Trojaner-Board - TR/Hijack.AE

Hallo,

habe Probleme mit o.g. Trojaner TR/Hijack.AE, der sich bei mir unter "C:\windows\system32\riched21.dll" eingenistet hat.

Meine Antivirensoftware (Avira Antivir) kann ihn leider nicht entfernen.
Achso, habe HP Home mit SP2.

1. Hab die Datei mit Virustotal.com/de untersucht mit dem Ergebnis:

Code:

File size: 19456 bytes

MD5...: 8ca3759d828e07fc186a4be0485ce2cb

SHA1..: db28b36f31714c4afaecfa9093a16bec74cd82be

SHA256: 03503637134d46dba77e16f88668c02f56dd1d7e1d4f60bd3efa7458c1fedd74

SHA512: 3fd724e32a3ae164bd8ee7e76125f876b22239e8db1611853d506e9bd04f6aca

d65836698b31b467d8dc3d29b9ec277dbe87baccec1f9e88302870819749b141

ssdeep: 384:Y4y/FZnNmk1hounra/ERk4T2mwcRTPlDArOdTYISxK8v/b:DkFZNuYra/ERk

DoAyTYdXz

PEiD..: Armadillo v1.xx - v2.xx

TrID..: File type identification

Win32 Executable MS Visual C++ (generic) (65.2%)

Win32 Executable Generic (14.7%)

Win32 Dynamic Link Library (generic) (13.1%)

Generic Win/DOS Executable (3.4%)

DOS Executable Generic (3.4%)

PEInfo: PE Structure information
 

( base data )

entrypointaddress.: 0x36004151

timedatestamp.....: 0xde392d31L (invalid)

machinetype.......: 0x14c (I386)
 

( 4 sections )

name viradd virsiz rawdsiz ntrpy md5

.text 0x1000 0x3c82 0x3e00 6.33 6006c52f9cf842968506a7882ba5de7c

.data 0x5000 0x13c 0x200 1.90 a9c47f21add80dd88f44de28f19e6a6d

.rsrc 0x6000 0x2e0 0x400 2.33 c16e7450c25f0cb8eb66fd8de7a0ebca

.reloc 0x7000 0x264 0x400 3.58 7dd464be2db863e1d0cf011fa39024f2
 

( 5 imports )

> ADVAPI32.dll: GetUserNameA

> USER32.dll: CharNextA, LoadStringA, wvsprintfA, CharLowerA

> KERNEL32.dll: GetModuleFileNameW, lstrcpyW, SystemTimeToFileTime, GetFileTime, DisableThreadLibraryCalls, GetTickCount, GetVersionExA, VirtualFree, WaitForSingleObject, IsBadReadPtr, GetModuleFileNameA, InterlockedIncrement, lstrlenA, lstrlenW, InterlockedDecrement, GetStringTypeExA, GetThreadLocale, CloseHandle, ReadFile, GetFileSize, CreateFileA, GetCurrentProcess, GetProcAddress, GetModuleHandleA, GetComputerNameA, VirtualAlloc, WriteProcessMemory, VirtualAllocEx, LoadLibraryA, CreateRemoteThread, VirtualProtect, Sleep, MoveFileExA, GetVolumeInformationA, FindClose, FindFirstFileA, GetWindowsDirectoryA, FreeLibrary, CreateThread, FreeLibraryAndExitThread, GetSystemTime

> WININET.dll: InternetCheckConnectionA, InternetOpenA, InternetConnectA, HttpOpenRequestA, HttpSendRequestA, InternetQueryDataAvailable, InternetReadFile, InternetCloseHandle, InternetCanonicalizeUrlA, InternetCrackUrlA, InternetGetConnectedState

> MSVCRT.dll: __2@YAPAXI@Z, realloc, __3@YAXPAX@Z, memset, _adjust_fdiv, malloc, _initterm, free, _except_handler3, memcpy
 

( 31 exports )

TSPI_lineAnswer, TSPI_lineClose, TSPI_lineDial, TSPI_lineDrop, TSPI_lineGetAddressCaps, TSPI_lineGetAddressID, TSPI_lineGetAddressStatus, TSPI_lineGetCallInfo, TSPI_lineGetCallStatus, TSPI_lineGetDevCaps, TSPI_lineGetDevConfig, TSPI_lineGetID, TSPI_lineGetIcon, TSPI_lineGetLineDevStatus, TSPI_lineGetNumAddressIDs, TSPI_lineMakeCall, TSPI_lineNegotiateTSPIVersion, TSPI_lineOpen, TSPI_lineSetAppSpecific, TSPI_lineSetDevConfig, TSPI_lineSetStatusMessages, TSPI_phoneNegotiateTSPIVersion, TSPI_providerEnumDevices, TSPI_providerGenericDialogData, TSPI_providerInit, TSPI_providerInstall, TSPI_providerShutdown, TSPI_providerUIIdentify, TUISPI_lineConfigDialog, TUISPI_lineConfigDialogEdit, TUISPI_providerInstall

2. Habe die Programme "Malwarebytes Antimalware" und "CCleaner" auf´m PC (falls euch das weiterhilft bzw. die Progs mir weiterhelfen).

3. Habe schonmal vorab ein Hijack-Logfile gemacht, Online-Auswertung findet nichts "Schlimmes".

Hijack-Logfile:

Code:

Logfile of HijackThis v1.99.1

Scan saved at 21:29:27, on 08.12.2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16735)
 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Programme\Avira\AntiVir PersonalEdition Premium\sched.exe

C:\Programme\Avira\AntiVir PersonalEdition Premium\avguard.exe

C:\Programme\Avira\AntiVir PersonalEdition Premium\avesvc.exe

C:\Programme\Avira\AntiVir PersonalEdition Premium\avmailc.exe

C:\Programme\Avira\AntiVir PersonalEdition Premium\AVWEBGRD.EXE

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\Mixer.exe

C:\Programme\QuickTime\qttask.exe

C:\Programme\Avira\AntiVir PersonalEdition Premium\avgnt.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\wkcalrem.exe

C:\Programme\Java\jre6\bin\jqs.exe

C:\Programme\Mozilla Firefox\firefox.exe

C:\DOKUME~1\XXXXX(~1\LOKALE~1\Temp\Temporäres Verzeichnis 2 für hijackthis.zip\HijackThis.exe
 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ish.de/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.ish.de/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://de.mcafee.com/apps/mpfplush5/de/mpfplush5/default.asp?affid=0-9&installtype=force&systempopup=true

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll

O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb03.exe

O4 - HKLM\..\Run: [WorksFUD] C:\Programme\Microsoft Works\wkfud.exe

O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Programme\Microsoft Works\WksSb.exe /AllUsers

O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Programme\Microsoft Works\WkDetect.exe

O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup

O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [CloneCDElbyCDFL] "C:\Programme\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL

O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Programme\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"

O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir PersonalEdition Premium\avgnt.exe" /min

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - Global Startup: Erinnerungen in Microsoft Works-Kalender.lnk = ?

O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE

O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\PartyGaming\PartyPoker\RunApp.exe

O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\PartyGaming\PartyPoker\RunApp.exe

O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe (file missing)

O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe (file missing)

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe

O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe

O10 - Broken Internet access because of LSP provider 'avsda.dll' missing

O11 - Options group: [INTERNATIONAL] International*

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: Avira AntiVir Premium MailGuard (AntiVirMailService) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Premium\avmailc.exe

O23 - Service: Avira AntiVir Premium Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Premium\sched.exe

O23 - Service: Avira AntiVir Premium Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Premium\avguard.exe

O23 - Service: Avira AntiVir Premium WebGuard (antivirwebservice) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Premium\AVWEBGRD.EXE

O23 - Service: Avira AntiVir Premium MailGuard Hilfsdienst (AVEService) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Premium\avesvc.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Unknown owner - C:\Programme\Java\jre6\bin\jqs.exe" -service -config "C:\Programme\Java\jre6\lib\deploy\jqs\jqs.conf (file missing)

O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - Unknown owner - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe (file missing)

Habe ansonsten mal noch nichts auf eigene Faust probiert.
Vielen Dank schonmal.