Wie Tojaner entfernen?

paprof · 01.10.2008, 11:26

Kriege den Trojaner nicht weg, bitte um Hilfe.
Habe gestern schon Malwarebytes laufen lassen, aber der hat nichts gefunden. Lasse grad nochmal scannen.
Bei der Datei handelt es sich um c:\windows\himem.exe

Die Analyse von virustotal:

Zitat:

AhnLab-V3 2008.10.1.0 2008.10.01 Win32/Xema.worm.1163576
AntiVir 7.8.1.34 2008.10.01 TR/VB.FC.1
Authentium 5.1.0.4 2008.09.30 W32/WormX.ZS
Avast 4.8.1195.0 2008.09.30 Win32:VB-FOR
AVG 8.0.0.161 2008.09.30 VB.APQ
BitDefender 7.2 2008.10.01 Win32.P2P.VB.AS
CAT-QuickHeal 9.50 2008.10.01 I-Worm.VB.fc
ClamAV 0.93.1 2008.10.01 Worm.P2P-1
DrWeb 4.44.0.09170 2008.10.01 Win32.HLLW.Hoad
eSafe 7.0.17.0 2008.09.30 P2P-Win32.VB.fc
eTrust-Vet 31.6.6120 2008.10.01 Win32/Tanaven.A
Ewido 4.0 2008.09.30 Worm.VB.fc
F-Prot 4.4.4.56 2008.09.30 W32/WormX.ZS
F-Secure 8.0.14332.0 2008.10.01 P2P-Worm.Win32.VB.fc
Fortinet 3.113.0.0 2008.10.01 W32/VB.FC!worm.p2p
GData 19 2008.10.01 Win32.P2P.VB.AS
Ikarus T3.1.1.34.0 2008.10.01 Win32.HLLW.Hoad
K7AntiVirus 7.10.478 2008.09.30 P2P-Worm.Win32.VB.fc
Kaspersky 7.0.0.125 2008.10.01 P2P-Worm.Win32.VB.fc
McAfee 5395 2008.10.01 Generic VB.b
Microsoft 1.4005 2008.10.01 Worm:Win32/VB.AH
NOD32 3485 2008.10.01 Win32/VB.NNI
Norman 5.80.02 2008.09.30 W32/VBWorm.OFF
Panda 9.0.0.4 2008.09.30 W32/Thanks.A.worm
PCTools 4.4.2.0 2008.09.30 Worm.P2P.VB.AAUQ
Prevx1 V2 2008.10.01 Malicious Software
Rising 20.63.62.00 2008.09.28 -
SecureWeb-Gateway 6.7.6 2008.10.01 Trojan.VB.FC.1
Sophos 4.34.0 2008.10.01 Mal/VB-F
Sunbelt 3.1.1675.1 2008.09.27 -
Symantec 10 2008.10.01 Downloader
TheHacker 6.3.0.9.097 2008.10.01 W32/VB.fc
TrendMicro 8.700.0.1004 2008.10.01 WORM_VB.FPK
VBA32 3.12.8.6 2008.09.30 Win32.HLLW.Hoad
ViRobot 2008.10.1.1401 2008.10.01 Worm.Win32.VB.7466676
VirusBuster 4.5.11.0 2008.09.30 Worm.P2P.VB.AAUQ
weitere Informationen
File size: 12288076 bytes
MD5...: bfbf4051521b0e4a4674b9b294c370d7
SHA1..: 17a14f098be39bc545b865de5fba84f7369a5f37
SHA256: f01c83ed689ab857ccc0e94f686026937fd60e833642552b048694481b391f82
SHA512: 6ca42553d8806634d695a73f6caebd3b2699f2e3220a118e45ef37dd3d291b0f
121c9521701f45123527ed2ca59417e8160be44c480047bab2a2e63ee6e3d070
PEiD..: -
TrID..: File type identification
Win32 Executable Microsoft Visual Basic 6 (86.2%)
Win32 Executable Generic (5.8%)
Win32 Dynamic Link Library (generic) (5.1%)
Generic Win/DOS Executable (1.3%)
DOS Executable Generic (1.3%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x401ccc
timedatestamp.....: 0x46ab1517 (Sat Jul 28 10:06:15 2007)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x18b9c 0x19000 6.26 51269e810784331a54ccaad950dbb48a
.data 0x1a000 0x152c 0x1000 0.00 620f0b67a91f7f74151bc5be745b7110
.rsrc 0x1c000 0x33d4 0x4000 3.97 526b4578b3b53967f0f03b6e98a1141a

( 1 imports )
> MSVBVM60.DLL: __vbaVarSub, __vbaStrI2, __vbaNextEachAry, _CIcos, _adj_fptan, __vbaVarMove, __vbaVarVargNofree, __vbaFreeVar, __vbaStrVarMove, __vbaLenBstr, __vbaEnd, __vbaFreeVarList, _adj_fdiv_m64, __vbaPut4, __vbaFreeObjList, -, __vbaVarTextTstLt, _adj_fprem1, -, __vbaVarTextCmpGt, __vbaStrCat, __vbaLsetFixstr, -, __vbaVarTextTstEq, -, __vbaSetSystemError, __vbaHresultCheckObj, __vbaLenVar, _adj_fdiv_m32, __vbaAryDestruct, -, __vbaExitProc, __vbaVarForInit, __vbaFileCloseAll, __vbaOnError, __vbaObjSet, -, _adj_fdiv_m16i, -, __vbaObjSetAddref, _adj_fdivr_m16i, -, __vbaStrFixstr, -, __vbaForEachCollVar, __vbaStrTextCmp, -, __vbaBoolVarNull, _CIsin, __vbaErase, __vbaVarZero, -, __vbaChkstk, -, __vbaFileClose, EVENT_SINK_AddRef, -, -, __vbaAryConstruct2, __vbaPutOwner3, __vbaStrTextLike, __vbaNextEachCollVar, DllFunctionCall, __vbaVarOr, _adj_fpatan, __vbaVarTextCmpLt, -, __vbaRedim, EVENT_SINK_Release, __vbaNew, __vbaVarTextTstNe, -, _CIsqrt, __vbaVarAnd, EVENT_SINK_QueryInterface, __vbaVarTextCmpEq, __vbaExceptHandler, __vbaStrToUnicode, __vbaPrintFile, -, __vbaExitEachAry, _adj_fprem, _adj_fdivr_m64, -, -, __vbaFPException, __vbaVarTextTstGe, __vbaInStrVar, __vbaStrVarVal, __vbaGetOwner3, __vbaVarCat, -, __vbaLsetFixstrFree, __vbaI2Var, __vbaFileSeek, -, _CIlog, __vbaFileOpen, __vbaInStr, __vbaNew2, -, __vbaR8Str, -, __vbaVarTextLikeVar, -, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, -, __vbaFreeStrList, -, __vbaVarTextTstGt, _adj_fdivr_m32, _adj_fdiv_r, -, -, -, -, __vbaI4Var, __vbaForEachAry, -, __vbaLateMemCall, __vbaVarAdd, __vbaStrToAnsi, __vbaVarDup, __vbaCheckTypeVar, __vbaVarMod, __vbaVarCopy, __vbaFpI4, __vbaVarSetObjAddref, -, _CIatan, __vbaCastObj, __vbaStrMove, -, __vbaStrVarCopy, __vbaR8IntI4, -, _allmul, -, __vbaVarTextCmpNe, _CItan, __vbaAryUnlock, __vbaFPInt, __vbaVarForNext, _CIexp, __vbaMidStmtBstr, __vbaFreeStr, __vbaFreeObj, -, -

( 0 exports )
Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=A6DFA4CA4C8836E8802FBB97E9757D00C144829C

Die Hihack-Auswertung:

Zitat:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:13:07, on 01.10.2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16711)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Sceneo\Bonavista\Services\ODSBC\ODSBCApp.exe
C:\Program Files\Home Cinema\TV Enhance\TVEService.exe
C:\Windows\System32\mmrtkrnl.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Logitech\SetPoint\LBTWiz.exe
C:\Windows\WindowsMobile\wmdcBase.exe
C:\Program Files\FreePDF_XP\fpassist.exe
C:\Windows\System32\rundll32.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\DL Mover\DLMov.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Windows\System32\mobsync.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Microsoft Office\Office12\WINWORD.EXE
C:\Windows\system32\rundll32.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.icq.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.msn.de
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [TVBroadcast] C:\Program Files\Sceneo\Bonavista\SERVICES\ODSBC\ODSBCApp.exe
O4 - HKLM\..\Run: [TVEService] "C:\Program Files\Home Cinema\TV Enhance\TVEService.exe"
O4 - HKLM\..\Run: [Realtime Audio Engine] "mmrtkrnl.exe" /i
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [ElbyCheckAnyDVD] "C:\Program Files\SlySoft\AnyDVD\ElbyCheck.exe" /L AnyDVD
O4 - HKLM\..\Run: [CloneDVDElbyDelay] "C:\Program Files\SlySoft\CloneDVD\ElbyCheck.exe" /L ElbyDelay
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [Bluetooth Connection Assistant] LBTWIZ.EXE -silent
O4 - HKLM\..\Run: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdcBase.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [FreePDF Assistant] C:\Program Files\FreePDF_XP\fpassist.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ActiveMultiwallpaper] C:\Program Files\ActiveMultiwallpaper\Changer.exe
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol 120\axcmd.exe" /automount
O4 - HKCU\..\Run: [himem] "c:\windows\himem.exe" 3fff 8ffff
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe (User 'Default user')
O4 - Startup: DLMov - Verknüpfung.lnk = DL Mover\DLMov.exe
O4 - Startup: Mozilla Sunbird.lnk = Mozilla Sunbird\sunbird.exe
O4 - Global Startup: Google Updater.lnk = Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: Lexware Info Service.lnk = Common Files\Lexware\Update Manager\LxUpdateManager.exe
O4 - Global Startup: Logitech SetPoint.lnk = Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~4.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~4.0_0\bin\ssv.dll
O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\Spiele\Poker\PartyPokerNet\RunPF.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\Spiele\Poker\PartyPokerNet\RunPF.exe (file missing)
O13 - Gopher Prefix:
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
O16 - DPF: {5BF3E4A3-7E64-4D53-B512-2E242E837D24} (CMCEInputCtl Object) - https://einfach.otto.de/ottoproj/ottomce//bin/activex/MCEControls.cab
O16 - DPF: {62BA437C-7712-48C6-9F0B-D251FA43192B} (SayaTV Control) - http://www.sayatv.com/download/SayaTV.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTSERV.EXE
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Sceneo PVR Service (srvcPVR) - Buhl Data Service GmbH - C:\Program Files\Sceneo\Bonavista\Services\PVR\PVRService.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: TVEnhance Background Capture Service (TBCS) (TVECapSvc) - Unknown owner - C:\Program Files\Home Cinema\TV Enhance\Kernel\TV\TVECapSvc.exe
O23 - Service: TVEnhance Task Scheduler (TTS)) (TVESched) - Unknown owner - C:\Program Files\Home Cinema\TV Enhance\Kernel\TV\TVESched.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

--
End of file - 12074 bytes

**Sunny** · 01.10.2008, 12:27

Hallo paprof

Hier nochmal das was du bei OSC schon von mir bekommen hast!
Brauche als erstes eine genaue Analyse der anderen beiden Dateien:

Dateien Online überprüfen lassen:

Als erstes versteckte Dateien anzeigen lassen! (nur Punkt 1 durchführen!)

Suche die Seite Virtustotal auf, klicke auf den Button „Durchsuchen“ und suche folgende Datei/Dateien:

Code:

ATTFilter

C:\Program Files\ActiveMultiwallpaper\Changer.exe
C:\Windows\System32\mmrtkrnl.exe

Lade nun nacheinander jede/alle Datei/Dateien hoch, und warte bis der Scan vorbei ist. (kann bis zu 2 Minuten dauern.)

Poste im Anschluss das Ergebnis der Auswertung, alles abkopieren und in einen Beitrag einfügen.

Wichtig: Auch die Größenangabe sowie den HASH mit kopieren!

danach bitte das hier:

ComboFix

Lade dir das Tool hier herunter auf den Desktop -> KLICK

Das Programm jedoch noch nicht starten sondern zuerst folgendes tun:

Schliesse alle Anwendungen und Programme, vor allem deine Antiviren-Software und andere Hintergrundwächter, sowie deinen Internetbrowser.
Vermeide es auch explizit während das Combofix läuft die Maus und Tastatur zu benutzen.

Dann folgende Anleitung durchlesen und abarbeiten -> CCleaner Systembereinigung

Starte nun die combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen und lass dein System durchsuchen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte abkopieren und in deinen Beitrag einfügen. Das log findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Hinweis: Combofix verhindert die Autostart Funktion aller CD / DVD und USB - Laufwerken um so eine Verbeitung einzudämmen. Wenn es hierdurch zu Problemen kommt, diese im Thread posten.

(ausführliche Anleitung -> Ein Leitfaden und Tutorium zur Nutzung von ComboFix)

paprof · 01.10.2008, 13:04

Datei mmrtkrnl.dll:

Zitat:

Antivirus Version letzte aktualisierung Ergebnis
AhnLab-V3 2008.10.1.0 2008.10.01 -
AntiVir 7.8.1.34 2008.10.01 -
Authentium 5.1.0.4 2008.09.30 -
Avast 4.8.1195.0 2008.10.01 -
AVG 8.0.0.161 2008.10.01 -
BitDefender 7.2 2008.10.01 -
CAT-QuickHeal 9.50 2008.10.01 -
ClamAV 0.93.1 2008.10.01 -
DrWeb 4.44.0.09170 2008.10.01 -
eSafe 7.0.17.0 2008.09.30 -
eTrust-Vet 31.6.6119 2008.09.30 -
Ewido 4.0 2008.10.01 -
F-Prot 4.4.4.56 2008.09.30 -
F-Secure 8.0.14332.0 2008.10.01 -
Fortinet 3.113.0.0 2008.10.01 -
GData 19 2008.10.01 -
Ikarus T3.1.1.34.0 2008.10.01 -
K7AntiVirus 7.10.478 2008.09.30 -
Kaspersky 7.0.0.125 2008.10.01 -
McAfee 5395 2008.10.01 -
Microsoft 1.4005 2008.10.01 -
NOD32 3485 2008.10.01 -
Norman 5.80.02 2008.09.30 -
Panda 9.0.0.4 2008.09.30 -
PCTools 4.4.2.0 2008.09.30 -
Prevx1 V2 2008.10.01 -
Rising 20.63.62.00 2008.09.28 -
SecureWeb-Gateway 6.7.6 2008.10.01 -
Sophos 4.34.0 2008.10.01 -
Sunbelt 3.1.1675.1 2008.09.27 -
Symantec 10 2008.10.01 -
TheHacker 6.3.0.9.097 2008.10.01 -
TrendMicro 8.700.0.1004 2008.10.01 -
VBA32 3.12.8.6 2008.09.30 -
ViRobot 2008.10.1.1401 2008.10.01 -
VirusBuster 4.5.11.0 2008.09.30 -
weitere Informationen
File size: 177664 bytes
MD5...: 917300d431a4490e089c2a72885176fc
SHA1..: 698dc0ca436c22ccade5a929eb6264e3b770b4c9
SHA256: d37289880d641922f9b6abc384a288eea82aad2ea0265309b8f125b54c38ee3d
SHA512: d4d98f740e045bd284404ce6ceea1f7740dc84530173e597ebb741b5464c801a
e9a2295ff83e03a403d58da97b6c01c236f1405e8c5d72dbd69bed68b88a8f68
PEiD..: -
TrID..: File type identification
Win32 Executable Generic (58.3%)
Win16/32 Executable Delphi generic (14.1%)
Generic Win/DOS Executable (13.7%)
DOS Executable Generic (13.6%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x42018c
timedatestamp.....: 0x2a425e19 (Fri Jun 19 22:22:17 1992)
machinetype.......: 0x14c (I386)

( 7 sections )
name viradd virsiz rawdsiz ntrpy md5
CODE 0x1000 0x1f388 0x1f400 6.53 3bd1cadcfa62cb49e002d9c8c60063d7
DATA 0x21000 0x820 0xa00 3.47 7b6227a3fb97fbc63a1081fa217326c0
BSS 0x22000 0xa45 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
.idata 0x23000 0xfe8 0x1000 4.87 33b722504d8ecb3c4ba136df7d65d74b
.edata 0x24000 0x87 0x200 1.51 2786236f02c2b71316b76915e88f65ee
.reloc 0x25000 0x24b0 0x2600 6.60 c5f6ce256b8ea450c8a22b068dc8e4f2
.rsrc 0x28000 0x7c00 0x7c00 4.41 fdbf03b3cc30f0cbaa175d25330ae7c9

( 13 imports )
> kernel32.dll: DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, GetVersion, GetCurrentThreadId, InterlockedDecrement, InterlockedIncrement, VirtualQuery, WideCharToMultiByte, MultiByteToWideChar, lstrlenA, lstrcpynA, LoadLibraryExA, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetCommandLineA, FreeLibrary, FindFirstFileA, FindClose, ExitProcess, WriteFile, UnhandledExceptionFilter, RtlUnwind, RaiseException, GetStdHandle
> user32.dll: GetKeyboardType, LoadStringA, MessageBoxA, CharNextA
> advapi32.dll: RegQueryValueExA, RegOpenKeyExA, RegCloseKey
> oleaut32.dll: SysFreeString, SysReAllocStringLen, SysAllocStringLen
> kernel32.dll: TlsSetValue, TlsGetValue, TlsFree, TlsAlloc, LocalFree, LocalAlloc
> advapi32.dll: RegSetValueExA, RegQueryValueExA, RegOpenKeyExA, RegFlushKey, RegCreateKeyExA, RegCloseKey
> kernel32.dll: WriteFile, WaitForSingleObject, VirtualQuery, VirtualProtect, VirtualAlloc, SetFilePointer, SetEvent, SetEndOfFile, ResetEvent, ReadFile, OpenSemaphoreA, LoadLibraryA, LeaveCriticalSection, InitializeCriticalSection, GlobalUnlock, GlobalReAlloc, GlobalHandle, GlobalLock, GlobalFree, GlobalFindAtomA, GlobalDeleteAtom, GlobalAlloc, GetVersionExA, GetThreadLocale, GetSystemDirectoryA, GetStringTypeExA, GetStdHandle, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLocalTime, GetLastError, GetFullPathNameA, GetFileAttributesA, GetDiskFreeSpaceA, GetDateFormatA, GetCurrentThreadId, GetCPInfo, GetACP, InterlockedIncrement, InterlockedDecrement, FreeLibrary, FormatMessageA, FindFirstFileA, FindClose, FileTimeToLocalFileTime, FileTimeToDosDateTime, EnumCalendarInfoA, EnterCriticalSection, DeviceIoControl, DeleteCriticalSection, CreateThread, CreateSemaphoreA, CreateFileA, CreateEventA, CreateDirectoryA, CompareStringA, CloseHandle
> version.dll: VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA
> user32.dll: CreateWindowExA, UnregisterClassA, TranslateMessage, SetWindowLongA, RegisterClassA, PeekMessageA, MsgWaitForMultipleObjects, MessageBoxA, LoadStringA, GetWindowLongA, GetSystemMetrics, GetClassInfoA, FindWindowA, DispatchMessageA, DestroyWindow, DefWindowProcA, CallWindowProcA, CharNextA, CharUpperBuffA, CharToOemA
> kernel32.dll: Sleep
> oleaut32.dll: SafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopy, VariantClear, VariantInit
> wsock32.dll: WSACleanup, WSAStartup, WSAGetLastError, WSACancelAsyncRequest, WSAAsyncGetServByName, WSAAsyncGetHostByName, WSAAsyncSelect, getservbyname, gethostbyname, socket, send, recv, ntohs, listen, ioctlsocket, inet_addr, htons, connect, closesocket, bind
> shell32.dll: SHGetSpecialFolderPathA

( 3 exports )
CallKernelDriver, CloseKernelDriver, OpenKernelDriver

Aber den Ordner bzw. Datei C:\Program Files\ActiveMultiwallpaper\Changer.exe gibt es nicht. Auch nicht als versteckten Ordner. Wo kommt das her?

paprof

**Sunny** · 01.10.2008, 13:11

Durch dieses Wallpaper, keine Ahnung wo das her kommt, wird auch sicherlich der Trojaner ins System gelangt sein..

Mach nun mit Combofix weiter, dann löschen wir den ganzen Müll..

paprof · 01.10.2008, 13:57

Das hier sagt ComboFix:

Zitat:

ComboFix 08-09-30.03 - Simon 2008-10-01 14:35:03.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1031.18.1086 [GMT 2:00]
ausgeführt von:: C:\Users\Simon\Desktop\ComboFix.exe
.

(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Windows\Downloaded Program Files\setup.inf

.
((((((((((((((((((((((( Dateien erstellt von 2008-09-01 bis 2008-10-01 ))))))))))))))))))))))))))))))
.

Keine neuen Dateien erstellt in diesem Zeitraum

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-01 12:22 --------- d-----w C:\Program Files\CCleaner
2008-10-01 10:06 12,288,076 ----a-w C:\Windows\himem.exe
2008-10-01 10:04 --------- d-----w C:\Program Files\Steam
2008-09-30 12:10 --------- d-----w C:\ProgramData\Google Updater
2008-09-30 10:24 --------- d-----w C:\Program Files\Malwarebytes' Anti-Malware
2008-09-30 10:21 --------- d-----w C:\Users\Simon\AppData\Roaming\Malwarebytes
2008-09-30 10:20 --------- d-----w C:\ProgramData\Malwarebytes
2008-09-29 10:48 --------- d-----w C:\Program Files\RocketDock
2008-09-29 10:28 615,424 ----a-w C:\Windows\System32\themeui.dll
2008-09-29 10:28 240,640 ----a-w C:\Windows\System32\uxtheme.dll
2008-09-28 20:11 --------- d-----w C:\Program Files\Mozilla Sunbird
2008-09-28 20:10 --------- d-----w C:\Program Files\Common Files\Steam
2008-09-26 14:49 --------- d-----w C:\ProgramData\SimCity Societies
2008-09-26 08:40 278,984 ----a-w C:\Windows\system32\drivers\atksgt.sys
2008-09-26 08:38 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-09-26 08:38 --------- d-----w C:\Program Files\Deep Silver
2008-09-26 08:37 --------- d-----w C:\Users\Simon\AppData\Roaming\InstallShield
2008-09-25 14:00 --------- d-----w C:\Program Files\BPM-Studio Profi
2008-09-25 13:59 --------- d-----w C:\Program Files\Azureus
2008-09-25 13:35 --------- d-----w C:\Program Files\MagicISO
2008-09-25 13:33 --------- d-----w C:\Users\Simon\AppData\Roaming\temp
2008-09-24 10:50 --------- d-----w C:\Program Files\Acro Software
2008-09-24 10:11 --------- d-----w C:\Program Files\Daslight
2008-09-23 19:33 --------- d-----w C:\Program Files\ICQ6
2008-09-22 21:01 --------- d-----w C:\Users\Simon\AppData\Roaming\dvdcss
2008-09-20 17:37 --------- d-----w C:\Program Files\eMule
2008-09-14 17:41 --------- d-----w C:\ProgramData\Microsoft Help
2008-09-14 16:29 --------- d-----w C:\Program Files\DL Mover
2008-09-09 22:04 38,528 ----a-w C:\Windows\system32\drivers\mbamswissarmy.sys
2008-09-09 22:03 17,200 ----a-w C:\Windows\system32\drivers\mbam.sys
2008-08-21 19:08 --------- d-----w C:\ProgramData\FreePDF
2008-08-19 16:38 --------- d-----w C:\Program Files\Common Files\Adobe
2008-08-18 18:55 --------- d-----w C:\ProgramData\NVIDIA
2008-08-18 16:34 --------- d-----w C:\Program Files\SystemRequirementsLab
2008-08-14 01:02 --------- d-----w C:\Program Files\Windows Mail
2008-08-08 22:40 --------- d-----w C:\ProgramData\Codemasters
2008-08-08 18:30 444,952 ----a-w C:\Windows\System32\wrap_oal.dll
2008-08-08 18:30 109,080 ----a-w C:\Windows\System32\OpenAL32.dll
2008-08-08 18:30 --------- d-----w C:\Program Files\OpenAL
2008-08-08 18:11 --------- d-----w C:\Program Files\Codemasters
2008-08-08 16:12 --------- d-----w C:\Program Files\TmNationsForever
2008-08-08 14:31 18,048 ----a-w C:\Windows\system32\drivers\lirsgt.sys
2008-08-07 18:05 --------- d-----w C:\Program Files\Sun
2008-08-07 18:05 --------- d-----w C:\Program Files\Java
2008-08-07 17:14 --------- d-----w C:\ProgramData\FLEXnet
2008-08-07 16:50 --------- d-----w C:\Program Files\Common Files\Control Panels
2008-08-07 16:48 --------- d-----w C:\Program Files\Bonjour
2008-08-07 16:39 --------- d-----w C:\Program Files\Common Files\Macrovision Shared
2008-08-07 05:10 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-08-04 16:47 --------- d-----w C:\Users\Simon\AppData\Roaming\Winamp
2008-08-04 16:47 --------- d-----w C:\Program Files\RouterControl
2008-08-04 16:47 --------- d-----w C:\Program Files\MAGIX Video Deluxe
2008-08-02 14:12 --------- d-----w C:\Program Files\YouTube to Mp3 Converter
2008-07-31 03:34 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-07-31 03:34 449,536 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-07-31 03:34 28,160 ----a-w C:\Windows\System32\Apphlpdm.dll
2008-07-31 03:34 2,144,256 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-07-31 03:34 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-07-31 03:34 1,686,528 ----a-w C:\Windows\System32\gameux.dll
2008-07-30 23:47 4,247,552 ----a-w C:\Windows\System32\GameUXLegacyGDFs.dll
2008-07-30 23:32 2,560 ----a-w C:\Windows\AppPatch\AcRes.dll
2008-07-19 15:09 174 --sha-w C:\Program Files\desktop.ini
2008-07-19 05:10 53,448 ----a-w C:\Windows\System32\wuauclt.exe
2008-07-19 05:10 45,768 ----a-w C:\Windows\System32\wups2.dll
2008-07-19 05:10 36,552 ----a-w C:\Windows\System32\wups.dll
2008-07-19 05:09 563,912 ----a-w C:\Windows\System32\wuapi.dll
2008-07-19 05:09 1,811,656 ----a-w C:\Windows\System32\wuaueng.dll
2008-07-19 03:44 83,456 ----a-w C:\Windows\System32\wudriver.dll
2008-07-19 03:44 1,524,736 ----a-w C:\Windows\System32\wucltux.dll
2008-07-18 20:08 163,904 ----a-w C:\Windows\System32\wuwebv.dll
2008-07-18 18:44 31,232 ----a-w C:\Windows\System32\wuapp.exe
2008-07-15 23:48 2,048 ----a-w C:\Windows\System32\tzres.dll
2007-08-28 16:12 0 ----a-w C:\Program Files\rrlog.txt
2007-06-06 04:55 0 ----a-w C:\Users\Simon\AppData\Roaming\wklnhst.dat
2006-05-03 10:06 163,328 --sh--r C:\Windows\System32\flvDX.dll
2007-02-21 11:47 31,232 --sh--r C:\Windows\System32\msfDX.dll
2007-12-17 13:43 27,648 --sh--w C:\Windows\System32\Smab0.dll
2007-11-18 10:22 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012007111820071119\index.dat
.

(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 125440]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-03-07 68856]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-12-23 143360]
"AlcoholAutomount"="C:\Program Files\Alcohol 120\axcmd.exe" [2007-07-02 220544]
"himem"="c:\windows\himem.exe" [2008-10-01 12288076]
"Steam"="C:\Program Files\Steam\Steam.exe" [2008-03-28 1271032]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 201728]
"RocketDock"="C:\Program Files\RocketDock\RocketDock.exe" [2007-09-02 495616]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-10 1232896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2006-09-29 151552]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"TVBroadcast"="C:\Program Files\Sceneo\Bonavista\SERVICES\ODSBC\ODSBCApp.exe" [2006-12-11 820736]
"TVEService"="C:\Program Files\Home Cinema\TV Enhance\TVEService.exe" [2007-01-12 155648]
"avgnt"="C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" [2008-04-25 262401]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"ElbyCheckAnyDVD"="C:\Program Files\SlySoft\AnyDVD\ElbyCheck.exe" [2003-09-20 45056]
"CloneDVDElbyDelay"="C:\Program Files\SlySoft\CloneDVD\ElbyCheck.exe" [2002-11-02 45056]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-10-10 36352]
"Windows Mobile-based device management"="C:\Windows\WindowsMobile\wmdcBase.exe" [2007-05-31 648072]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"FreePDF Assistant"="C:\Program Files\FreePDF_XP\fpassist.exe" [2007-04-25 311296]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2008-05-16 13535776]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2008-05-16 92704]
"RtHDVCpl"="RtHDVCpl.exe" [2006-12-01 C:\Windows\RtHDVCpl.exe]
"Realtime Audio Engine"="mmrtkrnl.exe" [2007-05-23 C:\Windows\System32\mmrtkrnl.exe]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-09-21 C:\Windows\KHALMNPR.Exe]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-09-21 C:\Windows\KHALMNPR.Exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 125440]

C:\Users\Simon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
DLMov - Verknpfung.lnk - C:\Program Files\DL Mover\DLMov.exe [2007-04-23 753664]
Mozilla Sunbird.lnk - C:\Program Files\Mozilla Sunbird\sunbird.exe [2007-08-28 6354540]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2008-03-07 125624]
Lexware Info Service.lnk - C:\Program Files\Common Files\Lexware\Update Manager\LxUpdateManager.exe [2006-10-27 2731048]
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2008-01-02 784912]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2007-11-15 11:10 72208 c:\Program Files\Common Files\Logitech\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.i420"= i420vfw.dll
"vidc.yv12"= yv12vfw.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{F11E76A2-8195-4298-8CD2-F4615C9555F0}"= UDP:C:\Program Files\Common Files\aol\acs\AOLDial.exe:AOL Optimized Dial-In
"{B0F6B1F6-8044-4AE1-A126-00F68145B63E}"= TCP:C:\Program Files\Common Files\aol\acs\AOLDial.exe:AOL Optimized Dial-In
"{CA98FD3C-49AE-46F6-B063-CF605C0D4DF1}"= UDP:C:\Program Files\Common Files\aol\acs\AOLacsd.exe:AOL Optimized Dial-In
"{418876EE-D465-44A3-A156-9A7D649BE4AC}"= TCP:C:\Program Files\Common Files\aol\acs\AOLacsd.exe:AOL Optimized Dial-In
"{3748D907-AEC7-4948-BBEB-A9D9C4BB51D8}"= UDP:C:\Program Files\AOL 9.0 VR\waol.exe:AOL
"{3EBA77F6-1201-4307-8D02-E8397FDAFC65}"= TCP:C:\Program Files\AOL 9.0 VR\waol.exe:AOL
"{E8307057-B0DC-44F3-BEA7-DBE5031C4F46}"= UDP:C:\Program Files\Common Files\aol\TopSpeed\3.0\aoltpsd3.exe:AOL TopSpeed
"{C0A0B5A1-95D3-417F-9F98-17D58AD4355E}"= TCP:C:\Program Files\Common Files\aol\TopSpeed\3.0\aoltpsd3.exe:AOL TopSpeed
"{C70731A9-1580-4FF9-9F82-EF440B02DF02}"= UDP:C:\Program Files\Common Files\aol\Loader\aolload.exe:AOL Loader
"{B531B213-D179-403F-AEC4-817FBB47F223}"= TCP:C:\Program Files\Common Files\aol\Loader\aolload.exe:AOL Loader
"{90AF2210-312B-4E9E-9C6C-B02D43898C06}"= UDP:C:\Program Files\Common Files\aol\System Information\sinf.exe:AOL System Information
"{3060B2F8-E81F-4FB9-A771-C45291FAAB5A}"= TCP:C:\Program Files\Common Files\aol\System Information\sinf.exe:AOL System Information
"{06BDDB6E-4229-47B2-AAE5-82F0ABCF90DA}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{6A120F1F-B642-4B58-AF25-EDB3BF0C4934}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{80F8961F-44ED-4D6A-9F8A-9324581FE993}"= UDP:C:\Program Files\Home Cinema\TV Enhance\TVEnhance.exe:CyberLink TVEnhance
"{86A13A66-7B7B-42FE-A1A6-3547B5181E94}"= TCP:C:\Program Files\Home Cinema\TV Enhance\TVEnhance.exe:CyberLink TVEnhance
"{B16BDB11-5A7C-48D6-90B3-46EB0BF9158A}"= UDP:C:\Program Files\Home Cinema\TV Enhance\TVEService.exe:CyberLink TVEnhance Resident Program
"{F7E4F0C0-C6DC-47F5-ABC7-700337273190}"= TCP:C:\Program Files\Home Cinema\TV Enhance\TVEService.exe:CyberLink TVEnhance Resident Program
"TCP Query User{59BFAFBF-4C88-4551-A47F-59391FE91C01}C:\\program files\\spiele\\battlefield 1942\\bf1942.exe"= UDP:C:\program files\spiele\battlefield 1942\bf1942.exe:BF1942
"UDP Query User{25694016-8CE1-47A9-BEFB-184FE30171F4}C:\\program files\\spiele\\battlefield 1942\\bf1942.exe"= TCP:C:\program files\spiele\battlefield 1942\bf1942.exe:BF1942
"TCP Query User{A1551601-61F1-4671-8692-068FAB9D49A2}C:\\program files\\spiele\\far cry\\bin32\\farcry.exe"= UDP:C:\program files\spiele\far cry\bin32\farcry.exe:Far Cry
"UDP Query User{40FFC090-FBFD-40A0-8A3B-31AF27AF72FE}C:\\program files\\spiele\\far cry\\bin32\\farcry.exe"= TCP:C:\program files\spiele\far cry\bin32\farcry.exe:Far Cry
"{D4E5A045-092B-475E-8203-23A4101ED317}"= UDP:C:\Program Files\PPLive\PPLive.exe:PPLive
"{AFA6ACC0-22D8-4599-95E3-86ABF4CED62B}"= TCP:C:\Program Files\PPLive\PPLive.exe:PPLive
"TCP Query User{37FB4FBA-F05D-4EBD-ABB8-354814499E48}C:\\program files\\emule\\emule.exe"= UDP:C:\program files\emule\emule.exe:eMule
"UDP Query User{8E007B71-AFEC-45E1-B117-0DB4BFC33B92}C:\\program files\\emule\\emule.exe"= TCP:C:\program files\emule\emule.exe:eMule
"{ED2AC488-0AF9-4A05-877A-F85EE469EAF2}"= UDP:C:\Program Files\Macromedia\Dreamweaver MX 2004\Dreamweaver.exe:Macromedia Dreamweaver MX 2004
"{146C0EAA-A9AF-4ADA-B269-6C73D647BF3F}"= TCP:C:\Program Files\Macromedia\Dreamweaver MX 2004\Dreamweaver.exe:Macromedia Dreamweaver MX 2004
"TCP Query User{1A3A79B6-2AB7-4F4A-9DF8-FAF88D0C4065}C:\\program files\\macromedia\\dreamweaver mx\\dreamweaver.exe"= UDP:C:\program files\macromedia\dreamweaver mx\dreamweaver.exe

reamweaver MX
"UDP Query User{73134BDB-47C2-4661-BA32-E44645D89BAE}C:\\program files\\macromedia\\dreamweaver mx\\dreamweaver.exe"= TCP:C:\program files\macromedia\dreamweaver mx\dreamweaver.exe

reamweaver MX
"TCP Query User{4D30997A-F0BA-4E74-AA49-35965CD70211}C:\\program files\\azureus\\azureus.exe"= UDP:C:\program files\azureus\azureus.exe:Azureus
"UDP Query User{7CF7AE34-D90D-41C8-8290-3D33D4C1498E}C:\\program files\\azureus\\azureus.exe"= TCP:C:\program files\azureus\azureus.exe:Azureus
"{D7D9A33F-8E23-4373-9012-40D9BD16DC6A}"= UDP:C:\Program Files\ICQ6\ICQ.exe:ICQ6
"{2AE8F829-208C-428F-B71D-5DF1D761B1C9}"= TCP:C:\Program Files\ICQ6\ICQ.exe:ICQ6
"{338043B5-2F77-4E89-AD62-52D3AB5465F0}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{A467E7C6-AC3D-4ED1-815D-54BB5D42A1E2}"= UDP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{F17E7848-AF25-4FC1-855D-CD835203AA92}"= TCP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{1F8DE05B-3FCB-4383-B269-CDD18C323AE9}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{5F3CAF9E-9C07-4BB2-9CE3-B126BE7049B4}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"TCP Query User{C365EC83-912B-4CD9-B193-F9D03FC141A6}C:\\users\\simon\\desktop\\cl08secu13\\cl08secu13\\routerclient.exe"= UDP:C:\users\simon\desktop\cl08secu13\cl08secu13\routerclient.exe:routerclient.exe
"UDP Query User{2D050F1E-DF4C-484F-A7EB-616B269839AC}C:\\users\\simon\\desktop\\cl08secu13\\cl08secu13\\routerclient.exe"= TCP:C:\users\simon\desktop\cl08secu13\cl08secu13\routerclient.exe:routerclient.exe
"TCP Query User{A932E82D-8EC0-4FAD-9431-C5B16F02B5B2}C:\\users\\simon\\desktop\\cl08secu13\\cl08secu13\\routerrecorder.exe"= UDP:C:\users\simon\desktop\cl08secu13\cl08secu13\routerrecorder.exe:routerrecorder.exe
"UDP Query User{322811A0-4FAC-4599-902B-347EC9B82CE0}C:\\users\\simon\\desktop\\cl08secu13\\cl08secu13\\routerrecorder.exe"= TCP:C:\users\simon\desktop\cl08secu13\cl08secu13\routerrecorder.exe:routerrecorder.exe
"TCP Query User{0E4FD196-45E4-4993-BBD6-3A5B5233605F}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{07E828B7-F711-4635-BC5C-9962B3642C69}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"TCP Query User{2E01E21F-8FEC-4CA6-8499-D6178056D3D2}C:\\program files\\videolan\\vlc\\vlc.exe"= UDP:C:\program files\videolan\vlc\vlc.exe:VLC media player
"UDP Query User{33F0610E-2D8E-4BEF-94FE-D570E0FE9185}C:\\program files\\videolan\\vlc\\vlc.exe"= TCP:C:\program files\videolan\vlc\vlc.exe:VLC media player
"TCP Query User{A6C6E43C-6672-49BF-BBBA-409C8281F7E7}C:\\program files\\ppmate\\ppamnet.exe"= UDP:C:\program files\ppmate\ppamnet.exe

pmnet Module
"UDP Query User{4CDB03F8-F79C-4B97-A8D8-D3F6BD4B947A}C:\\program files\\ppmate\\ppamnet.exe"= TCP:C:\program files\ppmate\ppamnet.exe

pmnet Module
"TCP Query User{A7B461BC-33FA-4BD1-991E-3A6DBB4F4DA0}C:\\program files\\tvuplayer\\tvuplayer.exe"= UDP:C:\program files\tvuplayer\tvuplayer.exe:TVU Player Component
"UDP Query User{3103D8B4-0F77-4BC3-9962-4CDF3E1D86CF}C:\\program files\\tvuplayer\\tvuplayer.exe"= TCP:C:\program files\tvuplayer\tvuplayer.exe:TVU Player Component
"TCP Query User{9520A0CB-C3C6-4891-90CC-4F4F8F2C42AF}C:\\program files\\tvants\\tvants.exe"= UDP:C:\program files\tvants\tvants.exe:TVAnts
"UDP Query User{4FA6EF1E-AB1A-41B8-8275-91633E0EB438}C:\\program files\\tvants\\tvants.exe"= TCP:C:\program files\tvants\tvants.exe:TVAnts
"{64008F1F-913D-4F5C-B5B8-0DCDD4FBE60D}"= UDP:C:\Medien\Software & Spiele\Civ IV\Civilization4.exe:Sid Meier's Civilization 4
"{C115E8AE-B666-40D6-BE40-F62AED8693BA}"= TCP:C:\Medien\Software & Spiele\Civ IV\Civilization4.exe:Sid Meier's Civilization 4
"TCP Query User{653DAC3F-B8A0-4599-B57D-0A3683098E64}C:\\program files\\slmev\\easyview.exe"= UDP:C:\program files\slmev\easyview.exe:3D visualizer
"UDP Query User{1F0D9566-3E86-4BFA-B6B4-9F89C3FF1EEE}C:\\program files\\slmev\\easyview.exe"= TCP:C:\program files\slmev\easyview.exe:3D visualizer
"{76CC111E-8CFE-4E0A-9F30-540CF98648CE}"= UDP:990:LocalSubnet:LocalSubnet|IF={A3829E93-9C0A-499A-BC87-E383E31A79C3}|%SystemRoot%\system32\svchost.exe|Svc=rapimgr:@%systemroot%\WindowsMobile\wmdSync.exe,-4001
"TCP Query User{4ABE603C-3745-4419-A0D3-4D98D26D7E2F}C:\\program files\\valve\\hl.exe"= UDP:C:\program files\valve\hl.exe:Half-Life Launcher
"UDP Query User{06BA88FB-BF2A-4C07-9B5A-11B6E9BD6DF2}C:\\program files\\valve\\hl.exe"= TCP:C:\program files\valve\hl.exe:Half-Life Launcher
"{7362BABC-B0EA-46E2-9450-8A001EE274F3}"= UDP:C:\Medien\Software & Spiele\Call of Duty 4\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
"{CD473CAC-974E-4F7E-A7B6-2C42E5118973}"= TCP:C:\Medien\Software & Spiele\Call of Duty 4\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
"TCP Query User{B03C4DBE-F387-4A3E-A933-EB6A79D600AD}C:\\program files\\tmnationsforever\\tmforever.exe"= UDP:C:\program files\tmnationsforever\tmforever.exe:TmForever
"UDP Query User{0E7951A9-3827-4893-BA12-8E4F58150BBF}C:\\program files\\tmnationsforever\\tmforever.exe"= TCP:C:\program files\tmnationsforever\tmforever.exe:TmForever
"TCP Query User{786131EB-55D0-462A-8A5C-184FAA6D27CB}C:\\program files\\freestyler\\art-net to dmx.exe"= UDP:C:\program files\freestyler\art-net to dmx.exe:Art-Net to DMX
"UDP Query User{8189766A-C041-442E-8FCC-55DCCBAD5EEA}C:\\program files\\freestyler\\art-net to dmx.exe"= TCP:C:\program files\freestyler\art-net to dmx.exe:Art-Net to DMX
"TCP Query User{94D635C8-C805-4021-AC6A-EE846F571B06}C:\\program files\\spiele\\far cry\\bin32\\farcry.exe"= UDP:C:\program files\spiele\far cry\bin32\farcry.exe:Far Cry
"UDP Query User{D590CD3F-77CC-47D4-9CBC-D99862815760}C:\\program files\\spiele\\far cry\\bin32\\farcry.exe"= TCP:C:\program files\spiele\far cry\bin32\farcry.exe:Far Cry
"{59C78D83-68DD-4444-A68E-E98B84763973}"= UDP:C:\Medien\Software & Spiele\Grid Racer\GRID.exe:GRID
"{707CACD4-80E9-4010-9E08-490D9251F669}"= TCP:C:\Medien\Software & Spiele\Grid Racer\GRID.exe:GRID
"{E6CE7978-97AC-4D7E-AC32-45FCD135A8AD}"= UDP:C:\Program Files\Spiele\Unreal Anthology\UT2004\System\UT2004.exe:UT2004
"{BB923BA7-A7D0-4CD3-B2DD-080F82BAACD4}"= TCP:C:\Program Files\Spiele\Unreal Anthology\UT2004\System\UT2004.exe:UT2004
"{06FF34BD-A41E-4312-A0A9-F5C09060FDAA}"= UDP:C:\Medien\Software & Spiele\Call of Duty 4\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
"{32A2E050-BD05-46B4-B9D5-C72A9C3AAD0E}"= TCP:C:\Medien\Software & Spiele\Call of Duty 4\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"C:\\Program Files\\PPMate\\ppmate.exe"= C:\Program Files\PPMate\ppmate.exe:*:Enabled:PPMate
"C:\\Program Files\\PPMate\\ppamnet.exe"= C:\Program Files\PPMate\ppamnet.exe:*:Enabled:PPMate

R2 DLPortIO;DriverLINX Port I/O Driver;C:\Windows\system32\drivers\DLPortIO.sys [1999-01-10 3584]
R2 srvcPVR;Sceneo PVR Service;C:\Program Files\Sceneo\Bonavista\Services\PVR\PVRService.exe [2007-01-04 1468928]
R2 TVECapSvc;TVEnhance Background Capture Service (TBCS);C:\Program Files\Home Cinema\TV Enhance\Kernel\TV\TVECapSvc.exe [2007-01-12 290908]
R2 TVESched;TVEnhance Task Scheduler (TTS));C:\Program Files\Home Cinema\TV Enhance\Kernel\TV\TVESched.exe [2007-01-12 114778]
R3 MBAMSwissArmy;MBAMSwissArmy;C:\Windows\system32\drivers\mbamswissarmy.sys [2008-09-10 38528]
R3 PhilCap;PhilCap service;C:\Windows\system32\DRIVERS\PhilCap.sys [2006-11-23 1053952]
R3 rt61x86;Ralink RT61 Wireless Driver for Windows Vista;C:\Windows\system32\DRIVERS\netr61.sys [2007-05-11 357376]
R3 X10Hid;X10 Hid Device;C:\Windows\system32\Drivers\x10hid.sys [2006-11-17 13976]
S3 Steam Client Service;Steam Client Service;C:\Program Files\Common Files\Steam\SteamService.exe [2008-09-28 92656]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{743d9790-654c-11dd-ad90-00038a000015}]
\shell\AutoRun\command - H:\Startmenue.exe

*Newly Created Service* - CATCHME
*Newly Created Service* - MBAMSWISSARMY
*Newly Created Service* - PROCEXP90
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -

HKLM-Run-Bluetooth Connection Assistant - LBTWIZ.EXE

.
------- Zusätzlicher Suchlauf -------
.
FireFox -: Profile - C:\Users\Simon\AppData\Roaming\Mozilla\Firefox\Profiles\29e822g8.default\
FF -: plugin - C:\Program Files\Google\Google Updater\2.2.1111.1511\npCIDetect11.dll
FF -: plugin - C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-01 14:38:30
Windows 6.0.6000 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

Scanne versteckte Dateien...

C:\Users\Simon\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\O9TO6RCM\themen[1].xml 1004 bytes

Scan erfolgreich abgeschlossen
versteckte Dateien: 1

**************************************************************************
.
Zeit der Fertigstellung: 2008-10-01 14:40:11
ComboFix-quarantined-files.txt 2008-10-01 12:39:54

Vor Suchlauf: Das System hat keinen Meldungstext fr die Meldungsnummer 0x2379 in der Meldungsdatei Application gefunden.
Nach Suchlauf: 20 Verzeichnis(se), 239,349,608,448 Bytes frei

270 --- E O F --- 2008-09-26 09:37:40

**Sunny** · 01.10.2008, 14:29

Scripten mit Combofix

Öffne den Editor ( Start -> Zubehör -> Editor ) kopiere nun folgenden Text in das weiße Feld:

Code:

ATTFilter

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"himem"=-


FILE::
C:\Windows\himem.exe
C:\Users\Simon\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\O9TO6RCM\themen[1].xml
C:\Program Files\ActiveMultiwallpaper\Changer.exe

FOLDER::
C:\Program Files\ActiveMultiwallpaper

Speichere diese Datei nun auf dem Desktop unter -> cfscript.txt

Nun die Datei cfscript.txt mit der rechten Maustaste auf das Sysmbol von Combofix ziehen!

Danach das Combofix nochmal ausführen, das System neu starten und das Log von Combofix posten

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann

Wenn das alles geschehen ist überprüfe vorsichtshalber nochmal mit Kaspersky dein System:

Kaspersky - Onlinescanner

Dieser Scanner entfernt die Funde nicht, gibt aber einen guten Überblick über die vorhandene Malware.

---> hier herunterladen => Kaspersky Online-Scanner
=> Hinweise zu älteren Versionen beachten!
=> Voraussetzung: Internet Explorer 6.0 oder höher
=> die nötigen ActiveX-Steuerelemente installieren => Update der Signaturen => Weiter
=> Scan-Einstellungen => Standard wählen => OK => Link "Arbeitsplatz" anklicken
=> Scan beginnt automatisch => Untersuchung wurde abgeschlossen => Protokoll speichern als
=> Dateityp auf .txt umstellen => auf dem Desktop als Kaspersky.txt speichern => Log hier posten
=> Deinstallation => Systemsteuerung => Software => Kaspersky Online Scanner entfernen

Danach sollte eigentlich alles wieder sauber sein!

01.10.2008, 13:11	#4
Sunny Administrator > Competence Manager	Wie Tojaner entfernen? Durch dieses Wallpaper, keine Ahnung wo das her kommt, wird auch sicherlich der Trojaner ins System gelangt sein.. Mach nun mit Combofix weiter, dann löschen wir den ganzen Müll.. __________________ Anfragen per Email, Profil- oder privater Nachricht werden ignoriert! Hilfe gibts NUR im Forum! Stulti est se ipsum sapientem putare.

Wie Tojaner entfernen?

Plagegeister aller Art und deren Bekämpfung: Wie Tojaner entfernen?