Den Trojaner ZLOB-BN bringe ich nicht weg

#1 Ich habe die Anleitungen studiert und soweit durchgeführt, soweit ich konnte.
Hier ist nun die HIJACK logdatei kopiert.


Logfile of HijackThis v1.99.1
Scan saved at 11:53:02, on 13.06.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\S24EvMon.exe
C:\Programme\NETGEAR\NETGEAR ProSafe VPN Client\IreIKE.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Alwil Software\Avast4\aswUpdSv.exe
C:\Programme\Alwil Software\Avast4\ashServ.exe
d:\PROGRAMME\BMDSoftware\BMDNtcsSvc.exe
d:\PROGRAMME\BMDSoftware\BMDPpsSvc.exe
C:\Programme\NETGEAR\NETGEAR ProSafe VPN Client\IPSecMon.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE
d:\PROGRA~1\BMDSOF~1\DBMGR\MSSQL$~1\binn\sqlservr.exe
C:\WINDOWS\system32\RegSrvc.exe
C:\Programme\Dantz\Retrospect\retrorun.exe
C:\Programme\Alwil Software\Avast4\ashMaiSv.exe
C:\Programme\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\ZCfgSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\1XConfig.exe
D:\PROGRAMME\BMDSoftware\BMDCallCenter.exe
C:\Programme\Logitech\iTouch\iTouch.exe
C:\WINDOWS\Logi_MwX.Exe
C:\Programme\Java\jre1.5.0_01\bin\jusched.exe
C:\Programme\CyberLink\PowerDVD\PDVDServ.exe
C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Programme\Synaptics\SynTP\SynTPLpr.exe
C:\Programme\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~1\Dantz\RETROS~1\ComboButton.exe
C:\PROGRA~1\NETSWI~1\NETSWT~1.EXE
C:\Programme\OIT\InfoNet\Tools\ClickYes.exe
C:\Programme\Babylon\Babylon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Microsoft ActiveSync\WCESCOMM.EXE
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Programme\Logitech\SetPoint\SetPoint.exe
C:\Programme\Gemeinsame Dateien\Logitech\KHAL\KHALMNPR.EXE
C:\Programme\NETGEAR\NETGEAR ProSafe VPN Client\SafeCfg.exe
C:\Programme\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\Programme\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Programme\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Dokumente und Einstellungen\han011\Desktop\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: Yahoo! Toolbar mit Pop-Up-Blocker - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [BMDNetClient_192.168.0.20] "C:\Programme\BMDNTCSClients\192.168.0.20\BMDNetClient.exe" /UPDATE
O4 - HKLM\..\Run: [BMDCallCenter] D:\PROGRAMME\BMDSoftware\BMDCallCenter.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Programme\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [BMDNetClient_SERVER01] "C:\Programme\BMDNTCSClients\SERVER01\BMDNetClient.exe" "/UPDATE=\\server01\BMDNTCS_PGM\"
O4 - HKLM\..\Run: [BMDNetClient_192.168.1.3] "C:\Programme\BMDNTCSClients\192.168.1.3\BMDNetClient.exe" "/UPDATE=\\192.168.1.3\bmdntcs_pgm\"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] C:\Programme\CyberLink\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [ZCfgSvc.exe] C:\WINDOWS\system32\ZCfgSvc.exe
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Programme\Intel\PROSetWireless\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Programme\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [MaxtorCombo] "C:\PROGRA~1\Dantz\RETROS~1\ComboButton.exe"
O4 - HKCU\..\Run: [NetSwitcher Tray Application] C:\PROGRA~1\NETSWI~1\NETSWT~1.EXE
O4 - HKCU\..\Run: [Express ClickYes] C:\Programme\OIT\InfoNet\Tools\ClickYes.exe
O4 - HKCU\..\Run: [Babylon Translator] C:\Programme\Babylon\Babylon.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Programme\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Programme\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Programme\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: NETGEAR ProSafe VPN Client.lnk = C:\Programme\NETGEAR\NETGEAR ProSafe VPN Client\SafeCfg.exe
O4 - Global Startup: Service Manager.lnk = C:\Programme\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Mobilen Favoriten erstellen... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O18 - Protocol: bw+0 - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: offline-8876480 - {52A2096A-CD38-4F7E-93D4-EDECA5B73F50} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O20 - Winlogon Notify: Sebring - C:\WINDOWS\system32\LgNotify.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Programme\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Programme\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programme\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Programme\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: BMDNtcsSvc - Unknown owner - d:\PROGRAMME\BMDSoftware\BMDNtcsSvc.exe
O23 - Service: BMDPpsService - Unknown owner - d:\PROGRAMME\BMDSoftware\BMDPpsSvc.exe
O23 - Service: AVM FRITZ!web Routing Service (de_serv) - AVM Berlin - C:\Programme\Gemeinsame Dateien\AVM\de_serv.exe
O23 - Service: SafeNet Monitor Service (IPSECMON) - SafeNet - C:\Programme\NETGEAR\NETGEAR ProSafe VPN Client\IPSecMon.exe
O23 - Service: SafeNet IKE Service (IreIKE) - SafeNet - C:\Programme\NETGEAR\NETGEAR ProSafe VPN Client\IreIKE.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\system32\RegSrvc.exe
O23 - Service: Retrospect Launcher (RetroLauncher) - Unknown owner - C:\Programme\Dantz\Retrospect\retrorun.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\system32\S24EvMon.exe

Ich bitte um hilfe, was ich weitermachen soll.

danke

#2 Wo meldet Avast denn diesen Zlob?
__________
MfG Ralf
SEO-Spam Hunter

#3

Zitat

raman postete
Wo meldet Avast denn diesen Zlob?

ca. alle halbe Stunde kommt eine Viruswarung! Die befallene Datei liegt im c:\Windows\system32\1024 ordner!

#4 Rechner im abgesicherten Modus starten und den Ordner c:\Windows\system32\1024 loeschen, neu starten und ein Datfindbat report erstellen und posten nach Anweisung: http://virus-protect.org/bat/datFind.bat
__________
MfG Ralf
SEO-Spam Hunter

#5

Zitat

raman postete
Rechner im abgesicherten Modus starten und den Ordner c:\Windows\system32\1024 loeschen, neu starten und ein Datfindbat report erstellen und posten nach Anweisung: http://virus-protect.org/bat/datFind.bat

Das ist der Inhalt von dirdat.txt!

Datentr„ger in Laufwerk C: ist Volume
Volumeseriennummer: 78FE-4EA2

Verzeichnis von c:\

13.06.2006 14:35 0 dirdat.txt
13.06.2006 14:34 1.610.612.736 pagefile.sys
13.06.2006 10:28 1.960 c.txt
13.06.2006 10:28 1.960 sys.txt
13.06.2006 10:27 9.671 windows.txt
13.06.2006 10:27 9.671 system.txt
13.06.2006 10:27 20.059 temp.txt
13.06.2006 10:26 20.059 systemtemp.txt
13.06.2006 10:26 102.298 system32.txt
31.05.2006 13:48 77.899 TIROL 6000-6699 2006.PDF
31.05.2006 13:30 123.511 TIROL 6000-6699 2005.PDF
23.05.2006 23:06 38 LIZ236021.TXT
23.05.2006 12:09 13.030 PDOXUSRS.NET
22.05.2006 14:32 2.022.400 LagerArt060522.xls
22.05.2006 14:28 888.832 ArtLager060522.xls
12.05.2006 12:06 330.752 HAN011.doc
10.05.2006 09:58 5.292 Touren.rtf
24.04.2006 08:27 87 bminit.txt
18.04.2006 15:52 1.055 intra.txt
29.03.2006 15:24 386 Telefonkampagne2006.TXT
29.03.2006 15:12 386 test.TXT
27.01.2006 10:22 6.596 policy.spd
05.01.2006 15:02 30.067 wiederhergestelltes Dokument.txt
27.12.2005 18:08 42 LIZ223065.TXT
29.11.2005 19:17 184.832 SeriendruckDokument.doc
29.11.2005 18:03 971.776 Etiketten Weihnachten 2005 - 1.xls
12.11.2005 00:11 1.120 INSTALL.LOG
29.09.2005 10:48 0 AUTOEXEC.BAT
29.09.2005 10:48 0 CONFIG.SYS
29.09.2005 10:48 0 IO.SYS
29.09.2005 10:48 0 MSDOS.SYS
29.09.2005 10:42 211 boot.ini
04.08.2004 14:00 251.184 ntldr
04.08.2004 14:00 47.564 NTDETECT.COM
04.08.2004 14:00 4.952 bootfont.bin
24.05.2001 13:59 162.304 UNWISE.EXE
36 Datei(en) 1.615.902.730 Bytes
0 Verzeichnis(se), 3.890.106.368 Bytes frei
Datentr„ger in Laufwerk C: ist Volume
Volumeseriennummer: 78FE-4EA2

Verzeichnis von C:\WINDOWS\system32

13.06.2006 14:35 50.701 ld101.tmp
13.06.2006 14:09 4.928 stdole3.tlb
12.06.2006 23:21 4.286 ot.ico
12.06.2006 23:21 4.286 ts.ico
12.06.2006 23:15 60.941 regperf.exe
11.06.2006 11:41 2.206 wpa.dbl
06.06.2006 07:40 4.212 zllictbl.dat
05.06.2006 09:14 3.002 CONFIG.NT
31.05.2006 11:02 624.640 aswBoot.exe
31.05.2006 10:54 90.112 AVASTSS.scr
29.05.2006 12:58 1.409 tmp82F50.FOT
29.05.2006 12:58 1.409 tmp92D50.FOT
22.05.2006 07:45 4.162 ModemLog_AVM ISDN Custom Config.txt
22.05.2006 07:45 4.660 ModemLog_AVM ISDN Analog Modem (V.32bis).txt
22.05.2006 07:45 4.610 ModemLog_AVM ISDN BTX.txt
22.05.2006 07:45 4.620 ModemLog_AVM ISDN FAX (G3).txt
22.05.2006 07:45 4.630 ModemLog_AVM ISDN - ISDN (X.75).txt
22.05.2006 07:45 4.632 ModemLog_AVM ISDN Mailbox (X.75).txt
22.05.2006 07:45 4.672 ModemLog_AVM ISDN SoftCompression X.75-V.42bis.txt
22.05.2006 07:45 4.642 ModemLog_AVM ISDN RAS (PPP over ISDN).txt
22.05.2006 07:45 4.652 ModemLog_AVM ISDN Internet (PPP over ISDN).txt
04.05.2006 06:26 5.818.784 MRT.exe
30.03.2006 11:26 1.492.480 shdocvw.dll
30.03.2006 03:16 18.944 xpsp3res.dll
26.03.2006 10:31 401.418 perfh009.dat
26.03.2006 10:31 412.904 perfh007.dat
26.03.2006 10:31 61.286 perfc009.dat
26.03.2006 10:31 72.338 perfc007.dat
26.03.2006 10:31 958.196 PerfStringBackup.INI


edit

#6 Hm, da sind n9och mehr Zlobreste, arbeite das bitte ab: http://siri.urz.free.fr/Fix/SmitfraudFix_De.php Bitte auch den Part mit "Reinigung" Abgesicherte Modus ist dabei wichtig!

Ein Kontrollscan mit Cureit im abgesicherten Modus danach waere auch empfehlenswert. http://virus-protect.org/cureit.html
Melde dich, falls Cureit noch etwas findet
__________
MfG Ralf
SEO-Spam Hunter

#7

Zitat

raman postete
Hm, da sind n9och mehr Zlobreste, arbeite das bitte ab: http://siri.urz.free.fr/Fix/SmitfraudFix_De.php Bitte auch den Part mit "Reinigung" Abgesicherte Modus ist dabei wichtig!

Ein Kontrollscan mit Cureit im abgesicherten Modus danach waere auch empfehlenswert. http://virus-protect.org/cureit.html
Melde dich, falls Cureit noch etwas findet

Dr. Web hat eine infiszierte Datei gefunden und gelöscht.

Ich danke vielmals für die Hilfe!!
lg aus Krems (A)