Warezov , W32/Stration

#1 Guten Abend... Ich habe auch diesen icq Virus -.-
hier hijack log

Logfile of HijackThis v1.99.1
Scan saved at 23:20:48, on 20.04.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\CTHELPER.EXE
C:\Programme\QuickTime\qttask.exe
C:\Programme\CyberLink\PowerDVD\PDVDServ.exe
C:\Programme\Java\jre1.6.0_01\bin\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\idl32.exe
C:\Programme\Skype\Phone\Skype.exe
C:\Programme\Wireless\IEEE802.11b WLAN USB Adapter v2.5\WLUSBCFG.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Programme\CyberLink\Shared files\RichVideo.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programme\WinRAR\WinRAR.exe
C:\DOKUME~1\Baumy\LOKALE~1\Temp\Rar$EX00.453\HijackThis.exe

R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll
O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\Programme\ICQToolbar\toolbaru.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_01\bin\ssv.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [KAVPersonal50] "C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Programme\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [RemoteControl] C:\Programme\CyberLink\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [LanguageShortcut] C:\Programme\CyberLink\PowerDVD\Language\Language.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [ICQ Lite] "C:\Programme\ICQLite\ICQLite.exe" -minimize
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [idl32.exe] C:\WINDOWS\idl32.exe s
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Programme\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ProxyCap] C:\PROGRA~1\PROXYL~1\ProxyCap\ProxyCap.exe
O4 - Global Startup: IEEE802.11b WLAN USB Adapter Utility.lnk = C:\Programme\Wireless\IEEE802.11b WLAN USB Adapter v2.5\WLUSBCFG.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: shfoxpob - C:\WINDOWS\system32\shfoxpob.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVM FRITZ!web Routing Service (de_serv) - Unknown owner - C:\Programme\Gemeinsame Dateien\AVM\de_serv.exe (file missing)
O23 - Service: kavsvc - Kaspersky Lab - C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Programme\CyberLink\Shared files\RichVideo.exe


Clean up hab ich auch schon gemacht

Combofix

"Baumy" - 07-04-20 23:24:03 Service Pack 2
ComboFix 07-04-20.3V - Running from: C:\Dokumente und Einstellungen\Baumy\Desktop\


((((((((((((((((((((((((((((((( Files Created from 2007-03-20 to 2007-04-20 ))))))))))))))))))))))))))))))))))


2007-04-20 23:16 53,248 --ah----- C:\WINDOWS\system32\diagisr.dll
2007-04-20 23:16 <DIR> d-------- C:\avenger
2007-04-20 20:45 177,152 --a------ C:\WINDOWS\idl32.exe
2007-04-20 20:37 4 --a------ C:\WINDOWS\system32\shfoxpob.dat
2007-04-08 01:18 180,224 --a------ C:\WINDOWS\system32\nvudisp.exe
2007-04-08 01:18 <DIR> d-------- C:\WINDOWS\nview
2007-04-08 01:17 180,224 --a------ C:\WINDOWS\system32\NVUNINST.EXE
2007-04-01 02:11 94,208 --a------ C:\WINDOWS\system32\China.dll
2007-04-01 02:11 <DIR> d-------- C:\Programme\KalOnlineEng


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2007-04-20 23:24 -------- d-------- C:\Programme\icqlite
2007-04-20 23:18 -------- d-------- C:\DOKUME~1\Baumy\ANWEND~1\skype
2007-04-19 09:19 -------- d-------- C:\Programme\icqtoolbar
2007-04-15 22:21 -------- d-------- C:\Programme\steam
2007-04-15 08:26 -------- d-------- C:\Programme\java
2007-04-12 21:55 -------- d-------- C:\Programme\warcraft iii
2007-04-10 09:17 -------- d-------- C:\DOKUME~1\Baumy\ANWEND~1\teamspeak2
2007-04-04 10:37 -------- d-------- C:\Programme\world of warcraft
2007-04-01 02:11 -------- d--h----- C:\Programme\installshield installation information
2007-03-29 17:45 -------- d-------- C:\Programme\yahoo!
2007-03-25 08:46 63778 --a------ C:\WINDOWS\system32\perfc007.dat
2007-03-25 08:46 391330 --a------ C:\WINDOWS\system32\perfh007.dat
2007-03-17 15:44 293376 --a------ C:\WINDOWS\system32\winsrv.dll
2007-03-08 17:36 579072 --a------ C:\WINDOWS\system32\user32.dll
2007-03-08 17:36 40960 --a------ C:\WINDOWS\system32\mf3216.dll
2007-03-08 17:36 281600 --a------ C:\WINDOWS\system32\gdi32.dll
2007-03-08 17:32 1843712 --a------ C:\WINDOWS\system32\win32k.sys
2007-03-01 17:32 163644 --a------ C:\WINDOWS\system32\drivers\secdrv.sys
2007-02-21 17:47 -------- d-------- C:\Programme\mirc
2007-02-21 11:55 -------- d-------- C:\DOKUME~1\Baumy\ANWEND~1\sun
2007-02-21 11:34 -------- d-------- C:\Programme\mp4 converter
2007-02-21 11:34 -------- d-------- C:\Programme\diablo ii
2007-02-21 11:33 -------- d-------- C:\Programme\ea games
2007-02-05 22:18 185856 --a------ C:\WINDOWS\system32\upnphost.dll
2007-01-24 18:40 90240 --a------ C:\WINDOWS\war3unin.dat
2007-01-06 23:55 124424 --a------ C:\DOKUME~1\Baumy\ANWEND~1\cosmos prefs


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{055FD26D-3A88-4e15-963D-DC8493744B1D} C:\Programme\ICQToolbar\toolbaru.dll
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} C:\Programme\Java\jre1.6.0_01\bin\ssv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"CTHelper"="CTHELPER.EXE"
"QuickTime Task"="\"C:\\Programme\\QuickTime\\qttask.exe\" -atboottime"
"KAVPersonal50"="\"C:\\Programme\\Kaspersky Lab\\Kaspersky Anti-Virus Personal\\kav.exe\" /minimize"
"Adobe Photo Downloader"="\"C:\\Programme\\Adobe\\Photoshop Album Starter Edition\\3.0\\Apps\\apdproxy.exe\""
"RemoteControl"="C:\\Programme\\CyberLink\\PowerDVD\\PDVDServ.exe"
"LanguageShortcut"="C:\\Programme\\CyberLink\\PowerDVD\\Language\\Language.exe"
"SunJavaUpdateSched"="\"C:\\Programme\\Java\\jre1.6.0_01\\bin\\jusched.exe\""
"ICQ Lite"="\"C:\\Programme\\ICQLite\\ICQLite.exe\" -minimize"
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"nwiz"="nwiz.exe /install"
"NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit"
"idl32.exe"="C:\\WINDOWS\\idl32.exe s"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\ctfmon.exe"
"Skype"="\"C:\\Programme\\Skype\\Phone\\Skype.exe\" /nosplash /minimized"
"Steam"=""
"ProxyCap"="C:\\PROGRA~1\\PROXYL~1\\ProxyCap\\ProxyCap.exe"

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\shfoxpob

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
Authentication Packages REG_MULTI_SZ msv1_0\0\0
Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0
Notification Packages REG_MULTI_SZ scecli\0\0


[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
Usnsvc REG_MULTI_SZ usnsvc\0\0


********************************************************************

catchme 0.2 W2K/XP/Vista - userland rootkit detector by Gmer, 17 October 2006
http://www.gmer.net

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

********************************************************************

Completion time: 07-04-20 23:27:27
C:\ComboFix-quarantined-files.txt ... 07-04-20 23:27
C:\ComboFix2.txt ... 07-04-20 23:09

und unten noch avengar

pls need help =P

#2 Starte im abgesicherten Modus: http://www.bsi.bund.de/av/texte/wiederher.htm und nutze dort bitte Cureit nach dieser Anleitung: http://virus-protect.org/cureit.html
Downloade es vorher von hier http://freedrweb.com/?lng=de
Verschiebe alle Funde poste nach einem neustart den Report, den es erstellt hat, sowie ein neues Hijackthis log.
__________
MfG Ralf
SEO-Spam Hunter

#3 danke für die schnelle und gute antwort


Logfile of HijackThis v1.99.1
Scan saved at 09:25:05, on 21.04.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Programme\CyberLink\Shared files\RichVideo.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\CTHELPER.EXE
C:\Programme\QuickTime\qttask.exe
C:\Programme\CyberLink\PowerDVD\PDVDServ.exe
C:\Programme\Java\jre1.6.0_01\bin\jusched.exe
C:\Programme\ICQLite\ICQLite.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Skype\Phone\Skype.exe
C:\Programme\Wireless\IEEE802.11b WLAN USB Adapter v2.5\WLUSBCFG.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\DOKUME~1\Baumy\LOKALE~1\Temp\Rar$EX00.329\HijackThis.exe

R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll
O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\Programme\ICQToolbar\toolbaru.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_01\bin\ssv.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [KAVPersonal50] "C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Programme\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [RemoteControl] C:\Programme\CyberLink\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [LanguageShortcut] C:\Programme\CyberLink\PowerDVD\Language\Language.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [ICQ Lite] "C:\Programme\ICQLite\ICQLite.exe" -minimize
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Programme\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ProxyCap] C:\PROGRA~1\PROXYL~1\ProxyCap\ProxyCap.exe
O4 - Global Startup: IEEE802.11b WLAN USB Adapter Utility.lnk = C:\Programme\Wireless\IEEE802.11b WLAN USB Adapter v2.5\WLUSBCFG.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: shfoxpob - C:\WINDOWS\system32\shfoxpob.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVM FRITZ!web Routing Service (de_serv) - Unknown owner - C:\Programme\Gemeinsame Dateien\AVM\de_serv.exe (file missing)
O23 - Service: kavsvc - Kaspersky Lab - C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Programme\CyberLink\Shared files\RichVideo.exe


meinen größten dank

#4 Bitte poste ein neuen Combofix Report. Du musst dein KAV auch noch wieder neu installieren. Das wird Warzov wohl deaktiviert/geloescht haben.
__________
MfG Ralf
SEO-Spam Hunter

#5 hier combofix report

"Baumy" - 07-04-21 15:19:53 Service Pack 2
ComboFix 07-04-20.3V - Running from: C:\Dokumente und Einstellungen\Baumy\Desktop\


((((((((((((((((((((((((((((((( Files Created from 2007-03-21 to 2007-04-21 ))))))))))))))))))))))))))))))))))


2007-04-21 09:11 <DIR> d-------- C:\DOKUME~1\Baumy\DoctorWeb
2007-04-21 00:41 <DIR> d-------- C:\avenger
2007-04-21 00:33 0 --a------ C:\WINDOWS\cdi1okj.dll
2007-04-20 20:37 4 --a------ C:\WINDOWS\system32\shfoxpob.dat
2007-04-08 01:18 180,224 --a------ C:\WINDOWS\system32\nvudisp.exe
2007-04-08 01:18 <DIR> d-------- C:\WINDOWS\nview
2007-04-08 01:17 180,224 --a------ C:\WINDOWS\system32\NVUNINST.EXE
2007-04-01 02:11 94,208 --a------ C:\WINDOWS\system32\China.dll
2007-04-01 02:11 <DIR> d-------- C:\Programme\KalOnlineEng


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2007-04-21 15:12 -------- d-------- C:\DOKUME~1\Baumy\ANWEND~1\skype
2007-04-21 00:33 -------- d-------- C:\Programme\icqlite
2007-04-20 23:38 -------- d-------- C:\Programme\steam
2007-04-19 09:19 -------- d-------- C:\Programme\icqtoolbar
2007-04-15 08:26 -------- d-------- C:\Programme\java
2007-04-12 21:55 -------- d-------- C:\Programme\warcraft iii
2007-04-10 09:17 -------- d-------- C:\DOKUME~1\Baumy\ANWEND~1\teamspeak2
2007-04-04 10:37 -------- d-------- C:\Programme\world of warcraft
2007-04-01 02:11 -------- d--h----- C:\Programme\installshield installation information
2007-03-29 17:45 -------- d-------- C:\Programme\yahoo!
2007-03-25 08:46 63778 --a------ C:\WINDOWS\system32\perfc007.dat
2007-03-25 08:46 391330 --a------ C:\WINDOWS\system32\perfh007.dat
2007-03-17 15:44 293376 --a------ C:\WINDOWS\system32\winsrv.dll
2007-03-08 17:36 579072 --a------ C:\WINDOWS\system32\user32.dll
2007-03-08 17:36 40960 --a------ C:\WINDOWS\system32\mf3216.dll
2007-03-08 17:36 281600 --a------ C:\WINDOWS\system32\gdi32.dll
2007-03-08 17:32 1843712 --a------ C:\WINDOWS\system32\win32k.sys
2007-03-01 17:32 163644 --a------ C:\WINDOWS\system32\drivers\secdrv.sys
2007-02-21 17:47 -------- d-------- C:\Programme\mirc
2007-02-21 11:55 -------- d-------- C:\DOKUME~1\Baumy\ANWEND~1\sun
2007-02-21 11:34 -------- d-------- C:\Programme\mp4 converter
2007-02-21 11:34 -------- d-------- C:\Programme\diablo ii
2007-02-21 11:33 -------- d-------- C:\Programme\ea games
2007-02-05 22:18 185856 --a------ C:\WINDOWS\system32\upnphost.dll
2007-01-24 18:40 90240 --a------ C:\WINDOWS\war3unin.dat
2007-01-06 23:55 124424 --a------ C:\DOKUME~1\Baumy\ANWEND~1\cosmos prefs


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{055FD26D-3A88-4e15-963D-DC8493744B1D} C:\Programme\ICQToolbar\toolbaru.dll
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} C:\Programme\Java\jre1.6.0_01\bin\ssv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"CTHelper"="CTHELPER.EXE"
"QuickTime Task"="\"C:\\Programme\\QuickTime\\qttask.exe\" -atboottime"
"KAVPersonal50"="\"C:\\Programme\\Kaspersky Lab\\Kaspersky Anti-Virus Personal\\kav.exe\" /minimize"
"Adobe Photo Downloader"="\"C:\\Programme\\Adobe\\Photoshop Album Starter Edition\\3.0\\Apps\\apdproxy.exe\""
"RemoteControl"="C:\\Programme\\CyberLink\\PowerDVD\\PDVDServ.exe"
"LanguageShortcut"="C:\\Programme\\CyberLink\\PowerDVD\\Language\\Language.exe"
"SunJavaUpdateSched"="\"C:\\Programme\\Java\\jre1.6.0_01\\bin\\jusched.exe\""
"ICQ Lite"="\"C:\\Programme\\ICQLite\\ICQLite.exe\" -minimize"
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"nwiz"="nwiz.exe /install"
"NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\ctfmon.exe"
"Skype"="\"C:\\Programme\\Skype\\Phone\\Skype.exe\" /nosplash /minimized"
"Steam"=""
"ProxyCap"="C:\\PROGRA~1\\PROXYL~1\\ProxyCap\\ProxyCap.exe"

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\shfoxpob

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
Authentication Packages REG_MULTI_SZ msv1_0\0\0
Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0
Notification Packages REG_MULTI_SZ scecli\0\0


[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
Usnsvc REG_MULTI_SZ usnsvc\0\0

*newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_PCANDIS5

********************************************************************

catchme 0.2 W2K/XP/Vista - userland rootkit detector by Gmer, 17 October 2006
http://www.gmer.net

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

********************************************************************

Completion time: 07-04-21 15:23:16
C:\ComboFix-quarantined-files.txt ... 07-04-21 15:23
C:\ComboFix2.txt ... 07-04-20 23:27
C:\ComboFix3.txt ... 07-04-20 23:09

ich und KAV ist noch aktiv also wird bei hochfahren gestartet und bleibt auch da. also kav ist ok

danke sehr

#6 Das sieht sauber aus. Du solltest noch diese beiden Dateien loeschen:
C:\WINDOWS\cdi1okj.dll
C:\WINDOWS\system32\shfoxpob.dat
__________
MfG Ralf
SEO-Spam Hunter

#7 vielen dank für die schnelle antwort raman