Trojaner-Board - Was bedeutet das?

1.)

HTML-Code:

[code] Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 21:01:49, on 10.09.2008

Platform: Windows Vista SP1 (WinNT 6.00.1905)

MSIE: Internet Explorer v7.00 (7.00.6001.18000)

Boot mode: Normal
 

Running processes:

C:\Windows\system32\Dwm.exe

C:\Windows\system32\taskeng.exe

C:\Windows\Explorer.EXE

E:\Programme\Synaptics\SynTP\SynTPEnh.exe

C:\Windows\RtHDVCpl.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

C:\Program Files\lg_swupdate\GiljabiStart.exe

C:\Program Files\LG Software\LG OSD\HotKey.exe

E:\Programme\iTunes\iTunesHelper.exe

E:\Programme\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe

C:\Program Files\Mozilla Firefox\firefox.exe

E:\Programme\Synaptics\SynTP\SynTPHelper.exe

E:\Programme\QIP Infium\infium.exe

C:\Windows\system32\extrac32.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Windows\system32\SearchFilterHost.exe

C:\Users\Saturn\Desktop\HiJackThis.exe
 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.lge.com

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.lge.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.lge.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 

O1 - Hosts: ::1 localhost

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - E:\Programme\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Programme\Java\jre1.6.0_03\bin\ssv.dll

O4 - HKLM\..\Run: [SynTPEnh] E:\Programme\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe

O4 - HKLM\..\Run: [LG Intelligent Update] "C:\Program Files\lg_swupdate\giljabistart.exe" Gilautouc

O4 - HKLM\..\Run: [KeybdUtility] C:\Program Files\LG Software\LG OSD\HotKey.exe

O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

O4 - HKLM\..\Run: [iTunesHelper] "E:\Programme\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [AVP] "E:\Programme\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"

O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')

O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')

O8 - Extra context menu item: Alles mit FDM herunterladen - file://E:\Programme\Free Download Manager\dlall.htm

O8 - Extra context menu item: Auswahl mit FDM herunterladen - file://E:\Programme\Free Download Manager\dlselected.htm

O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

O8 - Extra context menu item: Datei mit FDM herunterladen - file://E:\Programme\Free Download Manager\dllink.htm

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O8 - Extra context menu item: Hinzufügen zu Anti-Banner - E:\Programme\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm

O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~3\MICROS~1\Office12\EXCEL.EXE/3000

O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O8 - Extra context menu item: Videos mit FDM herunterladen - file://E:\Programme\Free Download Manager\dlfvideo.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Programme\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Programme\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra button: Statistik für den Schutz des Web-Datenverkehrs - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - E:\Programme\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~3\MICROS~1\Office12\REFIEBAR.DLL

O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\ICQ6\ICQ.exe

O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\ICQ6\ICQ.exe

O13 - Gopher Prefix: 

O20 - AppInit_DLLs: E:\PROGRA~2\KASPER~1\KASPER~1\mzvkbd.dll,E:\PROGRA~2\KASPER~1\KASPER~1\mzvkbd3.dll,E:\PROGRA~2\KASPER~1\KASPER~1\adialhk.dll,E:\PROGRA~2\KASPER~1\KASPER~1\kloehk.dll

O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - E:\Programme\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe

O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe

O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - E:\Programme\iPod\bin\iPodService.exe

O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe

O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe

O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe

O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - E:\Programme\Windows Media Player\wmpnetwk.exe (file missing)
 

--

End of file - 7236 bytes

[/code]

2.)

HTML-Code:

[code] Datei up_temp_tmp.xml empfangen 2008.09.10 21:03:14 (CET)

Status: Laden ... Wartend Warten Überprüfung Beendet Nicht gefunden Gestoppt

Ergebnis: 0/36 (0%)

Laden der Serverinformationen...

Ihre Datei wartet momentan auf Position: ___.

Geschätzte Startzeit is zwischen ___ und ___ .

Dieses Fenster bis zum Abschluss des Scans nicht schließen.

Der Scanner, welcher momentan Ihre Datei bearbeitet ist momentan gestoppt. Wir warten einige Sekunden um Ihr Ergebnis zu erstellen.

Falls Sie längern als fünf Minuten warten, versenden Sie bitte die Datei erneut.

Ihre Datei wird momentan von VirusTotal überprüft,

Ergebnisse werden sofort nach der Generierung angezeigt.

Filter Filter

Drucken der Ergebnisse Drucken der Ergebnisse

Datei existiert nicht oder dessen Lebensdauer wurde überschritten

Dienst momentan gestoppt. Ihre Datei befindet sich in der Warteschlange (position: ). Diese wird abgearbeitet, wenn der Dienst wieder startet.
 

SIe können auf einen automatischen reload der homepage warten, oder ihre email in das untere formular eintragen. Klicken Sie auf "Anfragen", damit das System sie benachrichtigt wenn die Überprüfung abgeschlossen ist.

Email:         

        

Antivirus         Version         letzte aktualisierung         Ergebnis

AhnLab-V3        2008.9.6.0        2008.09.10        -

AntiVir        7.8.1.28        2008.09.10        -

Authentium        5.1.0.4        2008.09.10        -

Avast        4.8.1195.0        2008.09.10        -

AVG        8.0.0.161        2008.09.10        -

BitDefender        7.2        2008.09.10        -

CAT-QuickHeal        9.50        2008.09.10        -

ClamAV        0.93.1        2008.09.10        -

DrWeb        4.44.0.09170        2008.09.10        -

eSafe        7.0.17.0        2008.09.10        -

eTrust-Vet        31.6.6080        2008.09.09        -

Ewido        4.0        2008.09.10        -

F-Prot        4.4.4.56        2008.09.09        -

F-Secure        8.0.14332.0        2008.09.10        -

Fortinet        3.112.0.0        2008.09.10        -

GData        19        2008.09.10        -

Ikarus        T3.1.1.34.0        2008.09.10        -

K7AntiVirus        7.10.450        2008.09.10        -

Kaspersky        7.0.0.125        2008.09.10        -

McAfee        5381        2008.09.10        -

Microsoft        1.3903        2008.09.10        -

NOD32v2        3429        2008.09.09        -

Norman        5.80.02        2008.09.10        -

Panda        9.0.0.4        2008.09.10        -

PCTools        4.4.2.0        2008.09.10        -

Prevx1        V2        2008.09.10        -

Rising        20.61.22.00        2008.09.10        -

Sophos        4.33.0        2008.09.10        -

Sunbelt        3.1.1616.1        2008.09.09        -

Symantec        10        2008.09.10        -

TheHacker        6.3.0.9.077        2008.09.10        -

TrendMicro        8.700.0.1004        2008.09.10        -

VBA32        3.12.8.5        2008.09.10        -

ViRobot        2008.9.10.1371        2008.09.10        -

VirusBuster        4.5.11.0        2008.09.10        -

Webwasher-Gateway        6.6.2        2008.09.10        -

weitere Informationen

File size: 102597 bytes

MD5...: 92ac64fea320ed617e8dc887167a03c0

SHA1..: ccafd95efb7bd02c3ec9cef7a8da17f67808cb37

SHA256: 8e11c481dfaf950f07f71e120b69426d7b2d3faa64f27de2b1946d3aa9667c37

SHA512: fc52c68db8b7c3b8caed6f8500373597d7087f12b06c84eaf90fbeabb289aaf4

e55ea9c4b16e3f10e78dcd2cea5d9633d4858cb01e7e0d9d1959c26234d295e6

PEiD..: -

TrID..: File type identification

file seems to be plain text/ASCII (0.0%)

PEInfo: - [/code]

3.)

HTML-Code:

[code]Stealth MBR rootkit detector 0.2.4 by Gmer, http://www.gmer.net
 

device: opened successfully

user: MBR read successfully

kernel: MBR read successfully

user & kernel MBR OK [/code]

4.) Blacklight hat nichts gefunden:

HTML-Code:

[code]09/10/08 21:10:13 [Info]: BlackLight Engine 1.0.70 initialized

09/10/08 21:10:13 [Info]: OS: 6.0 build 6001 (Service Pack 1)

09/10/08 21:10:14 [Note]: 7019 4

09/10/08 21:10:14 [Note]: 7005 0

09/10/08 21:10:19 [Note]: 7006 0

09/10/08 21:10:19 [Note]: 7027 0

09/10/08 21:10:20 [Note]: 7035 0

09/10/08 21:10:20 [Note]: 7026 0

09/10/08 21:10:20 [Note]: 7026 0

09/10/08 21:10:22 [Note]: FSRAW library version 1.7.1024

09/10/08 21:10:32 [Note]: 4015 70757

09/10/08 21:10:32 [Note]: 4027 70757 262144

09/10/08 21:10:32 [Note]: 4020 70753 262144

09/10/08 21:10:32 [Note]: 4018 70753 262144

09/10/08 21:10:39 [Note]: 4015 57874

09/10/08 21:10:39 [Note]: 4027 57874 131072

09/10/08 21:10:39 [Note]: 4020 57863 983040

09/10/08 21:10:39 [Note]: 4018 57863 983040

09/10/08 21:10:40 [Note]: 4015 57874

09/10/08 21:10:40 [Note]: 4027 57874 131072

09/10/08 21:10:40 [Note]: 4020 57863 983040

09/10/08 21:10:40 [Note]: 4018 57863 983040

09/10/08 21:10:55 [Note]: 4015 2805

09/10/08 21:10:55 [Note]: 4027 2805 65536

09/10/08 21:10:55 [Note]: 4020 1284 65536

09/10/08 21:10:55 [Note]: 4018 1284 65536

09/10/08 21:10:59 [Note]: 4015 2899

09/10/08 21:10:59 [Note]: 4027 2899 65536

09/10/08 21:10:59 [Note]: 4020 2805 65536

09/10/08 21:10:59 [Note]: 4018 2805 65536

09/10/08 21:17:00 [Note]: 4015 30250

09/10/08 21:17:00 [Note]: 4027 30250 65536

09/10/08 21:17:00 [Note]: 4020 30249 131072

09/10/08 21:17:00 [Note]: 4022 30249

09/10/08 21:22:01 [Note]: 7007 0[/code]

Malwarebytes-Log

...wird nachgereicht, scan dauert schon ewig...