USB-Stick infiziert?

Warsta · 25.02.2009, 02:01

Ich hab schonmal geantwortet, ber da ihr euch Zeit lasst, dachte ich, es könnte auch nochmal hilfreich sein, alles zusammenzustellen.
Ich hoffe es hilft:

Avira Systemprüfung:

Zitat:

Beginne mit der Suche in 'C:\' <Windows &Programme>
C:\pagefile.sys
[WARNUNG] Die Datei konnte nicht geöffnet werden!
C:\Documents and Settings\Skull\Local Settings\Application Data\Mozilla\Firefox\Profiles\z0sdjxgb.default\Cache\C2152591d01
[0] Archivtyp: RAR SFX (self extracting)
--> 32788R22FWJFW\psexec.cfexe
[1] Archivtyp: RSRC
--> Object
[FUND] Enthält Erkennungsmuster der Anwendung APPL/PsExec.E
[HINWEIS] Die Datei wurde gelöscht.
C:\System Volume Information\_restore{8CA6A1C6-F45F-419A-8ECF-FA0B93DBEA6A}\RP1\A0000259.EXE
[FUND] Enthält Erkennungsmuster der Anwendung APPL/PsExec.E
[HINWEIS] Die Datei wurde gelöscht.
Beginne mit der Suche in 'D:\' <Privates>
Beginne mit der Suche in 'E:\' <Videos & Musik & Bilder>
Beginne mit der Suche in 'F:\' <Backups>
F:\System Volume Information\_restore{8CA6A1C6-F45F-419A-8ECF-FA0B93DBEA6A}\RP1\A0000321.exe
[0] Archivtyp: RAR SFX (self extracting)
--> 32788R22FWJFW\psexec.cfexe
[1] Archivtyp: RSRC
--> Object
[FUND] Enthält Erkennungsmuster der Anwendung APPL/PsExec.E
[HINWEIS] Die Datei wurde gelöscht.
F:\Viren & Widerherstellung\ComboFix.exe
[0] Archivtyp: RAR SFX (self extracting)
--> 32788R22FWJFW\psexec.cfexe
[1] Archivtyp: RSRC
--> Object
[FUND] Enthält Erkennungsmuster der Anwendung APPL/PsExec.E
[HINWEIS] Die Datei wurde gelöscht.

Ich mache Combofix.exe auf und Avira meldet sich mit:

Zitat:

In der Datei 'C:\32788R22FWJFW\psexec.cfexe'
wurde ein Virus oder unerwünschtes Programm 'APPL/PsExec.E' [program] gefunden.
Ausgeführte Aktion: Datei löschen

Combofix-Log:

Zitat:

ComboFix 09-02-24.02 - Skull 2009-02-25 1:47:01.7 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1501 [GMT 1:00]
ausgeführt von:: f:\viren & widerherstellung\ComboFix.exe
AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated)
.

((((((((((((((((((((((( Dateien erstellt von 2009-01-25 bis 2009-02-25 ))))))))))))))))))))))))))))))
.

2009-02-25 00:39 . 2009-02-25 00:39 <DIR> d-------- C:\VundoFix Backups
2009-02-23 23:04 . 2009-02-24 18:23 250 --a------ c:\windows\gmer.ini
2009-02-22 21:24 . 2009-02-22 22:16 <DIR> d-------- c:\documents and settings\All Users\Application Data\SITEguard
2009-02-22 21:23 . 2009-02-22 21:23 <DIR> d-------- c:\program files\Common Files\iS3
2009-02-22 21:23 . 2009-02-22 22:18 <DIR> d-------- c:\documents and settings\All Users\Application Data\STOPzilla!
2009-02-22 20:02 . 2009-02-22 20:03 3,535,293 --a------ c:\windows\system32\VHCDYYMYF
2009-02-22 19:08 . 2009-02-22 19:08 <DIR> d-------- c:\program files\CCleaner
2009-02-22 16:55 . 2009-02-22 16:55 175,277 -r-hs---- C:\squdq.com
2009-02-16 11:48 . 2009-02-16 11:49 <DIR> d-------- c:\program files\SkyTestFQ
2009-02-16 11:48 . 2008-02-06 19:31 1,019,904 --a------ c:\windows\system32\EvoVoIP.ocx
2009-02-16 11:48 . 1998-07-06 00:00 158,208 --a------ c:\windows\system32\MSCMCDE.DLL
2009-02-16 11:48 . 2000-10-02 00:00 125,712 --a------ c:\windows\system32\VB6DE.DLL
2009-02-16 11:48 . 1998-06-24 01:00 108,336 --a------ c:\windows\system32\MSWINSCK.OCX
2009-02-16 11:48 . 1999-01-25 20:30 26,624 --a------ c:\windows\system32\JKJoystick2.ocx
2009-02-16 11:48 . 1999-01-25 21:31 1,025 --a------ c:\windows\system32\JKJoystick2.DEP
2009-02-14 02:06 . 2009-02-14 02:06 <DIR> d-------- c:\documents and settings\Skull\Application Data\Malwarebytes
2009-02-14 02:02 . 2009-02-14 02:02 <DIR> d-------- c:\program files\Trend Micro
2009-01-25 21:58 . 2009-01-25 21:58 <DIR> d-------- c:\documents and settings\Skull\Application Data\Media Player Classic
2009-01-25 21:56 . 2009-01-25 21:56 <DIR> d-------- c:\program files\Combined Community Codec Pack

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-24 16:23 --------- d-----w c:\documents and settings\Skull\Application Data\Orbit
2009-02-23 18:38 --------- d-----w c:\program files\FreePDF_XP
2009-02-23 17:52 --------- d-----w c:\program files\Orbitdownloader
2009-02-22 21:43 --------- d-----w c:\documents and settings\Skull\Application Data\uTorrent
2009-02-16 14:11 --------- d-----w c:\program files\Lx_cats
2009-02-14 01:08 --------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-02-06 14:50 --------- d-----w c:\program files\Abbyy FineReader 6.0 Sprint
2009-01-23 22:01 --------- d-----w c:\documents and settings\Skull\Application Data\FaxCtr
2009-01-23 22:00 --------- d-----w c:\program files\Lexmark 4300 Series
2009-01-23 18:45 --------- d-----w c:\program files\Lexmark Fax Solutions
2009-01-19 21:46 --------- d-----w c:\documents and settings\Skull\Application Data\GrabPro
2009-01-17 15:23 --------- d-----w c:\program files\DVDVideoSoft
2009-01-17 15:23 --------- d-----w c:\program files\Common Files\DVDVideoSoft
2009-01-08 18:43 --------- d--h--w c:\program files\InstallShield Installation Information
2009-01-08 18:43 --------- d-----w c:\program files\Realtek
2009-01-08 18:43 --------- d-----w c:\documents and settings\Skull\Application Data\InstallShield
2009-01-05 01:56 --------- d-----w c:\documents and settings\Skull\Application Data\Apple Computer
2009-01-04 16:20 --------- d-----w c:\program files\Miranda IM
2009-01-04 13:32 --------- d-----w c:\program files\gs
2009-01-03 22:22 --------- d-----w c:\program files\QuickTime
2009-01-03 22:22 --------- d-----w c:\program files\Common Files\Apple
2009-01-03 22:22 --------- d-----w c:\program files\Apple Software Update
2009-01-03 22:22 --------- d-----w c:\documents and settings\All Users\Application Data\Apple
2009-01-03 22:21 --------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer
2009-01-03 02:47 --------- d-----w c:\documents and settings\Guest\Application Data\vlc
2009-01-01 21:53 410,984 ----a-w c:\windows\system32\deploytk.dll
2009-01-01 21:53 --------- d-----w c:\program files\Java
2009-01-01 21:48 --------- d-----w c:\program files\Sun
2009-01-01 19:57 --------- d-----w c:\program files\Paint.NET
2009-01-01 19:12 --------- d-----w c:\program files\Reference Assemblies
2009-01-01 19:12 --------- d-----w c:\program files\MSBuild
2009-01-01 02:00 --------- d-----w c:\program files\MSXML 4.0
2008-12-31 20:37 --------- d-----w c:\program files\Windows Live
2008-12-31 20:31 --------- d-----w c:\documents and settings\All Users\Application Data\WLInstaller
2008-12-31 20:07 --------- d-----w c:\program files\Common Files\Windows Live
2008-12-31 19:34 --------- d-----w c:\program files\microsoft frontpage
2008-12-31 19:26 --------- d-----w c:\documents and settings\Skull\Application Data\Microsoft Web Folders
2008-12-31 19:24 --------- d-----w c:\program files\Autorun Eater
2008-12-31 19:15 --------- d-----w c:\documents and settings\Skull\Application Data\vlc
2008-12-31 19:04 --------- d-----w c:\program files\Symantec
2008-12-31 19:00 --------- d-----w c:\program files\Common Files\Adobe
2008-12-31 18:42 --------- d-----w c:\program files\Smart PC Solutions
2008-12-31 18:24 --------- d-----w c:\program files\uTorrent
2008-12-31 18:21 --------- d-----w c:\program files\Common Files\Symantec Shared
2008-12-31 18:15 --------- d-----w c:\program files\Brownie
2008-12-31 18:15 --------- d-----w c:\program files\Brother
2008-12-31 18:14 --------- d-----w c:\program files\Common Files\InstallShield
2008-12-31 02:26 --------- d-----w c:\program files\LECTURNITY Player
2008-12-31 02:17 --------- d-----w c:\program files\lg_fwupdate
2008-12-31 02:13 --------- d-----w c:\documents and settings\All Users\Application Data\CyberLink
2008-12-31 02:12 --------- d-----w c:\program files\CyberLink
2008-12-31 01:58 --------- d-----w c:\program files\Common Files\Ahead
2008-12-31 01:58 --------- d-----w c:\documents and settings\All Users\Application Data\Ahead
2008-12-31 01:56 --------- d-----w c:\program files\Nero
2008-12-31 01:56 --------- d-----w c:\documents and settings\All Users\Application Data\Nero
2008-12-31 01:50 --------- d-----w c:\documents and settings\All Users\Application Data\FaxCtr
2008-12-31 01:46 --------- d-----w c:\program files\Microsoft CAPICOM 2.1.0.2
2008-12-31 01:23 --------- d-----w c:\program files\ClearProg
2008-12-31 01:05 --------- dcsh--w c:\program files\Common Files\WindowsLiveInstaller
2008-12-31 00:56 --------- d-----w c:\program files\FLV Player
2008-12-31 00:54 --------- d-----w c:\program files\VideoLAN
2008-12-31 00:43 --------- d-----w c:\program files\Common Files\AVSMedia
2008-12-31 00:39 --------- d-----w c:\documents and settings\All Users\Application Data\AVS4YOU
2008-12-31 00:32 --------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
2008-12-30 23:56 --------- d-----w c:\program files\InterVideo
2008-12-30 23:56 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec
2008-12-30 23:33 --------- d-----w c:\program files\AMD
2008-12-30 23:32 --------- d-----w c:\program files\ASUS
2008-12-30 23:24 --------- d-----w c:\program files\Avira
2008-12-30 23:24 --------- d-----w c:\documents and settings\All Users\Application Data\Avira
2008-12-30 23:21 --------- d-----w c:\program files\ATI Technologies
2008-12-30 23:18 --------- d-----w c:\program files\Common Files\ATI Technologies
2008-12-30 22:58 315,392 ----a-w c:\windows\HideWin.exe
2008-12-20 23:15 826,368 ----a-w c:\windows\system32\wininet.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-02-23_12.28.57,53 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-02-23 22:04:44 819,200 ----a-w c:\windows\gmer.dll
+ 2008-01-18 19:31:10 757,760 ----a-w c:\windows\gmer.exe
+ 2009-02-23 22:04:44 85,713 ----a-w c:\windows\system32\drivers\gmer.sys
- 2009-02-23 11:18:08 71,138 ----a-w c:\windows\system32\perfc009.dat
+ 2009-02-24 21:30:09 71,138 ----a-w c:\windows\system32\perfc009.dat
- 2009-02-23 11:18:08 440,820 ----a-w c:\windows\system32\perfh009.dat
+ 2009-02-24 21:30:09 440,820 ----a-w c:\windows\system32\perfh009.dat
+ 2009-02-24 21:23:05 16,384 ------w c:\windows\Temp\Perflib_Perfdata_764.dat
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-13 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-13 455168]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-01-01 136600]
"LXCECATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\LXCEtime.dll" [2005-07-20 73728]
"EzPrint"="c:\program files\Lexmark 4300 Series\ezprint.exe" [2005-07-26 94208]
"FreePDF Assistant"="c:\program files\FreePDF_XP\fpassist.exe" [2007-06-26 312320]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.lsgc"= lsgc.dll
"vidc.ffds"= c:\progra~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\8169Diag]
--a------ 2008-01-24 15:12 139264 c:\program files\Realtek\Diagnostics Utility\8169Diag.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-10-15 01:04 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Autorun Eater]
--a------ 2008-11-27 02:19 501768 c:\program files\Autorun Eater\oldmcdonald.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EzPrint]
--a------ 2005-07-26 13:17 94208 c:\program files\Lexmark 4300 Series\ezprint.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FaxCenterServer]
--a------ 2005-07-12 10:36 299008 c:\program files\Lexmark Fax Solutions\fm3032.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FreePDF Assistant]
--a------ 2007-06-26 20:27 312320 c:\program files\FreePDF_XP\fpassist.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
--a------ 2008-04-13 20:13 208952 c:\windows\ime\IMJP8_1\imjpmig.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
--a------ 2007-11-26 14:54 1057064 c:\program files\Nero\Nero 7\InCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
--a------ 2007-01-08 22:17 52256 c:\program files\CyberLink\PowerDVD\Language\Language.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LGODDFU]
--a------ 2008-12-31 03:14 548864 c:\program files\lg_fwupdate\fwupdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lxcemon.exe]
--a------ 2005-08-02 18:45 192512 c:\program files\Lexmark 4300 Series\lxcemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2007-03-01 14:57 153136 c:\program files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-09-06 15:09 413696 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--------- 2007-03-14 21:01 71216 c:\program files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SecurDisc]
--a------ 2007-11-26 14:54 1629480 c:\program files\Nero\Nero 7\InCD\NBHGui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
-r------- 2008-01-29 08:47 16859648 c:\windows\RTHDCPL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WLSetupSvc"=3 (0x3)
"usnjsvc"=3 (0x3)
"RQHBQTV"=3 (0x3)
"RO"=3 (0x3)
"RichVideo"=2 (0x2)
"HBWIU"=3 (0x3)
"GRGZXZ"=3 (0x3)
"EKJMVGEPP"=3 (0x3)
"NBService"=3 (0x3)
"InCDsrv"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Miranda IM\\miranda32.exe"=
"c:\\Documents and Settings\\Skull\\Desktop\\New Folder\\Miranda\\miranda32.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitdm.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitnet.exe"=
"d:\\Studium\\Programmieren\\Java\\eclipse\\eclipse.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R2 AMDRAIDXpert;AMD RAIDXpert;c:\program files\AMD\RAIDXpert\jetty\extra\win32\Wrapper.exe [2003-09-29 110592]
R2 LANPkt;Realtek LANPkt Protocol Driver;c:\windows\system32\drivers\LANPkt.sys [2008-12-31 8960]
R3 AtiHdmiService;ATI Function Driver for HDMI Service;c:\windows\system32\drivers\AtiHdmi.sys [2007-07-20 84992]
S3 Diag69xp;Diag69xp;c:\windows\system32\drivers\diag69xp.sys [2008-12-31 11264]
S3 RTLVLAN;Realtek VLAN Intermediate Driver;c:\windows\system32\drivers\RTLVLAN.SYS [2008-12-31 16640]
S4 EKJMVGEPP;EKJMVGEPP;c:\docume~1\Skull\LOCALS~1\Temp\EKJMVGEPP.exe --> c:\docume~1\Skull\LOCALS~1\Temp\EKJMVGEPP.exe [?]
S4 GRGZXZ;GRGZXZ;c:\docume~1\Skull\LOCALS~1\Temp\GRGZXZ.exe --> c:\docume~1\Skull\LOCALS~1\Temp\GRGZXZ.exe [?]
S4 HBWIU;HBWIU;c:\docume~1\Skull\LOCALS~1\Temp\HBWIU.exe --> c:\docume~1\Skull\LOCALS~1\Temp\HBWIU.exe [?]
S4 RO;RO;c:\docume~1\Skull\LOCALS~1\Temp\RO.exe --> c:\docume~1\Skull\LOCALS~1\Temp\RO.exe [?]
S4 RQHBQTV;RQHBQTV;c:\docume~1\Skull\LOCALS~1\Temp\RQHBQTV.exe --> c:\docume~1\Skull\LOCALS~1\Temp\RQHBQTV.exe [?]
.
Inhalt des "geplante Tasks" Ordners

2009-01-03 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.com/
IE: &Download by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204
IE: Do&wnload selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202
FF - ProfilePath - c:\documents and settings\Skull\Application Data\Mozilla\Firefox\Profiles\z0sdjxgb.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-25 01:47:49
Windows 5.1.2600 Service Pack 3 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
LXCECATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\LXCEtime.dll,_RunDLLEntry@16??????????????????????????????????????????????????????????????????????????????? ????????????????????????????????????????????????????????????????????????????????????????????????????

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

- - - - - - - > 'winlogon.exe'(752)
c:\windows\system32\Ati2evxx.dll
.
Zeit der Fertigstellung: 2009-02-25 1:48:32
ComboFix-quarantined-files.txt 2009-02-25 00:48:30
ComboFix2.txt 2009-02-24 23:37:04
ComboFix3.txt 2009-02-24 17:44:10
ComboFix4.txt 2009-02-24 17:27:38
ComboFix5.txt 2009-02-25 00:46:43

Vor Suchlauf: 2.204.766.208 bytes free
Nach Suchlauf: 2,194,132,992 bytes free

255 --- E O F --- 2009-02-11 15:47:40

Warsta · 26.02.2009, 19:44

Hey, CCCleaner laufen lassen und dann Combofix: Danach Vondofix ...hatte aber keien Funde.

Zitat:

ComboFix 09-02-25.02 - Skull 2009-02-26 19:17:51.11 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1656 [GMT 1:00]
ausgeführt von:: f:\viren & widerherstellung\ComboFix.exe
AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated)
* Neuer Wiederherstellungspunkt wurde erstellt
.

((((((((((((((((((((((( Dateien erstellt von 2009-01-26 bis 2009-02-26 ))))))))))))))))))))))))))))))
.

2009-02-25 23:40 . 2009-02-25 23:40 1,374 --a------ c:\windows\imsins.BAK
2009-02-25 20:08 . 2009-02-25 21:00 97,280 -r-hs---- c:\windows\system32\uweyiwe1.dll
2009-02-25 00:39 . 2009-02-25 00:39 <DIR> d-------- C:\VundoFix Backups
2009-02-23 23:04 . 2009-02-25 16:14 250 --a------ c:\windows\gmer.ini
2009-02-22 21:24 . 2009-02-22 22:16 <DIR> d-------- c:\documents and settings\All Users\Application Data\SITEguard
2009-02-22 21:23 . 2009-02-22 21:23 <DIR> d-------- c:\program files\Common Files\iS3
2009-02-22 21:23 . 2009-02-22 22:18 <DIR> d-------- c:\documents and settings\All Users\Application Data\STOPzilla!
2009-02-22 20:02 . 2009-02-22 20:03 3,535,293 --a------ c:\windows\system32\VHCDYYMYF
2009-02-22 19:08 . 2009-02-22 19:08 <DIR> d-------- c:\program files\CCleaner
2009-02-16 11:48 . 2009-02-16 11:49 <DIR> d-------- c:\program files\SkyTestFQ
2009-02-16 11:48 . 2008-02-06 19:31 1,019,904 --a------ c:\windows\system32\EvoVoIP.ocx
2009-02-16 11:48 . 1998-07-06 00:00 158,208 --a------ c:\windows\system32\MSCMCDE.DLL
2009-02-16 11:48 . 2000-10-02 00:00 125,712 --a------ c:\windows\system32\VB6DE.DLL
2009-02-16 11:48 . 1998-06-24 01:00 108,336 --a------ c:\windows\system32\MSWINSCK.OCX
2009-02-16 11:48 . 1999-01-25 20:30 26,624 --a------ c:\windows\system32\JKJoystick2.ocx
2009-02-16 11:48 . 1999-01-25 21:31 1,025 --a------ c:\windows\system32\JKJoystick2.DEP
2009-02-14 02:06 . 2009-02-14 02:06 <DIR> d-------- c:\documents and settings\Skull\Application Data\Malwarebytes
2009-02-14 02:02 . 2009-02-14 02:02 <DIR> d-------- c:\program files\Trend Micro

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-26 00:21 --------- d-----w c:\program files\Orbitdownloader
2009-02-24 16:23 --------- d-----w c:\documents and settings\Skull\Application Data\Orbit
2009-02-23 18:38 --------- d-----w c:\program files\FreePDF_XP
2009-02-22 21:43 --------- d-----w c:\documents and settings\Skull\Application Data\uTorrent
2009-02-16 14:11 --------- d-----w c:\program files\Lx_cats
2009-02-14 01:08 --------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-02-06 14:50 --------- d-----w c:\program files\Abbyy FineReader 6.0 Sprint
2009-01-25 20:58 --------- d-----w c:\documents and settings\Skull\Application Data\Media Player Classic
2009-01-25 20:56 --------- d-----w c:\program files\Combined Community Codec Pack
2009-01-23 22:01 --------- d-----w c:\documents and settings\Skull\Application Data\FaxCtr
2009-01-23 22:00 --------- d-----w c:\program files\Lexmark 4300 Series
2009-01-23 18:45 --------- d-----w c:\program files\Lexmark Fax Solutions
2009-01-19 21:46 --------- d-----w c:\documents and settings\Skull\Application Data\GrabPro
2009-01-17 15:23 --------- d-----w c:\program files\DVDVideoSoft
2009-01-17 15:23 --------- d-----w c:\program files\Common Files\DVDVideoSoft
2009-01-08 18:43 --------- d--h--w c:\program files\InstallShield Installation Information
2009-01-08 18:43 --------- d-----w c:\program files\Realtek
2009-01-08 18:43 --------- d-----w c:\documents and settings\Skull\Application Data\InstallShield
2009-01-05 01:56 --------- d-----w c:\documents and settings\Skull\Application Data\Apple Computer
2009-01-04 16:20 --------- d-----w c:\program files\Miranda IM
2009-01-04 13:32 --------- d-----w c:\program files\gs
2009-01-03 22:22 --------- d-----w c:\program files\QuickTime
2009-01-03 22:22 --------- d-----w c:\program files\Common Files\Apple
2009-01-03 22:22 --------- d-----w c:\program files\Apple Software Update
2009-01-03 22:22 --------- d-----w c:\documents and settings\All Users\Application Data\Apple
2009-01-03 22:21 --------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer
2009-01-03 02:47 --------- d-----w c:\documents and settings\Guest\Application Data\vlc
2009-01-01 21:53 410,984 ----a-w c:\windows\system32\deploytk.dll
2009-01-01 21:53 --------- d-----w c:\program files\Java
2009-01-01 21:48 --------- d-----w c:\program files\Sun
2009-01-01 19:57 --------- d-----w c:\program files\Paint.NET
2009-01-01 19:12 --------- d-----w c:\program files\Reference Assemblies
2009-01-01 19:12 --------- d-----w c:\program files\MSBuild
2009-01-01 02:00 --------- d-----w c:\program files\MSXML 4.0
2008-12-31 20:37 --------- d-----w c:\program files\Windows Live
2008-12-31 20:31 --------- d-----w c:\documents and settings\All Users\Application Data\WLInstaller
2008-12-31 20:07 --------- d-----w c:\program files\Common Files\Windows Live
2008-12-31 19:34 --------- d-----w c:\program files\microsoft frontpage
2008-12-31 19:26 --------- d-----w c:\documents and settings\Skull\Application Data\Microsoft Web Folders
2008-12-31 19:24 --------- d-----w c:\program files\Autorun Eater
2008-12-31 19:15 --------- d-----w c:\documents and settings\Skull\Application Data\vlc
2008-12-31 19:04 --------- d-----w c:\program files\Symantec
2008-12-31 19:00 --------- d-----w c:\program files\Common Files\Adobe
2008-12-31 18:42 --------- d-----w c:\program files\Smart PC Solutions
2008-12-31 18:24 --------- d-----w c:\program files\uTorrent
2008-12-31 18:21 --------- d-----w c:\program files\Common Files\Symantec Shared
2008-12-31 18:15 --------- d-----w c:\program files\Brownie
2008-12-31 18:15 --------- d-----w c:\program files\Brother
2008-12-31 18:14 --------- d-----w c:\program files\Common Files\InstallShield
2008-12-31 02:26 --------- d-----w c:\program files\LECTURNITY Player
2008-12-31 02:17 --------- d-----w c:\program files\lg_fwupdate
2008-12-31 02:13 --------- d-----w c:\documents and settings\All Users\Application Data\CyberLink
2008-12-31 02:12 --------- d-----w c:\program files\CyberLink
2008-12-31 01:58 --------- d-----w c:\program files\Common Files\Ahead
2008-12-31 01:58 --------- d-----w c:\documents and settings\All Users\Application Data\Ahead
2008-12-31 01:56 --------- d-----w c:\program files\Nero
2008-12-31 01:56 --------- d-----w c:\documents and settings\All Users\Application Data\Nero
2008-12-31 01:50 --------- d-----w c:\documents and settings\All Users\Application Data\FaxCtr
2008-12-31 01:46 --------- d-----w c:\program files\Microsoft CAPICOM 2.1.0.2
2008-12-31 01:23 --------- d-----w c:\program files\ClearProg
2008-12-31 01:05 --------- dcsh--w c:\program files\Common Files\WindowsLiveInstaller
2008-12-31 00:56 --------- d-----w c:\program files\FLV Player
2008-12-31 00:54 --------- d-----w c:\program files\VideoLAN
2008-12-31 00:43 --------- d-----w c:\program files\Common Files\AVSMedia
2008-12-31 00:39 --------- d-----w c:\documents and settings\All Users\Application Data\AVS4YOU
2008-12-31 00:32 --------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
2008-12-30 23:56 --------- d-----w c:\program files\InterVideo
2008-12-30 23:56 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec
2008-12-30 23:33 --------- d-----w c:\program files\AMD
2008-12-30 23:32 --------- d-----w c:\program files\ASUS
2008-12-30 23:24 --------- d-----w c:\program files\Avira
2008-12-30 23:24 --------- d-----w c:\documents and settings\All Users\Application Data\Avira
2008-12-30 23:21 --------- d-----w c:\program files\ATI Technologies
2008-12-30 23:18 --------- d-----w c:\program files\Common Files\ATI Technologies
2008-12-30 22:58 315,392 ----a-w c:\windows\HideWin.exe
2008-12-20 23:15 826,368 ----a-w c:\windows\system32\wininet.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-02-23_12.28.57,53 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-02-23 22:04:44 819,200 ----a-w c:\windows\gmer.dll
+ 2008-01-18 19:31:10 757,760 ----a-w c:\windows\gmer.exe
- 2008-04-14 02:42:06 8,461,312 -c--a-w c:\windows\system32\dllcache\shell32.dll
+ 2008-06-17 19:02:19 8,461,312 -c--a-w c:\windows\system32\dllcache\shell32.dll
+ 2009-02-23 22:04:44 85,713 ----a-w c:\windows\system32\drivers\gmer.sys
- 2009-02-23 11:18:08 71,138 ----a-w c:\windows\system32\perfc009.dat
+ 2009-02-26 11:34:36 71,138 ----a-w c:\windows\system32\perfc009.dat
- 2009-02-23 11:18:08 440,820 ----a-w c:\windows\system32\perfh009.dat
+ 2009-02-26 11:34:36 440,820 ----a-w c:\windows\system32\perfh009.dat
- 2008-04-14 02:42:06 8,461,312 ----a-w c:\windows\system32\shell32.dll
+ 2008-06-17 19:02:19 8,461,312 ----a-w c:\windows\system32\shell32.dll
- 2008-07-09 07:38:24 17,272 ------w c:\windows\system32\spmsg.dll
+ 2007-11-30 11:18:51 17,272 ------w c:\windows\system32\spmsg.dll
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"kvasoft"="c:\windows\system32\kva8wr.exe" [BU]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-13 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-13 455168]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-01-01 136600]
"LXCECATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\LXCEtime.dll" [2005-07-20 73728]
"EzPrint"="c:\program files\Lexmark 4300 Series\ezprint.exe" [2005-07-26 94208]
"FreePDF Assistant"="c:\program files\FreePDF_XP\fpassist.exe" [2007-06-26 312320]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.lsgc"= lsgc.dll
"vidc.ffds"= c:\progra~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\8169Diag]
--a------ 2008-01-24 15:12 139264 c:\program files\Realtek\Diagnostics Utility\8169Diag.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-10-15 01:04 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Autorun Eater]
--a------ 2008-11-27 02:19 501768 c:\program files\Autorun Eater\oldmcdonald.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EzPrint]
--a------ 2005-07-26 13:17 94208 c:\program files\Lexmark 4300 Series\ezprint.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FaxCenterServer]
--a------ 2005-07-12 10:36 299008 c:\program files\Lexmark Fax Solutions\fm3032.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FreePDF Assistant]
--a------ 2007-06-26 20:27 312320 c:\program files\FreePDF_XP\fpassist.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
--a------ 2008-04-13 20:13 208952 c:\windows\ime\IMJP8_1\imjpmig.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
--a------ 2007-11-26 14:54 1057064 c:\program files\Nero\Nero 7\InCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
--a------ 2007-01-08 22:17 52256 c:\program files\CyberLink\PowerDVD\Language\Language.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LGODDFU]
--a------ 2008-12-31 03:14 548864 c:\program files\lg_fwupdate\fwupdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lxcemon.exe]
--a------ 2005-08-02 18:45 192512 c:\program files\Lexmark 4300 Series\lxcemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2007-03-01 14:57 153136 c:\program files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-09-06 15:09 413696 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--------- 2007-03-14 21:01 71216 c:\program files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SecurDisc]
--a------ 2007-11-26 14:54 1629480 c:\program files\Nero\Nero 7\InCD\NBHGui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
-r------- 2008-01-29 08:47 16859648 c:\windows\RTHDCPL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WLSetupSvc"=3 (0x3)
"usnjsvc"=3 (0x3)
"RQHBQTV"=3 (0x3)
"RO"=3 (0x3)
"RichVideo"=2 (0x2)
"HBWIU"=3 (0x3)
"GRGZXZ"=3 (0x3)
"EKJMVGEPP"=3 (0x3)
"NBService"=3 (0x3)
"InCDsrv"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Miranda IM\\miranda32.exe"=
"c:\\Documents and Settings\\Skull\\Desktop\\New Folder\\Miranda\\miranda32.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitdm.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitnet.exe"=
"d:\\Studium\\Programmieren\\Java\\eclipse\\eclipse.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R2 LANPkt;Realtek LANPkt Protocol Driver;c:\windows\system32\drivers\LANPkt.sys [2008-12-31 8960]
R3 AtiHdmiService;ATI Function Driver for HDMI Service;c:\windows\system32\drivers\AtiHdmi.sys [2007-07-20 84992]
S2 AMDRAIDXpert;AMD RAIDXpert;c:\program files\AMD\RAIDXpert\jetty\extra\win32\Wrapper.exe [2003-09-29 110592]
S3 Diag69xp;Diag69xp;c:\windows\system32\drivers\diag69xp.sys [2008-12-31 11264]
S3 RTLVLAN;Realtek VLAN Intermediate Driver;c:\windows\system32\drivers\RTLVLAN.SYS [2008-12-31 16640]
S4 EKJMVGEPP;EKJMVGEPP;c:\docume~1\Skull\LOCALS~1\Temp\EKJMVGEPP.exe --> c:\docume~1\Skull\LOCALS~1\Temp\EKJMVGEPP.exe [?]
S4 GRGZXZ;GRGZXZ;c:\docume~1\Skull\LOCALS~1\Temp\GRGZXZ.exe --> c:\docume~1\Skull\LOCALS~1\Temp\GRGZXZ.exe [?]
S4 HBWIU;HBWIU;c:\docume~1\Skull\LOCALS~1\Temp\HBWIU.exe --> c:\docume~1\Skull\LOCALS~1\Temp\HBWIU.exe [?]
S4 RO;RO;c:\docume~1\Skull\LOCALS~1\Temp\RO.exe --> c:\docume~1\Skull\LOCALS~1\Temp\RO.exe [?]
S4 RQHBQTV;RQHBQTV;c:\docume~1\Skull\LOCALS~1\Temp\RQHBQTV.exe --> c:\docume~1\Skull\LOCALS~1\Temp\RQHBQTV.exe [?]
.
Inhalt des "geplante Tasks" Ordners

2009-01-03 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.com/
IE: &Download by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204
IE: Do&wnload selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202
FF - ProfilePath - c:\documents and settings\Skull\Application Data\Mozilla\Firefox\Profiles\z0sdjxgb.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-26 19:18:38
Windows 5.1.2600 Service Pack 3 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
LXCECATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\LXCEtime.dll,_RunDLLEntry@16??????????????????????????????????????????????????????????????????????????????? ????????????????????????????????????????????????????????????????????????????????????????????????????

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

- - - - - - - > 'winlogon.exe'(752)
c:\windows\system32\Ati2evxx.dll
.
Zeit der Fertigstellung: 2009-02-26 19:19:21
ComboFix-quarantined-files.txt 2009-02-26 18:19:19
ComboFix2.txt 2009-02-25 20:02:13
ComboFix3.txt 2009-02-25 19:41:31
ComboFix4.txt 2009-02-25 19:26:59
ComboFix5.txt 2009-02-25 20:08:07

Vor Suchlauf: 2.136.686.592 bytes free
Nach Suchlauf: 2,123,329,536 bytes free

265 --- E O F --- 2009-02-25 22:40:36

**Sunny** · 26.02.2009, 19:48

Dateien Online überprüfen lassen:

Als erstes versteckte Dateien anzeigen lassen! (nur Punkt 1 durchführen!)

Suche die Seite Virtustotal auf, klicke auf den Button „Durchsuchen“ und suche folgende Datei/Dateien:

Code:

ATTFilter

c:\windows\system32\uweyiwe1.dll
c:\windows\system32\kva8wr.exe
c:\docume~1\Skull\LOCALS~1\Temp\RQHBQTV.exe
C:\squdq.com

Lade nun nacheinander jede/alle Datei/Dateien hoch, und warte bis der Scan vorbei ist. (kann bis zu 2 Minuten dauern.)

Poste im Anschluss das Ergebnis der Auswertung, alles abkopieren und in einen Beitrag einfügen.

Wichtig: Auch die Größenangabe sowie den HASH mit kopieren!

Scripten mit Combofix

Öffne den Editor ( Start -> Zubehör -> Editor ) kopiere nun folgenden Text in das weiße Feld:

Zitat:

dirlook::
c:\windows\system32\VHCDYYMYF

Speichere diese Datei nun auf dem Desktop unter -> cfscript.txt

Nun die Datei cfscript.txt mit der rechten Maustaste auf das Sysmbol von Combofix ziehen!

Danach das Combofix nochmal ausführen, das System neu starten und das Log von Combofix posten

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann

Warsta · 26.02.2009, 22:17

Danke für den Post... Die meisten Programme hab ich mit Combofix weggemacht und es ist nur noch das erste auf meinem PC zu finden:

http://www.virustotal.com/de/analisis/7b461ff54e0e62181e8bb274f320b229

Diese hier sind aus dem Karantäneverzeichnis von Combofix:

http://www.virustotal.com/de/analisis/46ccbdc2ee4ae4dcec4ac0ce4d74d9af
http://www.virustotal.com/de/analisis/79fb39372cc8a0f7632c4528dc6a1551
http://www.virustotal.com/de/analisi/e97add582e47892ff39eed5a2a56c220
http://www.virustotal.com/de/analisis/6b28a110726830a379597ef6f1ab41fe

Zitat:

ComboFix 09-02-26.01 - Skull 2009-02-26 22:14:06.13 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1624 [GMT 1:00]
ausgeführt von:: f:\viren & widerherstellung\ComboFix.exe
Benutzte Befehlsschalter :: c:\documents and settings\Skull\Desktop\cfscript.txt
AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated)
* Neuer Wiederherstellungspunkt wurde erstellt
.

((((((((((((((((((((((( Dateien erstellt von 2009-01-26 bis 2009-02-26 ))))))))))))))))))))))))))))))
.

2009-02-25 20:08 . 2009-02-25 21:00 97,280 -r-hs---- c:\windows\system32\uweyiwe1.dll
2009-02-25 00:39 . 2009-02-25 00:39 <DIR> d-------- C:\VundoFix Backups
2009-02-23 23:04 . 2009-02-25 16:14 250 --a------ c:\windows\gmer.ini
2009-02-22 21:24 . 2009-02-22 22:16 <DIR> d-------- c:\documents and settings\All Users\Application Data\SITEguard
2009-02-22 21:23 . 2009-02-22 21:23 <DIR> d-------- c:\program files\Common Files\iS3
2009-02-22 21:23 . 2009-02-22 22:18 <DIR> d-------- c:\documents and settings\All Users\Application Data\STOPzilla!
2009-02-22 20:02 . 2009-02-22 20:03 3,535,293 --a------ c:\windows\system32\VHCDYYMYF
2009-02-22 19:08 . 2009-02-22 19:08 <DIR> d-------- c:\program files\CCleaner
2009-02-16 11:48 . 2009-02-16 11:49 <DIR> d-------- c:\program files\SkyTestFQ
2009-02-16 11:48 . 2008-02-06 19:31 1,019,904 --a------ c:\windows\system32\EvoVoIP.ocx
2009-02-16 11:48 . 1998-07-06 00:00 158,208 --a------ c:\windows\system32\MSCMCDE.DLL
2009-02-16 11:48 . 2000-10-02 00:00 125,712 --a------ c:\windows\system32\VB6DE.DLL
2009-02-16 11:48 . 1998-06-24 01:00 108,336 --a------ c:\windows\system32\MSWINSCK.OCX
2009-02-16 11:48 . 1999-01-25 20:30 26,624 --a------ c:\windows\system32\JKJoystick2.ocx
2009-02-16 11:48 . 1999-01-25 21:31 1,025 --a------ c:\windows\system32\JKJoystick2.DEP
2009-02-14 02:06 . 2009-02-14 02:06 <DIR> d-------- c:\documents and settings\Skull\Application Data\Malwarebytes
2009-02-14 02:02 . 2009-02-14 02:02 <DIR> d-------- c:\program files\Trend Micro

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-26 00:21 --------- d-----w c:\program files\Orbitdownloader
2009-02-24 16:23 --------- d-----w c:\documents and settings\Skull\Application Data\Orbit
2009-02-23 18:38 --------- d-----w c:\program files\FreePDF_XP
2009-02-22 21:43 --------- d-----w c:\documents and settings\Skull\Application Data\uTorrent
2009-02-16 14:11 --------- d-----w c:\program files\Lx_cats
2009-02-14 01:08 --------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-02-06 14:50 --------- d-----w c:\program files\Abbyy FineReader 6.0 Sprint
2009-01-25 20:58 --------- d-----w c:\documents and settings\Skull\Application Data\Media Player Classic
2009-01-25 20:56 --------- d-----w c:\program files\Combined Community Codec Pack
2009-01-23 22:01 --------- d-----w c:\documents and settings\Skull\Application Data\FaxCtr
2009-01-23 22:00 --------- d-----w c:\program files\Lexmark 4300 Series
2009-01-23 18:45 --------- d-----w c:\program files\Lexmark Fax Solutions
2009-01-19 21:46 --------- d-----w c:\documents and settings\Skull\Application Data\GrabPro
2009-01-17 15:23 --------- d-----w c:\program files\DVDVideoSoft
2009-01-17 15:23 --------- d-----w c:\program files\Common Files\DVDVideoSoft
2009-01-08 18:43 --------- d--h--w c:\program files\InstallShield Installation Information
2009-01-08 18:43 --------- d-----w c:\program files\Realtek
2009-01-08 18:43 --------- d-----w c:\documents and settings\Skull\Application Data\InstallShield
2009-01-05 01:56 --------- d-----w c:\documents and settings\Skull\Application Data\Apple Computer
2009-01-04 16:20 --------- d-----w c:\program files\Miranda IM
2009-01-04 13:32 --------- d-----w c:\program files\gs
2009-01-03 22:22 --------- d-----w c:\program files\QuickTime
2009-01-03 22:22 --------- d-----w c:\program files\Common Files\Apple
2009-01-03 22:22 --------- d-----w c:\program files\Apple Software Update
2009-01-03 22:22 --------- d-----w c:\documents and settings\All Users\Application Data\Apple
2009-01-03 22:21 --------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer
2009-01-03 02:47 --------- d-----w c:\documents and settings\Guest\Application Data\vlc
2009-01-01 21:53 410,984 ----a-w c:\windows\system32\deploytk.dll
2009-01-01 21:53 --------- d-----w c:\program files\Java
2009-01-01 21:48 --------- d-----w c:\program files\Sun
2009-01-01 19:57 --------- d-----w c:\program files\Paint.NET
2009-01-01 19:12 --------- d-----w c:\program files\Reference Assemblies
2009-01-01 19:12 --------- d-----w c:\program files\MSBuild
2009-01-01 02:00 --------- d-----w c:\program files\MSXML 4.0
2008-12-31 20:37 --------- d-----w c:\program files\Windows Live
2008-12-31 20:31 --------- d-----w c:\documents and settings\All Users\Application Data\WLInstaller
2008-12-31 20:07 --------- d-----w c:\program files\Common Files\Windows Live
2008-12-31 19:34 --------- d-----w c:\program files\microsoft frontpage
2008-12-31 19:26 --------- d-----w c:\documents and settings\Skull\Application Data\Microsoft Web Folders
2008-12-31 19:24 --------- d-----w c:\program files\Autorun Eater
2008-12-31 19:15 --------- d-----w c:\documents and settings\Skull\Application Data\vlc
2008-12-31 19:04 --------- d-----w c:\program files\Symantec
2008-12-31 19:00 --------- d-----w c:\program files\Common Files\Adobe
2008-12-31 18:42 --------- d-----w c:\program files\Smart PC Solutions
2008-12-31 18:24 --------- d-----w c:\program files\uTorrent
2008-12-31 18:21 --------- d-----w c:\program files\Common Files\Symantec Shared
2008-12-31 18:15 --------- d-----w c:\program files\Brownie
2008-12-31 18:15 --------- d-----w c:\program files\Brother
2008-12-31 18:14 --------- d-----w c:\program files\Common Files\InstallShield
2008-12-31 02:26 --------- d-----w c:\program files\LECTURNITY Player
2008-12-31 02:17 --------- d-----w c:\program files\lg_fwupdate
2008-12-31 02:13 --------- d-----w c:\documents and settings\All Users\Application Data\CyberLink
2008-12-31 02:12 --------- d-----w c:\program files\CyberLink
2008-12-31 01:58 --------- d-----w c:\program files\Common Files\Ahead
2008-12-31 01:58 --------- d-----w c:\documents and settings\All Users\Application Data\Ahead
2008-12-31 01:56 --------- d-----w c:\program files\Nero
2008-12-31 01:56 --------- d-----w c:\documents and settings\All Users\Application Data\Nero
2008-12-31 01:50 --------- d-----w c:\documents and settings\All Users\Application Data\FaxCtr
2008-12-31 01:46 --------- d-----w c:\program files\Microsoft CAPICOM 2.1.0.2
2008-12-31 01:23 --------- d-----w c:\program files\ClearProg
2008-12-31 01:05 --------- dcsh--w c:\program files\Common Files\WindowsLiveInstaller
2008-12-31 00:56 --------- d-----w c:\program files\FLV Player
2008-12-31 00:54 --------- d-----w c:\program files\VideoLAN
2008-12-31 00:43 --------- d-----w c:\program files\Common Files\AVSMedia
2008-12-31 00:39 --------- d-----w c:\documents and settings\All Users\Application Data\AVS4YOU
2008-12-31 00:32 --------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
2008-12-30 23:56 --------- d-----w c:\program files\InterVideo
2008-12-30 23:56 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec
2008-12-30 23:33 --------- d-----w c:\program files\AMD
2008-12-30 23:32 --------- d-----w c:\program files\ASUS
2008-12-30 23:24 --------- d-----w c:\program files\Avira
2008-12-30 23:24 --------- d-----w c:\documents and settings\All Users\Application Data\Avira
2008-12-30 23:21 --------- d-----w c:\program files\ATI Technologies
2008-12-30 23:18 --------- d-----w c:\program files\Common Files\ATI Technologies
2008-12-30 22:58 315,392 ----a-w c:\windows\HideWin.exe
2008-12-20 23:15 826,368 ----a-w c:\windows\system32\wininet.dll
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

---- Directory of c:\windows\system32\VHCDYYMYF ----

c:\windows\system32\VHCDYYMYF\

((((((((((((((((((((((((((((( SnapShot@2009-02-23_12.28.57,53 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-02-23 22:04:44 819,200 ----a-w c:\windows\gmer.dll
+ 2008-01-18 19:31:10 757,760 ----a-w c:\windows\gmer.exe
- 2008-04-14 02:42:06 8,461,312 -c--a-w c:\windows\system32\dllcache\shell32.dll
+ 2008-06-17 19:02:19 8,461,312 -c--a-w c:\windows\system32\dllcache\shell32.dll
+ 2009-02-23 22:04:44 85,713 ----a-w c:\windows\system32\drivers\gmer.sys
- 2009-02-23 11:18:08 71,138 ----a-w c:\windows\system32\perfc009.dat
+ 2009-02-26 11:34:36 71,138 ----a-w c:\windows\system32\perfc009.dat
- 2009-02-23 11:18:08 440,820 ----a-w c:\windows\system32\perfh009.dat
+ 2009-02-26 11:34:36 440,820 ----a-w c:\windows\system32\perfh009.dat
- 2008-04-14 02:42:06 8,461,312 ----a-w c:\windows\system32\shell32.dll
+ 2008-06-17 19:02:19 8,461,312 ----a-w c:\windows\system32\shell32.dll
- 2008-07-09 07:38:24 17,272 ------w c:\windows\system32\spmsg.dll
+ 2007-11-30 11:18:51 17,272 ------w c:\windows\system32\spmsg.dll
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-13 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-13 455168]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-01-01 136600]
"LXCECATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\LXCEtime.dll" [2005-07-20 73728]
"EzPrint"="c:\program files\Lexmark 4300 Series\ezprint.exe" [2005-07-26 94208]
"FreePDF Assistant"="c:\program files\FreePDF_XP\fpassist.exe" [2007-06-26 312320]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.lsgc"= lsgc.dll
"vidc.ffds"= c:\progra~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\8169Diag]
--a------ 2008-01-24 15:12 139264 c:\program files\Realtek\Diagnostics Utility\8169Diag.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-10-15 01:04 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Autorun Eater]
--a------ 2008-11-27 02:19 501768 c:\program files\Autorun Eater\oldmcdonald.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EzPrint]
--a------ 2005-07-26 13:17 94208 c:\program files\Lexmark 4300 Series\ezprint.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FaxCenterServer]
--a------ 2005-07-12 10:36 299008 c:\program files\Lexmark Fax Solutions\fm3032.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FreePDF Assistant]
--a------ 2007-06-26 20:27 312320 c:\program files\FreePDF_XP\fpassist.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
--a------ 2008-04-13 20:13 208952 c:\windows\ime\IMJP8_1\imjpmig.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
--a------ 2007-11-26 14:54 1057064 c:\program files\Nero\Nero 7\InCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
--a------ 2007-01-08 22:17 52256 c:\program files\CyberLink\PowerDVD\Language\Language.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LGODDFU]
--a------ 2008-12-31 03:14 548864 c:\program files\lg_fwupdate\fwupdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lxcemon.exe]
--a------ 2005-08-02 18:45 192512 c:\program files\Lexmark 4300 Series\lxcemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2007-03-01 14:57 153136 c:\program files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-09-06 15:09 413696 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--------- 2007-03-14 21:01 71216 c:\program files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SecurDisc]
--a------ 2007-11-26 14:54 1629480 c:\program files\Nero\Nero 7\InCD\NBHGui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
-r------- 2008-01-29 08:47 16859648 c:\windows\RTHDCPL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WLSetupSvc"=3 (0x3)
"usnjsvc"=3 (0x3)
"RQHBQTV"=3 (0x3)
"RO"=3 (0x3)
"RichVideo"=2 (0x2)
"HBWIU"=3 (0x3)
"GRGZXZ"=3 (0x3)
"EKJMVGEPP"=3 (0x3)
"NBService"=3 (0x3)
"InCDsrv"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Miranda IM\\miranda32.exe"=
"c:\\Documents and Settings\\Skull\\Desktop\\New Folder\\Miranda\\miranda32.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitdm.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitnet.exe"=
"d:\\Studium\\Programmieren\\Java\\eclipse\\eclipse.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R2 LANPkt;Realtek LANPkt Protocol Driver;c:\windows\system32\drivers\LANPkt.sys [2008-12-31 8960]
R3 AtiHdmiService;ATI Function Driver for HDMI Service;c:\windows\system32\drivers\AtiHdmi.sys [2007-07-20 84992]
S2 AMDRAIDXpert;AMD RAIDXpert;c:\program files\AMD\RAIDXpert\jetty\extra\win32\Wrapper.exe [2003-09-29 110592]
S3 Diag69xp;Diag69xp;c:\windows\system32\drivers\diag69xp.sys [2008-12-31 11264]
S3 RTLVLAN;Realtek VLAN Intermediate Driver;c:\windows\system32\drivers\RTLVLAN.SYS [2008-12-31 16640]
S4 EKJMVGEPP;EKJMVGEPP;c:\docume~1\Skull\LOCALS~1\Temp\EKJMVGEPP.exe --> c:\docume~1\Skull\LOCALS~1\Temp\EKJMVGEPP.exe [?]
S4 GRGZXZ;GRGZXZ;c:\docume~1\Skull\LOCALS~1\Temp\GRGZXZ.exe --> c:\docume~1\Skull\LOCALS~1\Temp\GRGZXZ.exe [?]
S4 HBWIU;HBWIU;c:\docume~1\Skull\LOCALS~1\Temp\HBWIU.exe --> c:\docume~1\Skull\LOCALS~1\Temp\HBWIU.exe [?]
S4 RO;RO;c:\docume~1\Skull\LOCALS~1\Temp\RO.exe --> c:\docume~1\Skull\LOCALS~1\Temp\RO.exe [?]
S4 RQHBQTV;RQHBQTV;c:\docume~1\Skull\LOCALS~1\Temp\RQHBQTV.exe --> c:\docume~1\Skull\LOCALS~1\Temp\RQHBQTV.exe [?]
.
Inhalt des "geplante Tasks" Ordners

2009-01-03 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.com/
IE: &Download by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204
IE: Do&wnload selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202
FF - ProfilePath - c:\documents and settings\Skull\Application Data\Mozilla\Firefox\Profiles\z0sdjxgb.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-26 22:14:40
Windows 5.1.2600 Service Pack 3 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
LXCECATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\LXCEtime.dll,_RunDLLEntry@16??????????????????????????????????????????????????????????????????????????????? ????????????????????????????????????????????????????????????????????????????????????????????????????

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

- - - - - - - > 'winlogon.exe'(752)
c:\windows\system32\Ati2evxx.dll
.
Zeit der Fertigstellung: 2009-02-26 22:15:21
ComboFix-quarantined-files.txt 2009-02-26 21:15:19
ComboFix2.txt 2009-02-26 18:25:49
ComboFix3.txt 2009-02-26 18:19:21
ComboFix4.txt 2009-02-25 20:02:13
ComboFix5.txt 2009-02-26 21:13:39

Vor Suchlauf: 2.104.913.920 bytes free
Nach Suchlauf: 2,094,407,680 bytes free

268 --- E O F --- 2009-02-25 22:40:36

Warsta · 01.03.2009, 23:24

Hi, wenn hier niemand Zeit hat für mich, oder mein Problem schon behoben ist, wäre es nett, wenn mir jemand davon berichten könnte ^^.
Oder soll ich in ein anderes Forum gehen? Ich will hier die Leute nicht unnötig belasten, wenn sie überhautpt keine Zeit haben! (nicht ironisch gemeint)

Warsta · 24.03.2009, 21:22

Hiiiiiiiiiiiiiiiiiiiiiiiiiiilfeeeeeeeeeeeeeeeeeeeeeeeee ^^

ich hab noch immer ein Virus ... wurde jetzt beim neuen Avira scan jetzt wieder festgestellt. Hat denn wirklich niemand Zeit für mich??

Kaos · 24.03.2009, 22:16

Ich denke Sunny wird sich noch melden. Aber was du jetzt erstmal machen könntest:

ATF-Cleaner laden. Das Programm braucht nicht installiert zu werden und du kannst es direkt starten. Schliesse vorher alle offenen Programme. Starte nun ATF-Cleaner und drücke auf "Select all", danach auf "Empty selected" und anschließend kannst du es beenden.

Danach lässt du CCleaner alles bereinigen.

Malwarebytes updaten und laufen lassen und die gefundenen Dateien löschen. Behalte sie aber vorerst in der Quarantäne, da Malwarebytes gelegentlich auch legitime Dateien löscht.

Zum Schluss lese dir die Anleitung von SUPERAntiSpyware durch und führe es so aus. (Updaten nicht vergessen).

Ein neues HijackThis Logfile erstellen

Die Logs hier reinstellen.

mfg, Kaos

USB-Stick infiziert?

Plagegeister aller Art und deren Bekämpfung: USB-Stick infiziert?