Virusburst eingefangen

#1 hab mir den Schei... leider auch eingefangen, hier die logs.

Logfile of HijackThis v1.99.1
Scan saved at 20:43:17, on 12.10.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\HQVideoCodec\isamonitor.exe
C:\Programme\HQVideoCodec\pmsngr.exe
C:\Programme\QuickTime\qttask.exe
C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
C:\Programme\DAEMON Tools\daemon.exe
C:\PROGRA~1\eScan\TRAYICOS.EXE
C:\PROGRA~1\eScan\AVPMWrap.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\HQVideoCodec\pmmon.exe
C:\Programme\HQVideoCodec\isamini.exe
C:\PROGRA~1\eScan\MAILDISP.EXE
C:\PROGRA~1\eScan\MAILSCAN.EXE
C:\PROGRA~1\ESCAN\SPOOLER.EXE
C:\PROGRA~1\eScan\kavss.exe
C:\WINDOWS\system32\devldr32.exe
C:\Programme\FRITZ!DSL\IGDCTRL.EXE
C:\PROGRA~1\eScan\TRAYSSER.EXE
C:\PROGRA~1\eScan\avpm.exe
C:\Programme\Gemeinsame Dateien\MicroWorld\Agent\MWASER.EXE
C:\Programme\Gemeinsame Dateien\MicroWorld\Agent\MWAgent.exe
C:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\PROGRA~1\eScan\AvpM.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\Dokumente und Einstellungen\Administrator\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {d869742a-e5d2-4624-96c7-aae26170665e} - C:\Programme\HQVideoCodec\isaddon.dll
O3 - Toolbar: Protection Bar - {479fd0cf-5be9-4c63-8cda-b6d371c67bd5} - C:\Programme\HQVideoCodec\iesplugin.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Programme\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [MailScan Dispatcher] "C:\Programme\eScan\LAUNCH.EXE"
O4 - HKLM\..\Run: [eScan Updater] C:\PROGRA~1\eScan\TRAYICOS.EXE /App
O4 - HKLM\..\Run: [eScan Monitor] C:\PROGRA~1\eScan\AVPMWrap.EXE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\mwtsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\mwtsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\mwtsp.dll
O21 - SSODL: gaonic - {f31aee4a-1530-4fef-8537-79c6973bff9a} - C:\WINDOWS\system32\tazth.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVM IGD CTRL Service - AVM Berlin - C:\Programme\FRITZ!DSL\IGDCTRL.EXE
O23 - Service: AVM FRITZ!web Routing Service (de_serv) - AVM Berlin - C:\Programme\Gemeinsame Dateien\AVM\de_serv.exe
O23 - Service: eScan Server-Updater (eScan-trayicos) - MicroWorld Technologies Inc. - C:\PROGRA~1\eScan\TRAYSSER.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: eScan Monitor Service (KAVMonitorService) - Kaspersky Labs. - C:\PROGRA~1\eScan\avpm.exe
O23 - Service: MWAgent - MicroWorld Technologies Inc. - C:\Programme\Gemeinsame Dateien\MicroWorld\Agent\MWASER.EXE
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

---------------------------------------------------------------------------

Administrator - 06-10-12 20:50:24,49 Service Pack 2
ComboFix 06.10.12 - Running from: "C:\Dokumente und Einstellungen\Administrator\Desktop"

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\system32\taskmgr.com


((((((((((((((((((((((((((((((( Files Created from 2006-09-12 to 2006-10-12 ))))))))))))))))))))))))))))))))))


2006-10-12 14:19 950,272 --a------ C:\WINDOWS\system32\contfilt.dll
2006-10-12 14:19 9,488 --a------ C:\WINDOWS\sporder.dll
2006-10-12 14:19 81,976 --a------ C:\WINDOWS\winsbak2.reg
2006-10-12 14:19 7,680 --a------ C:\WINDOWS\sporder.exe
2006-10-12 14:19 508,928 --a------ C:\WINDOWS\system32\eInstall.exe
2006-10-12 14:19 41,984 --a------ C:\WINDOWS\killproc.exe
2006-10-12 14:19 40,448 --a------ C:\WINDOWS\inst_tsp.exe
2006-10-12 14:19 339,968 --a------ C:\WINDOWS\system32\mwtsp.dll
2006-10-12 14:19 32,768 --a------ C:\WINDOWS\system32\esmxlog.dll
2006-10-12 14:19 153,600 --a------ C:\WINDOWS\REGEDIT.COM
2006-10-12 14:19 153,600 --a------ C:\WINDOWS\R.COM
2006-10-12 14:19 140,800 --a------ C:\WINDOWS\system32\T.COM
2006-10-12 14:19 138,000 --a------ C:\WINDOWS\system32\drivers\klif108.sys
2006-10-12 14:19 130,560 --a------ C:\WINDOWS\system32\ZIPDLL.DLL
2006-10-12 14:19 125,440 --a------ C:\WINDOWS\system32\UNZDLL.DLL
2006-10-12 14:19 118,784 --a------ C:\WINDOWS\system32\mwnsp.dll
2006-10-12 14:19 117,008 --a------ C:\WINDOWS\system32\drivers\klif50.sys
2006-10-12 14:19 11,026 --a------ C:\WINDOWS\winsbak.reg
2006-10-12 14:19 <DIR> d-------- C:\WINDOWS\system32\FLCSS.EXE
2006-10-12 13:42 306,688 --a------ C:\WINDOWS\IsUninst.exe
2006-10-12 13:14 106,496 --a------ C:\WINDOWS\system32\tazth.dll
2006-09-21 12:08 223,128 --a------ C:\WINDOWS\system32\drivers\dtscsi.sys


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-10-12 20:50 -------- d-------- C:\Programme\eScan
2006-10-12 20:44 -------- d-------- C:\Programme\CleanUp!
2006-10-12 20:18 -------- d-------- C:\Programme\Mozilla Firefox
2006-10-12 15:31 -------- d-------- C:\Programme\Winamp
2006-10-12 15:27 -------- d-------- C:\Programme\HQVideoCodec
2006-10-12 14:19 -------- d-------- C:\Programme\Gemeinsame Dateien\MicroWorld
2006-10-12 14:19 -------- d-------- C:\Programme\Gemeinsame Dateien
2006-10-12 13:46 -------- d-------- C:\Programme\Lavasoft
2006-10-12 13:46 -------- d-------- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Lavasoft
2006-09-21 12:10 12464 --a------ C:\WINDOWS\system32\drivers\secdrv.sys
2006-09-21 12:08 -------- d-------- C:\Programme\DAEMON Tools
2006-09-11 16:32 33952 --a------ C:\WINDOWS\system32\drivers\oreans32.sys
2006-09-11 16:26 -------- d--h----- C:\Programme\InstallShield Installation Information
2006-09-11 16:26 -------- d-------- C:\Programme\Microsoft Games
2006-09-11 16:23 -------- d---s---- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Microsoft
2006-08-23 03:57 -------- d-------- C:\Programme\Combined Community Codec Pack


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\ctfmon.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"QuickTime Task"="\"C:\\Programme\\QuickTime\\qttask.exe\" -atboottime"
"SunJavaUpdateSched"="C:\\Programme\\Java\\jre1.5.0_06\\bin\\jusched.exe"
"DAEMON Tools"="\"C:\\Programme\\DAEMON Tools\\daemon.exe\" -lang 1033"
"MailScan Dispatcher"="\"C:\\Programme\\eScan\\LAUNCH.EXE\""
"eScan Updater"="C:\\PROGRA~1\\eScan\\TRAYICOS.EXE /App"
"eScan Monitor"="C:\\PROGRA~1\\eScan\\AVPMWrap.EXE"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Die derzeitige Homepage"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,00,01,00,00,00,00,00,00,00,04,00,00,00,04,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,f2,01,00,00,b9,00,00,00,7c,00,00,00,72,00,\
00,00,01,00,00,00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"
"{f31aee4a-1530-4fef-8537-79c6973bff9a}"="gaonic"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001
"SynchronousMachineGroupPolicy"=dword:00000000
"SynchronousUserGroupPolicy"=dword:00000000

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]
"isamonitor.exe"="C:\\Programme\\HQVideoCodec\\isamonitor.exe"
"pmsngr.exe"="C:\\Programme\\HQVideoCodec\\pmsngr.exe"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
"gaonic"="{f31aee4a-1530-4fef-8537-79c6973bff9a}"


HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders
securityproviders REG_SZ msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll


Completion time: 06-10-12 20:50:48.03
ComboFix.txt

#2 Download Registry Search by Bobbi Flekman
http://virus-protect.org/artikel/tools/regsearch.html
und doppelklicken, um zu starten. in: "Enter search strings" (reinkopieren)

HQVideoCodec

in edit und klicke "Ok".
Notepad wird sich oeffnen

in: "Enter search strings" (reinkopieren)

{d869742a-e5d2-4624-96c7-aae26170665e}

in edit und klicke "Ok".
Notepad wird sich oeffnen

in: "Enter search strings" (reinkopieren)

{479fd0cf-5be9-4c63-8cda-b6d371c67bd5}

in edit und klicke "Ok".
Notepad wird sich oeffnen
__________
MfG Sabina

rund um die PC-Sicherheit

#3 Also wenn ich das so mache öffnet sich leider nicht das notepad... am ende der suche hängt sich das programm quasi auf...

bzw was meinst du mit : in edit und klicke ok?
Ich gebe das von dir geschriebene einfach in "Enter search strins" ein und klicke dann ok.

#4 versuche es mit diesem Proggie

Registry Search Tool
http://www.billsway.com/vbspage/vbsfiles/RegSrch.zip
eventuelle Meldung vom Virenscanner --- > warnmeldung:bösartiges skript entdeckt --> ignorieren

Doppelklick:regsrch.vbs
reinkopieren: (siehe oben)
__________
MfG Sabina

rund um die PC-Sicherheit

#5 oki das geht, soll ich diese 3 loggs jetzt hier posten?
Ich machs einfach mal

REGEDIT4
; RegSrch.vbs © Bill James

; Registry search results for string "HQVideoCodec" 06-10-13 15:30:46

; NOTE: This file will be deleted when you close WordPad.
; You must manually save this file to a new location if you want to refer to it again later.
; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.)


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{479fd0cf-5be9-4c63-8cda-b6d371c67bd5}\InprocServer32]
@="C:\\Programme\\HQVideoCodec\\iesplugin.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d869742a-e5d2-4624-96c7-aae26170665e}\InprocServer32]
@="C:\\Programme\\HQVideoCodec\\isaddon.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run]
"isamonitor.exe"="C:\\Programme\\HQVideoCodec\\isamonitor.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run]
"pmsngr.exe"="C:\\Programme\\HQVideoCodec\\pmsngr.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Internet Explorer Security Plugin 2006]
"UninstallString"="\"C:\\Programme\\HQVideoCodec\\iesuninst.exe\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Internet Security Add-On]
"UninstallString"="\"C:\\Programme\\HQVideoCodec\\isauninst.exe\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Public Messenger ver 2.03]
"UninstallString"="\"C:\\Programme\\HQVideoCodec\\pmuninst.exe\""

[HKEY_USERS\S-1-5-21-1177238915-1993962763-854245398-500\Software\Internet Security]
"Path"="C:\\Programme\\HQVideoCodec"

[HKEY_USERS\S-1-5-21-1177238915-1993962763-854245398-500\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\\Programme\\HQVideoCodec\\pmsngr.exe"="pmsngr"

[HKEY_USERS\S-1-5-21-1177238915-1993962763-854245398-500\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\\Programme\\HQVideoCodec\\isamonitor.exe"="isamonitor"

[HKEY_USERS\S-1-5-21-1177238915-1993962763-854245398-500\Software\MicroWorld\MWAV\C:#Programme#HQVideoCodec]

---------------------------------------------------------------------------------------------------------------------------

REGEDIT4
; RegSrch.vbs © Bill James

; Registry search results for string "{d869742a-e5d2-4624-96c7-aae26170665e}" 06-10-13 15:32:11

; NOTE: This file will be deleted when you close WordPad.
; You must manually save this file to a new location if you want to refer to it again later.
; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.)


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d869742a-e5d2-4624-96c7-aae26170665e}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d869742a-e5d2-4624-96c7-aae26170665e}\InprocServer32]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d869742a-e5d2-4624-96c7-aae26170665e}]

[HKEY_USERS\S-1-5-21-1177238915-1993962763-854245398-500\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\
{D869742A-E5D2-4624-96C7-AAE26170665E}]

[HKEY_USERS\S-1-5-21-1177238915-1993962763-854245398-500\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\
{D869742A-E5D2-4624-96C7-AAE26170665E}\iexplore]

---------------------------------------------------------------------------------------------------------------------------------------------------------------------------

REGEDIT4
; RegSrch.vbs © Bill James

; Registry search results for string "{479fd0cf-5be9-4c63-8cda-b6d371c67bd5}" 06-10-13 15:33:06

; NOTE: This file will be deleted when you close WordPad.
; You must manually save this file to a new location if you want to refer to it again later.
; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.)


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{479fd0cf-5be9-4c63-8cda-b6d371c67bd5}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{479fd0cf-5be9-4c63-8cda-b6d371c67bd5}\Implemented Categories]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{479fd0cf-5be9-4c63-8cda-b6d371c67bd5}\Implemented Categories\{00021493-0000-0000-C000-000000000046}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{479fd0cf-5be9-4c63-8cda-b6d371c67bd5}\InprocServer32]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{479fd0cf-5be9-4c63-8cda-b6d371c67bd5}"=hex:00

[HKEY_USERS\S-1-5-21-1177238915-1993962763-854245398-500\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{479FD0CF-5BE9-4C63-8CDA-B6D371C67BD5}]

[HKEY_USERS\S-1-5-21-1177238915-1993962763-854245398-500\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{479FD0CF-5BE9-4C63-8CDA-B6D371C67BD5}\iexplore]

#6 exe

««
Gehe in die Registry
Start - Ausfuehren - regedit

bearbeiten - suchen - gaonic

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{f31aee4a-1530-4fef-8537-79c6973bff9a}"="gaonic" - loeschen

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"gaonic"="{f31aee4a-1530-4fef-8537-79c6973bff9a}" - loeschen

______________________________________________________________________________________

««
Den folgenden Text in den Editor (Start - Zubehör - Editor) kopieren und als fixme.reg mit 'Speichern unter' auf dem Desktop. Gebe bei Dateityp 'Alle Dateien' an. Du solltest jetzt auf dem Desktop diese Datei finden. Die Datei "fixme.reg" auf dem Desktop doppelklicken und der Registry mit "ja" oder "yes" beifügen

Zitat

REGEDIT4

[-HKEY_USERS\S-1-5-21-1177238915-1993962763-854245398-500\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D869742A-E5D2-4624-96C7-AAE26170665E}]

[-HKEY_USERS\S-1-5-21-1177238915-1993962763-854245398-500\Software\Internet Security]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run]
"isamonitor.exe"=-
"pmsngr.exe"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{479fd0cf-5be9-4c63-8cda-b6d371c67bd5}"=-

**
Avenger
http://virus-protect.org/artikel/tools/avenger.html
kopiere rein:

Zitat

registry keys to delete:
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f31aee4a-1530-4fef-8537-79c6973bff9a}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{479fd0cf-5be9-4c63-8cda-b6d371c67bd5}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d869742a-e5d2-4624-96c7-aae26170665e}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d869742a-e5d2-4624-96c7-aae26170665e}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Internet Explorer Security Plugin 2006
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Internet Security Add-On
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Public Messenger ver 2.03

Files to delete:
C:\WINDOWS\system32\tazth.dll

Folders to delete:
C:\Programme\HQVideoCodec
C:\Programme\VirusBurster

Klicke die grüne Ampel das Script wird nun ausgeführt, dann wird der PC automatisch neustarten

**
scanne mit smitfraudfix (option 1 und 2 ) - poste hier beide sanreporte
http://virus-protect.org/artikel/tools/smitfrautfix.html
__________
MfG Sabina

rund um die PC-Sicherheit

#7 SmitFraudFix v2.109

Scan done at 16:27:13.16, 06-10-13
Run from C:\Dokumente und Einstellungen\Administrator\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\Dokumente und Einstellungen\Administrator


»»»»»»»»»»»»»»»»»»»»»»»» C:\Dokumente und Einstellungen\Administrator\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Start Menu


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOKUME~1\ADMINI~1\FAVORI~1


»»»»»»»»»»»»»»»»»»»»»»»» Desktop


»»»»»»»»»»»»»»»»»»»»»»»» C:\Programme


»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Die derzeitige Homepage"


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""


»»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32


»»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection


»»»»»»»»»»»»»»»»»»»»»»»» End

-------------------------------------------------------------------

SmitFraudFix v2.109

Scan done at 16:33:26.46, 06-10-13
Run from C:\Dokumente und Einstellungen\Administrator\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files


»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» End

#8 es muesste wieder alles o.k. sein
kommen noch popups ?
__________
MfG Sabina

rund um die PC-Sicherheit

#9 ne alles top, ich dank dir vielmals !!
Bin super happy!