Win32:Warezov-BTW [Wrm]

#46 Mach bitte ein eigener Thread auf und poste da

1.Benutze CleunUp

Download CleanUp
Anleitung: http://www.virus-protect.org/cleanup.html

2 ComboFix
Download ComboFix zum Desktop
Doppelklick combofix.exe
Folge den Instruktionen in das Fenster
Waehrend Combofix lauft NICHT ins Fenster klicken sonst erfriert dein Rechner
Wenn das Tool fertig ist,oeffnet sich ein logfile(combofix.txt).
Poste nachher den logfile C:\ combofix.txt in dein folgender Bericht zuzammen mit ein log von HijackThis
__________
MfG Argus

#47 hi.
ich hab glaub ich mir auch diesen warezov- wurm eingefangen. jedenfalls trifft die beschreibung zu. ich hab nich grade nen großen durchblick von technischen sachen am comp und verteh auch nich wirklich was das für protokolle sind die hier gepostet werden. wär nett wenn ihr für mich noch mal erklären würdet was ich genau machen muss um den wieder los zu werden. thx


edit: ich hoff ich hab die richtigen protokolle gepostet. bitte schaut ma ob ihr was machen könnt.
logfile von hijackthis :


Logfile of HijackThis v1.99.1
Scan saved at 12:24, on 2007-05-12
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RunDll32.exe
C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe
C:\Programme\Musicmatch\Musicmatch Jukebox\mmtask.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
C:\Programme\D-Tools\daemon.exe
F:\Eigene Dateien\eigenes zeug\Programme\3.0\Apps\apdproxy.exe
F:\Eigene Dateien\eigenes zeug\Programme\ICQLite\ICQLite.exe
C:\Programme\AntiVir PersonalEdition Classic\sched.exe
F:\EIGENE~1\EIFCE4~1\PROGRA~1\AVGANT~1\avgcc.exe
F:\Eigene Dateien\eigenes zeug\Programme\MemOptimizer.exe
C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Windows Media Player\WMPNSCFG.exe
F:\EIGENE~1\EIFCE4~1\PROGRA~1\AVGANT~1\avgamsvr.exe
C:\Programme\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
F:\EIGENE~1\EIFCE4~1\PROGRA~1\AVGANT~1\avgupsvc.exe
F:\EIGENE~1\EIFCE4~1\PROGRA~1\AVGANT~1\avgemc.exe
C:\Programme\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Programme\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\Programme\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Programme\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
F:\Eigene Dateien\eigenes zeug\Programme\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\WINDOWS\System32\svchost.exe
F:\Eigene Dateien\eigenes zeug\Programme\Logitech\SetPoint\SetPoint.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe
C:\Programme\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
C:\Programme\Gemeinsame Dateien\Logitech\KHAL\KHALMNPR.EXE
C:\WINDOWS\system32\svchost.exe
C:\Programme\Winamp\Winamp.exe
C:\PROGRA~1\MOZILL~2\FIREFOX.EXE
C:\Dokumente und Einstellungen\möp\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.aldi.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.aldi.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ar.atwola.com/redir/B0/7rwJchSkakYaWRtPWfi0sV-mo5g5SgFi_ID1K3c3AUhLf6rOo7j84w$$/http://www.icq.com/cf/icq6/banners.html
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - F:\Eigene Dateien\eigenes zeug\Programme\ICQToolbar\toolbaru.dll
O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - F:\Eigene Dateien\eigenes zeug\Programme\ICQToolbar\toolbaru.dll
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar1.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - F:\Eigene Dateien\eigenes zeug\Programme\ICQToolbar\toolbaru.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [mmtask] "C:\Programme\Musicmatch\Musicmatch Jukebox\mmtask.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programme\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Adobe Photo Downloader] "F:\Eigene Dateien\eigenes zeug\Programme\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [LyraHD2TrayApp] "C:\Programme\Thomson\Lyra Jukebox\LyraHDTrayApp\LYRAHD2TrayApp.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Programme\Winamp\winampa.exe
O4 - HKLM\..\Run: [ICQ Lite] "F:\Eigene Dateien\eigenes zeug\Programme\ICQLite\ICQLite.exe" -minimize
O4 - HKLM\..\Run: [AVG7_CC] F:\EIGENE~1\EIFCE4~1\PROGRA~1\AVGANT~1\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [AOLMIcon] C:\Programme\Gemeinsame Dateien\AOLSHARE\AOLMIcon.exe
O4 - HKCU\..\Run: [TuneUp MemOptimizer] "F:\Eigene Dateien\eigenes zeug\Programme\MemOptimizer.exe" autostart
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [swg] C:\Programme\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = F:\Eigene Dateien\eigenes zeug\Programme\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = F:\Eigene Dateien\eigenes zeug\Programme\Reader\AdobeCollabSync.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = F:\Eigene Dateien\eigenes zeug\Programme\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech SetPoint.lnk = F:\Eigene Dateien\eigenes zeug\Programme\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: &Google Search - res://c:\programme\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Im Cache gespeicherte Seite - res://c:\programme\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Verweisseiten - res://c:\programme\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Ähnliche Seiten - res://c:\programme\google\GoogleToolbar2.dll/cmsimilar.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - F:\Eigene Dateien\eigenes zeug\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - F:\Eigene Dateien\eigenes zeug\Programme\ICQLite\ICQLite.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.aldi.com/
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1106843944468
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - F:\Eigene Dateien\eigenes zeug\Programme\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - F:\EIGENE~1\EIFCE4~1\PROGRA~1\AVGANT~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - F:\EIGENE~1\EIFCE4~1\PROGRA~1\AVGANT~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - F:\EIGENE~1\EIFCE4~1\PROGRA~1\AVGANT~1\avgemc.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Programme\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Programme\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Programme\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Programme\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - Unknown owner - E:\Zeug\TuneUp\WinStylerThemeSvc.exe (file missing)
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe






hier das logfile von combofix:


"m”p" - 2007-05-12 12:27:04 Service Pack 2
ComboFix 07-05.08.3.V - Running from: "C:\Dokumente und Einstellungen\m”p\Desktop\"


((((((((((((((((((((((((((((((( Files Created from 2007-04-05 to 2007-05-12 ))))))))))))))))))))))))))))))))))


2007-05-12 06:58 <DIR> d-------- C:\WINDOWS\LastGood
2007-05-11 18:49 <DIR> d-------- C:\Avenger
2007-05-10 14:17 <DIR> d-------- C:\DOKUME~1\MPBF6A~1\ANWEND~1\ICQ Toolbar
2007-05-10 14:17 <DIR> d-------- C:\DOKUME~1\MPBF6A~1\ANWEND~1\Google
2007-05-09 19:19 148 --a------ C:\DOKUME~1\MPBF6A~1\ANWEND~1\wklnhst.dat
2007-05-09 11:30 <DIR> d-------- C:\DOKUME~1\MPBF6A~1\ANWEND~1\TuneUp Software
2007-05-09 11:29 <DIR> d-------- C:\DOKUME~1\MPBF6A~1\ANWEND~1\Talkback
2007-05-09 11:28 <DIR> d-------- C:\DOKUME~1\MPBF6A~1\ANWEND~1\Winamp
2007-05-09 11:24 2,097,152 --a------ C:\DOKUME~1\MPBF6A~1\NTUSER.DAT
2007-05-09 11:24 <DIR> dr-h----- C:\DOKUME~1\MPBF6A~1\Anwendungsdaten
2007-05-09 11:24 <DIR> dr------- C:\DOKUME~1\MPBF6A~1\Startmen�
2007-05-09 11:24 <DIR> dr------- C:\DOKUME~1\MPBF6A~1\Favoriten
2007-05-09 11:24 <DIR> dr------- C:\DOKUME~1\MPBF6A~1\Eigene Dateien
2007-05-09 11:24 <DIR> d--h----- C:\DOKUME~1\MPBF6A~1\Vorlagen
2007-05-09 11:24 <DIR> d--h----- C:\DOKUME~1\MPBF6A~1\Netzwerkumgebung
2007-05-09 11:24 <DIR> d--h----- C:\DOKUME~1\MPBF6A~1\Lokale Einstellungen
2007-05-09 11:24 <DIR> d--h----- C:\DOKUME~1\MPBF6A~1\Druckumgebung
2007-05-09 11:24 <DIR> d---s---- C:\DOKUME~1\MPBF6A~1\UserData
2007-05-09 11:24 <DIR> d-------- C:\DOKUME~1\MPBF6A~1\WINDOWS
2007-05-09 11:24 <DIR> d-------- C:\DOKUME~1\MPBF6A~1\ANWEND~1\You've Got Pictures Screensaver
2007-05-09 11:24 <DIR> d-------- C:\DOKUME~1\MPBF6A~1\ANWEND~1\Real
2007-05-09 11:24 <DIR> d-------- C:\DOKUME~1\MPBF6A~1\ANWEND~1\Logitech
2007-05-09 11:24 <DIR> d-------- C:\DOKUME~1\MPBF6A~1\ANWEND~1\ICQLite
2007-05-09 11:24 <DIR> d-------- C:\DOKUME~1\MPBF6A~1\ANWEND~1\CyberLink
2007-05-09 11:24 <DIR> d-------- C:\DOKUME~1\MPBF6A~1\ANWEND~1\AOL
2007-04-19 15:43 43,584 --a------ C:\WINDOWS\system32\drivers\avipbb.sys
2007-04-19 15:43 28,352 --a------ C:\WINDOWS\system32\drivers\ssmdrv.sys
2007-04-15 09:08 <DIR> d-------- C:\My Games


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2007-05-12 10:22:50 -------- d-----w C:\Programme\Mozilla Firefox 2 Beta 2
2007-05-12 05:03:56 21,840 ----atw C:\WINDOWS\system32\SIntfNT.dll
2007-05-12 05:03:56 17,212 ----atw C:\WINDOWS\system32\SIntf32.dll
2007-05-12 05:03:56 12,067 ----atw C:\WINDOWS\system32\SIntf16.dll
2007-05-09 15:47:04 -------- d--h--w C:\Programme\InstallShield Installation Information
2007-05-09 09:41:11 -------- d-----w C:\Programme\ICQToolbar
2007-05-09 09:41:11 -------- d-----w C:\Programme\hp deskjet 970c series
2007-05-09 09:41:11 -------- d-----w C:\Programme\GameSpy Arcade
2007-05-08 08:45:01 -------- d-s---w C:\Programme\Xfire
2007-05-08 08:44:23 664 ----a-w C:\WINDOWS\system32\d3d9caps.dat
2007-04-20 16:34:41 108,144 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2007-04-19 14:36:00 -------- d-----w C:\Programme\Messenger
2007-04-17 18:47:50 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll
2007-04-07 15:21:07 -------- d-----w C:\Programme\MoodLogic
2007-04-07 15:21:03 -------- d-----w C:\Programme\Winamp
2007-04-07 15:15:21 -------- d-----w C:\Programme\Diablo II
2007-04-04 09:44:26 -------- d-----w C:\Programme\Yahoo!
2007-04-04 09:39:55 -------- d-----w C:\Programme\ICQLite
2007-04-04 09:39:08 -------- d-----w C:\Programme\ICOO Loader
2007-03-25 07:27:54 62,166 ----a-w C:\WINDOWS\system32\perfc007.dat
2007-03-25 07:27:54 386,058 ----a-w C:\WINDOWS\system32\perfh007.dat
2007-03-17 13:44:25 293,376 ----a-w C:\WINDOWS\system32\winsrv.dll
2007-03-09 13:31:26 127,034 ------r C:\WINDOWS\bwUnin-8.1.1.50-8876480SL.exe
2007-03-08 15:36:30 579,072 ----a-w C:\WINDOWS\system32\user32.dll
2007-03-08 15:36:30 40,960 ----a-w C:\WINDOWS\system32\mf3216.dll
2007-03-08 15:36:30 281,600 ----a-w C:\WINDOWS\system32\gdi32.dll
2007-03-08 15:32:24 1,843,712 ----a-w C:\WINDOWS\system32\win32k.sys
2007-02-28 16:01:28 1,088 ----a-w C:\WINDOWS\eReg.dat
2007-02-25 15:04:25 72,748 ----a-w C:\WINDOWS\unins000.exe
2007-02-25 15:04:25 647 ----a-w C:\WINDOWS\unins000.dat
2007-02-05 20:18:44 185,856 ----a-w C:\WINDOWS\system32\upnphost.dll


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
"{055FD26D-3A88-4e15-963D-DC8493744B1D}"="F:\Eigene Dateien\eigenes zeug\Programme\ICQToolbar\toolbaru.dll"
"{53707962-6F74-2D53-2644-206D7942484F}"="C:\PROGRA~1\SPYBOT~1\SDHelper.dll"
"{AA58ED58-01DD-4d91-8333-CF10577473F7}"="c:\programme\google\googletoolbar1.dll"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"Cmaudio"="RunDll32 cmicnfg.cpl,CMICtrlWnd"
"NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"avgnt"="\"C:\\Programme\\AntiVir PersonalEdition Classic\\avgnt.exe\" /min"
"mmtask"="\"C:\\Programme\\Musicmatch\\Musicmatch Jukebox\\mmtask.exe\""
"HPDJ Taskbar Utility"="C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\hpztsb04.exe"
"DAEMON Tools-1033"="\"C:\\Programme\\D-Tools\\daemon.exe\" -lang 1033"
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE"
"Adobe Photo Downloader"="\"F:\\Eigene Dateien\\eigenes zeug\\Programme\\3.0\\Apps\\apdproxy.exe\""
"LyraHD2TrayApp"="\"C:\\Programme\\Thomson\\Lyra Jukebox\\LyraHDTrayApp\\LYRAHD2TrayApp.exe\""
"WinampAgent"="C:\\Programme\\Winamp\\winampa.exe"
"ICQ Lite"="\"F:\\Eigene Dateien\\eigenes zeug\\Programme\\ICQLite\\ICQLite.exe\" -minimize"
"AVG7_CC"="F:\\EIGENE~1\\EIFCE4~1\\PROGRA~1\\AVGANT~1\\avgcc.exe /STARTUP"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"AOLMIcon"="C:\\Programme\\Gemeinsame Dateien\\AOLSHARE\\AOLMIcon.exe"
"TuneUp MemOptimizer"="\"F:\\Eigene Dateien\\eigenes zeug\\Programme\\MemOptimizer.exe\" autostart"
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"WMPNSCFG"="C:\\Programme\\Windows Media Player\\WMPNSCFG.exe"
"Steam"=""
"swg"="C:\\Programme\\Google\\GoogleToolbarNotifier\\1.2.908.5008\\GoogleToolbarNotifier.exe"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"AVG7_Run"="F:\\EIGENE~1\\EIFCE4~1\\PROGRA~1\\AVGANT~1\\avgw.exe /RUNONCE"


HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
Authentication Packages msv1_0\0\0
Security Packages kerberos\0msv1_0\0schannel\0wdigest\0\0
Notification Packages scecli\0\0




HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\agrsmmsg
AGRSMMSG.exe

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\antivirusregistration
c:\programme\antivirus offer\etrust antivirus registration\EzAntivirusRegistrationCheck.exe

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\aolmicon
C:\Programme\Gemeinsame Dateien\AOLSHARE\AOLMIcon.exe

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\atipta
C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe
C:\WINDOWS\system32\ctfmon.exe

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dit
Dit.exe

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\keyboard status
C:\PROGRA~1\Medion\KeyStat\KeyStat.exe

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nerofiltercheck
C:\WINDOWS\system32\NeroCheck.exe

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\pcmservice
"C:\Programme\Home Cinema\PowerCinema\PCMService.exe"

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\realtime monitor
C:\PROGRA~1\CA\ETRUST~1\realmon.exe -s

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\steam
C:\Programme\Valve\Steam\\Steam.exe -silent


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"TUWinStylerThemeSvc"=dword:00000002

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter HTTPFilter\0\0
LocalService Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService DnsCache\0\0
DcomLaunch DcomLaunch\0TermService\0\0
rpcss RpcSs\0\0
imgsvc StiSvc\0\0
termsvcs TermService\0\0
WudfServiceGroup WUDFSvc\0\0

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost
UxTuneUp


[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0f039ae1-8468-11d9-8a72-001109df9636}]
Shell\AutoRun\command L:\OEMBranding.exe

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{176ebe7a-8522-11d9-8a7e-001109df94c7}]
Shell\AutoRun\command K:\OEMBranding.exe

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b60dc10a-85ba-11d9-8a81-001109df94c7}]
Shell\AutoRun\command L:\OEMBranding.exe


Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\1-Klick-Wartung.job

********************************************************************

catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-05-12 12:29:29
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


********************************************************************

Completion time: 2007-05-12 12:29:36
C:\ComboFix-quarantined-files.txt ... 2007-05-12 12:29