iassvcsd.dll und gehackter account

#1 hallo,

ich habe angst das jemand zugreiff auf meinen pc hat :O daher mal n log und da is mir nur die eine .dll datei aufgefallen. vielleicht findet ja noch jemand was


Logfile of HijackThis v1.99.1
Scan saved at 14:03:58, on 18.08.2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Sygate\SPF\smc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\RunDll32.exe
C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe
C:\Programme\Rainlendar2\Rainlendar2.exe
C:\Programme\ATI Technologies\ATI.ACE\CLI.EXE
C:\Programme\MSN Messenger\msnmsgr.exe
C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Skype\Phone\Skype.exe
C:\Programme\iTunes\iTunes.exe
C:\Programme\ATI Technologies\ATI.ACE\cli.exe
C:\Programme\ATI Technologies\ATI.ACE\cli.exe
C:\Programme\Last.fm\LastFM.exe
C:\Programme\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\Programme\WinRAR\WinRAR.exe
C:\DOKUME~1\INSURG~1\LOKALE~1\Temp\Rar$EX00.360\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {F53A99C1-D5C9-4168-8099-E668DA91B3EF} - C:\WINDOWS\System32\iassvcsd.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [ATICCC] "C:\Programme\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKCU\..\Run: [Rainlendar2] C:\Programme\Rainlendar2\Rainlendar2.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Programme\MSN Messenger\msnmsgr.exe" /background
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1134816907250
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1134816889359
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{80B3C3CD-C489-4D5B-AE2E-9F99D921BB05}: NameServer = 10.0.0.1
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Unknown owner - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Sygate Personal Firewall Platinum (SmcService) - Sygate Technologies, Inc. - C:\Programme\Sygate\SPF\smc.exe

#2 Was sagt Jotti oder Virustotal denn zu C:\WINDOWS\System32\iassvcsd.dll ?

Poste bitte noch ein Combofix Report:
http://board.protecus.de/t23187.htm
__________
MfG Ralf
SEO-Spam Hunter

#3 AhnLab-V3 2007.8.18.0 2007.08.18 Win-AppCare/Stud.9728
AntiVir 7.4.1.62 2007.08.17 ADSPY/Stud.D
Authentium 4.93.8 2007.08.17 -
Avast 4.7.1029.0 2007.08.17 Win32:Trojano-3384
AVG 7.5.0.484 2007.08.17 Adware Generic.WNV
BitDefender 7.2 2007.08.18 Adware.Stud.I
CAT-QuickHeal 9.00 2007.08.18 AdWare.Stud.d (Not a Virus)
ClamAV 0.91 2007.08.18 Adware.BHO-15

das sagt der online scan, also trojaner und löschen?

#4 Den entsprechenden Eintrag
O2 - BHO: (no name) - {F53A99C1-D5C9-4168-8099-E668DA91B3EF} - C:\WINDOWS\System32\iassvcsd.dll
Anhaken und fix checked druecken, sowie ans Combofix Log denken.
__________
MfG Ralf
SEO-Spam Hunter

#5 den punkt mit hijackthis gefixed. hier noch der combofix log



ComboFix 07-08-14.4 - "Insurgency" 2007-08-18 17:24:46.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.1.1252.1.1031.18.1034 [GMT 2:00]
* Created a new restore point


((((((((((((((((((((((((( Files Created from 2007-07-18 to 2007-08-18 )))))))))))))))))))))))))))))))


2007-08-18 17:24 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-08-12 17:01 <DIR> d-------- C:\WINDOWS\Windows Update Setup-Dateien
2007-08-11 21:54 <DIR> d-------- C:\Programme\Rainlendar2
2007-08-11 21:54 <DIR> d-------- C:\DOKUME~1\INSURG~1\.rainlendar2
2007-07-20 12:36 <DIR> d-------- C:\Programme\Boonty


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-18 17:14 --------- d-------- C:\DOKUME~1\INSURG~1\ANWEND~1\Skype
2007-08-17 02:25 --------- d-------- C:\DOKUME~1\INSURG~1\ANWEND~1\teamspeak2
2007-08-15 00:39 98304 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2007-08-12 22:13 --------- d-------- C:\Programme\MSN Messenger
2007-07-27 22:02 --------- d-------- C:\DOKUME~1\INSURG~1\ANWEND~1\dvdcss
2007-07-19 22:27 --------- d-------- C:\Programme\Last.fm
2007-07-10 22:48 --------- d-------- C:\Programme\mIRC
2007-07-06 10:31 --------- d--h----- C:\Programme\InstallShield Installation Information
2007-07-02 21:13 --------- d-------- C:\DOKUME~1\INSURG~1\ANWEND~1\OpenOffice.org2
2007-07-01 11:08 --------- d-------- C:\Programme\Gemeinsame Dateien\Wise Installation Wizard
2007-07-01 11:07 --------- d-------- C:\DOKUME~1\INSURG~1\ANWEND~1\AquaSoft
2007-06-19 19:22 --------- d-------- C:\Programme\WC3Banlist
2007-06-19 18:29 --------- d-------- C:\Programme\WinPcap
2007-06-16 23:01 671744 --a------ C:\WINDOWS\is-76DPQ.exe
2006-08-26 12:17 457 --a------ C:\Programme\INSTALL.LOG


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Cmaudio"="cmicnfg.cpl" []
"avgnt"="C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" [2007-03-02 14:52]
"ATICCC"="C:\Programme\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-05-10 11:12]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Rainlendar2"="C:\Programme\Rainlendar2\Rainlendar2.exe" [2007-07-24 09:12]
"msnmsgr"="C:\Programme\MSN Messenger\msnmsgr.exe" [2006-07-29 19:34]

R0 a347bus;a347bus;C:\WINDOWS\System32\DRIVERS\a347bus.sys
R0 a347scsi;a347scsi;C:\WINDOWS\System32\Drivers\a347scsi.sys
R0 avgntmgr;avgntmgr;C:\WINDOWS\System32\drivers\avgntmgr.sys
R1 avgntdd;avgntdd;C:\WINDOWS\System32\DRIVERS\avgntdd.sys
R3 Cap7134;MEDION (7134) WDM Video Capture;C:\WINDOWS\System32\DRIVERS\Cap7134.sys
R3 FETNDISB;VIA Rhine Family Fast Ethernet Adapter Driver Service;C:\WINDOWS\System32\DRIVERS\fetnd5b.sys
R3 Intels51;Creatix V.9X DSP Data Fax Modem;C:\WINDOWS\System32\DRIVERS\ctxs51.sys
R3 PhTVTune;MEDION TV-TUNER 7134 MK2/3;C:\WINDOWS\System32\DRIVERS\PhTVTune.sys
R3 XUIF;X10 USB Wireless Transceiver;C:\WINDOWS\System32\Drivers\x10ufx2.sys
S3 EverestDriver;Lavalys EVEREST Kernel Driver;\??\C:\Programme\Lavalys\EVEREST Home Edition\kerneld.wnt
S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\System32\drivers\npf.sys
S3 NTSIM;NTSIM;\??\C:\WINDOWS\System32\ntsim.sys


Contents of the 'Scheduled Tasks' folder
2007-08-17 15:15:00 C:\WINDOWS\Tasks\1-Klick-Wartung.job - C:\Programme\TuneUp Utilities 2006\SystemOptimizer.exe
2007-07-05 10:41:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Programme\Apple Software Update\SoftwareUpdate.exe

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-18 17:26:49
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-18 17:27:29

--- E O F ---




schonmal ein liebes danke für die hilfe

#6 Kannst du mit der Datei C:\WINDOWS\is-76DPQ.exe etwas anfangen( Was steht in den Dateieigenschaften?), ansonsten sehe ich nichts besonderes. Du solltest danach www.windowsupdate.com besuchen und alle wichtigen Updates einspielen. Dein Betriebsystem hats noetig!
__________
MfG Ralf
SEO-Spam Hunter