System alert! nervt, mein Log-file dazu

#1 Hallo...

Habe auch diesen system alert in der Taskleiste. Hier mein LOG:

Logfile of HijackThis v1.99.1
Scan saved at 16:07:28, on 28.12.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\Logi_MwX.Exe
C:\Programme\Logitech\iTouch\iTouch.exe
C:\Programme\Java\jre1.5.0_09\bin\jusched.exe
C:\Programme\CyberLink\PowerDVD\PDVDServ.exe
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
C:\Programme\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Logitech\SetPoint\SetPoint.exe
C:\Programme\Gemeinsame Dateien\Logitech\KHAL\KHALMNPR.EXE
C:\Programme\Avant Browser\avant.exe
G:\Tools\Sicherheit\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.5.0_09\bin\ssv.dll
O4 - HKLM\..\Run: [Ptipbmf] rundll32.exe ptipbmf.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Programme\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [RemoteControl] C:\Programme\CyberLink\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [kis] "C:\Programme\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Programme\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: Alle Bilder von gleichem Server filtern - C:\Programme\Avant Browser\AddAllToADBlackList.htm
O8 - Extra context menu item: Alle Links auf dieser Seite öffnen... - C:\Programme\Avant Browser\OpenAllLinks.htm
O8 - Extra context menu item: Hervorheben - C:\Programme\Avant Browser\Highlight.htm
O8 - Extra context menu item: Hinzufügen zu Kaspersky Anti-Banner - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 6.0\\ie_banner_deny.htm
O8 - Extra context menu item: In neuer AvantBrowser-Instanz öffnen - C:\Programme\Avant Browser\OpenInNewBrowser.htm
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Suchen - C:\Programme\Avant Browser\Search.htm
O8 - Extra context menu item: Zur Werbebanner-Filterliste hinzufügen - C:\Programme\Avant Browser\AddToADBlackList.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Web-Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://files.ea.com/downloads/rtpatch/v2/EARTPX.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1143834910312
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{149DEF0D-B1DB-49DF-BD82-E7E8DE82A295}: NameServer = 213.191.74.19 213.191.92.87
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O21 - SSODL: buprestidae - {b59f3ba4-98da-4b5f-8a2d-7b56fb11140b} - C:\WINDOWS\system32\cthkpcv.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Kaspersky Internet Security 6.0 (AVP) - Unknown owner - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" -r (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe


ComboFix 06.11.27 - Running from: "G:\Tools\Sicherheit\combofix"

((((((((((((((((((((((((((((((( Files Created from 2006-11-28 to 2006-12-28 ))))))))))))))))))))))))))))))))))


2006-12-28 18:54 <DIR> dr-h----- C:\Dokumente und Einstellungen\Nils-Peter\Recent
2006-12-28 16:21 2,416 --a------ C:\WINDOWS\system32\tmp.reg
2006-12-26 18:36 <DIR> d-------- C:\Dokumente und Einstellungen\Nils-Peter\Anwendungsdaten\Spybot - Search & Destroy
2006-12-25 04:05 20,992 --a------ C:\WINDOWS\system32\cthkpcv.dll
2006-12-11 19:07 <DIR> d-------- C:\Programme\Kaspersky Lab
2006-12-11 19:07 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Kaspersky Lab
2006-12-05 16:25 <DIR> d---s---- C:\Dokumente und Einstellungen\Nils-Peter\UserData
2006-12-01 10:25 <DIR> d-------- C:\Dokumente und Einstellungen\Nils-Peter\Anwendungsdaten\tick link save
2006-11-29 16:07 <DIR> d-------- C:\Dokumente und


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-12-17 14:35 -------- d-------- C:\Programme\Gemeinsame Dateien\Adobe
2006-12-17 14:02 -------- d-------- C:\Programme\Avant Browser
2006-12-16 01:08 -------- d-------- C:\Programme\Internet Explorer
2006-12-16 01:06 -------- d-------- C:\Programme\Outlook Express
2006-12-16 01:06 -------- d-------- C:\Programme\Gemeinsame Dateien\System
2006-12-12 09:49 -------- d-------- C:\Programme\ICQLite
2006-12-11 21:20 61584 --a------ C:\WINDOWS\system32\drivers\klick.sys
2006-12-11 21:20 59536 --a------ C:\WINDOWS\system32\drivers\klin.sys
2006-12-08 11:29 -------- d-------- C:\Programme\Google
2006-12-08 11:29 -------- d-------- C:\Programme\Gemeinsame Dateien\Wise Installation Wizard
2006-12-07 07:40 2362184 --a------ C:\WINDOWS\system32\wmvcore.dll
2006-12-01 18:53 43520 --a------ C:\WINDOWS\system32\CmdLineExt03.dll
2006-11-27 18:12 -------- d-------- C:\Programme\Gemeinsame Dateien\Kaspersky Lab
2006-11-27 17:41 34308 --a------ C:\WINDOWS\system32\BASSMOD.dll
2006-11-27 17:37 -------- d-------- C:\Programme\Download Plugin
2006-11-26 21:24 -------- d--h----- C:\Programme\InstallShield Installation Information
2006-11-26 21:24 -------- d-------- C:\Programme\Electronic Arts
2006-11-08 06:06 679424 --a------ C:\WINDOWS\system32\inetcomm.dll
2006-11-07 14:55 -------- d-------- C:\Programme\CD Audio MP3 Converter
2006-11-07 13:45 -------- d-------- C:\Programme\Java
2006-11-06 13:27 -------- d-------- C:\Programme\Gemeinsame Dateien\Logitech
2006-11-06 13:26 -------- d-------- C:\Programme\Logitech
2006-11-04 14:14 1245696 --a------ C:\WINDOWS\system32\msxml4.dll
2006-10-28 13:10 -------- d---s---- C:\Programme\Xfire
2006-10-20 02:38 715776 --a------ C:\WINDOWS\system32\sxs.dll
2006-10-13 13:35 65536 --a------ C:\WINDOWS\system32\nwwks.dll
2006-10-13 13:35 64000 --a------ C:\WINDOWS\system32\nwapi32.dll
2006-10-13 13:35 146432 --a------ C:\WINDOWS\system32\nwprovau.dll
2006-10-12 02:47 307200 --a------ C:\WINDOWS\system32\atiiiexx.dll
2006-10-12 02:44 260608 --a------ C:\WINDOWS\system32\ati2dvag.dll
2006-10-12 02:38 90112 --a------ C:\WINDOWS\system32\ati2evxx.dll
2006-10-12 02:38 41984 --a------ C:\WINDOWS\system32\ati2edxx.dll
2006-10-12 02:38 26112 --a------ C:\WINDOWS\system32\Ati2mdxx.exe
2006-10-12 02:38 118784 --a------ C:\WINDOWS\system32\atipdlxx.dll
2006-10-12 02:38 106496 --a------ C:\WINDOWS\system32\Oemdspif.dll
2006-10-12 02:37 430080 --a------ C:\WINDOWS\system32\ati2evxx.exe
2006-10-12 02:36 53248 --a------ C:\WINDOWS\system32\ATIDDC.DLL
2006-10-12 02:31 2518336 --a------ C:\WINDOWS\system32\ati3duag.dll
2006-10-12 02:26 1092960 --a------ C:\WINDOWS\system32\ativvaxx.dll
2006-10-12 02:22 6684672 --a------ C:\WINDOWS\system32\atioglx1.dll
2006-10-12 02:22 303104 --a------ C:\WINDOWS\system32\ATIDEMGR.dll
2006-10-12 02:20 5148672 --a------ C:\WINDOWS\system32\atioglxx.dll
2006-10-12 02:15 221184 --a------ C:\WINDOWS\system32\atikvmag.dll
2006-10-12 02:14 17408 --a------ C:\WINDOWS\system32\atitvo32.dll
2006-10-12 02:10 294912 --a------ C:\WINDOWS\system32\ati2cqag.dll
2006-10-11 21:05 520192 --a------ C:\WINDOWS\system32\ati2sgag.exe


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\ctfmon.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"Ptipbmf"="rundll32.exe ptipbmf.dll,SetWriteCacheMode"
"SoundMan"="SOUNDMAN.EXE"
"Logitech Utility"="Logi_MwX.Exe"
"zBrowser Launcher"="C:\\Programme\\Logitech\\iTouch\\iTouch.exe"
"SunJavaUpdateSched"="\"C:\\Programme\\Java\\jre1.5.0_09\\bin\\jusched.exe\""
"RemoteControl"="C:\\Programme\\CyberLink\\PowerDVD\\PDVDServ.exe"
"TkBellExe"="\"C:\\Programme\\Gemeinsame Dateien\\Real\\Update_OB\\realsched.exe\" -osboot"
"NWEReboot"=""
"NeroFilterCheck"="C:\\Programme\\Gemeinsame Dateien\\Ahead\\Lib\\NeroCheck.exe"
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE"
"kis"="\"C:\\Programme\\Kaspersky Lab\\Kaspersky Internet Security 6.0\\avp.exe\""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000005

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Die derzeitige Homepage"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,00,01,00,00,00,00,00,00,00,04,00,00,00,04,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,00,01,00,00,00,00,00,00,00,04,00,00,00,04,\
00,00,04,00,00,40
"RestoredStateInfo"=hex:18,00,00,00,00,01,00,00,00,00,00,00,00,04,00,00,00,04,\
00,00,01,00,00,00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"
"{b59f3ba4-98da-4b5f-8a2d-7b56fb11140b}"="buprestidae"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
"ClearRecentDocsOnExit"=dword:00000001

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
"buprestidae"="{b59f3ba4-98da-4b5f-8a2d-7b56fb11140b}"


SmitFraudFix v2.131

Scan done at 19:42:08.25, 06-12-28
Run from G:\Tools\Sicherheit\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{b59f3ba4-98da-4b5f-8a2d-7b56fb11140b}"="buprestidae"

[HKEY_CLASSES_ROOT\CLSID\{b59f3ba4-98da-4b5f-8a2d-7b56fb11140b}\InProcServer32]
@="C:\WINDOWS\system32\cthkpcv.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{b59f3ba4-98da-4b5f-8a2d-7b56fb11140b}\InProcServer32]
@="C:\WINDOWS\system32\cthkpcv.dll"


»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri

C:\WINDOWS\system32\cthkpcv.dll -> Hoax.Win32.Renos.gen.i
C:\WINDOWS\system32\cthkpcv.dll -> Deleted


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files


»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» End

ComboFix 06.11.27 - Running from: "G:\Tools\Sicherheit\combofix"

((((((((((((((((((((((((((((((( Files Created from 2006-11-28 to 2006-12-28 ))))))))))))))))))))))))))))))))))


2006-12-28 19:41 79,360 --a------ C:\WINDOWS\system32\swxcacls.exe
2006-12-28 19:41 53,248 --a------ C:\WINDOWS\system32\Process.exe
2006-12-28 19:41 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2006-12-28 19:41 40,960 --a------ C:\WINDOWS\system32\swsc.exe
2006-12-28 19:41 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2006-12-28 19:41 135,168 --a------ C:\WINDOWS\system32\swreg.exe


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-12-17 14:35 -------- d-------- C:\Programme\Gemeinsame Dateien\Adobe
2006-12-17 14:02 -------- d-------- C:\Programme\Avant Browser
2006-12-16 01:08 -------- d-------- C:\Programme\Internet Explorer
2006-12-16 01:06 -------- d-------- C:\Programme\Outlook Express
2006-12-16 01:06 -------- d-------- C:\Programme\Gemeinsame Dateien\System
2006-12-12 09:49 -------- d-------- C:\Programme\ICQLite
2006-12-11 21:20 61584 --a------ C:\WINDOWS\system32\drivers\klick.sys
2006-12-11 21:20 59536 --a------ C:\WINDOWS\system32\drivers\klin.sys
2006-12-08 11:29 -------- d-------- C:\Programme\Google
2006-12-08 11:29 -------- d-------- C:\Programme\Gemeinsame Dateien\Wise Installation Wizard
2006-12-07 07:40 2362184 --a------ C:\WINDOWS\system32\wmvcore.dll
2006-12-01 18:53 43520 --a------ C:\WINDOWS\system32\CmdLineExt03.dll
2006-11-27 18:12 -------- d-------- C:\Programme\Gemeinsame Dateien\Kaspersky Lab
2006-11-27 17:41 34308 --a------ C:\WINDOWS\system32\BASSMOD.dll
2006-11-27 17:37 -------- d-------- C:\Programme\Download Plugin
2006-11-26 21:24 -------- d--h----- C:\Programme\InstallShield Installation Information
2006-11-26 21:24 -------- d-------- C:\Programme\Electronic Arts
2006-11-08 06:06 679424 --a------ C:\WINDOWS\system32\inetcomm.dll
2006-11-07 14:55 -------- d-------- C:\Programme\CD Audio MP3 Converter
2006-11-07 13:45 -------- d-------- C:\Programme\Java
2006-11-06 13:27 -------- d-------- C:\Programme\Gemeinsame Dateien\Logitech
2006-11-06 13:26 -------- d-------- C:\Programme\Logitech
2006-11-04 14:14 1245696 --a------ C:\WINDOWS\system32\msxml4.dll
2006-10-28 13:10 -------- d---s---- C:\Programme\Xfire
2006-10-20 02:38 715776 --a------ C:\WINDOWS\system32\sxs.dll
2006-10-13 13:35 65536 --a------ C:\WINDOWS\system32\nwwks.dll
2006-10-13 13:35 64000 --a------ C:\WINDOWS\system32\nwapi32.dll
2006-10-13 13:35 146432 --a------ C:\WINDOWS\system32\nwprovau.dll
2006-10-12 02:47 307200 --a------ C:\WINDOWS\system32\atiiiexx.dll
2006-10-12 02:44 260608 --a------ C:\WINDOWS\system32\ati2dvag.dll
2006-10-12 02:38 90112 --a------ C:\WINDOWS\system32\ati2evxx.dll
2006-10-12 02:38 41984 --a------ C:\WINDOWS\system32\ati2edxx.dll
2006-10-12 02:38 26112 --a------ C:\WINDOWS\system32\Ati2mdxx.exe
2006-10-12 02:38 118784 --a------ C:\WINDOWS\system32\atipdlxx.dll
2006-10-12 02:38 106496 --a------ C:\WINDOWS\system32\Oemdspif.dll
2006-10-12 02:37 430080 --a------ C:\WINDOWS\system32\ati2evxx.exe
2006-10-12 02:36 53248 --a------ C:\WINDOWS\system32\ATIDDC.DLL
2006-10-12 02:31 2518336 --a------ C:\WINDOWS\system32\ati3duag.dll
2006-10-12 02:26 1092960 --a------ C:\WINDOWS\system32\ativvaxx.dll
2006-10-12 02:22 6684672 --a------ C:\WINDOWS\system32\atioglx1.dll
2006-10-12 02:22 303104 --a------ C:\WINDOWS\system32\ATIDEMGR.dll
2006-10-12 02:20 5148672 --a------ C:\WINDOWS\system32\atioglxx.dll
2006-10-12 02:15 221184 --a------ C:\WINDOWS\system32\atikvmag.dll
2006-10-12 02:14 17408 --a------ C:\WINDOWS\system32\atitvo32.dll
2006-10-12 02:10 294912 --a------ C:\WINDOWS\system32\ati2cqag.dll
2006-10-11 21:05 520192 --a------ C:\WINDOWS\system32\ati2sgag.exe


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\ctfmon.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"Ptipbmf"="rundll32.exe ptipbmf.dll,SetWriteCacheMode"
"SoundMan"="SOUNDMAN.EXE"
"Logitech Utility"="Logi_MwX.Exe"
"zBrowser Launcher"="C:\\Programme\\Logitech\\iTouch\\iTouch.exe"
"SunJavaUpdateSched"="\"C:\\Programme\\Java\\jre1.5.0_09\\bin\\jusched.exe\""
"RemoteControl"="C:\\Programme\\CyberLink\\PowerDVD\\PDVDServ.exe"
"TkBellExe"="\"C:\\Programme\\Gemeinsame Dateien\\Real\\Update_OB\\realsched.exe\" -osboot"
"NWEReboot"=""
"NeroFilterCheck"="C:\\Programme\\Gemeinsame Dateien\\Ahead\\Lib\\NeroCheck.exe"
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE"
"kis"="\"C:\\Programme\\Kaspersky Lab\\Kaspersky Internet Security 6.0\\avp.exe\""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000005

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
"ClearRecentDocsOnExit"=dword:00000001

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"


Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\AB584FC391F7CD87.job

Completion time: 06-12-28 20:20:33.17
C:\ComboFix.txt ... 06-12-28 20:20
C:\ComboFix2.txt ... 06-12-28 19:07

#2 nach der anwendung von smitfraudfix sollte alles wieder i.o. sein - oder kommen noch popups ???
__________
MfG Sabina

rund um die PC-Sicherheit

#3 Nein, keine Pop-Ups mehr....

Ich danke dir für die Posts in den anderen Themen, wollte durch dieses Posting nur sicher gehen das ich alles richtig gemacht habe....