Erstmal gleich sorry, dass ich euch mit sowas belästige. Ich weis, "kann schon mal passieren", nur das es mir passiert ärgert und schmerzt am meisten, aber egal. Die rumpelstilzchen-phase hab ich gerade im garten hinter mich gebracht (sorry an die nachbarn!), und jetzt poste ich gleich mal, was in anderen threads zB. von myrtille bereits gefordert wurde:

Malwarebytes' Anti-Malware 1.28
Datenbank Version: 1221
Windows 5.1.2600 Service Pack 2

29.09.2008 15:59:27
mbam-log-2008-09-29 (15-59-27).txt

Scan-Methode: Vollständiger Scan (C:\|D:\|)
Durchsuchte Objekte: 219796
Laufzeit: 1 hour(s), 20 minute(s), 10 second(s)

Infizierte Speicherprozesse: 7
Infizierte Speichermodule: 3
Infizierte Registrierungsschlüssel: 16
Infizierte Registrierungswerte: 21
Infizierte Dateiobjekte der Registrierung: 2
Infizierte Verzeichnisse: 2
Infizierte Dateien: 42

Infizierte Speicherprozesse:
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\uvapibut\udklcxwj.exe (Trojan.Downloader) -> Unloaded process successfully.
C:\Programme\PCHealthCenter\1.exe (Trojan.Fakealert) -> Unloaded process successfully.
C:\Programme\PCHealthCenter\2.exe (Trojan.Fakealert) -> Unloaded process successfully.
C:\Programme\PCHealthCenter\3.exe (Trojan.Fakealert) -> Unloaded process successfully.
C:\Programme\PCHealthCenter\4.exe (Trojan.Fakealert) -> Unloaded process successfully.
C:\Programme\PCHealthCenter\7.exe (Trojan.Fakealert) -> Unloaded process successfully.
C:\Programme\MicroAV\MicroAV.exe (Rogue.MicroAntivirus) -> Unloaded process successfully.

Infizierte Speichermodule:
C:\WINDOWS\system32\khfGVlJd.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\hGvutrpo.dll (Trojan.Vundo) -> Delete on reboot.
C:\Programme\ICQToolbar\toolbaru.dll (Adware.BHO) -> Delete on reboot.

Infizierte Registrierungsschlüssel:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{f2cce6cd-ff43-4157-ae2a-a0ddf79c673f} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{f2cce6cd-ff43-4157-ae2a-a0ddf79c673f} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{5E549732-E106-9A48-C292-04F4103235C7} (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{9e49f5a8-060f-40a6-b3ff-314d147adbd9} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\hgvutrpo (Trojan.Vundo) -> Delete on reboot.
HKEY_CLASSES_ROOT\toolband.xttbpos00 (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{77d6ddfa-7834-4541-b2b3-a8b0fb0e3924} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{055fd26d-3a88-4e15-963d-dc8493744b1d} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{055fd26d-3a88-4e15-963d-dc8493744b1d} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{4bd2d6c3-31dc-b947-23d0-dc52ec4f0c4c} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{855f3b16-6d32-4fe6-8a56-bbb695989046} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\toolband.xttbpos00.1 (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\wkey (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\MicroAV (Rogue.MicroAntivirus) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\sysweb (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qi1tc4nduo (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{9e49f5a8-060f-40a6-b3ff-314d147adbd9} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{855f3b16-6d32-4fe6-8a56-bbb695989046} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\{855f3b16-6d32-4fe6-8a56-bbb695989046} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{855f3b16-6d32-4fe6-8a56-bbb695989046} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\{855f3b16-6d32-4fe6-8a56-bbb695989046} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\antivirus (Rogue.MicroAntivirus) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\antivirus (Rogue.MicroAntivirus) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur13.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur14.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur15.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur16.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur53.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur59.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur13.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur14.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur15.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur16.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur53.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur59.exe (Trojan.Agent) -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\khfgvljd -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\khfgvljd -> Delete on reboot.

Infizierte Verzeichnisse:
C:\Programme\PCHealthCenter (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Programme\MicroAV (Rogue.MicroAntivirus) -> Quarantined and deleted successfully.

Infizierte Dateien:
C:\WINDOWS\system32\khfGVlJd.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\dJlVGfhk.ini (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\dJlVGfhk.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\Programme\wolqmed\SysWeb.dll (Trojan.FakeAlert.H) -> Delete on reboot.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\uvapibut\udklcxwj.exe (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\hGvutrpo.dll (Trojan.Vundo) -> Delete on reboot.
C:\Programme\ICQToolbar\toolbaru.dll (Adware.BHO) -> Delete on reboot.
C:\Dokumente und Einstellungen\user\Lokale Einstellungen\Temporary Internet Files\Content.IE5\DHPHE9XI\wEvkx1zFE1[1].exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\user\Lokale Einstellungen\Temporary Internet Files\Content.IE5\DHPHE9XI\CAC9I7GT (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\user\Lokale Einstellungen\Temporary Internet Files\Content.IE5\DHPHE9XI\file[1].exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\sSMddATk.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Programme\PCHealthCenter\0.exe (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Programme\PCHealthCenter\0.gif (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Programme\PCHealthCenter\1.exe (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Programme\PCHealthCenter\1.gif (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Programme\PCHealthCenter\1.ico (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Programme\PCHealthCenter\2.exe (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Programme\PCHealthCenter\2.gif (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Programme\PCHealthCenter\2.ico (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Programme\PCHealthCenter\3.exe (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Programme\PCHealthCenter\3.gif (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Programme\PCHealthCenter\4.exe (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Programme\PCHealthCenter\5.exe (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Programme\PCHealthCenter\7.exe (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Programme\PCHealthCenter\sc.html (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Programme\MicroAV\MicroAV.cpl (Rogue.MicroAntivirus) -> Quarantined and deleted successfully.
C:\Programme\MicroAV\MicroAV.exe (Rogue.MicroAntivirus) -> Quarantined and deleted successfully.
C:\Programme\MicroAV\MicroAV.ooo (Rogue.MicroAntivirus) -> Quarantined and deleted successfully.
C:\Programme\MicroAV\MicroAV0.dat (Rogue.MicroAntivirus) -> Quarantined and deleted successfully.
C:\Programme\MicroAV\MicroAV1.dat (Rogue.MicroAntivirus) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\1.ico (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\2.ico (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\YUR13.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\YUR14.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\YUR15.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\YUR16.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\YUR53.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\YUR59.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\x (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\MicroAV.cpl (Rogue.MicroAntivirus) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\user\Desktop\Micro Antivirus 2009.lnk (Rogue.XPertAntivirus) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\user\Lokale Einstellungen\Temp\lwpwer.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.


Einträge habe ich auch schon gelöscht, mit dem ergebnis, dass schon mal das nervige popup verschwunden ist. Hier folgt das RSIT info file:


http://www.file-upload.net/download-.../info.txt.html


und noch das log:


http://www.file-upload.net/download-...0/log.txt.html


Bitte um eure hilfe, wies weitergehn soll, danke! =(

Hi,

Anleitung Avenger (by swandog46) Lade dir das Tool Avenger und speichere es auf dem Desktop:

• Doppelklick auf das Avenger-Symbol

• Kopiere nun folgenden Text in das weiße Feld bei -> "input script here"

 
files to delete:
C:\WINDOWS\system32\hGvutrpo.dll
C:\WINDOWS\system32\5f864a21-.txt
C:\WINDOWS\system32\dJlVGfhk.ini
C:\WINDOWS\system32\khfGVlJd.dll
folders to delete:
C:\Programme\wolqmed
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\uvapibut
         

• Schliesse nun alle Programme und Browser-Fenster

• Um den Avenger zu starten klicke auf -> Execute
• Dann bestätigen mit "Yes" das der Rechner neu startet

• Nachdem das System neu gestartet ist, findest du einen Report vom Avenger unter -> C:\avenger.txt

• Öffne die Datei mit dem Editor und kopiere den gesamten Text in deinen Beitrag hier am Trojaner-Board.

Ruf HijackThis auf und fixe folgende Einträge:

R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {F2CCE6CD-FF43-4157-AE2A-A0DDF79C673F} - C:\WINDOWS\system32\khfGVlJd.dll
O20 - Winlogon Notify: hGvutrpo - C:\WINDOWS\SYSTEM32\hGvutrpo.dll

Poste anschließend nochmal eine neue log.txt von RSIT.

lg myrtille

Danke erstmal!

Hier das Avanger file:

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!


Error: file "C:\WINDOWS\system32\hGvutrpo.dll" not found!
Deletion of file "C:\WINDOWS\system32\hGvutrpo.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist

File "C:\WINDOWS\system32\5f864a21-.txt" deleted successfully.

Error: file "C:\WINDOWS\system32\dJlVGfhk.ini" not found!
Deletion of file "C:\WINDOWS\system32\dJlVGfhk.ini" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "C:\WINDOWS\system32\khfGVlJd.dll" not found!
Deletion of file "C:\WINDOWS\system32\khfGVlJd.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist

Folder "C:\Programme\wolqmed" deleted successfully.
Folder "C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\uvapibut" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.


Hab dann das mit Hijack gelöscht, was du gepostet hast, bis auf den eintrag
O20 - Winlogon Notify: hGvutrpo - C:\WINDOWS\SYSTEM32\hGvutrpo.dll

den gabs nicht mehr.

Und zum abschluss nochmal das log:

http://www.file-upload.net/download-1146592/log2.txt.html

Hi,

Jetzt hast du mich doch kurz zum stutzen gebracht.
Es scheint aber alles seine Richtigkeit zu haben.

Wie gehts dem Rechner. Kannst du mir etwas zu diesem geplanten Task sagen:

C:\WINDOWS\tasks\WebReg 20080424174957.job

Weißt du wozu die Datei gehört?

lg myrtille

puh na sorry, wüsste net das ich einen geplanten task hätte, zumindest keinen aktiven ... kann das was vaio seitiges sein?

Hi,

das kann durchaus sein, google sagt das es nicht böse ist.
Ich wollt nur mal gefragt haben.

Wie gehts dem Rechner?

lg myrtille

also ich merke nix mehr, scheint wieder alles im grünen zu sein

vielen dank, hast mir sehr geholfen!

Hi,
RSIT und Avenger kannst du einfach löschen.
Malwarebytes würde ich empfehlen zu behalten und gelegentlich mit zu scannen.
Besuche vielleicht noch Secunia und überprüfe bitte ob deine Software aktuell ist. (Dazu wird Java benötigt)
Wenn du all diese Schritte durchgeführt hast, und keine Probleme aufgetreten sind, dann kannst du noch die Systemwiederherstellung de- und reaktivieren, indem du unter Start->Systemsteuerung->System->Systemwiederherstellung den Haken bei "Systemwiederherstellung auf allen Laufwerken deaktivieren" setzt und später wieder rausnimmst.
Damit werden alle Wiederherstellungspunkte und darin eventuell vorhandene Reste der Infektion gelöscht.

lg myrtille