Trojaner-Board - Nach Trojaner-Befall Probleme mit einigen Seiten

Hey, erstmal danke für deine Antwort ;)

Log von Malwarebytes:

Malwarebytes' Anti-Malware 1.25
Datenbank Version: 1065
Windows 5.1.2600 Service Pack 2

12:43:38 18.08.2008
mbam-log-08-18-2008 (12-43-38).txt

Scan-Methode: Vollständiger Scan (I:\|)
Durchsuchte Objekte: 104349
Laufzeit: 23 minute(s), 35 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 5
Infizierte Registrierungsschlüssel: 16
Infizierte Registrierungswerte: 1
Infizierte Dateiobjekte der Registrierung: 2
Infizierte Verzeichnisse: 0
Infizierte Dateien: 28

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
I:\WINDOWS\system32\awtsRiFv.dll (Trojan.Vundo.H) -> Delete on reboot.
I:\WINDOWS\system32\kumxuqdk.dll (Trojan.Vundo.H) -> Delete on reboot.
I:\WINDOWS\system32\pbsfxyhb.dll (Trojan.Vundo.H) -> Delete on reboot.
I:\WINDOWS\system32\viywxiqo.dll (Trojan.Vundo.H) -> Delete on reboot.
I:\WINDOWS\system32\ghdflp.dll (Trojan.Vundo.H) -> Delete on reboot.

Infizierte Registrierungsschlüssel:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6bc03760-586e-4d52-9fca-b4ac1415bf16} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ddcaqnde (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{6bc03760-586e-4d52-9fca-b4ac1415bf16} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{81eb7b74-e8b5-4646-aac8-226c47c7041c} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{81eb7b74-e8b5-4646-aac8-226c47c7041c} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c8c8a544-9d14-4ab4-94c4-cf6daa04cec1} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c8c8a544-9d14-4ab4-94c4-cf6daa04cec1} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\AntiMalwareGuard (Rogue.AntiMalwareGuard) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\xpre (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Trojan.Vundo) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\000000af (Trojan.Vundo.H) -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: i:\windows\system32\awtsrifv -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo.H) -> Data: i:\windows\system32\awtsrifv -> Delete on reboot.

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
I:\WINDOWS\system32\ddcAqNdE.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
I:\WINDOWS\system32\awtsRiFv.dll (Trojan.Vundo.H) -> Delete on reboot.
I:\WINDOWS\system32\vFiRstwa.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
I:\WINDOWS\system32\vFiRstwa.ini2 (Trojan.Vundo.H) -> Delete on reboot.
I:\WINDOWS\system32\ghdflp.dll (Trojan.Vundo.H) -> Delete on reboot.
I:\WINDOWS\system32\kumxuqdk.dll (Trojan.Vundo.H) -> Delete on reboot.
I:\WINDOWS\system32\kdquxmuk.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
I:\WINDOWS\system32\pbsfxyhb.dll (Trojan.Vundo.H) -> Delete on reboot.
I:\WINDOWS\system32\bhyxfsbp.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
I:\WINDOWS\system32\viywxiqo.dll (Trojan.Vundo.H) -> Delete on reboot.
I:\Dokumente und Einstellungen\****\Lokale Einstellungen\Temp\ProductPath\runbst.exe (Rogue.Installer) -> Quarantined and deleted successfully.
I:\Dokumente und Einstellungen\****\Lokale Einstellungen\Temporary Internet Files\Content.IE5\0PYLWZU7\kb767887[1] (Trojan.Vundo.H) -> Quarantined and deleted successfully.
I:\Dokumente und Einstellungen\****\Lokale Einstellungen\Temporary Internet Files\Content.IE5\SZI3UTK9\kb456456[1] (Trojan.Vundo.H) -> Quarantined and deleted successfully.
I:\System Volume Information\_restore{600E3424-209F-4216-8F10-79B523A0D5DC}\RP30\A0004706.exe (Rogue.Installer) -> Quarantined and deleted successfully.
I:\WINDOWS\system32\uykpnvoy.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
I:\WINDOWS\system32\fesuan.dll (Trojan.Vundo.H) -> Delete on reboot.
I:\WINDOWS\system32\fhxdrwyt.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
I:\WINDOWS\system32\kkfuqwme.dll (Trojan.Vundo.H) -> Delete on reboot.
I:\WINDOWS\system32\lhldfnrk.dll (Trojan.Vundo.H) -> Delete on reboot.
I:\WINDOWS\system32\shyolyic.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
I:\WINDOWS\system32\ucrpvjex.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
I:\WINDOWS\system32\mcrh.tmp (Malware.Trace) -> Quarantined and deleted successfully.
I:\WINDOWS\cookies.ini (Malware.Trace) -> Quarantined and deleted successfully.
I:\Dokumente und Einstellungen\****\Anwendungsdaten\Microsoft\Internet Explorer\Quick Launch\AntiMalwareGuard.lnk (Rogue.AntiMalwareGuard) -> Quarantined and deleted successfully.
I:\WINDOWS\pskt.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
I:\WINDOWS\BM3f24eae3.xml (Trojan.Vundo) -> Quarantined and deleted successfully.
I:\WINDOWS\BM3f24eae3.txt (Trojan.Vundo) -> Quarantined and deleted successfully.
I:\Dokumente und Einstellungen\****\Lokale Einstellungen\Temp\wavvsnet.exe (Trojan.Agent) -> Quarantined and deleted successfully.

und ein neues HJT-Log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:49:45, on 18.08.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
I:\WINDOWS\System32\smss.exe
I:\WINDOWS\system32\winlogon.exe
I:\WINDOWS\system32\services.exe
I:\WINDOWS\system32\lsass.exe
I:\WINDOWS\system32\Ati2evxx.exe
I:\WINDOWS\system32\svchost.exe
I:\WINDOWS\System32\svchost.exe
I:\WINDOWS\system32\Ati2evxx.exe
I:\WINDOWS\system32\spoolsv.exe
I:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
I:\WINDOWS\Explorer.EXE
I:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
I:\WINDOWS\eHome\ehRecvr.exe
I:\WINDOWS\eHome\ehSched.exe
I:\WINDOWS\system32\dllhost.exe
I:\WINDOWS\system32\wscntfy.exe
I:\WINDOWS\ehome\ehtray.exe
I:\Programme\Java\j2re1.4.2_05\bin\jusched.exe
I:\WINDOWS\system32\RunDll32.exe
I:\WINDOWS\eHome\ehmsas.exe
I:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe
I:\WINDOWS\system32\ctfmon.exe
I:\Programme\Mozilla Firefox\firefox.exe
I:\Programme\Malwarebytes' Anti-Malware\mbam.exe
I:\WINDOWS\system32\NOTEPAD.EXE
I:\Programme\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - I:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {0F751416-8CCF-4100-9A81-C8ED178A426D} - (no file)
O2 - BHO: (no name) - {7820ed96-40a7-453d-b217-5594a27f731d} - (no file)
O2 - BHO: {42bf6947-0544-7c3a-8e44-07626c7b6fcf} - {fcf6b7c6-2670-44e8-a3c7-44507496fb24} - I:\WINDOWS\system32\fesuan.dll (file missing)
O3 - Toolbar: (no name) - {D0943516-5076-4020-A3B5-AEFAF26AB263} - (no file)
O4 - HKLM\..\Run: [ehTray] I:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [Verknüpfung mit der High Definition Audio-Eigenschaftenseite] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] I:\Programme\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [PinnacleDriverCheck] I:\WINDOWS\system32\PSDrvCheck.exe
O4 - HKLM\..\Run: [StartCCC] "I:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [avgnt] "I:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SpyHunter Security Suite] I:\Programme\Enigma Software Group\SpyHunter\SpyHunter3.exe
O4 - HKCU\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] I:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - I:\Programme\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - I:\Programme\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - I:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - I:\Programme\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{02E2689A-6BF8-463A-BD26-AD8ABD07F3BB}: NameServer = 192.168.100.3,192.168.100.4
O17 - HKLM\System\CS1\Services\Tcpip\..\{02E2689A-6BF8-463A-BD26-AD8ABD07F3BB}: NameServer = 192.168.100.3,192.168.100.4
O17 - HKLM\System\CS2\Services\Tcpip\..\{02E2689A-6BF8-463A-BD26-AD8ABD07F3BB}: NameServer = 192.168.100.3,192.168.100.4
O20 - AppInit_DLLs: fesuan.dll
O23 - Service: Avira AntiVir Personal - Free Antivirus Planer (AntiVirScheduler) - Avira GmbH - I:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - I:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - I:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - I:\WINDOWS\system32\ati2sgag.exe

--
End of file - 4321 bytes