Frei von Keylogger?

#1 Hallo, ich hatte ein FUD Keylogger auf meinen PC, ich weiß "FUD" Full undeteced oder so...
Viele sagen dieß hier sei der Keylogger C:\Windows\System32\p2phost.exe
Die ist irgendwie unsichtbar in mein PC und finde die EXE nicht.
Aber ich wollte es trotzdem überprüfen lassen, deswegen hier LOG'S die ihr noch auswertigen müsstet:


Hijackthis LOG:

Zitat

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:18:35, on 28.07.2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16386)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Common Files\aol\1179901856\ee\aolsoftware.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\System32\p2phost.exe
C:\Windows\System32\rundll32.exe
C:\Windows\system32\conime.exe
C:\Program Files\Alice\signup\AliceCnn.exe
C:\Program Files\Norton Security Scan\Nss.exe
C:\Program Files\Norton Security Scan\Nss.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\Maikel\AppData\Local\Temp\21022.08.31\1031\wcu\dotnetframework\dotnetfx35setup.exe
c:\4b0af35d9d8c99d81a3e3124\setup.exe
C:\Windows\system32\WUSA.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\Taskmgr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\SearchFilterHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://alice.aol.de
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://alice.aol.de
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://alice.aol.de
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1179901856\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [CollaborationHost] C:\Windows\system32\p2phost.exe -s
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O17 - HKLM\System\CCS\Services\Tcpip\..\{380810AE-5539-4948-B3EB-E18B1E4F2ED3}: NameServer = 213.191.74.11 213.191.92.82
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: Automatisches LiveUpdate - Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

--
End of file - 6239 bytes

Dieses LOG von Malewarebytes kann ich nicht, weiß nicht wie das geht :o

Hier ein SCREEN von meiner Netstat, da kommen mir die 2 ersten merkwürdig vor :o
http://www.myimg.de/?img=hey29aa7e.jpg

#2 Hallo,Business

1.
wende Combofix an + kopiere den scanreport hier ein
http://virus-protect.org/artikel/tools/combofix.html

2.
wende zoek an + poste auch den report
http://virus-protect.org/artikel/tools/zoek.html
__________
MfG Sabina

rund um die PC-Sicherheit

#3 HIER DIE LOG VON ComboFix .

Zitat

ComboFix 08-08-27.05 - Maikel 2008-08-28 10:27:57.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1031.18.236 [GMT 2:00]
ausgeführt von:: C:\Users\Maikel\Downloads\ComboFix.exe
* Neuer Wiederherstellungspunkt wurde erstellt
.

((((((((((((((((((((((( Dateien erstellt von 2008-07-28 bis 2008-08-28 ))))))))))))))))))))))))))))))
.

2008-08-28 07:31 . 2006-11-02 12:23 <DIR> dr------- C:\Users\Gast\Videos
2008-08-28 07:31 . 2006-11-02 12:23 <DIR> d-------- C:\Users\Gast\Saved Games
2008-08-28 07:31 . 2006-11-02 12:23 <DIR> dr------- C:\Users\Gast\Pictures
2008-08-28 07:31 . 2006-11-02 12:23 <DIR> dr------- C:\Users\Gast\Music
2008-08-28 07:31 . 2006-11-02 12:23 <DIR> dr------- C:\Users\Gast\Links
2008-08-28 07:31 . 2006-11-02 12:23 <DIR> dr------- C:\Users\Gast\Downloads
2008-08-28 07:31 . 2008-08-28 07:31 <DIR> dr------- C:\Users\Gast\Documents
2008-08-28 07:31 . 2006-11-02 13:18 <DIR> d--h----- C:\Users\Gast\AppData
2008-08-28 07:31 . 2008-08-28 07:31 <DIR> d-------- C:\Users\Gast
2008-08-27 17:57 . 2008-08-27 17:57 <DIR> dr------- C:\Users\ramona\Searches
2008-08-27 17:56 . 2008-08-27 17:57 <DIR> dr------- C:\Users\ramona\Videos
2008-08-27 17:56 . 2008-08-27 17:57 <DIR> dr------- C:\Users\ramona\Saved Games
2008-08-27 17:56 . 2008-08-27 17:57 <DIR> dr------- C:\Users\ramona\Pictures
2008-08-27 17:56 . 2008-08-27 17:57 <DIR> dr------- C:\Users\ramona\Music
2008-08-27 17:56 . 2008-08-27 17:57 <DIR> dr------- C:\Users\ramona\Links
2008-08-27 17:56 . 2008-08-27 17:57 <DIR> dr------- C:\Users\ramona\Downloads
2008-08-27 17:56 . 2008-08-27 17:57 <DIR> dr------- C:\Users\ramona\Documents
2008-08-27 17:56 . 2008-08-27 17:56 <DIR> dr------- C:\Users\ramona\Contacts
2008-08-27 17:56 . 2006-11-02 14:37 <DIR> d-------- C:\Users\ramona\AppData\Roaming\Media Center Programs
2008-08-27 17:56 . 2008-08-27 17:57 <DIR> d--h----- C:\Users\ramona\AppData
2008-08-27 17:56 . 2008-08-27 17:57 <DIR> d-------- C:\Users\ramona
2008-08-27 17:16 . 2008-08-27 17:33 <DIR> d-------- C:\Program Files\TeamViewer3
2008-08-27 15:48 . 2008-08-27 15:48 <DIR> d-------- C:\Users\Maikel\AppData\Roaming\Desktopicon
2008-08-27 15:48 . 2008-08-27 15:48 <DIR> d-------- C:\Program Files\Unlocker
2008-08-27 15:41 . 2008-08-28 10:09 <DIR> d-------- C:\ProgramData\Spybot - Search & Destroy
2008-08-27 15:41 . 2008-08-28 10:10 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-08-27 15:39 . 2008-08-27 15:39 <DIR> d-------- C:\Program Files\Alwil Software
2008-08-27 15:39 . 2008-07-19 16:36 51,280 --a------ C:\Windows\System32\drivers\aswMonFlt.sys
2008-08-27 00:51 . 2008-08-28 10:19 <DIR> d-------- C:\Program Files\UltraVNC
2008-08-27 00:48 . 2008-08-27 16:47 <DIR> d-a------ C:\ProgramData\TEMP
2008-08-26 18:16 . 2008-08-26 18:14 102,208 --ah----- C:\Windows\System32\drivers\bdfndisf.sys
2008-08-26 16:47 . 2008-08-26 16:47 <DIR> d-------- C:\Program Files\Bonjour
2008-08-26 16:25 . 2008-08-26 16:25 <DIR> d-------- C:\Program Files\Common Files\Macrovision Shared
2008-08-26 15:41 . 2008-08-26 15:41 850 --ah----- C:\Windows\System32\ProductTweaks.xml
2008-08-26 15:41 . 2008-08-26 15:41 385 --ah----- C:\Windows\System32\user_gensett.xml
2008-08-22 20:48 . 2008-08-22 20:48 <DIR> d-------- C:\Program Files\BitDefender
2008-08-22 20:45 . 2008-08-28 09:55 <DIR> d-------- C:\Program Files\Common Files\BitDefender
2008-08-22 20:29 . 2008-08-22 20:29 <DIR> d-------- C:\Users\Maikel\AppData\Roaming\Symantec
2008-08-18 18:00 . 2008-08-18 18:00 <DIR> d-------- C:\Program Files\FileZilla FTP Client
2008-08-18 11:20 . 2008-08-18 11:20 <DIR> d-------- C:\Users\Maikel\AppData\Roaming\AOL
2008-08-18 09:58 . 2007-03-07 04:51 543,232 --a------ C:\Windows\System32\FWPUCLNT.DLL
2008-08-18 09:58 . 2007-03-07 04:51 416,768 --a------ C:\Windows\System32\IKEEXT.DLL
2008-08-18 09:58 . 2007-03-07 04:51 317,440 --a------ C:\Windows\System32\BFE.DLL
2008-08-18 09:58 . 2007-03-07 04:08 84,992 --a------ C:\Windows\System32\drivers\FWPKCLNT.SYS
2008-08-15 03:06 . 2008-07-16 01:48 2,048 --a------ C:\Windows\System32\tzres.dll
2008-08-12 21:01 . 2008-08-12 21:01 <DIR> d-------- C:\ProgramData\InstallShield
2008-08-10 11:00 . 2008-08-17 17:52 <DIR> d-------- C:\ProgramData\NortonInstaller
2008-08-10 11:00 . 2008-08-18 23:56 <DIR> d-------- C:\ProgramData\Norton
2008-08-09 16:54 . 2008-08-09 16:58 <DIR> d-------- C:\Users\Maikel\AppData\Roaming\Miranda
2008-08-01 05:23 . 2008-08-18 15:07 <DIR> d-------- C:\ProgramData\Messenger Plus!
2008-08-01 05:23 . 2008-08-01 05:23 <DIR> d-------- C:\Program Files\Messenger Plus! Live
2008-08-01 00:04 . 2008-08-22 19:44 <DIR> d-------- C:\Program Files\Windows Live Safety Center
2008-07-31 05:57 . 2008-07-31 05:57 <DIR> d-------- C:\Program Files\Common Files\Adobe Systems Shared
2008-07-30 19:58 . 2008-07-30 19:58 <DIR> d-------- C:\Program Files\Windows Live
2008-07-30 18:35 . 2008-07-30 18:35 205,824 --a------ C:\Windows\System32\msoeacct.dll
2008-07-30 18:35 . 2008-07-30 18:35 87,040 --a------ C:\Windows\System32\msoert2.dll
2008-07-30 18:35 . 2008-07-30 18:35 39,424 --a------ C:\Windows\System32\ACCTRES.dll
2008-07-30 18:34 . 2008-07-30 18:34 194,560 --a------ C:\Windows\System32\WebClnt.dll
2008-07-30 18:34 . 2008-07-30 18:34 110,080 --a------ C:\Windows\System32\drivers\mrxdav.sys
2008-07-30 18:32 . 2008-07-30 18:32 396,800 --a------ C:\Windows\System32\MPSSVC.dll
2008-07-30 18:32 . 2008-07-30 18:32 392,192 --a------ C:\Windows\System32\FirewallAPI.dll
2008-07-30 18:32 . 2008-07-30 18:32 178,688 --a------ C:\Windows\System32\iphlpsvc.dll
2008-07-30 18:32 . 2008-07-30 18:32 86,016 --a------ C:\Windows\System32\icfupgd.dll
2008-07-30 18:32 . 2008-07-30 18:32 63,488 --a------ C:\Windows\System32\drivers\mpsdrv.sys
2008-07-30 18:32 . 2008-07-30 18:32 61,952 --a------ C:\Windows\System32\cmifw.dll
2008-07-30 18:32 . 2008-07-30 18:32 23,040 --a------ C:\Windows\System32\drivers\tunnel.sys
2008-07-30 18:32 . 2008-07-30 18:32 16,896 --a------ C:\Windows\System32\wfapigp.dll
2008-07-30 18:32 . 2008-07-30 18:32 15,360 --a------ C:\Windows\System32\drivers\TUNMP.SYS
2008-07-30 18:31 . 2008-07-30 18:31 8,147,968 --a------ C:\Windows\System32\wmploc.DLL
2008-07-30 18:31 . 2008-07-30 18:31 1,191,936 --a------ C:\Windows\System32\msxml3.dll
2008-07-30 18:31 . 2008-07-30 18:31 7,680 --a------ C:\Windows\System32\spwmp.dll
2008-07-30 18:31 . 2008-07-30 18:31 4,096 --a------ C:\Windows\System32\msdxm.ocx
2008-07-30 18:31 . 2008-07-30 18:31 4,096 --a------ C:\Windows\System32\dxmasf.dll
2008-07-30 18:31 . 2008-07-30 18:31 2,048 --a------ C:\Windows\System32\msxml3r.dll
2008-07-30 18:29 . 2008-07-30 18:29 9,892,864 --a------ C:\Windows\System32\NlsLexicons000a.dll
2008-07-30 18:26 . 2008-07-30 18:26 1,585,664 --a------ C:\Windows\System32\setupapi.dll
2008-07-30 18:23 . 2008-07-30 18:23 2,027,008 --a------ C:\Windows\System32\win32k.sys
2008-07-30 18:23 . 2008-07-30 18:23 296,448 --a------ C:\Windows\System32\gdi32.dll
2008-07-30 18:23 . 2008-07-30 18:23 223,232 --a------ C:\Windows\System32\WMASF.DLL
2008-07-30 18:23 . 2008-07-30 18:23 9,728 --a------ C:\Windows\System32\LAPRXY.DLL
2008-07-30 18:23 . 2008-07-30 18:23 2,048 --a------ C:\Windows\System32\asferror.dll
2008-07-30 18:22 . 2008-07-30 18:22 1,335,296 --a------ C:\Windows\System32\msxml6.dll
2008-07-30 18:22 . 2008-07-30 18:22 2,048 --a------ C:\Windows\System32\msxml6r.dll
2008-07-30 18:21 . 2008-07-30 18:21 113,664 --a------ C:\Windows\System32\drivers\rmcast.sys
2008-07-30 18:21 . 2008-07-30 18:21 14,848 --a------ C:\Windows\System32\wshrm.dll
2008-07-30 18:21 . 2008-07-30 18:21 11,776 --a------ C:\Windows\System32\sbunattend.exe
2008-07-30 18:20 . 2008-07-30 18:20 130,048 --a------ C:\Windows\System32\drivers\srv2.sys
2008-07-30 18:20 . 2008-07-30 18:20 101,888 --a------ C:\Windows\System32\drivers\mrxsmb.sys
2008-07-30 18:20 . 2008-07-30 18:20 84,992 --a------ C:\Windows\System32\drivers\srvnet.sys
2008-07-30 18:20 . 2008-07-30 18:20 83,968 --a------ C:\Windows\System32\dnsrslvr.dll
2008-07-30 18:20 . 2008-07-30 18:20 58,368 --a------ C:\Windows\System32\drivers\mrxsmb20.sys
2008-07-30 18:20 . 2008-07-30 18:20 24,576 --a------ C:\Windows\System32\dnscacheugc.exe
2008-07-30 18:19 . 2008-07-30 18:19 788,992 --a------ C:\Windows\System32\rpcrt4.dll
2008-07-30 18:19 . 2008-07-30 18:19 152,576 --a------ C:\Windows\System32\imagehlp.dll
2008-07-30 18:19 . 2008-07-30 18:19 12,800 --a------ C:\Windows\System32\drivers\fs_rec.sys
2008-07-30 18:19 . 2008-07-30 18:19 5,120 --a------ C:\Windows\System32\wmi.dll
2008-07-30 18:18 . 2008-07-30 18:18 1,327,104 --a------ C:\Windows\System32\quartz.dll
2008-07-30 18:16 . 2008-07-30 18:16 3,504,824 --a------ C:\Windows\System32\ntkrnlpa.exe
2008-07-30 18:16 . 2008-07-30 18:16 3,470,520 --a------ C:\Windows\System32\ntoskrnl.exe
2008-07-30 18:13 . 2008-07-30 18:13 750,080 --a------ C:\Windows\System32\qmgr.dll
2008-07-30 16:53 . 2008-07-30 17:25 <DIR> d-------- C:\ProgramData\FLEXnet
2008-07-30 13:18 . 2008-07-30 13:18 1,712,984 --a------ C:\Windows\System32\wuaueng.dll
2008-07-30 13:18 . 2008-07-30 13:18 1,524,224 --a------ C:\Windows\System32\wucltux.dll
2008-07-30 13:18 . 2008-07-30 13:18 53,080 --a------ C:\Windows\System32\wuauclt.exe
2008-07-30 13:18 . 2008-07-30 13:18 43,352 --a------ C:\Windows\System32\wups2.dll
2008-07-30 13:17 . 2008-07-30 13:17 549,720 --a------ C:\Windows\System32\wuapi.dll
2008-07-30 13:17 . 2008-07-30 13:17 163,000 --a------ C:\Windows\System32\wuwebv.dll
2008-07-30 13:17 . 2008-07-30 13:17 80,896 --a------ C:\Windows\System32\wudriver.dll
2008-07-30 13:17 . 2008-07-30 13:17 33,624 --a------ C:\Windows\System32\wups.dll
2008-07-30 13:17 . 2008-07-30 13:17 31,232 --a------ C:\Windows\System32\wuapp.exe
2008-07-29 07:13 . 2008-08-26 16:47 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-07-28 22:51 . 2008-07-28 22:51 <DIR> d-------- C:\Program Files\Microsoft Synchronization Services
2008-07-28 22:51 . 2008-07-28 22:51 <DIR> d-------- C:\Program Files\Microsoft SQL Server Compact Edition
2008-07-28 22:51 . 2008-07-28 22:51 <DIR> d-------- C:\Program Files\Microsoft Silverlight
2008-07-28 22:47 . 2008-07-28 22:51 <DIR> d-------- C:\Program Files\Microsoft Visual Studio 9.0
2008-07-28 22:46 . 2008-07-28 22:46 <DIR> d-------- C:\Program Files\Microsoft SDKs
2008-07-28 22:22 . 2008-07-28 22:22 <DIR> d-------- C:\e654309269950f41b8d0469f762442
2008-07-28 22:20 . 2008-07-28 22:20 779,800 --a------ C:\Windows\System32\PresentationNative_v0300.dll
2008-07-28 22:20 . 2008-07-28 22:20 579,584 --a------ C:\Windows\System32\icardagt.exe
2008-07-28 22:20 . 2008-07-28 22:20 350,744 --a------ C:\Windows\System32\PresentationHost.exe
2008-07-28 22:20 . 2008-07-28 22:20 106,520 --a------ C:\Windows\System32\PresentationCFFRasterizerNative_v0300.dll
2008-07-28 22:20 . 2008-07-28 22:20 88,576 --a------ C:\Windows\System32\infocardapi.dll
2008-07-28 22:20 . 2008-07-28 22:20 33,304 --a------ C:\Windows\System32\PresentationHostProxy.dll
2008-07-28 22:20 . 2008-07-28 22:20 28,160 --a------ C:\Windows\System32\infocardcpl.cpl
2008-07-28 22:20 . 2008-07-28 22:20 11,776 --a------ C:\Windows\System32\icardres.dll

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-28 08:09 334,100 --sha-w C:\Windows\system32\drivers\fidbox.idx
2008-08-28 08:09 131,596,320 --sha-w C:\Windows\system32\drivers\fidbox.dat
2008-08-26 18:35 --------- d-----w C:\Users\Maikel\AppData\Roaming\FileZilla
2008-08-22 18:40 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-08-22 18:05 --------- d-----w C:\ProgramData\Kaspersky Lab
2008-08-22 18:02 --------- d-----w C:\Program Files\Kaspersky Lab
2008-08-22 17:59 --------- d-----w C:\ProgramData\Kaspersky Lab Setup Files
2008-08-18 09:28 --------- d-----w C:\Program Files\Common Files\aol
2008-08-18 08:02 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-08-18 08:00 319,456 ----a-w C:\Windows\DIFxAPI.dll
2008-08-17 15:54 --------- d-----w C:\ProgramData\Symantec
2008-08-17 15:53 --------- d-----w C:\Program Files\Symantec
2008-08-15 01:15 32 --sha-w C:\Windows\system32\drivers\fidbox2.idx
2008-08-15 01:15 32 --sha-w C:\Windows\system32\drivers\fidbox2.dat
2008-08-12 18:51 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-07-30 20:43 174 --sha-w C:\Program Files\desktop.ini
2008-07-30 20:39 --------- d-----w C:\Program Files\Windows Mail
2008-07-30 20:38 --------- d-----w C:\Program Files\Windows Sidebar
2008-07-30 16:29 9,845,248 ----a-w C:\Windows\System32\NlsData000a.dll
2008-07-30 16:25 944,184 ----a-w C:\Windows\System32\winload.exe
2008-07-28 20:51 --------- d-----w C:\ProgramData\Microsoft Help
2008-07-28 19:47 --------- d-----w C:\Program Files\Common Files\Alice
2008-07-27 13:52 --------- d-----w C:\Program Files\Zattoo
2008-07-24 18:02 --------- d-----w C:\Users\Maikel\AppData\Roaming\tor
2008-07-22 18:39 --------- d-----w C:\ProgramData\Yahoo! Companion
2008-07-21 00:48 --------- d-----w C:\Users\Maikel\AppData\Roaming\Yahoo!
2008-07-21 00:48 --------- d-----w C:\Program Files\Yahoo!
2008-07-21 00:46 --------- d-----w C:\Users\Maikel\AppData\Roaming\TeamViewer
2008-07-20 19:03 --------- d-----w C:\ProgramData\WLInstaller
2008-07-20 18:41 --------- d-----w C:\Users\Maikel\AppData\Roaming\PeerNetworking
2008-07-20 15:56 --------- d-----w C:\Program Files\Java
2008-07-20 15:54 --------- d-----w C:\Program Files\Common Files\Java
2008-07-20 15:36 --------- d-sh--w C:\ProgramData\Vorlagen
2008-07-20 15:36 --------- d-sh--w C:\ProgramData\Startmenü
2008-07-20 15:36 --------- d-sh--w C:\ProgramData\Favoriten
2008-07-20 15:36 --------- d-sh--w C:\ProgramData\Dokumente
2008-07-20 15:36 --------- d-sh--w C:\ProgramData\Anwendungsdaten
2008-07-20 15:36 --------- d-sh--w C:\Program Files\Gemeinsame Dateien
2008-06-27 03:54 826,368 ----a-w C:\Windows\System32\wininet.dll
2008-06-27 03:54 56,320 ----a-w C:\Windows\System32\iesetup.dll
2008-06-27 03:54 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-06-27 03:54 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
2008-06-19 03:25 61,440 ----a-w C:\Windows\System32\winipsec.dll
2008-06-19 03:25 361,984 ----a-w C:\Windows\System32\IPSECSVC.DLL
2008-06-19 03:25 28,672 ----a-w C:\Windows\System32\FwRemoteSvr.dll
2008-06-19 03:25 272,896 ----a-w C:\Windows\System32\polstore.dll
.

(((((((((((((((((((((((((((( Autostart Punkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Eintrage & legitime Standardeintrage werden nicht angezeigt.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-07-30 18:21 1232896]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]
"WindowsWelcomeCenter"="oobefldr.dll" [2006-11-02 14:34 2159104 C:\Windows\System32\oobefldr.dll]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 16:38 78008]
"UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe" [2008-05-02 06:15 15872]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 10:22 517768]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"HostManager"="C:\Program Files\Common Files\AOL\1179901856\ee\AOLSoftware.exe" [2006-11-14 15:47 50736]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{894BD5C2-0897-40CD-86AB-9ABC86666248}"= UDP:C:\Program Files\Common Files\aol\acs\AOLDial.exe:AOL Optimized Dial-In
"{495F1D0C-9FA6-43AC-9332-33500DFFB278}"= TCP:C:\Program Files\Common Files\aol\acs\AOLDial.exe:AOL Optimized Dial-In
"{C16D9B50-281B-4D49-8617-015A295BA000}"= UDP:C:\Program Files\Common Files\aol\acs\AOLacsd.exe:AOL Optimized Dial-In
"{436B88B8-22BB-4127-9AED-479F1447A736}"= TCP:C:\Program Files\Common Files\aol\acs\AOLacsd.exe:AOL Optimized Dial-In
"{7CC22A9D-CAE0-4424-BC08-990B5E1E4DA9}"= UDP:C:\Program Files\AOL 9.0 VR\waol.exe:AOL
"{F77A2C19-5794-4E27-9803-58612D3E15FA}"= TCP:C:\Program Files\AOL 9.0 VR\waol.exe:AOL
"{094FA550-0E83-4AE9-91F2-F9EDE0C55C11}"= UDP:C:\Program Files\Common Files\aol\TopSpeed\3.0\aoltpsd3.exe:AOL TopSpeed
"{9D275EE7-10D9-4E87-B56F-519AB46955E8}"= TCP:C:\Program Files\Common Files\aol\TopSpeed\3.0\aoltpsd3.exe:AOL TopSpeed
"{68E61C27-9E92-41BC-967E-3F302A5D1C96}"= UDP:C:\Program Files\Common Files\aol\Loader\aolload.exe:AOL Loader
"{C55A7E08-DE05-4E07-8D02-44525B2BDECA}"= TCP:C:\Program Files\Common Files\aol\Loader\aolload.exe:AOL Loader
"{85354C48-9CA4-49B2-A086-8129EDBCF52E}"= UDP:C:\Program Files\Common Files\aol\System Information\sinf.exe:AOL System Information
"{6004F1D5-FAE6-4E8D-8023-DDA9EC8F3D44}"= TCP:C:\Program Files\Common Files\aol\System Information\sinf.exe:AOL System Information
"{BBB64611-3748-4669-9DEA-2C33952F52BD}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{68DCC726-40B2-42C4-BDBE-CAAC65FFC821}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"TCP Query User{47E82A8D-7A60-4C9C-B3FA-59ACC684426A}C:\\programdata\\kaspersky lab setup files\\kaspersky internet security 2009\\german\\setup.exe"= UDP:C:\programdata\kaspersky lab setup files\kaspersky internet security 2009\german\setup.exe:Installationsprogramm für Kaspersky Internet Security 2009
"UDP Query User{3E73B335-28DE-46F4-9398-8E54465708CA}C:\\programdata\\kaspersky lab setup files\\kaspersky internet security 2009\\german\\setup.exe"= TCP:C:\programdata\kaspersky lab setup files\kaspersky internet security 2009\german\setup.exe:Installationsprogramm für Kaspersky Internet Security 2009
"{A6BEB597-D6C1-4508-9B8D-186E96EA998E}"= UDP:C:\Program Files\Internet Explorer\iexplore.exe:Internet Explorer
"{E03F289E-FE36-4585-96C3-588A6B8269DB}"= TCP:C:\Program Files\Internet Explorer\iexplore.exe:Internet Explorer
"{EC16E004-FDDD-4A58-94FF-9B56E02F357C}"= UDP:C:\Program Files\Mozilla Firefox\firefox.exe:Mozilla Firefox
"{4965BDFD-9983-4DC5-8010-09ECF13376D4}"= TCP:C:\Program Files\Mozilla Firefox\firefox.exe:Mozilla Firefox
"TCP Query User{A388250E-5AD5-402B-90FB-C5A79848C8A9}C:\\program files\\teamviewer3\\teamviewer.exe"= UDP:C:\program files\teamviewer3\teamviewer.exe:TeamViewer Remote Control Application
"UDP Query User{6CE4C43E-8E47-44A8-92E8-3B1E12AE0197}C:\\program files\\teamviewer3\\teamviewer.exe"= TCP:C:\program files\teamviewer3\teamviewer.exe:TeamViewer Remote Control Application
"TCP Query User{27538064-0CCA-45A7-A7C8-399E5959FD1F}C:\\program files\\zattoo\\zattood.exe"= UDP:C:\program files\zattoo\zattood.exe:zattood
"UDP Query User{917F11F4-09BD-4EBF-B547-DADAB79226CD}C:\\program files\\zattoo\\zattood.exe"= TCP:C:\program files\zattoo\zattood.exe:zattood
"TCP Query User{13485C8B-5215-4BA1-8A4E-98935853D81C}C:\\program files\\zattoo\\zattoo.exe"= UDP:C:\program files\zattoo\zattoo.exe:
"UDP Query User{335B0DDC-9562-4F5E-AA18-3EB62C0D4E18}C:\\program files\\zattoo\\zattoo.exe"= TCP:C:\program files\zattoo\zattoo.exe:
"{22E32131-D912-4956-A79A-45F8039D9C0B}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{6CB4AA6D-01E5-4B19-BEC7-7B234648CA30}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{4C48868F-F042-452C-86C9-3FA14688ABC2}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{C4969AE0-9B80-4BA9-95FE-F444E84F03BF}C:\\programdata\\kaspersky lab setup files\\kaspersky anti-virus 2009\\german\\setup.exe"= UDP:C:\programdata\kaspersky lab setup files\kaspersky anti-virus 2009\german\setup.exe:Installationsprogramm für Kaspersky Anti-Virus 2009
"UDP Query User{74720D2D-7E8D-4EB3-9772-D515F19DBD73}C:\\programdata\\kaspersky lab setup files\\kaspersky anti-virus 2009\\german\\setup.exe"= TCP:C:\programdata\kaspersky lab setup files\kaspersky anti-virus 2009\german\setup.exe:Installationsprogramm für Kaspersky Anti-Virus 2009
"TCP Query User{F69F9B88-9A7C-4EA7-85A4-D1D6F381EBBC}C:\\program files\\counter-strike 1.6\\hlds.exe"= UDP:C:\program files\counter-strike 1.6\hlds.exe:HLDS Launcher
"UDP Query User{8511DBE6-7464-484B-B2CF-DC9B09C52FC1}C:\\program files\\counter-strike 1.6\\hlds.exe"= TCP:C:\program files\counter-strike 1.6\hlds.exe:HLDS Launcher
"TCP Query User{3B994BD7-7467-4BEE-AC28-AA9FAF99478A}C:\\programdata\\kaspersky lab setup files\\kaspersky anti-virus 2009\\english\\setup.exe"= UDP:C:\programdata\kaspersky lab setup files\kaspersky anti-virus 2009\english\setup.exe:Kaspersky Anti-Virus 2009 Setup
"UDP Query User{3BCE4A64-B136-459C-94BE-1A0B298FA3A0}C:\\programdata\\kaspersky lab setup files\\kaspersky anti-virus 2009\\english\\setup.exe"= TCP:C:\programdata\kaspersky lab setup files\kaspersky anti-virus 2009\english\setup.exe:Kaspersky Anti-Virus 2009 Setup
"{A5F523C2-AA62-42D6-BC28-A900202C6465}"= UDP:C:\Program Files\Common Files\aol\1179901856\ee\aolsoftware.exe:AOL Shared Components
"{8F4027D8-66AA-470E-B2D6-48D7F6A003AD}"= TCP:C:\Program Files\Common Files\aol\1179901856\ee\aolsoftware.exe:AOL Shared Components
"TCP Query User{4488AB96-9BCD-4B6C-9A94-5C560ED9BFF9}C:\\program files\\ultravnc\\winvnc.exe"= UDP:C:\program files\ultravnc\winvnc.exe:VNC server for Win32
"UDP Query User{1A79445A-CB8A-4407-9D95-B17C67C2C1C0}C:\\program files\\ultravnc\\winvnc.exe"= TCP:C:\program files\ultravnc\winvnc.exe:VNC server for Win32
"TCP Query User{1517F953-2371-4E70-BBC2-39E7D75C28EF}C:\\program files\\realvnc\\vnc4\\vncviewer.exe"= UDP:C:\program files\realvnc\vnc4\vncviewer.exe:VNC Viewer Free Edition for Win32
"UDP Query User{46FEFDEF-9BF1-4610-9638-BFD90999BD7A}C:\\program files\\realvnc\\vnc4\\vncviewer.exe"= TCP:C:\program files\realvnc\vnc4\vncviewer.exe:VNC Viewer Free Edition for Win32

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"DoNotAllowExceptions"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

R0 klbg;Kaspersky Lab Boot Guard Driver;C:\Windows\system32\drivers\klbg.sys [2008-01-29 18:29]
R1 aswSP;avast! Self Protection;C:\Windows\system32\drivers\aswSP.sys [2008-07-19 16:35]
R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;C:\Windows\system32\DRIVERS\klim6.sys [2008-03-26 13:10]
R2 aswFsBlk;aswFsBlk;C:\Windows\system32\DRIVERS\aswFsBlk.sys [2008-07-19 16:37]
R2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2008-07-19 16:36]
R2 Automatisches LiveUpdate - Scheduler;Automatisches LiveUpdate - Scheduler;C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe [2007-09-26 10:53]
R2 TeamViewer;TeamViewer 3;C:\Program Files\TeamViewer3\TeamViewer_Service.exe [2008-08-06 08:42]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;C:\Windows\system32\DRIVERS\klfltdev.sys [2008-03-13 19:02]
R3 teamviewervpn;TeamViewer VPN Adapter;C:\Windows\system32\DRIVERS\teamviewervpn.sys [2008-01-25 11:12]
S3 PDNMp50;PDNMp50 NDIS Protocol Driver;C:\Windows\system32\drivers\PDNMp50.sys [2006-11-28 22:46]
S3 PDNSp50;PDNSp50 NDIS Protocol Driver;C:\Windows\system32\drivers\PDNSp50.sys [2006-11-28 22:46]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{37a0e52a-5670-11dd-b43c-806e6f6e6963}]
\shell\AutoRun\command - E:\Start.exe

*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
.
Inhalt des "geplante Tasks" Ordners

2008-08-27 C:\Windows\Tasks\User_Feed_Synchronization-{742F224C-1E6B-4B84-BC6A-349A412BCCD8}.job
- C:\Windows\system32\msfeedssync.exe [2006-11-02 11:45]
.
.
------- Zusätzlicher Scan -------
.
FireFox -: Profile - C:\Users\Maikel\AppData\Roaming\Mozilla\Firefox\Profiles\yl4q0tw6.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://de.search.yahoo.com/search?ei=UTF-8&fr=ytff-flv&p=
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://de.yahoo.com/
FF -: plugin - c:\Program Files\Microsoft Silverlight\npctrl.1.0.20926.0.dll
FF -: plugin - C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF -: plugin - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-28 10:33:01
Windows 6.0.6000 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostart Einträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
Zeit der Fertigstellung: 2008-08-28 10:37:24
ComboFix-quarantined-files.txt 2008-08-28 08:36:59

Pre-Run: 8 Verzeichnis(se), 110,883,725,312 Bytes frei
Post-Run: 17 Verzeichnis(se), 112,233,877,504 Bytes frei

295 --- E O F --- 2008-08-20 10:02:12

Soll ich jetzt noch von zoek machen?

Soll ich den Wiederherstellungspunkt benutzen oder nicht?


UND bin ich inifiziert von einem Keylogger?

#4 O4 - HKCU\..\Run: [CollaborationHost] C:\Windows\system32\p2phost.exe -s

Zitat

Related to People_Near_Me Microsoft® Windows® Peer-to-Peer Networking platform for Windows Vista. Note: Located in \%WINDIR%\System32\

ich sehe keinen Keylogger, allerdings:
UltraVNC: Remoteunterstützungs-Software ...
stelle sicher, dass nicht alle Welt das Passwort kennt.
Wozu hast du das überhaupt geladen ?
__________
MfG Sabina

rund um die PC-Sicherheit

#5 Was ist das denn?
Also dieses:

Zitat

Related to People_Near_Me Microsoft® Windows® Peer-to-Peer Networking platform for Windows Vista. Note: Located in \%WINDIR%\System32\

Ist das schlimm?


Aber der KEYLOGGER ist Fud, müsstest du den trotzdem sehen?

#6

Zitat

der KEYLOGGER ist Fud

was bedeutet "Fud" ???

Related to People_Near_Me Microsoft® Windows® Peer-to-Peer Networking platform for Windows Vista

ist nicht "schlimm"
http://technet.microsoft.com/en-us/network/bb545868.aspx

Zitat

http://support.microsoft.com/kb/817778/de
Advanced Networking Pack für Windows XP
Das Advanced Networking Pack für Windows XP aktualisiert IPv6 und Installiert die Internetverbindungsfirewall für IPv6. Standardmäßig werden nach der Installation des Updates keine Ports in der Firewall automatisch geöffnet. Verwenden Sie das Advanced Networking Pack für Windows XP für Software, die diese Funktionalität erfordert, oder wenn Sie benutzerdefinierte Programme entwerfen möchten, die die Windows Peer-to-Peer-Netzwerkinfrastruktur verwenden.

__________
MfG Sabina

rund um die PC-Sicherheit

#7

Zitat

Sabina postete

Zitat

der KEYLOGGER ist Fud

was bedeutet "Fud" ???

Related to People_Near_Me Microsoft® Windows® Peer-to-Peer Networking platform for Windows Vista

ist nicht "schlimm"
http://technet.microsoft.com/en-us/network/bb545868.aspx

Zitat

http://support.microsoft.com/kb/817778/de
Advanced Networking Pack für Windows XP
Das Advanced Networking Pack für Windows XP aktualisiert IPv6 und Installiert die Internetverbindungsfirewall für IPv6. Standardmäßig werden nach der Installation des Updates keine Ports in der Firewall automatisch geöffnet. Verwenden Sie das Advanced Networking Pack für Windows XP für Software, die diese Funktionalität erfordert, oder wenn Sie benutzerdefinierte Programme entwerfen möchten, die die Windows Peer-to-Peer-Netzwerkinfrastruktur verwenden.

FUD heißt "Full undetected" sowas wie "unbekannt" nicht zu finden, das sind die neuesten Keylogger, die Viren sind in einer "JPG" Datei versteckt, haben aber eine "EXE" Datei zum Ausführen, sieht jedoch aus wie "JPG".