Trojaner Ransom EJ 28 & PSW Zbot Y 876 & EXP/2011-3544.BU.1 zusammen aufgetaucht

.
DDS (Ver_2011-08-26.01) - NTFSx86 
Internet Explorer: 6.0.2900.5512  BrowserJavaVersion: 1.6.0_22
Run by Administrator at 23:38:27 on 2012-03-05
Microsoft Windows XP Professional  5.1.2600.3.1252.49.1031.18.1023.630 [GMT 1:00]
.
AV: Avira Desktop *Disabled/Updated* {C19476D9-52BC-4E93-8AF3-CCF59F7AE8FE}
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
E:\Systools\Avira\AntiVir Desktop\sched.exe
C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe
E:\Systools\Avira\AntiVir Desktop\avguard.exe
C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\WINDOWS\system32\bgsvcgen.exe
C:\Programme\Bonjour\mDNSResponder.exe
E:\Systools\Fritz.box\IGDCTRL.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Programme\Gemeinsame Dateien\Acronis\Fomatik\TrueImageTryStartService.exe
E:\Systools\Avira\AntiVir Desktop\avshadow.exe
E:\Systools\Avira\AntiVir Desktop\avmailc.exe
E:\Systools\Avira\AntiVir Desktop\AVWEBGRD.EXE
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Programme\iPod\bin\iPodService.exe
C:\WINDOWS\Explorer.EXE
D:\Audio\iTunes\iTunesHelper.exe
E:\Systools\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Programme\Microsoft IntelliType Pro\itype.exe
E:\Systools\Acronis.TI\TrueImageMonitor.exe
E:\Systools\Acronis.TI\TimounterMonitor.exe
C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe
C:\WINDOWS\system32\ctfmon.exe
E:\Programme\Video\Any.DVD\AnyDVDtray.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
D:\CD\4wdfdzns.exe
.
============== Pseudo HJT Report ===============
.
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - e:\programme\adobe\acrobat.6\acrobat\activex\AcroIEHelper.dll
BHO: AcroIEToolbarHelper Class: {ae7cd045-e861-484f-8273-0445ee161910} - e:\programme\adobe\acrobat.6\acrobat\AcroIEFavClient.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\programme\java\jre6\bin\jp2ssv.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - e:\programme\adobe\acrobat.6\acrobat\AcroIEFavClient.dll
EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - e:\programme\adobe\acrobat.6\acrobat\AcroIEFavClient.dll
uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe
uRun: [{D67F16B2-510B-11E1-897F-806D6172696F}] c:\dokumente und einstellungen\balthasar\anwendungsdaten\microsoft\torrent.exe
uRun: [AnyDVD] e:\programme\video\any.dvd\AnyDVDtray.exe
mRun: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
mRun: [APSDaemon] "c:\programme\gemeinsame dateien\apple\apple application support\APSDaemon.exe"
mRun: [iTunesHelper] "d:\audio\itunes\iTunesHelper.exe"
mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe
mRun: [avgnt] "e:\systools\avira\antivir desktop\avgnt.exe" /min
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [itype] "c:\programme\microsoft intellitype pro\itype.exe"
mRun: [TrueImageMonitor.exe] e:\systools\acronis.ti\TrueImageMonitor.exe
mRun: [AcronisTimounterMonitor] e:\systools\acronis.ti\TimounterMonitor.exe
mRun: [Acronis Scheduler2 Service] "c:\programme\gemeinsame dateien\acronis\schedule2\schedhlp.exe"
mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
mRun: [MSPY2002] c:\windows\system32\ime\pintlgnt\ImScInst.exe /SYNC
mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC
mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
LSP: e:\systools\avira\antivir desktop\avsda.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
LSA: Authentication Packages = msv1_0 relog_ap
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\dokumente und einstellungen\administrator\anwendungsdaten\mozilla\firefox\profiles\9s637xwb.default\
FF - plugin: c:\programme\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: d:\audio\itunes\mozilla plugins\npitunes.dll
FF - plugin: e:\internet\firefox\plugins\npdeployJava1.dll
FF - plugin: e:\internet\firefox\plugins\npViewpoint.dll
FF - plugin: e:\programme\adobe\acrobat.6\acrobat\browser\nppdf32.dll
.
============= SERVICES / DRIVERS ===============
.
R0 vidsflt53;Acronis Disk Storage Filter (53);c:\windows\system32\drivers\vsflt53.sys [2012-2-7 83392]
R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [2012-2-7 36000]
R2 AntiVirMailService;Avira Email Schutz;e:\systools\avira\antivir desktop\avmailc.exe [2012-3-2 342480]
R2 AntiVirSchedulerService;Avira Planer;e:\systools\avira\antivir desktop\sched.exe [2012-2-7 86224]
R2 AntiVirService;Avira Echtzeit Scanner;e:\systools\avira\antivir desktop\avguard.exe [2012-2-7 110032]
R2 AntiVirWebService;Avira Browser Schutz;e:\systools\avira\antivir desktop\avwebgrd.exe [2012-2-7 463824]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2012-2-7 74640]
R2 IGDCTRL;AVM IGD CTRL Service;e:\systools\fritz.box\IGDCTRL.EXE [2007-10-25 87344]
.
=============== Created Last 30 ================
.
2012-03-05 20:47:00	1409	----a-w-	c:\windows\QTFont.for
2012-03-05 20:16:05	--------	d-----w-	c:\dokumente und einstellungen\administrator\anwendungsdaten\Malwarebytes
2012-03-02 12:44:15	--------	d-----w-	c:\windows\system32\SoftwareDistribution
2012-03-01 20:43:56	--------	d-----w-	c:\programme\CCleaner
2012-03-01 17:18:53	--------	d-----w-	c:\dokumente und einstellungen\all users\anwendungsdaten\Malwarebytes
2012-03-01 17:18:51	20464	----a-w-	c:\windows\system32\drivers\mbam.sys
2012-02-27 19:40:57	36927	-c--a-w-	c:\windows\system32\dllcache\padrs411.dll
2012-02-27 19:33:17	8704	-c--a-w-	c:\windows\system32\dllcache\kbdjpn.dll
2012-02-27 19:33:17	8704	----a-w-	c:\windows\system32\kbdjpn.dll
2012-02-27 19:33:17	8192	-c--a-w-	c:\windows\system32\dllcache\kbdkor.dll
2012-02-27 19:33:17	8192	----a-w-	c:\windows\system32\kbdkor.dll
2012-02-27 19:33:17	6144	-c--a-w-	c:\windows\system32\dllcache\kbd101c.dll
2012-02-27 19:33:17	6144	----a-w-	c:\windows\system32\kbd101c.dll
2012-02-27 19:33:17	5632	-c--a-w-	c:\windows\system32\dllcache\kbd103.dll
2012-02-27 19:33:17	5632	----a-w-	c:\windows\system32\kbd103.dll
2012-02-27 19:33:13	6144	-c--a-w-	c:\windows\system32\dllcache\kbd101b.dll
2012-02-27 19:33:13	6144	----a-w-	c:\windows\system32\kbd101b.dll
2012-02-27 19:33:11	6144	-c--a-w-	c:\windows\system32\dllcache\kbd106.dll
2012-02-27 19:33:11	6144	----a-w-	c:\windows\system32\kbd106.dll
2012-02-26 14:44:53	--------	d-----w-	c:\dokumente und einstellungen\administrator\anwendungsdaten\Pegasys Inc
2012-02-26 14:21:37	--------	d-----w-	c:\dokumente und einstellungen\administrator\lokale einstellungen\anwendungsdaten\Mozilla
2012-02-26 04:07:59	--------	d-----w-	c:\dokumente und einstellungen\administrator\anwendungsdaten\Avira
2012-02-25 20:58:42	306688	----a-w-	c:\windows\IsUninst.exe
2012-02-24 03:41:46	--------	d-----w-	c:\windows\pss
2012-02-23 00:28:33	10624	-c--a-w-	c:\windows\system32\dllcache\gameenum.sys
2012-02-23 00:28:33	10624	----a-w-	c:\windows\system32\drivers\gameenum.sys
2012-02-22 23:43:00	5504	-c--a-w-	c:\windows\system32\dllcache\mstee.sys
2012-02-22 23:43:00	5504	----a-w-	c:\windows\system32\drivers\MSTEE.sys
2012-02-22 12:02:13	--------	d-----w-	c:\windows\SHELLNEW
2012-02-22 11:54:32	606208	----a-w-	c:\windows\system32\xvidcore.dll
2012-02-22 11:54:32	438272	----a-w-	c:\windows\system32\Mpeg2DecFilter.ax
2012-02-22 11:54:32	139264	----a-w-	c:\windows\system32\xvid.ax
2012-02-20 11:45:24	133376	----a-w-	c:\programme\internet explorer\plugins\nppdf32.dll
2012-02-18 19:23:43	--------	d-----w-	c:\windows\system32\Backup
2012-02-18 19:13:36	--------	d-----w-	c:\programme\Rainbow Technologies
2012-02-18 19:12:28	86016	----a-w-	c:\windows\unvise32qt.exe
2012-02-18 19:12:25	90112	----a-w-	c:\programme\internet explorer\plugins\npqtplugin5.dll
2012-02-18 19:12:25	90112	----a-w-	c:\programme\internet explorer\plugins\npqtplugin4.dll
2012-02-18 19:12:24	90112	----a-w-	c:\programme\internet explorer\plugins\npqtplugin3.dll
2012-02-18 19:12:24	90112	----a-w-	c:\programme\internet explorer\plugins\npqtplugin2.dll
2012-02-18 19:12:24	90112	----a-w-	c:\programme\internet explorer\plugins\npqtplugin.dll
2012-02-18 19:12:08	--------	d-----w-	c:\windows\system32\QuickTime
2012-02-18 18:49:50	74240	----a-w-	c:\windows\system32\unrar.dll
2012-02-13 01:15:21	266360	----a-w-	c:\windows\system32\TweakUI.exe
2012-02-10 19:06:06	--------	d-----w-	c:\windows\system32\NtmsData
2012-02-09 01:25:48	44384	----a-w-	c:\windows\system32\drivers\tifsfilt.sys
2012-02-09 01:25:48	441760	----a-w-	c:\windows\system32\drivers\timntr.sys
2012-02-09 01:25:39	129248	----a-w-	c:\windows\system32\drivers\snapman.sys
2012-02-09 01:24:59	--------	d-----w-	c:\programme\gemeinsame dateien\Acronis
2012-02-09 01:00:56	368480	----a-w-	c:\windows\system32\drivers\tdrpman.sys
2012-02-08 20:11:45	--------	d-----w-	c:\programme\Microsoft IntelliType Pro
2012-02-08 00:18:32	5632	----a-w-	c:\windows\system32\ptpusb.dll
2012-02-08 00:18:29	159232	----a-w-	c:\windows\system32\ptpusd.dll
2012-02-07 22:43:39	446464	----a-w-	c:\windows\system32\nvudisp.exe
2012-02-07 22:43:39	--------	d-----w-	c:\windows\nview
2012-02-07 22:43:23	--------	d-----w-	c:\windows\system32\ReinstallBackups
2012-02-07 22:43:15	446464	----a-w-	c:\windows\system32\NVUNINST.EXE
2012-02-07 22:43:12	32768	----a-w-	c:\programme\gemeinsame dateien\installshield\professional\runtime\Objectps.dll
2012-02-07 22:43:11	729088	----a-w-	c:\programme\gemeinsame dateien\installshield\professional\runtime\09\01\intel32\iKernel.dll
2012-02-07 22:43:11	69715	----a-w-	c:\programme\gemeinsame dateien\installshield\professional\runtime\09\01\intel32\ctor.dll
2012-02-07 22:43:11	5632	----a-w-	c:\programme\gemeinsame dateien\installshield\professional\runtime\09\01\intel32\DotNetInstaller.exe
2012-02-07 22:43:11	266240	----a-w-	c:\programme\gemeinsame dateien\installshield\professional\runtime\09\01\intel32\iscript.dll
2012-02-07 22:43:11	192512	----a-w-	c:\programme\gemeinsame dateien\installshield\professional\runtime\09\01\intel32\iuser.dll
2012-02-07 22:43:10	188548	----a-w-	c:\programme\gemeinsame dateien\installshield\professional\runtime\09\01\intel32\iGdi.dll
2012-02-07 22:43:09	311428	----a-w-	c:\programme\gemeinsame dateien\installshield\professional\runtime\09\01\intel32\setup.dll
2012-02-07 22:07:59	33104	----a-w-	c:\windows\system32\spool\prtprocs\w32x86\msonpppr.dll
2012-02-07 22:07:59	31640	----a-w-	c:\windows\system32\msonpmon.dll
2012-02-07 20:33:02	74640	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2012-02-07 20:33:02	36000	----a-w-	c:\windows\system32\drivers\avkmgr.sys
2012-02-07 20:33:00	--------	d-----w-	c:\dokumente und einstellungen\all users\anwendungsdaten\Avira
2012-02-07 19:06:55	216064	----a-w-	c:\windows\iun3405.exe
2012-02-07 19:06:55	--------	d-----w-	c:\windows\desktop
2012-02-07 14:10:04	73728	----a-w-	c:\windows\system32\javacpl.cpl
2012-02-07 14:10:04	472808	----a-w-	c:\windows\system32\deployJava1.dll
2012-02-07 14:04:55	414368	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2012-02-07 13:10:55	--------	d-----w-	c:\windows\system32\appmgmt
2012-02-07 13:06:23	59488	----a-w-	c:\windows\system32\GenSvcInst.exe
2012-02-07 13:06:23	33408	----a-w-	c:\windows\system32\drivers\CDRBSDRV.SYS
2012-02-07 13:06:23	145504	----a-w-	c:\windows\system32\bgsvcgen.exe
2012-02-07 13:00:32	77824	----a-w-	c:\programme\gemeinsame dateien\installshield\engine\6\intel 32\ctor.dll
2012-02-07 13:00:32	32768	------w-	c:\programme\gemeinsame dateien\installshield\engine\6\intel 32\objectps.dll
2012-02-07 13:00:32	225280	------w-	c:\programme\gemeinsame dateien\installshield\iscript\iscript.dll
2012-02-07 13:00:32	176128	------w-	c:\programme\gemeinsame dateien\installshield\engine\6\intel 32\iuser.dll
2012-02-07 13:00:31	610436	----a-w-	c:\programme\gemeinsame dateien\installshield\engine\6\intel 32\IKernel.exe
2012-02-07 13:00:31	--------	d-----w-	c:\programme\gemeinsame dateien\InstallShield
2012-02-07 12:47:46	58938	----a-w-	c:\windows\system32\atlu.dll
2012-02-07 12:47:46	424960	----a-w-	c:\windows\system32\msms001.vwp
2012-02-07 12:47:46	413760	----a-w-	c:\windows\system32\mpg4c32.dll
2012-02-07 12:47:46	281600	----a-w-	c:\windows\system32\mvoice.vwp
2012-02-07 12:47:45	82944	----a-w-	c:\windows\system32\vct3216.acm
2012-02-07 12:47:45	29184	----a-w-	c:\windows\system32\popup.ocx
2012-02-07 12:47:45	28160	----a-w-	c:\windows\system32\regcodec.exe
2012-02-07 12:47:45	278016	----a-w-	c:\windows\system32\vct3216.dll
2012-02-07 12:33:21	5504	----a-w-	c:\windows\system32\drivers\imagedrv.sys
2012-02-07 12:33:21	125184	----a-w-	c:\windows\system32\drivers\imagesrv.sys
2012-02-07 12:33:04	569344	----a-w-	c:\windows\system32\imagr5.dll
2012-02-07 12:33:04	544768	----a-w-	c:\windows\system32\imagx5.dll
2012-02-07 12:33:04	38912	----a-w-	c:\windows\system32\picn20.dll
2012-02-07 12:33:04	283920	----a-w-	c:\windows\system32\ImagXpr5.dll
2012-02-07 12:33:04	106496	----a-w-	c:\windows\system32\TwnLib20.dll
2012-02-07 12:33:03	155648	----a-w-	c:\windows\system32\NeroCheck.exe
2012-02-07 12:33:03	--------	d-----w-	c:\programme\gemeinsame dateien\Ahead
2012-02-07 12:28:32	328704	----a-w-	c:\windows\IsUn0407.exe
2012-02-07 12:26:35	--------	d-----w-	c:\programme\gemeinsame dateien\AVM
2012-02-07 12:25:31	--------	d-----w-	c:\programme\gemeinsame dateien\Wise Installation Wizard
2012-02-07 03:09:04	26600	----a-w-	c:\windows\system32\drivers\GEARAspiWDM.sys
2012-02-07 03:09:04	107368	----a-w-	c:\windows\system32\GEARAspi.dll
2012-02-07 03:03:14	--------	d-----w-	c:\programme\iPod
2012-02-07 03:03:10	--------	d-----w-	c:\dokumente und einstellungen\all users\anwendungsdaten\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2012-02-07 03:02:00	4517664	----a-w-	c:\windows\system32\usbaaplrc.dll
2012-02-07 03:02:00	42496	----a-w-	c:\windows\system32\drivers\usbaapl.sys
2012-02-07 03:01:18	--------	d-----w-	c:\programme\Bonjour
2012-02-07 03:00:53	--------	d-----w-	c:\programme\gemeinsame dateien\Apple
2012-02-07 01:47:40	993347	----a-w-	c:\windows\unins000.exe
2012-02-07 01:33:19	15104	-c--a-w-	c:\windows\system32\dllcache\usbscan.sys
2012-02-07 01:33:19	15104	----a-w-	c:\windows\system32\drivers\usbscan.sys
.
==================== Find3M  ====================
.
2012-02-18 19:23:44	421888	----a-w-	c:\windows\system32\AvidDVCodec.dll
2012-02-09 00:06:52	83392	----a-w-	c:\windows\system32\drivers\vsflt53.sys
2012-02-07 00:23:46	125472	----a-w-	c:\windows\system32\drivers\vididr.sys
2012-01-29 20:22:55	121208	----a-w-	c:\windows\system32\drivers\AnyDVD.sys
.
============= FINISH: 23:39:08,57 ===============