Symantec AntiVirus meldet: Adware.VirtuMonde

mattis

Mein Symantec AntiVirus meldet folgendes erkannte Risiko: Adware.VirtuMonde
Die Quelladresse lautet: c:\windows\system32\
Der Dateiname lautet: urqqrol.dll
Laut Spybot

Hier das hijackthis-Protoll:

Logfile of HijackThis v1.99.1
Scan saved at 11:30:12, on 12.12.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\acs.exe
C:\maint\sid\disth\disth.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\Symantec_Antivirus_10_DE\DefWatch.exe
C:\WINDOWS\system32\PMService.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\lotus\notes\ntmulti.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec\Symantec_Antivirus_10_DE\Rtvscan.exe
C:\Program Files\Börse 2007\bin\watchdog.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\CSCRIPT.EXE
C:\WINDOWS\system32\cscript.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\Symantec\SYMANT~1\VPTray.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\PROGRA~1\CYBERL~1\POWERD~1\DVDLAU~1.EXE
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Symantec\Symantec_Antivirus_10_DE\DoScan.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Apoint\HidFind.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Level One\Firmware\WLANPRO.exe
C:\Program Files\Siegfried_Weckmann\Hardcopy_14_XL\hardcopy.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\HiJackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = AO Z - Home
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [ACSrun] "%SystemRoot%\system32\usrlogon.bat"
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [EPA_EZ_GPO_Tool] C:\WINDOWS\system32\EZ_GPO_Tool.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\Symantec\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [DVDLauncher] "C:\PROGRA~1\CYBERL~1\POWERD~1\DVDLAU~1.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: AS Client-Manager.lnk = C:\VUS2001\System\ZACLIENT.EXE
O4 - Global Startup: 108Mbps Wireless LAN Adapter Configuration Utility.lnk = C:\Program Files\Level One\Firmware\WLANPRO.exe
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft\Office_XP_XL\Office10\OSA.EXE
O4 - Global Startup: Reg.lnk = ?
O4 - Global Startup: Siegfried Weckmann Hardcopy 14.5 XL.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Alles mit FlashGet laden - C:\Documents and Settings\anwender41\My Documents\Download (C)\FlashGet\jc_all.htm
O8 - Extra context menu item: &Mit FlashGet laden - C:\Documents and Settings\anwender41\My Documents\Download (C)\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Mobilen Favoriten erstellen... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Documents and Settings\anwender41\My Documents\Download (C)\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Documents and Settings\anwender41\My Documents\Download (C)\FlashGet\FlashGet.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=about:blank
O15 - Trusted Zone: *.ao-dh.de
O15 - Trusted Zone: *.ao-z.de
O15 - Trusted Zone: *.aodh.de
O15 - Trusted Zone: *.aoz.de
O15 - Trusted Zone: *.bonnfinanz-vertrieb.de
O15 - Trusted Zone: *.bvk.de
O15 - Trusted Zone: *.dws-direkt.deutsche-bank.de
O15 - Trusted Zone: *.deutsche-versicherungsboerse.de
O15 - Trusted Zone: *.dkv.com
O15 - Trusted Zone: *.dkv.de
O15 - Trusted Zone: *.info.dws.com
O15 - Trusted Zone: *.info.dws.de
O15 - Trusted Zone: *.dws.de
O15 - Trusted Zone: *.dwsgo.de
O15 - Trusted Zone: *.gdvonline.de
O15 - Trusted Zone: *.gmx.net
O15 - Trusted Zone: *.heeseshop.de
O15 - Trusted Zone: *.herold-vertrieb.de
O15 - Trusted Zone: *.herold.de
O15 - Trusted Zone: *.banking.ing-diba.de
O15 - Trusted Zone: *.IVZDH.de
O15 - Trusted Zone: *.maklerweb.de
O15 - Trusted Zone: *.orgam.de
O15 - Trusted Zone: *.vantage-kicks-ass.de
O15 - Trusted Zone: *.vantage-kicks-ass.net
O15 - Trusted Zone: *.vantagefunclub.ru
O15 - Trusted Zone: *.volkswagenbank.de
O15 - Trusted Zone: *.vtr1000.de
O15 - Trusted Zone: *.werder.de
O15 - Trusted Zone: *.zuerich.com
O15 - Trusted Zone: *.zuerich.de
O15 - Trusted Zone: *.zurich.com
O15 - Trusted Zone: *.zurich.de
O15 - Trusted Zone: *.ao-dh.de (HKLM)
O15 - Trusted Zone: *.ao-z.de (HKLM)
O15 - Trusted Zone: *.aodh.de (HKLM)
O15 - Trusted Zone: *.aoz.de (HKLM)
O15 - Trusted Zone: *.bonnfinanz-vertrieb.de (HKLM)
O15 - Trusted Zone: *.dkv.com (HKLM)
O15 - Trusted Zone: *.dkv.de (HKLM)
O15 - Trusted Zone: *.gdvonline.de (HKLM)
O15 - Trusted Zone: *.herold-vertrieb.de (HKLM)
O15 - Trusted Zone: *.herold.de (HKLM)
O15 - Trusted Zone: *.maklerweb.de (HKLM)
O15 - Trusted Zone: *.orgam.de (HKLM)
O15 - Trusted Zone: *.zuerich.com (HKLM)
O15 - Trusted Zone: *.zuerich.de (HKLM)
O15 - Trusted Zone: *.zurich.com (HKLM)
O15 - Trusted Zone: *.zurich.de (HKLM)
O15 - Trusted IP range: http://127.0.0.1
O15 - Trusted IP range: http://127.0.0.1 (HKLM)
O17 - HKLM\System\CCS\Services\Tcpip\..\{C4BDA7D2-1C8E-4B12-BEB7-9791C0689685}: Domain = oop.zfs
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = oop.zfs
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = oop.zfs
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = oop.zfs
O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
O23 - Service: BBDistHandler - Unknown owner - %SystemDrive%\maint\sid\disth\disth.exe (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec\Symantec_Antivirus_10_DE\DefWatch.exe
O23 - Service: DameWare Mini Remote Control (DWMRCS) - DameWare Development LLC - C:\WINDOWS\system32\DWRCS.exe
O23 - Service: Energy Star(TM) EZ GPO Power Management Configuration Tool (EPA_GPO_PMService) - TerraNovum - C:\WINDOWS\system32\PMService.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Lotus Notes - Gemeinsame Anmeldung (Lotus Notes Single Logon) - IBM Corp - C:\WINDOWS\system32\nslsvice.exe
O23 - Service: Multi-user Cleanup Service - IBM Corp - C:\Program Files\lotus\notes\ntmulti.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec\Symantec_Antivirus_10_DE\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec\Symantec_Antivirus_10_DE\Rtvscan.exe
O23 - Service: WisoBoerseWatchDog - market maker Software AG - C:\Program Files\Börse 2007\bin\watchdog.exe
O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe