Hallo,

Ich habe heute über mein Online-Banking-Telefonservice erfahren dass sich ein Trojaner auf dem Rechner befindet.

Nach einem Scan mit AVG habe ich den Trojaner: agent2.AGSV gefunden.
Leider habe ich dazu weder hier noch in Google was gefunden.

Jedoch habe ich ein hijackthis.log und ein random systems log und einen Malwarebytes report.

Ich kenne mich eigentlich garnicht aus mit dem beheben von solchen Problemen und hoffe mir kann jemand helfen.

Ich poste mal das rs und malwarebytes. Vielen Dank allen.
Gruß


Logfile of random's system information tool 1.06 (written by random/random)
Run by Trista Lacrima at 2010-01-27 18:59:24
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 4 GB (7%) free of 56 GB
Total RAM: 1023 MB (30% free)


======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
AVG Safe Search - C:\Programme\AVG\AVG8\avgssie.dll [2009-12-12 1111320]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
AVG Security Toolbar BHO - C:\Programme\AVG\AVG8\Toolbar\IEToolbar.dll [2009-06-14 1004800]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - c:\programme\google\googletoolbar2.dll [2008-08-27 2573944]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Programme\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll [2009-11-19 764912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Programme\Java\jre6\bin\jp2ssv.dll [2009-10-11 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-10-11 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EB5CEE80-030A-4ED8-8E20-454E9C68380F}]
BandooIEPlugin Class - C:\Programme\Bandoo\Plugins\IE\ieplugin.dll [2010-01-19 2074048]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - &Google - c:\programme\google\googletoolbar2.dll [2008-08-27 2573944]
{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - AVG Security Toolbar - C:\Programme\AVG\AVG8\Toolbar\IEToolbar.dll [2009-06-14 1004800]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SkyTel"=C:\WINDOWS\SkyTel.EXE [2006-05-16 2879488]
"SynTPEnh"=C:\Programme\Synaptics\SynTP\SynTPEnh.exe [2005-10-21 761945]
"IntelZeroConfig"=C:\Programme\Intel\Wireless\bin\ZCfgSvc.exe [2006-08-02 802816]
"IntelWireless"=C:\Programme\Intel\Wireless\Bin\ifrmewrk.exe [2006-08-02 696320]
"Power_Gear"=C:\Programme\ASUS\Power4 Gear\BatteryLife.exe [2006-03-06 86016]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2006-08-14 16050176]
"Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2005-05-03 69632]
"HControl"=C:\WINDOWS\ATK0100\HControl.exe [2006-07-28 110592]
"Wireless Console 2"=C:\Programme\Wireless Console 2\wcourier.exe [2005-10-17 987136]
"AVG8_TRAY"=C:\PROGRA~1\AVG\AVG8\avgtray.exe [2009-12-12 2043160]
"SunJavaUpdateSched"=C:\Programme\Java\jre6\bin\jusched.exe [2009-10-11 149280]
"QuickTime Task"=C:\Programme\QuickTime\qttask.exe [2008-11-04 413696]
" Malwarebytes Anti-Malware (reboot)"=C:\Programme\Malwarebytes' Anti-Malware\mbam.exe [2010-01-07 1394000]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"swg"=C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2008-02-08 68856]
"Msset"=C:\Dokumente und Einstellungen\Trista Lacrima\Anwendungsdaten\Adobe\Update\bltmmc.dat [2010-01-27 122368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="c:\progra~1\bandoo\bndhook.dll "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2006-08-02 86016]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avgrsstarter]
C:\WINDOWS\system32\avgrsstx.dll [2009-09-10 11952]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\aawservice]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Programme\Yahoo!\Messenger\YahooMessenger.exe"="C:\Programme\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\Programme\TeamViewer3\TeamViewer.exe"="C:\Programme\TeamViewer3\TeamViewer.exe:*:Enabled:TeamViewer Remote Control Application"
"C:\Programme\Messenger\MSMSGS.EXE"="C:\Programme\Messenger\MSMSGS.EXE:*:Enabled:Windows Messenger"
"C:\Programme\AVG\AVG8\avgupd.exe"="C:\Programme\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe"
"C:\Programme\AVG\AVG8\avgemc.exe"="C:\Programme\AVG\AVG8\avgemc.exe:*:Enabled:avgemc.exe"
"C:\Programme\ICQ6.5\ICQ.exe"="C:\Programme\ICQ6.5\ICQ.exe:*:Enabled:ICQ6"
"C:\Programme\Windows Live\Messenger\msnmsgr.exe"="C:\Programme\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Programme\Windows Live\Messenger\livecall.exe"="C:\Programme\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\Programme\Microsoft Office\Office12\ONENOTE.EXE"="C:\Programme\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\Programme\Mozilla Firefox\firefox.exe"="C:\Programme\Mozilla Firefox\firefox.exe:*:Enabled:Firefox"
"C:\Programme\Codemasters\Der Herr der Ringe Online\lotroclient.exe"="C:\Programme\Codemasters\Der Herr der Ringe Online\lotroclient.exe:*:Enabled:lotroclient"
"C:\Programme\VideoLAN\VLC\vlc.exe"="C:\Programme\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player"
"C:\Programme\Skype\Phone\Skype.exe"="C:\Programme\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Programme\Windows Live\Messenger\msnmsgr.exe"="C:\Programme\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Programme\Windows Live\Messenger\livecall.exe"="C:\Programme\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0e91ae46-f86a-11de-96c9-0018de96d36c}]
shell\AutoRun\command - F:\Launcher.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a639a3a4-9f26-11de-965d-0018de96d36c}]
shell\AutoRun\command - H:\AutoRun.exe


======List of files/folders created in the last 1 months======

2010-01-27 18:59:25 ----D---- C:\Programme\trend micro
2010-01-27 18:59:24 ----D---- C:\rsit
2010-01-27 13:58:40 ----D---- C:\Programme\CCleaner
2010-01-27 13:40:33 ----D---- C:\Programme\TrendMicro
2010-01-27 11:11:13 ----D---- C:\Dokumente und Einstellungen\Trista Lacrima\Anwendungsdaten\Malwarebytes
2010-01-27 11:10:59 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
2010-01-27 11:10:53 ----D---- C:\Programme\Malwarebytes' Anti-Malware
2010-01-23 17:45:27 ----D---- C:\Dokumente und Einstellungen\Trista Lacrima\Anwendungsdaten\Bandoo
2010-01-23 17:15:45 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Bandoo
2010-01-23 17:14:28 ----D---- C:\Programme\Bandoo
2010-01-14 02:58:20 ----HD---- C:\WINDOWS\$NtUninstallKB955759$
2010-01-14 02:58:10 ----HD---- C:\WINDOWS\$NtUninstallKB972270$
2010-01-13 21:22:59 ----D---- C:\Programme\IKEA HomePlanner
2010-01-13 02:32:45 ----D---- C:\Programme\Gemeinsame Dateien\PCSuite
2010-01-13 02:32:39 ----D---- C:\Programme\Gemeinsame Dateien\Nokia
2010-01-13 02:31:06 ----D---- C:\Programme\PC Connectivity Solution
2010-01-07 21:54:40 ----A---- C:\WINDOWS\uninst.exe
2010-01-03 18:11:31 ----D---- C:\Dokumente und Einstellungen\Trista Lacrima\Anwendungsdaten\PC Suite
2010-01-03 18:11:23 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC Suite
2010-01-03 18:11:22 ----D---- C:\Dokumente und Einstellungen\Trista Lacrima\Anwendungsdaten\Nokia
2010-01-03 15:22:02 ----D---- C:\Programme\DIFX
2010-01-03 15:21:38 ----A---- C:\WINDOWS\system32\nmwcdcls.dll
2010-01-03 15:21:37 ----D---- C:\Programme\Nokia
2010-01-03 14:16:15 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Installations

======List of files/folders modified in the last 1 months======

2010-01-27 12:31:36 ----A---- C:\WINDOWS\ModemLog_Motorola SM56 Speakerphone Modem.txt
2010-01-27 12:26:38 ----N---- C:\WINDOWS\SchedLgU.Txt
2010-01-26 08:34:18 ----A---- C:\WINDOWS\system32\user32.DLL
2010-01-05 01:17:46 ----A---- C:\WINDOWS\system32\MRT.exe
2009-12-30 03:20:04 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AvgLdx86;AVG AVI Loader Driver x86; C:\WINDOWS\System32\Drivers\avgldx86.sys [2009-09-10 335240]
R1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86; C:\WINDOWS\System32\Drivers\avgmfx86.sys [2009-09-10 27784]
R1 AvgTdiX;AVG8 Network Redirector; C:\WINDOWS\System32\Drivers\avgtdix.sys [2009-05-11 108552]
R1 intelppm;Intel-Prozessortreiber; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40448]
R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.5.3.0; C:\WINDOWS\system32\DRIVERS\AegisP.sys [2006-11-23 21419]
R2 atksgt;atksgt; C:\WINDOWS\system32\DRIVERS\atksgt.sys [2008-07-20 271360]
R2 lirsgt;lirsgt; C:\WINDOWS\system32\DRIVERS\lirsgt.sys [2008-07-20 18048]
R2 s24trans;WLAN Transport; C:\WINDOWS\system32\DRIVERS\s24trans.sys [2006-08-02 12544]
R3 Arp1394;1394-ARP-Clientprotokoll; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2006-08-02 1681920]
R3 CmBatt;Microsoft-Netzteiltreiber; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2008-04-13 13952]
R3 HDAudBus;Microsoft UAA-Bustreiber für High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2006-08-15 4368896]
R3 MODEMCSA;Unimodem-Datenstromfiltergerät; C:\WINDOWS\system32\drivers\MODEMCSA.sys [2001-08-17 16128]
R3 MTsensor;ATK0100 ACPI UTILITY; C:\WINDOWS\system32\DRIVERS\ATKACPI.sys [2005-02-17 5632]
R3 NETw3x32;Intel(R) PRO/Wireless 3945ABG Adaptertreiber für Windows XP 32 Bit; C:\WINDOWS\system32\DRIVERS\NETw3x32.sys [2006-07-26 1707776]
R3 NIC1394;1394-Netzwerktreiber; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 rimsptsk;rimsptsk; C:\WINDOWS\system32\DRIVERS\rimsptsk.sys [2005-07-12 51328]
R3 smserial;smserial; C:\WINDOWS\system32\DRIVERS\smserial.sys [2006-03-21 889472]
R3 SynTP;Synaptics TouchPad Driver; C:\WINDOWS\system32\DRIVERS\SynTP.sys [2005-10-21 191936]
R3 tap0901;TAP-Win32 Adapter V9; C:\WINDOWS\system32\DRIVERS\tap0901.sys [2009-10-01 25984]
R3 usbehci;Miniporttreiber für erweiterten Microsoft USB 2.0-Hostcontroller; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;USB2-aktivierter Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbuhci;Miniporttreiber für universellen Microsoft USB-Hostcontroller; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S1 kbdhid;Tastatur-HID-Treiber; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14720]
S2 adfs;adfs; C:\WINDOWS\system32\drivers\adfs.sys []
S3 a975weat;a975weat; C:\WINDOWS\system32\drivers\a975weat.sys []
S3 CCDECODE;Untertiteldecoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 HidUsb;Microsoft HID Class-Treiber; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2007-01-19 49920]
S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2007-01-19 16496]
S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2007-01-19 21568]
S3 ipswuio;ipswuio; C:\WINDOWS\System32\DRIVERS\ipswuio.sys [2006-01-24 34944]
S3 LVUSBSta;Logitech USB Monitor Filter; C:\WINDOWS\system32\drivers\lvusbsta.sys []
S3 mouhid;Maus-HID-Treiber; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-18 12288]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink-Konvertierung; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;NABTS/FEC VBI-Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Microsoft TV-/Videoverbindung; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]
S3 QCMerced;Logitech QuickCam Communicate; C:\WINDOWS\system32\DRIVERS\LVCM.sys []
S3 RTL8023xp;Realtek 10/100/1000 NIC Family all in one NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2005-11-16 78976]
S3 sdbus;sdbus; C:\WINDOWS\system32\DRIVERS\sdbus.sys [2008-04-13 79232]
S3 SIVDRIVER;SIV Kernel Driver; \??\C:\WINDOWS\system32\Drivers\SIVX32.sys []
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 streamip;BDA-IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 tap0801;TAP-Win32 Adapter V8; C:\WINDOWS\system32\DRIVERS\tap0801.sys [2006-10-01 26624]
S3 usbaudio;USB-Audiotreiber (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-13 60032]
S3 usbccgp;Microsoft Standard-USB-Haupttreiber; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 usbprint;Microsoft USB-Druckerklasse; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;USB-Scannertreiber; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;USB-Massenspeichertreiber; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WSTCODEC;World Standard Teletext-Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []
S4 MBAMSwissArmy;MBAMSwissArmy; \??\C:\WINDOWS\system32\drivers\mbamswissarmy.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aawservice;Lavasoft Ad-Aware Service; C:\Programme\Lavasoft\Ad-Aware\aawservice.exe [2008-10-09 611664]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2006-08-02 401408]
R2 avg8emc;AVG8 E-mail Scanner; C:\PROGRA~1\AVG\AVG8\avgemc.exe [2009-09-10 908056]
R2 avg8wd;AVG8 WatchDog; C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2009-09-10 297752]
R2 EvtEng;Intel(R) PROSet/Wireless Event Log; C:\Programme\Intel\Wireless\Bin\EvtEng.exe [2006-08-02 434176]
R2 JavaQuickStarterService;Java Quick Starter; C:\Programme\Java\jre6\bin\jqs.exe [2009-10-11 153376]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; c:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe [2006-04-24 73728]
R2 RegSrvc;Intel(R) PROSet/Wireless Registry Service; C:\Programme\Intel\Wireless\Bin\RegSrvc.exe [2006-08-02 327680]
R2 S24EventMonitor;Intel(R) PROSet/Wireless Service; C:\Programme\Intel\Wireless\Bin\S24EvMon.exe [2006-08-02 937984]
R2 UxTuneUp;TuneUp Designerweiterung; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
S2 Bandoo Coordinator;Bandoo Coordinator; C:\PROGRA~1\BANDOO\BANDOO.EXE [2010-01-19 1678272]
S2 Fax;Fax; C:\WINDOWS\system32\fxssvc.exe [2008-04-14 268800]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 gusvc;Google Software Updater; C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-03-25 183280]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 odserv;Microsoft Office Diagnostics Service; C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]
S3 OpenVPNService;OpenVPN Service; C:\Programme\OpenVPN\bin\openvpnserv.exe [2009-10-01 36352]
S3 ose;Office Source Engine; C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 ServiceLayer;ServiceLayer; C:\Programme\PC Connectivity Solution\ServiceLayer.exe [2009-10-27 657408]
S3 usnjsvc;Messenger USN Journal Reader-Service für freigegebene Ordner; C:\Programme\Windows Live\Messenger\usnsvc.exe [2007-10-18 98328]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

Malwarebytes' Anti-Malware 1.44
Datenbank Version: 3644
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

27.01.2010 12:25:25
mbam-log-2010-01-27 (12-25-25).txt

Scan-Methode: Vollständiger Scan (C:\|D:\|E:\|G:\|)
Durchsuchte Objekte: 190645
Laufzeit: 53 minute(s), 32 second(s)

Infizierte Speicherprozesse: 1
Infizierte Speichermodule: 1
Infizierte Registrierungsschlüssel: 15
Infizierte Registrierungswerte: 3
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 38

Infizierte Speicherprozesse:
C:\Dokumente und Einstellungen\Trista Lacrima\Anwendungsdaten\Adobe\Update\vidtray.exe (Malware.Packer) -> Unloaded process successfully.

Infizierte Speichermodule:
c:\WINDOWS\system32\termsrv.dll (Trojan.Patched) -> Delete on reboot.

Infizierte Registrierungsschlüssel:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18eab-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{25560540-9571-4d7b-9389-0f166788785a} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3dc201fb-e9c9-499c-a11f-23c360d7c3f8} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{9ff05104-b030-46fc-94b8-81276e4e27df} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59c7fc09-1c83-4648-b3e6-003d2bbc7481} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68af847f-6e91-45dd-9b68-d6a12c30e5d7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170b96c-28d4-4626-8358-27e6caeef907} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{d1a71fa0-ff48-48dd-9b6d-7a13a3e42127} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ddb1968e-ead6-40fd-8dae-ff14757f60c7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{f138d901-86f0-4383-99b6-9cdd406036da} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\termservice (Trojan.Patched) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\appitnt_dlls (Spyware.Agent.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\appidgt_dlls (Spyware.Agent.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\setms (Malware.Packer) -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\WINDOWS\system32\nmklo.dll (Spyware.Agent.H) -> Delete on reboot.
C:\Dokumente und Einstellungen\Trista Lacrima\Anwendungsdaten\Adobe\Update\vidtray.exe (Malware.Packer) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\qnyjg (Packed.Krap) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FBCDBC42-9971-493B-BB29-35ECA42557B2}\RP483\A0072247.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FBCDBC42-9971-493B-BB29-35ECA42557B2}\RP484\A0072270.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FBCDBC42-9971-493B-BB29-35ECA42557B2}\RP484\A0072281.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FBCDBC42-9971-493B-BB29-35ECA42557B2}\RP484\A0072355.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FBCDBC42-9971-493B-BB29-35ECA42557B2}\RP484\A0072367.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FBCDBC42-9971-493B-BB29-35ECA42557B2}\RP484\A0072376.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FBCDBC42-9971-493B-BB29-35ECA42557B2}\RP484\A0072398.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FBCDBC42-9971-493B-BB29-35ECA42557B2}\RP484\A0072409.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FBCDBC42-9971-493B-BB29-35ECA42557B2}\RP484\A0072418.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FBCDBC42-9971-493B-BB29-35ECA42557B2}\RP484\A0072427.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FBCDBC42-9971-493B-BB29-35ECA42557B2}\RP485\A0072469.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FBCDBC42-9971-493B-BB29-35ECA42557B2}\RP485\A0072488.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FBCDBC42-9971-493B-BB29-35ECA42557B2}\RP485\A0072505.exe (Trojan.Riern) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FBCDBC42-9971-493B-BB29-35ECA42557B2}\RP485\A0072515.exe (Trojan.Riern) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FBCDBC42-9971-493B-BB29-35ECA42557B2}\RP486\A0072538.exe (Trojan.Riern) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FBCDBC42-9971-493B-BB29-35ECA42557B2}\RP486\A0072547.exe (Trojan.Riern) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FBCDBC42-9971-493B-BB29-35ECA42557B2}\RP486\A0072558.exe (Trojan.Riern) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FBCDBC42-9971-493B-BB29-35ECA42557B2}\RP486\A0072566.exe (Trojan.Riern) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FBCDBC42-9971-493B-BB29-35ECA42557B2}\RP486\A0072577.exe (Trojan.Riern) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FBCDBC42-9971-493B-BB29-35ECA42557B2}\RP486\A0072588.exe (Malware.Packer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FBCDBC42-9971-493B-BB29-35ECA42557B2}\RP486\A0072607.exe (Malware.Packer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FBCDBC42-9971-493B-BB29-35ECA42557B2}\RP487\A0072626.exe (Malware.Packer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FBCDBC42-9971-493B-BB29-35ECA42557B2}\RP487\A0072645.exe (Malware.Packer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FBCDBC42-9971-493B-BB29-35ECA42557B2}\RP487\A0072653.exe (Malware.Packer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FBCDBC42-9971-493B-BB29-35ECA42557B2}\RP488\A0072657.DLL (Packed.Krap) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{FBCDBC42-9971-493B-BB29-35ECA42557B2}\RP488\A0072658.dll (Packed.Krap) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\termsrv.dll (Trojan.Patched) -> Delete on reboot.
C:\WINDOWS\system32\2346g.4e (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\bbri.few (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\few46dx.4e (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\wef6.gy (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\cooper.mine (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\msacm32.drv (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\wuasirvy.dll (Trojan.Banker) -> Quarantined and deleted successfully.
C:\WINDOWS\sdfixwcs.dll (Malware.Trace) -> Quarantined and deleted successfully.

Zitat von TearlessDust

Hallo,

Ich habe heute über mein Online-Banking-Telefonservice erfahren dass sich ein Trojaner auf dem Rechner befindet.

.

Guten Abend,

du musst diesen Bescheid deiner Bank sehr ernst nehmen. Es lohnt sich für dich dir sofort eine Image von deinem System zu erstellen und Logs von deinen Antimalwareprogrammen auf einem USB Stick zu speichern, damit du, sollte dein Konto von Kriminellen geleehrt worden sein/werden, beweisen kannst, dass dies durch Unbekannte geschehen ist.
Speicherabbild ? Wikipedia

> Danach formatiere deine Festplatte und führe eine Neuaufsetzung durch:
Lese dir diese Infos/Anleitung gründlich und in Ruhe durch:
Computersicherheit - Kompromittierung
http://www.trojaner-board.de/75455-b...mitierung.html
http://www.trojaner-board.de/51262-a...sicherung.html

lg.

Hallo,

Vielen Dank für die schnelle Antwort.
Ist das das einzige was ich machen kann? Gibt es da keine Übergangslösung? Eine möglichkeit den Trojaner zu entfernen vielleicht?

Liebe Grüße