| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Win32:Agent-UBX(Trj)Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
03.04.2008, 22:02
| #1 |
 |  Win32:Agent-UBX(Trj) hallo! avast hat heute beim starten des rechners folgenden trojaner gefunden win32:agent-ubx(trj). dateiname usw. siehe bild. den trojaner konnte ich in den virus container verschieben. ich konnte bis jetzt noch keine einschränkungen meines systems feststellen. wie soll ich am besten mit dem trojaner weiter verfahren? was hat er in meinem system angestellt? im www oder in der suchfunktion habe ich keine beiträge zu dem trojaner gefunden. (zumindest auf deutsch) Code:
ATTFilter Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 22:13:27, on 03.04.2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16608) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe C:\Programme\Alwil Software\Avast4\aswUpdSv.exe C:\Programme\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\RTHDCPL.EXE C:\Programme\Java\jre1.6.0_05\bin\jusched.exe C:\Acer\Empowering Technology\eRecovery\Monitor.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\AGRSMMSG.exe C:\Programme\QuickTime\qttask.exe C:\Programme\Acer\Acer eMode Management\AspireService.exe C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAEE.EXE C:\Programme\ICQLite\ICQLite.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Programme\a-squared Anti-Dialer\a2adguard.exe C:\Programme\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\WINDOWS\system32\ctfmon.exe C:\Programme\a-squared Anti-Dialer\a2service.exe C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Programme\Spybot - Search & Destroy\TeaTimer.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\PnkBstrB.exe C:\Programme\Electronic Arts\EADM\Core.exe C:\WINDOWS\system32\svchost.exe C:\Programme\Alwil Software\Avast4\ashMaiSv.exe C:\Programme\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\System32\alg.exe C:\Programme\ATI Technologies\ATI.ACE\Core-Static\ccc.exe C:\Programme\Alwil Software\Avast4\ashSimpl.exe C:\Programme\Alwil Software\Avast4\ashChest.exe C:\Programme\Mozilla Firefox\firefox.exe D:\Download\virensucher\HiJackThis202.exe C:\WINDOWS\system32\wbem\wmiprvse.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://google.icq.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.garnelenforum.de/board/cmps_index.php R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Programme\FlashGet\jccatch.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar4.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O2 - BHO: Burn4Free Toolbar Helper - {D187A56B-A33F-4CBE-9D77-459FC0BAE012} - C:\Programme\Burn4Free Toolbar\v3.3.0.1\Burn4Free_Toolbar.dll O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Programme\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Programme\FlashGet\getflash.dll O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Programme\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar4.dll O3 - Toolbar: Burn4Free Toolbar - {4F11ACBB-393F-4C86-A214-FF3D0D155CC3} - C:\Programme\Burn4Free Toolbar\v3.3.0.1\Burn4Free_Toolbar.dll O4 - HKLM\..\Run: [LaunchApp] Alaunch O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [ntiMUI] c:\Programme\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [AspireService] C:\Programme\Acer\Acer eMode Management\AspireService.exe O4 - HKLM\..\Run: [EPSON Stylus DX4200 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAEE.EXE /P26 "EPSON Stylus DX4200 Series" /O6 "USB001" /M "Stylus DX4200" O4 - HKLM\..\Run: [ICQ Lite] "C:\Programme\ICQLite\ICQLite.exe" -minimize O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [a-squared] "C:\Programme\a-squared Anti-Dialer\a2adguard.exe" O4 - HKLM\..\Run: [StartCCC] "C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\Run: [EA Core] "C:\Programme\Electronic Arts\EADM\Core.exe" -silent O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: &Alles mit FlashGet laden - C:\Programme\FlashGet\jc_all.htm O8 - Extra context menu item: &Mit FlashGet laden - C:\Programme\FlashGet\jc_link.htm O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programme\PartyGaming\PartyPoker\RunApp.exe O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programme\PartyGaming\PartyPoker\RunApp.exe O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Programme\FlashGet\FlashGet.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Programme\FlashGet\FlashGet.exe O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1150666801812 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL O23 - Service: a-squared Anti-Dialer Service (a2AntiDialer) - Emsi Software GmbH - C:\Programme\a-squared Anti-Dialer\a2service.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programme\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Automatisches LiveUpdate - Scheduler - Unknown owner - C:\Programme\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing) O23 - Service: avast! Antivirus - ALWIL Software - C:\Programme\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Programme\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Programme\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe O23 - Service: Symantec Core LC - Unknown owner - C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe -- End of file - 10720 bytes Code:
ATTFilter iclean log 03.04.2008 22:53:11
Windows XP SP2, Using advanced Kernel functions
Processes
---------
572 - \SystemRoot\System32\smss.exe - \SystemRoot\System32\smss.exe
620 - \??\C:\WINDOWS\system32\csrss.exe - \??\C:\WINDOWS\system32\csrss.exe
652 - \??\C:\WINDOWS\system32\winlogon.exe - \??\C:\WINDOWS\system32\winlogon.exe
696 - C:\WINDOWS\system32\services.exe - Anwendung für Dienste und Controller
708 - C:\WINDOWS\system32\lsass.exe - LSA Shell (Export Version)
880 - C:\WINDOWS\system32\Ati2evxx.exe - ATI External Event Utility EXE Module
900 - C:\WINDOWS\system32\svchost.exe - Generic Host Process for Win32 Services
1004 - C:\WINDOWS\system32\svchost.exe - Generic Host Process for Win32 Services
1120 - C:\WINDOWS\system32\svchost.exe - Generic Host Process for Win32 Services
1208 - C:\WINDOWS\system32\svchost.exe - Generic Host Process for Win32 Services
1232 - C:\WINDOWS\system32\Ati2evxx.exe - ATI External Event Utility EXE Module
1344 - C:\WINDOWS\system32\svchost.exe - Generic Host Process for Win32 Services
1472 - C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe - C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe (Signed)
1572 - C:\Programme\Alwil Software\Avast4\aswUpdSv.exe - avast! Antivirus updating service (Signed)
1632 - C:\Programme\Alwil Software\Avast4\ashServ.exe - avast! antivirus service (Signed)
1764 - C:\WINDOWS\Explorer.EXE - Windows Explorer
1920 - C:\WINDOWS\RTHDCPL.EXE - Realtek HD Audio Control Panel
116 - C:\Programme\Java\jre1.6.0_05\bin\jusched.exe - Java(TM) Platform SE binary (Signed)
(Hidden) 128 - C:\Acer\Empowering Technology\eRecovery\Monitor.exe - Monitor
216 - C:\WINDOWS\system32\spoolsv.exe - Spooler SubSystem App
432 - C:\WINDOWS\AGRSMMSG.exe - SoftModem Messaging Applet
500 - C:\Programme\QuickTime\qttask.exe - C:\Programme\QuickTime\qttask.exe
352 - AspireService.e - AspireService.e
608 - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAEE.EXE - EPSON Status Monitor 3
952 - C:\Programme\ICQLite\ICQLite.exe - ICQLite (Signed)
1068 - C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe - avast! service GUI component (Signed)
1240 - C:\Programme\a-squared Anti-Dialer\a2adguard.exe - a-squared Anti-Dialer Guard
1284 - C:\WINDOWS\system32\ctfmon.exe - CTF Loader
1216 - C:\Programme\ATI Technologies\ATI.ACE\Core-Static\MOM.exe - Catalyst Control Center: Monitoring program
1324 - C:\Programme\a-squared Anti-Dialer\a2service.exe - a-squared Service (Signed)
1332 - GoogleToolbarNo - GoogleToolbarNo
1540 - C:\Programme\Spybot - Search & Destroy\TeaTimer.exe - System settings protector (Signed)
1676 - C:\WINDOWS\system32\PnkBstrA.exe - C:\WINDOWS\system32\PnkBstrA.exe (Signed)
2016 - C:\WINDOWS\system32\PnkBstrB.exe - C:\WINDOWS\system32\PnkBstrB.exe (Signed)
2072 - C:\Programme\Electronic Arts\EADM\Core.exe - EA Download Manager
2144 - C:\WINDOWS\system32\svchost.exe - Generic Host Process for Win32 Services
2708 - C:\Programme\Alwil Software\Avast4\ashMaiSv.exe - avast! e-Mail Scanner Service (Signed)
2788 - C:\Programme\Alwil Software\Avast4\ashWebSv.exe - avast! Web Scanner (Signed)
3328 - C:\WINDOWS\System32\alg.exe - Application Layer Gateway Service
3896 - C:\Programme\ATI Technologies\ATI.ACE\Core-Static\ccc.exe - Catalyst Control Centre: Host application
992 - C:\Programme\Alwil Software\Avast4\ashSimpl.exe - Virus scanner (Signed)
2240 - C:\Programme\Mozilla Firefox\firefox.exe - Firefox (Signed)
3164 - C:\Programme\Alwil Software\Avast4\ashChest.exe - aswChestInterface application (Signed)
1672 - D:\Download\virensucher\iclean.exe - Interactive Cleaner
Services
--------
c:\programme\a-squared anti-dialer\a2service.exe=a2AntiDialer
C:\WINDOWS\system32\alg.exe=ALG
c:\programme\alwil software\avast4\aswupdsv.exe=aswUpdSv
C:\WINDOWS\system32\ati2evxx.exe=Ati HotKey Poller
C:\WINDOWS\system32\svchost.exe=AudioSrv
c:\programme\alwil software\avast4\ashserv.exe=avast! Antivirus
c:\programme\alwil software\avast4\ashmaisv.exe=avast! Mail Scanner
c:\programme\alwil software\avast4\ashwebsv.exe=avast! Web Scanner
C:\WINDOWS\system32\svchost.exe=CryptSvc
C:\WINDOWS\system32\svchost.exe=DcomLaunch
C:\WINDOWS\system32\svchost.exe=Dhcp
C:\WINDOWS\system32\svchost.exe=Dnscache
C:\WINDOWS\system32\svchost.exe=ERSvc
C:\WINDOWS\system32\services.exe=Eventlog
c:\windows\system32\svchost.exe=EventSystem
C:\WINDOWS\system32\svchost.exe=FastUserSwitchingCompatibility
C:\WINDOWS\system32\svchost.exe=helpsvc
C:\WINDOWS\system32\svchost.exe=HidServ
C:\WINDOWS\system32\svchost.exe=lanmanserver
C:\WINDOWS\system32\svchost.exe=lanmanworkstation
C:\WINDOWS\system32\svchost.exe=LmHosts
C:\WINDOWS\system32\svchost.exe=Netman
C:\WINDOWS\system32\svchost.exe=Nla
C:\WINDOWS\system32\services.exe=PlugPlay
c:\windows\system32\pnkbstra.exe=PnkBstrA
c:\windows\system32\pnkbstrb.exe=PnkBstrB
C:\WINDOWS\system32\lsass.exe=PolicyAgent
C:\WINDOWS\system32\lsass.exe=ProtectedStorage
C:\WINDOWS\system32\svchost.exe=RasMan
C:\WINDOWS\system32\svchost.exe=RpcSs
C:\WINDOWS\system32\lsass.exe=SamSs
C:\WINDOWS\system32\svchost.exe=Schedule
C:\WINDOWS\system32\svchost.exe=seclogon
C:\WINDOWS\system32\svchost.exe=SENS
C:\WINDOWS\system32\svchost.exe=SharedAccess
C:\WINDOWS\system32\svchost.exe=ShellHWDetection
C:\WINDOWS\system32\spoolsv.exe=Spooler
C:\WINDOWS\system32\svchost.exe=srservice
C:\WINDOWS\system32\svchost.exe=SSDPSRV
C:\WINDOWS\system32\svchost.exe=stisvc
c:\programme\gemeinsame dateien\symantec shared\ccpd-lc\symlcsvc.exe=Symantec Core LC
C:\WINDOWS\system32\svchost.exe=TapiSrv
C:\WINDOWS\system32\svchost.exe=TermService
C:\WINDOWS\system32\svchost.exe=Themes
C:\WINDOWS\system32\svchost.exe=TrkWks
C:\WINDOWS\system32\svchost.exe=W32Time
C:\WINDOWS\system32\svchost.exe=WebClient
C:\WINDOWS\system32\svchost.exe=winmgmt
C:\WINDOWS\system32\svchost.exe=wscsvc
C:\WINDOWS\system32\svchost.exe=wuauserv
C:\WINDOWS\system32\svchost.exe=WZCSVC
Registry
--------
000=HKCU\Run: CTFMON.EXE=c:\windows\system32\ctfmon.exe
000=HKCU\Run: EA Core="c:\programme\electronic arts\eadm\core.exe" -silent
000=HKCU\Run: SpybotSD TeaTimer=c:\programme\spybot - search & destroy\teatimer.exe
000=HKCU\Run: swg=c:\programme\google\googletoolbarnotifier\googletoolbarnotifier.exe
000=HKLM\Run: AGRSMMSG=c:\windows\agrsmmsg.exe
000=HKLM\Run: Alcmtr=c:\windows\alcmtr.exe
000=HKLM\Run: AspireService=c:\programme\acer\acer emode management\aspireservice.exe
000=HKLM\Run: a-squared="c:\programme\a-squared anti-dialer\a2adguard.exe"
000=HKLM\Run: avast!=c:\progra~1\alwils~1\avast4\ashdisp.exe
000=HKLM\Run: EPSON Stylus DX4200 Series=c:\windows\system32\spool\drivers\w32x86\3\e_fatiaee.exe /p26 "epson stylus dx4200 series" /o6 "usb001" /m "stylus dx4200"
000=HKLM\Run: eRecoveryService=c:\acer\empowering technology\erecovery\monitor.exe
000=HKLM\Run: High Definition Audio Property Page Shortcut=c:\windows\system32\hdashcut.exe
000=HKLM\Run: ICQ Lite="c:\programme\icqlite\icqlite.exe" -minimize
000=HKLM\Run: IMJPMIG8.1="c:\windows\ime\imjp8_1\imjpmig.exe" /spoil /remadvdef /migration32
000=HKLM\Run: LaunchApp=alaunch
000=HKLM\Run: MSPY2002=c:\windows\system32\ime\pintlgnt\imscinst.exe
000=HKLM\Run: ntiMUI=c:\programme\newtech infosystems\nti cd & dvd-maker 7\ntimui.exe
000=HKLM\Run: PHIME2002A=c:\windows\system32\ime\tintlgnt\tintsetp.exe /imename
000=HKLM\Run: PHIME2002ASync=c:\windows\system32\ime\tintlgnt\tintsetp.exe /sync
000=HKLM\Run: QuickTime Task="c:\programme\quicktime\qttask.exe" -atboottime
000=HKLM\Run: RTHDCPL=c:\windows\rthdcpl.exe
000=HKLM\Run: StartCCC="c:\programme\ati technologies\ati.ace\core-static\clistart.exe"
000=HKLM\Run: SunJavaUpdateSched="c:\programme\java\jre1.6.0_05\bin\jusched.exe"
001=Firewall bypass: %windir%\Network Diagnostic\xpnetdiag.exe=c:\windows\network diagnostic\xpnetdiag.exe
001=Firewall bypass: %windir%\system32\sessmgr.exe=c:\windows\system32\sessmgr.exe
001=Firewall bypass: C:\Programme\Acer\Acer eConsole\eConsole.exe=
001=Firewall bypass: C:\Programme\Acer\Acer eConsole\MediaServerService.exe=
001=Firewall bypass: C:\Programme\Acer\Acer eConsole\MediaSync.exe=
001=Firewall bypass: C:\Programme\EA GAMES\Battlefield 2\BF2.exe=c:\programme\ea games\battlefield 2\bf2.exe
001=Firewall bypass: C:\Programme\Electronic Arts\Battlefield 2142 Server\BF2142VoipServer_w32ded.exe=c:\programme\electronic arts\battlefield 2142 server\bf2142voipserver_w32ded.exe
001=Firewall bypass: C:\Programme\Electronic Arts\Battlefield 2142\BF2142.exe=c:\programme\electronic arts\battlefield 2142\bf2142.exe
001=Firewall bypass: C:\Programme\FlashGet\flashget.exe=c:\programme\flashget\flashget.exe
001=Firewall bypass: C:\Programme\ICQLite\ICQLite.exe=c:\programme\icqlite\icqlite.exe
001=Firewall bypass: C:\Programme\Skype\Phone\Skype.exe=c:\programme\skype\phone\skype.exe
001=Firewall bypass: C:\Programme\Ubisoft\DIE SIEDLER - Aufstieg eines Königreichs\base\bin\Settlers6.exe=c:\programme\ubisoft\die siedler - aufstieg eines königreichs\base\bin\settlers6.exe
001=Firewall bypass: C:\Programme\Winamp Remote\bin\Orb.exe=c:\programme\winamp remote\bin\orb.exe
001=Firewall bypass: C:\Programme\Winamp Remote\bin\OrbStreamerClient.exe=c:\programme\winamp remote\bin\orbstreamerclient.exe
001=Firewall bypass: C:\Programme\Winamp Remote\bin\OrbTray.exe=c:\programme\winamp remote\bin\orbtray.exe
001=Firewall bypass: C:\WINDOWS\system32\PnkBstrA.exe=c:\windows\system32\pnkbstra.exe
001=Firewall bypass: C:\WINDOWS\system32\PnkBstrB.exe=c:\windows\system32\pnkbstrb.exe
020=SSODL: CDBurn=C:\WINDOWS\system32\shell32.dll
020=SSODL: PostBootReminder=C:\WINDOWS\system32\shell32.dll
020=SSODL: SysTray=c:\windows\system32\stobject.dll
020=SSODL: WebCheck=c:\windows\system32\webcheck.dll
020=SSODL: WPDShServiceObj=c:\windows\system32\wpdshserviceobj.dll
030=BHO: {22BF413B-C6D2-4d91-82A9-A0F997BA588C}=c:\progra~1\skype\phone\ieplugin\skypei~1.dll (Skype add-on (mastermind))
030=BHO: {2F364306-AA45-47B5-9F9D-39A8B94E7EF7}=c:\programme\flashget\jccatch.dll (FGCatchUrl)
030=BHO: {53707962-6F74-2D53-2644-206D7942484F}=c:\progra~1\spybot~1\sdhelper.dll (Spybot-S&D IE Protection)
030=BHO: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=c:\programme\java\jre1.6.0_05\bin\ssv.dll (SSVHelper Class)
030=BHO: {AA58ED58-01DD-4d91-8333-CF10577473F7}=c:\programme\google\googletoolbar4.dll (Google Toolbar Helper)
030=BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D}=c:\programme\google\googletoolbarnotifier\2.0.301.7164\swg.dll (Google Toolbar Notifier BHO)
030=BHO: {D187A56B-A33F-4CBE-9D77-459FC0BAE012}=c:\programme\burn4free toolbar\v3.3.0.1\burn4free_toolbar.dll (Burn4Free Toolbar Helper)
030=BHO: {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A}=c:\programme\epson\epson web-to-page\epson web-to-page.dll (EpsonToolBandKicker Class)
030=BHO: {F156768E-81EF-470C-9057-481BA8380DBA}=c:\programme\flashget\getflash.dll (FlashGet GetFlash Class)
031=Toolbar: {01E04581-4EEE-11D0-BFE9-00AA005B4383}=C:\WINDOWS\system32\browseui.dll
031=Toolbar: {0E5CBF21-D15F-11D0-8301-00AA005B4383}=C:\WINDOWS\system32\shell32.dll
031=Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F}=c:\programme\google\googletoolbar4.dll
031=Toolbar: {4F11ACBB-393F-4C86-A214-FF3D0D155CC3}=c:\programme\burn4free toolbar\v3.3.0.1\burn4free_toolbar.dll
031=Toolbar: {EE5D279F-081B-4404-994D-C6B60AAEBA6D}=c:\programme\epson\epson web-to-page\epson web-to-page.dll
031=Toolbar: {F2CF5485-4E02-4F68-819C-B92DE9277049}=c:\windows\system32\ieframe.dll
031=Toolbar: ITBar7Layout=(null)
031=Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F}=c:\programme\google\googletoolbar4.dll
031=Toolbar: {4F11ACBB-393F-4C86-A214-FF3D0D155CC3}=c:\programme\burn4free toolbar\v3.3.0.1\burn4free_toolbar.dll
031=Toolbar: {EE5D279F-081B-4404-994D-C6B60AAEBA6D}=c:\programme\epson\epson web-to-page\epson web-to-page.dll
über eure hilfe freut sich urmel  |
| Themen zu Win32:Agent-UBX(Trj) |
| add-on, adobe, antivirus, application, avast!, bho, control center, drivers, e-mail, einschränkungen, excel, explorer, firefox, firewall, generic host, generic host process, google, hijack, hijackthis, hkus\s-1-5-18, internet, internet explorer, logfile, mozilla, mozilla firefox, realtek, rojaner gefunden, shortcut, skype.exe, software, starten, symantec, systray, trojaner, trojaner gefunden, usb, virus, webcheck, windows, windows xp |
Baum-Darstellung