Antivirenprogramme lassen sich nicht installieren

#31 Die Datei C:\WINDOWS\system32\hldrrr.exe ist eine Bagle Variante. schaue bitte, ob diese Meldung bei Panda Antirootkit noch auftaucht. BZW Poste bitte nochmal ein neuen Gmer und Combofix(bitte eine aktuelle Version herunterladen) Report. Nur um zu sehen, ob Panda diese Datei wirklich geloescht hat.
__________
MfG Ralf
SEO-Spam Hunter

#32 Tut mir leid, ein Blitzschlag hat scheinbar mein Netzteil zerlegt...
Habe schon ein neues bestellt, werde sobald wie möglich die nötigen Sachen posten.
Danke für die Hilfe

#33 hier der reglooks-log: REGLOOKS logfile

version 0.971
13.06.2007 23:02:27,06
running from: "D:\Downloads"

--- SSODL regkeys ---

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
only standard or legit regkeys found


--- STS regkeys ---

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler
only standard or legit regkeys found


--- USERINIT regkey ---

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"


--- SHELL regkey ---

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
"Shell"="Explorer.exe"


--- SYSTEM regkey ---

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
"System"=""


--- APPINIT_DLLS regkey ---

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows
"AppInit_DLLs"=""


--- NOTIFY regkeys ---

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
"AtiExtEvent" "DLLName"="Ati2evxx.dll"


--- BOOTEXECUTE regkey ---

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager
BootExecute= autocheck autochk *\0\0


--- SHELLEXECUTEHOOKS regkey ---

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""


--- AUTORUN regkeys ---

HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor
"AutoRun"=""


--- HKLM\Run regkeys ---

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"WinampAgent"="E:\\Programme\\Music & Video\\Winamp\\winampa.exe"
"SunJavaUpdateSched"="\"C:\\Programme\\Java\\jre1.5.0_11\\bin\\jusched.exe\""
"DAEMON Tools"="\"E:\\Programme\\Music & Video\\DAEMON Tools\\daemon.exe\" -lang 1033"
"Copy Handler"="E:\\Programme\\copyhandler\\ch.exe"
"ATICCC"="\"C:\\Programme\\ATI Technologies\\ATI.ACE\\CLIStart.exe\""
"SoundMan"="SOUNDMAN.EXE"
[run\OptionalComponents]
[run\OptionalComponents\IMAIL]
"Installed"="1"
[run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"
[run\OptionalComponents\MSFS]
"Installed"="1"


--- HKLM\RunOnce regkeys ---

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
no HKLM RunOnce keys found


--- HKLM\RunOnceEx regkeys ---

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
no HKLM RunOnceEx keys found


--- HKLM\RunServices regkeys ---

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
no HKLM RunServices keys found


--- HKLM\RunServicesOnce regkeys ---

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce
regkey does not exist


--- HKCU\Run regkeys ---

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"drvsyskit"="C:\\Dokumente und Einstellungen\\Diehlmann\\Anwendungsdaten\\hidires\\hidr.exe"
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"NetLimiter 2 Client"="F:\\Programme\\Filesharing\\NetLimiter 2 Pro\\NLClient.exe"
"msnmsgr"="\"C:\\Programme\\MSN Messenger\\msnmsgr.exe\" /background"


--- HKCU\RunOnce regkeys ---

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
no HKCU RunOnce keys found


--- HKCU\RunOnceEx regkeys ---

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
regkey does not exist


--- HKCU\RunServices regkeys ---

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
no HKCU RunServices keys found


--- HKCU\RunServicesOnce regkeys ---

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce
regkey does not exist


--- HKU\.DEFAULT\Run regkeys ---

HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE"


--- HKU\S-1-5-18\Run regkeys ---

HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE"


--- HKU\S-1-5-19\Run regkeys ---

HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE"


--- HKU\S-1-5-20\Run regkeys ---

HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE"


--- HKLM\Explorer\Run regkeys ---

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
no HKLM Explorer\Run keys found


--- HKCU\Explorer\Run regkeys ---

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
no HKCU Explorer\Run keys found


--- Image File Execution regkeys ---

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
no debuggers found


--- BROWSER HELPER OBJECTS regkeys ---

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
"{055FD26D-3A88-4e15-963D-DC8493744B1D}" FILE ="E:\\Programme\\ICQToolbar\\toolbaru.dll"
"{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}" regkey not found (ERROR)
"{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}" FILE ="C:\\Programme\\Java\\jre1.5.0_11\\bin\\ssv.dll"
"{bd0e4d83-654e-4213-965b-fcbe887061f4}" FILE ="C:\\Programme\\Coolstreaming_Tool-Bar_v1.0\\tbCoo1.dll"
"{f015f320-ab08-11db-abbd-0800200c9a66}" FILE ="C:\\WINDOWS\\inetloader.dll"


--- TOOLBAR regkeys ---

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar
"{855F3B16-6D32-4fe6-8A56-BBB695989046}" FILE ="E:\\Programme\\ICQToolbar\\toolbaru.dll"
"{bd0e4d83-654e-4213-965b-fcbe887061f4}" FILE ="C:\\Programme\\Coolstreaming_Tool-Bar_v1.0\\tbCoo1.dll"


--- URLSEARCHHOOKS regkeys ---

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks
Default URLSearchHook is missing
"{855F3B16-6D32-4fe6-8A56-BBB695989046}"="" FILE ="E:\\Programme\\ICQToolbar\\toolbaru.dll"
"{bd0e4d83-654e-4213-965b-fcbe887061f4}"="" FILE ="C:\\Programme\\Coolstreaming_Tool-Bar_v1.0\\tbCoo1.dll"


--- CONTEXTMENUHANDLERS regkeys ---

HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers
"7-Zip" CLSID ={23170F69-40C1-278A-1000-000100020000} FILE ="F:\\Programme\\Anderes\\7-Zip\\7-zip.dll"
"Erasext" CLSID ={8BE13461-936F-11D1-A87D-444553540000} FILE ="C:\\WINDOWS\\system32\\erasext.dll"
"Hex-Wizard" CLSID ={8e3e0f0a-0fcc-11ce-bcb0-b3fd0e25381a} FILE NOT FOUND
"HexWorkshopContextMenu" CLSID ={7bc80fe0-4b41-11cf-8fba-444553540000} FILE ="f:\\programme\\crack-stuff\\crackpack 1.5\\hex workshop 3.1\\hwext.dll"
"ICQLiteMenu" CLSID ={73B24247-042E-4EF5-ADC2-42F62E6FD654} FILE NOT FOUND
"Offline Files" CLSID ={750fdf0e-2a26-11d1-a3ea-080036587f03} FILE =%SystemRoot%\System32\cscui.dll
"Open With" CLSID ={09799AFB-AD67-11d1-ABCD-00C04FC30936} FILE =%SystemRoot%\system32\SHELL32.dll
"Open With EncryptionMenu" CLSID ={A470F8CF-A1E8-4f65-8335-227475AA5C46} FILE =%SystemRoot%\system32\SHELL32.dll
"TraXExCM" CLSID ={7020EDF4-B454-4814-9AA4-1D604D3F1417} FILE ="C:\\Programme\\TraXEx\\Integration\\TraXExCM.dll"
"TuneUp Shredder Shell Extension" CLSID ={4858E7D9-8E12-45a3-B6A3-1CD128C9D403} FILE ="F:\\Programme\\system\\TuneUp Utilities 2007\\SDShelEx-win32.dll"
"WinRAR" CLSID ={B41DB860-8EE4-11D2-9906-E49FADC173CA} FILE ="F:\\Programme\\Anderes\\WinRAR\\rarext.dll"
"{a2a9545d-a0c2-42b4-9708-a0b2badd77c8}" Start Menu Pin FILE =%SystemRoot%\system32\SHELL32.dll

HKEY_CLASSES_ROOT\Directory\shellex\ContextMenuHandlers
"7-Zip" CLSID ={23170F69-40C1-278A-1000-000100020000} FILE ="F:\\Programme\\Anderes\\7-Zip\\7-zip.dll"
"EncryptionMenu" CLSID ={A470F8CF-A1E8-4f65-8335-227475AA5C46} FILE =%SystemRoot%\system32\SHELL32.dll
"ICQLiteMenu" CLSID ={73B24247-042E-4EF5-ADC2-42F62E6FD654} FILE NOT FOUND
"Offline Files" CLSID ={750fdf0e-2a26-11d1-a3ea-080036587f03} FILE =%SystemRoot%\System32\cscui.dll
"Sharing" CLSID ={f81e9010-6ea4-11ce-a7ff-00aa003ca9f6} FILE ="ntshrui.dll"
"TuneUp Shredder Shell Extension" CLSID ={4858E7D9-8E12-45a3-B6A3-1CD128C9D403} FILE ="F:\\Programme\\system\\TuneUp Utilities 2007\\SDShelEx-win32.dll"
"WinRAR" CLSID ={B41DB860-8EE4-11D2-9906-E49FADC173CA} FILE ="F:\\Programme\\Anderes\\WinRAR\\rarext.dll"

HKEY_CLASSES_ROOT\Folder\shellex\ContextMenuHandlers
"Erasext" CLSID ={8BE13461-936F-11D1-A87D-444553540000} FILE ="C:\\WINDOWS\\system32\\erasext.dll"
"TraXExCM" CLSID ={7020EDF4-B454-4814-9AA4-1D604D3F1417} FILE ="C:\\Programme\\TraXEx\\Integration\\TraXExCM.dll"
"WinRAR" CLSID ={B41DB860-8EE4-11D2-9906-E49FADC173CA} FILE ="F:\\Programme\\Anderes\\WinRAR\\rarext.dll"


--- SAFEBOOT MINIMAL SERVICES ---

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal
no unknown services found


--- SAFEBOOT NETWORK SERVICES ---

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network
no unknown services found


--- SERVICES ---

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Adobe LM Service
"DisplayName"="Adobe LM Service"
"C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ALCXWDM
"DisplayName"="Service for Realtek AC97 Audio (WDM)"
system32\drivers\ALCXWDM.SYS

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Aspi32
System32\drivers\aspi32.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ATI Smart
"DisplayName"="ATI Smart"
C:\WINDOWS\system32\ati2sgag.exe

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ati2mtag
system32\DRIVERS\ati2mtag.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ATIAVAIW
"DisplayName"="ATI T200 Unified AVStream service"
system32\DRIVERS\atinavt2.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Atierecord
no imagepath value found

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\atinevxx
"DisplayName"="ATI WDM Rage Theater Video NSP"
system32\DRIVERS\atinevxx.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AVG Anti-Rootkit
"DisplayName"="AVG Anti-Rootkit"
System32\DRIVERS\anti_rkt.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AVG Clean Driver
"DisplayName"="AVG Clean Driver"
System32\DRIVERS\cleanDrv.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bdfdll
"DisplayName"="bdfdll"
\??\E:\Programme\BitDefender10\bdfdll.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BDFSDRV
"DisplayName"="BDFSDRV"
\??\E:\Programme\BitDefender10\bdfsdrv.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BDRSDRV
"DisplayName"="BDRSDRV"
\??\E:\Programme\BitDefender10\bdrsdrv.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CCDECODE
"DisplayName"="Untertiteldecoder"
system32\DRIVERS\CCDECODE.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dot4
"DisplayName"="MS IEEE-1284.4-Treiber"
system32\DRIVERS\Dot4.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dot4Print
"DisplayName"="Druckerklassentreiber für IEEE-1284.4"
system32\DRIVERS\Dot4Prt.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dot4Scan
"DisplayName"="Scannerklassentreiber für IEEE-1284.4"
system32\DRIVERS\Dot4Scan.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gameenum
"DisplayName"="Gameport-Enumerator"
system32\DRIVERS\gameenum.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gmer
System32\DRIVERS\gmer.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\GQP
"DisplayName"="GQP"
C:\DOKUME~1\DIEHLM~1\LOKALE~1\Temp\GQP.exe

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gusvc
"DisplayName"="Google Updater Service"
"C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hamachi
"DisplayName"="Hamachi Network Interface"
system32\DRIVERS\hamachi.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HidUsb
"DisplayName"="Microsoft HID Class-Treiber"
system32\DRIVERS\hidusb.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\iPod Service
"DisplayName"="iPod Service"
"C:\Programme\iPod\bin\iPodService.exe"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\irsir
"DisplayName"="Microsoft serieller Infrarottreiber"
system32\DRIVERS\irsir.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kbdhid
"DisplayName"="Tastatur-HID-Treiber"
system32\DRIVERS\kbdhid.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\L
"DisplayName"="L"
C:\DOKUME~1\DIEHLM~1\LOKALE~1\Temp\L.exe

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mouhid
"DisplayName"="Maus-HID-Treiber"
system32\DRIVERS\mouhid.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MPE
"DisplayName"="BDA MPE-Filter"
system32\DRIVERS\MPE.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSTEE
"DisplayName"="Microsoft Streaming Tee/Sink-to-Sink-Konvertierung"
system32\drivers\MSTEE.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ms_mpu401
"DisplayName"="Microsoft MPU-401 MIDI UART-Treiber"
system32\drivers\msmpu401.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MTsensor
"DisplayName"="ATK0110 ACPI UTILITY"
system32\DRIVERS\ASACPI.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MVDCODEC
"DisplayName"="ATI WDM Specialized MVD Codec"
system32\DRIVERS\atinmdxx.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\m_hook
"DisplayName"="Empty"
\??\C:\Dokumente und Einstellungen\Diehlmann\Anwendungsdaten\hidires\m_hook.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NABTSFEC
"DisplayName"="NABTS/FEC VBI-Codec"
system32\DRIVERS\NABTSFEC.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nlsvc
"DisplayName"="NetLimiter"
"F:\Programme\Filesharing\NetLimiter 2 Pro\nlsvc.exe"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nltdi
"DisplayName"="nltdi"
\??\C:\WINDOWS\system32\drivers\nltdi.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NwlnkIpx
"DisplayName"="NWLink IPX/SPX/NetBIOS-kompatibles Transportprotokoll"
system32\DRIVERS\nwlnkipx.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NwlnkNb
"DisplayName"="NWLink-NetBIOS"
system32\DRIVERS\nwlnknb.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NwlnkSpx
"DisplayName"="NWLink SPX/SPXII-Protokoll"
system32\DRIVERS\nwlnkspx.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\prodrv04
"DisplayName"="Star Force copy protection driver v4"
\SystemRoot\System32\drivers\prodrv04.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PxHelp20
"DisplayName"="PxHelp20"
System32\Drivers\PxHelp20.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\serenum
"DisplayName"="Serenum-Filtertreiber"
system32\DRIVERS\serenum.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SLIP
"DisplayName"="BDA Slip De-Framer"
system32\DRIVERS\SLIP.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd
System32\Drivers\sptd.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\streamip
"DisplayName"="BDA-IPSink"
system32\DRIVERS\StreamIP.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SymEvent
\??\C:\Programme\Symantec\SYMEVENT.SYS

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\usbccgp
"DisplayName"="Microsoft Standard-USB-Haupttreiber"
system32\DRIVERS\usbccgp.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\usbohci
"DisplayName"="Miniporttreiber für Microsoft USB Open Host-Controller"
system32\DRIVERS\usbohci.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\usnjsvc
"DisplayName"="Messenger USN Journal Reader-Service für freigegebene Ordner"
"C:\Programme\MSN Messenger\usnsvc.exe"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UxTuneUp
"DisplayName"="TuneUp Design Expansion"
%SystemRoot%\System32\svchost.exe -k netsvcs

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vmm
"DisplayName"="Virtual Machine Monitor"
\??\C:\WINDOWS\system32\Drivers\vmm.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VPCNetS2
"DisplayName"="Virtual Machine Network Services Driver"
system32\DRIVERS\VMNetSrv.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vsdatant
"DisplayName"="vsdatant"
\??\C:\WINDOWS\system32\vsdatant.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WO
"DisplayName"="WO"
C:\DOKUME~1\DIEHLM~1\LOKALE~1\Temp\WO.exe

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WSTCODEC
"DisplayName"="World Standard Teletext-Codec"
system32\DRIVERS\WSTCODEC.SYS

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\{153E79AE-BB60-4F01-8B00-0D39C3906475}
no imagepath value found

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\{180695F1-37ED-492E-8EC6-CE74C6ADB47F}
no imagepath value found

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\{51BEBAE2-48BD-4542-ACC9-4A51C879F3B9}
no imagepath value found

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\{7E5DE3F3-5C81-4C63-84D5-DCC7252A3E0A}
no imagepath value found

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\{F9E1437B-73D1-4C62-804F-1DF5561797AF}
no imagepath value found


--- SECURITYPROVIDERS regkey ---

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"


--- SVCHOST regkey ---

HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost
HTTPFilter: HTTPFilter\0\0
LocalService: Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService: DnsCache\0\0
netsvcs: 6to4\0AudioSrv\0Browser\0CryptSvc\0DMServer\0DHCP\0ERSvc\0EventSystem\0FastUserSwitchingCompatibility\0HidServ\0Ias\0Iprip\0Irmon\0LanmanServer\0LanmanWorkstation\0Messenger\0Netman\0Nla\0Ntmssvc\0NWCWorkstation\0Nwsapagent\0Rasauto\0Rasman\0Remoteaccess\0Schedule\0Seclogon\0SENS\0Sharedaccess\0SRService\0Tapisrv\0Themes\0TrkWks\0UxTuneUp\0W32Time\0WZCSVC\0Wmi\0WmdmPmSp\0winmgmt\0wscsvc\0xmlprov\0BITS\0wuauserv\0ShellHWDetection\0helpsvc\0WmdmPmSN\0\0
DcomLaunch: DcomLaunch\0TermService\0\0
rpcss: RpcSs\0\0
imgsvc: StiSvc\0\0
termsvcs: TermService\0\0


--- WOW-CMDLINE regkeys ---

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WOW
"cmdline" = %SystemRoot%\system32\ntvdm.exe
"wowcmdline" = %SystemRoot%\system32\ntvdm.exe -a %SystemRoot%\system32\krnl386


--- STARTUP FOLDERS ---



--- TASK SCHEDULER JOBS ---

C:\WINDOWS\tasks\1-Click Maintenance.job
C:\WINDOWS\tasks\AppleSoftwareUpdate.job


--- File associations ---

.BAT files: ("%1" %*)
.COM files: ("%1" %*)
.EXE files: ("%1" %*)
.HLP files: (%SystemRoot%\System32\winhlp32.exe %1)
.INF files: (%SystemRoot%\System32\NOTEPAD.EXE %1)
.INI files: (%SystemRoot%\System32\NOTEPAD.EXE %1)
.JS files: (%SystemRoot%\System32\WScript.exe "%1" %*)
.PIF files: ("%1" %*)
.REG files: (regedit.exe "%1")
.SCR files: ("%1" /S)
.TXT files: (%SystemRoot%\system32\NOTEPAD.EXE %1)
.VBS files: (%SystemRoot%\System32\WScript.exe "%1" %*)


FINISHED

anderen logs folgen...

#34 Teste bitte diese Datei bei VT
C:\DOKUME~1\DIEHLM~1\LOKALE~1\Temp\4s9ua7x0.exe
__________
MfG Argus

#35 Den folgenden Text in den Editor (Start - Zubehör - Editor) kopieren und als fix.reg mit 'Speichern unter' auf dem Desktop.
Gebe bei Dateityp 'Alle Dateien' an.
Du solltest jetzt auf dem Desktop diese Datei finden.

Code:

Zitat

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"drvsyskit"=-

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser
Helper Objects\{f015f320-ab08-11db-abbd-0800200c9a66}

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f015f320-ab08-11db-abbd-0800200c9a66}]

Computer in den abgesicherten Modus neustarten (F8 beim Starten drücken). Die Datei "fix.reg" auf dem Desktop doppelklicken und der Registry beifuegen
__________
MfG Argus

#36 hallo leute,

ich hab das gleichr problem nur liegt es bei mir an norton inet security(war schon drauf als ich PC gekauft habe) ich wollte kaspersky installiern und bei der ilöschung kam ne nachricht hab ok geklickt ging 1 sek kam wieder. hab schon mit tuneup probiert ging nicht.wer weiss hilfe???

mfg, HardcoreHölzi

#37 Dein Rechner war auch infiziert?
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2005033108162039?Open&tpre=nl?Open&docid=20050411155130924&nsf=SUPPORT%5CINTER%5Ctsgeninfointl.nsf&view=172d11361b05da508525695b005ca287
__________
MfG Argus

#38 wenn ich den agbgesicherten Modus starten will, bekomme ich einen bluescreen...

#39 Hi,

@Karlheinzon
ja, der Beagle verhindert das Booten im abgesicherten Modus,
und hier steckt der Rest von Ihm:

drvsyskit"="C:\\Dokumente und Einstellungen\\Diehlmann\\Anwendungsdaten\\hidires\\hidr.exe

Das ist der Hook von Beagle:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\m_hook
"DisplayName"="Empty"
\??\C:\Dokumente und Einstellungen\Diehlmann\Anwendungsdaten\hidires\m_hook.sys

Das hier prüfen (virustotal):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\L
"DisplayName"="L"
C:\DOKUME~1\DIEHLM~1\LOKALE~1\Temp\L.exe

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WO
"DisplayName"="WO"
C:\DOKUME~1\DIEHLM~1\LOKALE~1\Temp\WO.exe

Es besteht die Möglichkeit Windows endgültig lahm zu legen, da
eingetragene Services "gekillt" werden müssen, OK?

zuerst

Avenger:
Input script manually (anhaken)
kopiere in: View/edit script

Zitat

drivers to unload:
m_hook

registry keys to delete:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_M_HOOK
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_M_HOOK
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Enum\Root\LEGACY_M_HOOK
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_M_HOOK
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\m_hook
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\m_hook
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\m_hook
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\m_hook


Files to delete:
C:\Dokumente und Einstellungen\Diehlmann\Anwendungsdaten\hidires\hidr.exe
C:\Dokumente und Einstellungen\Diehlmann\Anwendungsdaten\hidires\m_hook.sys

Viel Glück,
Chris

#40 die Dateien die ich mit virustotal prüfen sollte findet er nicht.
Ist es das risoko wert den versuchen endgültig runterzuschmeißen, oder sollte ich lieber neu formatieren udn windows neu aufspielen?

#41 Hi,

wenn Du formatieren kannst, dann führe den Versuch durch. Falls er schief geht, endet es eh in der Neuinstallation, falls er erfolgreich ist, ist auch der Beagle weg. Dann probieren ob der abgesicherte Modus wieder geht...

Chris

#42 Versuch war erfolgreich.
Konnte danach wieder ein antivirenprogramm installieren, das auf Anhieb etliche varianten der beagle wurms gefunden und (hoffentlich) auch alle runtergeschmissen hat!
Danke für eure Hilfe