problem mit ivideo-codec und virus burster...

#1 hallo!
hab mir auch das problem mit ivideo-codec und virus burster eingefangen
hier erstmal die logfiles:

Hijackthis:

Logfile of HijackThis v1.99.1
Scan saved at 15:46:32, on 06.11.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Intel\Wireless\Bin\EvtEng.exe
C:\Programme\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\System32\ircomm2k.exe
C:\Programme\Intel\Wireless\Bin\OProtSvc.exe
C:\Programme\Intel\Wireless\Bin\RegSrvc.exe
D:\Programme\Spyware Doctor\sdhelp.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Intel\Wireless\Bin\ZcfgSvc.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\VidCodecs\isamonitor.exe
C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Programme\VidCodecs\pmmon.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\ATK0100\Hcontrol.exe
C:\Programme\VidCodecs\isamini.exe
C:\Programme\SAMSUNG\Keydefin\KeyDefin.exe
C:\Programme\Java\jre1.5.0_07\bin\jusched.exe
C:\WINDOWS\ATK0100\ATKOSD.exe
D:\Programme\CyberLink\PowerDVD\PDVDServ.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Programme\Intel\Wireless\Bin\ifrmewrk.exe
C:\Programme\Intel\Wireless\Bin\EOUWiz.exe
C:\Programme\Winamp\winampa.exe
C:\Programme\QuickTime\qttask.exe
C:\Programme\DAEMON Tools\daemon.exe
C:\drivers\Utility\Gear511.exe
C:\Programme\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Creative\MediaSource\Detector\CTDetect.exe
D:\Programme\Spyware Doctor\swdoctor.exe
C:\Programme\Adobe\Acrobat 6.0\Distillr\acrotray.exe
D:\Programme\BTTray.exe
D:\Programme\Corel\Graphics9\Register\Remind32.exe
D:\Spiele\ogame\wwwserver\wwwserver.exe
D:\Programme\BTStackServer.exe
C:\Programme\VidCodecs\pmsngr.exe
D:\Programme\Mozilla Firefox\firefox.exe
C:\Programme\WinRAR\WinRAR.exe
C:\WINDOWS\system32\notepad.exe
D:\Programme\Proton\proton.exe
C:\Programme\WinRAR\WinRAR.exe
C:\DOKUME~1\admin\LOKALE~1\Temp\Rar$EX00.913\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.at/0SEDEAT/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.at/0SEDEAT/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bearflix.com/at/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.at/0SEDEAT/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://f$/
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - D:\Programme\ICQToolbar\toolbaru.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {274c0420-ebe0-4f1d-b473-edd1aa9b85dd} - C:\Programme\VidCodecs\isaddon.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - D:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.5.0_07\bin\ssv.dll
O2 - BHO: Response Class - {81A99149-F047-4090-8AAD-D11FF4EFB734} - C:\WINDOWS\system32\dae.dll (file missing)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - D:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programme\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - D:\Programme\ICQToolbar\toolbaru.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Programme\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programme\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [Hcontrol] C:\WINDOWS\ATK0100\Hcontrol.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Programme\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SAMSUNG Keydefin] C:\Programme\SAMSUNG\Keydefin\KeyDefin.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_07\bin\jusched.exe
O4 - HKLM\..\Run: [RemoteControl] d:\Programme\CyberLink\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [IntelWireless] C:\Programme\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [EOUApp] C:\Programme\Intel\Wireless\Bin\EOUWiz.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Programme\Winamp\winampa.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Programme\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [AS00_Gear511] C:\drivers\Utility\Gear511.exe -hide
O4 - HKLM\..\Run: [OpwareSE2] "C:\Programme\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [ICQ Lite] "D:\Programme\ICQLite\ICQLite.exe" -minimize
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "D:\Programme\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Creative Detector] C:\Programme\Creative\MediaSource\Detector\CTDetect.exe /R
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programme\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Spyware Doctor] "D:\Programme\Spyware Doctor\swdoctor.exe" /Q
O4 - Startup: Corel Registration.lnk = D:\Programme\Corel\Graphics9\Register\Remind32.exe
O4 - Startup: Visual GSM Sleep Modus.lnk = D:\Programme\Visual GSM 2.0.3\vgsm20.exe
O4 - Startup: WWW Server.lnk = D:\Spiele\ogame\wwwserver\wwwserver.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Programme\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Windows Live Search - res://C:\Programme\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Easy-WebPrint - Drucken - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint - Schnelldruck - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint - Vorschau - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint - Zu Druckliste hinzufügen - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: In neuer Registerkarte im Hintergrund öffnen - res://C:\Programme\Windows Live Toolbar\Components\de-at\msntabres.dll.mui/229?06b09258c37946b782cd605ad73a4c91
O8 - Extra context menu item: In neuer Registerkarte im Vordergrund öffnen - res://C:\Programme\Windows Live Toolbar\Components\de-at\msntabres.dll.mui/230?06b09258c37946b782cd605ad73a4c91
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - D:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - D:\Spiele\PartyPokerNet\RunPF.exe
O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - D:\Spiele\PartyPokerNet\RunPF.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: IntelWireless - C:\Programme\Intel\Wireless\Bin\LgNotify.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: detachments - {01d8d081-0f76-4ab5-b5e4-9b23a709670e} - C:\WINDOWS\system32\sacskza.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: EvtEng - Intel Corporation - C:\Programme\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Virtueller Infrarot-Kommunikationsanschluß, Dienstprogramm (IrCOMM2kSvc) - Jan Kiszka - C:\WINDOWS\System32\ircomm2k.exe
O23 - Service: OwnershipProtocol - Intel Corporation - C:\Programme\Intel\Wireless\Bin\OProtSvc.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Programme\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Programme\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Samsung Update Plus - Unknown owner - C:\Programme\Samsung\Samsung Update Plus\SLUBackgroundService.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - D:\Programme\Spyware Doctor\sdhelp.exe



combofix:

admin - 06-11-06 15:22:24,47 Service Pack 2
ComboFix 06.10.19 - Running from: "D:\Programme\Mozilla Firefox"

((((((((((((((((((((((((((((((( Files Created from 2006-10-06 to 2006-11-06 ))))))))))))))))))))))))))))))))))


2006-11-06 11:58 51,072 --a------ C:\WINDOWS\system32\drivers\ikhlayer.sys
2006-11-06 11:58 30,592 --a------ C:\WINDOWS\system32\drivers\ikhfile.sys
2006-11-06 01:28 106,496 --a------ C:\WINDOWS\system32\sacskza.dll
2006-10-16 09:14 178,408 --a------ C:\WINDOWS\system32\muweb.dll
2006-10-16 09:14 128,232 --a------ C:\WINDOWS\system32\mucltui.dll


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-11-06 15:17 -------- d----c--- C:\Dokumente und Einstellungen\admin\Anwendungsdaten\Skype
2006-11-06 11:58 -------- d----c--- C:\Dokumente und Einstellungen\admin\Anwendungsdaten\PC Tools
2006-11-06 11:45 -------- d-------- C:\Programme\VidCodecs
2006-11-06 01:43 -------- d-------- C:\Programme\VirusBursters
2006-10-23 21:03 -------- d----c--- C:\Dokumente und Einstellungen\admin\Anwendungsdaten\BearShare
2006-10-17 15:08 -------- d-------- C:\Programme\MSXML 4.0
2006-10-14 14:47 -------- d---sc--- C:\Dokumente und Einstellungen\admin\Anwendungsdaten\Microsoft
2006-10-14 14:47 -------- d-------- C:\Programme\Windows Live Toolbar
2006-10-14 14:46 -------- d-------- C:\Programme\MSN Messenger
2006-09-28 11:45 778656 --a------ C:\WINDOWS\system32\drivers\avg7core.sys
2006-09-13 06:02 1084416 --a------ C:\WINDOWS\system32\msxml3.dll
2006-09-12 16:51 1245184 --a------ C:\WINDOWS\system32\msxml4.dll
2006-08-25 16:46 617472 --a------ C:\WINDOWS\system32\comctl32.dll
2006-08-21 13:26 16896 --a------ C:\WINDOWS\system32\fltlib.dll
2006-08-21 10:14 23040 --a------ C:\WINDOWS\system32\fltmc.exe
2006-08-16 12:58 100352 --a------ C:\WINDOWS\system32\6to4svc.dll


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\ctfmon.exe"
"Skype"="\"D:\\Programme\\Skype\\Phone\\Skype.exe\" /nosplash /minimized"
"Creative Detector"="C:\\Programme\\Creative\\MediaSource\\Detector\\CTDetect.exe /R"
"MsnMsgr"="\"C:\\Programme\\MSN Messenger\\MsnMsgr.Exe\" /background"
"Spyware Doctor"="\"D:\\Programme\\Spyware Doctor\\swdoctor.exe\" /Q"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"ATIModeChange"="Ati2mdxx.exe"
"ATIPTA"="C:\\Programme\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe"
"AGRSMMSG"="AGRSMMSG.exe"
"Hcontrol"="C:\\WINDOWS\\ATK0100\\Hcontrol.exe"
"SynTPLpr"="C:\\Programme\\Synaptics\\SynTP\\SynTPLpr.exe"
"SynTPEnh"="C:\\Programme\\Synaptics\\SynTP\\SynTPEnh.exe"
"SAMSUNG Keydefin"="C:\\Programme\\SAMSUNG\\Keydefin\\KeyDefin.exe"
"SunJavaUpdateSched"="C:\\Programme\\Java\\jre1.5.0_07\\bin\\jusched.exe"
"RemoteControl"="d:\\Programme\\CyberLink\\PowerDVD\\PDVDServ.exe"
"AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgcc.exe /STARTUP"
"AVG7_EMC"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgemc.exe"
@=""
"IntelWireless"="C:\\Programme\\Intel\\Wireless\\Bin\\ifrmewrk.exe /tf Intel PROSet/Wireless"
"EOUApp"="C:\\Programme\\Intel\\Wireless\\Bin\\EOUWiz.exe"
"WinampAgent"="C:\\Programme\\Winamp\\winampa.exe"
"QuickTime Task"="\"C:\\Programme\\QuickTime\\qttask.exe\" -atboottime"
"DAEMON Tools"="\"C:\\Programme\\DAEMON Tools\\daemon.exe\" -lang 1033"
"AS00_Gear511"="C:\\drivers\\Utility\\Gear511.exe -hide"
"OpwareSE2"="\"C:\\Programme\\ScanSoft\\OmniPageSE2.0\\OpwareSE2.exe\""
"ICQ Lite"="\"D:\\Programme\\ICQLite\\ICQLite.exe\" -minimize"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Die derzeitige Homepage"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,18,01,00,00,00,00,00,00,60,04,00,00,fc,03,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\
00,00,01,00,00,00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"
"Spyware Doctor"="\"D:\\Programme\\Spyware Doctor\\swdoctor.exe\" /Q"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"
"Spyware Doctor"="\"D:\\Programme\\Spyware Doctor\\swdoctor.exe\" /Q"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"
"{01d8d081-0f76-4ab5-b5e4-9b23a709670e}"="detachments"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]
"isamonitor.exe"="C:\\Programme\\VidCodecs\\isamonitor.exe"
"pmsngr.exe"="C:\\Programme\\VidCodecs\\pmsngr.exe"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
"detachments"="{01d8d081-0f76-4ab5-b5e4-9b23a709670e}"

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"


Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\Check Updates for Windows Live Toolbar.job

Completion time: 06-11-06 15:23:13.86
C:\ComboFix.txt ... 06-11-06 15:23


datafind:

log1:

Datentr„ger in Laufwerk C: ist WinXP
Volumeseriennummer: 6878-91AC

Verzeichnis von C:\WINDOWS\system32

06.11.2006 15:18 2.634 ikhcore.log
06.11.2006 15:15 2.262 wpa.dbl
06.11.2006 01:28 106.496 sacskza.dll
29.10.2006 17:51 311.938 perfh009.dat
29.10.2006 17:51 40.326 perfc009.dat
29.10.2006 17:51 48.552 perfc007.dat
29.10.2006 17:51 317.168 perfh007.dat
29.10.2006 17:51 723.744 PerfStringBackup.INI
14.10.2006 14:47 7.200 wuredist.cab
04.10.2006 21:03 9.639.336 MRT.exe
13.09.2006 06:02 1.084.416 msxml3.dll
12.09.2006 16:51 1.245.184 msxml4.dll
04.09.2006 07:12 1.494.016 shdocvw.dll
25.08.2006 16:46 617.472 comctl32.dll
21.08.2006 13:26 16.896 fltlib.dll
21.08.2006 10:14 23.040 fltmc.exe
16.08.2006 12:58 100.352 6to4svc.dll

log2:

Datentr„ger in Laufwerk C: ist WinXP
Volumeseriennummer: 6878-91AC

Verzeichnis von C:\DOKUME~1\admin\LOKALE~1\Temp

log3:

Datentr„ger in Laufwerk C: ist WinXP
Volumeseriennummer: 6878-91AC

Verzeichnis von C:\WINDOWS

06.11.2006 15:24 1.312.233 WindowsUpdate.log
06.11.2006 15:16 423.349 setupapi.log
06.11.2006 15:15 159 wiadebug.log
06.11.2006 15:15 50 wiaservc.log
06.11.2006 15:15 0 0.log
06.11.2006 15:14 2.048 bootstat.dat
06.11.2006 15:14 32.638 SchedLgU.Txt
06.11.2006 15:07 49 NeroDigital.ini
04.11.2006 03:08 155 winamp.ini
04.11.2006 02:37 54.156 QTFont.qfn
04.11.2006 02:13 10.010 mozver.dat
22.10.2006 15:54 1.409 QTFont.for
13.10.2006 08:41 327.109 tsoc.log
13.10.2006 08:41 924.053 iis6.log
13.10.2006 08:41 146.607 ntdtcsetup.log
13.10.2006 08:41 232.900 comsetup.log
13.10.2006 08:41 31.256 tabletoc.log
13.10.2006 08:41 1.393 imsins.log
13.10.2006 08:41 38.419 ocmsn.log
13.10.2006 08:41 12.432 KB924191.log
13.10.2006 08:41 49.467 medctroc.Log
13.10.2006 08:41 384.802 ocgen.log
13.10.2006 08:41 115.741 netfxocm.log
13.10.2006 08:41 35.016 msgsocm.log
13.10.2006 08:41 653.574 FaxSetup.log
13.10.2006 08:41 239.704 msmqinst.log
13.10.2006 08:41 37.601 updspapi.log
13.10.2006 08:41 1.393 imsins.BAK
13.10.2006 08:41 12.248 KB922819.log
13.10.2006 08:40 11.420 KB923414.log
13.10.2006 08:40 11.437 KB924496.log
13.10.2006 08:40 8.825 KB923191.log
26.09.2006 22:36 11.582 KB925486.log
15.09.2006 08:43 11.345 KB920685.log
15.09.2006 08:43 13.024 KB920872.log
15.09.2006 08:42 11.523 KB919007.log
15.09.2006 08:42 7.703 KB922582.log
28.08.2006 22:00 174.493 setupact.log
28.08.2006 21:09 7.210 WgaNotify.log
15.08.2006 21:49 22.359 KB920214.log
15.08.2006 21:48 20.777 KB921883.log
15.08.2006 21:48 21.924 KB922616.log
15.08.2006 21:48 22.435 KB921398.log
15.08.2006 21:47 25.724 KB918899.log
15.08.2006 21:46 18.256 KB920670.log
15.08.2006 21:45 18.423 KB917422.log
15.08.2006 21:45 18.009 KB920683.log

log4:

Datentr„ger in Laufwerk C: ist WinXP
Volumeseriennummer: 6878-91AC

Verzeichnis von C:\WINDOWS\Temp

log5:

Datentr„ger in Laufwerk C: ist WinXP
Volumeseriennummer: 6878-91AC

Verzeichnis von C:\WINDOWS\Downloaded Program Files

27.08.2005 13:30 5.065 swflash.inf
04.01.2005 20:59 65 desktop.ini
20.01.2000 15:25 1.162 Microsoft XML Parser for Java.osd
3 Datei(en) 6.292 Bytes
0 Verzeichnis(se), 838.819.840 Bytes frei

log6:

Datentr„ger in Laufwerk C: ist WinXP
Volumeseriennummer: 6878-91AC

Verzeichnis von C:\

06.11.2006 15:35 0 sys.txt
06.11.2006 15:35 408 down.txt
06.11.2006 15:34 109 tmp.txt
06.11.2006 15:33 10.779 system.txt
06.11.2006 15:32 125 systemtemp.txt
06.11.2006 15:31 101.582 system32.txt
06.11.2006 15:23 7.782 ComboFix.txt
06.11.2006 15:14 1.363.148.800 pagefile.sys
06.11.2006 14:20 210 VundoFix.txt
06.11.2006 11:47 268 sqmdata03.sqm
06.11.2006 11:47 244 sqmnoopt03.sqm
06.11.2006 02:02 268 sqmdata02.sqm
06.11.2006 02:02 244 sqmnoopt02.sqm
29.10.2006 19:35 244 sqmnoopt01.sqm
29.10.2006 19:35 268 sqmdata01.sqm
27.10.2006 21:17 268 sqmdata00.sqm
27.10.2006 21:17 244 sqmnoopt00.sqm
30.09.2006 19:35 137 BcBtRmv.log
22.12.2005 17:48 330.279 creatureScanexport.csef
31.10.2005 16:56 700.416 StubInstaller.exe
22.09.2005 15:29 12.946.530 AVG7DB_F.DAT
30.01.2005 08:00 12.339.825 AVG7QT.DAT
25.01.2005 20:43 211 boot.ini
25.01.2005 20:34 47.564 NTDETECT.COM
25.01.2005 20:34 251.184 ntldr
05.01.2005 20:00 17.008 SDSSetup.log
04.01.2005 21:00 0 IO.SYS
04.01.2005 21:00 0 CONFIG.SYS
04.01.2005 21:00 0 AUTOEXEC.BAT
04.01.2005 21:00 0 MSDOS.SYS
18.08.2001 13:00 4.952 bootfont.bin
31 Datei(en) 1.389.909.949 Bytes
0 Verzeichnis(se), 838.754.304 Bytes frei

die warnungen und popups machen mich schon langsam wahnsinnig...
bin echt froh das forum gefunden zu haben. hoffe ihr könnt mir weiterhelfen!
besten dank im voraus!
nibbler

#2 Download Registry Search by Bobbi Flekman
http://virus-protect.org/artikel/tools/regsearch.html
und doppelklicken, um zu starten. in: "Enter search strings" (reinschreiben oder reinkopieren)

iVideoCodec

in edit und klicke "Ok".
Notepad wird sich oeffnen - hier posten

in: "Enter search strings" (reinschreiben oder reinkopieren)

VirusBursters

in edit und klicke "Ok".
Notepad wird sich oeffnen - hier posten
__________
MfG Sabina

rund um die PC-Sicherheit

#3 danke. geht ja flott!

REGEDIT4

; Registry Search 2.0 by Bobbi Flekman © 2005
; Version: 2.0.1.0

; Results at 06.11.2006 17:17:33 for strings:
; 'ivideocodec'
; Strings excluded from search:
; (None)
; Search in:
; Registry Keys Registry Values Registry Data
; HKEY_LOCAL_MACHINE HKEY_USERS


; End Of The Log...


REGEDIT4

; Registry Search 2.0 by Bobbi Flekman © 2005
; Version: 2.0.1.0

; Results at 06.11.2006 17:19:24 for strings:
; 'virusbursters'
; Strings excluded from search:
; (None)
; Search in:
; Registry Keys Registry Values Registry Data
; HKEY_LOCAL_MACHINE HKEY_USERS


[HKEY_USERS\S-1-5-21-1004336348-764733703-839522115-1003\Software\Microsoft\Search Assistant\ACMru\5603]
"001"="virusbursters"

[HKEY_USERS\S-1-5-21-1004336348-764733703-839522115-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\\Programme\\VirusBursters\\virusbursters.exe"="Anti- spyware and adware"

; End Of The Log...

#4 Avenger
http://virus-protect.org/artikel/tools/avenger.html
kopiere rein
-------------------------------

Zitat

Registry values to delete:
HKLM\software\microsoft\windows\currentversion\shellserviceobjectdelayload|detachments
HKLM\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler|{01d8d081-0f76-4ab5-b5e4-9b23a709670e}
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run|isamonitor.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run|pmsngr.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run|wininet.dll
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run|VirusBursters

registry keys to delete:
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{ACF3DAB0-D308-4B7A-BFE3-E6C0FAFEB1E7}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\iVideoCodec
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Public Messenger ver 2.03
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Internet Explorer Security Plugin 2006
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8bf5b8fc-11cb-409f-8c91-4d4ca04a1b6d}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1a29a79a-b9c8-44a9-bedf-7fadde3cf33f}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{274c0420-ebe0-4f1d-b473-edd1aa9b85dd}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CodecsSoftwarePackage.chl
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVZipEnchancer.Chl
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirusBursters
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\virusbursters.exe
HKEY_LOCAL_MACHINE\SOFTWARE\VirusBursters

Files to delete:
C:\WINDOWS\system32\sacskza.dll

Folders to delete:
C:\Programme\VirusBursters
C:\Programme\iVideoCodec

---------------------------------------


Klicke die grüne Ampel
das Script wird nun ausgeführt, dann wird der PC automatisch neustarten

»»
loesche das Backup vom Avenger unter C:\Avenger\backup.zip + leere den Papierkorb

««
scanne mit smitfraudfix - Option 1 und 2 ( lasse auch die Registry mitreinigen)
http://virus-protect.org/artikel/tools/smitfrautfix.html
__________
MfG Sabina

rund um die PC-Sicherheit

#5 danke! hab bisher keine fehlermeldungen mehr und alle icons sind weg. super!
nochmal thx für die schnelle hilfe.
mfg nibbler