Trojaner-Board - Build.exe, Build2.exe --> Virus?

Hi,
Folgendes Problem ist mir nach meinem letzten Viren scann aufgefallen.
Unter C:\ wurde eine Build2.exe gefunden Antivir meint dazu :

Code:

Die Datei 'C:\Build2.exe'

enthielt einen Virus oder unerwünschtes Programm 'TR/Spy.Agent.gcb' [trojan].

Die Datei hab ich in Quarantäne verschoben.
Leider war die Datei nach kurzer zeit wieder da und mir is aufgefallen das im selben verzeichniss noch eine Build.exe liegt. Antivir hält diese datei jedoch für sauber. Virustotal sagt volgendes dazu:

Code:

Antivirus        Version        letzte aktualisierung        Ergebnis

a-squared        4.5.0.24        2009.07.21        Riskware.Hacktool.Keygen.office2007!IK

AhnLab-V3        5.0.0.2        2009.07.21        -

AntiVir        7.9.0.222        2009.07.21        -

Antiy-AVL        2.0.3.7        2009.07.17        -

Authentium        5.1.2.4        2009.07.21        -

Avast        4.8.1335.0        2009.07.21        -

AVG        8.5.0.387        2009.07.21        Generic12.BJJL

BitDefender        7.2        2009.07.22        -

CAT-QuickHeal        10.00        2009.07.21        Trojan.Agent.ATV

ClamAV        0.94.1        2009.07.21        -

Comodo        1729        2009.07.21        UnclassifiedMalware

DrWeb        5.0.0.12182        2009.07.22        -

eSafe        7.0.17.0        2009.07.21        Win32.Banker

eTrust-Vet        31.6.6631        2009.07.21        -

F-Prot        4.4.4.56        2009.07.21        -

F-Secure        8.0.14470.0        2009.07.21        -

Fortinet        3.120.0.0        2009.07.21        -

GData        19        2009.07.22        -

Ikarus        T3.1.1.64.0        2009.07.21        not-a-Virus.Hacktool.Keygen.office2007

Jiangmin        11.0.800        2009.07.21        -

K7AntiVirus        7.10.798        2009.07.21        Non-Virus:

Kaspersky        7.0.0.125        2009.07.22        -

McAfee        5683        2009.07.21        potentially unwanted program Generic PUP

McAfee+Artemis        5683        2009.07.21        potentially unwanted program Generic PUP

McAfee-GW-Edition        6.8.5        2009.07.21        Heuristic.LooksLike.Win32.Suspicious.C!92

Microsoft        1.4903        2009.07.22        -

NOD32        4265        2009.07.21        -

Norman        6.01.09        2009.07.21        W32/Smalltroj.JZOX

nProtect        2009.1.8.0        2009.07.21        -

Panda        10.0.0.14        2009.07.21        -

PCTools        4.4.2.0        2009.07.21        -

Prevx        3.0        2009.07.22        Medium Risk Malware

Rising        21.39.14.00        2009.07.22        -

Sophos        4.43.0        2009.07.21        Troj/Agent-GAU

Sunbelt        3.2.1858.2        2009.07.21        -

Symantec        1.4.4.12        2009.07.22        -

TheHacker        6.3.4.3.372        2009.07.21        Trojan/Agent.gen

TrendMicro        8.950.0.1094        2009.07.21        -

VBA32        3.12.10.8        2009.07.21        -

ViRobot        2009.7.21.1845        2009.07.21        -

VirusBuster        4.6.5.0        2009.07.21        -
 

weitere Informationen

File size: 237056 bytes

MD5...: a357c09f259edac1920375cb2df01545

SHA1..: 9323ff10e7ed5206e56a37780f16063273d61bc9

SHA256: 9eace85afdfc3d1fee53cf42907219b569ef77f47638360ecebcdd92f6b8830e

ssdeep: 6144:wFPlXB7Ic7tLbMTDoiN657uDVmjsN7fjGV:ilXBppHMTrjwjifKV<BR>

PEiD..: UPX 2.90 [LZMA] -&gt; Markus Oberhumer, Laszlo Molnar &amp; John Reiser

TrID..: File type identification<BR>Win32 EXE Yoda's Crypter (56.8%)<BR>Win32 Executable Generic (18.2%)<BR>Win32 Dynamic Link Library (generic) (16.2%)<BR>Generic Win/DOS Executable (4.2%)<BR>DOS Executable Generic (4.2%)

PEInfo: PE Structure information<BR><BR>( base data )<BR>entrypointaddress.: 0x9b0d0<BR>timedatestamp.....: 0x2a425e19 (Fri Jun 19 22:22:17 1992)<BR>machinetype.......: 0x14c (I386)<BR><BR>( 3 sections )<BR>name        viradd    virsiz   rawdsiz  ntrpy  md5<BR>            0x1000   0x65000       0x0   0.00  d41d8cd98f00b204e9800998ecf8427e<BR>.rdata     0x66000   0x36000   0x35400   7.93  c68db5fd66a131a2b0e0863341ff3a1f<BR>.rsrc      0x9c000    0x5000    0x4800   5.20  0e90922209ec2792d56daeed20f7f777<BR><BR>( 7 imports )  <BR>&gt; KERNEL32.DLL: LoadLibraryA, GetProcAddress, ExitProcess<BR>&gt; advapi32.dll: RegCloseKey<BR>&gt; comctl32.dll: ImageList_Add<BR>&gt; gdi32.dll: SaveDC<BR>&gt; oleaut32.dll: VariantCopy<BR>&gt; user32.dll: GetDC<BR>&gt; version.dll: VerQueryValueA<BR><BR>( 0 exports ) <BR>

PDFiD.: -

RDS...: NSRL Reference Data Set<BR>-

packers (Kaspersky): UPX

ThreatExpert info: &lt;a href='http://www.threatexpert.com/report.aspx?md5=a357c09f259edac1920375cb2df01545' target='_blank'&gt;http://www.threatexpert.com/report.aspx?md5=a357c09f259edac1920375cb2df01545&lt;/a&gt;

packers (F-Prot): UPX

Prevx info: &lt;a href='http://info.prevx.com/aboutprogramtext.asp?PX5=5B8E142F00B62ADB9EFF0302B3F0A700E14C8093' target='_blank'&gt;http://info.prevx.com/aboutprogramtext.asp?PX5=5B8E142F00B62ADB9EFF0302B3F0A700E14C8093&lt;/a&gt;

Zu guter Letzt noch mein Hijackthis Log :

Code:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 01:27:30, on 22.07.2009

Platform: Windows Vista SP2 (WinNT 6.00.1906)

MSIE: Internet Explorer v7.00 (7.00.6002.18005)

Boot mode: Normal
 

Running processes:

C:\Program Files (x86)\ASUS\AASP\1.00.67\aaCenter.exe

C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe

C:\Program Files (x86)\DAEMON Tools Lite\daemon.exe

D:\Steam\Steam.exe

C:\Program Files (x86)\Xfire\Xfire.exe

C:\Program Files (x86)\Creative\Shared Files\Module Loader\DLLML.exe

C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

C:\Program Files (x86)\Java\jre6\bin\jusched.exe

C:\Program Files (x86)\ASUS\AI Suite\AiNap\AiNap.exe

C:\Program Files (x86)\Creative\ShareDLL\CADI\NotiMan.exe

C:\Program Files (x86)\Winamp\winamp.exe

C:\Program Files (x86)\Trend Micro\HijackThis\HijackThis.exe
 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 

F2 - REG:system.ini: UserInit=userinit.exe

O1 - Hosts: ::1 localhost

O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll

O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll

O4 - HKLM\..\Run: [VolPanel] "C:\Program Files (x86)\Creative\Sound Blaster X-Fi Surround 5.1\Volume Panel\VolPanlu.exe" /r

O4 - HKLM\..\Run: [Module Loader] "C:\Program Files (x86)\Creative\Shared Files\Module Loader\DLLML.exe" -StartUpRun

O4 - HKLM\..\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [Ai Nap] "C:\Program Files (x86)\ASUS\AI Suite\AiNap\AiNap.exe"

O4 - HKLM\..\Run: [QFan Help] "C:\Program Files (x86)\ASUS\AI Suite\QFan3\QFanHelp.exe"

O4 - HKLM\..\Run: [Cpu Level Up help] "C:\Program Files (x86)\ASUS\AI Suite\CpuLevelUpHelp.exe"

O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe

O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\daemon.exe" -autorun

O4 - HKCU\..\Run: [Steam] "D:\Steam\Steam.exe" -silent

O4 - HKCU\..\Run: [HotSwap! Applet] "C:\Users\Admin\Desktop\HotSwap!.EXE"

O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe

O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')

O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')

O4 - Startup: Xfire.lnk = C:\Program Files (x86)\Xfire\Xfire.exe

O4 - Global Startup: Adobe Acrobat - Schnellstart.lnk = ?

O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe

O8 - Extra context menu item: An vorhandenes PDF anfügen - res://C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - res://C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - res://C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - res://C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - res://C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: In Adobe PDF konvertieren - res://C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~2\MICROS~1\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000

O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - res://C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - res://C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files (x86)\ICQ6.5\ICQ.exe

O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files (x86)\ICQ6.5\ICQ.exe

O13 - Gopher Prefix: 

O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://ccfiles.creative.com/Web/softwareupdate/su2/ocx/15107/CTPID.cab

O23 - Service: Adobe Version Cue CS3 {de_DE}  (Adobe Version Cue CS3) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe

O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)

O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

O23 - Service: ASP.NET-Zustandsdienst (aspnet_state) - Unknown owner - C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)

O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe

O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe

O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing)

O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe

O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~2\Symantec\LIVEUP~1\LUCOMS~1.EXE

O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)

O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: NetLimiter (nlsvc) - Locktime Software - C:\Program Files\NetLimiter 2 Pro\nlsvc.exe

O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files (x86)\Norton Ghost\Agent\VProSvc.exe

O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)

O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe

O23 - Service: PnkBstrB - Unknown owner - C:\Windows\system32\PnkBstrB.exe

O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)

O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)

O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)

O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)

O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe

O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Windows\SysWOW64\nvSCPAPISvr.exe

O23 - Service: SymSnapService - Symantec - C:\Program Files (x86)\Norton Ghost\Shared\Drivers\SymSnapServicex64.exe

O23 - Service: TeamViewer 4 (TeamViewer4) - TeamViewer GmbH - C:\Program Files (x86)\TeamViewer\Version4\TeamViewer_Service.exe

O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)

O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)

O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)

O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)

O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
 

--

End of file - 11001 bytes

Ach ja bevor ich vergess. Bei dem Antivir scann waren noch folgende weitere funde dabei:

Code:

Die Datei 'C:\Users\Admin\AppData\Local\Temp\server.exe'

enthielt einen Virus oder unerwünschtes Programm 'TR/Dropper.Gen' [trojan].

Die Datei 'C:\Users\Admin\AppData\Roaming\pUAKDR.exe'

enthielt einen Virus oder unerwünschtes Programm 'TR/Dropper.Gen' [trojan].

Die dateien hab ich beide von hand gelöscht und sind auch noch nicht wieder aufgetaucht.
So ich hoffe ihr könnt mir weiter helfen. würd echt gern wissen was es mit den beiden Dateien auf sich hat und wenn sie ein risiko sind wie ich sie loswerd.

MfG
GitL