Taskleiste meldet Virus Alert!

#1 HILFE!

Meine Taskleiste zeigt die Meldung VIRUS ALERT! neben der Uhrzeit!
HILFE was tun?

hab gestartet mit dem Cleaner und nun läuft combofix

und dan ??.... Hilfe

#2 gurkenpapst

««
wende Cleaner an + lösche alle temporären Dateien
http://www.ccleaner.de/?protecus.de

««
scanne mit Malwarebytes + poste den report
http://virus-protect.org/artikel/tools/malwarebytes.html

««
wende Combofix an , klicke die Warnmeldung weg + poste hier den kompletten Report
http://virus-protect.org/artikel/tools/combofix.html

-----------

dann, am Schluss der Reinigung musst du folgendes abarbeiten:
http://board.protecus.de/t33739.htm

sonst funktionieren die WindowsUpdates nicht mehr....
__________
MfG Sabina

rund um die PC-Sicherheit

#3 Malwarebytes' Anti-Malware 1.18
Datenbank Version: 875

22:36:24 21.06.2008
mbam-log-6-21-2008 (22-36-24).txt

Scan Art: Komplett Scan (C:\|D:\|E:\|F:\|)
Objekte gescannt: 228785
Scan Dauer: 1 hour(s), 0 minute(s), 48 second(s)

Infizierte Speicher Prozesse: 0
Infizierte Speicher Module: 0
Infizierte Registrierungsschlüssel: 17
Infizierte Registrierungswerte: 4
Infizierte Datei Objekte der Registrierung: 8
Infizierte Verzeichnisse: 1
Infizierte Dateien: 22

Infizierte Speicher Prozesse:
(Keine Malware Objekte gefunden)

Infizierte Speicher Module:
(Keine Malware Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7c4bcd17-bdba-4078-9d8c-8ca8b7eabe77} (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{ba7545e4-a565-47b7-aeec-1264756daf62} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{37d14133-5724-49fe-83a2-5eb82b01e31c} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{5dccfacb-668f-4215-a5f9-98849d8766d5} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{f8bbdd2e-deab-4e50-9eab-41b0d3ad0a9b} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{89f5f5fd-143c-419e-98c2-266c68b526d9} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{9afb8248-617f-460d-9366-d71cdeda3179} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{4221bcb3-d7d8-4af3-a0ff-64a9f6a48e67} (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{17ed1247-f0e5-4498-8d13-87c64550114c} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{860e2925-fad4-4be9-848c-e96b52a41351} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\webvideo (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{e4dcbead-d329-4eab-9c5d-09dace8ca679} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e4dcbead-d329-4eab-9c5d-09dace8ca679} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\vrmdtneg.blbx (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\vrmdtneg.toolbar.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WebVideo (Trojan.Fakealert) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinSpywareProtect (Rogue.Installer) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0\Source (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{860e2925-fad4-4be9-848c-e96b52a41351} (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Infizierte Datei Objekte der Registrierung:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductId (Trojan.FakeAlert) -> Bad: (VIRUS ALERT!) Good: (76497-OEM-0011903-00846) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\International\sTimeFormat (Trojan.FakeAlert) -> Bad: (HH:mm: VIRUS ALERT!) Good: (HH:mm:ss) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuMorePrograms (Hijack.StartMenu) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\StartMenuLogOff (Hijack.StartMenu) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoToolbarCustomize (Hijack.Explorer) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetFolders (Hijack.Explorer) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\NoDispCPL (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Infizierte Verzeichnisse:
C:\Programme\SpyGuarder (Rogue.SpyGuarder) -> Quarantined and deleted successfully.

Infizierte Dateien:
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ADSL Software Ltd\WinSpywareProtect\winspywareprotect.exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\media\Anwendungsdaten\spyguarder.exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\Programme\SpyGuarder\redir.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\wpvmqosg.dll (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Programme\SpyGuarder\Buy.url (Rogue.SpyGuarder) -> Quarantined and deleted successfully.
C:\Programme\SpyGuarder\Help.url (Rogue.SpyGuarder) -> Quarantined and deleted successfully.
C:\Programme\SpyGuarder\HowToBuy.txt (Rogue.SpyGuarder) -> Quarantined and deleted successfully.
C:\Programme\SpyGuarder\License.txt (Rogue.SpyGuarder) -> Quarantined and deleted successfully.
C:\Programme\SpyGuarder\Uninstall.exe (Rogue.SpyGuarder) -> Quarantined and deleted successfully.
C:\WINDOWS\xvorfwbd.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\vrmdtneg.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\neltabxw.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\ksendlbtvnl.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\Für Alle\Desktop\Spyware&Malware Protection.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\Für Alle\Desktop\Privacy Protector.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\Für Alle\Desktop\Error Cleaner.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\media\Favoriten\Error Cleaner.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\Für Alle\Favoriten\Error Cleaner.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\media\Favoriten\Privacy Protector.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\Für Alle\Favoriten\Privacy Protector.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\media\Favoriten\Spyware&Malware Protection.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\Für Alle\Favoriten\Spyware&Malware Protection.url (Rogue.Link) -> Quarantined and deleted successfully.




ComboFix 08-06-20.4 - media 2008-06-21 22:40:44.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1031.18.1354 [GMT 2:00]
ausgeführt von:: C:\Dokumente und Einstellungen\media\Desktop\ComboFix.exe
* Neuer Wiederherstellungspunkt wurde erstellt

[color=red]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/color]
.

(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Dokumente und Einstellungen\media\Anwendungsdaten\inst.exe
C:\WINDOWS\eson.exe
D:\Autorun.inf
E:\Autorun.inf
F:\Autorun.inf

.
((((((((((((((((((((((( Dateien erstellt von 2008-05-21 bis 2008-06-21 ))))))))))))))))))))))))))))))
.

2008-06-21 21:32 . 2008-06-21 21:32 <DIR> d-------- C:\Dokumente und Einstellungen\media\Anwendungsdaten\Malwarebytes
2008-06-21 21:31 . 2008-06-21 21:31 <DIR> d-------- C:\Programme\Malwarebytes' Anti-Malware
2008-06-21 21:31 . 2008-06-21 21:31 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
2008-06-21 21:31 . 2008-06-19 17:48 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-21 21:31 . 2008-06-19 17:47 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-06-21 21:22 . 2008-06-21 21:22 <DIR> d-------- C:\Programme\CCleaner
2008-06-20 18:53 . 2008-06-20 18:53 <DIR> d-------- C:\Programme\Trend Micro
2008-06-20 18:35 . 2008-06-20 18:40 <DIR> d-------- C:\Dokumente und Einstellungen\media\SmitfraudFix
2008-06-20 17:08 . 2008-06-20 17:08 <DIR> d-------- C:\Dokumente und Einstellungen\media\Anwendungsdaten\TuneUp Software
2008-06-20 17:08 . 2008-06-20 17:08 355,584 --a------ C:\WINDOWS\system32\TuneUpDefragService.exe
2008-06-20 17:08 . 2008-05-29 09:28 28,416 --a------ C:\WINDOWS\system32\uxtuneup.dll
2008-06-20 17:07 . 2008-06-20 17:08 <DIR> d-------- C:\Programme\TuneUp Utilities 2008
2008-06-20 17:07 . 2008-06-20 17:07 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TuneUp Software
2008-06-20 17:03 . 2008-06-20 17:54 <DIR> d--h----- C:\WINDOWS\system32\GroupPolicy
2008-06-20 16:16 . 2008-06-20 16:16 <DIR> d-------- C:\Dokumente und Einstellungen\Für Alle\Anwendungsdaten\TmpRecentIcons
2008-06-20 15:42 . 2008-06-20 15:42 62,910 --a------ C:\Programme\Uninstall.exe
2008-06-20 15:42 . 2008-06-20 15:42 0 --a------ C:\Programme\uninstall.dat
2008-06-20 15:32 . 2008-06-20 15:32 <DIR> d-------- C:\Programme\CleanUp!
2008-06-20 15:18 . 2008-06-20 15:18 <DIR> d-------- C:\Programme\ClearProg
2008-06-20 14:42 . 2008-06-20 14:42 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ADSL Software Ltd
2008-06-16 16:44 . 2008-06-16 16:44 <DIR> d-------- C:\WINDOWS\DA0BF7AB88EB46758FA1531EAD938821.TMP
2008-06-16 16:30 . 2008-06-16 16:30 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TechSmith
2008-06-16 16:29 . 2008-06-16 16:29 <DIR> d-------- C:\Programme\TechSmith
2008-06-16 16:28 . 2008-06-20 17:07 <DIR> d-------- C:\Programme\Gemeinsame Dateien\Wise Installation Wizard
2008-06-11 14:45 . 2008-06-14 19:57 273,024 --------- C:\WINDOWS\system32\drivers\bthport.sys
2008-06-11 14:45 . 2008-06-14 19:57 273,024 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-06-01 01:40 . 2008-06-01 01:40 0 --a------ C:\WINDOWS\pcfriend.INI
2008-05-22 21:21 . 2008-05-22 21:21 <DIR> d-------- C:\Programme\Octoshape Streaming Services

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-21 19:18 --------- d-----w C:\Programme\Morpheus
2008-06-21 19:16 --------- d-----w C:\Dokumente und Einstellungen\media\Anwendungsdaten\Skype
2008-06-21 19:15 --------- d-----w C:\Dokumente und Einstellungen\media\Anwendungsdaten\AdobeUM
2008-06-20 14:51 --------- d-----w C:\Programme\Winamp
2008-06-20 13:30 --------- d-----w C:\Dokumente und Einstellungen\media\Anwendungsdaten\DeepBurner
2008-06-19 15:22 --------- d-----w C:\Dokumente und Einstellungen\media\Anwendungsdaten\Azureus
2008-06-17 14:38 --------- d-----w C:\Programme\Picasa2
2008-06-14 20:59 --------- d-----w C:\Programme\Windows Live Safety Center
2008-06-12 14:05 --------- d-----w C:\Programme\AVS4YOU
2008-06-11 18:02 --------- d-----w C:\Dokumente und Einstellungen\media\Anwendungsdaten\BearShare
2008-06-07 17:57 2,598 ----a-w C:\Dokumente und Einstellungen\media\Anwendungsdaten\wklnhst.dat
2008-06-06 18:26 --------- d-----w C:\Programme\Burn4Free
2008-05-30 17:57 --------- d-----w C:\Programme\SopCast
2008-05-29 18:54 --------- d-----w C:\Programme\LimeWire
2008-05-29 17:54 --------- d-----w C:\Programme\Messenger Plus! Live
2008-05-25 19:22 --------- d-----w C:\Dokumente und Einstellungen\media\Anwendungsdaten\dvdcss
2008-05-19 10:17 --------- d-----w C:\Dokumente und Einstellungen\Für Alle\Anwendungsdaten\BearShare
2008-05-12 20:20 --------- d-----w C:\Programme\UltraStar
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-05-07 04:55 1,293,824 ----a-w C:\WINDOWS\system32\quartz.dll
2008-05-02 13:06 --------- d-----w C:\Programme\vanBasco's Karaoke Player
2008-04-30 17:28 --------- d-----w C:\Programme\NokiaFREE Unlock Codes Calculator
2008-04-21 06:56 672,256 ----a-w C:\WINDOWS\system32\wininet.dll
2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:51 187,168 ----a-w C:\WINDOWS\system32\msjint40.dll
2007-11-15 16:42 47,360 ----a-w C:\Dokumente und Einstellungen\media\Anwendungsdaten\pcouffin.sys
2007-09-05 18:15 630 ----a-w C:\Programme\Winamp.lnk
.

(((((((((((((((((((((((((((( Autostart Punkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Hinweis* leere Eintrage & legitime Standardeintrage werden nicht angezeigt.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4f3ed5cd-0726-42a9-87f5-d13f3d2976ac}]
2007-12-17 12:12 56360 --a------ C:\Programme\Windows Live\Family Safety\fssbho.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D187A56B-A33F-4CBE-9D77-459FC0BAE012}]
2008-03-05 22:39 806912 --a------ C:\Programme\Burn4Free Toolbar\v3.3.0.1\Burn4Free_Toolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{4F11ACBB-393F-4C86-A214-FF3D0D155CC3}"= "C:\Programme\Burn4Free Toolbar\v3.3.0.1\Burn4Free_Toolbar.dll" [2008-03-05 22:39 806912]

[HKEY_CLASSES_ROOT\clsid\{4f11acbb-393f-4c86-a214-ff3d0d155cc3}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{4F11ACBB-393F-4C86-A214-FF3D0D155CC3}"= C:\Programme\Burn4Free Toolbar\v3.3.0.1\Burn4Free_Toolbar.dll [2008-03-05 22:39 806912]

[HKEY_CLASSES_ROOT\clsid\{4f11acbb-393f-4c86-a214-ff3d0d155cc3}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-24 14:00 15360]
"MsnMsgr"="C:\Programme\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 12:34 5724184]
"Skype"="C:\Programme\Skype\Phone\Skype.exe" [2006-12-18 18:32 25365032]
"swg"="C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-05 12:44 68856]
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [ ]
"LogitechSoftwareUpdate"="C:\Programme\Logitech\Video\ManifestEngine.exe" [2005-06-08 15:44 196608]
"SweetIM"="C:\Programme\Macrogaming\SweetIM\SweetIM.exe" [2006-12-27 17:53 73840]
"DAEMON Tools"="C:\Programme\DAEMON Tools\daemon.exe" [2006-11-12 12:48 157592]
"Performance Center"="C:\Programme\Ascentive\Performance Center\ApcMain.exe" [ ]
"Voipwise"="C:\Programme\Voipwise.com\Voipwise\Voipwise.exe" [ ]
"Orb"="C:\Programme\Winamp Remote\bin\OrbTray.exe" [2007-12-18 03:02 471040]
"Veoh"="C:\Programme\Veoh Networks\Veoh\VeohClient.exe" [2008-04-01 18:35 3587120]
"Octoshape Streaming Services"="C:\Programme\Octoshape Streaming Services\media\OctoshapeClient.exe" [2006-02-13 18:33 214648]
"updateMgr"="C:\Programme\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 17:45 313472]
"WMPNSCFG"="C:\Programme\Windows Media Player\WMPNSCFG.exe" [2006-10-24 20:05 204288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-09-29 14:01 67584]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-07-12 13:19 7626752]
"nwiz"="nwiz.exe" [2006-07-12 13:19 1519616 C:\WINDOWS\system32\nwiz.exe]
"MedionVFD"="C:\Programme\Medion Info Display\MdionLCM.exe" [2006-04-17 16:04 184320]
"avgnt"="C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" [2008-04-18 15:01 262401]
"ChelloDesktop"="C:\Programme\chello\ChelloDesktop.exe" [ ]
"ChelloBackground"="C:\Programme\chello\ChelloMessenger.exe" [ ]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2005-07-19 18:32 221184]
"LogitechVideoRepair"="C:\Programme\Logitech\Video\ISStart.exe" [2005-06-08 16:24 458752]
"LogitechVideoTray"="C:\Programme\Logitech\Video\LogiTray.exe" [2005-06-08 16:14 217088]
"BearFlix"="C:\Programme\BearFlix\BearFlix.exe" [ ]
"RTHDCPL"="RTHDCPL.EXE" [2006-04-17 15:34 16143872 C:\WINDOWS\RTHDCPL.exe]
"DAEMON Tools"="C:\Programme\DAEMON Tools\daemon.exe" [2006-11-12 12:48 157592]
"ScanSoft OmniPage SE 4.0-reminder"="C:\Programme\ScanSoft\OmniPageSE4.0\Ereg\Ereg.exe" [ ]
"iTunesHelper"="C:\Programme\iTunes\iTunesHelper.exe" [2007-06-01 16:51 257088]
"Ulead Quick-Drop"="C:\Programme\Ulead Systems\Ulead DVD MovieFactory 5 Plus\Ulead DVD MovieFactory 5\Ulead DVD MovieFactory 5\Quick-Drop.exe" [2006-07-20 03:04 118784]
"QuickTime Task"="C:\Programme\QuickTime\qttask.exe" [2007-12-11 11:56 286720]
"WinampAgent"="C:\Programme\Winamp\winampa.exe" [2007-12-20 17:16 37376]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-07-12 13:19 86016]
"fssui"="C:\Programme\Windows Live\Family Safety\fssui.exe" [2007-12-17 12:12 243240]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-03-24 14:00 15360]
"Picasa Media Detector"="C:\Programme\Picasa2\PicasaMediaDetector.exe" [2008-02-26 03:23 443968]

C:\Dokumente und Einstellungen\media\Startmen�\Programme\Autostart\
Morpheus.lnk - C:\Programme\Morpheus\Morpheus.exe [2007-11-14 20:58:18 785920]

C:\Dokumente und Einstellungen\All Users\Startmen�\Programme\Autostart\
Adobe Reader - Schnellstart.lnk - C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 23:05:26 29696]
Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-11-10 21:24:29 67128]
SnagIt 8.lnk - C:\Programme\TechSmith\SnagIt 8\SnagIt32.exe [2007-05-16 10:39:16 6395464]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableChangePassword"= 1 (0x1)
"DisableLockWorkstation"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoLogoff"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.I420"= i420vfw.dll
"msacm.mpegacm"= mpegacm.acm
"msacm.ulmp3acm"= ulmp3acm.acm
"msacm.dvacm"= C:\PROGRA~1\GEMEIN~1\ULEADS~1\vio\dvacm.acm
"vidc.yv12"= yv12vfw.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"C:\\Programme\\Messenger\\msmsgs.exe"=
"C:\\WINDOWS\\system32\\fxsclnt.exe"=
"C:\\Programme\\NetMeeting\\Conf.exe"=
"C:\\Programme\\Counterstrike Source\\Cs-Source\\hl2.exe"=
"C:\\StubInstaller.exe"=
"C:\\Programme\\LimeWire\\LimeWire.exe"=
"C:\\Programme\\BearShare Applications\\BearShare\\BearShare.exe"=
"C:\\Programme\\uTorrent\\uTorrent.exe"=
"C:\\Programme\\SopCast\\SopCast.exe"=
"C:\\Dokumente und Einstellungen\\media\\Anwendungsdaten\\SopCast\\adv\\SopAdver.exe"=
"C:\\Programme\\Internet Explorer\\IEXPLORE.EXE"=
"C:\\Programme\\iTunes\\iTunes.exe"=
"C:\\Programme\\Azureus\\Azureus.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"C:\\Programme\\Morpheus\\Morpheus.exe"=
"C:\\WINDOWS\\system32\\dplaysvr.exe"=
"C:\\Programme\\Winamp Remote\\bin\\Orb.exe"=
"C:\\Programme\\Winamp Remote\\bin\\OrbTray.exe"=
"C:\\Programme\\Winamp Remote\\bin\\OrbStreamerClient.exe"=
"C:\\Programme\\Techland\\GTI Racing\\GTIRacing.exe"=
"C:\\Programme\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Programme\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Programme\\Veoh Networks\\Veoh\\VeohClient.exe"=
"C:\\Programme\\Octoshape Streaming Services\\media\\OctoshapeClient.exe"=
"C:\\Programme\\SopCast\\adv\\SopAdver.exe"=
"C:\\Programme\\Skype\\Phone\\Skype.exe"=

R2 fssfltr;FssFltr;C:\WINDOWS\system32\DRIVERS\fssfltr.sys [2007-10-17 14:53]
R2 fsssvc;Windows Live OneCare Family Safety;"C:\Programme\Windows Live\Family Safety\fsssvc.exe" [2007-12-17 12:13]
R2 UxTuneUp;TuneUp Designerweiterung;C:\WINDOWS\System32\svchost.exe [2006-03-24 14:00]
R3 3xHybrid;Philips SAA713x PCI Card;C:\WINDOWS\system32\DRIVERS\3xHybrid.sys [2006-04-28 16:34]
R3 X10Hid;X10 Hid Device;C:\WINDOWS\system32\Drivers\x10hid.sys [2005-11-28 10:45]
S3 NB762_XP;NB 802.11g XG762 1211B Driver;C:\WINDOWS\system32\DRIVERS\WlanUZXP.sys [2006-06-07 08:46]
S3 REMOVE;REMOVE;C:\WINDOWS\system32\drivers\REMOVE.SYS []
S3 TuneUp.Defrag;TuneUp Drive Defrag-Dienst;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-06-20 17:08]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

*Newly Created Service* - CATCHME
.
Inhalt des "geplante Tasks" Ordners
"2008-06-21 20:00:01 C:\WINDOWS\Tasks\1-Klick-Wartung.job"
- C:\Programme\TuneUp Utilities 2008\OneClickStarter.exe
"2008-06-19 19:33:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Programme\Apple Software Update\SoftwareUpdate.exe
"2008-06-21 20:18:02 C:\WINDOWS\Tasks\Auf Updates für Windows Live Toolbar prüfen.job"
- C:\Programme\Windows Live Toolbar\MSNTBUP.EXE
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-21 22:45:15
Windows 5.1.2600 Service Pack 2 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostart Einträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
Zeit der Fertigstellung: 2008-06-21 22:46:46
ComboFix-quarantined-files.txt 2008-06-21 20:46:25

19 Verzeichnis(se), 8,621,969,408 Bytes frei
21 Verzeichnis(se), 11,081,895,936 Bytes frei

214 --- E O F --- 2008-06-19 21:17:42

#4 Hallo, Dina_2712

««
http://virus-protect.org/artikel/tools/otmoveIt.html
Download OTMoveIt zum Desktop

OTMoveIt öffne: OTMoveIt.exe
OTMoveIt Kopiere rein: im linken Fenster ,wo steht: Paste List of Files/Folders to Move

Zitat

C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ADSL Software Ltd

Klicke auf den Roten MoveIt!

-------------------------------------------------------------------------

««
ComboFix entfernen
Start - Ausführen - Kopiere rein: Combofix /U
- klicke "OK"

««
dann, am Schluss der Reinigung musst du folgendes abarbeiten:
http://board.protecus.de/t33739.htm

versuche dann also die Windowsupdates zu machen + berichte, ob es klappt.
+
meide: SpyGuarder - ist ein gefälschtes Tool.
__________
MfG Sabina

rund um die PC-Sicherheit

#5 Hat alles geklappt. Es passt wieder alles.

VIELEN, VIELEN DANK