Trojaner-Board - Schon wieder ein infizierter

Hallo,

jetzt scheine ich immer wieder Leuten helfen zu müssen. Die beiden Studentinnen hatten Probleme mit Ihrem PC. Nach dem Hochfahren konnte man nichts mehr machen. Nach ein paar Neustarts ging es wieder. Irgendwann ging wieder gar nichts. Auf die Nachfrage Virenscanner, Updates, Firewall kam keine Antwort.
Erstmal AV installiert und Hijack laufen lassen.

Dann kam von AV einige Meldungen:

Code:

Start of scan:  Samstag, 5. Februar 2005  11:00
 

Memory test                          OK

Master boot record of hard disk HD0   OK

Master boot record of hard disk HD1   

      The record could not be read!

      Error code: 0x0057

Boot record of drive C:            OK
 

Drive: C:

Volume ID:   Serial No.: 748B-F5F4

C:\

  pagefile.sys

      Access denied! Error during file opening!

      This is a Windows swap file. This file is locked by Windows.

      Error code: 0x000D

      WARNING! Access error/file locked!

C:\Dokumente und Einstellungen\Sandra\Anwendungsdaten\Microsoft\Office\Zuletzt verwendet

  ???? (D).LNK

      Access denied! Error during file opening!

      Error code: 0x0016

      WARNING! Access error/file locked!

C:\Dokumente und Einstellungen\Sandra\Lokale Einstellungen\Temporary Internet Files\Content.IE5\537B154E

  axload[1].cab

  ArchiveType: CAB (Microsoft)

    --> axload.dll

        NOTE! Bad header

C:\Dokumente und Einstellungen\Sandra\Lokale Einstellungen\Temporary Internet Files\Content.IE5\G1KH67GH

  0,1518,suchcache-PB64-QV9FPSZBX0Y9U1BJRUdFTCtTUEVDSUFMJkFfVD1CJkFfQj0yMyUyRTEwJTJFMjAwNCZBX1Y9MjMlMkUwOSUyRTIwMDQmQV9aPTMwJkFfTz1TUE8rU1BJK0tTUC[2].html

      Access denied! Error during file opening!

      Error code: 0x0002

      WARNING! Access error/file locked!

Error! Could not change directory: System Volume Information

C:\WINDOWS

  Priggle[pgg-10240,de,5fb690418c053403c136e2d58789f182].exe

      [DETECTION] Contains the signature of a cost-incurring dialer DIAL/300507 (Dialer)

      WAS DELETED!

C:\WINDOWS\system32

  Afkbelpm.dll

      [DETECTION] Contains signature of the worm Worm/Korgo.dll.ac

      WAS DELETED!

  Bjcafmla.dll

      [DETECTION] Contains signature of the worm Worm/Korgo.dll.ac

      Could not be deleted!

  Jlnajden.exe

      [DETECTION] The Trojan horse TR/Spy.QuKart.NA

      Could not be deleted!

  Llieha32.exe

      [DETECTION] The Trojan horse TR/Spy.QuKart.NA

      WAS DELETED!

  phqghu.exe

      [DETECTION] The Trojan horse TR/Spy.QuKart.NA

      WAS DELETED!

  rbyei.exe

      [DETECTION] Contains signature of the worm Worm/Korgo.Q

      WAS DELETED!

C:\WINDOWS\system32\config

  default

      Access denied! Error during file opening!

      Error code: 0x000D

      WARNING! Access error/file locked!

  SAM

      Access denied! Error during file opening!

      Error code: 0x000D

      WARNING! Access error/file locked!

  SECURITY

      Access denied! Error during file opening!

      Error code: 0x000D

      WARNING! Access error/file locked!

  software

      Access denied! Error during file opening!

      Error code: 0x000D

      WARNING! Access error/file locked!

  system

      Access denied! Error during file opening!

      Error code: 0x000D

      WARNING! Access error/file locked!

C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\AEAJCL3D

  x[1].exe

      [DETECTION] Contains signature of the worm Worm/Korgo.Q

      WAS DELETED!
 

End of scan:  Samstag, 5. Februar 2005  11:25

Time taken:         25:12 min
 
 

2161 directories were scanned

68454 files were scanned

  10 warning messages were issued

   6 files were deleted

   0 files were repaired

   8 detections

Alle versucht zu löschen, teils erst nach Neustart. Jetzt sie die Log von Hijackthis so aus:

Code:

Logfile of HijackThis v1.99.0

Scan saved at 11:29:47, on 05.02.2005

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\System32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\System32\3Com_DMI\3CDMINIC.EXE

C:\Programme\AVPersonal\AVGUARD.EXE

C:\Programme\AVPersonal\AVWUPSRV.EXE

C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Programme\Analog Devices\SoundMAX\SMAgent.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\System32\TCAUDIAG.exe

C:\Programme\Gemeinsame Dateien\Sonic\Update Manager\sgtray.exe

C:\Programme\Analog Devices\SoundMAX\SMax4PNP.exe

C:\Programme\Analog Devices\SoundMAX\Smax4.exe

C:\Programme\EIZO\ScreenManager Pro for LCD\Lcdctrl.exe

C:\Programme\Microsoft Hardware\Mouse\point32.exe

C:\Programme\Microsoft Hardware\Keyboard\type32.exe

C:\WINDOWS\system32\dla\tfswctrl.exe

C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\Program Files\ASUS\Probe\AsusProb.exe

C:\Programme\AVPersonal\AVGNT.EXE

C:\Programme\Messenger\msmsgs.exe

C:\WINDOWS\System32\ctfmon.exe

C:\Programme\Telekom\Eumex 504PC USB\Capictrl.exe

C:\Dokumente und Einstellungen\Sandra\Desktop\HijackThis.exe
 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Programme\Canon\Easy-WebPrint\Toolband.dll

O4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG.exe -on

O4 - HKLM\..\Run: [StorageGuard] "C:\Programme\Gemeinsame Dateien\Sonic\Update Manager\sgtray.exe" /r

O4 - HKLM\..\Run: [SoundMAXPnP] C:\Programme\Analog Devices\SoundMAX\SMax4PNP.exe

O4 - HKLM\..\Run: [SoundMAX] "C:\Programme\Analog Devices\SoundMAX\Smax4.exe" /tray

O4 - HKLM\..\Run: [ScreenManager Pro for LCD] C:\Programme\EIZO\ScreenManager Pro for LCD\Lcdctrl.exe

O4 - HKLM\..\Run: [routcnf] C:\Programme\Telekom\Eumex 504PC USB\routcnf.exe

O4 - HKLM\..\Run: [POINTER] point32.exe

O4 - HKLM\..\Run: [IntelliType] "C:\Programme\Microsoft Hardware\Keyboard\type32.exe"

O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe

O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe

O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe

O4 - HKLM\..\Run: [AVGCtrl] "C:\Programme\AVPersonal\AVGNT.EXE" /min

O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe

O4 - Global Startup: CAPIControl.lnk = ?

O8 - Extra context menu item: Easy-WebPrint Drucken - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_Print.html

O8 - Extra context menu item: Easy-WebPrint Schnelldruck - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html

O8 - Extra context menu item: Easy-WebPrint Vorschau - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html

O8 - Extra context menu item: Easy-WebPrint Zu Druckliste hinzufügen - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html

O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Recherche-Assistent - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Encarta Researcher\EROPROJ.DLL

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O21 - SSODL: Web Event Logger - {79FEACFF-FFCE-815E-A900-316290B5B738} - C:\WINDOWS\System32\Bjcafmla.dll (file missing)

O23 - Service: 3Com DMI Agent - 3Com Corporation - C:\WINDOWS\System32\3Com_DMI\3CDMINIC.EXE

O23 - Service: AntiVir Service - H+BEDV Datentechnik GmbH - C:\Programme\AVPersonal\AVGUARD.EXE

O23 - Service: Ati HotKey Poller - Unknown - C:\WINDOWS\System32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: AntiVir Update - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE

O23 - Service: SoundMAX Agent Service - Analog Devices, Inc. - C:\Programme\Analog Devices\SoundMAX\SMAgent.exe

Was ist den

Code:

tfswctrl.exe

?
Im Ordner heißt es zu ein paar Dateien "Direct Access Component Sonic Coorp". Da sie einen DVD Brenner mit Sonic Software haben denke ich aber, das das in Ordnung ist.
Seht Ihr noch was.

Gruss
Malte