Trojaner gelöscht / Bitte Logfile checken

LuckyMan26

Liebes Forum,

vor ein paar Tagen hatte mir AntiVir eine Trojaner Meldung gegeben: TR/Crypt.ULPM.Gen

Ich habe die entsprechende .exe Datei sofort gelöscht. Ich möchte jetzt auf Nummer Sicher gehen und poste deshalb mein HJT Log File. Gibt es da noch Probleme?

Danke, Gruß, Lucky



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:01:54, on 31.10.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
C:\Programme\CA\eTrust Antivirus\InoRpc.exe
C:\Programme\CA\eTrust Antivirus\InoRT.exe
C:\Programme\CA\eTrust Antivirus\InoTask.exe
C:\Programme\CA\SharedComponents\CA_LIC\LogWatNT.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\PROGRA~1\OUTPOS~1.0\outpost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\Dit.exe
C:\WINDOWS\mHotkey.exe
C:\WINDOWS\CNYHKey.exe
C:\WINDOWS\system32\RunDll32.exe
C:\WINDOWS\DitExp.exe
C:\PROGRA~1\CA\ETRUST~1\realmon.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0D2.EXE
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe
C:\Programme\Unlocker\UnlockerAssistant.exe
C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
C:\Programme\Siemens\Gigaset USB Stick 54\Gcc.exe
C:\Programme\Vidalia Bundle\Privoxy\privoxy.exe
C:\Programme\Siemens\Gigaset USB Stick 54\OdHost.exe
C:\Programme\Mozilla Thunderbird\thunderbird.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\Programme\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

h**p://www.real.de/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft

Internet Explorer von Strato DSL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -

C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} -

C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [ledpointer] CNYHKey.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE

C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Realtime Monitor] C:\PROGRA~1\CA\ETRUST~1\realmon.exe -s
O4 - HKLM\..\Run: [VOBRegCheck] C:\WINDOWS\System32\VOBREGCheck.exe -CheckReg
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\PSDrvCheck.exe
O4 - HKLM\..\Run: [EPSON Stylus C84 Series]

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0D2.EXE /P23 "EPSON Stylus

C84 Series" /O6 "USB001" /M "Stylus C84"
O4 - HKLM\..\Run: [Outpost Firewall] C:\PROGRA~1\OUTPOS~1.0\outpost.exe

/waitservice
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame

Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe"

-atboottime
O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition

Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [UnlockerAssistant]

"C:\Programme\Unlocker\UnlockerAssistant.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search &

Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User

'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User

'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User

'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User

'Default user')
O4 - Global Startup: Gigaset WLAN Adapter Monitor.lnk =

C:\Programme\Siemens\Gigaset USB Stick 54\Gcc.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft

Office\Office10\OSA.EXE
O4 - Global Startup: Privoxy.lnk = C:\Programme\Vidalia

Bundle\Privoxy\privoxy.exe
O8 - Extra context menu item: Nach Microsoft &Excel exportieren -

res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: Share in Hello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} -

C:\Programme\Hello\PicasaCapture.dll
O9 - Extra 'Tools' menuitem: Share in H&ello -

{B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Programme\Hello\PicasaCapture.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no

file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -

C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra button: MedionShop - {ABF53A3A-024E-4762-A3C1-263AEE17F172} -

h**p://www.medionshop.de/ (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=h**p://www.strato.de/dsl/
O17 -

HKLM\System\CCS\Services\Tcpip\..\{EBF3A30D-AB43-4386-9B06-A2BE23556CB4}:

NameServer = 192.168.231.101
O17 -

HKLM\System\CCS\Services\Tcpip\..\{F6D225D3-F349-4F03-924F-A3380828DACC}:

NameServer = 192.168.231.101
O20 - AppInit_DLLs: C:\WINDOWS\system32\wmfhotfix.dll
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) -

Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira

GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: CA-Lizenz-Client (CA_LIC_CLNT) - Computer Associates -

C:\Programme\CA\SharedComponents\CA_LIC\lic98rmt.exe
O23 - Service: CA-Lizenzserver (CA_LIC_SRVR) - Computer Associates -

C:\Programme\CA\SharedComponents\CA_LIC\lic98rmtd.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision

Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel

32\IDriverT.exe
O23 - Service: eTrust Antivirus RPC Server (InoRPC) - Computer Associates

International, Inc. - C:\Programme\CA\eTrust Antivirus\InoRpc.exe
O23 - Service: eTrust Antivirus Realtime Server (InoRT) - Computer Associates

International, Inc. - C:\Programme\CA\eTrust Antivirus\InoRT.exe
O23 - Service: eTrust Antivirus Job Server (InoTask) - Computer Associates

International, Inc. - C:\Programme\CA\eTrust Antivirus\InoTask.exe
O23 - Service: Ereignisprotokoll-Überwachung (LogWatch) - Computer Associates

- C:\Programme\CA\SharedComponents\CA_LIC\LogWatNT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation -

C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Outpost Firewall Service (OutpostFirewall) - Agnitum -

C:\PROGRA~1\OUTPOS~1.0\outpost.exe
O23 - Service: X10 Device Network Service (x10nets) - Unknown owner -

C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe (file missing)

--
End of file - 6790 bytes