[TuT] Vermutliche Longju3 Infektionen beseitigen

[Mars2008]

ok thx

nur wie entferne ich die einträge richtig?

edit: hat isch erledigt einfach markieren und fix klicken^^

[shivana]

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Windows\RtHDVCpl.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Live\Family Safety\fsui.exe
C:\Windows\VM305_STI.EXE
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Windows\system32\rundll32.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hamachi\hamachi.exe
C:\Windows\system32\conime.exe
C:\Program Files\ICQ6.5\ICQ.exe
C:\Users\Administrator\Desktop\Flyff\Lightning55-Core-v2\1. Login Server.exe
C:\Users\Administrator\Desktop\Flyff\Lightning55-Core-v2\2. Char Server.exe
C:\Users\Administrator\Desktop\Flyff\Lightning55-Core-v2\3. World Server.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
R3 - URLSearchHook: Tencent SearchHook - {DB8B2393-7A6C-4C76-88CE-6B1F6FF6FFE9} - C:\Program Files\TENCENT\SSPlus\SAddr.dll
O2 - BHO: Tencent Browser Helper - {0C7C23EF-A848-485B-873C-0ED954731014} - C:\Program Files\TENCENT\SSPlus\SAddr.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: QQ??? - {29CF293A-1E7D-4069-9E11-E39698D0AF95} - C:\Program Files\Tencent\QQToolbar\IEBar.dll
O2 - BHO: Windows Live Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll
O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - C:\Program Files\Windows Live\Messenger\wlchtc.dll
O2 - BHO: (no name) - {669751ED-D558-49AE-B01A-3B374CC7910E} - C:\PROGRA~1\TENCENT\SSPlus\SSup.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O3 - Toolbar: QQ??? - {29CF293A-1E7D-4069-9E11-E39698D0AF95} - C:\Program Files\Tencent\QQToolbar\IEBar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [LXBTCATS] rundll32 C:\Windows\system32\spool\DRIVERS\W32X86\3\LXBTtim e.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [fssui] "C:\Program Files\Windows Live\Family Safety\fsui.exe" -autorun
O4 - HKLM\..\Run: [BigDog305] C:\Windows\VM305_STI.EXE VIMICRO USB PC Camera (ZC0305)
O4 - HKLM\..\Run: [stup.exe] C:\PROGRA~1\TENCENT\SSPlus\Stup.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ABBYY Screenshot Reader Retail] "C:\Program Files\ABBYY Screenshot Reader\ScreenShotReader.exe" -autorun
O4 - HKCU\..\Run: [QQ2009] "C:\Program Files\Tencent\QQ\Bin\QQ.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Fiddler2 - {CF819DA3-9882-4944-ADF5-6EF17ECF3C6E} - "C:\Program Files\Fiddler2\Fiddler.exe" (file missing)
O9 - Extra 'Tools' menuitem: Fiddler2 - {CF819DA3-9882-4944-ADF5-6EF17ECF3C6E} - "C:\Program Files\Fiddler2\Fiddler.exe" (file missing)
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O11 - Options group: [TBH] SOSO AddressBar Search
O13 - Gopher Prefix:
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) -
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) -
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) -
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apache2.2 - Apache Software Foundation - C:\AppServ\Apache2.2\bin\httpd.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: lxbt_device - - C:\Windows\system32\lxbtcoms.exe
O23 - Service: mysql - Unknown owner - C:\AppServ\MySQL\bin\mysqld-nt.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon.des.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Tencent Software Update Service (TSUSVC) - Tencent - C:\Program Files\Tencent\QQSoftMgr\TencentUpdateSvc.exe

[Lucyy]

@shivana

Auch wenn du es gut meinst kann ich nur dann alles Nachweisen wenn der Scan komplett ist. Du hast beim Log den Anfang und das Ende weg gelassen.

Adware und einige **** Einträge zeichnen auch dein System aus, entferne bitte folgende.

• R3 - URLSearchHook: (no name) - - (no file)
• R3 - URLSearchHook: Tencent SearchHook - {DB8B2393-7A6C-4C76-88CE-6B1F6FF6FFE9} - C:\Program Files\TENCENT\SSPlus\SAddr.dll
• O2 - BHO: QQ??? - {29CF293A-1E7D-4069-9E11-E39698D0AF95} - C:\Program Files\Tencent\QQToolbar\IEBar.dll
• O2 - BHO: (no name) - {669751ED-D558-49AE-B01A-3B374CC7910E} - C:\PROGRA~1\TENCENT\SSPlus\SSup.dll
• O3 - Toolbar: QQ??? - {29CF293A-1E7D-4069-9E11-E39698D0AF95} - C:\Program Files\Tencent\QQToolbar\IEBar.dll
• O4 - HKCU\..\Run: [QQ2009] "C:\Program Files\Tencent\QQ\Bin\QQ.exe" /background
• O9 - Extra button: Fiddler2 - {CF819DA3-9882-4944-ADF5-6EF17ECF3C6E} - "C:\Program Files\Fiddler2\Fiddler.exe" (file missing)
• O9 - Extra 'Tools' menuitem: Fiddler2 - {CF819DA3-9882-4944-ADF5-6EF17ECF3C6E} - "C:\Program Files\Fiddler2\Fiddler.exe" (file missing)
• O23 - Service: Tencent Software Update Service (TSUSVC) - Tencent - C:\Program Files\Tencent\QQSoftMgr\TencentUpdateSvc.exe

lg

[Metin GM]

Malwarebytes' Anti-Malware 1.37
Datenbank Version: 2232
Windows 6.0.6000

05.06.2009 11:14:59
mbam-log-2009-06-05 (11-14-53).txt

Scan-Methode: Vollständiger Scan (C:\|D:\|)
Durchsuchte Objekte: 292342
Laufzeit: 1 hour(s), 43 minute(s), 28 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\install.exe (Trojan.Agent) -> No action taken.


soll ich die löschen?

[Computerfreek]

[Ironie]Neeee, ist ja nur ein Trojaner, der kannruhig alles ausspionieren...[/Ironie]


Klar sollst du den löschen, oder zumindest mal in Quarantäne damit der keinen Schaden mehr anrichten kann.. Am besten bennenst du die Endung um, also damit da nichtmehr .exe steht sondern irgendwas, was du nicht öffnen kannst. Wie z.B. .virus
Also die Datei heißt dann statt install.exe so: install.virus
Und die lädst du dann mal auf Virustotal hoch, un postest und den Log.

[Metin GM]

wenn ich da .virus dahinter setze bleit das trotzdem ne exe-.-^^

also früher bei xp gings immer aber hab vista

hab die exe mal auf virustotal geladen

Antivirus	Version	letzte aktualisierung	Ergebnis
a-squared	4.0.0.101	2009.06.04	-
AhnLab-V3	5.0.0.2	2009.06.05	-
AntiVir	7.9.0.180	2009.06.05	-
Antiy-AVL	2.0.3.1	2009.06.05	-
Authentium	5.1.2.4	2009.06.05	-
Avast	4.8.1335.0	2009.06.04	-
AVG	8.5.0.339	2009.06.05	-
BitDefender	7.2	2009.06.05	-
CAT-QuickHeal	10.00	2009.06.05	-
ClamAV	0.94.1	2009.06.05	-
Comodo	1261	2009.06.05	-
DrWeb	5.0.0.12182	2009.06.05	-
eSafe	7.0.17.0	2009.06.04	-
eTrust-Vet	31.6.6541	2009.06.05	-
F-Prot	4.4.4.56	2009.06.04	-
F-Secure	8.0.14470.0	2009.06.05	-
Fortinet	3.117.0.0	2009.06.05	-
GData	19	2009.06.05	-
Ikarus	T3.1.1.59.0	2009.06.05	-
K7AntiVirus	7.10.754	2009.06.04	-
Kaspersky	7.0.0.125	2009.06.05	-
McAfee	5636	2009.06.04	-
McAfee+Artemis	5636	2009.06.04	-
McAfee-GW-Edition	6.7.6	2009.06.05	-
Microsoft	1.4701	2009.06.05	-
NOD32	4133	2009.06.05	-
Norman	6.01.09	2009.06.04	-
nProtect	2009.1.8.0	2009.06.05	-
Panda	10.0.0.14	2009.06.05	-
PCTools	4.4.2.0	2009.06.02	-
Prevx	3.0	2009.06.05	-
Rising	21.32.42.00	2009.06.05	-
Sophos	4.42.0	2009.06.05	-
Sunbelt	3.2.1858.2	2009.06.05	-
Symantec	1.4.4.12	2009.06.05	-
TheHacker	6.3.4.3.340	2009.06.05	-
TrendMicro	8.950.0.1092	2009.06.05	-
VBA32	3.12.10.6	2009.06.05	-
ViRobot	2009.6.5.1771	2009.06.05	-
VirusBuster	4.6.5.0	2009.06.04	-
weitere Informationen
File size: 562688 bytes
MD5...: 520a6d1cbcc9cf642c625fe814c93c58
SHA1..: fb517abb38e9ccc67de411d4f18a9446c11c0923
SHA256: 08966ce743aa1cbed0874933e104ef7b913188ecd8f0c679f7d8378516c51da2
ssdeep: -
PEiD..: -
TrID..: File type identification
InstallShield setup (46.1%)
Win32 Executable MS Visual C++ (generic) (40.4%)
Win32 Executable Generic (9.1%)
Generic Win/DOS Executable (2.1%)
DOS Executable Generic (2.1%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x3dfd8
timedatestamp.....: 0x47316ca3 (Wed Nov 07 07:43:31 2007)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x7a61e 0x7a800 6.32 88fac12502838d99cc519cb108c0e318
.data 0x7c000 0x798c 0x2200 3.40 f78c45748e6b7bcb33c43e9ea8ba0435
.rsrc 0x84000 0xbd8 0xc00 4.62 3564f93ee7baa50d785f29ecb0888286
.reloc 0x85000 0x97bc 0x9800 4.82 37ad37f70fa943e07c8139dc901c5c25

( 10 imports ) 
> KERNEL32.dll: GetLastError, LeaveCriticalSection, UnmapViewOfFile, DeleteCriticalSection, GetTempPathW, GetCurrentProcess, GetCurrentThread, CreateDirectoryW, GetFileSize, WideCharToMultiByte, WriteFile, FlushFileBuffers, GetModuleFileNameW, GetCommandLineW, DeleteFileW, lstrlenA, MultiByteToWideChar, GetCurrentThreadId, ResetEvent, MapViewOfFile, FlushInstructionCache, WaitForMultipleObjects, FormatMessageW, MulDiv, lstrlenW, GetDriveTypeW, GlobalHandle, lstrcmpW, TerminateThread, InterlockedIncrement, InterlockedDecrement, GetModuleHandleW, lstrcmpiW, LoadLibraryExW, InterlockedExchange, HeapSetInformation, GetUserDefaultLangID, CreateFileMappingW, EnterCriticalSection, InitializeCriticalSection, SizeofResource, LockResource, LoadResource, FindResourceW, GetSystemDirectoryW, SetEvent, CreateThread, CreateEventW, Sleep, SetLastError, GetTickCount, GetExitCodeProcess, WaitForSingleObject, CreateProcessW, GetProcAddress, GetVersionExW, LoadLibraryW, FreeLibrary, SetFilePointer, GlobalAlloc, LocalFree, LocalAlloc, GlobalUnlock, ReadFile, GlobalLock, GlobalReAlloc, GlobalFree, CloseHandle, RaiseException, CreateFileW, GetDriveTypeA, GetCurrentDirectoryA, ResumeThread, ExitThread, FileTimeToLocalFileTime, FileTimeToSystemTime, GetModuleHandleA, SetEndOfFile, FindClose, DuplicateHandle, GetSystemDefaultLCID, ReleaseMutex, IsProcessorFeaturePresent, GetProcessHeap, InterlockedCompareExchange, SetEnvironmentVariableA, CompareStringA, CreateFileA, GetTimeZoneInformation, GetConsoleOutputCP, WriteConsoleA, SetStdHandle, GetLocaleInfoA, GetStringTypeA, LCMapStringA, GetConsoleMode, GetConsoleCP, RtlUnwind, InitializeCriticalSectionAndSpinCount, HeapSize, GetOEMCP, GetACP, HeapReAlloc, VirtualAlloc, IsDebuggerPresent, UnhandledExceptionFilter, TerminateProcess, GetCurrentProcessId, QueryPerformanceCounter, VirtualFree, HeapCreate, TlsFree, TlsSetValue, TlsAlloc, TlsGetValue, GetStartupInfoA, GetFileType, SetHandleCount, GetModuleFileNameA, GetStdHandle, ExitProcess, SetUnhandledExceptionFilter, GetLocalTime, GetSystemTimeAsFileTime, HeapFree, HeapAlloc, LoadLibraryA
> GDI32.dll: GetStockObject, CreateSolidBrush, GetObjectW, GetTextExtentPoint32W, CreateCompatibleBitmap, CreateFontIndirectW, GetDeviceCaps, SetBkMode, SetTextColor, SetBkColor, CreatePalette, DeleteObject, SetDIBitsToDevice, PatBlt, DeleteDC, BitBlt, SelectObject, CreateCompatibleDC, CreateDIBitmap, RealizePalette, SelectPalette
> COMCTL32.dll: ImageList_ReplaceIcon, _TrackMouseEvent, ImageList_Create, InitCommonControlsEx, ImageList_Destroy
> IMM32.dll: ImmGetContext, ImmAssociateContext, ImmReleaseContext
> ole32.dll: OleLockRunning, CreateStreamOnHGlobal, CoCreateInstance, CoGetClassObject, CLSIDFromProgID, CLSIDFromString, OleInitialize, CoTaskMemFree, StringFromGUID2, CoTaskMemAlloc, OleUninitialize, CoUninitialize, CoInitialize, CoTaskMemRealloc
> OLEAUT32.dll: -, -, -, -, -, -, -, -, -, -, -, -, -
> SHELL32.dll: SHGetSpecialFolderLocation, SHGetDesktopFolder, ShellExecuteW
> SHLWAPI.dll: PathCombineW, PathIsRootW, PathStripToRootW, PathRemoveBackslashW, PathAddBackslashW, PathRemoveBlanksW, PathCanonicalizeW
> USER32.dll: PtInRect, ScreenToClient, GetActiveWindow, DialogBoxIndirectParamW, DestroyAcceleratorTable, InvalidateRgn, FillRect, ReleaseCapture, SetCapture, MoveWindow, ClientToScreen, CreateAcceleratorTableW, RedrawWindow, GetClassNameW, IsChild, EndPaint, BeginPaint, GetWindowTextLengthW, RegisterWindowMessageW, LoadImageW, DestroyIcon, SetWindowContextHelpId, MapDialogRect, UnregisterClassA, ShowWindow, SystemParametersInfoW, SetTimer, GetWindow, GetWindowLongW, MonitorFromWindow, GetMonitorInfoW, GetWindowRect, GetParent, GetCursorPos, MapWindowPoints, SetWindowPos, LoadIconW, GetDesktopWindow, GetSystemMenu, EnableMenuItem, SetFocus, GetFocus, SendMessageW, DestroyWindow, DefWindowProcW, ExitWindowsEx, CharPrevW, CharNextW, DispatchMessageW, TranslateMessage, PeekMessageW, MsgWaitForMultipleObjects, ReleaseDC, GetDC, PostQuitMessage, IsDlgButtonChecked, GetSysColorBrush, InvalidateRect, SetCursor, DrawFocusRect, DrawTextW, GetDlgItem, SetDlgItemTextW, SendDlgItemMessageW, SetWindowTextW, CallWindowProcW, SetWindowLongW, DialogBoxParamW, CreateDialogParamW, CreateWindowExW, LoadCursorW, GetClassInfoExW, RegisterClassExW, MessageBoxW, IsWindow, GetWindowTextW, EnableWindow, GetCursor, EndDialog, GetSysColor, GetClientRect, KillTimer, PostMessageW, IsDialogMessageW, GetSystemMetrics
> SETUPAPI.dll: SetupIterateCabinetW

( 0 exports ) 
PDFiD.: -
RDS...: NSRL Reference Data Set
-
ThreatExpert info: <a href='http://www.threatexpert.com/report.aspx?md5=520a6d1cbcc9cf642c625fe814c93c58' target='_blank'>http://www.threatexpert.com/report.aspx?md5=520a6d1cbcc9cf642c625fe814c93c58</a>

Und hier hijackthis log bite überprüfen

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:24:30, on 05.06.2009
Platform: Windows Vista  (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16830)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Programme\G DATA AntiVirenKit 2007 Trial\AVKTray\AVKTray.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Logitech\GamePanel Software\LGDevAgt.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe
C:\Windows\ehome\ehtray.exe
C:\Users\AppData\Local\Google\Update\GoogleUpdate.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Sitecom\Sitecom Wireless Network USB Adapter Turbo G WL-172\Installer\WLANUTL.EXE
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDClock.exe
C:\Program Files\Logitech\GamePanel Software\Applets\LCDCountdown.exe
C:\Program Files\Logitech\GamePanel Software\Applets\LCDMedia.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\conime.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Users\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O1 - Hosts: ::1 localhost
O1 - Hosts: 87.229.98.104 launcher.worldofwarcraft.com
O1 - Hosts: 87.229.98.104 status.wow-europe.com
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [AVKTray] "C:\Programme\G DATA AntiVirenKit 2007 Trial\AVKTray\AVKTray.exe"
O4 - HKLM\..\Run: [QuickFinder Scheduler] "c:\Program Files\WordPerfect Office X3\Programs\QFSCHD130.EXE"
O4 - HKLM\..\Run: [recinfo695] c:\RecInfo\RecInfo.exe
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Launch LgDevAgt] "C:\Program Files\Logitech\GamePanel Software\LgDevAgt.exe"
O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe"
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [fsc-reg] C:\ProgramData\fsc-reg\fscreg.exe 20090511
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Google Update] "C:\Users\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: Sitecom Wireless Utility.lnk = C:\Program Files\Sitecom\Sitecom Wireless Network USB Adapter Turbo G WL-172\Installer\WLANUTL.EXE
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Translate with &Babylon - res://C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
O8 - Extra context menu item: Öffnen mit WordPerfect - c:\Program Files\WordPerfect Office X3\Programs\WPLauncher.hta
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O13 - Gopher Prefix: 
O16 - DPF: {4C68DACE-E6BC-4650-9C7E-D036720CA729} (Nps Control) - http://kr.gameguard.nprotect.com/inca/onscan//tyscan/nps.cab
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://icq.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab
O23 - Service: ABBYY FineReader 9.0 PE Licensing Service (ABBYY.Licensing.FineReader.Professional.9.0) - ABBYY (BIT Software) - C:\Program Files\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe
O23 - Service: AVKProxy - G DATA Software AG - C:\Program Files\Common Files\G DATA\AVKProxy\AVKProxy.exe
O23 - Service: AVK Service (AVKService) - G DATA Software AG - C:\Programme\G DATA AntiVirenKit 2007 Trial\AVK\AVKService.exe
O23 - Service: AVK Wächter (AVKWCtl) - G DATA Software AG - C:\Programme\G DATA AntiVirenKit 2007 Trial\AVK\AVKWCtl.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon.des.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: ProtexisLicensing - Unknown owner - c:\Windows\system32\PSIService.exe
O23 - Service: Fujitsu Siemens Computers Diagnostic Testhandler (TestHandler) - Fujitsu Siemens Computers - C:\firststeps\OnlineDiagnostic\TestManager\TestHandler.exe
O23 - Service: UPnPService - Magix AG - C:\Program Files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe

--
End of file - 8711 bytes

[Lucyy]

@Metin_GM

Die Datei kann infiziert sein oder auch nicht, da Agent eine generalisierende Bezeichnung für verdächtiges Verhalten oder schleierhafte Signatur ist. Der Virustotal Bericht unterzeichnet jedoch die Aussage, dass sie clean ist.

Dein System selbst hat 2 manipulierte Host Einträge und ein **** Eintrag. Lösche die Hosts wenn du es nicht beabsichtigt eingefügt hast. Es ist folgendes:

• O1 - Hosts: 87.229.98.104 launcher.worldofwarcraft.com
• O1 - Hosts: 87.229.98.104 status.wow-europe.com
• O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

lg

[Metin GM]

danke mal...

kann das sein das die den wow server irgendwie über mich hosten?^^

[Lucyy]

Originally Posted by Metin GM

kann das sein das die den wow server irgendwie über mich hosten?^^

Das denke ich nicht, es wurden lediglich bestimmte DNS Server auf IP Addressen deklariert. Manchmal gewollt, aber meist unerwünscht.

lg

[spedman100]

Excuse me can some repeat all of this in english? please?

[S3R0]

^lol?

Longju3 is down (i think) and this Topic is rly old.

[banjo1]

*closed

old