hinterhältiger angriff.... ich wurde infiziert...

#0
16.02.2008, 21:20
Member

Beiträge: 67
#1 Hi, ich habe heute einen virus erhalten getarnt durch das programm activex das ich glaub als plugin oder codec programm kenne....
dieser virus öffnet automatisch den browser und versucht mir irgendwie den real player irgendwas anzudrehen... und unten in der taskleiste steht immer 1 ausrufezeichen mit einem fenster...
"so und so ein virus... schädlich... bla bla bla... klicken um anti spyware software runterzuladen..."
und dann kommt eben wieder dieses realtime spiel

hatte schon S&D am laufen aber der konnte des problem net beheben... anti vir hatte ich auch am laufen aber bei 80% machte der update und brach die suche ab -.-

hatte schon mit hijackthis 1 logfile die auswertung auf der hp angesehn... programme die ich vorher im taskmanager bereits als verdächtig sah konnte ich net beenden da sie immerwieder kommen.

hier von hijackthis 1 logfile... bitte helft mir!!!

Logfile of HijackThis v1.99.1
Scan saved at 21:09:49, on 16.02.2008
Platform: Unknown Windows (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16609)

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\NetProject\scit.exe
C:\Program Files\NetProject\sbmntr.exe

C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Windows\RtHDVCpl.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Ulead Systems\AutoDetector\Monitor.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\NetProject\scm.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\NetProject\sbsm.exe
C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\iTunes\iTunes.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\distnoted.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceHelper.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Users\Micke\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~2\ICQTOO~1\toolbaru.dll
O1 - Hosts: ::1 localhost
O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\PROGRA~2\ICQTOO~1\toolbaru.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {C2A1C5CB-C0EF-4689-9436-F62CCA1C5383} - C:\Program Files\NetProject\sbmdl.dll (file missing)
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~2\ICQTOO~1\toolbaru.dll
O3 - Toolbar: Web Application - {81705D67-3F73-4983-859B-97D0922E5ABE} - C:\Program Files\NetProject\wamdl.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\Windows\JM\JMInsIDE.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Updater] C:\Windows\system32\updater\explorer.exe
O4 - HKLM\..\Run: [ZSSnp211] C:\Windows\ZSSnp211.exe
O4 - HKLM\..\Run: [Domino] C:\Windows\Domino.exe

O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Ulead AutoDetector v2] C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [EA Core] "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: (no name) - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.explorertool.net/redirect.php (file missing)
O9 - Extra 'Tools' menuitem: IE Anti-Spyware - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.explorertool.net/redirect.php (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O13 - Gopher Prefix:
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~2\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: @%SystemRoot%\ehome\ehstart.dll,-101 (ehstart) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)
Seitenanfang Seitenende
16.02.2008, 21:47
Ehrenmitglied
Avatar Pinguin

Beiträge: 1441
#2 Hallo Spire

««
wende RVAXO an + poste den Report
http://virus-protect.org/artikel/tools/rvaxo.html

««
wende Combofix an + poste hier den report
http://virus-protect.org/artikel/tools/combofix.html
__________
Gruss
Pinguin

bin dabei, meine Seite + Proggies zu aktualisieren: http://www.virus-protect.org/
Seitenanfang Seitenende
16.02.2008, 22:00
Member

Themenstarter

Beiträge: 67
#3 so, hier erstma nach combofix anwendung die hijack logfile...

Logfile of HijackThis v1.99.1
Scan saved at 21:55:34, on 17.02.2008
Platform: Unknown Windows (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16609)

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Windows\RtHDVCpl.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Windows\ZSSnp211.exe
C:\Windows\Domino.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Ulead Systems\AutoDetector\Monitor.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Electronic Arts\EADM\Core.exe
C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe
C:\Windows\Explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\Micke\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~2\ICQTOO~1\toolbaru.dll
O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\PROGRA~2\ICQTOO~1\toolbaru.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {C2A1C5CB-C0EF-4689-9436-F62CCA1C5383} - C:\Program Files\NetProject\sbmdl.dll (file missing)
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~2\ICQTOO~1\toolbaru.dll
O3 - Toolbar: Web Application - {81705D67-3F73-4983-859B-97D0922E5ABE} - C:\Program Files\NetProject\wamdl.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\Windows\JM\JMInsIDE.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Updater] C:\Windows\system32\updater\explorer.exe
O4 - HKLM\..\Run: [ZSSnp211] C:\Windows\ZSSnp211.exe
O4 - HKLM\..\Run: [Domino] C:\Windows\Domino.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Ulead AutoDetector v2] C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [EA Core] "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: (no name) - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.explorertool.net/redirect.php (file missing)
O9 - Extra 'Tools' menuitem: IE Anti-Spyware - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.explorertool.net/redirect.php (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O13 - Gopher Prefix:
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~2\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: @%SystemRoot%\ehome\ehstart.dll,-101 (ehstart) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)

hier combofix


ComboFix 08-02-17.2 - Micke 2008-02-16 21:37:57.1 - NTFSx86
Microsoft® Windows Vista™ Ultimate 6.0.6000.0.1252.1.1031.18.1154 [GMT 1:00]
ausgeführt von:: C:\Users\Micke\Desktop\ComboFix.exe
* Neuer Wiederherstellungspunkt wurde erstellt
.

(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\setup.exe
C:\Windows\system32\drivers\npf.sys
C:\Windows\system32\Packet.dll
C:\Windows\system32\pthreadVC.dll
C:\Windows\system32\WanPacket.dll
C:\Windows\system32\wpcap.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\NPF


((((((((((((((((((((((( Dateien erstellt von 2008-01-17 bis 2008-02-17 ))))))))))))))))))))))))))))))
.

2008-02-16 20:40 . 2008-02-16 20:40 <DIR> d-------- C:\Users\Micke\AppData\Roaming\Grisoft
2008-02-16 20:37 . 2008-02-16 20:37 <DIR> d-------- C:\Users\All Users\Grisoft
2008-02-16 20:37 . 2008-02-16 20:37 <DIR> d-------- C:\ProgramData\Grisoft
2008-02-16 20:37 . 2007-05-30 13:10 10,872 --a------ C:\Windows\System32\drivers\AvgAsCln.sys
2008-02-16 11:10 . 2008-02-16 21:24 <DIR> d-------- C:\Program Files\NetProject
2008-02-13 22:27 . 2008-02-13 22:27 1,585,664 --a------ C:\Windows\System32\setupapi.dll
2008-02-13 22:26 . 2008-02-13 22:26 943,800 --a------ C:\Windows\System32\winload.exe
2008-02-13 22:26 . 2008-02-13 22:26 905,400 --a------ C:\Windows\System32\winresume.exe
2008-02-13 22:26 . 2008-02-13 22:26 595,456 --a------ C:\Windows\System32\schedsvc.dll
2008-02-13 22:26 . 2008-02-13 22:26 115,200 --a------ C:\Windows\System32\loadperf.dll
2008-02-13 22:26 . 2008-02-13 22:26 39,424 --a------ C:\Windows\System32\lodctr.exe
2008-02-13 22:26 . 2008-02-13 22:26 32,256 --a------ C:\Windows\System32\unlodctr.exe
2008-02-13 22:26 . 2008-02-13 22:26 23,552 --a------ C:\Windows\System32\nshhttp.dll
2008-02-13 22:26 . 2008-02-13 22:26 17,408 --a------ C:\Windows\System32\prflbmsg.dll
2008-02-13 22:24 . 2008-02-13 22:24 803,328 --a------ C:\Windows\System32\drivers\tcpip.sys
2008-02-13 22:24 . 2008-02-13 22:24 216,632 --a------ C:\Windows\System32\drivers\netio.sys
2008-02-13 22:24 . 2008-02-13 22:24 167,424 --a------ C:\Windows\System32\tcpipcfg.dll
2008-02-13 22:24 . 2008-02-13 22:24 24,064 --a------ C:\Windows\System32\netcfg.exe
2008-02-13 22:24 . 2008-02-13 22:24 22,016 --a------ C:\Windows\System32\netiougc.exe
2008-02-13 16:08 . 2008-02-13 16:08 <DIR> d-------- C:\Program Files\Bethesda Softworks
2008-02-12 06:17 . 2008-02-12 06:17 <DIR> d-------- C:\Users\Micke\AppData\Roaming\Electronic Arts
2008-02-11 06:56 . 2008-02-12 17:28 <DIR> d-------- C:\Program Files\freeshard_launcher
2008-02-11 06:55 . 2008-02-11 06:55 253,952 --------- C:\Windows\Setup1.exe
2008-02-11 06:55 . 2008-02-11 06:55 74,752 --a------ C:\Windows\ST6UNST.EXE
2008-02-11 06:08 . 2008-02-12 06:05 <DIR> d-------- C:\Dark Age of Camelot - Catacombs
2008-02-10 21:24 . 2008-02-10 21:23 691,545 --a------ C:\Windows\unins000.exe
2008-02-10 21:24 . 2008-02-10 21:24 3,442 --a------ C:\Windows\unins000.dat
2008-02-09 19:47 . 2008-02-09 19:47 <DIR> d-------- C:\Program Files\Real
2008-02-09 19:47 . 2008-02-09 19:47 <DIR> d-------- C:\Program Files\Common Files\xing shared
2008-02-09 19:47 . 2008-02-09 19:47 <DIR> d-------- C:\Program Files\Common Files\Real
2008-02-09 19:47 . 2008-02-09 19:47 499,712 --a------ C:\Windows\System32\msvcp71.dll
2008-02-09 11:44 . 2008-02-09 11:44 250,143 --a------ C:\DSC00096.JPG
2008-02-09 11:07 . 2008-02-09 11:07 <DIR> d-------- C:\Windows\ulead.dat
2008-02-09 11:07 . 2008-02-09 19:31 511 --a------ C:\Windows\ulead32.ini
2008-02-09 11:06 . 2008-02-09 11:06 <DIR> d-------- C:\Program Files\Ulead Systems
2008-02-09 11:06 . 2008-02-09 11:06 <DIR> d-------- C:\Program Files\Common Files\Ulead Systems
2008-02-09 11:05 . 2008-02-09 11:06 <DIR> d-------- C:\Users\All Users\Ulead Systems
2008-02-09 11:05 . 2008-02-09 11:06 <DIR> d-------- C:\ProgramData\Ulead Systems
2008-02-09 10:57 . 2008-02-09 10:57 <DIR> d-------- C:\Program Files\Funcom
2008-02-07 15:16 . 2008-02-07 15:16 <DIR> d-------- C:\Users\All Users\GRAW2
2008-02-07 15:16 . 2008-02-07 15:16 <DIR> d-------- C:\ProgramData\GRAW2
2008-02-07 14:53 . 2008-02-07 14:53 <DIR> d-------- C:\Program Files\UBISOFT
2008-02-07 14:50 . 2008-02-07 14:50 <DIR> d-------- C:\Users\Micke\AppData\Roaming\InstallShield
2008-01-31 03:02 . 2008-01-31 03:02 54,608 --a------ C:\Windows\System32\xfcodec.dll
2008-01-30 22:02 . 2008-01-30 22:02 <DIR> d-------- C:\Program Files\iTunes
2008-01-30 22:02 . 2008-01-30 22:02 <DIR> d-------- C:\Program Files\iPod
2008-01-30 22:01 . 2008-01-30 22:01 <DIR> d-------- C:\Program Files\Bonjour
2008-01-30 22:00 . 2008-01-30 22:01 <DIR> d-------- C:\Program Files\QuickTime
2008-01-30 21:17 . 2008-01-30 21:17 <DIR> d-------- C:\Y.D.T
2008-01-30 21:16 . 2008-01-30 21:21 <DIR> d-------- C:\Program Files\E.M. Youtube Video Download Tool
2008-01-30 19:53 . 2008-01-30 19:53 <DIR> d-------- C:\skin ogame
2008-01-28 22:24 . 2008-01-28 22:24 <DIR> d-------- C:\Users\Micke\AppData\Roaming\LPECommon
2008-01-28 22:23 . 2008-01-28 22:40 <DIR> d-------- C:\SWGEmu
2008-01-28 22:23 . 2008-01-29 14:42 <DIR> d-------- C:\Program Files\Launchpad Enhanced
2008-01-28 21:15 . 2008-02-07 15:24 <DIR> d-------- C:\Program Files\StarWarsGalaxies
2008-01-28 21:15 . 2008-01-28 21:15 <DIR> d-------- C:\Program Files\Sony
2008-01-25 19:54 . 2008-01-25 19:54 <DIR> d-------- C:\Windows\EffectResources
2008-01-25 19:54 . 2008-01-25 19:54 <DIR> d-------- C:\Windows\CatRoot
2008-01-25 19:54 . 2008-01-25 19:54 <DIR> d-------- C:\Program Files\Vimicro
2008-01-25 19:54 . 2000-10-31 12:00 307,200 --a------ C:\Windows\vidcap32.Exe
2008-01-25 19:54 . 2006-07-14 14:33 57,344 --a------ C:\Windows\Sti211.exe
2008-01-25 19:54 . 2006-07-14 16:24 49,152 --a------ C:\Windows\ZSSnp211.exe
2008-01-25 19:54 . 2006-07-04 14:16 49,152 --a------ C:\Windows\Domino.exe
2008-01-25 19:17 . 2008-01-26 19:46 <DIR> d-------- C:\Users\Micke\AppData\Roaming\skypePM
2008-01-25 18:57 . 2008-01-26 19:56 <DIR> d-------- C:\Users\Micke\AppData\Roaming\Skype
2008-01-25 18:52 . 2008-01-25 18:52 <DIR> d-------- C:\Program Files\Skype
2008-01-25 18:52 . 2008-01-25 18:52 <DIR> d-------- C:\Program Files\Common Files\Skype
2008-01-23 19:28 . 2008-01-23 19:29 <DIR> d-------- C:\Program Files\Common Files\AVSMedia
2008-01-23 19:28 . 2008-01-23 19:28 <DIR> d-------- C:\Program Files\AVSMedia
2008-01-23 18:56 . 2008-01-23 18:56 <DIR> d-------- C:\Users\Micke\AppData\Roaming\Media Player Classic
2008-01-23 18:55 . 2004-01-11 23:00 348,160 --a------ C:\Windows\System32\msvcr71.dll
2008-01-20 13:36 . 2008-02-12 06:26 <DIR> d-------- C:\Program Files\CCP
2008-01-20 12:06 . 2008-01-20 12:08 <DIR> d-------- C:\xampp
2008-01-20 12:02 . 2006-04-13 11:30 1,073,152 --a------ C:\Windows\System32\libmysql_c.dll

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-16 10:10 --------- d-----w C:\Program Files\ICQToolbar
2008-02-15 21:05 --------- d-----w C:\Users\Micke\AppData\Roaming\Azureus
2008-02-15 05:12 22,328 ----a-w C:\Windows\system32\drivers\PnkBstrK.sys
2008-02-15 05:01 --------- d-----w C:\Users\Micke\AppData\Roaming\LimeWire
2008-02-13 21:27 54,784 ----a-w C:\Windows\system32\drivers\i8042prt.sys
2008-02-13 21:27 495,160 ----a-w C:\Windows\system32\drivers\Wdf01000.sys
2008-02-13 21:27 35,384 ----a-w C:\Windows\system32\drivers\WdfLdr.sys
2008-02-13 21:27 35,384 ----a-w C:\Windows\system32\drivers\kbdclass.sys
2008-02-13 21:27 34,360 ----a-w C:\Windows\system32\drivers\mouclass.sys
2008-02-13 21:27 19,968 ----a-w C:\Windows\system32\drivers\sermouse.sys
2008-02-13 21:27 110,080 ----a-w C:\Windows\system32\drivers\mrxdav.sys
2008-02-13 21:25 --------- d-----w C:\ProgramData\Microsoft Help
2008-02-13 19:44 --------- d-----w C:\Users\Micke\AppData\Roaming\Xfire
2008-02-13 19:41 --------- d-----w C:\ProgramData\Xfire
2008-02-13 15:08 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-11 04:47 --------- d-----w C:\ProgramData\Spybot - Search & Destroy
2008-02-11 04:27 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-02-09 10:33 --------- d-----w C:\ProgramData\Media Center Programs
2008-02-08 19:55 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-02-08 11:09 --------- d-----w C:\Program Files\Electronic Arts
2008-02-08 07:51 --------- d-----w C:\Program Files\Xfire
2008-02-07 14:04 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-02-07 14:04 --------- d-----w C:\Program Files\AGEIA Technologies
2008-01-28 20:14 --------- d-----w C:\Program Files\LucasArts
2008-01-25 22:11 --------- d-----w C:\ProgramData\NVIDIA
2008-01-25 17:52 --------- d-----w C:\ProgramData\Skype
2008-01-20 10:20 --------- d-----w C:\Users\Micke\AppData\Roaming\DivX
2008-01-17 06:11 --------- d-----w C:\Program Files\Common Files\Blizzard Entertainment
2008-01-17 05:48 --------- d-----w C:\Program Files\World of Warcraft
2008-01-14 19:28 --------- d-----w C:\Program Files\Wizards of the Coast
2008-01-13 14:59 --------- d-----w C:\Program Files\Common Files\SWF Studio
2008-01-11 11:55 --------- d-----w C:\Program Files\Common Files\Steam
2008-01-10 15:29 --------- d-----w C:\Program Files\Gadu-Gadu
2008-01-10 04:52 --------- d-----w C:\Program Files\Windows Sidebar
2008-01-09 16:42 --------- d-----w C:\Users\Micke\AppData\Roaming\teamspeak2
2008-01-09 16:42 --------- d-----w C:\Program Files\Teamspeak2_RC2
2008-01-05 09:07 --------- d-----w C:\Users\Dana\AppData\Roaming\skypePM
2008-01-05 09:07 --------- d-----w C:\Users\Dana\AppData\Roaming\Skype
2008-01-05 09:02 --------- d-----w C:\Users\Dana\AppData\Roaming\Gadu-Gadu
2008-01-04 18:25 --------- d-----w C:\Users\Dana\AppData\Roaming\Apple Computer
2008-01-04 18:11 32 ----a-w C:\Users\All Users\ezsid.dat
2008-01-04 18:11 32 ----a-w C:\ProgramData\ezsid.dat
2008-01-04 18:05 --------- d-----w C:\Users\Micke\AppData\Roaming\Gadu-Gadu
2008-01-04 17:59 --------- d-----w C:\Users\Dana\AppData\Roaming\Talkback
2007-12-25 11:58 --------- d-----w C:\Program Files\Microsoft IntelliType Pro
2007-12-25 11:54 --------- d-----w C:\Program Files\Microsoft IntelliType Pro 5.3
2007-12-25 11:50 --------- d-----w C:\Program Files\Microsoft IntelliPoint
2007-12-24 16:02 --------- d-----w C:\Program Files\Azureus
2007-12-20 16:46 621,056 ----a-w C:\Windows\system32\drivers\dxgkrnl.sys
2007-12-20 16:36 --------- d-----w C:\Program Files\DAEMON Tools
2007-12-20 15:13 --------- d-----w C:\Program Files\GIF Movie Gear
2007-12-19 05:46 --------- d-----w C:\Program Files\Flagship Studios
2007-12-18 18:15 --------- d-----w C:\Program Files\DivX
2007-12-18 18:15 --------- d-----w C:\Program Files\Common Files\PX Storage Engine
2007-12-17 18:31 --------- d-----w C:\Users\Micke\AppData\Roaming\TuneUp Software
2007-12-17 18:30 --------- d-----w C:\Program Files\TuneUp Utilities 2008
2007-12-17 18:29 --------- d-----w C:\ProgramData\TuneUp Software
2007-12-17 05:12 --------- d-----w C:\Program Files\Lavalys
2007-12-12 19:47 22,328 ----a-w C:\Users\Micke\AppData\Roaming\PnkBstrK.sys
2007-12-09 11:58 2,923,520 ----a-w C:\Windows\explorer.exe
2007-12-07 19:51 319,984 ----a-w C:\Windows\DIFxAPI.dll
2007-12-06 04:08 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2007-11-28 16:44 174 --sha-w C:\Program Files\desktop.ini
.

(((((((((((((((((((((((((((( Autostart Punkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Hinweis* leere Eintrage & legitime Standardeintrage werden nicht angezeigt.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C2A1C5CB-C0EF-4689-9436-F62CCA1C5383}]
C:\Program Files\NetProject\sbmdl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{855F3B16-6D32-4FE6-8A56-BBB695989046}
{81705D67-3F73-4983-859B-97D0922E5ABE}

[HKEY_CLASSES_ROOT\clsid\{81705d67-3f73-4983-859b-97d0922e5abe}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{81705D67-3F73-4983-859B-97D0922E5ABE}"= C:\Program Files\NetProject\wamdl.dll [2008-02-16 11:10 70656]

[HKEY_CLASSES_ROOT\clsid\{81705d67-3f73-4983-859b-97d0922e5abe}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-09 22:43 1232896]
"WindowsWelcomeCenter"="oobefldr.dll" [2006-11-02 13:32 2159104 C:\Windows\System32\oobefldr.dll]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]
"EA Core"="C:\Program Files\Electronic Arts\EADM\Core.exe" [2007-12-04 05:57 2494464]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2007-07-11 04:17 1006264]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2007-11-28 18:21 249896]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016]
"PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2007-08-07 01:05 200704]
"RtHDVCpl"="RtHDVCpl.exe" [2006-12-01 06:37 4186112 C:\Windows\RtHDVCpl.exe]
"JMB36X IDE Setup"="C:\Windows\JM\JMInsIDE.exe" [2006-10-30 13:44 36864]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"Updater"="C:\Windows\system32\updater\explorer.exe" [2007-11-24 14:08 1478612]
"ZSSnp211"="C:\Windows\ZSSnp211.exe" [2006-07-14 16:24 49152]
"Domino"="C:\Windows\Domino.exe" [2006-07-04 14:16 49152]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2006-09-14 21:09 157592]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2007-08-31 12:01 1037736]
"itype"="C:\Program Files\Microsoft IntelliType Pro\itype.exe" [2006-11-21 17:08 813912]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-12-11 17:06 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-12-11 17:06 8530464]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-12-11 17:06 81920]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-10 15:27 385024]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-01-15 03:22 267048]
"Ulead AutoDetector v2"="C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe" [2005-05-23 09:57 90112]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-02-09 19:47 185896]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312]

R2 NMSAccessU;NMSAccessU;C:\Program Files\CDBurnerXP\NMSAccessU.exe [2007-10-12 08:34]
R2 SBSDWSCService;SBSD Security Center Service;C:\Program Files\Spybot []
R2 UxTuneUp;TuneUp Designerweiterung;C:\Windows\System32\svchost.exe [2006-11-02 10:45]
S0 OemBiosDevice;Royalty OEM Bios Extension;C:\Windows\system32\drivers\royal.sys [2007-12-04 18:57]
S3 Steam Client Service;Steam Client Service;C:\Program Files\Common Files\Steam\SteamService.exe [2008-01-11 06:18]
S3 TuneUp.Defrag;TuneUp Drive Defrag-Dienst;C:\Windows\System32\TuneUpDefragService.exe [2007-12-17 19:30]
S3 ZSMC211;USB PC Camera (ZS211);C:\Windows\system32\Drivers\ZS211.sys [2006-07-25 11:47]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d20a0b72-9dcf-11dc-b152-806e6f6e6963}]
\shell\AutoRun\command - H:\OblivionLauncher.exe

*Newly Created Service* - AVGASCLN
.
Inhalt des "geplante Tasks" Ordners
"2008-02-08 19:36:31 C:\Windows\Tasks\1-Klick-Wartung.job"
- C:\Program Files\TuneUp Utilities 2008\OneClick.exe
"2008-02-17 20:41:28 C:\Windows\Tasks\User_Feed_Synchronization-{C97E9A21-FFA1-4DA0-B495-34A110A6016C}.job"
- C:\Windows\system32\msfeedssync.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-17 21:46:52
Windows 6.0.6000 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostart Einträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\PnkBstrA.exe
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\conime.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\\?\C:\Windows\system32\wbem\WMIADAP.EXE
.
**************************************************************************
.
Zeit der Fertigstellung: 2008-02-17 21:52:04 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-17 20:51:59
.
2008-02-15 21:06:55 --- E O F ---




RVAXO funktioniert bei mir leider nicht!... irgendwie stürzt es jedesmal ab und wenn ich den ordner öffne und die datei starte steht ein paar mal zugriff verweigert...
Seitenanfang Seitenende
16.02.2008, 22:07
Ehrenmitglied
Avatar Argus

Beiträge: 6028
#4 Versuch es via unterstehende Anleitung
RVAXO
Note:
Vista benutzer: .Rechtsklick auf “ RunMe .cmd” und waehle "Run as Administrator".

Download: RVAXO by Smeenk,zum Desktop
Danach doppelklicken
Öffne die Datei RVAXO und doppelklick “ RunMe .cmd”
Moeglich startet der Uninstaller von ein Roquescanner schliesse es nicht ab aber lass es seine Arbeit tun
Dein Rechner wird neu gestartet, das cmd-fenster von RVAXO oeffnet sich von neuem
Und warte bis ein logfile sich oeffnet:C:\ RVAXO-results.log
Poste dessen inhalt hier ins Forum
Wenn dein Rechner nicht neu startet mach es manuel sowie auch RunMe .cmd
__________
MfG Argus
Seitenanfang Seitenende
16.02.2008, 22:29
Member

Themenstarter

Beiträge: 67
#5 leider konnte keine logfile erstellt werden... musste alles wie beschrieben manuell machen... wenn ich runme starte schliesst des fenster nach 1 tausenstel sekunde wieder genauso wie bei rvaxo und ich starte es sogar als administrator...
Seitenanfang Seitenende
16.02.2008, 23:31
Ehrenmitglied
Avatar Pinguin

Beiträge: 1441
#6 Spire

Information:
http://virus-protect.org/artikel/spyware/netproject.html

---------

HijackThis
Setze ein Häckchen in das Kästchen vor den genannten Eintrag und wähle fix checked.

Zitat

O2 - BHO: (no name) - {C2A1C5CB-C0EF-4689-9436-F62CCA1C5383} - C:\Program Files\NetProject\sbmdl.dll (file missing)

O3 - Toolbar: Web Application - {81705D67-3F73-4983-859B-97D0922E5ABE} - C:\Program Files\NetProject\wamdl.dll

O9 - Extra button: (no name) - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.explorertool.net/redirect.php (file missing)

O9 - Extra 'Tools' menuitem: IE Anti-Spyware - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.explorertool.net/redirect.php (file missing)
-------------

««
Den folgenden Text in den Editor (Start - Zubehör - Editor) kopieren und als cfscript.txt mit 'Speichern unter' auf dem Desktop. Gib an "Alle Dateien" - Speichern

Zitat

KILLALL::

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"=-
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C2A1C5CB-C0EF-4689-9436-F62CCA1C5383}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{855F3B16-6D32-4FE6-8A56-BBB695989046}"=-
"{81705D67-3F73-4983-859B-97D0922E5ABE}"=-
[-HKEY_CLASSES_ROOT\clsid\{81705d67-3f73-4983-859b-97d0922e5abe}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{81705D67-3F73-4983-859B-97D0922E5ABE}"=-
[-HKEY_CLASSES_ROOT\clsid\{81705d67-3f73-4983-859b-97d0922e5abe}]

Folder::
C:\Program Files\NetProject
Man sollte jetzt auf dem Desktop diese Datei cfscript.txt finden.

cfscript.txt und mit der rechten Maustaste auf das Symbol von Combofix ziehen
danach: Combofix noch einmal anwenden - tippe 1

PC neustarten

»»
poste das neue Log von Combofix

---------------
«
lade die exe hoch, lasse sie prüfen ++ poste den report
http://www.virustotal.com/de/

C:\Windows\system32\updater\explorer.exe
__________
Gruss
Pinguin

bin dabei, meine Seite + Proggies zu aktualisieren: http://www.virus-protect.org/
Seitenanfang Seitenende
19.02.2008, 12:05
Member

Themenstarter

Beiträge: 67
#7 folgendes problem... nachdem ich combofix mit cfscript benutzt hab... machte der auch alles wie ganz normal, also startete nach einer weile den rechner neu und als ich mich dann einloggte erschien mir kein bericht... ich weiss auch nicht wo ich den finde...

edit: es wurde gar keine erstellt... hab den rechner durchsucht und es wurden alte gefunden aber kein neuer....

als ich combofix zum 2. verwendet hatte kam mir ein bluescreen

eidt2: schon zum 2. mal erhielt ich 1 bluescreen
Dieser Beitrag wurde am 19.02.2008 um 12:17 Uhr von Spire editiert.
Seitenanfang Seitenende
19.02.2008, 13:07
Ehrenmitglied
Avatar Pinguin

Beiträge: 1441
#8 Spire

du musst ein neues script erstellen (hab was verändert) ..alles abarbeiten,was ich oben geschrieben habe... Punkt für Punkt, damit die Ursache aller Probleme.. NetProject gelöscht wird.

Poste dann bitte nach Neustart das neue Log von Combifix zur Überprüfung, also Combofix noch mal anwenden, damit das log erstellt wird
__________
Gruss
Pinguin

bin dabei, meine Seite + Proggies zu aktualisieren: http://www.virus-protect.org/
Seitenanfang Seitenende
19.02.2008, 14:23
Member

Themenstarter

Beiträge: 67
#9 ComboFix 08-02-17.2 - Micke 2008-02-20 14:16:52.5 - NTFSx86
Microsoft® Windows Vista™ Ultimate 6.0.6000.0.1252.1.1031.18.1202 [GMT 1:00]
ausgeführt von:: C:\Users\Micke\Desktop\ComboFix.exe
.

((((((((((((((((((((((( Dateien erstellt von 2008-01-20 bis 2008-02-20 ))))))))))))))))))))))))))))))
.

2008-02-18 19:18 . 2008-02-18 19:18 <DIR> d-------- C:\Program Files\GameSpy
2008-02-18 19:16 . 2008-02-18 19:16 <DIR> d-------- C:\Windows\System32\URTTEMP
2008-02-18 19:13 . 2008-02-18 19:13 669,184 --a------ C:\Windows\System32\pbsvc.exe
2008-02-16 20:40 . 2008-02-16 20:40 <DIR> d-------- C:\Users\Micke\AppData\Roaming\Grisoft
2008-02-16 20:37 . 2008-02-16 20:37 <DIR> d-------- C:\Users\All Users\Grisoft
2008-02-16 20:37 . 2008-02-16 20:37 <DIR> d-------- C:\ProgramData\Grisoft
2008-02-16 20:37 . 2007-05-30 13:10 10,872 --a------ C:\Windows\System32\drivers\AvgAsCln.sys
2008-02-16 11:10 . 2008-02-20 14:01 <DIR> d-------- C:\Program Files\NetProject
2008-02-13 22:27 . 2008-02-13 22:27 1,585,664 --a------ C:\Windows\System32\setupapi.dll
2008-02-13 22:26 . 2008-02-13 22:26 943,800 --a------ C:\Windows\System32\winload.exe
2008-02-13 22:26 . 2008-02-13 22:26 905,400 --a------ C:\Windows\System32\winresume.exe
2008-02-13 22:26 . 2008-02-13 22:26 595,456 --a------ C:\Windows\System32\schedsvc.dll
2008-02-13 22:26 . 2008-02-13 22:26 115,200 --a------ C:\Windows\System32\loadperf.dll
2008-02-13 22:26 . 2008-02-13 22:26 39,424 --a------ C:\Windows\System32\lodctr.exe
2008-02-13 22:26 . 2008-02-13 22:26 32,256 --a------ C:\Windows\System32\unlodctr.exe
2008-02-13 22:26 . 2008-02-13 22:26 23,552 --a------ C:\Windows\System32\nshhttp.dll
2008-02-13 22:26 . 2008-02-13 22:26 17,408 --a------ C:\Windows\System32\prflbmsg.dll
2008-02-13 22:24 . 2008-02-13 22:24 803,328 --a------ C:\Windows\System32\drivers\tcpip.sys
2008-02-13 22:24 . 2008-02-13 22:24 216,632 --a------ C:\Windows\System32\drivers\netio.sys
2008-02-13 22:24 . 2008-02-13 22:24 167,424 --a------ C:\Windows\System32\tcpipcfg.dll
2008-02-13 22:24 . 2008-02-13 22:24 24,064 --a------ C:\Windows\System32\netcfg.exe
2008-02-13 22:24 . 2008-02-13 22:24 22,016 --a------ C:\Windows\System32\netiougc.exe
2008-02-13 16:08 . 2008-02-13 16:08 <DIR> d-------- C:\Program Files\Bethesda Softworks
2008-02-12 06:17 . 2008-02-12 06:17 <DIR> d-------- C:\Users\Micke\AppData\Roaming\Electronic Arts
2008-02-11 06:56 . 2008-02-12 17:28 <DIR> d-------- C:\Program Files\freeshard_launcher
2008-02-11 06:55 . 2008-02-11 06:55 253,952 --------- C:\Windows\Setup1.exe
2008-02-11 06:55 . 2008-02-11 06:55 74,752 --a------ C:\Windows\ST6UNST.EXE
2008-02-11 06:08 . 2008-02-18 18:43 <DIR> d-------- C:\Dark Age of Camelot - Catacombs
2008-02-10 21:24 . 2008-02-10 21:23 691,545 --a------ C:\Windows\unins000.exe
2008-02-10 21:24 . 2008-02-10 21:24 3,442 --a------ C:\Windows\unins000.dat
2008-02-09 19:47 . 2008-02-09 19:47 <DIR> d-------- C:\Program Files\Real
2008-02-09 19:47 . 2008-02-09 19:47 <DIR> d-------- C:\Program Files\Common Files\xing shared
2008-02-09 19:47 . 2008-02-09 19:47 <DIR> d-------- C:\Program Files\Common Files\Real
2008-02-09 19:47 . 2008-02-09 19:47 499,712 --a------ C:\Windows\System32\msvcp71.dll
2008-02-09 11:44 . 2008-02-09 11:44 250,143 --a------ C:\DSC00096.JPG
2008-02-09 11:07 . 2008-02-09 11:07 <DIR> d-------- C:\Windows\ulead.dat
2008-02-09 11:07 . 2008-02-09 19:31 511 --a------ C:\Windows\ulead32.ini
2008-02-09 11:06 . 2008-02-09 11:06 <DIR> d-------- C:\Program Files\Ulead Systems
2008-02-09 11:06 . 2008-02-09 11:06 <DIR> d-------- C:\Program Files\Common Files\Ulead Systems
2008-02-09 11:05 . 2008-02-09 11:06 <DIR> d-------- C:\Users\All Users\Ulead Systems
2008-02-09 11:05 . 2008-02-09 11:06 <DIR> d-------- C:\ProgramData\Ulead Systems
2008-02-09 10:57 . 2008-02-09 10:57 <DIR> d-------- C:\Program Files\Funcom
2008-02-07 15:16 . 2008-02-07 15:16 <DIR> d-------- C:\Users\All Users\GRAW2
2008-02-07 15:16 . 2008-02-07 15:16 <DIR> d-------- C:\ProgramData\GRAW2
2008-02-07 14:53 . 2008-02-07 14:53 <DIR> d-------- C:\Program Files\UBISOFT
2008-01-31 03:02 . 2008-01-31 03:02 54,608 --a------ C:\Windows\System32\xfcodec.dll
2008-01-30 22:02 . 2008-01-30 22:02 <DIR> d-------- C:\Program Files\iTunes
2008-01-30 22:02 . 2008-01-30 22:02 <DIR> d-------- C:\Program Files\iPod
2008-01-30 22:01 . 2008-01-30 22:01 <DIR> d-------- C:\Program Files\Bonjour
2008-01-30 22:00 . 2008-01-30 22:01 <DIR> d-------- C:\Program Files\QuickTime
2008-01-30 21:17 . 2008-01-30 21:17 <DIR> d-------- C:\Y.D.T
2008-01-30 21:16 . 2008-01-30 21:21 <DIR> d-------- C:\Program Files\E.M. Youtube Video Download Tool
2008-01-30 19:53 . 2008-01-30 19:53 <DIR> d-------- C:\skin ogame
2008-01-28 22:24 . 2008-01-28 22:24 <DIR> d-------- C:\Users\Micke\AppData\Roaming\LPECommon
2008-01-28 22:23 . 2008-01-28 22:40 <DIR> d-------- C:\SWGEmu
2008-01-28 22:23 . 2008-01-29 14:42 <DIR> d-------- C:\Program Files\Launchpad Enhanced
2008-01-28 21:15 . 2008-02-07 15:24 <DIR> d-------- C:\Program Files\StarWarsGalaxies
2008-01-28 21:15 . 2008-01-28 21:15 <DIR> d-------- C:\Program Files\Sony
2008-01-25 19:54 . 2008-01-25 19:54 <DIR> d-------- C:\Windows\EffectResources
2008-01-25 19:54 . 2008-01-25 19:54 <DIR> d-------- C:\Windows\CatRoot
2008-01-25 19:54 . 2008-01-25 19:54 <DIR> d-------- C:\Program Files\Vimicro
2008-01-25 19:54 . 2000-10-31 12:00 307,200 --a------ C:\Windows\vidcap32.Exe
2008-01-25 19:54 . 2006-07-14 14:33 57,344 --a------ C:\Windows\Sti211.exe
2008-01-25 19:54 . 2006-07-14 16:24 49,152 --a------ C:\Windows\ZSSnp211.exe
2008-01-25 19:54 . 2006-07-04 14:16 49,152 --a------ C:\Windows\Domino.exe
2008-01-25 19:17 . 2008-01-26 19:46 <DIR> d-------- C:\Users\Micke\AppData\Roaming\skypePM
2008-01-25 18:57 . 2008-01-26 19:56 <DIR> d-------- C:\Users\Micke\AppData\Roaming\Skype
2008-01-25 18:52 . 2008-01-25 18:52 <DIR> d-------- C:\Program Files\Skype
2008-01-25 18:52 . 2008-01-25 18:52 <DIR> d-------- C:\Program Files\Common Files\Skype
2008-01-23 19:28 . 2008-01-23 19:29 <DIR> d-------- C:\Program Files\Common Files\AVSMedia
2008-01-23 19:28 . 2008-01-23 19:28 <DIR> d-------- C:\Program Files\AVSMedia
2008-01-23 18:56 . 2008-01-23 18:56 <DIR> d-------- C:\Users\Micke\AppData\Roaming\Media Player Classic
2008-01-23 18:55 . 2004-01-11 23:00 348,160 --a------ C:\Windows\System32\msvcr71.dll
2008-01-20 13:36 . 2008-02-12 06:26 <DIR> d-------- C:\Program Files\CCP
2008-01-20 12:06 . 2008-01-20 12:08 <DIR> d-------- C:\xampp
2008-01-20 12:02 . 2006-04-13 11:30 1,073,152 --a------ C:\Windows\System32\libmysql_c.dll

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-18 18:16 --------- d-----w C:\Program Files\ICQToolbar
2008-02-18 18:13 22,328 ----a-w C:\Windows\system32\drivers\PnkBstrK.sys
2008-02-18 18:13 22,328 ----a-w C:\Users\Micke\AppData\Roaming\PnkBstrK.sys
2008-02-18 18:13 103,736 ----a-w C:\Windows\System32\PnkBstrB.exe
2008-02-18 18:12 --------- d-----w C:\ProgramData\Media Center Programs
2008-02-18 17:55 --------- d-----w C:\Program Files\Electronic Arts
2008-02-18 17:46 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-18 16:06 --------- d-----w C:\Users\Micke\AppData\Roaming\Azureus
2008-02-15 05:01 --------- d-----w C:\Users\Micke\AppData\Roaming\LimeWire
2008-02-13 21:25 --------- d-----w C:\ProgramData\Microsoft Help
2008-02-13 19:44 --------- d-----w C:\Users\Micke\AppData\Roaming\Xfire
2008-02-13 19:41 --------- d-----w C:\ProgramData\Xfire
2008-02-11 04:47 --------- d-----w C:\ProgramData\Spybot - Search & Destroy
2008-02-11 04:27 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-02-08 19:55 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-02-08 07:51 --------- d-----w C:\Program Files\Xfire
2008-02-07 14:04 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-02-07 14:04 --------- d-----w C:\Program Files\AGEIA Technologies
2008-01-28 20:14 --------- d-----w C:\Program Files\LucasArts
2008-01-25 22:11 --------- d-----w C:\ProgramData\NVIDIA
2008-01-25 17:52 --------- d-----w C:\ProgramData\Skype
2008-01-20 10:20 --------- d-----w C:\Users\Micke\AppData\Roaming\DivX
2008-01-17 06:11 --------- d-----w C:\Program Files\Common Files\Blizzard Entertainment
2008-01-17 05:48 --------- d-----w C:\Program Files\World of Warcraft
2008-01-14 19:28 --------- d-----w C:\Program Files\Wizards of the Coast
2008-01-13 14:59 --------- d-----w C:\Program Files\Common Files\SWF Studio
2008-01-11 11:55 --------- d-----w C:\Program Files\Common Files\Steam
2008-01-10 15:29 --------- d-----w C:\Program Files\Gadu-Gadu
2008-01-10 04:52 --------- d-----w C:\Program Files\Windows Sidebar
2008-01-09 21:43 11,776 ----a-w C:\Windows\System32\sbunattend.exe
2008-01-09 16:42 --------- d-----w C:\Users\Micke\AppData\Roaming\teamspeak2
2008-01-09 16:42 --------- d-----w C:\Program Files\Teamspeak2_RC2
2008-01-05 09:07 --------- d-----w C:\Users\Dana\AppData\Roaming\skypePM
2008-01-05 09:07 --------- d-----w C:\Users\Dana\AppData\Roaming\Skype
2008-01-05 09:02 --------- d-----w C:\Users\Dana\AppData\Roaming\Gadu-Gadu
2008-01-04 18:25 --------- d-----w C:\Users\Dana\AppData\Roaming\Apple Computer
2008-01-04 18:11 32 ----a-w C:\Users\All Users\ezsid.dat
2008-01-04 18:11 32 ----a-w C:\ProgramData\ezsid.dat
2008-01-04 18:05 --------- d-----w C:\Users\Micke\AppData\Roaming\Gadu-Gadu
2008-01-04 17:59 --------- d-----w C:\Users\Dana\AppData\Roaming\Talkback
2007-12-25 11:58 --------- d-----w C:\Program Files\Microsoft IntelliType Pro
2007-12-25 11:54 --------- d-----w C:\Program Files\Microsoft IntelliType Pro 5.3
2007-12-25 11:50 --------- d-----w C:\Program Files\Microsoft IntelliPoint
2007-12-24 16:02 --------- d-----w C:\Program Files\Azureus
2007-12-20 16:46 621,056 ----a-w C:\Windows\system32\drivers\dxgkrnl.sys
2007-12-20 16:46 36,864 ----a-w C:\Windows\System32\cdd.dll
2007-12-20 16:36 --------- d-----w C:\Program Files\DAEMON Tools
2007-12-20 15:13 --------- d-----w C:\Program Files\GIF Movie Gear
2007-12-19 21:48 107,888 ----a-w C:\Windows\System32\CmdLineExt.dll
2007-12-17 18:30 306,432 ----a-w C:\Windows\System32\TuneUpDefragService.exe
2007-12-13 15:34 66,872 ----a-w C:\Windows\System32\PnkBstrA.exe
2007-12-12 14:13 9,728 ----a-w C:\Windows\System32\LAPRXY.DLL
2007-12-12 14:13 223,232 ----a-w C:\Windows\System32\WMASF.DLL
2007-12-12 14:13 1,327,104 ----a-w C:\Windows\System32\quartz.dll
2007-12-12 14:10 3,504,824 ----a-w C:\Windows\System32\ntkrnlpa.exe
2007-12-12 14:10 3,470,520 ----a-w C:\Windows\System32\ntoskrnl.exe
2007-12-11 22:35 524,288 ----a-w C:\Windows\System32\DivXsm.exe
2007-12-11 22:34 3,596,288 ----a-w C:\Windows\System32\qt-dx331.dll
2007-12-11 22:34 200,704 ----a-w C:\Windows\System32\ssldivx.dll
2007-12-11 22:34 1,044,480 ----a-w C:\Windows\System32\libdivx.dll
2007-12-11 22:33 823,296 ----a-w C:\Windows\System32\divx_xx0c.dll
2007-12-11 22:33 823,296 ----a-w C:\Windows\System32\divx_xx07.dll
2007-12-11 22:33 81,920 ----a-w C:\Windows\System32\dpl100.dll
2007-12-11 22:33 802,816 ----a-w C:\Windows\System32\divx_xx11.dll
2007-12-11 22:33 682,496 ----a-w C:\Windows\System32\DivX.dll
2007-12-11 22:33 593,920 ----a-w C:\Windows\System32\dpuGUI11.dll
2007-12-11 22:33 57,344 ----a-w C:\Windows\System32\dpv11.dll
2007-12-11 22:33 53,248 ----a-w C:\Windows\System32\dpuGUI10.dll
2007-12-11 22:33 344,064 ----a-w C:\Windows\System32\dpus11.dll
2007-12-11 22:33 294,912 ----a-w C:\Windows\System32\dpu11.dll
2007-12-11 22:33 294,912 ----a-w C:\Windows\System32\dpu10.dll
2007-12-11 22:33 196,608 ----a-w C:\Windows\System32\dtu100.dll
2007-12-11 22:32 156,992 ----a-w C:\Windows\System32\DivXCodecVersionChecker.exe
2007-12-11 22:32 12,288 ----a-w C:\Windows\System32\DivXWMPExtType.dll
2007-12-11 17:52 356,352 ----a-w C:\Windows\System32\nvuninst.exe
2007-12-10 17:37 88,576 ----a-w C:\Windows\System32\infocardapi.dll
2007-12-10 17:37 579,584 ----a-w C:\Windows\System32\icardagt.exe
2007-12-10 17:37 11,776 ----a-w C:\Windows\System32\icardres.dll
2007-12-10 17:36 779,800 ----a-w C:\Windows\System32\PresentationNative_v0300.dll
2007-12-10 17:36 350,744 ----a-w C:\Windows\System32\PresentationHost.exe
2007-12-10 17:36 33,304 ----a-w C:\Windows\System32\PresentationHostProxy.dll
2007-12-10 17:36 106,520 ----a-w C:\Windows\System32\PresentationCFFRasterizerNative_v0300.dll
2007-12-10 17:28 96,760 ----a-w C:\Windows\System32\dfshim.dll
2007-12-10 17:28 84,480 ----a-w C:\Windows\System32\mscories.dll
2007-12-10 17:28 41,984 ----a-w C:\Windows\System32\netfxperf.dll
2007-12-10 17:28 282,112 ----a-w C:\Windows\System32\mscoree.dll
2007-12-10 17:28 158,720 ----a-w C:\Windows\System32\mscorier.dll
2007-12-09 11:58 704,000 ----a-w C:\Windows\System32\PhotoScreensaver.scr
2007-12-09 11:58 67,584 ----a-w C:\Windows\System32\wlanhlp.dll
2007-12-09 11:58 542,720 ----a-w C:\Windows\System32\sysmain.dll
2007-12-09 11:58 502,784 ----a-w C:\Windows\System32\wlansvc.dll
2007-12-09 11:58 47,104 ----a-w C:\Windows\System32\wlanapi.dll
2007-12-09 11:58 297,984 ----a-w C:\Windows\System32\wlansec.dll
2007-12-09 11:58 290,816 ----a-w C:\Windows\System32\wlanmsm.dll
2007-12-09 11:58 24,064 ----a-w C:\Windows\System32\wtsapi32.dll
2007-12-09 11:58 2,923,520 ----a-w C:\Windows\explorer.exe
2007-12-09 11:58 2,027,008 ----a-w C:\Windows\System32\win32k.sys
2007-12-07 19:51 319,984 ----a-w C:\Windows\DIFxAPI.dll
2007-12-06 05:31 1,244,672 ----a-w C:\Windows\System32\mcmde.dll
2007-12-06 05:24 1,171,848 ----a-w C:\Windows\System32\SecureKeyBackupCPL.dll
.

(((((((((((((((((((((((((((( Autostart Punkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Hinweis* leere Eintrage & legitime Standardeintrage werden nicht angezeigt.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{81705D67-3F73-4983-859B-97D0922E5ABE}"= C:\Program Files\NetProject\wamdl.dll [ ]

[HKEY_CLASSES_ROOT\clsid\{81705d67-3f73-4983-859b-97d0922e5abe}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-09 22:43 1232896]
"WindowsWelcomeCenter"="oobefldr.dll" [2006-11-02 13:32 2159104 C:\Windows\System32\oobefldr.dll]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]
"EA Core"="C:\Program Files\Electronic Arts\EADM\Core.exe" [2007-12-04 05:57 2494464]
"Comrade.exe"="C:\Program Files\GameSpy\Comrade\Comrade.exe" [2007-06-29 15:03 36864]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2007-07-11 04:17 1006264]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2007-11-28 18:21 249896]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016]
"PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2007-08-07 01:05 200704]
"RtHDVCpl"="RtHDVCpl.exe" [2006-12-01 06:37 4186112 C:\Windows\RtHDVCpl.exe]
"JMB36X IDE Setup"="C:\Windows\JM\JMInsIDE.exe" [2006-10-30 13:44 36864]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"Updater"="C:\Windows\system32\updater\explorer.exe" [2007-11-24 14:08 1478612]
"ZSSnp211"="C:\Windows\ZSSnp211.exe" [2006-07-14 16:24 49152]
"Domino"="C:\Windows\Domino.exe" [2006-07-04 14:16 49152]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2006-09-14 21:09 157592]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2007-08-31 12:01 1037736]
"itype"="C:\Program Files\Microsoft IntelliType Pro\itype.exe" [2006-11-21 17:08 813912]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-12-11 17:06 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-12-11 17:06 8530464]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-12-11 17:06 81920]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-10 15:27 385024]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-01-15 03:22 267048]
"Ulead AutoDetector v2"="C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe" [2005-05-23 09:57 90112]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-02-09 19:47 185896]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312]
"NetFxUpdate_v1.1.4322"="C:\Windows\Microsoft.NET\Framework\v1.1.4322\netfxupdate.exe" [2004-08-10 16:20 106496]

R2 NMSAccessU;NMSAccessU;C:\Program Files\CDBurnerXP\NMSAccessU.exe [2007-10-12 08:34]
R2 SBSDWSCService;SBSD Security Center Service;C:\Program Files\Spybot []
R2 UxTuneUp;TuneUp Designerweiterung;C:\Windows\System32\svchost.exe [2006-11-02 10:45]
S0 OemBiosDevice;Royalty OEM Bios Extension;C:\Windows\system32\drivers\royal.sys [2007-12-04 18:57]
S3 Steam Client Service;Steam Client Service;C:\Program Files\Common Files\Steam\SteamService.exe [2008-01-11 06:18]
S3 TuneUp.Defrag;TuneUp Drive Defrag-Dienst;C:\Windows\System32\TuneUpDefragService.exe [2007-12-17 19:30]
S3 ZSMC211;USB PC Camera (ZS211);C:\Windows\system32\Drivers\ZS211.sys [2006-07-25 11:47]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

.
Inhalt des "geplante Tasks" Ordners
"2008-02-08 19:36:31 C:\Windows\Tasks\1-Klick-Wartung.job"
- C:\Program Files\TuneUp Utilities 2008\OneClick.exe
"2008-02-20 10:00:02 C:\Windows\Tasks\User_Feed_Synchronization-{C97E9A21-FFA1-4DA0-B495-34A110A6016C}.job"
- C:\Windows\system32\msfeedssync.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-20 14:22:28
Windows 6.0.6000 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostart Einträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
Zeit der Fertigstellung: 2008-02-20 14:23:11
ComboFix-quarantined-files.txt 2008-02-20 13:23:09
ComboFix2.txt 2008-02-20 10:32:26
ComboFix3.txt 2008-02-17 20:52:05
.
2008-02-19 17:28:23 --- E O F ---
Seitenanfang Seitenende
19.02.2008, 14:31
Ehrenmitglied
Avatar Pinguin

Beiträge: 1441
#10 alles noch da... du hast das script nicht korrekt angewendet.
schau dir noch mal genau an, wie es gemacht wird.
__________
Gruss
Pinguin

bin dabei, meine Seite + Proggies zu aktualisieren: http://www.virus-protect.org/
Seitenanfang Seitenende
19.02.2008, 14:58
Member

Themenstarter

Beiträge: 67
#11 kann doch net sein... hab des script von hier kopiert... in editor eingefügt
name: cfscript.txt speichern unter desktop, format alle datein.
mit der RECHTEN MAUSTASTE des script auf combofix.exe gezogen und gestartet. hab gewartet bis der rechner neu gestartet hat, dann verschwand nach dem neustart das script und ich sollte dann nochmal combofix starten und 1 tippen und nochmal neustarten... also ich hab alles ausgeführt wie es sein muss... und in hijackthis sind die 4 sachen auch nicht zu finden!

und hier die explorer exe...

AhnLab-V3 2008.2.19.1 2008.02.19 -
AntiVir 7.6.0.67 2008.02.19 -
Authentium 4.93.8 2008.02.19 -
Avast 4.7.1098.0 2008.02.18 -
AVG 7.5.0.516 2008.02.19 -
BitDefender 7.2 2008.02.19 -
CAT-QuickHeal 9.50 2008.02.18 -
ClamAV 0.92.1 2008.02.19 -
DrWeb 4.44.0.09170 2008.02.19 -
eSafe 7.0.15.0 2008.02.17 Suspicious Archive Structure
eTrust-Vet 31.3.5548 2008.02.19 -
Ewido 4.0 2008.02.18 -
FileAdvisor 1 2008.02.19 -
Fortinet 3.14.0.0 2008.02.19 -
F-Prot 4.4.2.54 2008.02.18 -
F-Secure 6.70.13260.0 2008.02.19 -
Ikarus T3.1.1.20 2008.02.19 -
Kaspersky 7.0.0.125 2008.02.19 -
McAfee 5232 2008.02.18 -
Microsoft 1.3204 2008.02.19 -
NOD32v2 2886 2008.02.19 error - password-protected file
Norman 5.80.02 2008.02.19 -
Panda 9.0.0.4 2008.02.19 -
Prevx1 V2 2008.02.19 Heuristic: Suspicious File With Bad Child Associations
Rising 20.32.12.00 2008.02.19 -
Sophos 4.26.0 2008.02.19 -
Sunbelt 3.0.884.0 2008.02.19 -
Symantec 10 2008.02.19 -
TheHacker 6.2.9.223 2008.02.18 -
VBA32 3.12.6.1 2008.02.17 -
VirusBuster 4.3.26:9 2008.02.19 -
Webwasher-Gateway 6.6.2 2008.02.19 -
Dieser Beitrag wurde am 19.02.2008 um 15:13 Uhr von Spire editiert.
Seitenanfang Seitenende
19.02.2008, 15:58
Ehrenmitglied
Avatar Pinguin

Beiträge: 1441
#12 nun gut..poste das neue Log von Combofix ... mal sehen ;)
__________
Gruss
Pinguin

bin dabei, meine Seite + Proggies zu aktualisieren: http://www.virus-protect.org/
Seitenanfang Seitenende
19.02.2008, 16:18
Member

Themenstarter

Beiträge: 67
#13 Logfile of HijackThis v1.99.1
Scan saved at 16:16:48, on 20.02.2008
Platform: Unknown Windows (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16609)

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Windows\RtHDVCpl.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Windows\ZSSnp211.exe
C:\Windows\Domino.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Ulead Systems\AutoDetector\Monitor.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Electronic Arts\EADM\Core.exe
C:\Program Files\GameSpy\Comrade\Comrade.exe
C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\Micke\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~2\ICQTOO~1\toolbaru.dll
O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\PROGRA~2\ICQTOO~1\toolbaru.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~2\ICQTOO~1\toolbaru.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\Windows\JM\JMInsIDE.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Updater] C:\Windows\system32\updater\explorer.exe
O4 - HKLM\..\Run: [ZSSnp211] C:\Windows\ZSSnp211.exe
O4 - HKLM\..\Run: [Domino] C:\Windows\Domino.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Ulead AutoDetector v2] C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [EA Core] "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent
O4 - HKCU\..\Run: [Comrade.exe] C:\Program Files\GameSpy\Comrade\Comrade.exe
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O13 - Gopher Prefix:
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~2\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: @%SystemRoot%\ehome\ehstart.dll,-101 (ehstart) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)

combo:



ComboFix 08-02-17.2 - Micke 2008-02-20 14:16:52.5 - NTFSx86
Microsoft® Windows Vista™ Ultimate 6.0.6000.0.1252.1.1031.18.1202 [GMT 1:00]
ausgeführt von:: C:\Users\Micke\Desktop\ComboFix.exe
.

((((((((((((((((((((((( Dateien erstellt von 2008-01-20 bis 2008-02-20 ))))))))))))))))))))))))))))))
.

2008-02-18 19:18 . 2008-02-18 19:18 <DIR> d-------- C:\Program Files\GameSpy
2008-02-18 19:16 . 2008-02-18 19:16 <DIR> d-------- C:\Windows\System32\URTTEMP
2008-02-18 19:13 . 2008-02-18 19:13 669,184 --a------ C:\Windows\System32\pbsvc.exe
2008-02-16 20:40 . 2008-02-16 20:40 <DIR> d-------- C:\Users\Micke\AppData\Roaming\Grisoft
2008-02-16 20:37 . 2008-02-16 20:37 <DIR> d-------- C:\Users\All Users\Grisoft
2008-02-16 20:37 . 2008-02-16 20:37 <DIR> d-------- C:\ProgramData\Grisoft
2008-02-16 20:37 . 2007-05-30 13:10 10,872 --a------ C:\Windows\System32\drivers\AvgAsCln.sys
2008-02-16 11:10 . 2008-02-20 14:01 <DIR> d-------- C:\Program Files\NetProject
2008-02-13 22:27 . 2008-02-13 22:27 1,585,664 --a------ C:\Windows\System32\setupapi.dll
2008-02-13 22:26 . 2008-02-13 22:26 943,800 --a------ C:\Windows\System32\winload.exe
2008-02-13 22:26 . 2008-02-13 22:26 905,400 --a------ C:\Windows\System32\winresume.exe
2008-02-13 22:26 . 2008-02-13 22:26 595,456 --a------ C:\Windows\System32\schedsvc.dll
2008-02-13 22:26 . 2008-02-13 22:26 115,200 --a------ C:\Windows\System32\loadperf.dll
2008-02-13 22:26 . 2008-02-13 22:26 39,424 --a------ C:\Windows\System32\lodctr.exe
2008-02-13 22:26 . 2008-02-13 22:26 32,256 --a------ C:\Windows\System32\unlodctr.exe
2008-02-13 22:26 . 2008-02-13 22:26 23,552 --a------ C:\Windows\System32\nshhttp.dll
2008-02-13 22:26 . 2008-02-13 22:26 17,408 --a------ C:\Windows\System32\prflbmsg.dll
2008-02-13 22:24 . 2008-02-13 22:24 803,328 --a------ C:\Windows\System32\drivers\tcpip.sys
2008-02-13 22:24 . 2008-02-13 22:24 216,632 --a------ C:\Windows\System32\drivers\netio.sys
2008-02-13 22:24 . 2008-02-13 22:24 167,424 --a------ C:\Windows\System32\tcpipcfg.dll
2008-02-13 22:24 . 2008-02-13 22:24 24,064 --a------ C:\Windows\System32\netcfg.exe
2008-02-13 22:24 . 2008-02-13 22:24 22,016 --a------ C:\Windows\System32\netiougc.exe
2008-02-13 16:08 . 2008-02-13 16:08 <DIR> d-------- C:\Program Files\Bethesda Softworks
2008-02-12 06:17 . 2008-02-12 06:17 <DIR> d-------- C:\Users\Micke\AppData\Roaming\Electronic Arts
2008-02-11 06:56 . 2008-02-12 17:28 <DIR> d-------- C:\Program Files\freeshard_launcher
2008-02-11 06:55 . 2008-02-11 06:55 253,952 --------- C:\Windows\Setup1.exe
2008-02-11 06:55 . 2008-02-11 06:55 74,752 --a------ C:\Windows\ST6UNST.EXE
2008-02-11 06:08 . 2008-02-18 18:43 <DIR> d-------- C:\Dark Age of Camelot - Catacombs
2008-02-10 21:24 . 2008-02-10 21:23 691,545 --a------ C:\Windows\unins000.exe
2008-02-10 21:24 . 2008-02-10 21:24 3,442 --a------ C:\Windows\unins000.dat
2008-02-09 19:47 . 2008-02-09 19:47 <DIR> d-------- C:\Program Files\Real
2008-02-09 19:47 . 2008-02-09 19:47 <DIR> d-------- C:\Program Files\Common Files\xing shared
2008-02-09 19:47 . 2008-02-09 19:47 <DIR> d-------- C:\Program Files\Common Files\Real
2008-02-09 19:47 . 2008-02-09 19:47 499,712 --a------ C:\Windows\System32\msvcp71.dll
2008-02-09 11:44 . 2008-02-09 11:44 250,143 --a------ C:\DSC00096.JPG
2008-02-09 11:07 . 2008-02-09 11:07 <DIR> d-------- C:\Windows\ulead.dat
2008-02-09 11:07 . 2008-02-09 19:31 511 --a------ C:\Windows\ulead32.ini
2008-02-09 11:06 . 2008-02-09 11:06 <DIR> d-------- C:\Program Files\Ulead Systems
2008-02-09 11:06 . 2008-02-09 11:06 <DIR> d-------- C:\Program Files\Common Files\Ulead Systems
2008-02-09 11:05 . 2008-02-09 11:06 <DIR> d-------- C:\Users\All Users\Ulead Systems
2008-02-09 11:05 . 2008-02-09 11:06 <DIR> d-------- C:\ProgramData\Ulead Systems
2008-02-09 10:57 . 2008-02-09 10:57 <DIR> d-------- C:\Program Files\Funcom
2008-02-07 15:16 . 2008-02-07 15:16 <DIR> d-------- C:\Users\All Users\GRAW2
2008-02-07 15:16 . 2008-02-07 15:16 <DIR> d-------- C:\ProgramData\GRAW2
2008-02-07 14:53 . 2008-02-07 14:53 <DIR> d-------- C:\Program Files\UBISOFT
2008-01-31 03:02 . 2008-01-31 03:02 54,608 --a------ C:\Windows\System32\xfcodec.dll
2008-01-30 22:02 . 2008-01-30 22:02 <DIR> d-------- C:\Program Files\iTunes
2008-01-30 22:02 . 2008-01-30 22:02 <DIR> d-------- C:\Program Files\iPod
2008-01-30 22:01 . 2008-01-30 22:01 <DIR> d-------- C:\Program Files\Bonjour
2008-01-30 22:00 . 2008-01-30 22:01 <DIR> d-------- C:\Program Files\QuickTime
2008-01-30 21:17 . 2008-01-30 21:17 <DIR> d-------- C:\Y.D.T
2008-01-30 21:16 . 2008-01-30 21:21 <DIR> d-------- C:\Program Files\E.M. Youtube Video Download Tool
2008-01-30 19:53 . 2008-01-30 19:53 <DIR> d-------- C:\skin ogame
2008-01-28 22:24 . 2008-01-28 22:24 <DIR> d-------- C:\Users\Micke\AppData\Roaming\LPECommon
2008-01-28 22:23 . 2008-01-28 22:40 <DIR> d-------- C:\SWGEmu
2008-01-28 22:23 . 2008-01-29 14:42 <DIR> d-------- C:\Program Files\Launchpad Enhanced
2008-01-28 21:15 . 2008-02-07 15:24 <DIR> d-------- C:\Program Files\StarWarsGalaxies
2008-01-28 21:15 . 2008-01-28 21:15 <DIR> d-------- C:\Program Files\Sony
2008-01-25 19:54 . 2008-01-25 19:54 <DIR> d-------- C:\Windows\EffectResources
2008-01-25 19:54 . 2008-01-25 19:54 <DIR> d-------- C:\Windows\CatRoot
2008-01-25 19:54 . 2008-01-25 19:54 <DIR> d-------- C:\Program Files\Vimicro
2008-01-25 19:54 . 2000-10-31 12:00 307,200 --a------ C:\Windows\vidcap32.Exe
2008-01-25 19:54 . 2006-07-14 14:33 57,344 --a------ C:\Windows\Sti211.exe
2008-01-25 19:54 . 2006-07-14 16:24 49,152 --a------ C:\Windows\ZSSnp211.exe
2008-01-25 19:54 . 2006-07-04 14:16 49,152 --a------ C:\Windows\Domino.exe
2008-01-25 19:17 . 2008-01-26 19:46 <DIR> d-------- C:\Users\Micke\AppData\Roaming\skypePM
2008-01-25 18:57 . 2008-01-26 19:56 <DIR> d-------- C:\Users\Micke\AppData\Roaming\Skype
2008-01-25 18:52 . 2008-01-25 18:52 <DIR> d-------- C:\Program Files\Skype
2008-01-25 18:52 . 2008-01-25 18:52 <DIR> d-------- C:\Program Files\Common Files\Skype
2008-01-23 19:28 . 2008-01-23 19:29 <DIR> d-------- C:\Program Files\Common Files\AVSMedia
2008-01-23 19:28 . 2008-01-23 19:28 <DIR> d-------- C:\Program Files\AVSMedia
2008-01-23 18:56 . 2008-01-23 18:56 <DIR> d-------- C:\Users\Micke\AppData\Roaming\Media Player Classic
2008-01-23 18:55 . 2004-01-11 23:00 348,160 --a------ C:\Windows\System32\msvcr71.dll
2008-01-20 13:36 . 2008-02-12 06:26 <DIR> d-------- C:\Program Files\CCP
2008-01-20 12:06 . 2008-01-20 12:08 <DIR> d-------- C:\xampp
2008-01-20 12:02 . 2006-04-13 11:30 1,073,152 --a------ C:\Windows\System32\libmysql_c.dll

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-18 18:16 --------- d-----w C:\Program Files\ICQToolbar
2008-02-18 18:13 22,328 ----a-w C:\Windows\system32\drivers\PnkBstrK.sys
2008-02-18 18:13 22,328 ----a-w C:\Users\Micke\AppData\Roaming\PnkBstrK.sys
2008-02-18 18:13 103,736 ----a-w C:\Windows\System32\PnkBstrB.exe
2008-02-18 18:12 --------- d-----w C:\ProgramData\Media Center Programs
2008-02-18 17:55 --------- d-----w C:\Program Files\Electronic Arts
2008-02-18 17:46 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-18 16:06 --------- d-----w C:\Users\Micke\AppData\Roaming\Azureus
2008-02-15 05:01 --------- d-----w C:\Users\Micke\AppData\Roaming\LimeWire
2008-02-13 21:25 --------- d-----w C:\ProgramData\Microsoft Help
2008-02-13 19:44 --------- d-----w C:\Users\Micke\AppData\Roaming\Xfire
2008-02-13 19:41 --------- d-----w C:\ProgramData\Xfire
2008-02-11 04:47 --------- d-----w C:\ProgramData\Spybot - Search & Destroy
2008-02-11 04:27 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-02-08 19:55 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-02-08 07:51 --------- d-----w C:\Program Files\Xfire
2008-02-07 14:04 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-02-07 14:04 --------- d-----w C:\Program Files\AGEIA Technologies
2008-01-28 20:14 --------- d-----w C:\Program Files\LucasArts
2008-01-25 22:11 --------- d-----w C:\ProgramData\NVIDIA
2008-01-25 17:52 --------- d-----w C:\ProgramData\Skype
2008-01-20 10:20 --------- d-----w C:\Users\Micke\AppData\Roaming\DivX
2008-01-17 06:11 --------- d-----w C:\Program Files\Common Files\Blizzard Entertainment
2008-01-17 05:48 --------- d-----w C:\Program Files\World of Warcraft
2008-01-14 19:28 --------- d-----w C:\Program Files\Wizards of the Coast
2008-01-13 14:59 --------- d-----w C:\Program Files\Common Files\SWF Studio
2008-01-11 11:55 --------- d-----w C:\Program Files\Common Files\Steam
2008-01-10 15:29 --------- d-----w C:\Program Files\Gadu-Gadu
2008-01-10 04:52 --------- d-----w C:\Program Files\Windows Sidebar
2008-01-09 21:43 11,776 ----a-w C:\Windows\System32\sbunattend.exe
2008-01-09 16:42 --------- d-----w C:\Users\Micke\AppData\Roaming\teamspeak2
2008-01-09 16:42 --------- d-----w C:\Program Files\Teamspeak2_RC2
2008-01-05 09:07 --------- d-----w C:\Users\Dana\AppData\Roaming\skypePM
2008-01-05 09:07 --------- d-----w C:\Users\Dana\AppData\Roaming\Skype
2008-01-05 09:02 --------- d-----w C:\Users\Dana\AppData\Roaming\Gadu-Gadu
2008-01-04 18:25 --------- d-----w C:\Users\Dana\AppData\Roaming\Apple Computer
2008-01-04 18:11 32 ----a-w C:\Users\All Users\ezsid.dat
2008-01-04 18:11 32 ----a-w C:\ProgramData\ezsid.dat
2008-01-04 18:05 --------- d-----w C:\Users\Micke\AppData\Roaming\Gadu-Gadu
2008-01-04 17:59 --------- d-----w C:\Users\Dana\AppData\Roaming\Talkback
2007-12-25 11:58 --------- d-----w C:\Program Files\Microsoft IntelliType Pro
2007-12-25 11:54 --------- d-----w C:\Program Files\Microsoft IntelliType Pro 5.3
2007-12-25 11:50 --------- d-----w C:\Program Files\Microsoft IntelliPoint
2007-12-24 16:02 --------- d-----w C:\Program Files\Azureus
2007-12-20 16:46 621,056 ----a-w C:\Windows\system32\drivers\dxgkrnl.sys
2007-12-20 16:46 36,864 ----a-w C:\Windows\System32\cdd.dll
2007-12-20 16:36 --------- d-----w C:\Program Files\DAEMON Tools
2007-12-20 15:13 --------- d-----w C:\Program Files\GIF Movie Gear
2007-12-19 21:48 107,888 ----a-w C:\Windows\System32\CmdLineExt.dll
2007-12-17 18:30 306,432 ----a-w C:\Windows\System32\TuneUpDefragService.exe
2007-12-13 15:34 66,872 ----a-w C:\Windows\System32\PnkBstrA.exe
2007-12-12 14:13 9,728 ----a-w C:\Windows\System32\LAPRXY.DLL
2007-12-12 14:13 223,232 ----a-w C:\Windows\System32\WMASF.DLL
2007-12-12 14:13 1,327,104 ----a-w C:\Windows\System32\quartz.dll
2007-12-12 14:10 3,504,824 ----a-w C:\Windows\System32\ntkrnlpa.exe
2007-12-12 14:10 3,470,520 ----a-w C:\Windows\System32\ntoskrnl.exe
2007-12-11 22:35 524,288 ----a-w C:\Windows\System32\DivXsm.exe
2007-12-11 22:34 3,596,288 ----a-w C:\Windows\System32\qt-dx331.dll
2007-12-11 22:34 200,704 ----a-w C:\Windows\System32\ssldivx.dll
2007-12-11 22:34 1,044,480 ----a-w C:\Windows\System32\libdivx.dll
2007-12-11 22:33 823,296 ----a-w C:\Windows\System32\divx_xx0c.dll
2007-12-11 22:33 823,296 ----a-w C:\Windows\System32\divx_xx07.dll
2007-12-11 22:33 81,920 ----a-w C:\Windows\System32\dpl100.dll
2007-12-11 22:33 802,816 ----a-w C:\Windows\System32\divx_xx11.dll
2007-12-11 22:33 682,496 ----a-w C:\Windows\System32\DivX.dll
2007-12-11 22:33 593,920 ----a-w C:\Windows\System32\dpuGUI11.dll
2007-12-11 22:33 57,344 ----a-w C:\Windows\System32\dpv11.dll
2007-12-11 22:33 53,248 ----a-w C:\Windows\System32\dpuGUI10.dll
2007-12-11 22:33 344,064 ----a-w C:\Windows\System32\dpus11.dll
2007-12-11 22:33 294,912 ----a-w C:\Windows\System32\dpu11.dll
2007-12-11 22:33 294,912 ----a-w C:\Windows\System32\dpu10.dll
2007-12-11 22:33 196,608 ----a-w C:\Windows\System32\dtu100.dll
2007-12-11 22:32 156,992 ----a-w C:\Windows\System32\DivXCodecVersionChecker.exe
2007-12-11 22:32 12,288 ----a-w C:\Windows\System32\DivXWMPExtType.dll
2007-12-11 17:52 356,352 ----a-w C:\Windows\System32\nvuninst.exe
2007-12-10 17:37 88,576 ----a-w C:\Windows\System32\infocardapi.dll
2007-12-10 17:37 579,584 ----a-w C:\Windows\System32\icardagt.exe
2007-12-10 17:37 11,776 ----a-w C:\Windows\System32\icardres.dll
2007-12-10 17:36 779,800 ----a-w C:\Windows\System32\PresentationNative_v0300.dll
2007-12-10 17:36 350,744 ----a-w C:\Windows\System32\PresentationHost.exe
2007-12-10 17:36 33,304 ----a-w C:\Windows\System32\PresentationHostProxy.dll
2007-12-10 17:36 106,520 ----a-w C:\Windows\System32\PresentationCFFRasterizerNative_v0300.dll
2007-12-10 17:28 96,760 ----a-w C:\Windows\System32\dfshim.dll
2007-12-10 17:28 84,480 ----a-w C:\Windows\System32\mscories.dll
2007-12-10 17:28 41,984 ----a-w C:\Windows\System32\netfxperf.dll
2007-12-10 17:28 282,112 ----a-w C:\Windows\System32\mscoree.dll
2007-12-10 17:28 158,720 ----a-w C:\Windows\System32\mscorier.dll
2007-12-09 11:58 704,000 ----a-w C:\Windows\System32\PhotoScreensaver.scr
2007-12-09 11:58 67,584 ----a-w C:\Windows\System32\wlanhlp.dll
2007-12-09 11:58 542,720 ----a-w C:\Windows\System32\sysmain.dll
2007-12-09 11:58 502,784 ----a-w C:\Windows\System32\wlansvc.dll
2007-12-09 11:58 47,104 ----a-w C:\Windows\System32\wlanapi.dll
2007-12-09 11:58 297,984 ----a-w C:\Windows\System32\wlansec.dll
2007-12-09 11:58 290,816 ----a-w C:\Windows\System32\wlanmsm.dll
2007-12-09 11:58 24,064 ----a-w C:\Windows\System32\wtsapi32.dll
2007-12-09 11:58 2,923,520 ----a-w C:\Windows\explorer.exe
2007-12-09 11:58 2,027,008 ----a-w C:\Windows\System32\win32k.sys
2007-12-07 19:51 319,984 ----a-w C:\Windows\DIFxAPI.dll
2007-12-06 05:31 1,244,672 ----a-w C:\Windows\System32\mcmde.dll
2007-12-06 05:24 1,171,848 ----a-w C:\Windows\System32\SecureKeyBackupCPL.dll
.

(((((((((((((((((((((((((((( Autostart Punkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Hinweis* leere Eintrage & legitime Standardeintrage werden nicht angezeigt.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{81705D67-3F73-4983-859B-97D0922E5ABE}"= C:\Program Files\NetProject\wamdl.dll [ ]

[HKEY_CLASSES_ROOT\clsid\{81705d67-3f73-4983-859b-97d0922e5abe}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-09 22:43 1232896]
"WindowsWelcomeCenter"="oobefldr.dll" [2006-11-02 13:32 2159104 C:\Windows\System32\oobefldr.dll]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]
"EA Core"="C:\Program Files\Electronic Arts\EADM\Core.exe" [2007-12-04 05:57 2494464]
"Comrade.exe"="C:\Program Files\GameSpy\Comrade\Comrade.exe" [2007-06-29 15:03 36864]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2007-07-11 04:17 1006264]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2007-11-28 18:21 249896]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016]
"PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2007-08-07 01:05 200704]
"RtHDVCpl"="RtHDVCpl.exe" [2006-12-01 06:37 4186112 C:\Windows\RtHDVCpl.exe]
"JMB36X IDE Setup"="C:\Windows\JM\JMInsIDE.exe" [2006-10-30 13:44 36864]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"Updater"="C:\Windows\system32\updater\explorer.exe" [2007-11-24 14:08 1478612]
"ZSSnp211"="C:\Windows\ZSSnp211.exe" [2006-07-14 16:24 49152]
"Domino"="C:\Windows\Domino.exe" [2006-07-04 14:16 49152]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2006-09-14 21:09 157592]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2007-08-31 12:01 1037736]
"itype"="C:\Program Files\Microsoft IntelliType Pro\itype.exe" [2006-11-21 17:08 813912]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-12-11 17:06 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-12-11 17:06 8530464]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-12-11 17:06 81920]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-10 15:27 385024]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-01-15 03:22 267048]
"Ulead AutoDetector v2"="C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe" [2005-05-23 09:57 90112]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-02-09 19:47 185896]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312]
"NetFxUpdate_v1.1.4322"="C:\Windows\Microsoft.NET\Framework\v1.1.4322\netfxupdate.exe" [2004-08-10 16:20 106496]

R2 NMSAccessU;NMSAccessU;C:\Program Files\CDBurnerXP\NMSAccessU.exe [2007-10-12 08:34]
R2 SBSDWSCService;SBSD Security Center Service;C:\Program Files\Spybot []
R2 UxTuneUp;TuneUp Designerweiterung;C:\Windows\System32\svchost.exe [2006-11-02 10:45]
S0 OemBiosDevice;Royalty OEM Bios Extension;C:\Windows\system32\drivers\royal.sys [2007-12-04 18:57]
S3 Steam Client Service;Steam Client Service;C:\Program Files\Common Files\Steam\SteamService.exe [2008-01-11 06:18]
S3 TuneUp.Defrag;TuneUp Drive Defrag-Dienst;C:\Windows\System32\TuneUpDefragService.exe [2007-12-17 19:30]
S3 ZSMC211;USB PC Camera (ZS211);C:\Windows\system32\Drivers\ZS211.sys [2006-07-25 11:47]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

.
Inhalt des "geplante Tasks" Ordners
"2008-02-08 19:36:31 C:\Windows\Tasks\1-Klick-Wartung.job"
- C:\Program Files\TuneUp Utilities 2008\OneClick.exe
"2008-02-20 10:00:02 C:\Windows\Tasks\User_Feed_Synchronization-{C97E9A21-FFA1-4DA0-B495-34A110A6016C}.job"
- C:\Windows\system32\msfeedssync.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-20 14:22:28
Windows 6.0.6000 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostart Einträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
Zeit der Fertigstellung: 2008-02-20 14:23:11
ComboFix-quarantined-files.txt 2008-02-20 13:23:09
ComboFix2.txt 2008-02-20 10:32:26
ComboFix3.txt 2008-02-17 20:52:05
.
2008-02-19 17:28:23 --- E O F ---
Seitenanfang Seitenende
19.02.2008, 23:46
Ehrenmitglied
Avatar Pinguin

Beiträge: 1441
#14 ««

arbeite ab, wie hier beschrieben:
http://virus-protect.org/artikel/tools/otmoveIt.html

reinkopieren:

Zitat

C:\Program Files\NetProject

nach Neustart poste den report, der erscheint

-------

leider kann ich damit die Werte in der Registry nicht löschen..schade, dass du es mit der Combofix nicht gebacken bekommst ;)
__________
Gruss
Pinguin

bin dabei, meine Seite + Proggies zu aktualisieren: http://www.virus-protect.org/
Seitenanfang Seitenende
Um auf dieses Thema zu ANTWORTEN
bitte erst » hier kostenlos registrieren!!

Folgende Themen könnten Dich auch interessieren: