Virus Buster... die zehnte! ^^

#1 servus ihr auskenner! welches problem hab ich wohl? wäre cool, wenn jemand helfen kann!

die logfile sieht wie folgt aus:


Logfile of HijackThis v1.99.1
Scan saved at 18:18:28, on 08.12.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\carpserv.exe
C:\Programme\Apoint2K\Apoint.exe
C:\PROGRA~1\LAUNCH~1\QtaET2S.EXE
C:\Programme\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Programme\iWare\iWare Mouse\3.2\MOUSE32A.EXE
C:\Programme\QuickTime\qttask.exe
C:\Programme\D-Link\AirPlus G\AirGCFG.exe
C:\Programme\ANI\ANIWZCS2 Service\WZCSLDR2.exe
C:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe
C:\Programme\Apoint2K\Apntex.exe
C:\Programme\HP\HP Software Update\HPWuSchd2.exe
C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\Programme\Java\jre1.5.0_09\bin\jusched.exe
C:\Programme\Gemeinsame Dateien\ICQLite\ICQLite.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Microsoft ActiveSync\WCESCOMM.EXE
C:\Programme\Hewlett-Packard\AiO\hp officejet v series\Bin\hpoant07.exe
C:\Programme\HP\Digital Imaging\bin\hpqtra08.exe
C:\PROGRA~1\HEWLET~1\AiO\Shared\Bin\hpoevm07.exe
C:\Programme\Hewlett-Packard\AiO\Shared\bin\hpOSTS07.exe
C:\Programme\Hewlett-Packard\AiO\Shared\bin\hpOFXM07.exe
C:\Programme\HP\Digital Imaging\bin\hpqimzone.exe
C:\Programme\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Programme\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\Dokumente und Einstellungen\Baecker-Baumeister\Desktop\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.de/0SEDEDE/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.de/0SEDEDE/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.de/0SEDEDE/SAOS01?FORM=TOOLBR
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\Gemeinsame Dateien\ICQToolbar\tbu3D\toolbaru.dll
O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\Programme\Gemeinsame Dateien\ICQToolbar\tbu3D\toolbaru.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1a1ddc19-5893-43ab-a73f-f41a0f34d115} - C:\Programme\Video ActiveX Object\isaddon.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: (no name) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - (no file)
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programme\Windows Live Toolbar\msntb.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\Gemeinsame Dateien\ICQToolbar\tbu3D\toolbaru.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programme\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Protection Bar - {5d4831e0-5a7c-4a46-afd5-a79ab8ce36c2} - C:\Programme\Video ActiveX Object\iesplugin.dll (file missing)
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [Apoint] C:\Programme\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtaET2S.EXE
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Programme\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [Gnetmous] C:\Programme\KYE\Genius PowerScroll Series Mouse\gnetmous.exe
O4 - HKLM\..\Run: [CheckMedi8or] C:\Programme\Mediator 7 Pro\CheckNewUser.exe
O4 - HKLM\..\Run: [LWBMOUSE] C:\Programme\iWare\iWare Mouse\3.2\MOUSE32A.EXE
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb03.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [D-Link AirPlus G] C:\Programme\D-Link\AirPlus G\AirGCFG.exe
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Programme\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKLM\..\Run: [HPHUPD08] C:\Programme\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Programme\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [AVP] "C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [ICQ Lite] "C:\Programme\Gemeinsame Dateien\ICQLite\ICQLite.exe" -minimize
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Programme\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programme\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Programme\Gemeinsame Dateien\ICQLite\ICQLite.exe -trayboot
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: HPAiODevice(hp officejet v series) - 1.lnk = C:\Programme\Hewlett-Packard\AiO\hp officejet v series\Bin\hpoant07.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Programme\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Schnellstart.lnk = C:\Programme\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Programme\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: In neuer Registerkarte im Hintergrund öffnen - res://C:\Programme\Windows Live Toolbar\Components\de-de\msntabres.dll.mui/229?a3ce3edc4664491fa1455414bb5ecf0f
O8 - Extra context menu item: In neuer Registerkarte im Vordergrund öffnen - res://C:\Programme\Windows Live Toolbar\Components\de-de\msntabres.dll.mui/230?a3ce3edc4664491fa1455414bb5ecf0f
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_09\bin\npjpi150_09.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_09\bin\npjpi150_09.dll
O9 - Extra button: Web-Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: Mobilen Favoriten erstellen - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Programme\Microsoft ActiveSync\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Programme\Microsoft ActiveSync\INetRepl.dll
O9 - Extra 'Tools' menuitem: Mobilen Favoriten erstellen... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Programme\Microsoft ActiveSync\INetRepl.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\Gemeinsame Dateien\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\Gemeinsame Dateien\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://global.acer.com/
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O21 - SSODL: blippers - {f2efa195-4785-4db1-9316-b48c64bb71da} - C:\WINDOWS\system32\xqpauzx.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Programme\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing)
O23 - Service: C-DillaCdaC11BA - C-Dilla Ltd - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe



==============================================================


und:

Baecker-Baumeister - 06-12-08 18:43:39,76 Service Pack 2
ComboFix 06.11.27W - Running from: "C:\Programme\Mozilla Firefox"

((((((((((((((((((((((((((((((( Files Created from 2006-11-08 to 2006-12-08 ))))))))))))))))))))))))))))))))))


2006-12-08 15:58 <DIR> d--hs---- C:\FOUND.010
2006-12-08 13:51 <DIR> d--hs---- C:\FOUND.009
2006-12-07 19:16 <DIR> d-------- C:\WINDOWS\Sun
2006-12-07 19:16 <DIR> d-------- C:\Dokumente und Einstellungen\Baecker-Baumeister\Anwendungsdaten\Sun
2006-12-07 19:11 <DIR> d-------- C:\Programme\Java
2006-12-07 19:10 <DIR> d-------- C:\Programme\Gemeinsame Dateien\Java
2006-12-07 16:43 <DIR> d--hs---- C:\FOUND.008
2006-12-07 06:04 <DIR> d--hs---- C:\FOUND.007
2006-12-07 05:38 61,584 --a------ C:\WINDOWS\system32\drivers\klick.sys
2006-12-07 05:38 59,536 --a------ C:\WINDOWS\system32\drivers\klin.sys
2006-12-07 05:38 <DIR> d-------- C:\Programme\Kaspersky Lab
2006-12-07 05:38 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Kaspersky Lab
2006-12-07 05:25 <DIR> d-------- C:\kav
2006-12-07 04:13 178,408 --a------ C:\WINDOWS\system32\muweb.dll
2006-12-07 04:13 128,232 --a------ C:\WINDOWS\system32\mucltui.dll
2006-12-07 03:41 18,432 --a------ C:\WINDOWS\system32\xqpauzx.dll
2006-12-06 19:17 <DIR> d-------- C:\Dokumente und Einstellungen\Baecker-Baumeister\Contacts
2006-12-06 19:14 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Windows Live Toolbar
2006-12-06 19:09 <DIR> d-------- C:\Programme\Windows Live Toolbar
2006-12-06 19:07 <DIR> d-------- C:\WINDOWS\system32\DRVSTORE
2006-12-04 22:13 <DIR> d-------- C:\Programme\MSXML 4.0
2006-12-04 22:13 <DIR> d-------- C:\3fe1e069c1769483d9450e3de0b0aa8c
2006-12-03 19:20 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\HP
2006-12-03 19:17 <DIR> d-------- C:\Programme\Gemeinsame Dateien\Sonic Shared
2006-12-03 19:17 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sonic
2006-12-03 19:14 <DIR> d-------- C:\Programme\Gemeinsame Dateien\HP
2006-12-03 19:03 <DIR> dr--s---- C:\WINDOWS\assembly
2006-12-03 19:03 <DIR> d-------- C:\WINDOWS\system32\URTTemp
2006-12-03 19:03 <DIR> d-------- C:\WINDOWS\Microsoft.NET
2006-12-03 19:02 51,120 -ra------ C:\WINDOWS\system32\drivers\HPZid412.sys
2006-12-03 19:02 16,496 -ra------ C:\WINDOWS\system32\drivers\HPZipr12.sys
2006-12-03 19:01 77,824 -ra------ C:\WINDOWS\system32\hpzids01.dll
2006-12-03 19:01 37,376 --a------ C:\WINDOWS\system32\hpz3l3xu.dll
2006-12-03 18:58 94,208 --a------ C:\WINDOWS\system32\HPZipt12.dll
2006-12-03 18:58 69,632 --a------ C:\WINDOWS\system32\HPZipm12.exe
2006-12-03 18:58 61,440 --a------ C:\WINDOWS\system32\HPZinw12.exe
2006-12-03 18:58 57,344 --a------ C:\WINDOWS\system32\HPZisn12.dll
2006-12-03 18:58 278,584 --a------ C:\WINDOWS\system32\HPZidr12.dll
2006-12-03 18:58 204,800 --a------ C:\WINDOWS\system32\HPZipr12.dll
2006-12-03 18:54 <DIR> d-------- C:\Programme\HP
2006-12-03 18:51 <DIR> d--h----- C:\Config.Msi
2006-12-03 18:50 <DIR> d-------- C:\Dokumente und Einstellungen\Baecker-Baumeister\Anwendungsdaten\HP
2006-12-03 18:44 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2006-12-03 07:21 <DIR> dr-h----- C:\Dokumente und Einstellungen\Baecker-Baumeister\Recent
2006-12-03 05:29 <DIR> d-------- C:\Programme\WinRAR
2006-12-01 20:03 <DIR> d--h----- C:\WINDOWS\PIF
2006-12-01 19:42 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Symantec
2006-12-01 19:40 <DIR> d-------- C:\Programme\Gemeinsame Dateien\Symantec Shared
2006-12-01 13:48 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2006-12-01 13:48 <DIR> d-------- C:\WINDOWS\system32\PreInstall
2006-12-01 10:26 <DIR> d-------- C:\Temp
2006-12-01 10:22 <DIR> d-------- C:\Dokumente und Einstellungen\Baecker-Baumeister\Anwendungsdaten\Macromedia
2006-12-01 10:20 <DIR> d-------- C:\Programme\Gemeinsame Dateien\ICQToolbar
2006-12-01 10:20 <DIR> d-------- C:\Program Files
2006-12-01 10:20 <DIR> d-------- C:\Dokumente und Einstellungen\Baecker-Baumeister\Anwendungsdaten\ICQ Toolbar
2006-12-01 10:19 <DIR> d-------- C:\Programme\Gemeinsame Dateien\ICQLite
2006-12-01 10:19 <DIR> d-------- C:\Dokumente und Einstellungen\Baecker-Baumeister\Anwendungsdaten\ICQLite
2006-12-01 10:11 <DIR> d-------- C:\Programme\Mozilla Firefox
2006-12-01 10:11 <DIR> d-------- C:\Dokumente und Einstellungen\Baecker-Baumeister\Anwendungsdaten\Mozilla
2006-12-01 10:06 <DIR> d-------- C:\WINDOWS\system32\SoftwareDistribution
2006-11-15 15:44 18,273 --a------ C:\WINDOWS\system32\drivers\klop.sys
2006-11-12 16:08 <DIR> d-------- C:\Programme\Interaktive Lernmodule


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-11-04 14:14 1245696 --a------ C:\WINDOWS\system32\msxml4.dll
2006-11-01 17:42 94314 --a------ C:\WINDOWS\system32\klogon.dll
2006-10-13 13:35 146432 --a------ C:\WINDOWS\system32\nwprovau.dll
2006-09-13 06:02 1084416 --a------ C:\WINDOWS\system32\msxml3.dll


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\ctfmon.exe"
"H/PC Connection Agent"="\"C:\\Programme\\Microsoft ActiveSync\\WCESCOMM.EXE\""
"MsnMsgr"="\"C:\\Programme\\MSN Messenger\\MsnMsgr.Exe\" /background"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runonce]
"ICQ Lite"="C:\\Programme\\Gemeinsame Dateien\\ICQLite\\ICQLite.exe -trayboot"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"CARPService"="carpserv.exe"
"Apoint"="C:\\Programme\\Apoint2K\\Apoint.exe"
"LManager"="C:\\PROGRA~1\\LAUNCH~1\\QtaET2S.EXE"
"Share-to-Web Namespace Daemon"="C:\\Programme\\Hewlett-Packard\\HP Share-to-Web\\hpgs2wnd.exe"
"Gnetmous"="C:\\Programme\\KYE\\Genius PowerScroll Series Mouse\\gnetmous.exe"
"CheckMedi8or"="C:\\Programme\\Mediator 7 Pro\\CheckNewUser.exe"
"LWBMOUSE"="C:\\Programme\\iWare\\iWare Mouse\\3.2\\MOUSE32A.EXE"
"HPDJ Taskbar Utility"="C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\hpztsb03.exe"
"QuickTime Task"="\"C:\\Programme\\QuickTime\\qttask.exe\" -atboottime"
"D-Link AirPlus G"="C:\\Programme\\D-Link\\AirPlus G\\AirGCFG.exe"
"ANIWZCS2Service"="C:\\Programme\\ANI\\ANIWZCS2 Service\\WZCSLDR2.exe"
"HPHUPD08"="C:\\Programme\\HP\\Digital Imaging\\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\\hphupd08.exe"
"HP Software Update"="C:\\Programme\\HP\\HP Software Update\\HPWuSchd2.exe"
"AVP"="\"C:\\Programme\\Kaspersky Lab\\Kaspersky Anti-Virus 6.0\\avp.exe\""
@=""
"SunJavaUpdateSched"="\"C:\\Programme\\Java\\jre1.5.0_09\\bin\\jusched.exe\""
"ICQ Lite"="\"C:\\Programme\\Gemeinsame Dateien\\ICQLite\\ICQLite.exe\" -minimize"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"NoChange"="1"
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000005

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Die derzeitige Homepage"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e2,02,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e2,02,\
00,00,04,00,00,40
"RestoredStateInfo"=hex:18,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e2,02,\
00,00,01,00,00,00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"
"{f2efa195-4785-4db1-9316-b48c64bb71da}"="blippers"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
"blippers"="{f2efa195-4785-4db1-9316-b48c64bb71da}"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"


Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\WebReg HP Photosmart 8000 Series.job
C:\WINDOWS\tasks\HPpromotions journeysoftware.job
C:\WINDOWS\tasks\Check Updates for Windows Live Toolbar.job

Completion time: 06-12-08 18:47:30.22
C:\ComboFix.txt ... 06-12-08 18:47


dieser mist geht mir auf den keks!!! hiiiiiiilfe!

#2 platzhirsch

arbeite das avenger script und smitfraudfix ab
http://virus-protect.org/artikel/spyware/videoactivexobject.html
__________
MfG Sabina

rund um die PC-Sicherheit

#3 ok, so sieht es aus: das symbol ist schomma weg!

berichte:


und smitfraud 1:

SmitFraudFix v2.128

Scan done at 21:10:03,23, 08.12.2006
Run from C:\Dokumente und Einstellungen\Baecker-Baumeister\Desktop\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is FAT32
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

C:\WINDOWS\system32\xqpauzx.dll FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» C:\Dokumente und Einstellungen\Baecker-Baumeister


»»»»»»»»»»»»»»»»»»»»»»»» C:\Dokumente und Einstellungen\Baecker-Baumeister\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Start Menu


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOKUME~1\BAECKE~1\FAVORI~1


»»»»»»»»»»»»»»»»»»»»»»»» Desktop


»»»»»»»»»»»»»»»»»»»»»»»» C:\Programme


»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Die derzeitige Homepage"


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32


»»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection


»»»»»»»»»»»»»»»»»»»»»»»» End

==========================================================

und smitfraud 2:

SmitFraudFix v2.128

Scan done at 21:10:56,53, 08.12.2006
Run from C:\Dokumente und Einstellungen\Baecker-Baumeister\Desktop\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is FAT32
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

C:\WINDOWS\system32\xqpauzx.dll Deleted

»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» End

==========================================================


ist jetzt alles cool? irgendwie steht mir da zuviel "could not..."! aber falls ja, ging es schnell und ich bin dir zu ewigem dank verpflichtet! ^^