VIRUS ALERT hat sich aufmeinem PC

#1 virus alert hat sich eingenistet.Wer kann helfen?????
seit der virus sich eingenistet hat kann ich nicht mehr auf meine daten zurück greifen,wie bekommt man es weg

#2 Hallo, baerin33

wende cleaner an + lösche die temp-Dateien
http://www.ccleaner.de/?protecus.de

«
scanne mit Malwarebytes, lasse alles gefundene entfernen + poste den report
http://virus-protect.org/artikel/tools/malwarebytes.html

«
wende combofix an , warnmeldung wegklicken + poste hier den report
http://virus-protect.org/artikel/tools/combofix.html
__________
MfG Sabina

rund um die PC-Sicherheit

#3 hallo...bin heut das erste mal hier und ich versteh nur bahnhof xD hab auch das selbe problem -.-"
habe aber hier das Log-dingen von Malewarebytes...
Malwarebytes' Anti-Malware 1.20
Datenbank Version: 941
Windows 5.1.2600 Service Pack 2

23:08:22 11.07.2008
mbam-log-7-11-2008 (23-08-22).txt

Scan Art: Komplett Scan (C:\|D:\|)
Objekte gescannt: 105595
Scan Dauer: 47 minute(s), 2 second(s)

Infizierte Speicher Prozesse: 0
Infizierte Speicher Module: 3
Infizierte Registrierungsschlüssel: 22
Infizierte Registrierungswerte: 5
Infizierte Datei Objekte der Registrierung: 13
Infizierte Verzeichnisse: 0
Infizierte Dateien: 15

Infizierte Speicher Prozesse:
(Keine Malware Objekte gefunden)

Infizierte Speicher Module:
C:\WINDOWS\system32\pmnljHaw.dll (Trojan.Vundo) -> Unloaded module successfully.
C:\WINDOWS\system32\rciihdhc.dll (Trojan.Vundo) -> Unloaded module successfully.
C:\WINDOWS\system32\tuvVPffg.dll (Trojan.Vundo) -> Unloaded module successfully.

Infizierte Registrierungsschlüssel:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{953c2059-4df4-439e-8964-1440fae0babb} (Trojan.Vundo) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{953c2059-4df4-439e-8964-1440fae0babb} (Trojan.Vundo) -> Delete on reboot.
HKEY_CLASSES_ROOT\Interface\{68bb1169-2020-4738-bcba-6e9e1bbfc304} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{953da2f5-6918-4424-94fc-d21585ccce75} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{b8483a1e-e66b-44fa-a0dc-9e07093b17d1} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{fa268283-f681-4bfd-9a05-44e642777444} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{7f1b566d-5901-49f4-b02c-107f17746dc9} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{0d987fb6-2cb1-4189-b6a1-5e8185e9a899} (Rogue.Registry.Defender) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{9773dd4d-24e3-4b32-91bb-d252b9a544a8} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9773dd4d-24e3-4b32-91bb-d252b9a544a8} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{6cf0a05e-7d6b-4e00-b836-b3f23513657c} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6cf0a05e-7d6b-4e00-b836-b3f23513657c} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\tuvvpffg (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VSPlugin (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\sqvgnrpx.btfw (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\sqvgnrpx.toolbar.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\VB and VBA Program Settings\Registry Defender (Rogue.Registry.Defender) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\58cdc704 (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\0\source (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{6cf0a05e-7d6b-4e00-b836-b3f23513657c} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\fdxbameg (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\fsrpknov (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Infizierte Datei Objekte der Registrierung:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo) -> Data: c:\windows\system32\pmnljhaw -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\pmnljhaw -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductId (Trojan.FakeAlert) -> Bad: (VIRUS ALERT!) Good: (76416-OEM-0011903-00126) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\International\sTimeFormat (Trojan.FakeAlert) -> Bad: (HH:mm: VIRUS ALERT!) Good: (HH:mm:ss) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowControlPanel (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Not selected for removal.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowRun (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Not selected for removal.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowSearch (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Not selected for removal.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowHelp (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Not selected for removal.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowMyDocs (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Not selected for removal.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowMyComputer (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Not selected for removal.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\StartMenuLogOff (Hijack.StartMenu) -> Bad: (1) Good: (0) -> Not selected for removal.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives (Hijack.Drives) -> Bad: (12) Good: (0) -> Not selected for removal.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoToolbarCustomize (Hijack.Explorer) -> Bad: (1) Good: (0) -> Not selected for removal.

Infizierte Verzeichnisse:
(Keine Malware Objekte gefunden)

Infizierte Dateien:
C:\WINDOWS\system32\pmnljHaw.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\waHjlnmp.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\waHjlnmp.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\rciihdhc.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\chdhiicr.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\wbxdpgfeqod.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\elvr.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\WinLockDll.dll (Malware.Tool) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\jqwxmwaw.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\noqlnz.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\clbdll.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\tuvVPffg.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\qoMcddBu.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\uid.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\gpefaowr.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

das von combofix kommt noch.



So das is die Log datei von combofix:

ComboFix 08-07-11.1 - Fabian 2008-07-11 23:30:22.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1031.18.337 [GMT 2:00]
ausgeführt von:: C:\Dokumente und Einstellungen\Fabian\Desktop\ComboFix.exe
* Neuer Wiederherstellungspunkt wurde erstellt

[color=red]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/color]
.

(((((((((((((((((((((((((((((((((((( Weitere L”schungen ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\oeminfo.ini
C:\WINDOWS\system32\waHjlnmp.ini
C:\WINDOWS\system32\waHjlnmp.ini2
C:\WINDOWS\wl.exe
D:\Autorun.inf

.
((((((((((((((((((((((( Dateien erstellt von 2008-06-11 bis 2008-07-11 ))))))))))))))))))))))))))))))
.

2008-07-11 22:16 . 2008-07-11 22:16 <DIR> d-------- C:\Programme\Malwarebytes' Anti-Malware
2008-07-11 22:16 . 2008-07-11 22:16 <DIR> d-------- C:\Dokumente und Einstellungen\Fabian\Anwendungsdaten\Malwarebytes
2008-07-11 22:16 . 2008-07-11 22:16 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
2008-07-11 22:16 . 2008-07-07 17:35 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-07-11 22:16 . 2008-07-07 17:35 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-07-11 21:13 . 2008-07-11 21:13 <DIR> d-------- C:\Programme\Trend Micro
2008-07-11 20:27 . 2008-07-11 21:04 <DIR> d-------- C:\Programme\Registry Defender Platinum
2008-07-11 20:08 . 2008-07-11 20:08 181 --a------ C:\WINDOWS\wininit.ini
2008-07-11 19:01 . 2008-07-11 19:01 <DIR> d-------- C:\Programme\Spybot - Search & Destroy
2008-07-11 19:01 . 2008-07-11 21:41 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
2008-07-10 22:25 . 2008-07-11 23:35 664 --a------ C:\WINDOWS\system32\d3d9caps.dat
2008-07-10 22:17 . 2004-08-04 14:00 4,224 --a------ C:\WINDOWS\system32\beep.sys

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-11 21:36 --------- d-----w C:\Dokumente und Einstellungen\Fabian\Anwendungsdaten\Skype
2008-07-11 21:35 --------- d-----w C:\Programme\PestPatrol
2008-07-11 20:09 --------- d-----w C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Google Updater
2008-07-11 17:14 --------- d-----w C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TrackMania
2008-07-10 20:20 --------- d-----w C:\Programme\ICQToolbar
2008-07-06 13:27 --------- d-----w C:\Dokumente und Einstellungen\Fabian\Anwendungsdaten\teamspeak2
2008-06-05 19:11 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-06-03 11:52 --------- d-----w C:\Programme\GameSpy Arcade
2008-06-03 11:38 --------- d--h--w C:\Programme\InstallShield Installation Information
2008-06-03 11:38 --------- d-----w C:\Programme\EA GAMES
2008-05-25 13:28 --------- d-----w C:\Programme\Call of Duty
2008-05-25 10:11 --------- d-----w C:\Programme\TrackMania Nations ESWC
2007-07-07 16:50 25,600 ----a-w C:\Dokumente und Einstellungen\Fabian\usbsermptxp.sys
2007-07-07 16:50 22,768 ----a-w C:\Dokumente und Einstellungen\Fabian\usbsermpt.sys
2007-06-25 19:33 85,632 ----a-w C:\Dokumente und Einstellungen\Fabian\Anwendungsdaten\GDIPFONTCACHEV1.DAT
2006-01-28 08:53 8 --sh--r C:\WINDOWS\system32\363CCEFC6B.sys
2006-01-28 08:53 4,704 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

(((((((((((((((((((((((((((( Autostart Punkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Hinweis* leere Eintrage & legitime Standardeintrage werden nicht angezeigt.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="C:\Programme\Skype\Phone\Skype.exe" [2007-03-23 15:01 25268776]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 14:00 15360]
"WMPNSCFG"="C:\Programme\Windows Media Player\WMPNSCFG.exe" [2006-11-03 10:56 204288]
"ICQ"="C:\Programme\ICQ6\ICQ.exe" [2008-04-01 12:40 172280]
"SpybotSD TeaTimer"="C:\Programme\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 09:42 2156368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 14:00 59392]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 14:00 455168]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 14:00 455168]
"AntivirusRegistration"="C:\Programme\CA\Etrust Antivirus\Register.exe" [2005-08-22 23:05 258048]
"AOLDialer"="C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLDial.exe" [2004-11-09 22:36 497240]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 14:00 208952]
"SynTPEnh"="C:\Programme\Synaptics\SynTP\SynTPEnh.exe" [2005-10-28 18:58 761945]
"PestPatrolRegistration"="C:\Programme\PestPatrol\Register.exe" [2005-08-23 00:27 180224]
"PPMemCheck"="C:\PROGRA~1\PESTPA~1\PPMemCheck.exe" [2004-04-02 16:11 148480]
"CookiePatrol"="C:\PROGRA~1\PESTPA~1\CookiePatrol.exe" [2005-01-10 10:35 73728]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50 155648]
"RemoteControl"="C:\Programme\Home Cinema\PowerDVD\PDVDServ.exe" [2004-11-02 21:24 32768]
"PCMService"="C:\Programme\Home Cinema\PowerCinema\PCMService.exe" [2006-02-09 13:53 143360]
"iTunesHelper"="C:\Programme\iTunes\iTunesHelper.exe" [2004-12-18 01:20 278528]
"Google Desktop Search"="C:\Programme\Google\Google Desktop Search\GoogleDesktop.exe" [2007-07-26 21:38 1836544]
"avgnt"="C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" [2008-04-20 19:54 262401]
"QuickTime Task"="C:\Programme\QuickTime\qttask.exe" [2006-01-28 00:27 155648]
"Adobe Reader Speed Launcher"="C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 20:51 39792]
"TkBellExe"="C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" [2007-09-28 20:41 185632]
"SoundMan"="SOUNDMAN.EXE" [2005-12-14 19:06 577536 C:\WINDOWS\soundman.exe]
"AGRSMMSG"="AGRSMMSG.exe" [2004-07-22 14:38 88361 C:\WINDOWS\AGRSMMSG.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 14:00 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.mkdmp3enc"= C:\PROGRA~1\HOMECI~1\POWERC~1\Kernel\Burner\MKDMP3Enc.ACM
"wave2"= AvmSnd.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Programme\\Gemeinsame Dateien\\AOL\\ACS\\AOLDIAL.exe"=
"C:\\Programme\\Gemeinsame Dateien\\AOL\\ACS\\AOLACSD.exe"=
"C:\\Programme\\Call of Duty\\CoDMP.exe"=
"C:\\Programme\\iTunes\\iTunes.exe"=
"C:\\WINDOWS\\system32\\fxsclnt.exe"=
"C:\\Programme\\Ahead\\Nero MediaHome\\NeroMediaHome.exe"=
"C:\\Programme\\NetMeeting\\Conf.exe"=
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"C:\\Programme\\ICQ6\\ICQ.exe"=
"C:\\Programme\\EA GAMES\\Battlefield 2\\BF2.exe"=
"C:\\Programme\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
"AllowInboundRouterRequest"= 1 (0x1)

R1 wbsecdrv;wbsecdrv Protocol Driver;C:\WINDOWS\system32\DRIVERS\wbsecdrv.sys [2005-06-14 15:20]
R2 AVMPORT;AVMPORT;C:\WINDOWS\system32\drivers\avmport.sys [2001-10-23 01:00]
R2 NwSapAgent;SAP-Agent;C:\WINDOWS\system32\svchost.exe [2004-08-04 14:00]
R2 wbsecsvc;wbsecsvc;C:\WINDOWS\system32\wbsecsvc.exe [2005-04-30 16:40]
R3 W33ND;W89C33 mPCI 802.11 Wireless LAN Adapter Driver;C:\WINDOWS\system32\DRIVERS\W33ND.SYS [2005-07-26 19:00]
S3 3xHybrid;3xHybrid service;C:\WINDOWS\system32\DRIVERS\3xHybrid.sys [2005-11-18 15:02]
S3 ULI5261XP;ULi M526X Ethernet NT Driver;C:\WINDOWS\system32\DRIVERS\ULILAN51.SYS [2005-03-22 21:36]

.
- - - - ORPHANS REMOVED - - - -

Toolbar-{83B3FEA7-601A-4BB0-8D74-A819069A4CFA} - C:\WINDOWS\sqvgnrpx.dll
HKCU-Run-MSMSGS - C:\PROGRA~1\MESSEN~1\Msmsgs.exe
HKLM-Run-PestPatrol Control Center - C-\PROGRA~1\PESTPA~1\PPControl.exe
HKLM-Run-58cdc704 - C:\WINDOWS\system32\rciihdhc.dll
Notify-xpspqdvd - C:\WINDOWS\system32\xpspqdvd.dll


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-11 23:36:23
Windows 5.1.2600 Service Pack 2 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostart Eintr„ge...

Scanne versteckte Dateien...


**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\AvmSnd.dll

PROCESS: C:\WINDOWS\system32\lsass.exe
-> C:\WINDOWS\system32\AvmSnd.dll

PROCESS: C:\WINDOWS\explorer.exe
-> C:\WINDOWS\system32\AvmSnd.dll
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\Programme\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
C:\Programme\Gemeinsame Dateien\aol\ACS\AOLacsd.exe
C:\Programme\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\Programme\Home Cinema\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe
C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\Programme\CyberLink\Shared Files\RichVideo.exe
C:\Programme\Common Files\X10\Common\X10nets.exe
C:\Programme\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
C:\Programme\Windows Media Player\wmpnetwk.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\cmd.exe
C:\Programme\PestPatrol\PPMemCheck.exe
C:\Programme\PestPatrol\CookiePatrol.exe
C:\Programme\iPod\bin\iPodService.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2008-07-11 23:43:19 - machine was rebooted
ComboFix-quarantined-files.txt 2008-07-11 21:42:12

8 Verzeichnis(se), 42,941,059,072 Bytes frei
12 Verzeichnis(se), 42,862,706,688 Bytes frei

170

<><><><><><><><><><><><><><>
MFG king lui

#4 Hallo king lui
Malwarebytes hat schon alles sauber bekommen
kommen noch Popups ?

ComboFix entfernen
Start - Ausführen - Kopiere rein: Combofix /U
- klicke "OK"
__________
MfG Sabina

rund um die PC-Sicherheit

#5 Kompliment king lui !
Das war 'ne Punktlandung! ....und das gleich beim Einstand !!

#6 so..... Popups kommen nich... is das gut oder schlecht?
combofix is auch weg...
thx is ne verdammt informative seite!!!

aber wie erkennt man an den logs ob alles sauber is?

<><><><><><><><><><><><><><>
MFG king lui