Habe ich ein Rootkit auf dem PC?

planet gold

Hi Leute,
habe seit ein paar Tagen ein Problem: Wenn ich manche Sachen starte(beispielsweise Quicktime oder die Benutzerkonten über die Systemsteuerung) hängt das Betriebssystem und der Monitor geht aus, später rebootet der PC. Ab und zu erhalte ich auch Meldungen wie Buffer Overrun etc.

hier mein Hijack this Log

Logfile of HijackThis v1.99.1
Scan saved at 11:57:29, on 26.10.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\iSaver\iSaverCtrl.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Eraser\Eraser.exe
C:\Program Files\Free Download Manager\FUM\fumoei.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\hh.exe
C:\DOCUME~1\...\LOCALS~1\Temp\Rar$EX00.469\Rootkit_Detective.exe
C:\Program Files\TrueCrypt\TrueCrypt.exe
C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE
C:\Documents and Settings\...\Desktop\hijackthis_199\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [iSaverCtrl] C:\Program Files\iSaver\iSaverCtrl.exe --startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SAITEKAUTOCONFIGURE] C:\Program Files\Saitek\ST\Drv\saicnfig.exe /autorun
O4 - HKCU\..\Run: [Jet Detection] C:\Program Files\Creative\SBAudigy\PROGRAM\ADGJDet.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [Eraser] C:\Program Files\Eraser\Eraser.exe -hide
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Free Uploader Oe Integration] C:\Program Files\Free Download Manager\FUM\fumoei.exe
O4 - Global Startup: BTTray.lnk = ?
O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download video with Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Senden an &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Upload - {FD4E2FF8-973C-4A19-89BD-8E86B3CFCFE1} - C:\Program Files\Free Download Manager\FUM\fumiebtn.dll
O9 - Extra button: Klicke hier um das Projekt xp-AntiSpy zu unterstützen - {0e921e80-267a-42aa-aee4-60b9a1222a44} - C:\Program Files\xp-AntiSpy\sponsoring\sponsor.html (HKCU)
O9 - Extra 'Tools' menuitem: Unterstützung für xp-AntiSpy - {0e921e80-267a-42aa-aee4-60b9a1222a44} - C:\Program Files\xp-AntiSpy\sponsoring\sponsor.html (HKCU)
O11 - Options group: [INTERNATIONAL] International*
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: widimg - {EE7C2AFF-5742-44FF-BD0E-E521B0D3C3BA} - C:\WINDOWS\system32\btxppanel.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: FileZilla Server FTP server (FileZilla Server) - Unknown owner - c:\xampp\filezillaftp\filezillaserver.exe (file missing)
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

hier der report vom Rootkit unlocker
>SSDT State
NtConnectPort
Actual Address 0xF3E4AEB0
Hooked by: C:\WINDOWS\System32\vsdatant.sys

NtCreateFile
Actual Address 0xF3E47870
Hooked by: C:\WINDOWS\System32\vsdatant.sys

NtCreateKey
Actual Address 0xF3E52700
Hooked by: C:\WINDOWS\System32\vsdatant.sys

NtCreatePort
Actual Address 0xF3E4B270
Hooked by: C:\WINDOWS\System32\vsdatant.sys

NtCreateProcess
Actual Address 0xF3E51500
Hooked by: C:\WINDOWS\System32\vsdatant.sys

NtCreateProcessEx
Actual Address 0xF3E51730
Hooked by: C:\WINDOWS\System32\vsdatant.sys

NtCreateSection
Actual Address 0xF3E55090
Hooked by: C:\WINDOWS\System32\vsdatant.sys

NtCreateThread
Actual Address 0xF7D059BC
Hooked by: Unknown module filename

NtCreateWaitablePort
Actual Address 0xF3E4B350
Hooked by: C:\WINDOWS\System32\vsdatant.sys

NtDeleteFile
Actual Address 0xF3E47EF0
Hooked by: C:\WINDOWS\System32\vsdatant.sys

NtDeleteKey
Actual Address 0xF3E53720
Hooked by: C:\WINDOWS\System32\vsdatant.sys

NtDeleteValueKey
Actual Address 0xF3E53360
Hooked by: C:\WINDOWS\System32\vsdatant.sys

NtDuplicateObject
Actual Address 0xF3E51270
Hooked by: C:\WINDOWS\System32\vsdatant.sys

NtEnumerateKey
Actual Address 0xF752AFB2
Hooked by: sptd.sys

NtEnumerateValueKey
Actual Address 0xF752B340
Hooked by: sptd.sys

NtLoadKey
Actual Address 0xF3E53A60
Hooked by: C:\WINDOWS\System32\vsdatant.sys

NtOpenFile
Actual Address 0xF3E47D40
Hooked by: C:\WINDOWS\System32\vsdatant.sys

NtOpenKey
Actual Address 0xF75250B0
Hooked by: sptd.sys

NtOpenProcess
Actual Address 0xF7D059A8
Hooked by: Unknown module filename

NtOpenThread
Actual Address 0xF7D059AD
Hooked by: Unknown module filename

NtQueryKey
Actual Address 0xF752B418
Hooked by: sptd.sys

NtQueryValueKey
Actual Address 0xF752B298
Hooked by: sptd.sys

NtRenameKey
Actual Address 0xF3E541D0
Hooked by: C:\WINDOWS\System32\vsdatant.sys

NtReplaceKey
Actual Address 0xF3E53D50
Hooked by: C:\WINDOWS\System32\vsdatant.sys

NtRequestWaitReplyPort
Actual Address 0xF3E4AB50
Hooked by: C:\WINDOWS\System32\vsdatant.sys

NtRestoreKey
Actual Address 0xF3E54000
Hooked by: C:\WINDOWS\System32\vsdatant.sys

NtSecureConnectPort
Actual Address 0xF3E4B060
Hooked by: C:\WINDOWS\System32\vsdatant.sys

NtSetInformationFile
Actual Address 0xF3E48060
Hooked by: C:\WINDOWS\System32\vsdatant.sys

NtSetValueKey
Actual Address 0xF3E52ED7
Hooked by: C:\WINDOWS\System32\vsdatant.sys

NtTerminateProcess
Actual Address 0xF7D059B7
Hooked by: Unknown module filename

NtWriteVirtualMemory
Actual Address 0xF7D059B2
Hooked by: Unknown module filename

>Shadow
NtUserMessageCall
Actual Address 0xF3E491A0
Hooked by: C:\WINDOWS\System32\vsdatant.sys

NtUserPostMessage
Actual Address 0xF3E49230
Hooked by: C:\WINDOWS\System32\vsdatant.sys

NtUserPostThreadMessage
Actual Address 0xF3E492B0
Hooked by: C:\WINDOWS\System32\vsdatant.sys

NtUserSendInput
Actual Address 0xF3E49470
Hooked by: C:\WINDOWS\System32\vsdatant.sys

>Processes
>Drivers
>Stealth
Unknown page with executable code
Address: 0x86C2F706
Size: 2298
Unknown page with executable code
Address: 0x86CA23BD
Size: 3139
Unknown page with executable code
Address: 0x86C35DE2
Size: 542
Unknown page with executable code
Address: 0x86CA1D92
Size: 622
>Files
>Hooks
fastfat.sys-->ntoskrnl.exe-->IoCreateDevice, Type: IAT modification at address 0xBAC9787C hook handler located in [unknown_code_page]
ntoskrnl.exe-->IoCreateDevice, Type: EAT modification at address 0x8067E8F4 hook handler located in [unknown_code_page]
tcpip.sys-->ndis.sys-->NdisCloseAdapter, Type: IAT modification at address 0xF3EDEF28 hook handler located in [vsdatant.sys]
tcpip.sys-->ndis.sys-->NdisOpenAdapter, Type: IAT modification at address 0xF3EDEF54 hook handler located in [vsdatant.sys]
tcpip.sys-->ndis.sys-->NdisRegisterProtocol, Type: IAT modification at address 0xF3EDEF60 hook handler located in [vsdatant.sys]
tcpip.sys-->ntoskrnl.exe-->IoCreateDevice, Type: IAT modification at address 0xF3EDEF88 hook handler located in [unknown_code_page]
wanarp.sys-->ndis.sys-->NdisCloseAdapter, Type: IAT modification at address 0xF7774B4C hook handler located in [vsdatant.sys]
wanarp.sys-->ndis.sys-->NdisDeregisterProtocol, Type: IAT modification at address 0xF7774B1C hook handler located in [vsdatant.sys]
wanarp.sys-->ndis.sys-->NdisOpenAdapter, Type: IAT modification at address 0xF7774B3C hook handler located in [vsdatant.sys]
wanarp.sys-->ndis.sys-->NdisRegisterProtocol, Type: IAT modification at address 0xF7774B28 hook handler located in [vsdatant.sys]
wanarp.sys-->ntoskrnl.exe-->IoCreateDevice, Type: IAT modification at address 0xF7774C08 hook handler located in [unknown_code_page]
!!POSSIBLE ROOTKIT ACTIVITY DETECTED!! =)