Laptop jetz sauber?

#1 Hallo,

hatte ein problem mit einem vundo trojaner, hab dann combofix laufen lassen und wäre euch sehr verbunden wenn mir irgendjemand darüber schauen könnte. Will nur wissen ob jetzt alles sauber ist. Kenn mich nicht sonderlich gut aus.

ComboFix 08-07-02.3 - Jenny 2008-07-03 11:32:39.2 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1031.18.1946 [GMT 2:00]
ausgeführt von:: C:\Users\Jenny\Desktop\ComboFix.exe
.

(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\ProgramData\Microsoft\Network\Downloader\qmgr0.dat
C:\ProgramData\Microsoft\Network\Downloader\qmgr1.dat
C:\Windows\system32\KBL.LOG

----- BITS: Possible infected sites -----

hxxp://ftp.hp.com
.
((((((((((((((((((((((( Dateien erstellt von 2008-06-03 bis 2008-07-03 ))))))))))))))))))))))))))))))
.


2008-07-02 14:29 . 2008-07-02 14:29 <DIR> dr-h----- C:\MSOCache
2008-07-02 13:25 . 2008-07-03 00:00 <DIR> d-------- C:\Users\Jenny\AppData\Roaming\Ahead
2008-07-02 13:25 . 2008-07-02 13:25 <DIR> d-------- C:\Users\All Users\Ahead
2008-07-02 13:25 . 2008-07-02 13:25 <DIR> d-------- C:\ProgramData\Ahead
2008-07-02 13:20 . 2008-07-02 13:24 <DIR> d-------- C:\Program Files\Common Files\Ahead
2008-07-02 12:15 . 2008-02-28 13:26 1,414,440 --a------ C:\Windows\System32\ShellManager310E2D762.dll
2008-07-02 12:15 . 2008-02-28 13:01 774,144 --a------ C:\Windows\System32\NEROINSTAEC43759.DB
2008-07-02 12:15 . 2008-07-02 12:15 0 --a------ C:\Windows\Irremote.ini
2008-07-02 11:07 . 2008-07-03 11:03 <DIR> d-------- C:\Users\Jenny\AppData\Roaming\Winamp
2008-07-02 11:07 . 2008-07-02 11:07 <DIR> d-------- C:\Program Files\Winamp
2008-07-01 21:36 . 1997-11-19 14:49 303,616 --a------ C:\Windows\IsUninst.exe
2008-07-01 21:04 . 2008-07-01 21:04 <DIR> d-------- C:\TMOTM
2008-07-01 21:03 . 2008-07-01 21:13 <DIR> d-------- C:\Program Files\Das Geheimnis der Mumie
2008-07-01 19:11 . 2008-07-01 22:27 <DIR> d-------- C:\Users\Jenny\AppData\Roaming\DivX
2008-07-01 19:10 . 2008-07-02 11:50 <DIR> d-------- C:\Program Files\DivX
2008-07-01 19:10 . 2008-07-02 11:38 <DIR> d-------- C:\Program Files\Common Files\PX Storage Engine
2008-06-30 20:56 . 2008-06-30 20:56 <DIR> d-------- C:\Program Files\Pop Art Studio 3.0
2008-06-30 00:56 . 2008-06-30 00:56 <DIR> d-------- C:\Program Files\NeroInstall.bak
2008-06-30 00:54 . 2008-06-30 00:54 <DIR> d-------- C:\Users\Jenny\AppData\Roaming\Nero
2008-06-30 00:52 . 2008-07-02 13:20 <DIR> d-------- C:\Users\All Users\Nero
2008-06-30 00:52 . 2008-07-02 13:20 <DIR> d-------- C:\ProgramData\Nero
2008-06-30 00:52 . 2008-07-02 13:20 <DIR> d-------- C:\Program Files\Nero
2008-06-30 00:52 . 2008-07-02 12:16 <DIR> d-------- C:\Program Files\Common Files\Nero
2008-06-28 19:27 . 2008-06-28 19:27 <DIR> d-------- C:\Users\All Users\Elaborate Bytes
2008-06-28 19:27 . 2008-06-28 19:27 <DIR> d-------- C:\ProgramData\Elaborate Bytes
2008-06-27 17:51 . 2008-06-27 17:51 <DIR> d--h----- C:\Users\All Users\CanonBJ
2008-06-27 17:51 . 2008-06-27 17:51 <DIR> d--h----- C:\ProgramData\CanonBJ
2008-06-27 00:38 . 2008-06-27 01:03 <DIR> d-------- C:\Program Files\SimPE
2008-06-25 15:32 . 2008-06-25 19:49 <DIR> d-------- C:\Users\Jenny\AppData\Roaming\My Games
2008-06-25 15:28 . 2008-06-25 15:28 <DIR> d-------- C:\Users\Jenny\AppData\Roaming\Template
2008-06-25 15:28 . 2008-06-25 15:28 0 --a------ C:\Users\Jenny\AppData\Roaming\wklnhst.dat
2008-06-25 15:15 . 2008-06-25 15:15 <DIR> d-------- C:\Program Files\Firaxis Games
2008-06-25 12:31 . 2008-06-25 12:31 <DIR> d-------- C:\Program Files\CCleaner
2008-06-24 22:02 . 2008-06-24 22:02 0 --a------ C:\Windows\oodcnt.INI
2008-06-24 18:57 . 2008-06-24 19:15 <DIR> d-------- C:\Windows\System32\oodag
2008-06-24 18:51 . 2008-06-24 18:51 <DIR> d-------- C:\Program Files\OO Software
2008-06-24 18:07 . 2008-06-24 18:07 <DIR> d-------- C:\Users\All Users\Avira
2008-06-24 18:07 . 2008-06-24 18:07 <DIR> d-------- C:\ProgramData\Avira
2008-06-24 18:07 . 2008-06-24 18:07 <DIR> d-------- C:\Program Files\Avira
2008-06-24 14:41 . 2008-06-24 14:41 2,126,624 --a------ C:\Windows\keinohrhase_screensaver.scr
2008-06-23 15:44 . 2008-07-03 11:04 40,056 --a------ C:\Windows\System32\OODBS.lor
2008-06-23 13:23 . 2008-06-11 02:07 129,784 --------- C:\Windows\System32\pxafs.dll
2008-06-22 23:29 . 2008-06-28 17:56 <DIR> d-------- C:\Users\Jenny\AppData\Roaming\ICQ
2008-06-22 23:29 . 2008-06-22 23:33 <DIR> d-------- C:\Program Files\ICQ6
2008-06-22 23:28 . 2008-06-22 23:28 <DIR> d-------- C:\Users\Jenny\AppData\Roaming\InstallShield
2008-06-22 09:26 . 2008-07-02 22:21 <DIR> dr------- C:\Users\Jenny\Jenny´s Musik
2008-06-21 18:04 . 2008-06-21 18:04 <DIR> d-------- C:\Users\Jenny\AppData\Roaming\Magic Academy
2008-06-21 11:58 . 2008-06-21 11:59 <DIR> d-------- C:\Program Files\Paint.NET
2008-06-20 18:44 . 2008-06-20 21:36 <DIR> d-------- C:\CloneDVDTemp
2008-06-20 18:34 . 2008-06-20 18:34 <DIR> d-------- C:\Program Files\Elaborate Bytes
2008-06-20 12:34 . 2008-06-20 12:34 <DIR> d-------- C:\Users\Jenny\AppData\Roaming\PlayFirst
2008-06-20 10:08 . 2008-06-20 18:40 48 --------- C:\Windows\S9F9CD3C7.tmp
2008-06-20 10:08 . 2008-06-20 18:40 48 --ahs---- C:\Windows\S9F9CD3C7(169).tmp
2008-06-20 09:45 . 2008-06-20 09:45 194,560 --a------ C:\Windows\System32\WebClnt.dll
2008-06-20 09:45 . 2008-06-20 09:45 110,080 --a------ C:\Windows\System32\drivers\mrxdav.sys
2008-06-20 09:43 . 2008-06-20 09:43 1,060,920 --a------ C:\Windows\System32\drivers\ntfs.sys
2008-06-20 09:43 . 2008-06-20 09:43 41,984 --a------ C:\Windows\System32\drivers\monitor.sys
2008-06-20 09:39 . 2008-06-20 09:39 220,160 --a------ C:\Windows\System32\drivers\bthport.sys
2008-06-20 09:39 . 2008-06-20 09:39 181,760 --a------ C:\Windows\System32\fsquirt.exe
2008-06-20 09:39 . 2008-06-20 09:39 29,184 --a------ C:\Windows\System32\drivers\BTHUSB.SYS
2008-06-20 09:39 . 2008-06-20 09:39 19,456 --a------ C:\Windows\System32\drivers\bthenum.sys
2008-06-20 09:38 . 2008-06-20 09:38 1,585,664 --a------ C:\Windows\System32\setupapi.dll
2008-06-20 09:36 . 2008-06-20 09:36 2,027,008 --a------ C:\Windows\System32\win32k.sys
2008-06-20 09:35 . 2008-06-20 09:35 296,448 --a------ C:\Windows\System32\gdi32.dll
2008-06-20 09:35 . 2008-06-20 09:35 113,664 --a------ C:\Windows\System32\drivers\rmcast.sys
2008-06-20 09:35 . 2008-06-20 09:35 14,848 --a------ C:\Windows\System32\wshrm.dll
2008-06-20 09:34 . 2008-06-20 09:34 11,776 --a------ C:\Windows\System32\sbunattend.exe
2008-06-20 09:33 . 2008-06-20 09:33 4,247,552 --a------ C:\Windows\System32\GameUXLegacyGDFs.dll
2008-06-20 09:33 . 2008-06-20 09:33 1,686,528 --a------ C:\Windows\System32\gameux.dll
2008-06-20 09:32 . 2008-06-20 09:32 1,327,104 --a------ C:\Windows\System32\quartz.dll
2008-06-20 09:32 . 2008-06-20 09:32 83,968 --a------ C:\Windows\System32\dnsrslvr.dll
2008-06-20 09:32 . 2008-06-20 09:32 24,576 --a------ C:\Windows\System32\dnscacheugc.exe
2008-06-20 09:31 . 2008-06-20 09:31 1,244,672 --a------ C:\Windows\System32\mcmde.dll
2008-06-20 09:31 . 2008-06-20 09:31 428,032 --a------ C:\Windows\System32\EncDec.dll
2008-06-20 09:31 . 2008-06-20 09:31 292,352 --a------ C:\Windows\System32\psisdecd.dll
2008-06-20 09:31 . 2008-06-20 09:31 218,624 --a------ C:\Windows\System32\psisrndr.ax
2008-06-20 09:31 . 2008-06-20 09:31 80,896 --a------ C:\Windows\System32\MSNP.ax
2008-06-20 09:31 . 2008-06-20 09:31 68,608 --a------ C:\Windows\System32\Mpeg2Data.ax
2008-06-20 09:31 . 2008-06-20 09:31 57,856 --a------ C:\Windows\System32\MSDvbNP.ax
2008-06-20 09:30 . 2008-06-20 09:30 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-06-20 09:28 . 2008-06-20 09:28 826,368 --a------ C:\Windows\System32\wininet.dll
2008-06-19 20:12 . 2007-09-19 22:05 1,073,152 --a------ C:\Windows\System32\nvcpluir.dll
2008-06-19 20:12 . 2007-09-19 22:05 753,664 --a------ C:\Windows\System32\nvcplui.exe
2008-06-19 20:12 . 2007-09-19 22:05 413,696 --a------ C:\Windows\System32\nvcpl.cpl
2008-06-19 20:12 . 2007-09-19 22:05 307,200 --a------ C:\Windows\System32\nvexpbar.dll
2008-06-19 20:08 . 2008-06-19 20:08 <DIR> d-------- C:\NVIDIA
2008-06-19 19:39 . 2008-06-19 19:39 <DIR> d-------- C:\Program Files\SystemRequirementsLab
2008-06-19 19:05 . 2008-07-02 01:22 27,335 --a------ C:\Users\Jenny\AppData\Roaming\nvModes.dat
2008-06-19 18:34 . 2008-06-19 18:34 <DIR> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller
2008-06-19 18:33 . 2008-06-19 18:33 <DIR> d-------- C:\Users\All Users\WLInstaller
2008-06-19 18:33 . 2008-06-19 18:33 <DIR> d-------- C:\ProgramData\WLInstaller
2008-06-19 18:33 . 2008-06-19 18:35 <DIR> d-------- C:\Program Files\Windows Live
2008-06-19 17:34 . 2008-06-19 17:34 <DIR> d-------- C:\Users\Jenny\AppData\Roaming\WildTangent
2008-06-19 17:11 . 2008-06-26 14:04 <DIR> d-------- C:\Program Files\EA GAMES
2008-06-19 17:11 . 2004-08-18 10:34 442,368 -ra------ C:\Windows\System32\vp6vfw.dll
2008-06-19 16:48 . 2008-06-19 16:48 <DIR> d-------- C:\Users\Public\CyberLink
2008-06-19 16:48 . 2008-06-19 16:48 <DIR> d-------- C:\Users\All Users\LightScribe
2008-06-19 16:48 . 2008-06-19 16:48 <DIR> d-------- C:\ProgramData\LightScribe
2008-06-19 15:14 . 2008-06-19 15:14 <DIR> d-------- C:\Users\Jenny\AppData\Roaming\HP
2008-06-19 15:14 . 2008-06-20 22:45 <DIR> d-------- C:\Users\Jenny\AppData\Roaming\CyberLink
2008-06-19 15:14 . 2008-06-19 15:14 <DIR> d-------- C:\Users\All Users\HP
2008-06-19 15:14 . 2008-06-19 15:14 <DIR> d-------- C:\ProgramData\HP
2008-06-19 15:02 . 2008-06-19 15:02 1,712,984 --a------ C:\Windows\System32\wuaueng.dll
2008-06-19 15:02 . 2008-06-19 15:02 1,524,224 --a------ C:\Windows\System32\wucltux.dll
2008-06-19 15:02 . 2008-06-19 15:02 53,080 --a------ C:\Windows\System32\wuauclt.exe
2008-06-19 15:02 . 2008-06-19 15:02 43,352 --a------ C:\Windows\System32\wups2.dll
2008-06-19 15:01 . 2008-06-19 15:01 549,720 --a------ C:\Windows\System32\wuapi.dll
2008-06-19 15:01 . 2008-06-19 15:01 163,000 --a------ C:\Windows\System32\wuwebv.dll
2008-06-19 15:01 . 2008-06-19 15:01 80,896 --a------ C:\Windows\System32\wudriver.dll
2008-06-19 15:01 . 2008-06-19 15:01 33,624 --a------ C:\Windows\System32\wups.dll
2008-06-19 15:01 . 2008-06-19 15:01 31,232 --a------ C:\Windows\System32\wuapp.exe
2008-06-19 14:43 . 2008-06-19 14:43 3,682 --a------ C:\Windows\System32\ealregsnapshot1.reg
2008-06-19 14:14 . 2008-06-19 14:14 <DIR> d-------- C:\Users\Jenny\Bluetooth Software
2008-06-19 14:13 . 2008-06-19 14:13 <DIR> d-------- C:\Users\Jenny\AppData\Roaming\Symantec
2008-06-19 14:12 . 2008-06-19 14:12 <DIR> dr------- C:\Users\Jenny\Searches
2008-06-19 14:12 . 2008-06-19 15:37 <DIR> dr------- C:\Users\Jenny\Contacts
2008-06-19 14:12 . 2008-06-19 14:12 81 --a------ C:\Windows\System32\LOG
2008-06-19 14:12 . 2008-06-19 14:12 44 --a------ C:\Windows\system\hpsysdrv.dat
2008-06-19 14:05 . 2008-06-19 14:14 <DIR> d-------- C:\Users\Jenny\AppData\Roaming\Hewlett-Packard
2008-06-19 14:04 . 2008-06-19 14:04 <DIR> d-------- C:\Users\All Users\Electronic Arts

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-03 09:03 --------- d-----w C:\ProgramData\Microsoft Help
2008-07-02 12:40 --------- d-----w C:\Program Files\Microsoft Works
2008-07-02 12:13 --------- d-----w C:\Program Files\MSBuild
2008-07-01 17:03 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-01 17:03 --------- d-----w C:\Program Files\CyberLink
2008-06-23 17:33 --------- d-----w C:\ProgramData\CyberLink
2008-06-23 13:59 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-06-23 13:58 --------- d-----w C:\ProgramData\Symantec
2008-06-21 17:39 --------- d-----w C:\ProgramData\WildTangent
2008-06-20 08:16 --------- d-----w C:\Program Files\Windows Mail
2008-06-20 08:15 --------- d-----w C:\Program Files\Windows Sidebar
2008-06-20 07:37 944,184 ----a-w C:\Windows\System32\winload.exe
2008-06-20 07:33 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-06-20 07:33 449,536 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-06-20 07:33 2,560 ----a-w C:\Windows\AppPatch\AcRes.dll
2008-06-20 07:33 2,144,256 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-06-20 07:33 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-06-20 07:28 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-06-20 07:27 56,320 ----a-w C:\Windows\System32\iesetup.dll
2008-06-20 07:27 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
2008-06-19 18:59 --------- d-----w C:\ProgramData\NVIDIA
2008-06-19 12:45 --------- d-----w C:\Program Files\Hewlett-Packard
2008-06-19 12:14 --------- d-----w C:\ProgramData\Hewlett-Packard
2008-06-19 11:58 --------- d-----w C:\Program Files\HPQ
2008-06-19 11:51 --------- d-sh--w C:\ProgramData\Vorlagen
2008-06-19 11:51 --------- d-sh--w C:\ProgramData\Startmenü
2008-06-19 11:51 --------- d-sh--w C:\ProgramData\Favoriten
2008-06-19 11:51 --------- d-sh--w C:\ProgramData\Dokumente
2008-06-19 11:51 --------- d-sh--w C:\ProgramData\Anwendungsdaten
2008-06-19 11:51 --------- d-sh--w C:\Program Files\Gemeinsame Dateien
2008-05-10 01:44 --------- d-----w C:\Program Files\Online-Dienste
2008-05-10 01:44 --------- d-----w C:\Program Files\HP Games
2008-05-10 01:32 --------- d-----w C:\Program Files\Hp
2008-05-10 01:28 --------- d-----w C:\Program Files\WIDCOMM
2008-05-10 01:27 --------- d-----w C:\Program Files\WinTV
2008-05-10 01:26 --------- d-----w C:\ProgramData\Atheros
2008-05-10 01:26 --------- d-----w C:\Program Files\CONEXANT
2008-05-10 01:26 --------- d-----w C:\Program Files\Atheros
2008-05-10 01:24 --------- d-----w C:\Program Files\NetWaiting
2008-05-10 01:23 0 ---ha-w C:\Windows\system32\drivers\Msft_Kernel_SynTP_01000.Wdf
2008-05-10 01:22 --------- d-----w C:\Program Files\Synaptics
2008-02-22 14:05 174 --sha-w C:\Program Files\desktop.ini
.

(((((((((((((((((((((((((((( Autostart Punkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Hinweis* leere Eintrage & legitime Standardeintrage werden nicht angezeigt.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-06-20 09:34 1232896]
"LightScribe Control Panel"="C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-08-23 17:36 455968]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 14:35 125440]
"ICQ"="C:\Program Files\ICQ6\ICQ.exe" [2008-04-01 12:40 172280]
"WindowsWelcomeCenter"="oobefldr.dll" [2006-11-02 14:34 2159104 C:\Windows\System32\oobefldr.dll]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPStart"="C:\Program Files\Synaptics\SynTP\SynTPStart.exe" [2007-09-15 10:29 102400]
"QPService"="C:\Program Files\HP\QuickPlay\QPService.exe" [2007-09-30 19:34 181544]
"UCam_Menu"="C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2007-09-13 16:32 222504]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 04:06 40048]
"HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-17 00:11 49152]
"hpWirelessAssistant"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-09-13 09:47 480560]
"WAWifiMessage"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-08 16:53 311296]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 05:00 132496]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-09-19 22:05 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-09-19 22:05 8497696]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-09-19 22:05 81920]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-01-16 00:54 37376]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-12 10:06 262401]
"OODefragTray"="C:\Windows\system32\oodtray.exe" [2007-05-11 02:08 2512392]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 15:57 153136]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
BTTray.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-09-05 13:09:54 727592]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{B7948E02-8335-4290-A0F1-888D46440E7A}"= C:\Program Files\HP\QuickPlay\QP.exe:Quick Play
"{52BE1B09-1761-42B1-8D4F-DB2A06998ABE}"= C:\Program Files\HP\QuickPlay\QPService.exe:Quick Play Resident Program
"{42B24A0A-740C-423E-9522-0FB0140013B0}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{C1C902EC-E9A9-4677-9401-705E4D9A814D}C:\\program files\\icq6\\icq.exe"= UDP:C:\program files\icq6\icq.exe:ICQ Library
"UDP Query User{EF133874-87AE-4BA0-B857-1D2A4DF34FF5}C:\\program files\\icq6\\icq.exe"= TCP:C:\program files\icq6\icq.exe:ICQ Library
"TCP Query User{D04E2CC9-DC48-47C1-8A3C-A6A22CF90791}C:\\program files\\common files\\ahead\\nero web\\setupx.exe"= UDP:C:\program files\common files\ahead\nero web\setupx.exe:MSI starter
"UDP Query User{D2514164-1D04-4118-81BC-3C4B1FF6C3E8}C:\\program files\\common files\\ahead\\nero web\\setupx.exe"= TCP:C:\program files\common files\ahead\nero web\setupx.exe:MSI starter

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

R2 QPCapSvc;QuickPlay Background Capture Service (QBCS);"C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe" [2007-09-30 19:34]
R2 QPSched;QuickPlay Task Scheduler (QTS);"C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe" [2007-09-30 19:34]
R3 btwaudio;Bluetooth-Audiogerät;C:\Windows\system32\drivers\btwaudio.sys [2007-09-18 15:12]
R3 btwavdt;Bluetooth AVDT Service;C:\Windows\system32\drivers\btwavdt.sys [2007-09-18 15:12]
R3 btwrchid;btwrchid;C:\Windows\system32\DRIVERS\btwrchid.sys [2007-09-18 15:12]
R3 HpqRemHid;HP Remote Control HID Device;C:\Windows\system32\DRIVERS\HpqRemHid.sys [2007-07-11 10:30]
S3 GameConsoleService;GameConsoleService;"C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe" [2007-07-24 01:33]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ

*Newly Created Service* - CATCHME

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
.
- - - - ORPHANS REMOVED - - - -

BHO-{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
HKCU-Run-IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
HKLM-Run-HP Health Check Scheduler - [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
HKLM-Run-NBKeyScan - C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-03 11:35:03
Windows 6.0.6000 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostart Einträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
Zeit der Fertigstellung: 2008-07-03 11:36:09
ComboFix-quarantined-files.txt 2008-07-03 09:36:07

11 Verzeichnis(se), 154,346,184,704 Bytes frei
21 Verzeichnis(se), 159,357,005,824 Bytes frei

264 --- E O F --- 2008-06-24 16:05:17

#2 CombiFix entfernen
Start > Ausführen>Kopiere rein ComboFix /U OK

Malwarebytes Anti-Malware fuer Windows 2000,XP und Vista
Download MBAM
Doppelklick mbam-setup und waehle Deutsch ,das Program wird jetzt ge-updatet
Waehle bei Reiter “Scanner”> "Komplett Scan durchfuehren" .
Waehle alle Laufwerke>Scan laufen lassen
Wenn am Ende infizierungen gefunden werden,anhaacken und entfernen lassen
Unter Scanberichte stet das log (mbam-log-XX-XX-XXXX.txt)
Poste dessen inhalt hier ins Forum
Note:
Wenn MBAM Schwierigkeiten damit hat Daten zu entfernen wird es gemeldet und klicke OK
Danach wird gefragt den Rechner neu zu starten,lass es zu
Nehme als Update Spiegel >>It-mate.co.uk
Malwarebytes Anti-Malware kann man nachher behalten !

Download: Trend Micro Hijack This™
Doppelklick HJTInstall.exe und installiere das Tool in C:\Programme\Trend Micro\Hijack This
Am Ende steht auf dein Desktop eine verknüpfung

Starte Hijack This und klicke “Do a system scan and safe a logfile”
Save log --> hijackthis.log - Save - es öffnet sich der Editor
nun das KOMPLETTE Log mit rechtem Mausklick abkopieren und ins Forum mit rechtem Mausklick "einfügen"
__________
MfG Argus

#3 Hallo Arnold,

schonmal vielen Dank!
Hier ist erstmal das log von mbam, hat mir die datei gelöscht.

Gruß


Malwarebytes' Anti-Malware 1.19
Datenbank Version: 920
Windows 6.0.6000

10:24:25 04.07.2008
mbam-log-7-4-2008 (10-24-25).txt

Scan Art: Komplett Scan (C:\|D:\|)
Objekte gescannt: 170723
Scan Dauer: 36 minute(s), 6 second(s)

Infizierte Speicher Prozesse: 0
Infizierte Speicher Module: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Datei Objekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1

Infizierte Speicher Prozesse:
(Keine Malware Objekte gefunden)

Infizierte Speicher Module:
(Keine Malware Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine Malware Objekte gefunden)

Infizierte Registrierungswerte:
(Keine Malware Objekte gefunden)

Infizierte Datei Objekte der Registrierung:
(Keine Malware Objekte gefunden)

Infizierte Verzeichnisse:
(Keine Malware Objekte gefunden)

Infizierte Dateien:
C:\Users\Jenny\Documents\Installationsdateien\Keygen NEW.exe (Trojan.Agent) -> Quarantined and deleted successfully.




und hier das andere!



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:36:30, on 04.07.2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16681)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Program Files\Hp\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
C:\Program Files\Hp\HP Software Update\hpwuSchd2.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Windows\System32\oodtray.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\ICQ6\ICQ.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Internet Explorer\IEUser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=81&bd=Pavilion&pf=laptop
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [OnScreenDisplay] C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\1.0"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [OODefragTray] C:\Windows\system32\oodtray.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [ICQ] "C:\Program Files\ICQ6\ICQ.exe" silent
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O4 - Global Startup: BTTray.lnk = ?
O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O13 - Gopher Prefix:
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLL
O23 - Service: Avira AntiVir Personal – Free Antivirus Planer (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\Windows\system32\oodag.exe
O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 9069 bytes

#4 Java
Dein Java software ist veraltet,
Download jre-6u6-windows-i586-p.exe
Scrolle runter nach ----> Java Runtime Environment (JRE) 6 Update 6
Waehle bei Platform: dein OS
Haacke an :” I agree to the Java SE Runtime Environment 6 License Agreement”
Klicke: Continue
Haacke an : Windows Offline Installation
Download : jre-6u6-windows-i586-p.exe zum Desktop

Entferne ueber "Start -> Einstellungen -> Systemsteuerung -> Software
Die aeltere Versionen von Java Runtime Environment (JRE of J2SE)
Nachdem alles entfernt wurde --->Rechner neu starten
Schliesse alle Programme auch dein Webbrowser
Installiere jetzt vom Desktop aus ---> jre-6u6-windows-i586-p.exe

Adobe Reader
Am 24/06 gab es schon wieder eine Sicherheitslücke in Adobe Reader
Ich benutze jetzt Foxit Reader http://www.foxitsoftware.com/pdf/rd_intro.php
Man kann dazu ja noch viele Add-ons hinzu fuegen
__________
MfG Argus

#5 aber sonst is alles okay soweit, ja?

Ich danke dir

#6 Sauber
MBAM wird jeden Tag mehrmals ge-updated ist ein SUPER scanner
__________
MfG Argus

#7 alles klar vielen dank, hast mir echt supi geholfen!!!

aber eine frage hab ich noch, weiß nich ob das jetzt hier hin passt. Durch das combofix is der autostart vom laufwerk funktionsunfähig geworden, wie bekomm ich das rückgängig gemacht?

#8 welche Laufwerke ? DVD-Brenner oder CD-Room, USB-Stick ?
__________
MfG Sabina

rund um die PC-Sicherheit

#9 hallo sabina,

der lappi hat nur eins isn DVD-RW multi . Und die maus im usb erkennt er auch nimmer...

gruß

#10 Ausführen bei Vista : Windows Taste + R drücken

reinschreiben:

regedit

klicke dich durch zum Schlüssel:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Cdrom

Ändere auf der rechten Seite den Eintrag 'Autorun' von 0 auf 1
+
abspeichern + Rechner neustarten

--------------

dann installiere den Treiber für die Maus neu (siehe CD)
__________
MfG Sabina

rund um die PC-Sicherheit

#11 Also die Maus läuft jetz wieder ohne probleme.

Der autostart funktioniert allerdings noch immer nich=(