   862   ----a-w-   c:\programdata\tmpCE66.tmp
2009-03-17 16:48 . 2009-03-17 16:48   862   ----a-w-   c:\programdata\tmpA4E6.tmp
2009-03-17 16:47 . 2009-03-17 16:47   862   ----a-w-   c:\programdata\tmpC706.tmp
2009-03-17 03:38 . 2009-04-16 12:49   13824   ----a-w-   c:\windows\system32\apilogen.dll
2009-03-17 03:38 . 2009-04-16 12:49   24064   ----a-w-   c:\windows\system32\amxread.dll
2008-10-19 16:42 . 2008-10-19 16:42   998   ----a-w-   c:\program files\updates.xml
2008-05-29 16:07 . 2008-07-15 16:39   699   ----a-w-   c:\program files\updater.ini
2008-05-29 16:07 . 2008-07-15 16:39   220   ----a-w-   c:\program files\browserconfig.properties
2008-05-29 16:07 . 2008-07-15 16:39   106   ----a-w-   c:\program files\old-homepage-default.properties
2008-05-29 16:07 . 2008-07-15 16:39   229   ----a-w-   c:\program files\README.txt
2008-05-29 14:24 . 2008-07-15 16:39   476   ----a-w-   c:\program files\softokn3.chk
2008-05-29 14:24 . 2008-07-15 16:39   151552   ----a-w-   c:\program files\softokn3.dll
2008-05-29 14:24 . 2008-07-15 16:39   476   ----a-w-   c:\program files\freebl3.chk
2008-05-29 14:24 . 2008-07-15 16:39   233472   ----a-w-   c:\program files\freebl3.dll
2008-05-29 14:24 . 2008-07-15 16:39   44   ----a-w-   c:\program files\platform.ini
2008-05-29 14:24 . 2008-07-15 16:39   981   ----a-w-   c:\program files\blocklist.xml
2008-05-29 14:24 . 2008-07-15 16:39   31393   ----a-w-   c:\program files\LICENSE
2008-05-29 14:24 . 2008-07-15 16:39   2025   ----a-w-   c:\program files\application.ini
2008-03-08 00:52 . 2008-07-15 16:39   4053   ----a-w-   c:\program files\crashreporter.ini
2008-02-03 15:25 . 2008-07-15 16:39   705   ----a-w-   c:\program files\crashreporter-override.ini
2006-05-03 09:06 . 2008-07-30 17:14   163328   --sh--r-   c:\windows\System32\flvDX.dll
2007-02-21 10:47 . 2008-07-30 17:14   31232   --sh--r-   c:\windows\System32\msfDX.dll
.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Easy-PrintToolBox"="c:\program files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE" [2006-10-17 398944]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2007-08-30 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-08-30 8429568]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-08-30 81920]
"SynTPStart"="c:\program files\Synaptics\SynTP\SynTPStart.exe" [2007-10-30 102400]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-14 148888]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2007-08-30 4431872]

c:\users\Anita\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
PRINTKEY2000 - Verknpfung.lnk - c:\users\Anita\Downloads\Setup\PRINTKEY2000\PRINTKEY2000.EXE [2008-7-9 794112]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
VPN Client.lnk - c:\windows\Installer\{4C271126-C295-4828-A901-5910AE0C258B}\Icon3E5562ED7.ico [2008-11-25 6144]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3102851551-2663328022-2275541088-1000]
"EnableNotificationsRef"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{4A36F8E5-9CDA-441D-989D-41CE7ED4B7CD}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{A167CEBD-3DAC-4839-A69C-48073F2B7A24}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"TCP Query User{CDA8960A-6507-464C-B031-B7371F36C14A}c:\\program files\\icq6\\icq.exe"= UDP:c:\program files\icq6\icq.exe:ICQ Library
"UDP Query User{20AB8924-8B75-439A-B308-E28B5A62459C}c:\\program files\\icq6\\icq.exe"= TCP:c:\program files\icq6\icq.exe:ICQ Library
"{011E80E2-FBFF-4C8F-99F0-EDC5749AE2D1}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{9F31915C-6C11-41F7-BC62-666510962E4F}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{4C925556-8C08-4309-BF03-CE1C2B97E4D8}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{88051672-7863-4307-85CE-2F03F2A4DFF0}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"{BE89E003-A4B1-413F-9291-8268958B8B39}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{E11AE57D-EA16-450E-AD2A-F8BEDB1B1B24}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{B96E8AB7-2924-4D0F-86F5-F652A70AFEEA}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"TCP Query User{11EB0F40-7528-46E3-AA9C-69D6BDC01D4D}c:\\program files\\icq6\\icq.exe"= UDP:c:\program files\icq6\icq.exe:ICQ Library
"UDP Query User{400601D9-5CDF-4F83-991C-551974834ECD}c:\\program files\\icq6\\icq.exe"= TCP:c:\program files\icq6\icq.exe:ICQ Library
"TCP Query User{FE779A7F-EA79-446A-99DB-F3A986EB60D8}c:\\program files\\icq6.5\\icq.exe"= UDP:c:\program files\icq6.5\icq.exe:ICQ
"UDP Query User{3F9A143E-B596-460C-A93B-B198C05126C9}c:\\program files\\icq6.5\\icq.exe"= TCP:c:\program files\icq6.5\icq.exe:ICQ
"TCP Query User{D38520A7-B7B4-49B6-803D-677F80612241}c:\\program files\\icq6.5\\icq.exe"= UDP:c:\program files\icq6.5\icq.exe:ICQ
"UDP Query User{0DB2EA53-AFEB-45BE-8FC5-768712C31BA7}c:\\program files\\icq6.5\\icq.exe"= TCP:c:\program files\icq6.5\icq.exe:ICQ

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [19.03.2009 17:14 108289]
R3 b57nd60x;%SvcDispName%;c:\windows\System32\drivers\b57nd60x.sys [20.07.2008 18:35 179712]
R3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\System32\drivers\NETw5v32.sys [17.11.2008 08:40 3668480]
R3 winbondcir;Winbond IR Transceiver;c:\windows\System32\drivers\winbondcir.sys [28.03.2007 07:51 43008]
S3 FWLANUSB;AVM FRITZ!WLAN;c:\windows\System32\drivers\fwlanusb.sys [09.07.2008 13:33 452736]
S4 MDESIGN License Manager;MDESIGN License Manager;c:\program files\FLEXlm\MDESIGN\lmgrd.exe [27.04.2009 15:34 1339392]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -

SafeBoot-procexp90.Sys


.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
uInternet Settings,ProxyOverride = *.local
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: {5C4CC7D5-DA61-4E4C-9552-8C080E1D7B42} = 10.150.128.2
FF - ProfilePath - c:\users\Anita\AppData\Roaming\Mozilla\Firefox\Profiles\57hzc4dl.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q=

---- Firefox Richtlinien ----
FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-07 11:32
Windows 6.0.6001 Service Pack 1 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Zeit der Fertigstellung: 2009-06-07 11:34
ComboFix-quarantined-files.txt  2009-06-07 09:34

Vor Suchlauf: 17 Verzeichnis(se), 74.701.107.200 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 74.664.570.880 Bytes frei

200   --- E O F ---   2009-06-04 17:22
 

Moderator informieren  

Okay hattest navipromo drauf.

Mache bitte folgendes:

Start -> Ausführen -> Combofix /u

Dann wird combofix erneut starten und sich entfernen!

Mache dann weiter mit Sdfix:

http://virus-protect.org/artikel/tools/sdfix.html

Moderator informieren  

Sdfix vergessen, läuft unter Vista nicht.

Ladt Navilog runter und wähle zuerst Option 1 aus.

Report posten.

http://virus-protect.org/artikel/tools/navilog.html

 

Moderator informieren  

 Navilog

Search Navipromo version 3.7.7 began on 07.06.2009 at 21:01:16,44

!!! Warning, this report may include legitimate files/programs !!!
!!! Post this report on the forum you are being helped !!!
!!! Don't continue with removal unless instructed by an authorized helper !!!

Fix running from C:\Program Files\navilog1

Updated on 12.05.2009 at 18h00 by IL-MAFIOSO

Microsoft® Windows Vista™ Home Premium  ( v6.0.6001 ) Service Pack 1
X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 Duo CPU     T7300  @ 2.00GHz )
BIOS : ZD1 v0.3508 3E08
USER : Anita ( Administrator )
BOOT : Normal boot




C:\ (Local Disk) - NTFS - Total:149 Go (Free:69 Go)
D:\ (CD or DVD)


Search done in normal mode


*** Search folders in "C:\Windows" ***


*** Search folders in "C:\Program Files" ***


*** Search folders in "c:\progra~2\micros~1\windows\startm~1\programs" ***


*** Search folders in "c:\progra~2\micros~1\windows\startm~1" ***


*** Search folders in "C:\ProgramData" ***


*** Search folders in "c:\users\anita\appdata\roaming\micros~1\windows\startm~1\programs" ***


*** Search folders in "C:\Users\Anita\AppData\Local\virtualstore\Program Files" ***



*** Search folders in "C:\Users\Anita\AppData\Local" ***




*** Search folders in "C:\Users\Anita\AppData\Roaming" ***


*** Search with Catchme-rootkit/stealth malware detector by gmer ***
for more info : http://www.gmer.net



*** Search with GenericNaviSearch ***
!!! Possibility of legitimate files in the result !!!
!!! Must always be checked before manually deleting !!!

* Scan in "C:\Windows\system32" *

* Scan in "C:\Users\Anita\AppData\Local\Microsoft" *

* Scan in "C:\Users\Anita\AppData\Local\virtualstore\windows\system32" *

* Scan in "C:\Users\Anita\AppData\Local" *



*** Search files ***



*** Search specific Registry keys ***
!! Following keys are not certainly all infected !!


*** Complementary Search ***
(Search specific files)

1)Search new Instant Access files :


2)Heuristic Search :

* In "C:\Windows\system32" :


* In "C:\Users\Anita\AppData\Local\Microsoft" :


* In "C:\Users\Anita\AppData\Local\virtualstore\windows\system32" :


* In "C:\Users\Anita\AppData\Local" :


3)Certificates Search :

Egroup certificate not found !
Electronic-Group certificate not found !
Montorgueil certificate not found !
OOO-Favorit certificate not found !
Sunny-Day-Design-Ltd certificate not found !

4)Search others known folders and files :

 

Moderator informieren  

Okay bitte A-squared Free installieren -> Updaten und einen Detail Scan machen. Funde löschen und Report posten.

Moderator informieren  

 A Squared Free


a-squared Free - Version 4.5
Letztes Update: 07.06.2009 21:55:46

Scan Einstellungen:

Scan Methode: Detail Scan
Objekte: Speicher, Traces, Cookies, C:\
Archiv Scan: An
Heuristik: Aus
ADS Scan: An

Scan Beginn:   07.06.2009 21:56:49

C:\Users\Anita\AppData\Roaming\Microsoft\Windows\Cookies\anita@2o7[1].txt    gefunden: Trace.TrackingCookie.2o7!A2
C:\Users\Anita\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt    gefunden: Trace.TrackingCookie.adserv!A2
C:\Users\Anita\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt    gefunden: Trace.TrackingCookie.adserv!A2
C:\Users\Anita\AppData\Roaming\Microsoft\Windows\Cookies\anita@adtech[1].txt    gefunden: Trace.TrackingCookie.adtech!A2
C:\Users\Anita\AppData\Roaming\Microsoft\Windows\Cookies\anita@advertising[2].txt    gefunden: Trace.TrackingCookie.advertising!A2
C:\Users\Anita\AppData\Roaming\Microsoft\Windows\Cookies\anita@adviva[1].txt    gefunden: Trace.TrackingCookie.adviva!A2
C:\Users\Anita\AppData\Roaming\Microsoft\Windows\Cookies\anita@atdmt[1].txt    gefunden: Trace.TrackingCookie.atdmt!A2
C:\Users\Anita\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt    gefunden: Trace.TrackingCookie.bs.serving-sys!A2
C:\Users\Anita\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt    gefunden: Trace.TrackingCookie.com!A2
C:\Users\Anita\AppData\Roaming\Microsoft\Windows\Cookies\anita@doubleclick[1].txt    gefunden: Trace.TrackingCookie.doubleclick!A2
C:\Users\Anita\AppData\Roaming\Microsoft\Windows\Cookies\anita@doubleclick[2].txt    gefunden: Trace.TrackingCookie.doubleclick!A2
C:\Users\Anita\AppData\Roaming\Microsoft\Windows\Cookies\anita@doubleclick[3].txt    gefunden: Trace.TrackingCookie.doubleclick!A2
C:\Users\Anita\AppData\Roaming\Microsoft\Windows\Cookies\anita@serving-sys[2].txt    gefunden: Trace.TrackingCookie.serving-sys!A2
C:\Users\Anita\AppData\Roaming\Microsoft\Windows\Cookies\anita@statcounter[2].txt    gefunden: Trace.TrackingCookie.statcounter!A2
C:\Users\Anita\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt    gefunden: Trace.TrackingCookie.statse.webtrendslive!A2
C:\Users\Anita\AppData\Roaming\Microsoft\Windows\Cookies\anita@tradedoubler[2].txt    gefunden: Trace.TrackingCookie.tradedoubler!A2
C:\Users\Anita\AppData\Roaming\Microsoft\Windows\Cookies\anita@tradedoubler[3].txt    gefunden: Trace.TrackingCookie.tradedoubler!A2
C:\Users\Anita\AppData\Roaming\Microsoft\Windows\Cookies\anita@tribalfusion[1].txt    gefunden: Trace.TrackingCookie.tribalfusion!A2
C:\Users\Anita\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt    gefunden: Trace.TrackingCookie.www.com!A2
C:\Users\Anita\AppData\Roaming\Mozilla\Firefox\Profiles\57hzc4dl.default\cookies.sqlite:1244403868217983    gefunden: Trace.TrackingCookie.pop!A2
C:\Users\Anita\Downloads\Setup\DVD\CloneDVD.1.3.10.1-ORiON.www.eselfilme.de.rar/Keygen-CloneDVD.exe    gefunden: Riskware.Keygen.CloneDVD!IK
C:\Users\Anita\Downloads\Setup\DVD\CloneDVD.1.3.10.1.Incl.Keygen-ORiON\Keygen-CloneDVD.exe    gefunden: Riskware.Keygen.CloneDVD!IK

Gescannt

Dateien:    424813
Traces:    527934
Cookies:    201
Prozesse:    52

Gefunden

Dateien:    2
Traces:    0
Cookies:    21
Prozesse:    0
Registry Keys:    0

Scan Ende:   08.06.2009 00:01:58
Scan Zeit:   2:05:09

C:\Users\Anita\Downloads\Setup\DVD\CloneDVD.1.3.10.1-ORiON.www.eselfilme.de.rar/Keygen-CloneDVD.exe   Gelöscht Riskware.Keygen.CloneDVD!IK
C:\Users\Anita\Downloads\Setup\DVD\CloneDVD.1.3.10.1.Incl.Keygen-ORiON\Keygen-CloneDVD.exe   Gelöscht Riskware.Keygen.CloneDVD!IK
C:\Users\Anita\AppData\Roaming\Mozilla\Firefox\Profiles\57hzc4dl.default\cookies.sqlite:1244403868217983   Gelöscht Trace.TrackingCookie.pop!A2
C:\Users\Anita\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt   Gelöscht Trace.TrackingCookie.www.com!A2
C:\Users\Anita\AppData\Roaming\Microsoft\Windows\Cookies\anita@tribalfusion[1].txt   Gelöscht Trace.TrackingCookie.tribalfusion!A2
C:\Users\Anita\AppData\Roaming\Microsoft\Windows\Cookies\anita@tradedoubler[2].txt   Gelöscht Trace.TrackingCookie.tradedoubler!A2
C:\Users\Anita\AppData\Roaming\Microsoft\Windows\Cookies\anita@tradedoubler[3].txt   Gelöscht Trace.TrackingCookie.tradedoubler!A2
C:\Users\Anita\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt   Gelöscht Trace.TrackingCookie.statse.webtrendslive!A2
C:\Users\Anita\AppData\Roaming\Microsoft\Windows\Cookies\anita@statcounter[2].txt   Gelöscht Trace.TrackingCookie.statcounter!A2
C:\Users\Anita\AppData\Roaming\Microsoft\Windows\Cookies\anita@serving-sys[2].txt   Gelöscht Trace.TrackingCookie.serving-sys!A2
C:\Users\Anita\AppData\Roaming\Microsoft\Windows\Cookies\anita@doubleclick[1].txt   Gelöscht Trace.TrackingCookie.doubleclick!A2
C:\Users\Anita\AppData\Roaming\Microsoft\Windows\Cookies\anita@doubleclick[2].txt   Gelöscht Trace.TrackingCookie.doubleclick!A2
C:\Users\Anita\AppData\Roaming\Microsoft\Windows\Cookies\anita@doubleclick[3].txt   Gelöscht Trace.TrackingCookie.doubleclick!A2
C:\Users\Anita\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt   Gelöscht Trace.TrackingCookie.com!A2
C:\Users\Anita\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt   Gelöscht Trace.TrackingCookie.bs.serving-sys!A2
C:\Users\Anita\AppData\Roaming\Microsoft\Windows\Cookies\anita@atdmt[1].txt   Gelöscht Trace.TrackingCookie.atdmt!A2
C:\Users\Anita\AppData\Roaming\Microsoft\Windows\Cookies\anita@adviva[1].txt   Gelöscht Trace.TrackingCookie.adviva!A2
C:\Users\Anita\AppData\Roaming\Microsoft\Windows\Cookies\anita@advertising[2].txt   Gelöscht Trace.TrackingCookie.advertising!A2
C:\Users\Anita\AppData\Roaming\Microsoft\Windows\Cookies\anita@adtech[1].txt   Gelöscht Trace.TrackingCookie.adtech!A2
C:\Users\Anita\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt   Gelöscht Trace.TrackingCookie.adserv!A2
C:\Users\Anita\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt   Gelöscht Trace.TrackingCookie.adserv!A2
C:\Users\Anita\AppData\Roaming\Microsoft\Windows\Cookies\anita@2o7[1].txt   Gelöscht Trace.TrackingCookie.2o7!A2

Gelöscht

Dateien:    2
Traces:    0
Cookies:    20
 

Moderator informieren  

Ich muss sagen, wer sich selber Malware durch Keygens auf den PC holt ist einfach nur doof, ersrecht wenn es eh immer rauskommt!!!

Code: [Auswählen]
"C:\Users\Anita\Downloads\Setup\DVD\CloneDVD.1.3.10.1-ORiON.www.eselfilme.de.rar/Keygen-CloneDVD.exe    gefunden: Riskware.Keygen.CloneDVD!IK

C:\Users\Anita\Downloads\Setup\DVD\CloneDVD.1.3.10.1.Incl.Keygen-ORiON\Keygen-CloneDVD.exe    gefunden: Riskware.Keygen.CloneDVD!IK"
Mache einen online Scan mit F-secure und lasse weitere Funde löschen, den Report auch wieder hier posten.
Moderator informieren  

Scanning Report
Monday, June 8, 2009 20:39:35 - 21:46:59

Computer name: R178017
Scanning type: Scan system for malware, spyware and rootkits
Target: C:\
6 malware found
TrackingCookie.2o7 (spyware)

    * System (Disinfected)

TrackingCookie.Doubleclick (spyware)

    * System (Disinfected)

TrackingCookie.Zanox (spyware)

    * System (Disinfected)

TrackingCookie.Atwola (spyware)

    * System (Disinfected)

TrackingCookie.Yieldmanager (spyware)

    * System (Disinfected)

W32/Packed_FSG.D (virus)

    * C:\PROGRAM FILES\NAVILOG1\GNC.EXE (Disinfected)

Statistics
Scanned:

    * Files: 71440
    * System: 3603
    * Not scanned: 19

Actions:

    * Disinfected: 6
    * Renamed: 0
    * Deleted: 0
    * Not cleaned: 0
    * Submitted: 0

Files not scanned:

    * C:\HIBERFIL.SYS
    * C:\PAGEFILE.SYS
    * C:\WINDOWS\SYSTEM32\CONFIG\COMPONENTS
    * C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT
    * C:\WINDOWS\SYSTEM32\CONFIG\SAM
    * C:\WINDOWS\SYSTEM32\CONFIG\SECURITY
    * C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE
    * C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM
    * C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\COMPONENTS
    * C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\SAM
    * C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\SECURITY
    * C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\DEFAULT
    * C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\SOFTWARE
    * C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\SYSTEM
    * C:\WINDOWS\SYSTEM32\CATROOT2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\CATDB
    * C:\WINDOWS\SYSTEM32\CATROOT2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\CATDB
    * C:\USERS\ALL USERS\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\C59AB3CAA76B8129D69111F448A2B59C_408FE236-5A37-4310-8BE8-BCDD2F169440
    * C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\C59AB3CAA76B8129D69111F448A2B59C_408FE236-5A37-4310-8BE8-BCDD2F169440
    * C:\BOOT\BCD

Options
Scanning engines:

Scanning options:

    * Scan defined files: COM EXE SYS OV? BIN SCR DLL SHS HTM HTML HTT VBS JS INF VXD DO? XL? RTF CPL WIZ HTA PP? PWZ P?T MSO PIF . ACM ASP AX CNV CSC DRV INI MDB MPD MPP MPT OBD OBT OCX PCI TLB TSP WBK WBT WPC WSH VWP WML BOO HLP TD0 TT6 MSG ASD JSE VBE WSC CHM EML PRC SHB LNK WSF {* PDF ZL? XML ZIP XXX ANI AVB BAT CMD JOB LSP MAP MHT MIF PHP POT SWF WMF NWS TAR
    * Use advanced heuristics

      Copyright © 1998-2009 Product support | Send virus sample to F-Secure
      F-Secure assumes no responsibility for material created or published by third parties that F-Secure World Wide Web pages have a link to. Unless you have clearly stated otherwise, by submitting material to any of our servers, for example by E-mail or via our F-Secure's CGI E-mail, you agree that the material you make available may be published in the F-Secure World Wide Pages or hard-copy publications. You will reach F-Secure public web site by clicking on underlined links. While doing this, your access will be logged to our private access statistics with your domain name. This information will not be given to any third party. You agree not to take action against us in relation to material that you submit. Unless you have clearly stated otherwise, by submitting material you warrant that F-Secure may incorporate any concepts described in it in the F-Secure products/publications without liability.

 

Moderator informieren  

Okay ist rein. Navilog noch löschen und ab die post.

oder gibts noch Probleme ?

Moderator informieren  

Hab nix mehr festgestellt.

Vielen Dank nochmal
LG

Moderator informieren  

« Welches dieser beiden AntiViren-Programme empfehlt ihr?Windows XP: Virus !!! »
 
Schnelle Hilfe: Hier nach ähnlichen Fragen und passenden Tipps suchen!

nidde Gast
Datum: 07.06.09, 11:07:16
2803x gelesen, 14 Antworten.
0 Mitglieder und 1 Gast betrachten dieses Thema.
Fremdwörter? Erklärungen im Lexikon!
Datenbank
Eine Datenbank (DBS), im englischen database, ist eine strukturierte Datensammlung und fungiert wie ein "digitales Archiv". Datenbanken dienen der effizienten Aufbewahrun...

Beta Version
Unter einer Beta Version versteht man ein Programm, das sich in einer Testphase, also noch vor der finalen Version, die veröffentlicht wird, befindet. Allgemein wird...

Bulk Version
Eine Bulk-Version ist nicht für den Einzelverkauf gedacht, sondern für Händler, die daraus ein Komplettangebot zusammenstellen. Oft erhält man nur die...



Ähnliche Fragen: