Neuer PC - GDATA meldet Trojaner?

Julia R · 20.09.2008, 10:54

Hallo!

Ich habe seit einer Woche einen neuen PC.

Nach installieren von einigen Programmen hat erst der eingebaute windows defender eine dll im system32 ordner als infiziert gemeldet und jetzt spinnt GDATA auch rum.

Da vista, nachdem der windows defender die datei in quarantäne gesteckt hat, eine fehlermeldung alla "konnte .dll nicht laden" gebracht hat, hab ich die datei einfach mal wieder aus der quarantäne raus verschoben, da ich sonst überhaupt keine probleme mit meinem system habe.

Nach dem Ärger hab ich den windows defender ausgeschaltet (2 virenprogramme gleichzeitig ist ja auch nicht so sinnvoll

).

Gestern hat dann GDATA eine andere dll als befallen gemeldet. Daraufhin hab ich einen kompletten System Scan machen lassen.
Jetzt hat gdata aber noch weitere dlls gefunden und auch ein paar temp dateien.
Ich hab alle in die Quarantäne gesteckt, aber jetzt bringt windows beim system start wieder die fehlende .dll meldung....
hier mal die gefundenen dlls:

und hier der HijackThis log:

fett- erstmal die dll die geladen wird (und die fehlermeldung bringt!)
und zweitens bei 023 hab ich keine ahnung was das sein soll - es war zwar schon von anfang an da, aber ich weiß nicht was es macht

unterstrichen - wenn jemand weiß, wie man den extra ebay button wegbekommt, bitte bitte sagen! ich habs schon auf eigene Faust probiert, aber hat nicht so geklappt.... das gleiche gilt für den automatischen nvidia driver-scanner

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:15:46, on 20.09.2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\G DATA InternetSecurity\Firewall\GDFirewallTray.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\G DATA InternetSecurity\AVKTray\AVKTray.exe
C:\Program Files\Cyberlink\Shared files\brs.exe
C:\Program Files\HomeCinema\TV Enhance\TVEService.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\***\Downloads\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.de/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=C:\Windows\system32\userinit.exe,c:\program files\g data internetsecurity\avkkid\avkcks.exe
O1 - Hosts: ::1 localhost
O2 - BHO: G DATA WebFilter Class - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files\G DATA InternetSecurity\Webfilter\AVKWebIE.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {96083B3D-3729-4DE3-8E2B-7CE147780862} - C:\Windows\system32\geBuUmLd.dll
O3 - Toolbar: G DATA WebFilter - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files\G DATA InternetSecurity\Webfilter\AVKWebIE.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [GDFirewallTray] C:\Program Files\G DATA InternetSecurity\Firewall\GDFirewallTray.exe
O4 - HKLM\..\Run: [AVKTray] "C:\Program Files\G DATA InternetSecurity\AVKTray\AVKTray.exe"
O4 - HKLM\..\Run: [BDRegion] C:\Program Files\Cyberlink\Shared Files\brs.exe
O4 - HKLM\..\Run: [TVEService] "C:\Program Files\HomeCinema\TV Enhance\TVEService.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\fccbBQJc.dll,#1
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O4 - Global Startup: G DATA Firewall Tray.lnk = ?
O8 - Extra context menu item: Öffnen mit WordPerfect - C:\Program Files\WordPerfect Office X3\Programs\WPLauncher.hta
O9 - Extra button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - http://rover.ebay.com/rover/1/707-37276-17534-25/4 (file missing)
O9 - Extra 'Tools' menuitem: eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - http://rover.ebay.com/rover/1/707-37276-17534-25/4 (file missing)
O9 - Extra button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - http://rover.ebay.com/rover/1/707-37276-17534-15/4 (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - http://rover.ebay.com/rover/1/707-37276-17534-15/4 (file missing) (HKCU)
O13 - Gopher Prefix:
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: G DATA AntiVirus Proxy (AVKProxy) - G DATA Software AG - C:\Program Files\Common Files\G DATA\AVKProxy\AVKProxy.exe
O23 - Service: G DATA Scheduler (AVKService) - G DATA Software AG - C:\Program Files\G DATA InternetSecurity\AVK\AVKService.exe
O23 - Service: AntiVirus Wächter (AVKWCtl) - G DATA Software AG - C:\Program Files\G DATA InternetSecurity\AVK\AVKWCtl.exe
O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: G DATA Personal Firewall (GDFwSvc) - G DATA Software AG - C:\Program Files\G DATA InternetSecurity\Firewall\GDFwSvc.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\system32\IoctlSvc.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\Windows\system32\PSIService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\Cyberlink\Shared files\RichVideo.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe
O23 - Service: TVEnhance Background Capture Service (TBCS) (TVECapSvc) - Unknown owner - C:\Program Files\HomeCinema\TV Enhance\Kernel\TV\TVECapSvc.exe
O23 - Service: TVEnhance Task Scheduler (TTS)) (TVESched) - Unknown owner - C:\Program Files\HomeCinema\TV Enhance\Kernel\TV\TVESched.exe
O23 - Service: UPnPService - Magix AG - C:\Program Files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

--
End of file - 7606 bytes

Ich tippe im Moment stark auf Fehlmeldung, da ich ja überhaupt keine Probleme mit meinem System habe....

dankeschön!

cosinus · 20.09.2008, 11:07

Hallo

Da sind mit Sicherheit Schädlinge am Werkeln. Acker diese Punkte für weitere Analysen ab:

1.) Stell sicher, daß Dir auch alle Dateien angezeigt werden, danach folgende Dateien bei Virustotal.com auswerten lassen und alle Ergebnisse posten, und zwar so, daß man die der einzelnen Virenscanner sehen kann. Bitte mit Dateigrößen und Prüfsummen:

Code:

ATTFilter

C:\Windows\system32\geBuUmLd.dll
C:\Windows\system32\fccbBQJc.dll

2.) Deaktiviere die Systemwiederherstellung, im Verlauf der Infektion wurden auch Malwaredateien in Wiederherstellungspunkten mitgesichert - die sind alle nun unbrauchbar, da ein Zurücksetzen des System durch einen Wiederherstellungspunkt das System wahrscheinlich wieder infizieren würde.

3.) Führe dieses MBR-Tool aus und poste die Ausgabe

4.) Blacklight und Malwarebytes Antimalware ausführen und Logfiles posten

5.) Führe Silentrunners nach dieser Anleitung aus und poste das Logfile (mit Codetags umschlossen), falls es zu groß sein sollte kannst Du es (gezippt) bei file-upload.net hochladen und hier verlinken.

6.) ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir das Tool hier herunter auf den Desktop -> KLICK

Das Programm jedoch noch nicht starten sondern zuerst folgendes tun:

Schliesse alle Anwendungen und Programme, vor allem deine Antiviren-Software und andere Hintergrundwächter, sowie deinen Internetbrowser.
Vermeide es auch explizit während das Combofix läuft die Maus und Tastatur zu benutzen.

Dann folgende Anleitung durchlesen und abarbeiten -> CCleaner Systembereinigung

Starte nun die combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen und lass dein System durchsuchen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte abkopieren und in deinen Beitrag einfügen. Das log findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Hinweis: Combofix verhindert die Autostart Funktion aller CD / DVD und USB - Laufwerken um so eine Verbeitung einzudämmen. Wenn es hierdurch zu Problemen kommt, diese im Thread posten.

Poste alle Logfiles bitte mit Codetags umschlossen (#-Button) also so:

HTML-Code:

[code] Hier das Logfile rein! [/code]

7.) Mach auch ein Filelisting mit diesem script:

Script abspeichern per Rechtsklick, speichern unter auf dem Desktop
Doppelklick auf listing8.cmd auf dem Desktop
nach kurzer Zeit erscheint eine listing.txt auf dem Desktop

Diese listing.txt z.B. bei File-Upload.net hochladen und hier verlinken, da dieses Logfile zu groß fürs Board ist.

8.) Poste ein neues Hijackthis Logfile, nimm dazu diese umbenannte hijackthis.exe - editiere die Links und privaten Infos!!

Julia R · 20.09.2008, 14:04

Hallo!

Danke für die schnelle Antwort.
1. virustotal
geBuUmLd.dll :

Code:

ATTFilter

Antivirus     Version     letzte aktualisierung     Ergebnis
AhnLab-V3     2008.9.19.2     2008.09.19     -
AntiVir     7.8.1.34     2008.09.19     -
Authentium     5.1.0.4     2008.09.19     -
Avast     4.8.1195.0     2008.09.19     -
AVG     8.0.0.161     2008.09.19     Generic11.ABBJ
BitDefender     7.2     2008.09.19     -
CAT-QuickHeal     9.50     2008.09.20     -
ClamAV     0.93.1     2008.09.19     -
DrWeb     4.44.0.09170     2008.09.20     -
eSafe     7.0.17.0     2008.09.18     -
eTrust-Vet     31.6.6095     2008.09.19     Win32/VundoCryptorT!Generic
Ewido     4.0     2008.09.19     -
F-Prot     4.4.4.56     2008.09.19     -
F-Secure     8.0.14332.0     2008.09.20     -
Fortinet     3.113.0.0     2008.09.20     -
GData     19     2008.09.20     -
Ikarus     T3.1.1.34.0     2008.09.19     -
K7AntiVirus     7.10.464     2008.09.19     -
Kaspersky     7.0.0.125     2008.09.20     -
McAfee     5388     2008.09.19     -
Microsoft     1.3903     2008.09.20     Trojan:Win32/Vundo.AY
NOD32v2     3457     2008.09.19     -
Norman     5.80.02     2008.09.19     Vundo.gen281
Panda     9.0.0.4     2008.09.19     -
PCTools     4.4.2.0     2008.09.19     -
Prevx1     V2     2008.09.20     Fraudulent Security Program
Rising     20.62.52.00     2008.09.20     Packer.Win32.Agent.v
Sophos     4.33.0     2008.09.20     Troj/Virtum-Gen
Sunbelt     3.1.1651.1     2008.09.19     -
Symantec     10     2008.09.19     -
TheHacker     6.3.0.9.089     2008.09.20     -
TrendMicro     8.700.0.1004     2008.09.20     -
VBA32     3.12.8.5     2008.09.19     -
ViRobot     2008.9.20.1384     2008.09.20     -
VirusBuster     4.5.11.0     2008.09.19     -
Webwasher-Gateway     6.6.2     2008.09.19     Win32.Malware.gen (suspicious)

weitere Informationen
File size: 255488 bytes
MD5...: 95ae884f8517be3ae200685134ae8a15
SHA1..: 8b1b28af32ce4128833f138f08a9d54b36f4b5d9
SHA256: 223925b71cf1f6254bbb9632b6de5cae8289ecff0c15e7b3371dc098e77fd544
SHA512: c6a1d2f8464fbc0c2f440fc92560c6c078f7673a23e2902701cd6d67ee3545de
826581e417618526f73ea9b3cf7855017dcc8570e0589cbed764197322e70fb8
PEiD..: -
TrID..: File type identification
Win32 Executable Generic (38.4%)
Win32 Dynamic Link Library (generic) (34.2%)
Clipper DOS Executable (9.1%)
Generic Win/DOS Executable (9.0%)
DOS Executable Generic (9.0%)

Die andere dll weigert sich geöffnet zu werden Umbenennen, Dateiendung ändern und auf dem desktop kopieren hilft nicht weiter - was nun?

MBR sagt:

Code:

ATTFilter

Stealth MBR rootkit detector 0.2.4 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK

4. Blacklight &malwarebytes

BL findet nix
log:

Code:

ATTFilter

09/20/08 12:43:29 [Info]: BlackLight Engine 1.0.70 initialized
09/20/08 12:43:29 [Info]: OS: 6.0 build 6001 (Service Pack 1)
09/20/08 12:43:29 [Note]: 7019 4
09/20/08 12:43:29 [Note]: 7005 0
09/20/08 12:43:31 [Note]: 7006 0
09/20/08 12:43:31 [Note]: 7027 0
09/20/08 12:43:31 [Note]: 7035 0
09/20/08 12:43:31 [Note]: 7026 0
09/20/08 12:43:31 [Note]: 7026 0
09/20/08 12:43:34 [Note]: FSRAW library version 1.7.1024
09/20/08 12:43:39 [Note]: 4015 50226
09/20/08 12:43:39 [Note]: 4027 50226 262144
09/20/08 12:43:39 [Note]: 4020 50225 262144
09/20/08 12:43:39 [Note]: 4018 50225 262144
09/20/08 12:43:46 [Note]: 4015 74628
09/20/08 12:43:46 [Note]: 4027 74628 65536
09/20/08 12:43:46 [Note]: 4020 49222 458752
09/20/08 12:43:46 [Note]: 4018 49222 458752
09/20/08 12:43:47 [Note]: 4015 52400
09/20/08 12:43:47 [Note]: 4027 52400 9043968
09/20/08 12:43:47 [Note]: 4020 52058 655360
09/20/08 12:43:47 [Note]: 4018 52058 655360
09/20/08 12:43:51 [Note]: 4015 132861
09/20/08 12:43:51 [Note]: 4027 132861 196608
09/20/08 12:43:51 [Note]: 4020 62 65536
09/20/08 12:43:51 [Note]: 4018 62 65536
09/20/08 12:43:52 [Note]: 4015 52637
09/20/08 12:43:52 [Note]: 4027 52637 327680
09/20/08 12:43:52 [Note]: 4020 52626 327680
09/20/08 12:43:52 [Note]: 4018 52626 327680
09/20/08 12:43:52 [Note]: 4015 52633
09/20/08 12:43:52 [Note]: 4027 52633 327680
09/20/08 12:43:52 [Note]: 4020 52626 327680
09/20/08 12:43:52 [Note]: 4018 52626 327680
09/20/08 12:43:58 [Note]: 4015 1271
09/20/08 12:43:58 [Note]: 4027 1271 65536
09/20/08 12:43:58 [Note]: 4020 1268 65536
09/20/08 12:43:58 [Note]: 4018 1268 65536
09/20/08 12:44:00 [Note]: 4015 1443
09/20/08 12:44:00 [Note]: 4027 1443 65536
09/20/08 12:44:00 [Note]: 4020 558 65536
09/20/08 12:44:00 [Note]: 4018 558 65536
09/20/08 12:44:02 [Note]: 4015 1490
09/20/08 12:44:02 [Note]: 4027 1490 65536
09/20/08 12:44:02 [Note]: 4020 1443 65536
09/20/08 12:44:02 [Note]: 4018 1443 65536
09/20/08 12:44:03 [Note]: 4015 2138
09/20/08 12:44:03 [Note]: 4027 2138 65536
09/20/08 12:44:03 [Note]: 4020 1443 65536
09/20/08 12:44:03 [Note]: 4018 1443 65536
09/20/08 12:44:24 [Note]: 4015 2408
09/20/08 12:44:24 [Note]: 4027 2408 65536
09/20/08 12:44:24 [Note]: 4020 1443 65536
09/20/08 12:44:24 [Note]: 4018 1443 65536
09/20/08 12:45:35 [Note]: 7007 0

malwarebytes:

Code:

ATTFilter

Malwarebytes' Anti-Malware 1.28
Datenbank Version: 1180
Windows 6.0.6001 Service Pack 1

20.09.2008 14:23:40
mbam-log-2008-09-20 (14-23-40).txt

Scan-Methode: Vollständiger Scan (C:\|D:\|)
Durchsuchte Objekte: 165313
Laufzeit: 1 hour(s), 30 minute(s), 39 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 1
Infizierte Registrierungsschlüssel: 3
Infizierte Registrierungswerte: 2
Infizierte Dateiobjekte der Registrierung: 2
Infizierte Verzeichnisse: 0
Infizierte Dateien: 4

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
C:\Windows\System32\geBuUmLd.dll (Trojan.Vundo.H) -> Delete on reboot.

Infizierte Registrierungsschlüssel:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{75c638ae-ae7e-414a-98db-f7a74af4e5f4} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{75c638ae-ae7e-414a-98db-f7a74af4e5f4} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{09c72999-5c10-41a3-a524-24661d942003} (Trojan.Vundo) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{09c72999-5c10-41a3-a524-24661d942003} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msserver (Trojan.Vundo) -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\gebuumld -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\gebuumld  -> Delete on reboot.

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\Windows\System32\geBuUmLd.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\Windows\System32\dLmUuBeg.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\Windows\System32\dLmUuBeg.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\Windows\System32\fccbBQJc.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

5. silentrunners
http://www.file-upload.net/download-1124512/Startup-Programs--JULIASPCWEISS--2008-09-20-14.29.47.txt.html

6. combofix

ist das wirklich notwendig? trau mich nicht so recht das auszuprobieren....

7. anderes script:
http://www.file-upload.net/download-1124520/listing.txt.html

8. neuer hijack log:

Code:

ATTFilter

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:36:32, on 20.09.2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\G DATA InternetSecurity\Firewall\GDFirewallTray.exe
C:\Program Files\G DATA InternetSecurity\AVKTray\AVKTray.exe
C:\Program Files\Cyberlink\Shared files\brs.exe
C:\Program Files\HomeCinema\TV Enhance\TVEService.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Julia\Downloads\qlketzd.com

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.de/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=C:\Windows\system32\userinit.exe,c:\program files\g data internetsecurity\avkkid\avkcks.exe,
O1 - Hosts: ::1 localhost
O2 - BHO: {305ca88b-eabb-9c29-b744-deb4465324a8} - {8a423564-4bed-447b-92c9-bbaeb88ac503} - C:\Windows\system32\vxhzqw.dll
O3 - Toolbar: (no name) - {0124123D-61B4-456f-AF86-78C53A0790C5} - (no file)
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [GDFirewallTray] C:\Program Files\G DATA InternetSecurity\Firewall\GDFirewallTray.exe
O4 - HKLM\..\Run: [AVKTray] "C:\Program Files\G DATA InternetSecurity\AVKTray\AVKTray.exe"
O4 - HKLM\..\Run: [BDRegion] C:\Program Files\Cyberlink\Shared Files\brs.exe
O4 - HKLM\..\Run: [TVEService] "C:\Program Files\HomeCinema\TV Enhance\TVEService.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [BMe9168382] Rundll32.exe "C:\Windows\system32\wmhexjiu.dll",s
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O4 - Global Startup: G DATA Firewall Tray.lnk = ?
O8 - Extra context menu item: Öffnen mit WordPerfect - C:\Program Files\WordPerfect Office X3\Programs\WPLauncher.hta
O9 - Extra button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - http://rover.ebay.com/rover/1/707-37276-17534-25/4 (file missing)
O9 - Extra 'Tools' menuitem: eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - http://rover.ebay.com/rover/1/707-37276-17534-25/4 (file missing)
O9 - Extra button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - http://rover.ebay.com/rover/1/707-37276-17534-15/4 (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - http://rover.ebay.com/rover/1/707-37276-17534-15/4 (file missing) (HKCU)
O13 - Gopher Prefix:
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
O20 - AppInit_DLLs: vxhzqw.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: G DATA AntiVirus Proxy (AVKProxy) - G DATA Software AG - C:\Program Files\Common Files\G DATA\AVKProxy\AVKProxy.exe
O23 - Service: G DATA Scheduler (AVKService) - G DATA Software AG - C:\Program Files\G DATA InternetSecurity\AVK\AVKService.exe
O23 - Service: AntiVirus Wächter (AVKWCtl) - G DATA Software AG - C:\Program Files\G DATA InternetSecurity\AVK\AVKWCtl.exe
O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: G DATA Personal Firewall (GDFwSvc) - G DATA Software AG - C:\Program Files\G DATA InternetSecurity\Firewall\GDFwSvc.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\system32\IoctlSvc.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\Windows\system32\PSIService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\Cyberlink\Shared files\RichVideo.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe
O23 - Service: TVEnhance Background Capture Service (TBCS) (TVECapSvc) - Unknown owner - C:\Program Files\HomeCinema\TV Enhance\Kernel\TV\TVECapSvc.exe
O23 - Service: TVEnhance Task Scheduler (TTS)) (TVESched) - Unknown owner - C:\Program Files\HomeCinema\TV Enhance\Kernel\TV\TVESched.exe
O23 - Service: UPnPService - Magix AG - C:\Program Files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

--
End of file - 7385 bytes

bin ich jetzt trojaner frei?

cosinus · 21.09.2008, 13:31

Malwarefrei bist Du noch nicht. Combofix solltest Du noch ausführen, wenn Du Dich nach der Anleitung hälst kann eigentlich nix passieren.

Anleitung Avenger (by swandog46)

Lade dir das Tool Avenger und speichere es auf dem Desktop:

Doppelklick auf das Avenger-Symbol

Kopiere nun folgenden Text in das weiße Feld bei -> "input script here"

Code:

ATTFilter

registry values to delete:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run | BMe9168382

registry keys to delete:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8a423564-4bed-447b-92c9-bbaeb88ac503}

files to delete:
C:\Windows\system32\wmhexjiu.dll
C:\Windows\system32\vxhzqw.dll
C:\Windows\system32\geBuUmLd.dll
C:\Windows\system32\fccbBQJc.dll
C:\Windows\system32\flgrsikb.ini
C:\Windows\system32\bkisrglf.dll
C:\Windows\system32\hktdspre.dll
C:\Windows\system32\vxhzqw.dll
C:\Windows\system32\wmhexjiu.dll
C:\Windows\system32\e1067460-.txt
C:\Windows\system32\FNTCACHE.DAT
C:\Windows\system32\FfLSuutv.ini2
C:\Windows\system32\FfLSuutv.ini

Schliesse nun alle Programme und Browser-Fenster

Um den Avenger zu starten klicke auf -> Execute
Dann bestätigen mit "Yes" das der Rechner neu startet

Nachdem das System neu gestartet ist, findest du einen Report vom Avenger unter -> C:\avenger.txt

Öffne die Datei mit dem Editor und kopiere den gesamten Text in deinen Beitrag hier am Trojaner-Board.
Poste ein neues Hijackthis Logfile, nimm dazu diese umbenannte hijackthis.exe - editiere die Links und privaten Infos!!

Julia R · 22.09.2008, 21:12

Hi,

was macht denn das combofix teil denn genau? bzw. was kann passieren wenns schief läuft?

Hier der avenger txt:

Code:

ATTFilter

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform:  Windows Vista

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File "C:\Windows\system32\wmhexjiu.dll" deleted successfully.
File "C:\Windows\system32\vxhzqw.dll" deleted successfully.

Error:  file "C:\Windows\system32\geBuUmLd.dll" not found!
Deletion of file "C:\Windows\system32\geBuUmLd.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
  --> the object does not exist


Error:  file "C:\Windows\system32\fccbBQJc.dll" not found!
Deletion of file "C:\Windows\system32\fccbBQJc.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
  --> the object does not exist

File "C:\Windows\system32\flgrsikb.ini" deleted successfully.
File "C:\Windows\system32\bkisrglf.dll" deleted successfully.
File "C:\Windows\system32\hktdspre.dll" deleted successfully.

Error:  file "C:\Windows\system32\vxhzqw.dll" not found!
Deletion of file "C:\Windows\system32\vxhzqw.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
  --> the object does not exist


Error:  file "C:\Windows\system32\wmhexjiu.dll" not found!
Deletion of file "C:\Windows\system32\wmhexjiu.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
  --> the object does not exist

File "C:\Windows\system32\e1067460-.txt" deleted successfully.
File "C:\Windows\system32\FNTCACHE.DAT" deleted successfully.
File "C:\Windows\system32\FfLSuutv.ini2" deleted successfully.
File "C:\Windows\system32\FfLSuutv.ini" deleted successfully.
Registry value "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|BMe9168382" deleted successfully.
Registry key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8a423564-4bed-447b-92c9-bbaeb88ac503}" deleted successfully.

Completed script processing.

*******************

Finished!  Terminate.

neuer hijackthis:

Code:

ATTFilter

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:09:51, on 22.09.2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\conime.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\G DATA InternetSecurity\AVKTray\AVKTray.exe
C:\Program Files\Cyberlink\Shared files\brs.exe
C:\Program Files\HomeCinema\TV Enhance\TVEService.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\G DATA InternetSecurity\Firewall\GDFirewallTray.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\Taskmgr.exe
C:\Users\Julia\Downloads\qlketzd.com

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.de/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
F2 - REG:system.ini: UserInit=C:\Windows\system32\userinit.exe,c:\program files\g data internetsecurity\avkkid\avkcks.exe,
O1 - Hosts: ::1 localhost
O3 - Toolbar: (no name) - {0124123D-61B4-456f-AF86-78C53A0790C5} - (no file)
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [GDFirewallTray] C:\Program Files\G DATA InternetSecurity\Firewall\GDFirewallTray.exe
O4 - HKLM\..\Run: [AVKTray] "C:\Program Files\G DATA InternetSecurity\AVKTray\AVKTray.exe"
O4 - HKLM\..\Run: [BDRegion] C:\Program Files\Cyberlink\Shared Files\brs.exe
O4 - HKLM\..\Run: [TVEService] "C:\Program Files\HomeCinema\TV Enhance\TVEService.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [mindex32] rundll32.exe mindex32.dll,iquq
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O4 - Global Startup: G DATA Firewall Tray.lnk = ?
O8 - Extra context menu item: Öffnen mit WordPerfect - C:\Program Files\WordPerfect Office X3\Programs\WPLauncher.hta
O13 - Gopher Prefix: 
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
O20 - AppInit_DLLs: vxhzqw.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: G DATA AntiVirus Proxy (AVKProxy) - G DATA Software AG - C:\Program Files\Common Files\G DATA\AVKProxy\AVKProxy.exe
O23 - Service: G DATA Scheduler (AVKService) - G DATA Software AG - C:\Program Files\G DATA InternetSecurity\AVK\AVKService.exe
O23 - Service: AntiVirus Wächter (AVKWCtl) - G DATA Software AG - C:\Program Files\G DATA InternetSecurity\AVK\AVKWCtl.exe
O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: G DATA Personal Firewall (GDFwSvc) - G DATA Software AG - C:\Program Files\G DATA InternetSecurity\Firewall\GDFwSvc.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Microsoft Media Index (mindex32) - Unknown owner - rundll32.exe (file missing)
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\system32\IoctlSvc.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\Windows\system32\PSIService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\Cyberlink\Shared files\RichVideo.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe
O23 - Service: TVEnhance Background Capture Service (TBCS) (TVECapSvc) - Unknown owner - C:\Program Files\HomeCinema\TV Enhance\Kernel\TV\TVECapSvc.exe
O23 - Service: TVEnhance Task Scheduler (TTS)) (TVESched) - Unknown owner - C:\Program Files\HomeCinema\TV Enhance\Kernel\TV\TVESched.exe
O23 - Service: UPnPService - Magix AG - C:\Program Files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

--
End of file - 6688 bytes

immer noch was vorhanden? zur not würd ich doch noch vombofix in betracht ziehen :/

Julia R · 22.09.2008, 21:43

...hab jetzt doch combofix ausgeführt, hier das log file (zum glück nix passiert

)

Code:

ATTFilter

ComboFix 08-09-20.05 - Julia 2008-09-22 22:28:54.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium   6.0.6001.1.1252.1.1031.18.2075 [GMT 2:00]
ausgeführt von:: C:\Users\Julia\Desktop\ComboFix.exe
 * Neuer Wiederherstellungspunkt wurde erstellt
.

(((((((((((((((((((((((   Dateien erstellt von 2008-08-22 bis 2008-09-22  ))))))))))))))))))))))))))))))
.

2008-09-22 22:27 . 2008-09-22 22:28    <DIR>    d--------    C:\32788R22FWJFW
2008-09-21 15:28 . 2008-09-21 15:28    <DIR>    d--------    C:\Users\Julia\AppData\Roaming\Steganos
2008-09-21 15:22 . 2008-09-21 15:22    <DIR>    d--------    C:\Users\All Users\Brockhaus Multimedia
2008-09-21 15:22 . 2008-09-21 15:22    <DIR>    d--------    C:\ProgramData\Brockhaus Multimedia
2008-09-20 18:52 . 2008-09-20 18:53    <DIR>    d--------    C:\Users\Julia\AppData\Roaming\SPORE
2008-09-20 18:29 . 2008-09-20 18:29    <DIR>    d--------    C:\Program Files\7-Zip
2008-09-20 15:26 . 2008-09-20 15:26    69    --a------    C:\Windows\NeroDigital.ini
2008-09-20 12:41 . 2008-09-20 12:41    <DIR>    d--------    C:\Users\Julia\AppData\Roaming\Malwarebytes
2008-09-20 12:40 . 2008-09-20 12:40    <DIR>    d--------    C:\Users\All Users\Malwarebytes
2008-09-20 12:40 . 2008-09-20 12:40    <DIR>    d--------    C:\ProgramData\Malwarebytes
2008-09-19 15:17 . 2007-10-31 08:11    9,288    --a------    C:\Windows\System32\nvide.nvu
2008-09-19 15:14 . 2007-09-28 11:32    356,352    --a------    C:\Windows\System32\nvusmu.exe
2008-09-19 15:14 . 2007-11-17 16:22    3,636    --a------    C:\Windows\System32\drivers\nvphy.bin
2008-09-19 15:14 . 2007-09-12 14:14    659    --a------    C:\Windows\System32\nvsmu.nvu
2008-09-19 15:13 . 2007-05-18 15:43    356,352    --a------    C:\Windows\System32\nvusmb.exe
2008-09-19 15:13 . 2007-04-02 19:06    1,950    --a------    C:\Windows\System32\nvsmb.nvu
2008-09-19 15:12 . 2008-09-19 15:12    <DIR>    d--------    C:\Users\Julia\AppData\Roaming\InstallShield
2008-09-19 14:19 . 2008-05-16 14:01    1,079,840    --a------    C:\Windows\System32\nvcpluir.dll
2008-09-19 14:19 . 2008-05-16 14:01    768,544    --a------    C:\Windows\System32\nvcplui.exe
2008-09-19 14:19 . 2008-05-16 14:01    420,384    --a------    C:\Windows\System32\nvcpl.cpl
2008-09-19 14:19 . 2008-05-16 14:01    313,888    --a------    C:\Windows\System32\nvexpbar.dll
2008-09-19 14:15 . 2008-05-16 11:48    446,464    --a------    C:\Windows\System32\NVUNINST.EXE
2008-09-19 14:15 . 2008-06-11 14:48    188,960    --a------    C:\Windows\System32\nvapps.xml
2008-09-19 11:20 . 2008-09-19 11:20    <DIR>    d--------    C:\Users\Public\CyberLink
2008-09-18 22:35 . 2008-09-18 22:35    <DIR>    d--------    C:\Users\All Users\FLEXnet
2008-09-18 22:35 . 2008-09-18 22:35    <DIR>    d--------    C:\ProgramData\FLEXnet
2008-09-18 19:42 . 2008-09-18 19:42    <DIR>    d--------    C:\Program Files\Common Files\Macrovision Shared
2008-09-18 18:59 . 2008-09-18 18:59    <DIR>    d--------    C:\Program Files\Xilisoft
2008-09-18 18:44 . 2008-09-18 18:44    <DIR>    d--------    C:\Users\Julia\AppData\Roaming\TuneUp Software
2008-09-18 18:44 . 2008-09-18 18:44    <DIR>    d--------    C:\Users\All Users\TuneUp Software
2008-09-18 18:44 . 2008-09-18 18:44    <DIR>    d--------    C:\ProgramData\TuneUp Software
2008-09-18 18:44 . 2008-09-18 19:14    <DIR>    d--------    C:\Program Files\TuneUp Utilities 2008
2008-09-18 18:44 . 2008-09-18 18:44    <DIR>    d--------    C:\Program Files\Common Files\Wise Installation Wizard
2008-09-18 18:44 . 2008-09-18 18:44    355,584    --a------    C:\Windows\System32\TuneUpDefragService.exe
2008-09-18 18:44 . 2008-05-29 09:28    28,416    --a------    C:\Windows\System32\uxtuneup.dll
2008-09-18 18:44 . 2008-05-29 09:28    16,640    --a------    C:\Windows\System32\authuitu.dll
2008-09-18 18:09 . 2008-09-18 19:32    <DIR>    d--------    C:\Program Files\Trillian
2008-09-16 21:27 . 2008-09-16 21:27    <DIR>    d--------    C:\Users\All Users\Last.fm
2008-09-16 21:27 . 2008-09-16 21:27    <DIR>    d--------    C:\ProgramData\Last.fm
2008-09-16 21:08 . 2008-09-16 21:08    <DIR>    d--------    C:\Program Files\Last.fm
2008-09-16 13:19 . 2008-07-19 07:09    1,811,656    --a------    C:\Windows\System32\wuaueng.dll
2008-09-16 13:19 . 2008-07-19 05:44    1,524,736    --a------    C:\Windows\System32\wucltux.dll
2008-09-16 13:19 . 2008-07-19 07:10    53,448    --a------    C:\Windows\System32\wuauclt.exe
2008-09-16 13:19 . 2008-07-19 07:10    45,768    --a------    C:\Windows\System32\wups2.dll
2008-09-16 13:18 . 2008-07-19 07:09    563,912    --a------    C:\Windows\System32\wuapi.dll
2008-09-16 13:18 . 2008-07-18 22:08    163,904    --a------    C:\Windows\System32\wuwebv.dll
2008-09-16 13:18 . 2008-07-19 05:44    83,456    --a------    C:\Windows\System32\wudriver.dll
2008-09-16 13:18 . 2008-07-19 07:10    36,552    --a------    C:\Windows\System32\wups.dll
2008-09-16 13:18 . 2008-07-18 20:44    31,232    --a------    C:\Windows\System32\wuapp.exe
2008-09-14 19:28 . 2008-09-21 13:17    <DIR>    d--------    C:\Program Files\EA GAMES
2008-09-14 19:28 . 2004-08-18 10:34    442,368    -ra------    C:\Windows\System32\vp6vfw.dll
2008-09-14 19:23 . 2008-09-14 19:23    <DIR>    dr-------    C:\Windows\System32\config\systemprofile\Music
2008-09-14 18:56 . 2008-09-14 18:56    <DIR>    d--------    C:\Program Files\Alcohol Soft
2008-09-14 18:26 . 2008-09-14 18:26    <DIR>    d--------    C:\Program Files\SimPE
2008-09-14 17:55 . 2008-09-14 17:55    716,272    --a------    C:\Windows\System32\drivers\sptd.sys
2008-09-14 16:58 . 2008-09-14 16:58    <DIR>    d----c---    C:\Windows\System32\DRVSTORE
2008-09-14 16:58 . 2008-09-14 16:58    <DIR>    d--------    C:\Users\Julia\AppData\Roaming\Apple Computer
2008-09-14 16:58 . 2008-09-14 16:58    <DIR>    d--------    C:\Users\All Users\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-09-14 16:58 . 2008-09-14 16:58    <DIR>    d--------    C:\ProgramData\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-09-14 16:58 . 2008-09-16 21:27    <DIR>    d--------    C:\Program Files\iTunes
2008-09-14 16:58 . 2008-09-14 16:58    <DIR>    d--------    C:\Program Files\iPod
2008-09-14 16:58 . 2008-04-17 13:12    107,368    --a------    C:\Windows\System32\GEARAspi.dll
2008-09-14 16:58 . 2008-04-17 13:12    15,464    --a------    C:\Windows\System32\drivers\GEARAspiWDM.sys
2008-09-14 16:57 . 2008-09-14 16:57    <DIR>    d--------    C:\Program Files\Bonjour
2008-09-14 16:56 . 2008-09-16 23:50    <DIR>    d--------    C:\Users\All Users\Apple Computer
2008-09-14 16:56 . 2008-09-16 23:50    <DIR>    d--------    C:\ProgramData\Apple Computer
2008-09-14 16:56 . 2008-09-14 16:57    <DIR>    d--------    C:\Program Files\QuickTime
2008-09-14 16:54 . 2008-09-14 16:54    <DIR>    d--------    C:\Program Files\Apple Software Update
2008-09-14 16:53 . 2008-09-14 16:53    <DIR>    d--------    C:\Users\All Users\Apple
2008-09-14 16:53 . 2008-09-14 16:53    <DIR>    d--------    C:\ProgramData\Apple
2008-09-14 16:53 . 2008-09-14 16:56    <DIR>    d--------    C:\Program Files\Common Files\Apple
2008-09-14 16:23 . 2008-09-18 19:20    <DIR>    d--------    C:\Users\Julia\AppData\Roaming\Corel
2008-09-14 16:23 . 2008-09-15 17:19    952    --ahs----    C:\Windows\System32\KGyGaAvL.sys
2008-09-14 16:09 . 2008-09-14 16:09    <DIR>    d--------    C:\Users\Julia\AppData\Roaming\Nero
2008-09-14 16:03 . 2008-09-19 11:20    <DIR>    d--------    C:\Users\Julia\AppData\Roaming\CyberLink
2008-09-14 16:02 . 2008-09-14 16:02    <DIR>    d--------    C:\Users\All Users\X10 Settings
2008-09-14 16:02 . 2008-09-14 16:02    <DIR>    d--------    C:\ProgramData\X10 Settings
2008-09-14 15:40 . 2008-07-16 03:32    2,048    --a------    C:\Windows\System32\tzres.dll
2008-09-14 15:32 . 2008-07-31 03:13    4,240,384    --a------    C:\Windows\System32\GameUXLegacyGDFs.dll
2008-09-14 15:32 . 2008-07-31 05:32    28,160    --a------    C:\Windows\System32\Apphlpdm.dll
2008-09-14 15:30 . 2008-04-18 07:48    269,312    --a------    C:\Windows\System32\es.dll
2008-09-14 15:13 . 2008-09-14 15:13    <DIR>    d--hs----    C:\$RECYCLE.BIN
2008-09-14 15:12 . 2008-09-18 13:10    <DIR>    dr-------    C:\Users\***\Videos
2008-09-14 15:12 . 2008-09-14 15:12    <DIR>    dr-------    C:\Users\***\Searches
2008-09-14 15:12 . 2008-09-14 15:12    <DIR>    dr-------    C:\Users\***\Saved Games
2008-09-14 15:12 . 2008-09-19 12:08    <DIR>    dr-------    C:\Users\***\Pictures
2008-09-14 15:12 . 2008-09-16 23:45    <DIR>    dr-------    C:\Users\***\Music
2008-09-14 15:12 . 2008-09-14 15:12    <DIR>    dr-------    C:\Users\***\Links
2008-09-14 15:12 . 2008-09-22 22:09    <DIR>    dr-------    C:\Users\***\Downloads
2008-09-14 15:12 . 2008-09-21 13:09    <DIR>    dr-------    C:\Users\*\Documents
2008-09-14 15:12 . 2008-09-15 17:57    <DIR>    dr-------    C:\Users\*\Contacts
2008-09-14 15:12 . 2006-11-02 14:37    <DIR>    d--------    C:\Users\*\AppData\Roaming\Media Center Programs
2008-09-14 15:12 . 2008-09-14 15:12    <DIR>    d--h-----    C:\Users\*\AppData
2008-09-14 15:12 . 2008-09-19 15:16    <DIR>    d--------    C:\Users\*
2008-09-14 15:09 . 2008-09-14 15:09    <DIR>    dr-------    C:\Windows\System32\config\systemprofile\Contacts
2008-09-14 15:05 . 2008-09-14 15:05    <DIR>    d--h-----    C:\Users\All Users\CanonBJ
2008-09-14 15:05 . 2008-09-14 15:05    <DIR>    d--h-----    C:\ProgramData\CanonBJ
2008-09-14 15:04 . 2008-09-22 21:56    12    --a------    C:\Windows\bthservsdp.dat
2008-09-10 16:45 . 2008-09-10 16:45    32,000    --a------    C:\Windows\System32\drivers\usbaapl.sys
2008-09-06 15:09 . 2008-09-06 15:09    90,112    --a------    C:\Windows\System32\QuickTimeVR.qtx
2008-09-06 15:09 . 2008-09-06 15:09    57,344    --a------    C:\Windows\System32\QuickTime.qts
2008-08-29 10:18 . 2008-08-29 10:18    87,336    --a------    C:\Windows\System32\dns-sd.exe
2008-08-29 09:53 . 2008-08-29 09:53    61,440    --a------    C:\Windows\System32\dnssd.dll

.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-20 16:36    ---------    d--h--w    C:\Program Files\InstallShield Installation Information
2008-09-19 13:19    ---------    d-----w    C:\ProgramData\NVIDIA
2008-09-19 09:28    ---------    d-----w    C:\ProgramData\Cyberlink
2008-09-18 17:48    ---------    d-----w    C:\Program Files\Common Files\Adobe
2008-09-17 15:51    ---------    d-----w    C:\Program Files\Google
2008-09-14 13:55    ---------    d-----w    C:\Program Files\MAGIX
2008-09-14 13:39    ---------    d-----w    C:\Program Files\Windows Mail
2008-09-14 13:27    ---------    d-----w    C:\ProgramData\MAGIX
2008-09-14 13:23    ---------    d-----w    C:\Program Files\Common Files\Corel
2008-09-14 13:09    ---------    d-sh--w    C:\ProgramData\Vorlagen
2008-09-14 13:09    ---------    d-sh--w    C:\ProgramData\Startmenü
2008-09-14 13:09    ---------    d-sh--w    C:\ProgramData\Favoriten
2008-09-14 13:09    ---------    d-sh--w    C:\ProgramData\Dokumente
2008-09-14 13:09    ---------    d-sh--w    C:\ProgramData\Anwendungsdaten
2008-09-14 13:09    ---------    d-sh--w    C:\Program Files\Gemeinsame Dateien
2008-09-14 13:05    ---------    d-----w    C:\ProgramData\G DATA
2008-08-02 03:26    36,864    ----a-w    C:\Windows\System32\cdd.dll
2008-08-02 01:01    625,152    ----a-w    C:\Windows\system32\drivers\dxgkrnl.sys
2008-07-31 03:32    460,288    ----a-w    C:\Windows\AppPatch\AcSpecfc.dll
2008-07-31 03:32    2,154,496    ----a-w    C:\Windows\AppPatch\AcGenral.dll
2008-07-31 03:32    173,056    ----a-w    C:\Windows\AppPatch\AcXtrnal.dll
2008-07-23 23:22    ---------    d-----w    C:\Program Files\Windows Photo Gallery
2008-07-23 23:22    ---------    d-----w    C:\Program Files\Windows Journal
2008-07-23 23:22    ---------    d-----w    C:\Program Files\Windows Defender
2008-07-23 23:22    ---------    d-----w    C:\Program Files\Windows Collaboration
2008-07-23 23:22    ---------    d-----w    C:\Program Files\Windows Calendar
2008-07-23 16:44    ---------    d-----w    C:\Program Files\Microsoft Silverlight
2008-07-23 16:43    ---------    d-----w    C:\Program Files\MSXML 4.0
2008-07-23 16:24    ---------    d-----w    C:\Program Files\HomeCinema
2008-07-23 16:11    ---------    d-----w    C:\Program Files\Cyberlink
2008-07-23 16:11    ---------    d-----w    C:\Program Files\Common Files\InstallShield
2008-07-23 16:02    ---------    d-----w    C:\Program Files\Common Files\MAGIX Shared
2008-07-23 16:00    ---------    d-----w    C:\ProgramData\Corel
2008-07-23 15:56    ---------    d-----w    C:\Program Files\Brockhaus Multimedia
2008-07-23 15:54    ---------    d-----w    C:\ProgramData\Borland
2008-07-23 15:54    ---------    d-----w    C:\Program Files\WordPerfect Office X3
2008-07-23 15:54    ---------    d-----w    C:\Program Files\Common Files\Borland Shared
2008-07-23 15:50    ---------    d-----w    C:\Program Files\NeroInstall.bak
2008-07-23 15:48    ---------    d-----w    C:\ProgramData\Nero
2008-07-23 15:48    ---------    d-----w    C:\Program Files\Common Files\Nero
2008-07-23 15:24    ---------    d-----w    C:\Program Files\Nero
2008-07-23 15:19    42,952    ----a-w    C:\Windows\system32\drivers\PktIcpt.sys
2008-07-23 15:18    46,536    ----a-w    C:\Windows\system32\drivers\MiniIcpt.sys
2008-07-23 15:18    32,200    ----a-w    C:\Windows\system32\drivers\HookCentre.sys
2008-07-23 15:17    41,928    ----a-w    C:\Windows\system32\drivers\GDTdiIcpt.sys
2008-07-23 15:17    ---------    d-----w    C:\Program Files\G DATA InternetSecurity
2008-07-23 15:17    ---------    d-----w    C:\Program Files\Common Files\G DATA
2008-07-23 15:13    ---------    d-----w    C:\Program Files\Windows Sidebar
2008-07-23 14:57    ---------    d-----w    C:\Program Files\X10 Hardware
2008-07-23 14:56    ---------    d-----w    C:\Program Files\Common Files\X10
2008-07-23 14:52    319,456    ----a-w    C:\Windows\DIFxAPI.dll
2008-07-23 14:52    315,392    ----a-w    C:\Windows\HideWin.exe
2008-07-23 14:52    ---------    d-----w    C:\Program Files\Realtek
2008-07-23 13:26    0    ---ha-w    C:\Windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2008-06-27 04:15    827,392    ----a-w    C:\Windows\System32\wininet.dll
2008-06-26 03:29    801,280    ----a-w    C:\Windows\System32\NaturalLanguage6.dll
2008-06-26 03:29    565,248    ----a-w    C:\Windows\System32\emdmgmt.dll
2008-06-26 03:29    45,056    ----a-w    C:\Windows\System32\dataclen.dll
2008-06-26 03:29    303,616    ----a-w    C:\Windows\System32\wmpeffects.dll
2008-06-26 01:45    2,644,480    ----a-w    C:\Windows\System32\NlsLexicons0009.dll
2008-06-26 01:45    12,240,896    ----a-w    C:\Windows\System32\NlsLexicons0007.dll
2008-06-24 07:05    643,072    ----a-w    C:\Windows\System32\autochk.exe
2008-06-24 07:05    323,584    ----a-w    C:\Windows\System32\untfs.dll
2008-06-24 07:04    485,888    ----a-w    C:\Windows\System32\evr.dll
2008-06-24 07:04    181,760    ----a-w    C:\Windows\System32\fsquirt.exe
2008-06-24 07:04    1,314,816    ----a-w    C:\Windows\System32\quartz.dll
2008-06-24 07:01    428,544    ----a-w    C:\Windows\System32\EncDec.dll
2008-06-24 07:01    293,376    ----a-w    C:\Windows\System32\psisdecd.dll
2008-06-24 07:00    295,936    ----a-w    C:\Windows\System32\gdi32.dll
2008-06-24 06:50    2,560    ----a-w    C:\Windows\AppPatch\AcRes.dll
2008-06-24 06:50    1,695,744    ----a-w    C:\Windows\System32\gameux.dll
2008-01-21 02:43    174    --sha-w    C:\Program Files\desktop.ini
.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-21 125952]
"WindowsWelcomeCenter"="oobefldr.dll" [2008-01-21 C:\Windows\System32\oobefldr.dll]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"GDFirewallTray"="C:\Program Files\G DATA InternetSecurity\Firewall\GDFirewallTray.exe" [2008-02-07 1193648]
"AVKTray"="C:\Program Files\G DATA InternetSecurity\AVKTray\AVKTray.exe" [2008-02-11 603720]
"BDRegion"="C:\Program Files\Cyberlink\Shared Files\brs.exe" [2008-06-12 91432]
"TVEService"="C:\Program Files\HomeCinema\TV Enhance\TVEService.exe" [2007-10-19 155648]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-09-06 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-09-10 289576]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2008-05-16 13535776]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2008-05-16 92704]
"RtHDVCpl"="RtHDVCpl.exe" [2008-03-26 C:\Windows\RtHDVCpl.exe]
"mindex32"="mindex32.dll" [2004-09-21 C:\Windows\System32\mindex32.dll]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
G DATA Firewall Tray.lnk - C:\Program Files\G DATA InternetSecurity\Firewall\GDFirewallTray.exe [2008-07-23 1193648]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=vxhzqw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3codecp"= l3codecp.acm

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"PlayMovie"="C:\Program Files\HomeCinema\PlayMovie\PMVService.exe"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{E4E67EEB-68E0-4DC3-BC10-85634B16C786}"= C:\Program Files\HomeCinema\PowerDVD\PowerDVD.EXE:CyberLink PowerDVD
"{FE161D6B-4397-4558-96F2-B86411C93D48}"= C:\Program Files\HomeCinema\PlayMovie\PlayMovie.exe:CyberLink PlayMovie
"{DA109F41-CA79-47EE-9614-23DD04D1B551}"= C:\Program Files\HomeCinema\PlayMovie\PMVService.exe:CyberLink PlayMovie Resident Program
"{81E39639-0715-4A62-BBFF-82E61C82145C}"= C:\Program Files\HomeCinema\MakeDisc\MakeDisc.exe:CyberLink MakeDisc
"{9055A5F9-652E-4A36-8439-38168A1430F7}"= C:\Program Files\HomeCinema\TV Enhance\TVEnhance.exe:CyberLink TVEnhance
"{082D3426-F6A4-4B2B-BE82-815768022724}"= C:\Program Files\HomeCinema\TV Enhance\TVEService.exe:CyberLink TVEnhance Resident Program
"{2C82C071-CA6F-4700-A7D5-40E5EA35D277}"= UDP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{751F59B3-96CE-4629-936D-7DA5C5766487}"= TCP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{19037D1C-7E28-4B87-86E5-CBF5DBAD4ACB}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{830BC046-E4B2-4CFF-9E37-FC5751CD16F4}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

R1 gdwfpcd;G DATA WFP CD;C:\Windows\system32\DRIVERS\gdwfpcd32.sys [2008-02-14 39880]
R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796};C:\Program Files\HomeCinema\PlayMovie\000.fcl [2008-06-17 21:05 61424]
R2 {95808DC4-FA4A-4C74-92FE-5B863F82066B};{95808DC4-FA4A-4C74-92FE-5B863F82066B};C:\Program Files\HomeCinema\PowerDVD\000.fcl [2008-06-18 15:59 61424]
R2 AVKProxy;G DATA AntiVirus Proxy;C:\Program Files\Common Files\G DATA\AVKProxy\AVKProxy.exe [2008-02-19 718408]
R2 AVKService;G DATA Scheduler;C:\Program Files\G DATA InternetSecurity\AVK\AVKService.exe [2008-02-07 427592]
R2 AVKWCtl;AntiVirus Wächter;C:\Program Files\G DATA InternetSecurity\AVK\AVKWCtl.exe [2008-02-05 1127816]
R2 GDTdiInterceptor;GDTdiInterceptor;C:\Windows\system32\drivers\GDTdiIcpt.sys [2008-07-23 41928]
R2 TVECapSvc;TVEnhance Background Capture Service (TBCS);C:\Program Files\HomeCinema\TV Enhance\Kernel\TV\TVECapSvc.exe [2007-10-19 290909]
R2 TVESched;TVEnhance Task Scheduler (TTS));C:\Program Files\HomeCinema\TV Enhance\Kernel\TV\TVESched.exe [2007-10-19 114779]
R2 UxTuneUp;TuneUp Designerweiterung;C:\Windows\System32\svchost.exe [2008-01-21 21504]
R3 GDFwSvc;G DATA Personal Firewall;C:\Program Files\G DATA InternetSecurity\Firewall\GDFwSvc.exe [2007-12-12 1496648]
R3 GDMnIcpt;GDMnIcpt;C:\Windows\system32\drivers\MiniIcpt.sys [2008-07-23 46536]
R3 GDPkIcpt;GDPkIcpt;C:\Windows\system32\drivers\PktIcpt.sys [2008-07-23 42952]
R3 HookCentre;HookCentre;C:\Windows\system32\drivers\HookCentre.sys [2008-07-23 32200]
R3 netr28u;RT2870 USB Wireless LAN Card Driver for Vista;C:\Windows\system32\DRIVERS\netr28u.sys [2007-09-21 554496]
R3 PhilCap;Pinnacle PCTV service;C:\Windows\system32\DRIVERS\PhilCap.sys [2007-07-30 908832]
R3 X10Hid;X10 Hid Device;C:\Windows\system32\Drivers\x10hid.sys [2006-11-17 13976]
S2 mindex32;Microsoft Media Index;rundll32.exe C:\Windows\system32\mindex32.dll,iquq [ ]
S3 TuneUp.Defrag;TuneUp Drive Defrag-Dienst;C:\Windows\System32\TuneUpDefragService.exe [2008-09-18 355584]
S3 UPnPService;UPnPService;C:\Program Files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe [2006-12-14 544768]
S4 ErrDev;Microsoft Hardware Error Device Driver;C:\Windows\system32\drivers\errdev.sys [2008-01-21 6656]
S4 MegaSR;MegaSR;C:\Windows\system32\drivers\megasr.sys [2008-01-21 386616]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs    REG_MULTI_SZ       BthServ

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp

*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
.
Inhalt des "geplante Tasks" Ordners
.
.
------- Zusätzlicher Suchlauf -------
.
FireFox -: Profile - C:\Users\Julia\AppData\Roaming\Mozilla\Firefox\Profiles\oiy2i26j.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://google.de/
FF -: plugin - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-22 22:35:29
Windows 6.0.6001 Service Pack 1 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
Zeit der Fertigstellung: 2008-09-22 22:36:40
ComboFix-quarantined-files.txt  2008-09-22 20:36:37

Vor Suchlauf: 8 Verzeichnis(se), 868.561.485.824 Bytes frei
Nach Suchlauf: 15 Verzeichnis(se), 868,542,197,760 Bytes frei

295    --- E O F ---    2008-09-17 19:17:54

Julia R · 22.09.2008, 21:47

neue hijack this (alte rpost war zu lang)

neue hijack:

Code:

ATTFilter

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:45:17, on 22.09.2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\G DATA InternetSecurity\Firewall\GDFirewallTray.exe
C:\Program Files\G DATA InternetSecurity\AVKTray\AVKTray.exe
C:\Program Files\Cyberlink\Shared files\brs.exe
C:\Program Files\HomeCinema\TV Enhance\TVEService.exe
C:\Windows\System32\mobsync.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\System32\rundll32.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\conime.exe
C:\Windows\Explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\Julia\Downloads\qlketzd.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O1 - Hosts: ::1 localhost
O3 - Toolbar: (no name) - {0124123D-61B4-456f-AF86-78C53A0790C5} - (no file)
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [GDFirewallTray] C:\Program Files\G DATA InternetSecurity\Firewall\GDFirewallTray.exe
O4 - HKLM\..\Run: [AVKTray] "C:\Program Files\G DATA InternetSecurity\AVKTray\AVKTray.exe"
O4 - HKLM\..\Run: [BDRegion] C:\Program Files\Cyberlink\Shared Files\brs.exe
O4 - HKLM\..\Run: [TVEService] "C:\Program Files\HomeCinema\TV Enhance\TVEService.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [mindex32] rundll32.exe mindex32.dll,iquq
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O4 - Global Startup: G DATA Firewall Tray.lnk = ?
O8 - Extra context menu item: Öffnen mit WordPerfect - C:\Program Files\WordPerfect Office X3\Programs\WPLauncher.hta
O13 - Gopher Prefix: 
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
O20 - AppInit_DLLs: vxhzqw.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: G DATA AntiVirus Proxy (AVKProxy) - G DATA Software AG - C:\Program Files\Common Files\G DATA\AVKProxy\AVKProxy.exe
O23 - Service: G DATA Scheduler (AVKService) - G DATA Software AG - C:\Program Files\G DATA InternetSecurity\AVK\AVKService.exe
O23 - Service: AntiVirus Wächter (AVKWCtl) - G DATA Software AG - C:\Program Files\G DATA InternetSecurity\AVK\AVKWCtl.exe
O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: G DATA Personal Firewall (GDFwSvc) - G DATA Software AG - C:\Program Files\G DATA InternetSecurity\Firewall\GDFwSvc.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Microsoft Media Index (mindex32) - Unknown owner - rundll32.exe (file missing)
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\system32\IoctlSvc.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\Windows\system32\PSIService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\Cyberlink\Shared files\RichVideo.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe
O23 - Service: TVEnhance Background Capture Service (TBCS) (TVECapSvc) - Unknown owner - C:\Program Files\HomeCinema\TV Enhance\Kernel\TV\TVECapSvc.exe
O23 - Service: TVEnhance Task Scheduler (TTS)) (TVESched) - Unknown owner - C:\Program Files\HomeCinema\TV Enhance\Kernel\TV\TVESched.exe
O23 - Service: UPnPService - Magix AG - C:\Program Files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

--
End of file - 6114 bytes

cosinus · 23.09.2008, 18:39

Code:

ATTFilter

C:\32788R22FWJFW

Was ist das für ein Ordner?

Code:

ATTFilter

O4 - HKLM\..\Run: [mindex32] rundll32.exe mindex32.dll,iquq
O20 - AppInit_DLLs: vxhzqw.dll
O23 - Service: Microsoft Media Index (mindex32) - Unknown owner - rundll32.exe (file missing)

Mit HijackThis fixen!

Julia R · 23.09.2008, 18:55

Hi,

Keine Ahnung, der ist aber schon im Papierkorb gelandet - war komplett leer, ich vermute war ein Überbleibsel von meiner treiberupdate-aktion für die graka.

den rest hab ich gerade gefixt, danke!

23.09.2008, 18:39	#8
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Neuer PC - GDATA meldet Trojaner? Code: ATTFilter C:\32788R22FWJFW Was ist das für ein Ordner? Code: ATTFilter O4 - HKLM\..\Run: [mindex32] rundll32.exe mindex32.dll,iquq O20 - AppInit_DLLs: vxhzqw.dll O23 - Service: Microsoft Media Index (mindex32) - Unknown owner - rundll32.exe (file missing) Mit HijackThis fixen! __________________ Logfiles bitte immer in CODE-Tags posten

Neuer PC - GDATA meldet Trojaner?

Log-Analyse und Auswertung: Neuer PC - GDATA meldet Trojaner?