Virusbuster Eingefangen

#1 Ich habe mi den Virusbuster eingefangen jetz nervt mich das fenster immer mehr . habe ich mich rumgehört wie ich es wegkriege ich hoffe ihr könnt mir helfen.
Ich weiss nicht mehr weiter wäre nett wenn ihr mir hilft Hier HTJ und co*

Logfile of HijackThis v1.99.1
Scan saved at 20:54, on 06-12-06
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\TuneUp Utilities 2006\WinStylerThemeSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Sygate\SPF\smc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\brss01a.exe
C:\Programme\Video ActiveX Object\isamonitor.exe
C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programme\Video ActiveX Object\isamini.exe
C:\Programme\MSN Messenger\msnmsgr.exe
C:\Programme\ArcorOnline\Arcor.exe
C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\WINDOWS\system32\Brmfrmps.exe
C:\Programme\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wdfmgr.exe
E:\Dateien\hijackthis\HijackThis.exe


C:\Programme\Video ActiveX Object\isamini.exe <<<< von dem ort kommt der

C:\Programme\Video ActiveX Object\isamonitor.exe<<<<<< von diesen Ort kommt der



R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ogame.de/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.arcor.de
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.arcor.de/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Arcor AG & Co. KG
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: XTTBPos00 Class - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\Programme\ICQToolbar\tbu1A\toolbaru.dll
O2 - BHO: (no name) - {1a1ddc19-5893-43ab-a73f-f41a0f34d115} - C:\Programme\Video ActiveX Object\isaddon.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: Protection Bar - {96ebbe6a-2864-4345-b32b-26ee9be524b5} - C:\Programme\Video ActiveX Object\iesplugin.dll (file missing)
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [kav] "C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Programme\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\RunServices: [Microsoft dll Host Service ] wkssr.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Web-Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE
O15 - Trusted Zone: http://www.ogame.de
O16 - DPF: {2EF3FB47-7B1E-4536-BA4D-51427BD45DFA} (PIXACO Drag and Drop upload plugin) - http://www.pixaco.de/static/download/pixacodndupload.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{503AB39E-34A4-4129-8EAA-59D80A063F76}: NameServer = 195.50.140.114 195.50.140.252
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: klogon - C:\WINDOWS\System32\klogon.dll
O21 - SSODL: flammei - {9d635a36-6b3c-4146-8625-f3aaf507bbf8} - C:\WINDOWS\System32\vcehaeb.dll
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Kaspersky Lab - C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
O23 - Service: Brother Popup Suspend service for Resource manager (brmfrmps) - Unknown owner - C:\WINDOWS\system32\Brmfrmps.exe" -service (file missing)
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\System32\brsvc01a.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Programme\ewido anti-spyware 4.0\guard.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Programme\Sygate\SPF\smc.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Programme\TuneUp Utilities 2006\WinStylerThemeSvc.exe


ComboFix 06.11.27W - Running from: "C:\Dokumente und Einstellungen\Master Of Creed\Desktop"

((((((((((((((((((((((((((((((( Files Created from 2006-11-06 to 2006-12-06 ))))))))))))))))))))))))))))))))))


2006-12-05 13:45 <DIR> d-------- C:\Programme\CleanUp!
2006-12-05 13:34 <DIR> d--hs---- C:\FOUND.000
2006-12-04 20:50 <DIR> d-------- C:\Programme\Kaspersky Lab
2006-12-04 20:50 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Kaspersky Lab
2006-12-04 20:45 17,920 --a------ C:\WINDOWS\system32\vcehaeb.dll
2006-12-04 20:45 <DIR> d-------- C:\Programme\Video ActiveX Object
2006-12-03 19:46 <DIR> d-------- C:\Dokumente und Einstellungen\Master Of Creed\Anwendungsdaten\Help
2006-11-16 08:05 55,891 --a------ C:\WINDOWS\system32\drivers\Teefer.sys
2006-11-16 08:05 18,518 --a------ C:\WINDOWS\system32\drivers\wpsdrvnt.sys
2006-11-16 08:05 11,914 --a------ C:\WINDOWS\system32\drivers\wg3n.sys
2006-11-15 19:43 <DIR> d-------- C:\WINDOWS\system32\appmgmt
2006-11-14 13:42 83,096 --a------ C:\WINDOWS\system32\SSSensor.dll
2006-11-14 13:42 <DIR> d-------- C:\Programme\Sygate
2006-11-12 14:32 <DIR> dr------- C:\Dokumente und Einstellungen\Master Of Creed\Anwendungsdaten\Brother
2006-11-12 13:11 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
2006-11-12 13:10 <DIR> d-------- C:\Programme\Spybot - Search & Destroy
2006-11-12 09:25 <DIR> d-------- C:\Dokumente und Einstellungen\Master Of Creed\Anwendungsdaten\Ahead
2006-11-12 02:41 <DIR> d-------- C:\WINDOWS\system32\NtmsData
2006-11-10 19:11 <DIR> d-------- C:\Dokumente und Einstellungen\Master Of Creed\Anwendungsdaten\MSN6
2006-11-10 19:11 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MSN6
2006-11-07 20:30 <DIR> d-------- C:\Programme\inKline Global
2006-11-06 20:08 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Yahoo! Companion
2006-11-06 19:51 <DIR> d-------- C:\Programme\Yahoo!


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-12-05 14:16 61072 --a------ C:\WINDOWS\system32\drivers\klick.sys
2006-12-05 14:16 59536 --a------ C:\WINDOWS\system32\drivers\klin.sys
2006-11-02 16:36 -------- d-------- C:\Programme\Gemeinsame Dateien\ScanSoft Shared
2006-11-02 16:07 -------- d-------- C:\Dokumente und Einstellungen\Master Of Creed\Anwendungsdaten\ScanSoft
2006-11-02 15:36 0 --a------ C:\Programme\error.dat
2006-11-02 15:18 -------- d-------- C:\Programme\Common Files
2006-11-02 15:18 -------- d-------- C:\Programme\Brother
2006-11-02 15:15 -------- d-------- C:\Programme\ScanSoft
2006-11-01 11:39 -------- d-------- C:\Programme\audiograbber
2006-10-31 13:57 -------- d-------- C:\Programme\Lionhead Studios Ltd
2006-10-29 00:45 -------- d-------- C:\Dokumente und Einstellungen\Master Of Creed\Anwendungsdaten\DivX
2006-10-29 00:43 -------- d-------- C:\Programme\DivX
2006-10-28 17:45 -------- d-------- C:\Programme\Gemeinsame Dateien\Ahead
2006-10-28 17:45 -------- d-------- C:\Programme\Ahead
2006-10-28 17:43 -------- d-------- C:\Programme\WinRAR
2006-10-27 18:03 -------- d-------- C:\Programme\Gemeinsame Dateien\Designer
2006-10-27 18:01 -------- d-------- C:\Programme\Microsoft Office
2006-10-27 18:01 -------- d-------- C:\Dokumente und Einstellungen\Master Of Creed\Anwendungsdaten\Microsoft Web Folders
2006-10-24 18:09 43520 --a------ C:\WINDOWS\system32\CmdLineExt03.dll
2006-10-24 17:22 -------- d-------- C:\Dokumente und Einstellungen\Master Of Creed\Anwendungsdaten\Macromedia
2006-10-24 16:16 -------- d--h----- C:\Programme\InstallShield Installation Information
2006-10-24 16:16 -------- d-------- C:\Programme\Rockstar Games
2006-10-24 16:16 -------- d-------- C:\Programme\Gemeinsame Dateien\InstallShield
2006-10-24 15:08 -------- d-------- C:\Programme\mIRC
2006-10-23 21:25 -------- d-------- C:\Programme\Mozilla Firefox
2006-10-23 21:25 -------- d-------- C:\Dokumente und Einstellungen\Master Of Creed\Anwendungsdaten\Mozilla
2006-10-23 21:15 -------- d-------- C:\Dokumente und Einstellungen\Master Of Creed\Anwendungsdaten\Sun
2006-10-23 21:14 -------- d-------- C:\Programme\Google
2006-10-23 21:14 -------- d-------- C:\Dokumente und Einstellungen\Master Of Creed\Anwendungsdaten\Google
2006-10-23 21:13 -------- d-------- C:\Programme\Java
2006-10-23 21:12 -------- d-------- C:\Programme\Gemeinsame Dateien\Java
2006-10-23 21:05 -------- d-------- C:\Programme\MSN Messenger
2006-10-23 20:55 -------- d-------- C:\Programme\Winamp
2006-10-23 20:53 -------- d-------- C:\Dokumente und Einstellungen\Master Of Creed\Anwendungsdaten\ICQ Toolbar
2006-10-23 20:50 -------- d-------- C:\Programme\ICQToolbar
2006-10-23 20:49 -------- d-------- C:\Programme\ICQLite
2006-10-23 20:49 -------- d-------- C:\Dokumente und Einstellungen\Master Of Creed\Anwendungsdaten\ICQLite
2006-10-23 20:47 -------- d-------- C:\Programme\ArcorOnline
2006-10-23 20:40 -------- d-------- C:\Programme\RegCleaner
2006-10-23 20:39 -------- d-------- C:\Programme\ewido anti-spyware 4.0
2006-10-23 20:37 -------- d-------- C:\Programme\Lavalys
2006-10-23 20:36 -------- d-------- C:\Programme\TuneUp Utilities 2006
2006-10-23 20:36 -------- d-------- C:\Programme\Gemeinsame Dateien\Wise Installation Wizard
2006-10-23 20:36 -------- d-------- C:\Dokumente und Einstellungen\Master Of Creed\Anwendungsdaten\TuneUp Software
2006-10-23 20:30 -------- d--h----- C:\Programme\Uninstall Information
2006-10-23 20:30 -------- d-------- C:\Dokumente und Einstellungen\Master Of Creed\Anwendungsdaten\Identities
2006-10-23 20:23 0 -rahs---- C:\MSDOS.SYS
2006-10-23 20:23 0 -rahs---- C:\IO.SYS
2006-10-23 20:23 0 --a------ C:\CONFIG.SYS
2006-10-23 20:23 0 --a------ C:\AUTOEXEC.BAT
2006-10-23 20:23 -------- d-------- C:\Programme\xerox
2006-10-23 20:23 -------- d-------- C:\Programme\microsoft frontpage
2006-10-23 20:21 -------- d-------- C:\Programme\Online-Dienste
2006-10-23 20:20 -------- d-------- C:\Programme\Windows Media Player
2006-10-23 20:20 -------- d-------- C:\Programme\Movie Maker
2006-10-23 20:19 -------- d-------- C:\Programme\Outlook Express
2006-10-23 20:19 -------- d-------- C:\Programme\NetMeeting
2006-10-23 20:19 -------- d-------- C:\Programme\Internet Explorer
2006-10-23 20:19 -------- d-------- C:\Programme\Gemeinsame Dateien\System
2006-10-23 20:19 -------- d-------- C:\Programme\Gemeinsame Dateien\MSSoap
2006-10-23 20:19 -------- d-------- C:\Programme\Gemeinsame Dateien\Dienste
2006-10-23 20:18 -------- d--h----- C:\Programme\WindowsUpdate
2006-10-23 20:18 -------- d-------- C:\Programme\Online Services
2006-10-23 20:18 -------- d-------- C:\Programme\Messenger
2006-10-23 20:18 -------- d-------- C:\Programme\ComPlus Applications
2006-10-23 20:17 -------- d-------- C:\Programme\Windows NT
2006-10-23 20:17 -------- d-------- C:\Programme\MSN Gaming Zone
2006-10-23 20:17 -------- d-------- C:\Programme\MSN
2006-10-23 20:11 62 --ahs---- C:\Dokumente und Einstellungen\Master Of Creed\Anwendungsdaten\desktop.ini
2006-10-23 20:11 -------- d-------- C:\Programme\Gemeinsame Dateien\SpeechEngines
2006-10-23 20:11 -------- d-------- C:\Programme\Gemeinsame Dateien\ODBC
2006-10-23 20:11 -------- d-------- C:\Programme\Gemeinsame Dateien\Microsoft Shared
2006-10-23 20:11 -------- d-------- C:\Programme\Gemeinsame Dateien
2006-10-23 20:10 -------- d---s---- C:\Dokumente und Einstellungen\Master Of Creed\Anwendungsdaten\Microsoft


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\ctfmon.exe"
"msnmsgr"="\"C:\\Programme\\MSN Messenger\\msnmsgr.exe\" /background"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runservices]
"Microsoft dll Host Service "="wkssr.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"SmcService"="C:\\PROGRA~1\\Sygate\\SPF\\smc.exe -startgui"
@=""
"kav"="\"C:\\Programme\\Kaspersky Lab\\Kaspersky Anti-Virus 6.0\\avp.exe\""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"NoChange"="1"
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Die derzeitige Homepage"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e2,02,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,12,03,00,00,23,00,00,00,dc,00,00,00,d2,00,\
00,00,01,00,00,00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"
"Microsoft dll Host Service "="wkssr.exe"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runservices]
"Microsoft dll Host Service "="wkssr.exe"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"
"Microsoft dll Host Service "="wkssr.exe"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\runservices]
"Microsoft dll Host Service "="wkssr.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"
"{9d635a36-6b3c-4146-8625-f3aaf507bbf8}"="flammei"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="ewido anti-spyware 4.0"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]
"isamonitor.exe"="C:\\Programme\\Video ActiveX Object\\isamonitor.exe"
"isamini.exe"="C:\\Programme\\Video ActiveX Object\\isamonitor.exe"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
"flammei"="{9d635a36-6b3c-4146-8625-f3aaf507bbf8}"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"msnmsgr"="\"C:\\Programme\\MSN Messenger\\msnmsgr.exe\" /background"
"MSMSGS"="\"C:\\Programme\\Messenger\\msmsgs.exe\" /background"
"CTFMON.EXE"="C:\\WINDOWS\\System32\\ctfmon.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"NeroCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"SSBkgdUpdate"="\"C:\\Programme\\Gemeinsame Dateien\\Scansoft Shared\\SSBkgdUpdate\\SSBkgdupdate.exe\" -Embedding -boot"
"IndexSearch"="C:\\Programme\\ScanSoft\\PaperPort\\IndexSearch.exe"
"PaperPort PTD"="C:\\Programme\\ScanSoft\\PaperPort\\pptd40nt.exe"
"SetDefPrt"="C:\\Programme\\Brother\\Brmfl05a\\BrStDvPt.exe"
"SunJavaUpdateSched"="C:\\Programme\\Java\\jre1.5.0_06\\bin\\jusched.exe"
"ControlCenter2.0"="C:\\Programme\\Brother\\ControlCenter2\\brctrcen.exe /autorun"
"WinampAgent"="C:\\Programme\\Winamp\\winampa.exe"
"kav"="\"C:\\Programme\\Kaspersky Lab\\Kaspersky Anti-Virus 6.0\\avp.exe\""

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"


Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\1-Klick-Wartung.job

Completion time: 06-12-06 20:56:21.93
C:\ComboFix.txt ... 06-12-06 20:56

Datentr„ger in Laufwerk C: ist WINDOWS
Volumeseriennummer: 1E45-16F8

Verzeichnis von C:\WINDOWS\system32

04.12.2006 20:45 17.920 vcehaeb.dll
03.12.2006 17:30 2.184 wpa.dbl
02.11.2006 16:38 50 bridf05a.dat
02.11.2006 15:43 50 BRIDF04A.dat
02.11.2006 15:36 184 brsvc01a.bsi
02.11.2006 15:36 30 brss01a.ini

#2 Schnulli1990

««
wende das avenger script und smitfraudfix an
http://virus-protect.org/artikel/spyware/videoactivexobject.html
__________
MfG Sabina

rund um die PC-Sicherheit

#3 Hallo!
Habe mir auch den Virus Buster eingefangen und es erscheint immer critical system errors! Habe in meiner Not alle Temps und cookies geloescht, aber ohne Erfolg. Hier meine Infos. Kann mir bitte jemand helfen. Bin eher ein Laie! Danke
FEFE

Logfile of HijackThis v1.99.1
Scan saved at 1:49:18 PM, on 12/7/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
C:\WINDOWS\system32\Atievxx.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\lotus\notes\ntmulti.exe
C:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe
C:\Program Files\Sophos\AutoUpdate\ALsvc.exe
C:\Program Files\TightVNC\WinVNC.exe
C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
C:\Program Files\NetInst\NiAiServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\tp4mon.exe
C:\Program Files\Netinst\NiAgnt32.exe
C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe
C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe
C:\WINDOWS\system32\RunDll32.exe
C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Lenovo\PkgMgr\HOTKEY\TPONSCR.exe
C:\Program Files\Lenovo\PkgMgr\HOTKEY_1\TpScrex.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
C:\Program Files\Sophos\AutoUpdate\ALMon.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.064\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [TrackPointSrv] tp4mon.exe
O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\TightVNC\WinVNC.exe" -servicehelper
O4 - HKLM\..\Run: [ACTray] C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe
O4 - HKLM\..\Run: [ACWLIcon] C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe
O4 - HKLM\..\Run: [BMMGAG] RunDll32 C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll,StartPwrMonitor
O4 - HKLM\..\Run: [BMMLREF] C:\Program Files\ThinkPad\Utilities\BMMLREF.EXE
O4 - HKLM\..\Run: [BMMMONWND] rundll32.exe C:\PROGRA~1\ThinkPad\UTILIT~1\BatInfEx.dll,BMMAutonomicMonitor
O4 - HKLM\..\Run: [BLOG] rundll32.exe C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
O4 - Global Startup: AutoUpdate Monitor.lnk = C:\Program Files\Sophos\AutoUpdate\ALMon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: Software Installer - {D1A4DEBD-C2EE-449f-B9FB-E8409F9A0BC5} - C:\Program Files\Lenovo\PkgMgr\PkgMgr.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - AppInit_DLLs: C:\WINDOWS\NiAMH.dll
O20 - Winlogon Notify: ACNotify - ACNotify.dll (file missing)
O20 - Winlogon Notify: tpfnf2 - C:\WINDOWS\SYSTEM32\notifyf2.dll
O20 - Winlogon Notify: tphotkey - C:\WINDOWS\SYSTEM32\tphklock.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: flammei - {9d635a36-6b3c-4146-8625-f3aaf507bbf8} - C:\WINDOWS\system32\vcehaeb.dll
O23 - Service: Ac Profile Manager Service (AcPrfMgrSvc) - Unknown owner - C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
O23 - Service: Access Connections Main Service (AcSvc) - Lenovo - C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Multi-user Cleanup Service - IBM Corp - C:\Program Files\lotus\notes\ntmulti.exe
O23 - Service: NetInstall Service (NIAIServ) - enteo Software GmbH - C:\Program Files\NetInst\NiAiServ.exe
O23 - Service: NetInstall Executive (NiExServ) - enteo Software GmbH - C:\Program Files\NetInst\NiExServ.exe
O23 - Service: Sophos Anti-Virus status reporter (SAVAdminService) - Sophos Plc - C:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe
O23 - Service: Sophos Anti-Virus (SAVService) - Sophos Plc - C:\Program Files\Sophos\Sophos Anti-Virus\SavService.exe
O23 - Service: Sophos AutoUpdate Service - Sophos Plc - C:\Program Files\Sophos\AutoUpdate\ALsvc.exe
O23 - Service: VNC Server (winvnc) - Unknown owner - C:\Program Files\TightVNC\WinVNC.exe" -service (file missing)


Hier die Ergenisse von ComboFix!

Administrator - 06-12-07 14:01:08.48 Service Pack 2
ComboFix 06.11.27W - Running from: "C:\Documents and Settings\Administrator"

((((((((((((((((((((((((((((((( Files Created from 2006-11-07 to 2006-12-07 ))))))))))))))))))))))))))))))))))


2006-12-07 02:43 17,920 --a------ C:\WINDOWS\system32\vcehaeb.dll
2006-12-07 02:43 <DIR> d-------- C:\Program Files\Virus-Bursters
2006-12-07 02:42 <DIR> d-------- C:\Program Files\Video ActiveX Object
2006-12-05 00:16 15,872 --a------ C:\WINDOWS\system32\sophosboottasks.exe
2006-12-05 00:16 <DIR> d-------- C:\Program Files\Common Files\Cisco Systems
2006-11-19 02:09 <DIR> d-------- C:\Program Files\MSXML 4.0
2006-11-16 12:54 7,552 --a------ C:\WINDOWS\system32\drivers\SONYPVU1.SYS
2006-11-07 14:51 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Thunderbird
2006-11-07 14:51 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Talkback
2006-11-07 01:57 <DIR> d-------- C:\Program Files\PartyGaming


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-12-07 13:27 -------- d-------- C:\Program Files\Mozilla Firefox
2006-12-06 12:45 -------- d-------- C:\Program Files\Mozilla Thunderbird
2006-11-22 15:07 -------- d---s---- C:\Documents and Settings\Administrator\Application Data\Microsoft
2006-11-19 02:08 -------- d-------- C:\Program Files\Internet Explorer
2006-11-17 01:42 -------- d-------- C:\Documents and Settings\Administrator\Application Data\Real
2006-11-07 14:51 -------- d-------- C:\Documents and Settings\Administrator\Application Data\Mozilla
2006-11-04 14:14 1245696 --a------ C:\WINDOWS\system32\msxml4.dll
2006-11-01 17:57 -------- d-------- C:\Program Files\WinRAR
2006-10-30 22:47 -------- d-------- C:\Program Files\eMule.de 0.46c v17
2006-10-30 01:04 -------- d-------- C:\Documents and Settings\Administrator\Application Data\Sun
2006-10-29 22:03 -------- d-------- C:\Documents and Settings\Administrator\Application Data\SSH
2006-10-29 18:43 -------- d-------- C:\Program Files\CDex_170b2
2006-10-27 22:38 -------- d-------- C:\Program Files\Google
2006-10-27 22:38 -------- d-------- C:\Documents and Settings\Administrator\Application Data\Google
2006-10-27 09:55 -------- d-------- C:\Documents and Settings\Administrator\Application Data\AdobeUM
2006-10-27 09:54 -------- d-------- C:\Documents and Settings\Administrator\Application Data\Adobe
2006-10-13 13:35 65536 --a------ C:\WINDOWS\system32\nwwks.dll
2006-10-13 13:35 64000 --a------ C:\WINDOWS\system32\nwapi32.dll
2006-10-13 13:35 142336 --a------ C:\WINDOWS\system32\nwprovau.dll
2006-10-13 11:23 163584 --a------ C:\WINDOWS\system32\drivers\nwrdr.sys
2006-09-13 06:01 1084416 --a------ C:\WINDOWS\system32\msxml3.dll


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"swg"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\1.2.908.5008\\GoogleToolbarNotifier.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"TrackPointSrv"="tp4mon.exe"
"WinVNC"="\"C:\\Program Files\\TightVNC\\WinVNC.exe\" -servicehelper"
"ACTray"="C:\\Program Files\\ThinkPad\\ConnectUtilities\\ACTray.exe"
"ACWLIcon"="C:\\Program Files\\ThinkPad\\ConnectUtilities\\ACWLIcon.exe"
"BMMGAG"="RunDll32 C:\\PROGRA~1\\ThinkPad\\UTILIT~1\\pwrmonit.dll,StartPwrMonitor"
"BMMLREF"="C:\\Program Files\\ThinkPad\\Utilities\\BMMLREF.EXE"
"BMMMONWND"="rundll32.exe C:\\PROGRA~1\\ThinkPad\\UTILIT~1\\BatInfEx.dll,BMMAutonomicMonitor"
"BLOG"="rundll32.exe C:\\PROGRA~1\\ThinkPad\\UTILIT~1\\BatLogEx.DLL,StartBattLog"
"TPHOTKEY"="C:\\PROGRA~1\\Lenovo\\PkgMgr\\HOTKEY\\TPHKMGR.exe"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,00,01,00,00,00,00,00,00,00,04,00,00,e4,03,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,c0,04,00,00,1f,00,00,00,70,01,00,00,66,01,\
00,00,01,00,00,00

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"
"{9d635a36-6b3c-4146-8625-f3aaf507bbf8}"="flammei"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
"NoSharedDocuments"=dword:00000001
"NoResolveSearch"=dword:00000001
"LinkResolveIgnoreLinkInfo"=dword:00000000

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001
"LogonType"=dword:00000000

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoWelcomeScreen"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\Run]
"999"="\"C:\\Program Files\\Netinst\\NiAgnt32.exe\" /NWCM"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
"NoSharedDocuments"=dword:00000001
"NoResolveSearch"=dword:00000001
"LinkResolveIgnoreLinkInfo"=dword:00000000

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
"NoSharedDocuments"=dword:00000001
"NoResolveSearch"=dword:00000001
"LinkResolveIgnoreLinkInfo"=dword:00000000

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
"flammei"="{9d635a36-6b3c-4146-8625-f3aaf507bbf8}"

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpfnf2
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\SAVService

Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\BMMTask.job

Completion time: 06-12-07 14:02:14.02
C:\ComboFix.txt ... 06-12-07 14:02

#4 FEFE

««
wende das avenger script und smitfraudfix an
http://virus-protect.org/artikel/spyware/videoactivexobject.html
----------------

Start - Ausführen - regedit

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSharedDocuments"=dword:00000001 - auf 0 aendern
"NoResolveSearch"=dword:00000001 - auf 0 aendern

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSharedDocuments"=dword:00000001- auf 0 aendern
"NoResolveSearch"=dword:00000001- auf 0 aendern

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoSharedDocuments"=dword:00000001- auf 0 aendern
"NoResolveSearch"=dword:00000001- auf 0 aendern
__________
MfG Sabina

rund um die PC-Sicherheit

#5 Ich weiss zwar nicht genau, ob ich dass alles so richtig gemacht habe, auf alle Faelle ist die Meldnung weg und auch sonst nix auffaellig.

Auf jeden Fall vielen Dank fuer die Hilfe.

Eine Frage hab ich noch? ist das fuer meine Sicherheit wirklich unbedenklich, wenn ich die Infos meines PCs so offen ins ein Forum stelle? Kann es da nicht passieren, dass die falschen etwasrauslesen?


LG

FELIX

#6 FEFE

nichts von deinem PC interessiert jemanden, ausser mich, was die viren betrifft, wenn es delikate Eintraege geben sollte, so loesche ich sie umgehend
__________
MfG Sabina

rund um die PC-Sicherheit