AntiVir findet BDS/Agent.AY

Loretta

Hallo Zusammen,

dieses Forum ist wirklich toll. Bin froh, dass ich darauf gestossen bin.
Bekomme seit einigen Tagen von AntiVir die Meldung über einen BDS/Agent.AY. Hier sind meine Logfiles von HJT und escan. Wäre lieb, wenn sich das mal jemand ansehen könnte. Daaaannnnkkkkeee....

Logfile of HijackThis v1.99.1
Scan saved at 16:39:27, on 15.11.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Programme\AVPersonal\AVGUARD.EXE
C:\Programme\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\System32\cisvc.exe
C:\WINDOWS\system32\nslsvice.exe
C:\MySQL\bin\mysqld-max-nt.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\EzButton\CPLBTS88.EXE
C:\Programme\TOSHIBA\E-KEY\CeEKey.exe
C:\Programme\Apoint2K\Apoint.exe
C:\Programme\TOSHIBA\TouchPad\TPTray.exe
C:\Programme\TOSHIBA\Power Management\CePMTray.exe
C:\Programme\Java\j2re1.4.2_02\bin\jusched.exe
C:\Programme\AVPersonal\AVGNT.EXE
C:\Programme\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Messenger\msmsgs.exe
C:\Programme\Apoint2K\Apntex.exe
C:\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe
C:\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe
C:\WINDOWS\system32\monitorbk.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Hijackthis\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://www.bluewin.ch/index_d.html
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [CPLBTS88] C:\PROGRA~1\EzButton\CPLBTS88.EXE
O4 - HKLM\..\Run: [CeEKEY] C:\Programme\TOSHIBA\E-KEY\CeEKey.exe
O4 - HKLM\..\Run: [Apoint] C:\Programme\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [TPNF] C:\Programme\TOSHIBA\TouchPad\TPTray.exe
O4 - HKLM\..\Run: [CeEPOWER] C:\Programme\TOSHIBA\Power Management\CePMTray.exe
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\printray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\j2re1.4.2_02\bin\jusched.exe
O4 - HKLM\..\Run: [AVGCtrl] "C:\Programme\AVPersonal\AVGNT.EXE" /min
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [TVAgent WiFi] C:\Programme\Bluewin\Netopia_Router\Wizard\Agent_Wifi.exe
O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\Ahead\NEROPH~1\data\Xtras\mssysmgr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Microsoft Office2000\Office\OSA9.EXE
O4 - Global Startup: Picture Package VCD Maker.lnk = ?
O4 - Global Startup: Picture Package Menu.lnk = ?
O4 - Global Startup: Belkin PCMCIA WLAN Monitor.lnk = C:\WINDOWS\system32\monitorbk.exe
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: Microsoft WFC Forms Designer - file://F:\VJ98\wfcforms.cab
O16 - DPF: Visual Studio 6 Extensibility Libraries - file://F:\VJ98\vstudio6.cab
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Programme\AVPersonal\AVGUARD.EXE
O23 - Service: Apache - Unknown owner - c:\developmentsw\FoxServ\Apache\bin\Apache.exe" -k runservice (file missing)
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: Macromedia JRun Admin Server (JRun Admin) - Macromedia Inc. - C:\DevelopmentSW\JRun4\bin\jrunsvc.exe
O23 - Service: Macromedia JRun Default Server (JRun Default) - Macromedia Inc. - C:\DevelopmentSW\JRun4\bin\jrunsvc.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Lotus Notes Single Logon - Unknown owner - C:\WINDOWS\system32\\nslsvice.exe
O23 - Service: MySQL - Unknown owner - C:\MySQL\bin\mysqld-max-nt.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe


escan:

Tue Nov 15 16:07:20 2005 => Total Objects Scanned: 176621
Tue Nov 15 16:07:20 2005 => Total Virus(es) Found: 22
Tue Nov 15 16:07:20 2005 => Total Disinfected Files: 0
Tue Nov 15 16:07:20 2005 => Total Files Renamed: 0
Tue Nov 15 16:07:20 2005 => Total Deleted Objects: 0
Tue Nov 15 16:07:20 2005 => Total Errors: 556
Tue Nov 15 16:07:20 2005 => Time Elapsed: 02:10:58
Tue Nov 15 16:07:20 2005 => Virus Database Date: 2005/11/11
Tue Nov 15 16:07:20 2005 => Virus Database Count: 159282


{\rtf1\ansi\ansicpg1252\deff0\deflang1031{\fonttbl{\f0\fswiss\fcharset0 Arial;}}
{\*\generator Msftedit 5.41.15.1507;}\viewkind4\uc1\pard\f0\fs20 Tue Nov 15 13:56:25 2005 => System found infected with gain.gator Spyware/Adware (\{21ffb6c0-0da1-11d5-a9d5-00500413153c\})! Action taken: No Action Taken.\par
\par
Tue Nov 15 15:01:14 2005 => Scanning Folder: C:\\Programme\\AVPersonal\\INFECTED\\*.*\par
\par
Tue Nov 15 14:31:55 2005 => File C:\\Dokumente und Einstellungen\\***\\Lokale Einstellungen\\Temporary Internet Files\\Content.IE5\\F7HJ75CW\\content28240-0[1].htm tagged as "not-a-virus:AdWare.Win32.Gator.k". Action Taken: No Action Taken.\par
\par
Tue Nov 15 14:32:04 2005 => File C:\\Dokumente und Einstellungen\\***\\Lokale Einstellungen\\Temporary Internet Files\\Content.IE5\\4FPBU6B9\\content23596-0[1].htm tagged as "not-a-virus:AdWare.Win32.Gator.k". Action Taken: No Action Taken.\par
\par
Tue Nov 15 14:33:22 2005 => File C:\\Dokumente und Einstellungen\\***\\Lokale Einstellungen\\Temporary Internet Files\\Content.IE5\\QLPE3EDC\\content34938-0[1].htm tagged as "not-a-virus:AdWare.Win32.Gator.k". Action Taken: No Action Taken.\par
\par
Tue Nov 15 14:35:51 2005 => File C:\\Dokumente und Einstellungen\\***\\Lokale Einstellungen\\Temporary Internet Files\\Content.IE5\\JFD77DSW\\content40044-0[1].htm tagged as "not-a-virus:AdWare.Win32.Gator.k". Action Taken: No Action Taken.\par
\par
Tue Nov 15 14:43:02 2005 => File C:\\Dokumente und Einstellungen\\***\\Lokale Einstellungen\\Temporary Internet Files\\Content.IE5\\OPGX4PUF\\content28240-0[1].htm tagged as "not-a-virus:AdWare.Win32.Gator.k". Action Taken: No Action Taken.\par
\par
Tue Nov 15 14:43:10 2005 => File C:\\Dokumente und Einstellungen\\***\\Lokale Einstellungen\\Temporary Internet Files\\Content.IE5\\GZ410FOT\\content23596-0[1].htm tagged as "not-a-virus:AdWare.Win32.Gator.k". Action Taken: No Action Taken.\par
\par
Tue Nov 15 14:46:20 2005 => File C:\\Dokumente und Einstellungen\\***\\Lokale Einstellungen\\Temporary Internet Files\\Content.IE5\\016RWP2R\\content40044-0[1].htm tagged as "not-a-virus:AdWare.Win32.Gator.k". Action Taken: No Action Taken.\par
\par
Tue Nov 15 14:50:31 2005 => File C:\\Dokumente und Einstellungen\\***\\Lokale Einstellungen\\Temporary Internet Files\\Content.IE5\\85INKTUR\\content23596-0[1].htm tagged as "not-a-virus:AdWare.Win32.Gator.k". Action Taken: No Action Taken.\par
\par
Tue Nov 15 14:51:48 2005 => File C:\\Programme\\Gemeinsame Dateien\\GMT\\EGNSEngine.dll tagged as "not-a-virus:AdWare.Win32.Gator.5017". Action Taken: No Action Taken.\par
\par
Tue Nov 15 14:51:49 2005 => File C:\\Programme\\Gemeinsame Dateien\\GMT\\GatorRes.dll tagged as "not-a-virus:AdWare.Win32.Gator.6041". Action Taken: No Action Taken.\par
\par
Tue Nov 15 14:51:49 2005 => File C:\\Programme\\Gemeinsame Dateien\\GMT\\GatorStubSetup.exe tagged as "not-a-virus:AdWare.Win32.Gator.5112". Action Taken: No Action Taken.\par
\par
\par
Tue Nov 15 14:51:50 2005 => File C:\\Programme\\Gemeinsame Dateien\\GMT\\GMT.exe tagged as "not-a-virus:AdWare.Win32.Gator.7035". Action Taken: No Action Taken.\par
\par
Tue Nov 15 14:51:50 2005 => File C:\\Programme\\Gemeinsame Dateien\\GMT\\gtrawbm.fil tagged as "not-a-virus:AdWare.Win32.Gator.a". Action Taken: No Action Taken.\par
\par
Tue Nov 15 14:54:09 2005 => File C:\\Programme\\Gemeinsame Dateien\\GMT\\RTA86110 tagged as "not-a-virus:AdWare.Win32.Gator.6041". Action Taken: No Action Taken.\par
\par
Tue Nov 15 14:54:10 2005 => File C:\\Programme\\Gemeinsame Dateien\\GMT\\RTB86110 tagged as "not-a-virus:AdWare.Win32.Gator.6041". Action Taken: No Action Taken.\par
\par
Tue Nov 15 14:54:10 2005 => File C:\\Programme\\Gemeinsame Dateien\\GMT\\RTC86110 tagged as "not-a-virus:AdWare.Win32.Gator.6041". Action Taken: No Action Taken.\par
\par
Tue Nov 15 14:54:10 2005 => File C:\\Programme\\Gemeinsame Dateien\\GMT\\RTD86110 tagged as "not-a-virus:AdWare.Win32.Gator.5017". Action Taken: No Action Taken.\par
\par
Tue Nov 15 14:54:10 2005 => File C:\\Programme\\Gemeinsame Dateien\\GMT\\RTE86110 tagged as "not-a-virus:AdWare.Win32.Gator.6041". Action Taken: No Action Taken.\par
\par
\par
Tue Nov 15 14:54:10 2005 => File C:\\Programme\\Gemeinsame Dateien\\GMT\\RTF86110 tagged as "not-a-virus:AdWare.Win32.Gator.6034". Action Taken: No Action Taken.\par
\par
Tue Nov 15 15:23:25 2005 => Scanning File C:\\DevelopmentSW\\J2sdk1.4.2_02\\docs\\api\\org\\omg\\IOP\\class-use\\TaggedProfileHolder.html\par
\par
Tue Nov 15 15:23:25 2005 => Scanning File C:\\DevelopmentSW\\J2sdk1.4.2_02\\docs\\api\\org\\omg\\IOP\\class-use\\TaggedProfileHelper.html\par
\par
Tue Nov 15 15:23:25 2005 => Scanning File C:\\DevelopmentSW\\J2sdk1.4.2_02\\docs\\api\\org\\omg\\IOP\\class-use\\TaggedComponentHolder.html\par
\par
Tue Nov 15 15:23:25 2005 => Scanning File C:\\DevelopmentSW\\J2sdk1.4.2_02\\docs\\api\\org\\omg\\IOP\\class-use\\TaggedComponentHelper.html\par
\par
Tue Nov 15 15:23:25 2005 => Scanning File C:\\DevelopmentSW\\J2sdk1.4.2_02\\docs\\api\\org\\omg\\IOP\\class-use\\TaggedComponent.html\par
\par
Tue Nov 15 15:23:25 2005 => Scanning File C:\\DevelopmentSW\\J2sdk1.4.2_02\\docs\\api\\org\\omg\\IOP\\class-use\\TaggedProfile.html\par
\par
Tue Nov 15 15:23:27 2005 => Scanning File C:\\DevelopmentSW\\J2sdk1.4.2_02\\docs\\api\\org\\omg\\IOP\\TaggedComponent.html\par
\par
Tue Nov 15 15:23:27 2005 => Scanning File C:\\DevelopmentSW\\J2sdk1.4.2_02\\docs\\api\\org\\omg\\IOP\\TaggedComponentHelper.html\par
\par
Tue Nov 15 15:23:27 2005 => Scanning File C:\\DevelopmentSW\\J2sdk1.4.2_02\\docs\\api\\org\\omg\\IOP\\TaggedComponentHolder.html\par
\par
Tue Nov 15 15:23:27 2005 => Scanning File C:\\DevelopmentSW\\J2sdk1.4.2_02\\docs\\api\\org\\omg\\IOP\\TaggedProfile.html\par
\par
\par
Tue Nov 15 15:23:27 2005 => Scanning File C:\\DevelopmentSW\\J2sdk1.4.2_02\\docs\\api\\org\\omg\\IOP\\TaggedProfileHelper.html\par
\par
Tue Nov 15 15:23:27 2005 => Scanning File C:\\DevelopmentSW\\J2sdk1.4.2_02\\docs\\api\\org\\omg\\IOP\\TaggedProfileHolder.html\par
\par
Tue Nov 15 15:40:38 2005 => Scanning File C:\\TEMP\\docs\\api\\org\\omg\\IOP\\class-use\\TaggedProfileHolder.html\par
\par
Tue Nov 15 15:40:38 2005 => Scanning File C:\\TEMP\\docs\\api\\org\\omg\\IOP\\class-use\\TaggedProfileHelper.html\par
\par
Tue Nov 15 15:40:38 2005 => Scanning File C:\\TEMP\\docs\\api\\org\\omg\\IOP\\class-use\\TaggedComponentHolder.html\par
\par
Tue Nov 15 15:40:38 2005 => Scanning File C:\\TEMP\\docs\\api\\org\\omg\\IOP\\class-use\\TaggedComponentHelper.html\par
\par
Tue Nov 15 15:40:39 2005 => Scanning File C:\\TEMP\\docs\\api\\org\\omg\\IOP\\class-use\\TaggedComponent.html\par
\par
Tue Nov 15 15:40:39 2005 => Scanning File C:\\TEMP\\docs\\api\\org\\omg\\IOP\\class-use\\TaggedProfile.html\par
\par
Tue Nov 15 15:40:40 2005 => Scanning File C:\\TEMP\\docs\\api\\org\\omg\\IOP\\TaggedProfile.html\par
\par
Tue Nov 15 15:40:40 2005 => Scanning File C:\\TEMP\\docs\\api\\org\\omg\\IOP\\TaggedComponent.html\par
\par
Tue Nov 15 15:40:40 2005 => Scanning File C:\\TEMP\\docs\\api\\org\\omg\\IOP\\TaggedComponentHelper.html\par
\par
Tue Nov 15 15:40:40 2005 => Scanning File C:\\TEMP\\docs\\api\\org\\omg\\IOP\\TaggedComponentHolder.html\par
\par
Tue Nov 15 15:40:40 2005 => Scanning File C:\\TEMP\\docs\\api\\org\\omg\\IOP\\TaggedProfileHelper.html\par
\par
Tue Nov 15 15:40:40 2005 => Scanning File C:\\TEMP\\docs\\api\\org\\omg\\IOP\\TaggedProfileHolder.html\par
\par
\par
\par
\par
\par
}