trojan-downloader & Spyware/Adware - Brauche Rat

#1 Hallo liebe Forengemeinde,

nachdem ich vor einigen Wochen Probleme mit Spyware und Trojanern hatte
befürchte ich meinen Rechner immer noch nicht komplett sauber bekommen zu haben. Es gibt keine direkten Anzeichen dafür, bis auf das meine Internetverbindung manchmal komplett tot ist (bis zu 5 mal am Tag). Außerdem sind sehr viele Prozesse bei mir am laufen:



Ich hoffe ihr könnt mir weiterhelfen



Mein hijacklog:



Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\CTHELPER.EXE
C:\Programme\QuickTime\qttask.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Programme\Winamp\winampa.exe
C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\devldr32.exe
C:\Programme\Last.fm\LastFMHelper.exe
c:\programme\a-squared free\a2service.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\ATKKBService.exe
C:\Programme\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Programme\avmwlanstick\WlanNetService.exe
C:\WINDOWS\SYSTEM32\GEARSEC.EXE
C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\Programme\Last.fm\LastFM.exe
C:\Programme\Lavasoft\Ad-Aware 2007\LSUpdateManager.exe
C:\Programme\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Programme\internet explorer\iexplore.exe
C:\WINDOWS\system32\notepad.exe
C:\Programme\Hijack This\HJT1991.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http***/www.google.de/
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar1.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] C:\Programme\Creative-Soundtreiber\SBLive\PROGRAM\ADGJDet.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [DevconDefaultDB] C:\WINDOWS\READREG /PSCONV={NO} /NO_DEFPS
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [WinampAgent] C:\Programme\Winamp\winampa.exe
O4 - HKCU\..\Run: [swg] C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe
O4 - Startup: Last.fm Helper.lnk = C:\Programme\Last.fm\LastFMHelper.exe
O4 - Global Startup: aBackup.lnk = C:\Programme\MODular SOftware\aBackup\aBackup.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Google AdSense Preview-Tool - http***/pagead2.googlesyndication.com/pagead/preview/de/preview.html
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res***/C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQ\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQ\ICQLite.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http***/www.kaspersky.com/kos/german/partner/de/kavwebscan_unicode.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} - http***/security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - http***/download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http***/update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1170499116562
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} - http***/security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http***/download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} - http***/www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{6729461A-777F-4EDB-A815-566CCF948D5B}: NameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{985C07DA-2137-4934-86C8-0269A0B93F16}: NameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{BEFE0502-D1C4-4C99-BFDA-4D3972B14161}: NameServer = 192.168.2.1
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - c:\programme\a-squared free\a2service.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Programme\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AdobeVersionCue - Adobe Sytems - C:\Programme\Adobe\Adobe Version Cue\service\VersionCue.exe
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Programme\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVM WLAN Connection Service - AVM Berlin - C:\Programme\avmwlanstick\WlanNetService.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\MAGIX\Common\Database\bin\fbserver.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\SYSTEM32\GEARSEC.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe








Escan hat folgendes gefunden:


Tue Jan 22 09:24:51 2008 => ***** Adware/Spyware - Scan der Registrierung und des Dateisystems *****
Tue Jan 22 09:24:51 2008 => Loading Spyware Signatures from new External Database [Name: C:\DOKUME~1\Besitzer\LOKALE~1\Temp\spydb.avs, Size: 336049].
Tue Jan 22 09:24:54 2008 => Indexed Spyware Databases Successfully Created...

Tue Jan 22 09:24:55 2008 => Key found with NULL Character: HKLM\Software\Microsoft\Windows\CurrentVersion\System !!!
Tue Jan 22 09:25:02 2008 => Object "NULLBYTE Spyware/Adware" in Dateisystem gefunden! Folgende Maßnahme wurde durchgeführt: Keine Aktion vorgenommen.

Tue Jan 22 09:25:03 2008 => Offending file found: C:\WINDOWS\system32\swreg.exe
Tue Jan 22 09:25:03 2008 => System found infected with trojan-downloader.bat.ftp.ab Trojan-Downloader (swreg.exe)! Action taken: Keine Aktion vorgenommen.

Tue Jan 22 09:25:03 2008 => Offending file found: C:\WINDOWS\system32\swsc.exe
Tue Jan 22 09:25:03 2008 => System found infected with trojan-downloader.bat.ftp.ab Trojan-Downloader (swsc.exe)! Action taken: Keine Aktion vorgenommen.

Tue Jan 22 09:25:06 2008 => Offending file found: C:\Dokumente und Einstellungen\Besitzer\Desktop\notepad2.exe
Tue Jan 22 09:25:06 2008 => System found infected with popuper Spyware/Adware (notepad2.exe)! Action taken: Keine Aktion vorgenommen.

Tue Jan 22 09:25:06 2008 => Offending file found: C:\Dokumente und Einstellungen\Besitzer\Favoriten\linkpopularität\potentielle linkauschpartner\internet.url
Tue Jan 22 09:25:06 2008 => System found infected with ezula Spyware/Adware (internet.url)! Action taken: Keine Aktion vorgenommen.

Tue Jan 22 09:25:38 2008 => Offending file found: C:\WINDOWS\icons
Tue Jan 22 09:25:38 2008 => System found infected with holistyc Dialer (C:\WINDOWS\icons)! Action taken: Keine Aktion vorgenommen.

Tue Jan 22 09:25:39 2008 => Checking MountPoints2 Registry Key...
Tue Jan 22 09:25:39 2008 => Invalid Command Found in {59779fe6-749f-11dc-9ec4-bb7b91d45360}\Shell\AutoRun\command: G:\pushinst.exe
Tue Jan 22 09:25:39 2008 => Offending Key found: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{59779fe6-749f-11dc-9ec4-bb7b91d45360} !!!
Tue Jan 22 09:25:39 2008 => Object "Possible Fujacks-type Worm" in Dateisystem gefunden! Folgende Maßnahme wurde durchgeführt: Keine Aktion vorgenommen.

Tue Jan 22 09:25:39 2008 => Invalid Command Found in {d7fd8089-7123-11dc-9ebd-e06e0e685df5}\Shell\AutoRun\command: G:\pushinst.exe
Tue Jan 22 09:25:39 2008 => Offending Key found: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d7fd8089-7123-11dc-9ebd-e06e0e685df5} !!!
Tue Jan 22 09:25:39 2008 => Object "Possible Fujacks-type Worm" in Dateisystem gefunden! Folgende Maßnahme wurde durchgeführt: Keine Aktion vorgenommen.
__________
http://www.webseitenoptimierung-seo.de

#2 lirumlarum

««
wende CCleaner an
http://www.virus-protect.org/ccleaner.html

««
poste bitte das log von combofix
http://www.virus-protect.org/artikel/tools/combofix.html
__________
Gruss
Pinguin

bin dabei, meine Seite + Proggies zu aktualisieren: http://www.virus-protect.org/

#3 Hallo,

danke für deine Antwort. Combofix hat kein Log in C:\ oder auf dem DEsktop erstellt. Nur in dem Ordner C:\Combofix war eine Combofix.txt mit folgendem Inhalt zu finden:

ComboFix 08-01-21.6 - Besitzer 2008-01-22 16:05:20.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1031.18.1695 [GMT 1:00]
ausgeführt von:: C:\Dokumente und Einstellungen\Besitzer\Desktop\ComboFix.exe

[color=red]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/color]

Anschließend habe ich es mit FixPolicies.exe probiert. Leider kein Ergebnis. Danach mit Comboscan. Nachdem scann hat sich allerdings nur eine main.txt geöffnet. Hier der Inhalt:

Deckard's System Scanner v20071014.68
Run by Besitzer on 2008-01-22 16:20:48
Computer is in Normal Mode.
--------------------------------------------------------------------------------

[color=red]System Drive C: has 4.16 GiB (less than 15%) free.[/color]


-- HijackThis (run as Besitzer.exe) --------------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 16:20, on 2008-01-22
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\CTHELPER.EXE
C:\Programme\QuickTime\qttask.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Programme\Winamp\winampa.exe
C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Last.fm\LastFMHelper.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\devldr32.exe
c:\programme\a-squared free\a2service.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\ATKKBService.exe
C:\Programme\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Programme\avmwlanstick\WlanNetService.exe
C:\WINDOWS\SYSTEM32\GEARSEC.EXE
C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Dokumente und Einstellungen\Besitzer\Desktop\dss.exe
C:\PROGRA~1\HIJACK~1\Besitzer.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http**/www.google.de/
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar1.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] C:\Programme\Creative-Soundtreiber\SBLive\PROGRAM\ADGJDet.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [DevconDefaultDB] C:\WINDOWS\READREG /PSCONV={NO} /NO_DEFPS
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [WinampAgent] C:\Programme\Winamp\winampa.exe
O4 - HKCU\..\Run: [swg] C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe
O4 - Startup: Last.fm Helper.lnk = C:\Programme\Last.fm\LastFMHelper.exe
O4 - Global Startup: aBackup.lnk = C:\Programme\MODular SOftware\aBackup\aBackup.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Google AdSense Preview-Tool - http**/pagead2.googlesyndication.com/pagead/preview/de/preview.html
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res**/C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQ\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQ\ICQLite.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http**/www.kaspersky.com/kos/german/partner/de/kavwebscan_unicode.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} - http**/security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - http**/download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http**/update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1170499116562
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} - http**/security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http**/download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} - http**/www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{6729461A-777F-4EDB-A815-566CCF948D5B}: NameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{985C07DA-2137-4934-86C8-0269A0B93F16}: NameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{BEFE0502-D1C4-4C99-BFDA-4D3972B14161}: NameServer = 192.168.2.1
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - c:\programme\a-squared free\a2service.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Programme\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AdobeVersionCue - Adobe Sytems - C:\Programme\Adobe\Adobe Version Cue\service\VersionCue.exe
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Programme\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVM WLAN Connection Service - AVM Berlin - C:\Programme\avmwlanstick\WlanNetService.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\MAGIX\Common\Database\bin\fbserver.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\SYSTEM32\GEARSEC.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe


-- Files created between 2007-12-22 and 2008-01-22 -----------------------------

2008-01-22 15:48:21 0 d-------- C:\Programme\EF Process Manager
2008-01-22 14:49:34 0 dr-h----- C:\Dokumente und Einstellungen\Besitzer\Recent
2008-01-22 10:16:43 0 d-------- C:\Programme\CCleaner
2008-01-22 08:24:35 0 d-------- C:\Programme\Lavasoft
2008-01-18 12:28:23 0 d-------- C:\Programme\Last.fm
2008-01-10 08:04:48 0 d-------- C:\VundoFix Backups
2008-01-09 08:25:50 0 d-------- C:\Programme\Gemeinsame Dateien\G DATA
2008-01-09 08:25:48 53248 -----n--- C:\WINDOWS\system32\GEARSEC.EXE <Not Verified; GEAR Software; gearsec>
2008-01-07 23:15:09 0 d-------- C:\WINDOWS\ftpcache
2008-01-07 23:11:45 223128 --a------ C:\WINDOWS\system32\drivers\vaxscsi.sys
2008-01-07 23:11:44 0 d-------- C:\Programme\Alcohol Soft
2008-01-07 22:44:33 715248 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-01-04 20:34:29 0 d-------- C:\Programme\Hijack This
2008-01-02 11:36:18 0 d-------- C:\Programme\Gemeinsame Dateien\Java
2007-12-24 20:01:26 0 d-------- C:\Programme\Avira
2007-12-24 19:39:09 0 d-------- C:\Programme\Alwil Software
2007-12-24 16:37:52 0 d-------- C:\Dokumente und Einstellungen\Besitzer\temporary internet files
2007-12-24 15:40:07 0 d-a------ C:\WINDOWS\system32\systems.txt
2007-12-24 09:24:09 0 d-------- C:\WINDOWS\Content.IE5
2007-12-24 09:00:29 81920 --a------ C:\WINDOWS\system32\IEDFix.exe <Not Verified; S!Ri.URZ; IEDFix>
2007-12-22 19:39:19 0 d-------- C:\Programme\Power Tab Software


-- Find3M Report ---------------------------------------------------------------

2008-01-22 15:48:30 0 d-------- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\EFSoftware
2008-01-22 08:24:10 0 d-------- C:\Programme\Gemeinsame Dateien\Wise Installation Wizard
2008-01-22 08:21:56 0 d-------- C:\Programme\Ad-Aware
2008-01-22 08:21:55 0 d-------- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\Lavasoft
2008-01-21 22:51:18 0 d-------- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\Adobe
2008-01-21 07:13:01 0 d-------- C:\Programme\a-squared Free
2008-01-18 12:43:32 0 d-------- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\AdobeUM
2008-01-11 21:25:55 0 d--h----- C:\Programme\InstallShield Installation Information
2008-01-10 20:03:26 0 d-------- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\WordToPDF
2008-01-10 07:55:42 0 d-------- C:\Programme\Winamp
2008-01-09 08:25:50 0 d-------- C:\Programme\Gemeinsame Dateien
2008-01-07 22:53:20 0 d-------- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\DAEMON Tools
2008-01-07 15:18:10 416251 --a------ C:\Programme\AccessLog.ali
2008-01-06 11:31:11 0 d-------- C:\Programme\AccessLog
2008-01-02 11:38:10 0 d-------- C:\Programme\Java
2007-12-27 09:24:52 0 d-------- C:\Programme\DaViDeo 4 professional
2007-12-26 16:10:56 0 d-------- C:\Programme\FeedReader30
2007-12-24 19:22:41 0 d-------- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\Grisoft
2007-12-24 18:34:43 4212 ---h----- C:\WINDOWS\system32\zllictbl.dat
2007-12-24 09:03:05 2554 --a------ C:\WINDOWS\system32\tmp.reg
2007-12-23 19:03:33 0 d-------- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\SUPERAntiSpyware.com
2007-12-23 15:35:44 0 --ahs---- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\GDIPFONTCACHEV18787515caed7b4539d89efe00ba1e2bc.dat
2007-12-22 19:10:29 0 dr-h----- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\CrystalSpace
2007-12-21 06:25:03 0 d-------- C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\vlc
2007-12-04 14:32:58 0 d-------- C:\Programme\VideoLAN
2007-11-28 19:59:07 0 d-------- C:\Programme\No23 Recorder
2007-11-27 08:04:31 0 d-------- C:\Programme\DivX
2007-11-20 01:47:36 24576 --a------ C:\WINDOWS\system32\VundoFixSVC.exe <Not Verified; Atribune.org; Vundofix Service>
2007-10-29 19:18:59 405118 --a------ C:\WINDOWS\system32\perfh007.dat
2007-10-29 19:18:59 70580 --a------ C:\WINDOWS\system32\perfc007.dat


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2006-08-02 22:12 C:\WINDOWS\SOUNDMAN.EXE]
"WINDVDPatch"="CTHELPER.EXE" [2002-07-02 16:56 C:\WINDOWS\system32\CTHELPER.EXE]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 01:00]
"Jet Detection"="C:\Programme\Creative-Soundtreiber\SBLive\PROGRAM\ADGJDet.exe" [2001-11-29 00:00]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 12:22]
"nwiz"="nwiz.exe" [2006-10-22 12:22 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="NvMCTray.dll" [2006-10-22 12:22 C:\WINDOWS\system32\nvmctray.dll]
"Adobe Reader Speed Launcher"="C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 18:51]
"DevconDefaultDB"="C:\WINDOWS\READREG /PSCONV={NO} /NO_DEFPS" []
"QuickTime Task"="C:\Programme\QuickTime\qttask.exe" [2006-10-25 18:58]
"avgnt"="C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2007-12-24 20:03]
"WinampAgent"="C:\Programme\Winamp\winampa.exe" [2007-12-20 16:16]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-03-30 20:10]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-02-28 13:00]
"SetDefaultMIDI"="MIDIDef.exe" [2002-01-14 13:42 C:\WINDOWS\MIDIDEF.EXE]

C:\Dokumente und Einstellungen\Besitzer\Startmen�\Programme\Autostart\
Last.fm Helper.lnk - C:\Programme\Last.fm\LastFMHelper.exe [2008-01-18 12:28:23]

C:\Dokumente und Einstellungen\All Users\Startmen�\Programme\Autostart\
aBackup.lnk - C:\Programme\MODular SOftware\aBackup\aBackup.exe [2007-10-20 08:59:52]
Microsoft Office.lnk - C:\Programme\Microsoft Office\Office10\OSA.EXE [2001-02-13 00:01:04]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"MSMSGS"="C:\Programme\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"QuickTime Task"="C:\Programme\QuickTime\qttask.exe" -atboottime
"NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe
"nwiz"=nwiz.exe /install
"AdobeVersionCue"=C:\Programme\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
"dvd43"=C:\Programme\dvd43\dvd43_tray.exe
"ICQ Lite"=C:\Programme\ICQ\ICQLite.exe -minimize
"avast!"=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
"!AVG Anti-Spyware"="C:\Programme\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
"SunJavaUpdateSched"="C:\Programme\Java\jre1.6.0_03\bin\jusched.exe"

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{59779fe6-749f-11dc-9ec4-bb7b91d45360}]
AutoRun\command- G:\pushinst.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d7fd8089-7123-11dc-9ebd-e06e0e685df5}]
AutoRun\command- G:\pushinst.exe




-- End of Deckard's System Scanner: finished at 2008-01-22 16:21:09 ------------
__________
http://www.webseitenoptimierung-seo.de

#4 wende datfindbat an - poste alle logs, ca. 3 monate von jedem
http://virus-protect.org/datfindbat.html

wende renv an « poste das log (nix weiter machen, nur das log<
http://virus-protect.org/artikel/tools/renvexe.html
__________
Gruss
Pinguin

bin dabei, meine Seite + Proggies zu aktualisieren: http://www.virus-protect.org/

#5 Hallo,

hier die gewünschten Logdateien:


Verzeichnis von C:\WINDOWS\system32

2008-01-22 16:12 88,566 nvapps.xml
2008-01-22 08:29 12,632 lsdelete.exe
2008-01-22 06:15 13,646 wpa.dbl
2008-01-09 08:16 53,248 GEARSEC.EXE
2008-01-09 08:16 78,896 GEARASPI.DLL
2008-01-04 18:19 2,953 CONFIG.NT
2008-01-02 11:38 5,686 jupdate-1.6.0_03-b05.log
2007-12-24 18:34 4,212 zllictbl.dat
2007-12-24 09:03 2,554 tmp.reg
2007-12-24 09:03 0 tmp.txt
2007-12-22 22:43 228,328 FNTCACHE.DAT
2007-12-20 23:11 81,920 IEDFix.exe
2007-12-12 14:32 387,268 TZLog.log
2007-12-04 14:04 837,496 aswBoot.exe
2007-11-20 01:47 24,576 VundoFixSVC.exe
2007-11-13 12:31 60,416 tzchange.exe
2007-11-07 10:49 734,720 lsasrv.dll
2007-10-31 00:19 3,590,656 mshtml.dll
2007-10-29 23:42 1,293,312 quartz.dll
2007-10-29 19:18 392,296 perfh009.dat
2007-10-29 19:18 70,580 perfc007.dat
2007-10-29 19:18 58,596 perfc009.dat
2007-10-29 19:18 938,224 PerfStringBackup.INI
2007-10-29 19:18 405,118 perfh007.dat
2007-10-29 16:07 373,760 xpsp3res.dll
2007-10-25 17:42 8,501,248 shell32.dll
2007-10-20 06:01 227,328 wmasf.dll
2007-10-20 01:56 4,816 divxsm.tlb



Verzeichnis von C:\DOKUME~1\Besitzer\LOKALE~1\Temp

2008-01-22 17:48 109,190 datfind.txt
2008-01-22 17:40 512 ~DF3F5A.tmp
2008-01-22 17:40 16,384 ~DF3F4C.tmp
2008-01-22 16:58 2,044 mso1F8CF.emf
2008-01-22 16:58 1,908 mso5D2B6.emf
2008-01-22 16:58 2,044 mso7972C.emf
2008-01-22 16:58 2,004 mso9FF32.emf
2008-01-22 16:58 2,144 msoB25D.emf
2008-01-22 11:38 26,899,292 MWAV.LOG
2008-01-22 11:38 398,508 sfdb.dat
2008-01-22 11:20 5,111,767 MWAVC.LOG
2008-01-22 11:12 0 h2rD8.tmp
2008-01-22 11:12 136 r2hD7.tmp
2008-01-22 11:12 0 h2rD5.tmp
2008-01-22 11:12 136 r2hD4.tmp
2008-01-22 09:24 208 java_install_reg.log
2008-01-22 09:19 483 EUpdate.ini
2008-01-22 09:19 4,715 Download.log
2008-01-22 09:19 0 success.sem
2008-01-22 09:19 91 IUpdate.ini
2008-01-22 09:19 230 update.txt
2008-01-22 09:19 100,080 phupdn.txz

Verzeichnis von C:\WINDOWS

2008-01-22 16:12 1,904,575 WindowsUpdate.log
2008-01-22 16:12 2,048 bootstat.dat
2008-01-22 16:11 32,626 SchedLgU.Txt
2008-01-22 09:19 50 Lic.xxx
2008-01-21 08:55 54,156 QTFont.qfn
2008-01-18 18:34 1,409 QTFont.for
2008-01-09 08:25 316,640 WMSysPr9.prx
2008-01-08 08:04 740 win.ini
2007-12-24 08:55 12,108 cdplayer.ini
2007-11-27 20:33 116 NeroDigital.ini
2007-10-23 07:03 0 homeDVD-Fotos_dlx.INI
2007-10-23 07:02 6,537 mgxoschk.ini
2007-09-19 18:14 1,580 jxsz_z24.ini
2007-07-29 15:43 4,328 ODBCINST.INI

Verzeichnis von C:\WINDOWS\Downloaded Program Files

2007-11-20 09:27 2,072 vscanmsx.dat
2007-11-19 05:04 31,451 vet.da1
2007-11-19 01:18 13,076,520 vet.dat
2007-11-14 01:00 32 virscant.dat
2007-11-14 01:00 5,260,290 virscan9.dat
2007-11-14 01:00 6,899 ecbootil.vxd
2007-11-14 01:00 1,862,947 virscan8.dat
2007-11-14 01:00 14,386,178 virscan7.dat
2007-11-14 01:00 2,504 catalog.dat
2007-11-14 01:00 4,871,963 virscan5.dat
2007-11-14 01:00 320,253 virscan4.dat
2007-11-14 01:00 150,536 virscan3.dat
2007-11-14 01:00 570,966 virscan2.dat
2007-11-14 01:00 996,122 virscan1.dat
2007-11-14 01:00 97,776 scrauth.dat
2007-11-14 01:00 106,244 virscan.inf
2007-11-14 01:00 392,074 virscan6.dat
2007-11-14 01:00 11,816 symaveng.cat
2007-11-14 01:00 1,061 symaveng.inf
2007-11-14 01:00 400,415 tcdefs.dat
2007-11-14 01:00 2,344,295 tcscan7.dat
2007-11-14 01:00 413,082 tcscan8.dat
2007-11-14 01:00 968,800 tcscan9.dat
2007-11-14 01:00 224 zdone.dat
2007-11-14 01:00 148 tinfidx.dat
2007-11-14 01:00 1,957 tinfl.dat
2007-11-14 01:00 67,815 tscan1.dat
2007-11-14 01:00 3,240 tscan1hd.dat
2007-11-14 01:00 4,778 v.grd
2007-11-14 01:00 2,267 v.sig
2007-11-14 01:00 453 tinf.dat
2007-10-21 21:40 2,305 kavwebscan.inf
2007-10-18 01:02 214 DivXPlugin.inf
2007-04-11 14:55 1,292 erma.inf
2007-02-14 15:30 144 setup.inf
2007-02-03 08:59 65 desktop.ini



log.txt

Code

Ran on 2008-01-22 - 17:50:48.23

 Entries:                0  (0)
 Directories:            0  Files:             0
 Bytes:                  0  Blocks:            0

__________
http://www.webseitenoptimierung-seo.de

#6 1.
CCleaner anwenden
http://www.ccleaner.de/?protecus.de

2.
lade die exe hoch, kannst du von hier aus einkopieren - poste den report
http://www.virustotal.com/

C:\WINDOWS\system32\lsdelete.exe

----------
__________
Gruss
Pinguin

bin dabei, meine Seite + Proggies zu aktualisieren: http://www.virus-protect.org/

#7 Hier der Report:



Datei lsdelete.exe empfangen 2008.01.22 19:29:22 (CET)Antivirus Version letzte aktualisierung Ergebnis
AhnLab-V3 2008.1.23.10 2008.01.22 -
AntiVir 7.6.0.48 2008.01.22 -
Authentium 4.93.8 2008.01.22 -
Avast 4.7.1098.0 2008.01.22 -
AVG 7.5.0.516 2008.01.22 -
BitDefender 7.2 2008.01.22 -
CAT-QuickHeal 9.00 2008.01.22 -
ClamAV 0.91.2 2008.01.22 -
DrWeb 4.44.0.09170 2008.01.22 -
eSafe 7.0.15.0 2008.01.16 -
eTrust-Vet 31.3.5477 2008.01.22 -
Ewido 4.0 2008.01.22 -
FileAdvisor 1 2008.01.22 -
Fortinet 3.14.0.0 2008.01.22 -
F-Prot 4.4.2.54 2008.01.21 -
F-Secure 6.70.13260.0 2008.01.22 -
Ikarus T3.1.1.20 2008.01.22 -
Kaspersky 7.0.0.125 2008.01.22 -
McAfee 5213 2008.01.22 -
Microsoft 1.3109 2008.01.22 -
NOD32v2 2815 2008.01.22 -
Norman 5.80.02 2008.01.22 -
Panda 9.0.0.4 2008.01.21 -
Prevx1 V2 2008.01.22 -
Rising 20.28.12.00 2008.01.22 -
Sophos 4.24.0 2008.01.22 -
Sunbelt 2.2.907.0 2008.01.17 -
Symantec 10 2008.01.22 -
TheHacker 6.2.9.194 2008.01.22 -
VBA32 3.12.2.5 2008.01.21 -
VirusBuster 4.3.26:9 2008.01.22 -
Webwasher-Gateway 6.6.2 2008.01.22 -

weitere Informationen
File size: 12632 bytes
MD5: 56d1aa22bdbfde2e3a64a93359dd9397
SHA1: 115c099b1286851f6f8fb57de476cc59183d7376
PEiD: -
__________
http://www.webseitenoptimierung-seo.de

#8 ««
ich finde nichts... und was den haufen an Scannern betrifft, so solltest du alle bis auf einen deinstallieren .
Falls es probleme gibt, kannst du wunderbar Onlinescans machen
http://board.protecus.de/t8642.htm

««
die fehlende Internetverbindung ... kann es ein Hardware-Problem sein ? Hast du einen Router ?
__________
Gruss
Pinguin

bin dabei, meine Seite + Proggies zu aktualisieren: http://www.virus-protect.org/

#9 Hallo,

ersteinmal vielen vielen Dank für die Geduld und die vielen Antworten. Werde das Forum aufjedefall weiterempfehlen. Wirklich großartig.

Was die Internetverbindung angeht. Ich habe 16000 DSL-Flat, da sollte man eigentlich rund um die url volle Performance haben. Desweiteren benutze ich Stromnetzadapter anstatt WLAN was auch für eine stabile Verbindung sorgen müsste. Wie bereits erwähnt stehen hier zwei Rechner in einem Zimmer. Meiner ist leider derjenige der täglich Probleme hat. Da das Problem nur bei einem Rechner auftaucht kann es also nicht an der Leitung liegen. Habe deshalb vermutet mein SYstem sei, durch was auch immer, vielleicht überlastet.

Ich sollte alle bis auf einen scanner deinstallieren? Gibt es da Empfehlungen? Kann ich nicht entscheiden welchen ich drauf lasse...
__________
http://www.webseitenoptimierung-seo.de

#10 1.
Alcohol Soft und a-squared free und Ad-Aware 2007 und Software/LastFMHelper muss nicht immer aktiv sein, kannst du vorrübergehend deaktivieren

2.
klicke auf start, ausführen, msconfig eingeben, enter.

dort wähle die Programme aus, die nicht unbedingt mit dem System starten müssen, bzw. gar nicht notwendig sind mitzustarten!

wenn dann was nicht ordnungsgemäss funktionieren sollte, kannst du es wieder aktivieren, indem du das Häkchen wieder setzt.

raus könnte meiner Meinung nach:

Zitat

Winamp
O4 - HKLM\..\Run: [WinampAgent] C:\Programme\Winamp\winampa.exe

QuickTime
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime

a-squared Anti-Malware
O4 - Global Startup: aBackup.lnk = C:\Programme\MODular SOftware\aBackup\aBackup.exe

Office
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE

Creative Audio Product
O4 - HKLM\..\Run: [Jet Detection] C:\Programme\Creative-Soundtreiber\SBLive\PROGRAM\ADGJDet.exe
O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe

O4 - Startup: Last.fm Helper.lnk = C:\Programme\Last.fm\LastFMHelper.exe

was die Scanner betrifft: Avira reicht völlig aus.

3.
wende das an « poste den report
http://www.virus-protect.org/registry_stuff.html
__________
Gruss
Pinguin

bin dabei, meine Seite + Proggies zu aktualisieren: http://www.virus-protect.org/

#11 Super, das wird der Systemauslastung sicherlich zu gute kommen. Hier der Report:

doesn't exist HKEY_LOCAL_MACHINE\SSYSTEM\CurrentControlSet\Services\windowsnetwork
doesn't exist HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteRegistry
doesn't exist HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TlntSvr
doesn't exist HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
-----------------------
-----------------------
REGEDIT4

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess]
"DependOnGroup"=hex(7):00
"DependOnService"=hex(7):4e,65,74,6d,61,6e,00,57,69,6e,4d,67,6d,74,00,00
"Description"="Bietet allen Computern in Heim- und kleinen Firmennetzwerken Dienste für die Netzwerkadressübersetzung, Adressierung, Namensauflösung und Eindringsschutz."
"DisplayName"="Windows-Firewall/Gemeinsame Nutzung der Internetverbindung"
"ErrorControl"=dword:00000001
"ImagePath"=hex(2):25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,53,79,73,74,65,6d,33,\
32,5c,73,76,63,68,6f,73,74,2e,65,78,65,20,2d,6b,20,6e,65,74,73,76,63,73,00
"ObjectName"="LocalSystem"
"Start"=dword:00000002
"Type"=dword:00000020

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch]
"Epoch"=dword:0000148e

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters]
"ServiceDll"=hex(2):25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,53,79,73,74,65,6d,\
33,32,5c,69,70,6e,61,74,68,6c,70,2e,64,6c,6c,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP"="139:TCP:*:Enabled:@xpsp2res.dll,-22004"
"445:TCP"="445:TCP:*:Enabled:@xpsp2res.dll,-22005"
"137:UDP"="137:UDP:*:Enabled:@xpsp2res.dll,-22001"
"138:UDP"="138:UDP:*:Enabled:@xpsp2res.dll,-22002"
"1900:UDP"="1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007"
"2869:TCP"="2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall"=dword:00000000
"DoNotAllowExceptions"=dword:00000000
"DisableNotifications"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP"="139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004"
"445:TCP"="445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005"
"137:UDP"="137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001"
"138:UDP"="138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002"
"1900:UDP"="1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007"
"2869:TCP"="2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Setup]
"ServiceUpgrade"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Setup\InterfacesUnfirewalledAtUpdate]
"All"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Enum]
"0"="Root\\LEGACY_SHAREDACCESS\\0000"
"Count"=dword:00000001
"NextInstance"=dword:00000001


[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]


[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System]


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc]
"Type"=dword:00000020
"Start"=dword:00000002
"ErrorControl"=dword:00000001
"ImagePath"=hex(2):25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,53,79,73,74,65,6d,33,\
32,5c,73,76,63,68,6f,73,74,2e,65,78,65,20,2d,6b,20,6e,65,74,73,76,63,73,00
"DisplayName"="Sicherheitscenter"
"DependOnService"=hex(7):52,70,63,53,73,00,77,69,6e,6d,67,6d,74,00,00
"ObjectName"="LocalSystem"
"Description"="Überwacht Systemsicherheitseinstellungen und -konfigurationen."

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify"=dword:00000000
"FirewallDisableNotify"=dword:00000000
"UpdatesDisableNotify"=dword:00000000
"AntiVirusOverride"=dword:00000000
"FirewallOverride"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]


[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]


__________
http://www.webseitenoptimierung-seo.de

#12 wende sdfix im abgesicherten Modus an - post den report hier
http://www.virus-protect.org/artikel/tools/sdfix.html
__________
Gruss
Pinguin

bin dabei, meine Seite + Proggies zu aktualisieren: http://www.virus-protect.org/

#13 Habe alle Schritte ausgeführt. Hier der Report:




SDFix: Version 1.130

Run by Administrator on 23.01.2008 at 16:10

Microsoft Windows XP [Version 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...


Normal Mode:
Checking Files:

No Trojan Files Found






Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.



Final Check:

catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-23 16:51:09
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"p0"="C:\Programme\Alcohol Soft\Alcohol 120\"
"h0"=dword:00000001
"ujdew"=hex:3b,bd,91,4c,93,ff,38,6e,c5,84,c7,8d,27,af,6e,1e,f7,0c,5a,0f,07,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:3e,8e,3a,69,1e,83,a4,a8,32,ce,12,d3,5b,fd,94,c8,66,b4,e3,1d,38,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"p0"="C:\Programme\Alcohol Soft\Alcohol 120\"
"h0"=dword:00000001
"ujdew"=hex:3b,bd,91,4c,93,ff,38,6e,c5,84,c7,8d,27,af,6e,1e,f7,0c,5a,0f,07,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:3e,8e,3a,69,1e,83,a4,a8,32,ce,12,d3,5b,fd,94,c8,66,b4,e3,1d,38,..

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\System]
"OODEFRAG08.00.00.01WORKSTATION"="6488CA6B36EEC9FB68729C63A78E9042BD26F27A5214

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services:
------------------



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

Remaining Files:
---------------


Files with Hidden Attributes:

Wed 23 Jan 2008 29,519 ...H. --- "C:\Programme\Ipswitch\WS_FTP Pro\wsftpgui.exe-CommandBars"

Finished!
__________
http://www.webseitenoptimierung-seo.de

#14 wende sdfix an - im normalmodus - klicke 3 - sophos wird geladen, scanne mit Option 6 + poste den report
http://www.virus-protect.org/artikel/tools/sdfix.html
__________
Gruss
Pinguin

bin dabei, meine Seite + Proggies zu aktualisieren: http://www.virus-protect.org/

#15 SophosReport.txt

Sophos Anti-Virus
Version 4.25.0 [Win32/Intel]
Virus data version 4.25E, January 2008
Includes detection for 332949 viruses, trojans and worms
Copyright (c) 1989-2008 Sophos Plc, www.sophos.com

System time 18:37:26, System date 23 January 2008
Command line qualifiers are: -f -remove -nc -nb --stop-scan

Full Scanning

>>> Virus 'Mal/Banc-B' found in file C:\Dokumente und Einstellungen\Besitzer\Lokale Einstellungen\temp\DOWNLOAD.EXE
Removal successful
Could not check C:\Programme\No23 Recorder\No23Recorder.exe\FILE:0000 (archive files nested too deeply)
>>> Virus 'Mal/Banc-B' found in file C:\System Volume Information\_restore{75FD6CF1-F721-4ECA-8555-50580350C502}\RP52\A0009284.exe
Removal successful
Could not open C:\WINDOWS\system32\drivers\sptd.sys
Could not open C:\WINDOWS\system32\drivers\vaxscsi.sys
Password protected file D:\Internetverwaltung\PowerPoint\***\***\***.ppt

2 boot sectors swept.
99132 files swept in 57 minutes and 40 seconds.
4 errors were encountered.
2 viruses were discovered.
2 files out of 99132 were infected.
Please send infected samples to Sophos for analysis.
For advice consult www.sophos.com, email support@sophos.com
or telephone +44 1235 559933
1 encrypted file was not checked.
Ending Sophos Anti-Virus.
__________
http://www.webseitenoptimierung-seo.de