Trojaner Spy Agent

#1 Hab einen lästigen Trojaner auf meinem Rechner. Hier der Log:

Logfile of HijackThis v1.99.1
Scan saved at 17:32:39, on 21.05.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Analog Devices\SoundMAX\DrvLsnr.exe
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
C:\Programme\AVPersonal\AVGNT.EXE
C:\Programme\PestPatrol\PPMemCheck.exe
C:\Programme\CyberLink\PowerDVD\PDVDServ.exe
C:\Programme\D-Tools\daemon.exe
C:\Programme\McAfee.com\VSO\mcvsshld.exe
C:\PROGRA~1\mcafee.com\vso\mcvsescn.exe
C:\Programme\McAfee.com\VSO\oasclnt.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programme\AVPersonal\AVGUARD.EXE
C:\Programme\AVPersonal\AVWUPSRV.EXE
c:\programme\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\MSN Messenger\MsnMsgr.Exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Programme\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Programme\Messenger\msmsgs.exe
C:\Programme\Internet Explorer\iexplore.exe
c:\programme\mcafee.com\shared\mcinfo.exe
C:\Programme\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\Dokumente und Einstellungen\Bachleitner\Desktop\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O2 - BHO: IE DOM Explorer - {CC7E636D-39AA-49b6-B511-65413DA137A1} - C:\Programme\Internet Explorer Developer Toolbar\IEDevToolbar.dll
O3 - Toolbar: Developer Toolbar - {CC962137-2E78-4f94-975E-FC0C07DBD78F} - C:\Programme\Internet Explorer Developer Toolbar\IEDevToolbar.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll
O3 - Toolbar: Protection Bar - {0D045BAA-4BD3-4C94-BE8B-21536BD6BD9F} - C:\Programme\Video ActiveX Object\iesplugin.dll (file missing)
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [DrvLsnr] C:\Programme\Analog Devices\SoundMAX\DrvLsnr.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb0 4.exe
O4 - HKLM\..\Run: [AVGCtrl] C:\Programme\AVPersonal\AVGNT.EXE /min
O4 - HKLM\..\Run: [PPMemCheck] C:\Programme\PestPatrol\PPMemCheck.exe
O4 - HKLM\..\Run: [CookiePatrol] C:\Programme\PestPatrol\CookiePatrol.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SemanticInsight] C:\Programme\RXToolBar\Semantic Insight\SemanticInsight.exe
O4 - HKLM\..\Run: [RemoteControl] C:\Programme\CyberLink\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programme\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] C:\Programme\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [OASClnt] C:\Programme\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Registry Cleaner] "C:\Programme\TPT Registry_Cleaner (Trial)\regclean.exe"
O4 - HKCU\..\Run: [Spyware Cleaner] "C:\Programme\Spyware Cleaner\SpywareCleaner.Exe" /boot
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programme\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [updateMgr] "C:\Programme\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Programme\ICQToolbar\toolbaru.dll/SEARCH.HTML
O8 - Extra context menu item: &Search - http://kp.bar.need2find.com/KP/menusearch.html?p=KP
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programme\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programme\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) - https://signup.msn.com/pages/MsnInstC.cab
O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540000} - http://www.spywarestormer.com/files2/Install.cab
O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} - http://sib1.od2.com/common/Member/ClientInstall/10.20.0002/OCI/setup.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1120470629133
O16 - DPF: {B64F4A7C-97C9-11DA-8BDE-F66BAD1E3F3A} - http://de.errorsafe.com/pages/scanner_de/ErrorSafeScannerInstallDE.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{759698FC-51CC-47CD-B2BC-99C84F7CCEE4}: NameServer = 213.174.248.1 193.80.248.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{B560F438-AD95-4B0E-8040-C83B64B747A1}: NameServer = 213.174.248.1
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs:
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Programme\AVPersonal\AVGUARD.EXE
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod-Dienst (iPod Service) - Unknown owner - C:\Programme\iPod\bin\iPodService.exe (file missing)
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\programme\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programme\Analog Devices\SoundMAX\SMAgent.exe

Wie kann ich ihn beseitigen? Hab zwar McAfee VirusScan laufen, aber der kann ihn nicht löschen. Brauche dringend Hilfe!

#2 Etwas mehr infos waeren Hilfreich! Wo findet Mcafee diesen Trojaner? Arbeite bitte dsie Punkte 1-3 von http://board.protecus.de/t23188.htm ab.
__________
MfG Ralf
SEO-Spam Hunter

#3 Okay, hab damit nicht viel am Hut, aber hoff das hilft. Hab die Schritte wie folgt ausgeführt.

"Bachleitner" - 2007-05-21 18:39:52 Service Pack 2
ComboFix 07-05.21.6.V - Running from: "C:\Dokumente und Einstellungen\Bachleitner\Desktop\"


(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\system32\5_exception.nls
C:\WINDOWS\update7.exe
C:\DOKUME~1\BACHLE~1\ANWEND~1\Install.dat
C:\WINDOWS\system32\ipv6monr.dll
C:\WINDOWS\system32\ipv6mons.dll
C:\WINDOWS\2410.exe
C:\WINDOWS\system32\ksys.sys
C:\install.log
C:\WINDOWS\hosts
C:\WINDOWS\update.exe
C:\Programme\video activex object
~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~
Folders Quarantined:
C:\qoobox\purity\C\DOKUME~1
C:\qoobox\purity\C\DOKUME~1\BACHLE~1
C:\qoobox\purity\C\DOKUME~1\BACHLE~1\ANWEND~1
C:\qoobox\purity\C\DOKUME~1\BACHLE~1\EIGENE~1
C:\qoobox\purity\C\DOKUME~1\BACHLE~1\ANWEND~1\ECURIT~1
C:\qoobox\purity\C\DOKUME~1\BACHLE~1\ANWEND~1\RACLE~1
C:\qoobox\purity\C\DOKUME~1\BACHLE~1\ANWEND~1\RACLE~2
C:\qoobox\purity\C\DOKUME~1\BACHLE~1\ANWEND~1\SCURIT~1
C:\qoobox\purity\C\DOKUME~1\BACHLE~1\EIGENE~1\PPPATC~1
C:\qoobox\purity\C\DOKUME~1\BACHLE~1\EIGENE~1\SSEMBL~1
C:\qoobox\purity\C\Programme\CROSOF~1.NET
C:\qoobox\purity\C\Programme\MANTEC~1
C:\qoobox\purity\C\Programme\RACLE~1
C:\qoobox\purity\C\Programme\SEMBLY~1
C:\qoobox\purity\C\Programme\SMBOLS~1
C:\qoobox\purity\C\Programme\SSEMBL~1
C:\qoobox\purity\C\Programme\WNSXS~1
C:\qoobox\purity\C\Programme\YSTEM3~1
C:\qoobox\purity\C\WINDOWS\DOBE~1
C:\qoobox\purity\C\WINDOWS\PPPATC~1
C:\qoobox\purity\C\WINDOWS\RACLE~1
C:\qoobox\purity\C\WINDOWS\SEMBLY~1
C:\qoobox\purity\C\WINDOWS\SMANTE~1
C:\qoobox\purity\C\WINDOWS\STEM32~1
C:\qoobox\purity\C\WINDOWS\system32\CURITY~1
C:\qoobox\purity\C\WINDOWS\system32\ECURIT~1
C:\qoobox\purity\C\WINDOWS\system32\FNTS~1
C:\qoobox\purity\C\WINDOWS\system32\MANTEC~1
C:\qoobox\purity\C\WINDOWS\system32\MBOLS~1
C:\qoobox\purity\C\WINDOWS\system32\PPATCH~1
C:\qoobox\purity\C\WINDOWS\system32\STEM~1
C:\qoobox\purity\C\WINDOWS\system32\WNSXS~1
C:\qoobox\purity\C\WINDOWS\system32\YMBOLS~1


((((((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


-------\LEGACY_EXAMPLE
-------\LEGACY_NDNET1
-------\LEGACY_RUNTIME
-------\LEGACY_RUNTIME2
-------\EXAMPLE
-------\NDnet1
-------\Runtime


((((((((((((((((((((((((((((((( Files Created from 2007-04-05 to 2007-05-21 ))))))))))))))))))))))))))))))))))


2007-05-21 12:52 114,464 --a------ C:\WINDOWS\system32\drivers\naiavf5x.sys
2007-05-21 10:31 <DIR> d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\Spybot - Search & Destroy
2007-05-21 08:08 <DIR> d-------- C:\Programme\McAfee
2007-05-21 08:08 <DIR> d-------- C:\DOKUME~1\BACHLE~1\ANWEND~1\McAfee
2007-05-21 08:07 349,760 --a------ C:\WINDOWS\system32\mcinsctl.dll
2007-05-21 08:07 288,320 --a------ C:\WINDOWS\system32\mcgdmgr.dll
2007-05-21 08:07 <DIR> d-------- C:\Programme\McAfee.com
2007-05-21 08:07 <DIR> d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\McAfee.com
2007-05-20 23:18 77,312 --a------ C:\WINDOWS\ua2.dll
2007-05-20 23:10 <DIR> d-------- C:\Programme\Apple Software Update
2007-05-11 12:35 75,776 --a------ C:\WINDOWS\installer.exe
2007-05-10 09:44 <DIR> d--hs---- C:\found.004
2007-04-22 00:35 <DIR> d-------- C:\DOKUME~1\BACHLE~1\ANWEND~1\TVU Networks


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-05-21 09:12:00 -------- d-----w C:\Programme\CasinoOnNet
2007-05-21 08:22:00 335 ----a-w C:\WINDOWS\nsreg.dat
2007-05-20 12:34:02 -------- d-----w C:\Programme\Google
2007-05-20 06:42:40 -------- d-----w C:\Programme\GIMP-2.0
2007-05-15 09:32:27 507,904 ----a-w C:\WINDOWS\system32\winlogon.exe
2007-05-15 09:32:26 82,944 ----a-w C:\WINDOWS\system32\ws2_32.dll
2007-04-28 05:13:03 -------- d-----w C:\Programme\DOSBox-0.65
2007-04-25 07:55:03 -------- d-----w C:\DOKUME~1\BACHLE~1\ANWEND~1\Google
2007-04-16 20:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll
2007-04-16 20:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll
2007-04-16 20:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
2007-04-16 20:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
2007-04-16 20:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll
2007-04-16 20:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
2007-04-16 20:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
2007-04-16 20:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll
2007-04-07 05:59:36 64,796 ----a-w C:\WINDOWS\system32\perfc007.dat
2007-04-07 05:59:36 394,830 ----a-w C:\WINDOWS\system32\perfh007.dat
2007-03-26 16:28:59 -------- d-----w C:\DOKUME~1\BACHLE~1\ANWEND~1\Leadertech
2007-03-26 16:09:46 -------- d-----w C:\Programme\Any Video Converter
2007-03-22 19:05:35 1,480 ----a-w C:\WINDOWS\AUTOLNCH.REG
2007-03-20 17:54:53 -------- d-----w C:\Programme\AVPersonal
2007-03-20 08:11:23 552 ----a-w C:\WINDOWS\system32\d3d8caps.dat
2007-03-17 13:44:25 293,376 ----a-w C:\WINDOWS\system32\winsrv.dll
2007-03-10 14:09:58 2 ----a-w C:\WINDOWS\system32\wcpsvtr.exe
2007-03-08 15:36:30 579,072 ----a-w C:\WINDOWS\system32\user32.dll
2007-03-08 15:36:30 40,960 ----a-w C:\WINDOWS\system32\mf3216.dll
2007-03-08 15:36:30 281,600 ----a-w C:\WINDOWS\system32\gdi32.dll
2007-03-08 15:32:24 1,843,712 ----a-w C:\WINDOWS\system32\win32k.sys
2007-02-05 20:18:44 185,856 ----a-w C:\WINDOWS\system32\upnphost.dll


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2006-01-12 21:38]
{CC7E636D-39AA-49b6-B511-65413DA137A1}=C:\Programme\Internet Explorer Developer Toolbar\IEDevToolbar.dll [2005-12-20 12:51]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DrvLsnr"="C:\Programme\Analog Devices\SoundMAX\DrvLsnr.exe" [2003-05-08 11:34]
"TkBellExe"="C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" [2005-06-19 12:44]
"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe" [2003-01-30 18:49]
"AVGCtrl"="C:\Programme\AVPersonal\AVGNT.exe" [2005-06-07 11:34]
"PPMemCheck"="C:\Programme\PestPatrol\PPMemCheck.exe" [2004-03-11 08:11]
"CookiePatrol"="C:\Programme\PestPatrol\CookiePatrol.exe" [2004-03-11 08:11]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2004-08-02 21:03]
"nwiz"="nwiz.exe" [2004-08-02 21:03 C:\WINDOWS\system32\nwiz.exe]
"RegistryMechanic"="" []
"SemanticInsight"="C:\Programme\RXToolBar\Semantic Insight\SemanticInsight.exe" []
"RemoteControl"="C:\Programme\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 19:42]
"DAEMON Tools-1033"="C:\Programme\D-Tools\daemon.exe" [2003-12-27 20:43]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50]
"VSOCheckTask"="C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" [2005-07-08 18:18]
"VirusScan Online"="C:\Programme\McAfee.com\VSO\mcvsshld.exe" [2005-08-10 12:49]
"MCAgentExe"="c:\PROGRA~1\mcafee.com\agent\mcagent.exe" [2005-09-22 18:29]
"MCUpdateExe"="c:\PROGRA~1\mcafee.com\agent\McUpdate.exe" [2006-01-11 12:05]
"OASClnt"="C:\Programme\McAfee.com\VSO\oasclnt.exe" [2005-08-11 22:02]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:57]
"Registry Cleaner"="C:\Programme\TPT Registry_Cleaner (Trial)\regclean.exe" []
"Spyware Cleaner"="C:\Programme\Spyware Cleaner\SpywareCleaner.exe" []
"MsnMsgr"="C:\Programme\MSN Messenger\MsnMsgr.exe" [2006-01-25 06:23]
"updateMgr"="C:\Programme\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2005-10-24 16:53]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=

*Newly Created Service* -RUNTIME
*Newly Created Service* -RUNTIME2

Contents of the 'Scheduled Tasks' folder
2007-05-20 21:10:41 C:\WINDOWS\tasks\AppleSoftwareUpdate.job

********************************************************************

catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-05-21 18:51:39
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

? [3804]


scanning hidden autostart entries ...

scanning hidden files ...

C:\WINDOWS\system32\drivers\runtime2.sys 40960 bytes

scan completed successfully
hidden files: 1


********************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\runtime2]
"ImagePath"="\SystemRoot\system32\drivers\runtime2.sys"

Completion time: 2007-05-21 18:57:31 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-05-21 18:57

--- E O F ---

#4 Jo, total verseucht der Rechner! Du solltest dir ueberlegen, ob du den PC nicht neu aufsetzen willst. Wenn nicht, erstelle ein neues Combofix Log, ein sdfixreport(abgesicherter Modus) http://virus-protect.org/artikel/tools/sdfix.html sowie Kontrollscans mit Drweb cureit und ewido Micro.

Drweb cureit wird einige Mcafee Dateien als moeglicherweise infiziert melden. Diese Dateien bitte nicht loeschen!

http://virus-protect.org/cureit.html
Aber bitte den Download von hier nutzen http://freedrweb.com/?lng=de

Ewido micro: http://downloads.ewido.net/ewido_micro.exe
__________
MfG Ralf
SEO-Spam Hunter

#5 Ich hab gerade durchgescannt und es sind wirklich zu viele. Dann ist wohl Option 1 besser. Danke trotzdem.