antivir alamiert, aber keine bereinigung...?!!

#1 hi,

wie ihr seht bin ich neu hier...also verzeiht wenn was noch nich ganz so reibungslos verläuft, wie es wünschenswert wäre

also, mein antivir schlägt immer virusalarm wenn ich den rechner hochfahre. kann den aber weder löschen, noch in quarantäne verschieben etc. (dabei handelt es sich um: ifcstat.dll, wmplmspo.vir und confifc.fll, cluscomr.dll, crypmapi.VIR)

da ein hijackthis log in so einem fall ja doch oft brauchbar ist, werd ich das hier hintendran hängen. falls was fehlt bitte darauf hinweisen. ansonsten bedank ich mich für eure bemühungen und hoff dass mir geholfen werden kann...


mfg

Logfile of HijackThis v1.99.1
Scan saved at 01:52:26, on 05.04.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Intel\Wireless\Bin\EvtEng.exe
C:\Programme\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\FRITZ!DSL\IGDCTRL.EXE
C:\Acer\Empowering Technology\admServ.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
C:\Programme\Raxco\PerfectDisk\PDAgent.exe
C:\Programme\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Raxco\PerfectDisk\PDEngine.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Programme\Synaptics\SynTP\SynTPLpr.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Programme\Synaptics\SynTP\SynTPEnh.exe
C:\Acer\Empowering Technology\eRecovery\Monitor.exe
C:\Acer\Empowering Technology\admtray.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
C:\Programme\Java\jre1.5.0_11\bin\jusched.exe
C:\Programme\ATI Technologies\ATI.ACE\cli.exe
C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programme\Logitech\SetPoint\SetPoint.exe
C:\Programme\FRITZ!DSL\FwebProt.exe
C:\Programme\FRITZ!DSL\StCenter.exe
C:\Programme\Gemeinsame Dateien\Logitech\KHAL\KHALMNPR.EXE
C:\PROGRA~1\Mozilla Firefox\firefox.exe
C:\DOKUME~1\MEINER~1\LOKALE~1\Temp\RtkBtMnt.exe
C:\Programme\ATI Technologies\ATI.ACE\cli.exe
C:\Programme\WinRAR\WinRAR.exe
C:\WINDOWS\system32\svchost.exe
C:\DOKUME~1\MEINER~1\LOKALE~1\Temp\Rar$EX00.047\HijackThis.exe
C:\PROGRA~1\LAUNCH~1\DialCtrl.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.aceradvantage.com/stdreg
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.aceradvantage.com/stdreg
R3 - URLSearchHook: Yahoo! Toolbar mit Pop-Up-Blocker - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [SynTPLpr] C:\Programme\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [ADMTray.exe] "C:\Acer\Empowering Technology\admtray.exe"
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [ntiMUI] C:\Programme\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [AzMixerSel] C:\Programme\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [Acer ePower Management] C:\Acer\Empowering Technology\ePower\Acer ePower Management.exe boot
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [ATICCC] "C:\Programme\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [xljymcin] C:\capjvlct.bat
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] c:\Programme\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [LDM] C:\Programme\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Startup: Adobe Gamma.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: FRITZ!DSL Protect.lnk = C:\Programme\FRITZ!DSL\FwebProt.exe
O4 - Startup: FRITZ!DSL Startcenter.lnk = C:\Programme\FRITZ!DSL\StCenter.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Programme\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Programme\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: AutoCAD-Startbeschleuniger.lnk = C:\Programme\Gemeinsame Dateien\Autodesk Shared\acstart16.exe
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\programme\fritz!dsl\sarah.dll
O10 - Unknown file in Winsock LSP: c:\programme\fritz!dsl\sarah.dll
O10 - Unknown file in Winsock LSP: c:\programme\fritz!dsl\sarah.dll
O10 - Unknown file in Winsock LSP: c:\programme\fritz!dsl\sarah.dll
O10 - Unknown file in Winsock LSP: c:\programme\fritz!dsl\sarah.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1170537009423
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: bw+0 - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: offline-8876480 - {B3DF014F-8141-4255-9256-BEA86EA4E5DD} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: wmplmspo.dll confifc.dll ifcstat.dll diagisr.dll
O20 - Winlogon Notify: crypmapi - C:\WINDOWS\system32\crypmapi.dll
O20 - Winlogon Notify: dbgmgr - C:\WINDOWS\SYSTEM32\ifcmgr32.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Programme\Gemeinsame Dateien\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVM IGD CTRL Service - AVM Berlin - C:\Programme\FRITZ!DSL\IGDCTRL.EXE
O23 - Service: AdminWorks Agent X6 (AWService) - Avocent Inc. - C:\Acer\Empowering Technology\admServ.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: AVM FRITZ!web Routing Service (de_serv) - AVM Berlin - C:\Programme\Gemeinsame Dateien\AVM\de_serv.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Programme\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Programme\Raxco\PerfectDisk\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Programme\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Programme\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Programme\Intel\Wireless\Bin\S24EvMon.exe


edit:

scan bei jotti ergab folgendes. jetzt müsste ich sie nur noch entfernen können...

Datei: confifc.dll
Auslastung:
0% 100%
Status:
INFIZIERT/MALWARE (Anmerkung: diese Datei wurde bereits vorher gescannt. Die Scanergebnisse werden daher nicht in der Datenbank gespeichert.)
Entdeckte Packprogramme:
-

AntiVir
WORM/Stration.Gen gefunden
ArcaVir
Worm.Warezov.Hx gefunden
Avast
Win32:Warezov-BUB gefunden
AVG Antivirus
I-Worm/Stration.CLG gefunden
BitDefender
Win32.Warezov.GC@mm gefunden
ClamAV
Keine Viren gefunden
Dr.Web
Win32.HLLM.Limar gefunden
F-Prot Antivirus
W32/EmailWorm.FQI gefunden
F-Secure Anti-Virus
Email-Worm.Win32.Warezov.hx gefunden
Fortinet
W32/Stration.HX@mm gefunden
Kaspersky Anti-Virus
Email-Worm.Win32.Warezov.hx gefunden
NOD32
Win32/Stration.YB gefunden
Norman Virus Control
W32/Stration.EXO gefunden
Panda Antivirus
W32/Spamta.AJ.worm gefunden
Rising Antivirus
Worm.Mail.Warezov.jh gefunden
VirusBuster
Keine Viren gefunden
VBA32
MalwareScope.Worm.Warezov.1 gefunden


Datei: ifcstat.dll
Auslastung:
0% 100%
Status:
INFIZIERT/MALWARE (Anmerkung: diese Datei wurde bereits vorher gescannt. Die Scanergebnisse werden daher nicht in der Datenbank gespeichert.)
Entdeckte Packprogramme:
-

AntiVir
WORM/Warezov.HX.4 gefunden
ArcaVir
Worm.Warezov.Hx gefunden
Avast
Win32:Warezov-MV gefunden
AVG Antivirus
I-Worm/Stration.CLJ gefunden
BitDefender
Win32.Warezov.GC@mm gefunden
ClamAV
Keine Viren gefunden
Dr.Web
Win32.HLLM.Limar gefunden
F-Prot Antivirus
W32/EmailWorm.FZB gefunden
F-Secure Anti-Virus
Email-Worm.Win32.Warezov.hx gefunden
Fortinet
W32/Stration.HX@mm gefunden
Kaspersky Anti-Virus
Email-Worm.Win32.Warezov.hx gefunden
NOD32
Win32/Stration.YB gefunden
Norman Virus Control
W32/Stration.EXQ gefunden
Panda Antivirus
Keine Viren gefunden
Rising Antivirus
Keine Viren gefunden
VirusBuster
Keine Viren gefunden
VBA32
MalwareScope.Worm.Warezov.1 gefunden


Datei: wmplmspo.dll
Auslastung:
0% 100%
Status:
INFIZIERT/MALWARE
Entdeckte Packprogramme:
-

AntiVir
WORM/Stration.Gen gefunden
ArcaVir
Worm.Warezov.Iq gefunden
Avast
Win32:Warezov-BTW gefunden
AVG Antivirus
I-Worm/Stration.CSS gefunden
BitDefender
Win32.Worm.Warezov.AB gefunden
ClamAV
Worm.Stration.ACD-3 gefunden
Dr.Web
Win32.HLLM.Limar gefunden
F-Prot Antivirus
Keine Viren gefunden
F-Secure Anti-Virus
Email-Worm.Win32.Warezov.iq gefunden
Fortinet
W32/Stration gefunden
Kaspersky Anti-Virus
Email-Worm.Win32.Warezov.iq gefunden
NOD32
Win32/Stration.YK gefunden
Norman Virus Control
Keine Viren gefunden
Panda Antivirus
Keine Viren gefunden
Rising Antivirus
Keine Viren gefunden
VirusBuster
Keine Viren gefunden
VBA32
Worm.Win32.Stration.YK gefunden


Datei: cluscomr.dll
Auslastung:
0% 100%
Status:
INFIZIERT/MALWARE (Anmerkung: diese Datei wurde bereits vorher gescannt. Die Scanergebnisse werden daher nicht in der Datenbank gespeichert.)
Entdeckte Packprogramme:
-

AntiVir
WORM/Stration.Gen gefunden
ArcaVir
Keine Viren gefunden
Avast
Win32:Warezov-BTX gefunden
AVG Antivirus
I-Worm/Stration.CSP gefunden
BitDefender
DeepScan:Generic.Stration.51EDF12E gefunden
ClamAV
Worm.Stration.ACD-1 gefunden
Dr.Web
Win32.HLLM.Limar gefunden
F-Prot Antivirus
Keine Viren gefunden
F-Secure Anti-Virus
Email-Worm.Win32.Warezov.ml gefunden
Fortinet
W32/Stration gefunden
Kaspersky Anti-Virus
Email-Worm.Win32.Warezov.ml gefunden
NOD32
Win32/Stration.YK gefunden
Norman Virus Control
Keine Viren gefunden
Panda Antivirus
W32/Spamta.VG.worm gefunden
Rising Antivirus
Keine Viren gefunden
VirusBuster
Keine Viren gefunden
VBA32
Worm.Win32.Stration.YK gefunden

#2 ontherockz

stelle den CleanUp genauso ein, wie hier angegeben:
http://virus-protect.org/cleanup.html

Kopiere diese 6 Textdateien ab . (rechtsklick mit der Maus -> den Text markieren -> kopieren -> einfügen) Sie sind nach Datum geordnet. (kopiere nur die letzten 3 Monate ab)
http://virus-protect.org/datfindbat.html

dann helfe ich dir, das zu reinigen
__________
MfG Sabina

rund um die PC-Sicherheit

#3 danke, sehr nett
hier die gewünschten daten:

Datentr„ger in Laufwerk C: ist ACER
Volumeseriennummer: 0954-16DC

Verzeichnis von C:\WINDOWS\system32

05.04.2007 18:11 494 eRLog.ini
05.04.2007 18:10 1.158 wpa.dbl
04.04.2007 23:42 273.376 FNTCACHE.DAT
04.04.2007 18:02 411.638 perfh007.dat
04.04.2007 18:02 74.250 perfc007.dat
04.04.2007 18:02 397.096 perfh009.dat
04.04.2007 18:02 955.024 PerfStringBackup.INI
04.04.2007 18:02 61.568 perfc009.dat
02.04.2007 07:58 546.304 hhctrl.ocx
27.03.2007 08:01 9.799 jupdate-1.5.0_11-b03.log
19.03.2007 15:51 7.680 pxinst.dll
12.03.2007 20:04 108.144 CmdLineExt.dll
08.03.2007 17:36 281.600 gdi32.dll
08.03.2007 17:36 40.960 mf3216.dll
08.03.2007 17:36 579.072 user32.dll
08.03.2007 17:32 1.843.712 win32k.sys
07.03.2007 21:36 12.619.736 MRT.exe
02.03.2007 11:20 34.308 BASSMOD.dll
21.02.2007 14:17 188 eDataSecurity.dat
15.02.2007 18:01 337.280 WgaTray.exe
15.02.2007 18:01 1.476.992 LegitCheckControl.dll
15.02.2007 18:00 236.928 WgaLogon.dll
15.02.2007 17:13 122.142 TZLog.log
13.02.2007 23:12 16.832 amcompat.tlb
13.02.2007 23:12 23.392 nscompat.tlb
11.02.2007 14:21 205 lsprst7.dll
11.02.2007 14:21 219 lsprst7.tgz
11.02.2007 14:21 73 ssprs.dll
11.02.2007 14:21 87 ssprs.tgz
10.02.2007 03:21 1.025 sysprs7.tgz
10.02.2007 03:21 1.025 clauth2.dll
10.02.2007 03:21 1.025 clauth1.dll
10.02.2007 03:21 1.025 sysprs7.dll
09.02.2007 13:10 4 JobSave.dat
09.02.2007 13:10 734 OptionsSave.dat
07.02.2007 15:12 262.144 wrap_oal.dll
07.02.2007 15:12 86.016 OpenAL32.dll
07.02.2007 14:07 9.074 jupdate-1.5.0_10-b03.log
06.02.2007 17:18 30 brss01a.ini
06.02.2007 17:18 184 brsvc01a.bsi
04.02.2007 02:02 185.952 rmoc3260.dll
04.02.2007 02:02 6.656 pndx5016.dll
04.02.2007 02:02 5.632 pndx5032.dll
04.02.2007 02:02 278.528 pncrt.dll
04.02.2007 00:45 308 results.txt
04.02.2007 00:34 37.416 $winnt$.inf
01.02.2007 05:56 823.296 divx_xx07.dll
01.02.2007 05:56 823.296 divx_xx0c.dll
01.02.2007 05:56 802.816 divx_xx11.dll
01.02.2007 05:56 639.066 DivX.dll
01.02.2007 05:55 679.936 divxdec.ax
31.01.2007 22:27 524.288 DivXsm.exe
31.01.2007 22:27 4.816 divxsm.tlb
31.01.2007 00:15 118.784 DivXCodecUpdateChecker.exe
30.01.2007 16:15 1.044.480 roboex32.dll
30.01.2007 16:15 49.152 Inetwh32.dll
30.01.2007 06:03 10.152 dsm_de.qm
30.01.2007 06:03 3.596.288 qt-dx331.dll
30.01.2007 06:03 1.044.480 libdivx.dll
30.01.2007 06:03 200.704 ssldivx.dll
30.01.2007 05:56 73.728 dpl100.dll
30.01.2007 05:56 196.608 dtu100.dll
30.01.2007 05:56 53.248 dpuGUI10.dll
30.01.2007 05:56 593.920 dpuGUI11.dll
30.01.2007 05:56 57.344 dpv11.dll
30.01.2007 05:56 344.064 dpus11.dll
30.01.2007 05:56 294.912 dpu11.dll
30.01.2007 05:56 294.912 dpu10.dll
30.01.2007 05:56 352.401 DivXMedia.ax
29.01.2007 09:58 60.416 tzchange.exe
19.01.2007 12:53 51.056 sirenacm.dll
12.01.2007 09:27 232.960 webcheck.dll
12.01.2007 09:27 1.149.952 urlmon.dll
12.01.2007 09:27 822.784 wininet.dll
12.01.2007 09:27 477.696 mshtmled.dll
12.01.2007 09:27 132.608 extmgr.dll
12.01.2007 09:27 6.054.400 ieframe.dll
12.01.2007 09:27 3.580.416 mshtml.dll
12.01.2007 09:27 458.752 msfeeds.dll
12.01.2007 09:27 27.136 jsproxy.dll
12.01.2007 09:27 51.712 msfeedsbs.dll
12.01.2007 09:27 670.720 mstime.dll
10.01.2007 17:42 1.040.384 ieframe.dll.mui
08.01.2007 19:04 105.984 url.dll
08.01.2007 19:04 102.400 occache.dll
08.01.2007 19:03 193.024 msrating.dll
08.01.2007 19:02 1.823.744 inetcpl.cpl
08.01.2007 19:02 266.752 iertutil.dll
08.01.2007 19:02 44.544 iernonce.dll
08.01.2007 19:02 153.088 ieakeng.dll
08.01.2007 19:02 383.488 ieapfltr.dll
08.01.2007 19:02 161.792 ieakui.dll
08.01.2007 19:02 384.000 iedkcs32.dll
08.01.2007 19:02 230.400 ieaksie.dll
08.01.2007 19:01 17.408 corpol.dll
08.01.2007 19:00 124.928 advpack.dll
08.01.2007 18:08 56.832 ie4uinit.exe
08.01.2007 18:08 13.824 ieudinit.exe
02.01.2007 13:46 733.184 MtsWopCtrl.ocx

#4 es sind 6 logs (schaue bitte die Anleitung von datfndbat)
__________
MfG Sabina

rund um die PC-Sicherheit

#5 ups...sry. da war doch was ^^
ok... hier die restlichen 5:

Datentr„ger in Laufwerk C: ist ACER
Volumeseriennummer: 0954-16DC

Verzeichnis von C:\DOKUME~1\MEINER~1\LOKALE~1\Temp

05.04.2007 18:31 0 IMG5.tmp
05.04.2007 18:15 173 jusched.log
05.04.2007 18:12 16.384 Perflib_Perfdata_bb4.dat
05.04.2007 18:11 49.152 ~DF336B.tmp
05.04.2007 18:11 16.384 Perflib_Perfdata_930.dat
05.04.2007 18:10 25.665 French.bin
05.04.2007 18:10 24.274 German.bin
05.04.2007 18:10 25.824 Italian.bin
05.04.2007 18:10 24.638 Russian.bin
05.04.2007 18:10 26.062 Spanish.bin
05.04.2007 18:10 22.684 SWEDISH.bin
05.04.2007 18:10 24.654 Portuguese.bin
05.04.2007 18:10 21.773 English.bin
05.04.2007 18:10 15.534 SimChin.bin
05.04.2007 18:10 24.173 Dutch.bin
05.04.2007 18:10 20.733 Thai.bin
05.04.2007 18:10 23.467 Greek.bin
05.04.2007 18:10 22.606 Polish.bin
05.04.2007 18:10 23.522 Portuguese(Brazil).bin
05.04.2007 18:10 22.862 Czech.bin
05.04.2007 18:10 21.562 Finnish.bin
05.04.2007 18:10 18.436 Hebrew.bin
05.04.2007 18:10 24.446 Hungarian.bin
05.04.2007 18:10 20.608 Norwegian.bin
05.04.2007 18:10 20.859 Turkish.bin
05.04.2007 18:10 500.224 RtkBtMnt.exe
05.04.2007 18:10 16.913 TradChin.bin
05.04.2007 18:10 19.506 Arabic.bin
05.04.2007 18:10 22.856 Danish.bin
05.04.2007 18:10 18.978 Korean.bin
05.04.2007 18:10 22.809 Japanese.bin
15.02.2007 18:45 24.613 IadHide5.dll


Datentr„ger in Laufwerk C: ist ACER
Volumeseriennummer: 0954-16DC

Verzeichnis von C:\WINDOWS

05.04.2007 18:10 3.840 ModemLog_HDAUDIO Soft Data Fax Modem with SmartCP.txt
05.04.2007 18:10 159 wiadebug.log
05.04.2007 18:10 0 0.log
05.04.2007 18:10 2.048 bootstat.dat
05.04.2007 18:09 32.630 SchedLgU.Txt
05.04.2007 18:09 1.835.439 WindowsUpdate.log
05.04.2007 18:09 50 wiaservc.log
05.04.2007 12:47 396.745 setupapi.log
05.04.2007 12:45 54.156 QTFont.qfn
05.04.2007 12:25 8.025 resetlog.txt
05.04.2007 10:43 271.694 ntbtlog.txt
05.04.2007 03:04 306.088 pxinstall_log.txt
05.04.2007 03:02 15.425 pxdrvinstall.log
05.04.2007 03:01 77.312 ua2.dll
05.04.2007 01:07 607 setupact.log
05.04.2007 00:08 29.230 comsetup.log
05.04.2007 00:08 4.907 ehOCGen.log
05.04.2007 00:08 12.469 MedCtrOC.log
05.04.2007 00:08 8.694 KB935448.log
05.04.2007 00:08 1.355 imsins.log
05.04.2007 00:08 93.313 iis6.log
05.04.2007 00:08 4.354 tabletoc.log
05.04.2007 00:08 41.264 tsoc.log
05.04.2007 00:08 4.871 ocmsn.log
05.04.2007 00:08 17.987 ntdtcsetup.log
05.04.2007 00:08 87.770 FaxSetup.log
05.04.2007 00:08 4.447 msgsocm.log
05.04.2007 00:08 43.596 ocgen.log
05.04.2007 00:08 15.671 netfxocm.log
05.04.2007 00:08 11.005 plusoc.log
05.04.2007 00:08 26.386 msmqinst.log
05.04.2007 00:08 8.026 updspapi.log
04.04.2007 23:38 15.987 KB925902.log
04.04.2007 23:38 1.355 imsins.BAK
04.04.2007 23:28 2.963 avmadd32.log
04.04.2007 18:00 794 avmcowlan.log
03.04.2007 18:28 650 win.ini
30.03.2007 17:07 0 x0h7bh.reg
30.03.2007 12:50 277 system.ini
29.03.2007 06:41 131.791 DirectX.log
29.03.2007 06:30 2.064 ModemLog_SAMSUNG Mobile USB Modem.txt
28.03.2007 06:15 24.979 wmsetup.log
16.03.2007 05:11 13.177 KB929399.log
16.03.2007 05:10 16.844 KB929338.log
03.03.2007 20:18 69 NeroDigital.ini
02.03.2007 15:53 1.409 QTFont.for
28.02.2007 17:20 12.466 WgaNotify.log
21.02.2007 21:28 425 BRWMARK.INI
21.02.2007 21:28 27 BRPP2KA.INI
15.02.2007 23:57 6.078 DPINST.LOG
15.02.2007 18:45 179 LDM.log
15.02.2007 18:45 118.784 bwUnin-7.2.0.137-8876480SL.exe
15.02.2007 18:45 86 KE.log
15.02.2007 17:13 20.893 KB927779.log
15.02.2007 17:13 17.901 KB927802.log
15.02.2007 17:13 17.581 KB928255.log
15.02.2007 17:13 13.986 KB924667.log
15.02.2007 17:13 26.533 KB931836.log
15.02.2007 17:13 16.038 KB926436.log
15.02.2007 17:13 10.947 KB928090-IE7.log
15.02.2007 17:12 12.989 KB918118.log
15.02.2007 17:12 12.553 KB928843.log
15.02.2007 10:30 35 render.ini
13.02.2007 23:12 14.733 spupdsvc.log
13.02.2007 21:54 1.943 wmsetup10.log
13.02.2007 21:54 6.487 KB926239.log
13.02.2007 21:54 6.346 MSCompPackV1.log
13.02.2007 21:54 18.298 wmp11.log
13.02.2007 21:53 28.917 WMFDist11.log
13.02.2007 21:53 1.557 Wudf01000Inst.log
11.02.2007 22:57 905 medblker.Log
11.02.2007 22:55 13.713 KB925766.log
11.02.2007 21:08 21.333 LUINSTALL.LOG
11.02.2007 20:32 617 eReg.dat
11.02.2007 20:05 30 dmachine.inf
11.02.2007 20:05 146.776 d_eJay2.inf
11.02.2007 20:02 5 ejaylang.txt
10.02.2007 21:49 23 BlendSettings.ini
10.02.2007 15:53 286.720 Setup1.exe
10.02.2007 15:52 73.216 ST6UNST.EXE
10.02.2007 03:15 720.896 iun6002.exe
09.02.2007 23:48 122 OEWABLog.txt
09.02.2007 21:27 0 Jcmkr32.INI
07.02.2007 14:07 4.185 mozver.dat
06.02.2007 19:02 0 setuperr.log
04.02.2007 18:07 400 ODBC.INI
04.02.2007 00:51 93 alaunch.ini
04.02.2007 00:50 88 GridV.UNI
04.02.2007 00:44 0 MCE.INI
04.02.2007 00:44 79 QtZgAcer.UNI
03.02.2007 22:29 316.640 WMSysPr9.prx
03.02.2007 22:29 1.024.229 setupapi.log.1.old
03.02.2007 19:22 2 msoffice.ini


Datentr„ger in Laufwerk C: ist ACER
Volumeseriennummer: 0954-16DC

Verzeichnis von C:\WINDOWS\Temp

05.04.2007 18:10 409 WGANotify.settings
05.04.2007 18:10 255 WGAErrLog.txt
05.04.2007 18:10 0 T30DebugLogFile.txt
3 Datei(en) 664 Bytes
0 Verzeichnis(se), 12.389.122.048 Bytes frei


Datentr„ger in Laufwerk C: ist ACER
Volumeseriennummer: 0954-16DC

Verzeichnis von C:\WINDOWS\Downloaded Program Files

09.11.2006 14:36 5.019 swflash.inf
12.03.2006 10:22 346.216 IDrop.ocx
12.03.2006 10:22 114.280 IDropENU.dll
07.03.2006 14:54 114.256 IDropDEU.dll
26.05.2005 04:19 291 wuweb.inf
14.06.2003 03:57 65 desktop.ini
6 Datei(en) 580.127 Bytes
0 Verzeichnis(se), 12.389.089.280 Bytes frei[/color]

Datentr„ger in Laufwerk C: ist ACER
Volumeseriennummer: 0954-16DC

Verzeichnis von C:\

05.04.2007 19:52 0 sys.txt
05.04.2007 19:52 530 down.txt
05.04.2007 19:52 382 tmp.txt
05.04.2007 19:52 8.453 system.txt
05.04.2007 19:52 1.834 systemtemp.txt
05.04.2007 19:52 117.183 system32.txt
05.04.2007 18:09 2.145.505.280 hiberfil.sys
05.04.2007 18:09 1.610.612.736 pagefile.sys
05.04.2007 02:36 3.982 avenger.txt
05.04.2007 01:46 2.504 pjrbwovl.txt
29.03.2007 06:30 0 conmgr.log
03.02.2007 20:11 209 boot.ini
10.08.2004 20:00 47.564 NTDETECT.COM

#6 poste dieses log
http://virus-protect.org/artikel/tools/combofix.html
__________
MfG Sabina

rund um die PC-Sicherheit

#7 gab aber keine datenträgerbereinigung...

ComboFix 07-04-05 - Running from: "C:\Programme\Mozilla Firefox"


((((((((((((((((((((((((((((((( Files Created from 2007-03-05 to 2007-04-05 ))))))))))))))))))))))))))))))))))


2007-04-05 12:10 <DIR> d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\Spybot - Search & Destroy
2007-04-05 03:02 <DIR> d-------- C:\DOKUME~1\MEINER~1\ANWEND~1\Prevx
2007-04-05 03:02 <DIR> d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\Prevx
2007-04-05 03:01 77,312 --a------ C:\WINDOWS\ua2.dll
2007-04-05 02:38 <DIR> d-------- C:\avenger
2007-04-05 01:46 60,416 --a------ C:\WINDOWS\system32\drivers\p^tryrjo.sys
2007-04-05 00:31 <DIR> d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\AntiVir PersonalEdition Classic
2007-04-04 18:00 97,312 --a------ C:\WINDOWS\system32\drivers\Fwusb1b.bin
2007-04-04 18:00 33,792 --a------ C:\WINDOWS\system32\avmcowlan.dll
2007-04-04 18:00 264,704 --a------ C:\WINDOWS\system32\drivers\fwlanusb.sys
2007-04-04 18:00 <DIR> d-------- C:\WINDOWS\AVM_Driver
2007-04-04 18:00 <DIR> d-------- C:\DOKUME~1\MEINER~1\AVM_Driver
2007-03-30 17:07 0 --a------ C:\WINDOWS\x0h7bh.reg
2007-03-29 06:42 <DIR> d-------- C:\DOKUME~1\MEINER~1\ANWEND~1\Command & Conquer 3 Tiberium Wars
2007-03-29 06:41 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll
2007-03-29 06:15 <DIR> d-------- C:\Programme\Electronic Arts
2007-03-14 20:39 <DIR> d-------- C:\Programme\GUILD WARS
2007-03-13 14:10 <DIR> d-------- C:\DOKUME~1\MEINER~1\ANWEND~1\Gearbox Software
2007-03-13 14:02 <DIR> d-------- C:\Programme\Ubisoft
2007-03-12 20:07 <DIR> d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\Test Drive Unlimited
2007-03-12 20:04 <DIR> dr-h----- C:\DOKUME~1\MEINER~1\ANWEND~1\SecuROM
2007-03-12 19:51 <DIR> d-------- C:\Programme\Atari


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2007-04-04 18:02 74250 --a------ C:\WINDOWS\system32\perfc007.dat
2007-04-04 18:02 411638 --a------ C:\WINDOWS\system32\perfh007.dat
2007-03-28 06:50 196 --a------ C:\DOKUME~1\MEINER~1\ANWEND~1\g-force prefs (windowsmediaplayer).txt
2007-03-13 14:09 163644 --a------ C:\WINDOWS\system32\drivers\secdrv.sys
2007-03-12 20:04 108144 --a------ C:\WINDOWS\system32\cmdlineext.dll
2007-03-08 17:36 579072 --a------ C:\WINDOWS\system32\user32.dll
2007-03-08 17:36 40960 --a------ C:\WINDOWS\system32\mf3216.dll
2007-03-08 17:36 281600 --a------ C:\WINDOWS\system32\gdi32.dll
2007-03-08 17:32 1843712 --a------ C:\WINDOWS\system32\win32k.sys
2007-03-03 13:06 -------- d-------- C:\DOKUME~1\MEINER~1\ANWEND~1\sony
2007-03-03 13:04 -------- d-------- C:\Programme\sony
2007-03-03 13:03 -------- d-------- C:\Programme\sony setup
2007-03-03 12:39 -------- d-------- C:\DOKUME~1\MEINER~1\ANWEND~1\apple computer
2007-03-02 21:07 120 --a------ C:\DOKUME~1\MEINER~1\ANWEND~1\fixvts.ini
2007-03-02 13:15 -------- d-------- C:\Programme\itncprog
2007-03-02 12:18 -------- d-------- C:\Programme\pqdvd
2007-02-28 17:24 -------- d-------- C:\Programme\isl
2007-02-27 21:47 -------- d-------- C:\Programme\samsung
2007-02-23 21:15 -------- dr------- C:\DOKUME~1\MEINER~1\ANWEND~1\brother
2007-02-22 23:30 -------- d-------- C:\DOKUME~1\MEINER~1\ANWEND~1\ahead
2007-02-22 23:29 -------- d-------- C:\Programme\nero
2007-02-22 23:29 -------- d-------- C:\Programme\Gemeinsame Dateien\ahead
2007-02-22 12:27 -------- d-------- C:\Programme\vodei
2007-02-21 14:17 188 --a------ C:\WINDOWS\system32\edatasecurity.dat
2007-02-16 00:04 -------- d-------- C:\Programme\messenger plus! live
2007-02-15 21:31 -------- d-------- C:\Programme\answerworks 4.0
2007-02-15 21:28 -------- d-------- C:\Programme\autocad 2006
2007-02-15 21:26 -------- d-------- C:\Programme\autodesk
2007-02-15 18:58 -------- d-------- C:\DOKUME~1\MEINER~1\ANWEND~1\logitech
2007-02-15 18:45 118784 -r------- C:\WINDOWS\bwunin-7.2.0.137-8876480sl.exe
2007-02-15 18:44 -------- d-------- C:\Programme\logitech
2007-02-15 18:44 -------- d-------- C:\Programme\Gemeinsame Dateien\logitech
2007-02-13 21:18 -------- d-------- C:\Programme\ebay
2007-02-12 23:41 -------- d-------- C:\Programme\emule
2007-02-11 20:44 -------- d-------- C:\Programme\xp-antispy
2007-02-11 20:44 -------- d-------- C:\Programme\Gemeinsame Dateien\adobe systems shared
2007-02-11 20:32 617 --a------ C:\WINDOWS\ereg.dat
2007-02-11 20:27 -------- d-------- C:\Programme\ea games
2007-02-11 19:13 -------- d-------- C:\DOKUME~1\MEINER~1\ANWEND~1\vlc
2007-02-11 19:12 -------- d-------- C:\Programme\videolan
2007-02-11 18:23 -------- d-------- C:\Programme\dvd
2007-02-11 18:22 -------- d-------- C:\Programme\dvd decrypter
2007-02-11 18:22 -------- d-------- C:\DOKUME~1\MEINER~1\ANWEND~1\ripit4me
2007-02-11 17:09 -------- d-------- C:\Programme\topware
2007-02-11 14:21 73 --a------ C:\WINDOWS\system32\ssprs.dll
2007-02-11 14:21 205 --a------ C:\WINDOWS\system32\lsprst7.dll
2007-02-10 19:17 -------- d-------- C:\DOKUME~1\MEINER~1\ANWEND~1\cimco integration
2007-02-10 15:53 286720 --------- C:\WINDOWS\setup1.exe
2007-02-10 15:52 73216 --a------ C:\WINDOWS\st6unst.exe
2007-02-10 03:21 1025 --a------ C:\WINDOWS\system32\sysprs7.dll
2007-02-10 03:21 1025 --a------ C:\WINDOWS\system32\clauth2.dll
2007-02-10 03:21 1025 --a------ C:\WINDOWS\system32\clauth1.dll
2007-02-10 03:16 -------- d-------- C:\Programme\microtech
2007-02-10 03:15 720896 --a------ C:\WINDOWS\iun6002.exe
2007-02-10 02:47 -------- d-------- C:\Programme\mts
2007-02-09 22:46 -------- d-------- C:\DOKUME~1\MEINER~1\ANWEND~1\autodesk
2007-02-09 22:45 -------- d-------- C:\Programme\microsoft wse
2007-02-09 22:45 -------- d-------- C:\Programme\Gemeinsame Dateien\autodesk shared
2007-02-09 13:10 734 --a------ C:\WINDOWS\system32\optionssave.dat
2007-02-09 13:10 4 --a------ C:\WINDOWS\system32\jobsave.dat
2007-02-07 15:12 86016 --a------ C:\WINDOWS\system32\openal32.dll
2007-02-07 15:12 262144 --a------ C:\WINDOWS\system32\wrap_oal.dll
2007-02-07 14:08 -------- d-------- C:\DOKUME~1\MEINER~1\ANWEND~1\sun
2007-02-07 14:07 4185 --a------ C:\WINDOWS\mozver.dat
2007-02-07 14:07 -------- d-------- C:\Programme\java
2007-02-07 14:06 -------- d-------- C:\Programme\Gemeinsame Dateien\java
2007-02-06 21:26 -------- d-------- C:\Programme\dvd shrink de
2007-02-06 20:20 -------- d-------- C:\DOKUME~1\MEINER~1\ANWEND~1\cyberlink
2007-02-06 16:50 -------- d-------- C:\DOKUME~1\MEINER~1\ANWEND~1\fritz!
2007-02-06 16:49 -------- d-------- C:\Programme\Gemeinsame Dateien\avm
2007-02-06 16:49 -------- d-------- C:\Programme\fritz!dsl
2007-02-03 21:35 251 --a------ C:\Programme\wt3d.ini
2007-02-01 05:56 823296 --a------ C:\WINDOWS\system32\divx_xx0c.dll
2007-02-01 05:56 823296 --a------ C:\WINDOWS\system32\divx_xx07.dll
2007-02-01 05:56 802816 --a------ C:\WINDOWS\system32\divx_xx11.dll
2007-02-01 05:56 639066 --a------ C:\WINDOWS\system32\divx.dll
2007-01-31 22:27 524288 --a------ C:\WINDOWS\system32\divxsm.exe
2007-01-31 00:15 118784 --a------ C:\WINDOWS\system32\divxcodecupdatechecker.exe
2007-01-30 16:15 49152 -ra------ C:\WINDOWS\system32\inetwh32.dll
2007-01-30 16:15 1044480 -ra------ C:\WINDOWS\system32\roboex32.dll
2007-01-30 06:03 3596288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2007-01-30 06:03 200704 --a------ C:\WINDOWS\system32\ssldivx.dll
2007-01-30 06:03 1044480 --a------ C:\WINDOWS\system32\libdivx.dll
2007-01-30 05:56 73728 --a------ C:\WINDOWS\system32\dpl100.dll
2007-01-30 05:56 593920 --a------ C:\WINDOWS\system32\dpugui11.dll
2007-01-30 05:56 57344 --a------ C:\WINDOWS\system32\dpv11.dll
2007-01-30 05:56 53248 --a------ C:\WINDOWS\system32\dpugui10.dll
2007-01-30 05:56 344064 --a------ C:\WINDOWS\system32\dpus11.dll
2007-01-30 05:56 294912 --a------ C:\WINDOWS\system32\dpu11.dll
2007-01-30 05:56 294912 --a------ C:\WINDOWS\system32\dpu10.dll
2007-01-30 05:56 196608 --a------ C:\WINDOWS\system32\dtu100.dll
2007-01-19 12:53 51056 --a------ C:\WINDOWS\system32\sirenacm.dll
2007-01-08 19:01 17408 --a------ C:\WINDOWS\system32\corpol.dll


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"updateMgr"="c:\\Programme\\Adobe\\Acrobat 7.0\\Reader\\AdobeUpdateManager.exe AcRdB7_0_9"
"LDM"="C:\\Programme\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"
"SpybotSD TeaTimer"="C:\\Programme\\Spybot - Search & Destroy\\TeaTimer.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"ehTray"="C:\\WINDOWS\\ehome\\ehtray.exe"
"LaunchApp"="Alaunch"
"SynTPLpr"="C:\\Programme\\Synaptics\\SynTP\\SynTPLpr.exe"
"SynTPEnh"="C:\\Programme\\Synaptics\\SynTP\\SynTPEnh.exe"
"IMJPMIG8.1"="\"C:\\WINDOWS\\IME\\imjp8_1\\IMJPMIG.EXE\" /Spoil /RemAdvDef /Migration32"
"MSPY2002"="C:\\WINDOWS\\system32\\IME\\PINTLGNT\\ImScInst.exe /SYNC"
"PHIME2002ASync"="C:\\WINDOWS\\system32\\IME\\TINTLGNT\\TINTSETP.EXE /SYNC"
"PHIME2002A"="C:\\WINDOWS\\system32\\IME\\TINTLGNT\\TINTSETP.EXE /IMEName"
"igfxtray"="C:\\WINDOWS\\system32\\igfxtray.exe"
"igfxhkcmd"="C:\\WINDOWS\\system32\\hkcmd.exe"
"igfxpers"="C:\\WINDOWS\\system32\\igfxpers.exe"
"ADMTray.exe"="\"C:\\Acer\\Empowering Technology\\admtray.exe\""
"eDataSecurity Loader"="C:\\Acer\\Empowering Technology\\eDataSecurity\\eDSloader.exe"
"ntiMUI"="C:\\Programme\\NewTech Infosystems\\NTI CD & DVD-Maker 7\\ntiMUI.exe"
"RTHDCPL"="RTHDCPL.EXE"
"Alcmtr"="ALCMTR.EXE"
"AzMixerSel"="C:\\Programme\\Realtek\\InstallShield\\AzMixerSel.exe"
"ePower_DMC"="C:\\Acer\\Empowering Technology\\ePower\\ePower_DMC.exe"
"Acer ePower Management"="C:\\Acer\\Empowering Technology\\ePower\\Acer ePower Management.exe boot"
"LManager"="C:\\PROGRA~1\\LAUNCH~1\\QtZgAcer.EXE"
"eRecoveryService"="C:\\Acer\\Empowering Technology\\eRecovery\\Monitor.exe"
"SunJavaUpdateSched"="\"C:\\Programme\\Java\\jre1.5.0_11\\bin\\jusched.exe\""
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE"
"ATICCC"="\"C:\\Programme\\ATI Technologies\\ATI.ACE\\cli.exe\" runtime -Delay"
"NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"QuickTime Task"="\"C:\\Programme\\QuickTime\\qttask.exe\" -atboottime"
"avgnt"="\"C:\\Programme\\AntiVir PersonalEdition Classic\\avgnt.exe\" /min"
"PrevxOne"="\"C:\\Programme\\Prevx1\\PXConsole.exe\""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
@=""
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
@=""
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
@=""
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="qttask"
"hkey"="HKLM"
"command"="\"C:\\Programme\\QuickTime\\qttask.exe\" -atboottime"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"appinit_dlls"="  wmplmspo.dll confifc.dll ifcstat.dll"


[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"WPDShServiceObj"="{AAA288BA-9A4C-45B0-95D7-94D524869DB5}"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"=hex(2):43,3a,5c,57,49,4e,44,4f,57,53,5c,52,65,73,6f,75,72,\
63,65,73,5c,54,68,65,6d,65,73,5c,52,6f,79,61,6c,65,5c,52,6f,79,61,6c,65,2e,\
6d,73,73,74,79,6c,65,73,00
"InstallTheme"=hex(2):43,3a,5c,57,49,4e,44,4f,57,53,5c,52,65,73,6f,75,72,63,65,\
73,5c,54,68,65,6d,65,73,5c,52,6f,79,61,6c,65,2e,74,68,65,6d,65,00

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\crypmapi
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dbgmgr

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
Authentication Packages REG_MULTI_SZ msv1_0\0\0
Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0
Notification Packages REG_MULTI_SZ scecli\0\0

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0


[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{991aa3fa-e2c5-11db-8e6c-0018de252e46}]
Shell\AutoRun\command G:\pushinst.exe
*newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_INT15.SYS


********************************************************************

catchme 0.2 W2K/XP/Vista - userland rootkit detector by Gmer, 17 October 2006
http://www.gmer.net

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

********************************************************************

Completion time: 07-04-05 20:20:11
C:\ComboFix-quarantined-files.txt ... 07-04-05 20:20

#8 Avenger
http://virus-protect.org/artikel/tools/avenger.html
Input script manually (anhaken)
kopiere in: View/edit script

Zitat

Registry values to replace with dummy:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows|AppInit_DLLs

Registry keys to delete:
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\crypmapi
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dbgmgr

Files to delete:
C:\WINDOWS\ua2.dll
C:\WINDOWS\x0h7bh.reg

Klicke die grüne Ampel
das Script wird nun ausgeführt, dann wird der PC automatisch neustarten

------------------

««
Arbeitsplatz --> Rechtsklick, dann auf Eigenschaften --> Reiter Systemwiederherstellung --> Häkchen setzen bei Systemwiederherstellung auf allen Laufwerken deaktivieren.
(dann gleich wieder aktivieren)

««
http://virus-protect.org/artikel/tools/sdfix.html
im Normalmodus
RunThis.bat doppelt klicken
reinschreiben: 3
3 : wird Sophos geladen - waehle 6 - scanne und poste den report
__________
MfG Sabina

rund um die PC-Sicherheit

#9 Sophos Anti-Virus
Version 4.16.0 [Win32/Intel]
Virus data version 4.16, April 2007
Includes detection for 233497 viruses, trojans and worms
Copyright (c) 1989-2007 Sophos Plc, www.sophos.com

System time 20:51:08, System date 05 April 2007
Command line qualifiers are: -f -remove -nc -nb --stop-scan

Could not check C:\WINDOWS\system32\drivers\RMCast.sys (virus scan failed)
Could not open C:\WINDOWS\system32\drivers\sptd.sys
Could not check C:\WINDOWS\system32\dllcache\rmcast.sys (virus scan failed)
Could not check C:\WINDOWS\$hf_mig$\KB919007\SP2QFE\rmcast.sys (virus scan failed)
Password protected file C:\Programme\Adobe\Acrobat 7.0\Reader\WebSearch\WebSearchENU.pdf
Password protected file C:\Programme\Adobe\Acrobat 7.0\Reader\Messages\ENU\RdrMsgENU.pdf
Password protected file C:\Programme\Adobe\Acrobat 7.0\Reader\Messages\RdrMsgSplash.pdf
Could not open C:\hiberfil.sys

2 boot sectors swept.
34791 files swept in 19 minutes and 53 seconds.
8 errors were encountered.
No viruses were discovered.
3 encrypted files were not checked.
Ending Sophos Anti-Virus.

#10 wenn nun die Windowsupdates funktionieren (ausprobieren) und dein Antivirenscanner im abgesicherten modus scannen - nichts mehr findet - sollte alles wieder i.o. sein
__________
MfG Sabina

rund um die PC-Sicherheit

#11 SUPER, funtkioniert alles wieder einwandfrei! Danke!