TR/Vundo.Gen; TR/Vundo.fnr.6 entfernen ?

Seraphine_

So, das hat ´ne Weile gedauert. Hier der Bericht von MalwareBytes:

Malwarebytes' Anti-Malware 1.30
Datenbank Version: 1333
Windows 5.1.2600 Service Pack 2

28.10.2008 22:33:41
mbam-log-2008-10-28 (22-33-41).txt

Scan-Methode: Vollständiger Scan (C:\|)
Durchsuchte Objekte: 125942
Laufzeit: 3 hour(s), 26 minute(s), 11 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 2
Infizierte Registrierungsschlüssel: 18
Infizierte Registrierungswerte: 1
Infizierte Dateiobjekte der Registrierung: 5
Infizierte Verzeichnisse: 0
Infizierte Dateien: 27

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
C:\WINDOWS\system32\jkkIYqol.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\xxYoljJC.dll (Trojan.Vundo.H) -> Delete on reboot.

Infizierte Registrierungsschlüssel:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9cf8f23a-70ff-439b-b040-16caa043c8aa} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{9cf8f23a-70ff-439b-b040-16caa043c8aa} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c2d425b2-3452-427a-96be-b3cd66620205} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\xxyoljjc (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{c2d425b2-3452-427a-96be-b3cd66620205} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e23e930a-55c6-4588-9c89-56a5cc2307ca} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{e23e930a-55c6-4588-9c89-56a5cc2307ca} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{082716ea-cdb7-457b-bc0b-56a22394b400} (Trojan.BHO.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{082716ea-cdb7-457b-bc0b-56a22394b400} (Trojan.BHO.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{9cf8f23a-70ff-439b-b040-16caa043c8aa} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c2d425b2-3452-427a-96be-b3cd66620205} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{8ca5ed52-f3fb-4414-a105-2e3491156990} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{082716ea-cdb7-457b-bc0b-56a22394b400} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{c2d425b2-3452-427a-96be-b3cd66620205} (Trojan.Vundo.H) -> Delete on reboot.

Infizierte Dateiobjekte der Registrierung:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\jkkiyqol -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\regfile\shell\open\command\ (Broken.OpenCommand) -> Bad: ("regedit.exe" "%1") Good: (regedit.exe "%1") -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\jkkiyqol -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowRun (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowHelp (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\WINDOWS\system32\jkkIYqol.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\loqYIkkj.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\loqYIkkj.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\xxYoljJC.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\xvycan.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\jlhvjwjt.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\tjwjvhlj.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\bikpfmsk.dll (Trojan.BHO.H) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{AFA2D6BF-6F44-4198-B485-72609AE98E41}\RP358\A0035469.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{AFA2D6BF-6F44-4198-B485-72609AE98E41}\RP376\A0055651.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{AFA2D6BF-6F44-4198-B485-72609AE98E41}\RP376\A0055652.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{AFA2D6BF-6F44-4198-B485-72609AE98E41}\RP376\A0055653.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{AFA2D6BF-6F44-4198-B485-72609AE98E41}\RP377\A0055906.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\cbjahkvn.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\gnefeiwh.exe (Trojan.LowZones) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\hgGXNdaA.VIR (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kcldpgda.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\qhpamcbs.exe (Trojan.LowZones) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\vcruwy.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\cuvfduiu.exe (Trojan.LowZones) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\wxlwwojv.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\xvycan.VIR (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\xxyyvUlk.VIR (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\yvalblya.VIR (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\Johnny.ANDREW-LD6AM2H7\Lokale Einstellungen\Temporary Internet Files\Content.IE5\3NNT1A2D\cntr[1].VIR (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\Johnny.ANDREW-LD6AM2H7\Lokale Einstellungen\Temporary Internet Files\Content.IE5\NGEVE7OL\4l1gd[1].VIR (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\Johnny.ANDREW-LD6AM2H7\results.txt (Malware.Trace) -> Quarantined and deleted successfully.

Werde dann mal Combofix laden, aber noch nicht starten. Erst auf Anweisung warten, oder ?