Warning!Spyware detected on your computer!

#1 Hilfe! Ich war so blöd, den Anhang einer unbekannten Mail zu öffnen. Seitdem erscheint obige Meldung auf meinem Desktop. Mein Virenprogramm Antivir fand einige Viren und ein Spywareprogramm, stürzt aber jedes Mal gemeinsam mit dem gesamten Computer ab, bevor es den Suchlauf beenden kann. Habe mit CleanUP! den Computer gereinigt. Dann habe ich mir Hijackthis besorgt. Jetzt weiß ich nicht mehr weiter. Hier ist der komplette Log aus dem Editor:

Logfile of HijackThis v1.99.1
Scan saved at 13:35:05, on 12.07.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Programme\Gemeinsame Dateien\EPSON\EBAPI\SAgent2.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe
C:\Programme\SPAMfighter\sfus.exe
C:\WINDOWS\system32\atiptaxx.exe
C:\Programme\Apoint2K\Apoint.exe
C:\Programme\TOSHIBA\TouchPad\TPTray.exe
C:\Programme\TOSHIBA\Power Management\CePMTray.exe
C:\Programme\TOSHIBA\E-KEY\CeEKey.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\FreePDF_XP\fpassist.exe
C:\Programme\iTunes\iTunesHelper.exe
C:\Programme\QuickTime\qttask.exe
C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe
C:\Programme\Kyocera\FS-720 Utilities\KMGLNC.exe
C:\Programme\SPAMfighter\SFAgent.exe
C:\WINDOWS\system32\lphc1f0j0e371.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Messenger\msmsgs.exe
C:\Programme\Apoint2K\Apntex.exe
C:\Programme\WinZip\WZQKPICK.EXE
C:\Programme\Canon\CAL\CALMAIN.exe
C:\Programme\iPod\bin\iPodService.exe
C:\WINDOWS\System32\alg.exe
C:\Programme\ArcorOnline\AOButler.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\Dokumente und Einstellungen\Nicolas Dobra\Desktop\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.finderg.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.tiscali.de
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Arcor AG & Co. KG
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: (no name) - _{9337C435-655C-4B13-AB3F-2A9136BC9AA6} - (no file)
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\ntos.exe,
O2 - BHO: BHObj Class - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - C:\WINDOWS\nem220.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: BHObj Class - {8F4E5661-F99E-4B3E-8D85-0EA71C0748E4} - C:\WINDOWS\wsem303.dll (file missing)
O2 - BHO: BAHelper Class - {A3FDD654-A057-4971-9844-4ED8E67DBBB8} - C:\Programme\SideFind\sfbho13.dll (file missing)
O3 - Toolbar: ISTbar - {5F1ABCDB-A875-46c1-8345-B72A4567E486} - C:\PROGRA~1\ISTbar\istbar.dll (file missing)
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [Apoint] C:\Programme\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [TPNF] C:\Programme\TOSHIBA\TouchPad\TPTray.exe
O4 - HKLM\..\Run: [CeEPOWER] C:\Programme\TOSHIBA\Power Management\CePMTray.exe
O4 - HKLM\..\Run: [CeEKEY] C:\Programme\TOSHIBA\E-KEY\CeEKey.exe
O4 - HKLM\..\Run: [EPSON Stylus C62 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus C62 Series" /O5 "LPT1:" /M "Stylus C62"
O4 - HKLM\..\Run: [Microsoft WinUpdates] serm32.exe
O4 - HKLM\..\Run: [Win32 USB2 Driver] svchosting.exe
O4 - HKLM\..\Run: [RunDLL] rundll32.exe "C:\WINDOWS\Downloaded Program Files\bridge.dll",Load
O4 - HKLM\..\Run: [MBYF5] C:\WINDOWS\twvigb.exe
O4 - HKLM\..\Run: [b63h9bko] C:\WINDOWS\system32\b63h9bko.exe
O4 - HKLM\..\Run: [IST Service] C:\Programme\ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programme\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Launcher] C:\Programme\Kyocera\FS-720 Utilities\KMGLNC.exe
O4 - HKLM\..\Run: [SPAMfighter Agent] "C:\Programme\SPAMfighter\SFAgent.exe" update delay 60
O4 - HKLM\..\Run: [lphc1f0j0e371] C:\WINDOWS\system32\lphc1f0j0e371.exe
O4 - HKLM\..\Run: [SMrhc5f0j0e371] C:\Programme\rhc5f0j0e371\rhc5f0j0e371.exe
O4 - HKLM\..\RunServices: [Microsoft WinUpdates] serm32.exe
O4 - HKLM\..\RunServices: [Win32 USB2 Driver] svchosting.exe
O4 - HKLM\..\RunServices: [Registry Server] regsrv32.exe
O4 - HKLM\..\RunServices: [msn] msnmsg.exe
O4 - HKLM\..\RunServices: [System Main Functionality] systemtemp32.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Win32 USB2 Driver] svchosting.exe
O4 - HKCU\..\Run: [Registry Server] regsrv32.exe
O4 - HKCU\..\Run: [msn] msnmsg.exe
O4 - HKCU\..\Run: [System Main Functionality] systemtemp32.exe
O4 - HKCU\..\RunServices: [Registry Server] regsrv32.exe
O4 - HKCU\..\RunServices: [msn] msnmsg.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programme\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: SideFind - {10E42047-DEB9-4535-A118-B3F6EC39B807} - C:\Programme\SideFind\sidefind13.dll (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Programme\Internet Explorer\PLUGINS\nppdf32.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.tiscali.de
O17 - HKLM\System\CCS\Services\Tcpip\..\{762A7526-A21F-4358-8431-4BD004725283}: NameServer = 195.50.140.252 195.50.140.114
O18 - Filter: text/html - {6B8C0B4C-0AD4-4FF9-80A9-85BC3E39D369} - C:\Dokumente und Einstellungen\Nicolas Dobra\Lokale Einstellungen\Anwendungsdaten\microsoft\internet explorer\V0.26.dat
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Programme\Canon\CAL\CALMAIN.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Programme\Gemeinsame Dateien\EPSON\EBAPI\SAgent2.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: SPAMfighter Update Service - SPAMfighter ApS - C:\Programme\SPAMfighter\sfus.exe

Und nun hoffe ich auf einen Profi.

Gruß aus Berlin

Nico

#2 Hallo Sabina,

das hört sich ja gar nicht gut an. Anbei die vier Berichte.

Gruß & Dank

Nico


Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!


Error: file "C:\WINDOWS\system32\tygba.dll" not found!
Deletion of file "C:\WINDOWS\system32\tygba.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist

File "C:\WINDOWS\system32\ntos.exe" deleted successfully.

Error: folder "C:\Programme\rhc5f0j0e371" not found!
Deletion of folder "C:\Programme\rhc5f0j0e371" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist

Folder "C:\WINDOWS\system32\wsnpoem" deleted successfully.
Folder "C:\WINDOWS\system32\config\systemprofile\Anwendungsdaten\wsnpoem" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

SDFix: Version 1.205
Run by Nicolas Dobra on 15.07.2008 at 11:20

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix

Checking Services :


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


Checking Files :

Trojan Files Found:

C:\WINDOWS\system32\TFTP108 - Deleted
C:\WINDOWS\system32\TFTP2028 - Deleted
C:\WINDOWS\system32\TFTP3016 - Deleted





Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-15 11:27:42
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services :




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\WINDOWS\\System32\\ftp.exe"="C:\\WINDOWS\\System32\\ftp.exe:*isabledrogramm zur Datei�bertragung"
"C:\\Program Files\\WS_FTP\\WS_FTP95.exe"="C:\\Program Files\\WS_FTP\\WS_FTP95.exe:*:Enabled:WS_FTP 95"
"C:\\Programme\\iTunes\\iTunes.exe"="C:\\Programme\\iTunes\\iTunes.exe:*:Enabled:iTunes"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

Remaining Files :


File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes :

Wed 4 Aug 2004 93,184 A.SH. --- "C:\Programme\Internet Explorer\iexplore.exe"
Sat 22 Mar 2003 4,348 ..SH. --- "C:\Dokumente und Einstellungen\All Users\DRM\DRMv1.bak"
Sat 22 Mar 2003 401 ..SH. --- "C:\Dokumente und Einstellungen\All Users\DRM\DRMv14.bak"
Wed 28 Jan 2004 37,376 ...H. --- "C:\Dokumente und Einstellungen\Nicolas Dobra\Desktop\~WRL1276.tmp"
Thu 4 Mar 2004 30,208 ...H. --- "C:\Dokumente und Einstellungen\Nicolas Dobra\Desktop\~WRL0001.tmp"
Sat 6 Mar 2004 30,720 ...H. --- "C:\Dokumente und Einstellungen\Nicolas Dobra\Desktop\~WRL0004.tmp"
Tue 11 Sep 2007 24,064 ...H. --- "C:\Dokumente und Einstellungen\Nicolas Dobra\Desktop\~WRL3205.tmp"
Tue 11 Sep 2007 24,064 ...H. --- "C:\Dokumente und Einstellungen\Nicolas Dobra\Desktop\~WRL1208.tmp"
Thu 31 Mar 2005 562,688 ...H. --- "C:\Dokumente und Einstellungen\Nicolas Dobra\Desktop\~WRL2702.tmp"
Thu 31 Mar 2005 25,600 ...H. --- "C:\Dokumente und Einstellungen\Nicolas Dobra\Desktop\~WRL2355.tmp"
Mon 20 Sep 2004 29,696 ...H. --- "C:\Dokumente und Einstellungen\Nicolas Dobra\Eigene Dateien\Bewerbungen\Lebenslauf\~WRL0004.tmp"
Mon 20 Sep 2004 31,232 ...H. --- "C:\Dokumente und Einstellungen\Nicolas Dobra\Eigene Dateien\Bewerbungen\Lebenslauf\~WRL2328.tmp"
Mon 20 Sep 2004 31,232 ...H. --- "C:\Dokumente und Einstellungen\Nicolas Dobra\Eigene Dateien\Bewerbungen\Lebenslauf\~WRL2988.tmp"

Finished!
Logfile of HijackThis v1.99.1
Scan saved at 11:29:58, on 15.07.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Programme\Gemeinsame Dateien\EPSON\EBAPI\SAgent2.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe
C:\Programme\SPAMfighter\sfus.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\atiptaxx.exe
C:\Programme\Apoint2K\Apoint.exe
C:\Programme\TOSHIBA\TouchPad\TPTray.exe
C:\Programme\TOSHIBA\Power Management\CePMTray.exe
C:\Programme\TOSHIBA\E-KEY\CeEKey.exe
C:\Programme\FreePDF_XP\fpassist.exe
C:\Programme\iTunes\iTunesHelper.exe
C:\Programme\Apoint2K\Apntex.exe
C:\Programme\iPod\bin\iPodService.exe
C:\Programme\QuickTime\qttask.exe
C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe
C:\Programme\Kyocera\FS-720 Utilities\KMGLNC.exe
C:\Programme\SPAMfighter\SFAgent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Messenger\msmsgs.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\msiexec.exe
C:\Programme\Microsoft Office\Office10\WINWORD.EXE
C:\Dokumente und Einstellungen\Nicolas Dobra\Desktop\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.finderg.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R3 - URLSearchHook: (no name) - _{9337C435-655C-4B13-AB3F-2A9136BC9AA6} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [Apoint] C:\Programme\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [TPNF] C:\Programme\TOSHIBA\TouchPad\TPTray.exe
O4 - HKLM\..\Run: [CeEPOWER] C:\Programme\TOSHIBA\Power Management\CePMTray.exe
O4 - HKLM\..\Run: [CeEKEY] C:\Programme\TOSHIBA\E-KEY\CeEKey.exe
O4 - HKLM\..\Run: [EPSON Stylus C62 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus C62 Series" /O5 "LPT1:" /M "Stylus C62"
O4 - HKLM\..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programme\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Launcher] C:\Programme\Kyocera\FS-720 Utilities\KMGLNC.exe
O4 - HKLM\..\Run: [SPAMfighter Agent] "C:\Programme\SPAMfighter\SFAgent.exe" update delay 60
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: SideFind - {10E42047-DEB9-4535-A118-B3F6EC39B807} - C:\Programme\SideFind\sidefind13.dll (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Programme\Internet Explorer\PLUGINS\nppdf32.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.tiscali.de
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Programme\Canon\CAL\CALMAIN.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Programme\Gemeinsame Dateien\EPSON\EBAPI\SAgent2.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: SPAMfighter Update Service - SPAMfighter ApS - C:\Programme\SPAMfighter\sfus.exe


ComboFix 08-07-14.2 - Nicolas Dobra 2008-07-15 11:38:23.2 - [color=red]FAT32[/color]x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1031.18.291 [GMT 2:00]
ausgeführt von:: C:\Dokumente und Einstellungen\Nicolas Dobra\Desktop\ComboFix.exe
* Neuer Wiederherstellungspunkt wurde erstellt

[color=red]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/color]
.

((((((((((((((((((((((( Dateien erstellt von 2008-06-15 bis 2008-07-15 ))))))))))))))))))))))))))))))
.

2008-07-15 11:18 . 2008-07-15 11:18 <DIR> d-------- C:\WINDOWS\ERUNT
2008-07-15 10:46 . 2008-07-13 06:12 <DIR> d-------- C:\SDFix
2008-07-14 14:05 . 2008-07-14 14:05 <DIR> d-------- C:\Programme\CCleaner
2008-07-14 13:41 . 2008-07-14 13:41 <DIR> d-------- C:\fixwareout
2008-07-13 21:26 . 2008-07-13 21:26 <DIR> d--hs---- C:\FOUND.003
2008-07-12 11:19 . 2008-07-12 11:19 <DIR> d-------- C:\Programme\MSXML 4.0
2008-07-11 19:06 . 2008-07-11 19:06 <DIR> d-------- C:\WINDOWS\system32\CatRoot_bak
2008-07-11 18:56 . 2008-06-14 19:57 273,024 --------- C:\WINDOWS\system32\dllcache\bthport.sys
2008-06-30 15:08 . 2008-07-10 14:10 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-06-30 15:08 . 2008-06-30 15:08 1,409 --a------ C:\WINDOWS\QTFont.for
2008-06-30 15:04 . 2008-06-30 15:04 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\hps
2008-06-30 15:04 . 2008-06-30 15:04 1,025 --a------ C:\WINDOWS\system32\sysprs7.tgz
2008-06-30 15:04 . 2008-06-30 15:04 1,025 --a------ C:\WINDOWS\system32\sysprs7.dll
2008-06-30 15:04 . 2008-06-30 15:04 1,025 --a------ C:\WINDOWS\system32\clauth2.dll
2008-06-30 15:04 . 2008-06-30 15:04 1,025 --a------ C:\WINDOWS\system32\clauth1.dll
2008-06-30 15:04 . 2008-06-30 15:04 219 --a------ C:\WINDOWS\system32\lsprst7.tgz
2008-06-30 15:04 . 2008-06-30 15:04 87 --a------ C:\WINDOWS\system32\ssprs.tgz
2008-06-30 15:03 . 2008-06-30 15:03 <DIR> d-------- C:\Programme\SCHLECKER
2008-06-20 19:39 . 2008-06-20 19:39 247,296 --------- C:\WINDOWS\system32\dllcache\mswsock.dll
2008-06-20 12:44 . 2008-06-20 12:44 138,368 --------- C:\WINDOWS\system32\dllcache\afd.sys
2008-06-18 14:41 . 2008-06-18 14:41 <DIR> d-------- C:\Dokumente und Einstellungen\Nicolas Dobra\Anwendungsdaten\SPAMfighter
2008-06-18 14:40 . 2008-06-18 14:40 <DIR> d-------- C:\Programme\Gemeinsame Dateien\Ankiro
2008-06-18 14:39 . 2008-06-18 14:39 <DIR> d-------- C:\Programme\SPAMfighter
2008-06-18 14:39 . 2008-06-18 14:39 <DIR> d-------- C:\Programme\Gemeinsame Dateien\Application

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-20 17:39 247,296 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 17:39 148,992 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\dllcache\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\dllcache\tcpip6.sys
2008-06-14 17:57 273,024 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\dllcache\rmcast.sys
2008-05-07 05:14 1,293,312 ----a-w C:\WINDOWS\system32\quartz.dll
2008-05-07 05:14 1,293,312 ------w C:\WINDOWS\system32\dllcache\quartz.dll
2008-04-17 10:52 18,432 ------w C:\WINDOWS\system32\dllcache\iedw.exe
2005-05-11 12:05 29,848 ----a-w C:\Dokumente und Einstellungen\Nicolas Dobra\Anwendungsdaten\GDIPFONTCACHEV1.DAT
.

------- Sigcheck -------

2004-08-04 00:58 17408 a97f7e7a3e8cd23aa7dd0d4a8d2b99e6 C:\WINDOWS\system32\svchost.exe
2001-08-18 14:00 12800 adbb33d5893bcf08e75ea54bb5669205 C:\WINDOWS\$NtServicePackUninstall$\svchost.exe
2004-08-04 00:58 14336 65a819b121eb6fdab4400ea42bdffe64 C:\WINDOWS\ServicePackFiles\i386\svchost.exe

2004-08-04 00:58 510464 2a47c32bcc6189c1f088b82fc012f7b6 C:\WINDOWS\system32\winlogon.exe
2001-08-18 14:00 435200 5dac883c68d261d406489f3f990d8ddf C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
2004-08-04 00:58 507392 2b6a0baf33a9918f09442d873848ff72 C:\WINDOWS\ServicePackFiles\i386\winlogon.exe

2004-08-04 00:58 110592 871865feec32db1f3965f799167be719 C:\WINDOWS\system32\services.exe
2001-08-18 14:00 101888 a87c3a6b407fb3b22c566315607ce229 C:\WINDOWS\$NtServicePackUninstall$\services.exe
2004-08-04 00:58 108544 edb6b81761bd60f32f740bbc40afb676 C:\WINDOWS\ServicePackFiles\i386\services.exe

2004-08-04 00:58 14848 2772dedb7e2849e8741032c7e16559ae C:\WINDOWS\system32\lsass.exe
2001-08-18 14:00 11776 06df1b4d51bea83cf16fd45ab8c8cce8 C:\WINDOWS\$NtServicePackUninstall$\lsass.exe
2004-08-04 00:58 13312 183805eb05bca5a1e4aaaed4d2be3690 C:\WINDOWS\ServicePackFiles\i386\lsass.exe

2005-06-11 01:53 58880 9140c3ac3fe75d2aeebc0e1c490cf6b3 C:\WINDOWS\system32\spoolsv.exe
2005-06-11 02:17 57856 ad3d9d191aea7b5445fe1d82ffbb4788 C:\WINDOWS\$hf_mig$\KB896423\SP2QFE\spoolsv.exe
2001-08-18 14:00 51200 9b627e6da0ea47a3a664f69d954831d7 C:\WINDOWS\$NtServicePackUninstall$\spoolsv.exe
2004-08-04 00:58 57856 54e7113a4bd696e430919bcaf5c65e06 C:\WINDOWS\ServicePackFiles\i386\spoolsv.exe
2004-08-04 00:58 57856 54e7113a4bd696e430919bcaf5c65e06 C:\WINDOWS\$NtUninstallKB896423$\spoolsv.exe
.
((((((((((((((((((((((((((((( snapshot@2008-07-14_14.25.43.27 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-07-13 04:11:02 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE
+ 2008-07-15 09:18:36 4,091,904 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000001\ntuser.dat
+ 2008-07-15 09:18:36 12,288 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000002\UsrClass.dat
+ 2008-07-13 04:11:02 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE
+ 2008-07-15 09:18:26 4,091,904 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000001\ntuser.dat
+ 2008-07-15 09:18:26 12,288 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000002\UsrClass.dat
- 2008-07-14 11:58:14 16,384 ------w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2008-07-15 07:35:12 16,384 ------w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
- 2008-07-14 11:58:14 32,768 ------w C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\index.dat
+ 2008-07-15 07:35:12 32,768 ------w C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\index.dat
- 2008-07-14 11:58:14 32,768 ------w C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Verlauf\History.IE5\index.dat
+ 2008-07-15 07:35:12 32,768 ------w C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Verlauf\History.IE5\index.dat
.
(((((((((((((((((((((((((((( Autostart Punkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Hinweis* leere Eintrage & legitime Standardeintrage werden nicht angezeigt.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:57 15360]
"MSMSGS"="C:\Programme\Messenger\msmsgs.exe" [2004-10-13 18:24 1694208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="C:\Programme\Apoint2K\Apoint.exe" [2002-03-29 14:40 122880]
"TPNF"="C:\Programme\TOSHIBA\TouchPad\TPTray.exe" [2002-07-25 14:08 45056]
"CeEPOWER"="C:\Programme\TOSHIBA\Power Management\CePMTray.exe" [2002-08-07 10:29 114688]
"CeEKEY"="C:\Programme\TOSHIBA\E-KEY\CeEKey.exe" [2002-08-22 20:21 372736]
"EPSON Stylus C62 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE" [2002-04-10 05:04 74240]
"FreePDF Assistant"="C:\Programme\FreePDF_XP\fpassist.exe" [2005-05-27 11:24 145920]
"iTunesHelper"="C:\Programme\iTunes\iTunesHelper.exe" [2005-10-18 11:58 278528]
"QuickTime Task"="C:\Programme\QuickTime\qttask.exe" [2006-03-24 20:15 155648]
"avgnt"="C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" [2008-04-18 10:13 262401]
"Launcher"="C:\Programme\Kyocera\FS-720 Utilities\KMGLNC.exe" [2005-01-27 20:48 57344]
"SPAMfighter Agent"="C:\Programme\SPAMfighter\SFAgent.exe" [2008-05-14 15:23 321160]
"ATIModeChange"="Ati2mdxx.exe" [2002-04-22 23:14 28672 C:\WINDOWS\system32\Ati2mdxx.exe]
"AtiPTA"="atiptaxx.exe" [2002-04-23 01:00 282624 C:\WINDOWS\system32\atiptaxx.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:57 15360]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\WINDOWS\\System32\\ftp.exe"=
"C:\\Program Files\\WS_FTP\\WS_FTP95.exe"=
"C:\\Programme\\iTunes\\iTunes.exe"=

R0 avgntmgr;avgntmgr;C:\WINDOWS\system32\drivers\avgntmgr.sys [2008-04-18 10:13]
R1 avgntdd;avgntdd;C:\WINDOWS\system32\DRIVERS\avgntdd.sys [2008-04-18 10:13]
R2 SPAMfighter Update Service;SPAMfighter Update Service;C:\Programme\SPAMfighter\sfus.exe [2008-05-14 15:24]
S3 AVMUNET;AVM FRITZ! Box;C:\WINDOWS\system32\DRIVERS\avmunet.sys [2004-03-11 01:00]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6c4c7360-2c89-11dd-9d9f-00023f8a3a86}]
\Shell\AutoRun\command - E:\Menu.exe

.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-15 11:40:00
Windows 5.1.2600 Service Pack 2 FAT NTAPI

Scanne versteckte Prozesse...

Scanne versteckte Autostart Einträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
Zeit der Fertigstellung: 2008-07-15 11:41:07
ComboFix-quarantined-files.txt 2008-07-15 09:41:02

20 Verzeichnis(se), 7,987,298,304 Bytes frei
26 Verzeichnis(se), 7,980,957,696 Bytes frei

134 --- E O F --- 2008-07-14 10:17:18

#3 Hi Sabina,

mich hat's mit dem gleichen Problem erwischt. Auch ich habe auf meinem Desktop einen blauen Hintergrund und die Meldung:

"Warning! Spyware detected on your computer! Install an antivirus or spyware remover to clean your computer"

Bin zum ersten Mal hier. Ist das korrekt, wenn ich meine log-Datei hier poste, oder hätte ich einen neuen Thread aufmachen sollen?

Ein erster Bekämpfungsversuch (http://virus-protect.org/artikel/tools/smitfrautfix.html) schien das Problem gelöst zu haben, dann trat es wieder auf.

Jedenfalls meldet mein AntiVir Guard in der Datei .tt3E.tmp das Trojanische Pferd TR/Crypt.XPACK.Gen.

Hier ist mein logfile:

Logfile of HijackThis v1.99.1
Scan saved at 19:11:36, on 15.07.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\spoolsv.exe
c:\programme\gemeinsame dateien\logitech\lvmvfm\LVPrcSrv.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\Gemeinsame Dateien\AAV\aavus.exe
C:\Programme\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programme\avmclient\avmbtservice.exe
C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Programme\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
C:\Programme\Ahead\InCD\InCD.exe
C:\Programme\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programme\Adobe\Photoshop Elements 4.0\apdproxy.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Programme\Logitech\Video\CameraAssistant.exe
C:\WINDOWS\system32\ElkCtrl.exe
C:\Programme\Winamp\winampa.exe
C:\Programme\avmclient\bluefritz!.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programme\iTunes\iTunesHelper.exe
C:\WINDOWS\vsnp2std.exe
C:\WINDOWS\system32\lphccdmj0e991.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\GMX\GMX SMS-Manager\SMSMngr.exe
C:\Programme\ATI Multimedia\RemCtrl\ATIRW.exe
C:\Programme\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Programme\Google\Google Updater\GoogleUpdater.exe
C:\Programme\SystemControl\SystemControl\SystemControl.exe
C:\Programme\VIA\RAID\raid_tool.exe
C:\Programme\iPod\bin\iPodService.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Dokumente und Einstellungen\Administrator\Desktop\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe

O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: IE.Filter - {8B2AE9C0-1555-4C92-905A-531532F15698} - C:\WINDOWS\system32\intefl.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar3.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar3.dll
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [RemoteControl] "C:\Programme\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [InCD] C:\Programme\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Programme\Adobe\Photoshop Elements 4.0\apdproxy.exe"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechCameraAssistant] C:\Programme\Logitech\Video\CameraAssistant.exe
O4 - HKLM\..\Run: [LogitechVideo[inspector]] C:\Programme\Logitech\Video\InstallHelper.exe /inspect
O4 - HKLM\..\Run: [LogitechCameraService(E)] C:\WINDOWS\system32\ElkCtrl.exe /automation
O4 - HKLM\..\Run: [WinampAgent] C:\Programme\Winamp\winampa.exe
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Programme\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AVMBlueClient] C:\Programme\avmclient\bluefritz!.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programme\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [snp2std] C:\WINDOWS\vsnp2std.exe
O4 - HKLM\..\Run: [lphccdmj0e991] C:\WINDOWS\system32\lphccdmj0e991.exe
O4 - HKLM\..\Run: [SMrhc9dmj0e991] C:\Programme\rhc9dmj0e991\rhc9dmj0e991.exe
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [GMX SMS-Manager] C:\Programme\GMX\GMX SMS-Manager\SMSMngr.exe
O4 - HKCU\..\Run: [ATI Remote Control] C:\Programme\ATI Multimedia\RemCtrl\ATIRW.exe
O4 - HKCU\..\Run: [swg] C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Skype] "C:\Programme\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Global Startup: Acrobat Assistant.lnk = C:\Programme\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Google Updater.lnk = C:\Programme\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: SystemControl.lnk = ?
O4 - Global Startup: VIA RAID TOOL.lnk = C:\Programme\VIA\RAID\raid_tool.exe
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe (file missing)
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IPSUploader Control) - http://as.photoprintit.de/ips-opdata/activex/IPSUploader.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AAV UpdateService - Unknown owner - C:\Programme\Gemeinsame Dateien\AAV\aavus.exe
O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - C:\Programme\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVM BT Connection Service - Unknown owner - C:\Programme\avmclient\avmbtservice.exe
O23 - Service: AVM BT PAN Service - AVM Berlin - C:\Programme\avmclient\panapp.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Programme\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\programme\gemeinsame dateien\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Programme\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Programme\Spyware Doctor\pctsSvc.exe

Kannst Du mir vorschlagen, wass ich tun soll?

Dank im voraus, und viele Grüße!

Dopa

#4 Hallo dobra

wende avz an + poste den Report
http://virus-protect.org/artikel/tools/avz.html
__________
MfG Sabina

rund um die PC-Sicherheit

#5 Hallo Dopa

wende cleaner an + lösche die temp-Dateien
http://www.ccleaner.de/?protecus.de

mit dem HijackThis löschen ("fixen")
Klicke: "Do a system scan only"
Setze ein Häckchen in das Kästchen vor den genannten Eintrag
und wähle fix checked. + starte den Rechner neu.

Zitat

O2 - BHO: IE.Filter - {8B2AE9C0-1555-4C92-905A-531532F15698} - C:\WINDOWS\system32\intefl.dll (file missing)

O4 - HKLM\..\Run: [lphccdmj0e991] C:\WINDOWS\system32\lphccdmj0e991.exe

O4 - HKLM\..\Run: [SMrhc9dmj0e991] C:\Programme\rhc9dmj0e991\rhc9dmj0e991.exe

«
wende navilog an + Option 1, dann Option 2 - poste hier den report von Option 2
http://virus-protect.org/artikel/tools/navilog.html

«
wende combofix an , warnmeldung wegklicken + poste hier den report
http://virus-protect.org/artikel/tools/combofix.html
__________
MfG Sabina

rund um die PC-Sicherheit

#6 Hi Sabina.

Vielen Dank für Deine schnelle Hilfe!

Gestern Abend war ich noch aktiv und habe die Datei
lphccdmj0e991.exe
direkt "bekämpft", bevor ich Deine Antwort gelesen habe.
Anschließend habe ich meinen Antivir durchlaufen lassen, der hat "nur" noch ein Problem gefunden:



Avira AntiVir Personal
Erstellungsdatum der Reportdatei: Mittwoch, 16. Juli 2008 00:34

Der Suchlauf über die ausgewählten Dateien wird begonnen:

Beginne mit der Suche in 'C:\'
C:\pagefile.sys
[WARNUNG] Die Datei konnte nicht geöffnet werden!
C:\System Volume Information\_restore{FACA7031-03B6-4131-88CE-D5391365B209}\RP712\A0079701.exe
[FUND] Ist das Trojanische Pferd TR/Fakealert.AG
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '48ad895b.qua' verschoben!
Beginne mit der Suche in 'E:\' <USB DISK>


Ende des Suchlaufs: Mittwoch, 16. Juli 2008 07:57
Benötigte Zeit: 7:23:35 min

Der Suchlauf wurde vollständig durchgeführt.

8657 Verzeichnisse wurden überprüft
440905 Dateien wurden geprüft
1 Viren bzw. unerwünschte Programme wurden gefunden
0 Dateien wurden als verdächtig eingestuft
0 Dateien wurden gelöscht
0 Viren bzw. unerwünschte Programme wurden repariert
1 Dateien wurden in die Quarantäne verschoben
0 Dateien wurden umbenannt
1 Dateien konnten nicht durchsucht werden
440904 Dateien ohne Befall
1854 Archive wurden durchsucht
5 Warnungen
1 Hinweise

Interessanterweise kann ich auf C:\System Volume Information nicht zugreifen! Scheinbar haben wir es auch noch mit TR/Fakealert.AG zu tun...

Heute morgen habe ich dann Deinen Leitfaden befolgt:

Habe den CCleaner angewendet, außerdem mit HijackThis die 3 Zeilen gefixt.

Dann Navilog:

Navipromo Removal version 3.6.0 started on 2008-07-16 at 9:08:56.85

Fix running from C:\Programme\navilog1
Actual User Account : "Administrator"

Updated on 27.06.2008 at 23h00 by IL-MAFIOSO


Microsoft Windows XP [Version 5.1.2600]
Internet Explorer : 6.0.2900.2180
Filesystem type : NTFS

Automatic removal
with Catchme and GNS results


Cleanning stage done on Reboot


*** fsbl1.txt not found ***
(Check that Catchme found nothing in Search Mode)


*** Deleting with Backups GenericNaviSearch results ***

* Deletion in "C:\WINDOWS\System32" *


* Deletion in "C:\Dokumente und Einstellungen\Administrator\lokale~1\anwend~1" *


* Deletion in "C:\DOKUME~1\Gast\lokale~1\anwend~1" *



*** Deleting folders in "C:\WINDOWS" ***


*** Deleting folders in "C:\Programme" ***


*** Deleting folders in "c:\dokume~1\alluse~1\anwend~1" ***


*** Deleting folders in "c:\dokume~1\alluse~1\startm~1\progra~1" ***


*** Deleting folders in "C:\Dokumente und Einstellungen\Administrator\anwend~1" ***


*** Deleting folders in "C:\DOKUME~1\Gast\anwend~1" ***


*** Deleting folders in "C:\Dokumente und Einstellungen\Administrator\lokale~1\anwend~1" ***


*** Deleting folders in "C:\DOKUME~1\Gast\lokale~1\anwend~1" ***


*** Deleting folders in "C:\Dokumente und Einstellungen\Administrator\startm~1\progra~1" ***


*** Deleting folders in "C:\DOKUME~1\Gast\startm~1\progra~1" ***



*** Deleting files ***


*** Deleting temporary files ***

Cleaning of C:\WINDOWS\Temp done !
Cleaning of C:\Dokumente und Einstellungen\Administrator\lokale~1\Temp done !

*** Complementary Search ***
(Search specific files)

1)Deletion with backups new Instant Access files:

2)Heuristic search and deletion with backups :


* In "C:\WINDOWS\system32" *


* In "C:\Dokumente und Einstellungen\Administrator\lokale~1\anwend~1" *


* In "C:\DOKUME~1\Gast\lokale~1\anwend~1" *


*** Copy Registry to Safebackup folder ***

Backing up Registry done !

*** Cleaning Registry ***

Registry cleaned


*** Certificates ***

Egroup Certificate not found !
Electronic-Group Certificate not found !
OOO-Favorit Certificate not found !
Sunny-Day-Design-Ltd Certificate not found !

*** Cleaning stage complete on 2008-07-16 at 9:12:47.65 ***


Combofix habe ich auch durchlaufen lassen, scheint sich aber ganz am Ende aufgehangen zu haben:
In einem Fenster das "Find3M" heißt, steht:

"Bereite Logdatei vor.
Starte keine anderen Programme, bevor ComboFix fertig ist."

Seither ist nichts passiert, d.h. er scheint durchgelaufen zu sein, ich habe aber keine log-Datei.
(Anmerkung: Der infizierte Rechner ist vom Netz getrennt, ich schreibe Dir von einem anderen und kopiere die logs via USB-Stick)

Soll ich vielleicht neu starten und Combofix ein zweites Mal ausprobieren?

Viele Grüße,

Dopa

Zusatz:

Das Hintergrundbild mit der Warnemldung

"Warning! Spyware detected on your computer! Install an antivirus or spyware remover to clean your computer"

ist im Moment weg...

#7 Hallo Dopa

versuche Combofix noch mal anzuwenden.
wenn es nicht klappt, poste die 2 logs von comboscan
http://virus-protect.org/artikel/tools/comboscan.html
__________
MfG Sabina

rund um die PC-Sicherheit

#8

Zitat

Sabina postete
Hallo dobra

wende avz an + poste den Report
http://virus-protect.org/artikel/tools/avz.html

Hallo Sabina,

hier ist der avz-Report.

Nochmals vielen Dank

Nico

Attention !!! Database was last updated 06.04.2008 it is necessary to update the bases using automatic updates (File/Database update)
AVZ Antiviral Toolkit log; AVZ version is 4.30
Scanning started at 16.07.2008 10:49:30
Database loaded: signatures - 157571, NN profile(s) - 2, microprograms of healing - 55, signature database released 06.04.2008 17:09
Heuristic microprograms loaded: 370
SPV microprograms loaded: 9
Digital signatures of system files loaded: 70476
Heuristic analyzer mode: Medium heuristics level
Healing mode: enabled
Windows version: 5.1.2600, Service Pack 2 ; AVZ is launched with administrator rights
System Restore: enabled
1. Searching for Rootkits and programs intercepting API functions
1.1 Searching for user-mode API hooks
Analysis: kernel32.dll, export table found in section .text
Analysis: ntdll.dll, export table found in section .text
Analysis: user32.dll, export table found in section .text
Analysis: advapi32.dll, export table found in section .text
Analysis: ws2_32.dll, export table found in section .text
Analysis: wininet.dll, export table found in section .text
Analysis: rasapi32.dll, export table found in section .text
Analysis: urlmon.dll, export table found in section .text
Analysis: netapi32.dll, export table found in section .text
1.2 Searching for kernel-mode API hooks
Driver loaded successfully
SDT found (RVA=082680)
Kernel ntoskrnl.exe found in memory at address 804D7000
SDT = 80559680
KiST = 804E26A8 (284)
Functions checked: 284, intercepted: 0, restored: 0
1.3 Checking IDT and SYSENTER
Analysis for CPU 1
Checking IDT and SYSENTER - complete
1.4 Searching for masking processes and drivers
Checking not performed: extended monitoring driver (AVZPM) is not installed
Driver loaded successfully
1.5 Checking of IRP handlers
Checking - complete
2. Scanning memory
Number of processes found: 43
Number of modules loaded: 306
Scanning memory - complete
3. Scanning disks
Direct reading C:\Dokumente und Einstellungen\Nicolas Dobra\Lokale Einstellungen\Temp\~DFD796.tmp
Direct reading C:\Dokumente und Einstellungen\Nicolas Dobra\Lokale Einstellungen\Temp\~DFEDBC.tmp
4. Checking Winsock Layered Service Provider (SPI/LSP)
LSP settings checked. No errors detected
5. Searching for keyboard/mouse/windows events hooks (Keyloggers, Trojan DLLs)
C:\Programme\SPAMfighter\Clients\Outlook Express\SFOE0001.dll --> Suspicion for Keylogger or Trojan DLL
C:\Programme\SPAMfighter\Clients\Outlook Express\SFOE0001.dll>>> Behavioural analysis
1. Reacts to events: keyboard
C:\Programme\SPAMfighter\Clients\Outlook Express\SFOE0001.dll>>> Neural net: file with probability 14.50% like a typical keyboard/mouse events interceptor
Note: Do NOT delete suspicious files, send them for analysis (see FAQ for more details), because there are lots of useful hooking DLLs
6. Searching for opened TCP/UDP ports used by malicious programs
Checking disabled by user
7. Heuristic system check
Checking - complete
8. Searching for vulnerabilities
>> Services: potentially dangerous service allowed: TermService (Terminaldienste)
>> Services: potentially dangerous service allowed: SSDPSRV (SSDP-Suchdienst)
>> Services: potentially dangerous service allowed: Schedule (Taskplaner)
>> Services: potentially dangerous service allowed: mnmsrvc (NetMeeting-Remotedesktop-Freigabe)
>> Services: potentially dangerous service allowed: RDSessMgr (Sitzungs-Manager für Remotedesktophilfe)
> Services: please bear in mind that the set of services depends on the use of the PC (home PC, office PC connected to corporate network, etc)!
>> Security: disk drives' autorun is enabled
>> Security: administrative shares (C$, D$ ...) are enabled
>> Security: anonymous user access is enabled
>> Security: sending Remote Assistant queries is enabled
Checking - complete
9. Troubleshooting wizard
Checking - complete
Files scanned: 89463, extracted from archives: 73116, malicious software found 0, suspicions - 0
Scanning finished at 16.07.2008 11:27:27
Time of scanning: 00:38:00
If you have a suspicion on presence of viruses or questions on the suspected objects,
you can address http://virusinfo.info conference

#9 Hallo dobra

lade complet.bat - anwenden - poste dann das log als Anhang
http://virus-protect.org/completbat.html
__________
MfG Sabina

rund um die PC-Sicherheit

#10 Hallo Sabina,

anbei das Log als Anhang.

Gruß

Nico

#11 Hallo dobra

wende regstuff an + poste den report (als Anhang)
http://virus-protect.org/registry_stuff.html
__________
MfG Sabina

rund um die PC-Sicherheit

#12

Zitat

Sabina postete
Hallo dobra

wende regstuff an + poste den report (als Anhang)
http://virus-protect.org/registry_stuff.html

Hallo Sabina,

ich komme mir vor wie ein Vollinvalide, sozusagen in einem ähnlichen Zustand wie mein Computer.

Gruß

Nico

#13 Hallo dobra

Vollinvalide ... na ja... nicht übertreiben, der Rechner rollert wieder normal, oder ?
das ist soweit wieder in Ordnung, ich finde nichts mehr.
Mache nun bitte einen Online-Scan mit Bitdefender, alles entfernen lassen,w as gefunden wird + poste den Report
http://virus-protect.org/artikel/tools/bitdefender.html
__________
MfG Sabina

rund um die PC-Sicherheit

#14 Hi Sabina,

Cmbofix hat nicht geklappt, hat sich 2 x bei Schritt 32 aufgehängt...

Hier die beiden ComboScan logs:

Deckard's System Scanner v20071014.68
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------

-- System Information ----------------------------------------------------------

Microsoft Windows XP Professional (build 2600) SP 2.0
Architecture: X86; Language: German

CPU 0: AMD Athlon(tm) XP 2400+
Percentage of Memory in Use: 21%
Physical Memory (total/avail): 1503.48 MiB / 1175.42 MiB
Pagefile Memory (total/avail): 2076.96 MiB / 1806.32 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1944.5 MiB

C: is Fixed (NTFS) - 74.55 GiB total, 8.53 GiB free.
D: is CDROM (No Media)
F: is Removable (No Media)
G: is Removable (No Media)
H: is Removable (No Media)
I: is Removable (No Media)

\\.\PHYSICALDRIVE0 - SAMSUNG SP0802N - 74.56 GiB - 1 partition
\PARTITION0 (bootable) - Installierbares Dateisystem - 74.55 GiB - C:

\\.\PHYSICALDRIVE1 - Generic STORAGE DEVICE USB Device

\\.\PHYSICALDRIVE2 - Generic STORAGE DEVICE USB Device

\\.\PHYSICALDRIVE3 - Generic STORAGE DEVICE USB Device

\\.\PHYSICALDRIVE4 - Generic STORAGE DEVICE USB Device



-- Security Center -------------------------------------------------------------

AUOptions is scheduled to auto-install.
Windows Internal Firewall is enabled.

AntiVirusDisableNotify is set.

AV: Avira AntiVir PersonalEdition v8.0.1.15 (Avira GmbH) [COLOR=RED]Disabled[/COLOR]

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Programme\\MSN Messenger\\msnmsgr.exe"="C:\\Programme\\MSN Messenger\\msnmsgr.exe:*:Enabled:MSN Messenger 7.5"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Programme\\Real\\RealOne Player\\realplay.exe"="C:\\Programme\\Real\\RealOne Player\\realplay.exe:*:Enabled:RealOne Player"
"C:\\Programme\\WinMX\\WinMX.exe"="C:\\Programme\\WinMX\\WinMX.exe:*:Enabled:WinMX Application"
"C:\\Program Files\\WS_FTP\\WS_FTP95.exe"="C:\\Program Files\\WS_FTP\\WS_FTP95.exe:*:Enabled:WS_FTP 95"
"C:\\WINDOWS\\system32\\mshta.exe"="C:\\WINDOWS\\system32\\mshta.exe:*:Enabled:Microsoft (R) HTML Application host"
"C:\\Programme\\Hewlett-Packard\\HP Software Update\\HPWUCli.exe"="C:\\Programme\\Hewlett-Packard\\HP Software Update\\HPWUCli.exe:*:Enabled:HP Software Update Client"
"C:\\Programme\\Mozilla Firefox\\firefox.exe"="C:\\Programme\\Mozilla Firefox\\firefox.exe:*:Enabled:Firefox"
"C:\\Programme\\Messenger\\msmsgs.exe"="C:\\Programme\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Programme\\eMule\\emule.exe"="C:\\Programme\\eMule\\emule.exe:*:Enabled:eMule"
"C:\\Programme\\MSN Messenger\\msnmsgr.exe"="C:\\Programme\\MSN Messenger\\msnmsgr.exe:*:Enabled:MSN Messenger 7.5"
"C:\\Dokumente und Einstellungen\\Administrator\\Anwendungsdaten\\Facebook\\facebook.exe"="C:\\Dokumente und Einstellungen\\Administrator\\Anwendungsdaten\\Facebook\\facebook.exe:127.0.0.1/255.255.255.255:Enabled:Facebook"
"C:\\Programme\\iTunes\\iTunes.exe"="C:\\Programme\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"C:\\Programme\\Skype\\Phone\\Skype.exe"="C:\\Programme\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"

---------------------------------------------------------------

Administrator (admin)
Gast (guest)


-- Add/Remove Programs ---------------------------------------------------------

Avira AntiVir Personal – Free Antivirus --> C:\Programme\Avira\AntiVir PersonalEdition Classic\SETUP.EXE /REMOVE
CCleaner (remove only) --> "C:\Programme\CCleaner\uninst.exe"
HijackThis 1.99.1 --> C:\Dokumente und Einstellungen\Administrator\Desktop\HijackThis.exe /uninstall
Navilog1 3.6.0 --> "C:\Programme\Navilog1\unins000.exe"
Panda ActiveScan 2.0 --> C:\Programme\Panda Security\ActiveScan 2.0\as2uninst.exe
Sicherheitsupdate für Windows XP (KB951748) --> "C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Sunbelt CounterSpy --> MsiExec.exe /I{0AD5AD99-6172-4385-8765-385FBE3A1013}


-- Application Event Log -------------------------------------------------------

Event Record #/Type8924 / Error
Event Submitted/Written: 07/16/2008 06:16:12 PM
Event ID/Source: 0 / PAN Service
Event Description:
PAN Service error: 183Error: GetMacAddress failed

Event Record #/Type8923 / Success
Event Submitted/Written: 07/16/2008 06:16:11 PM
Event ID/Source: 2570 / Adobe Active File Monitor 4.0
Event Description:
Der Adobe Active File-Monitor-Service wurde gestartet.

Event Record #/Type8917 / Error
Event Submitted/Written: 07/16/2008 05:53:23 PM
Event ID/Source: 0 / PAN Service
Event Description:
PAN Service error: 183Error: GetMacAddress failed

Event Record #/Type8916 / Success
Event Submitted/Written: 07/16/2008 05:53:22 PM
Event ID/Source: 2570 / Adobe Active File Monitor 4.0
Event Description:
Der Adobe Active File-Monitor-Service wurde gestartet.

Event Record #/Type8909 / Error
Event Submitted/Written: 07/16/2008 05:33:05 PM
Event ID/Source: 0 / PAN Service
Event Description:
PAN Service error: 183Error: GetMacAddress failed



-- Security Event Log ----------------------------------------------------------

No Errors/Warnings found.


-- System Event Log ------------------------------------------------------------

Event Record #/Type69208 / Error
Event Submitted/Written: 07/16/2008 06:16:18 PM
Event ID/Source: 7023 / Service Control Manager
Event Description:
Der Dienst "AVM BT PAN Service" wurde mit folgendem Fehler beendet:
%%183

Event Record #/Type69187 / Error
Event Submitted/Written: 07/16/2008 05:53:24 PM
Event ID/Source: 7023 / Service Control Manager
Event Description:
Der Dienst "AVM BT PAN Service" wurde mit folgendem Fehler beendet:
%%183

Event Record #/Type69166 / Error
Event Submitted/Written: 07/16/2008 05:33:15 PM
Event ID/Source: 7023 / Service Control Manager
Event Description:
Der Dienst "AVM BT PAN Service" wurde mit folgendem Fehler beendet:
%%183

Event Record #/Type69162 / Warning
Event Submitted/Written: 07/16/2008 04:23:45 PM / 07/16/2008 04:23:53 PM
Event ID/Source: 18 / avgntflt
Event Description:
TIMEOUT<catchme.tmp>

Event Record #/Type69141 / Error
Event Submitted/Written: 07/16/2008 09:11:47 AM
Event ID/Source: 7023 / Service Control Manager
Event Description:
Der Dienst "AVM BT PAN Service" wurde mit folgendem Fehler beendet:
%%183



-- End of Deckard's System Scanner: finished at 2008-07-16 18:54:51 ------------

Deckard's System Scanner v20071014.68
Run by Administrator on 2008-07-16 18:53:00
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.


-- Last 5 Restore Point(s) --
8: 2008-07-16 16:53:15 UTC - RP718 - Deckard's System Scanner Restore Point
7: 2008-07-16 06:11:40 UTC - RP717 - ComboFix created restore point
6: 2008-07-15 19:58:09 UTC - RP716 - Software Distribution Service 3.0
5: 2008-07-15 19:52:52 UTC - RP715 - CounterSpy - 15.07.2008 21:52:38
4: 2008-07-15 17:19:53 UTC - RP714 - Installed Sunbelt CounterSpy


-- First Restore Point --
1: 2008-07-14 19:52:09 UTC - RP711 - Systemprüfpunkt


Backed up registry hives.
Performed disk cleanup.

[color=red]System Drive C: has 8.53 GiB (less than 15%) free.[/color]


-- HijackThis (run as Administrator.exe) ---------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 18:54, on 2008-07-16
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\spoolsv.exe
c:\programme\gemeinsame dateien\logitech\lvmvfm\LVPrcSrv.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\Gemeinsame Dateien\AAV\aavus.exe
C:\Programme\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programme\avmclient\avmbtservice.exe
C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Programme\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
C:\Programme\Ahead\InCD\InCD.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programme\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programme\Adobe\Photoshop Elements 4.0\apdproxy.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Programme\Logitech\Video\CameraAssistant.exe
C:\WINDOWS\system32\ElkCtrl.exe
C:\Programme\Winamp\winampa.exe
C:\Programme\iTunes\iTunesHelper.exe
C:\WINDOWS\vsnp2std.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\ATI Multimedia\RemCtrl\ATIRW.exe
C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Programme\iPod\bin\iPodService.exe
C:\Dokumente und Einstellungen\Administrator\Desktop\dss.exe
C:\Programme\Internet Explorer\IEXPLORE.EXE
C:\DOKUME~1\ADMINI~1\Desktop\Administrator.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar3.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar3.dll
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [RemoteControl] "C:\Programme\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [InCD] C:\Programme\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Programme\Adobe\Photoshop Elements 4.0\apdproxy.exe"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechCameraAssistant] C:\Programme\Logitech\Video\CameraAssistant.exe
O4 - HKLM\..\Run: [LogitechVideo[inspector]] C:\Programme\Logitech\Video\InstallHelper.exe /inspect
O4 - HKLM\..\Run: [LogitechCameraService(E)] C:\WINDOWS\system32\ElkCtrl.exe /automation
O4 - HKLM\..\Run: [WinampAgent] C:\Programme\Winamp\winampa.exe
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Programme\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AVMBlueClient] C:\Programme\avmclient\bluefritz!.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programme\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [snp2std] C:\WINDOWS\vsnp2std.exe
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SunServer] C:\Programme\Sunbelt Software\CounterSpy\Consumer\sunserver.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ATI Remote Control] C:\Programme\ATI Multimedia\RemCtrl\ATIRW.exe
O4 - HKCU\..\Run: [swg] C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe (file missing)
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IPSUploader Control) - http://as.photoprintit.de/ips-opdata/activex/IPSUploader.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AAV UpdateService - Unknown owner - C:\Programme\Gemeinsame Dateien\AAV\aavus.exe
O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - C:\Programme\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVM BT Connection Service - Unknown owner - C:\Programme\avmclient\avmbtservice.exe
O23 - Service: AVM BT PAN Service - AVM Berlin - C:\Programme\avmclient\panapp.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Programme\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\programme\gemeinsame dateien\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Programme\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Programme\Spyware Doctor\pctsSvc.exe


-- HijackThis Fixed Entries (C:\DOKUME~1\ADMINI~1\Desktop\backups\) ------------

backup-20080716-084639-108 O4 - HKLM\..\Run: [lphccdmj0e991] C:\WINDOWS\system32\lphccdmj0e991.exe
backup-20080716-084639-440 O2 - BHO: IE.Filter - {8B2AE9C0-1555-4C92-905A-531532F15698} - C:\WINDOWS\system32\intefl.dll (file missing)
backup-20080716-084639-888 O4 - HKLM\..\Run: [SMrhc9dmj0e991] C:\Programme\rhc9dmj0e991\rhc9dmj0e991.exe

-- File Associations -----------------------------------------------------------

All associations okay.


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R1 AFS2K - c:\windows\system32\drivers\afs2k.sys <Not Verified; Oak Technology Inc.; AFS>
R1 BS_I2cIo - c:\windows\system32\drivers\bs_i2cio.sys <Not Verified; BIOSTAR Group; BIOSTAR I/O driver fle>
R1 SSHDRV61 - c:\windows\system32\drivers\sshdrv61.sys
R1 SSHDRV85 - c:\windows\system32\drivers\sshdrv85.sys <Not Verified; ; ProtectCD>
R1 ssmdrv - c:\windows\system32\drivers\ssmdrv.sys <Not Verified; AVIRA GmbH; >
R2 ACEDRV05 - c:\windows\system32\drivers\acedrv05.sys <Not Verified; Protect Software GmbH; >
R2 ElbyCDIO (ElbyCDIO Driver) - c:\windows\system32\drivers\elbycdio.sys <Not Verified; Elaborate Bytes AG; CDRTools>
R2 SetupNT - c:\windows\system32\setupnt.sys
R3 AnyDVD - c:\windows\system32\drivers\anydvd.sys <Not Verified; SlySoft, Inc.; AnyDVD>
R3 AVMBTSND (AVM Bluetooth Audio Driver) - c:\windows\system32\drivers\avmbtsnd.sys <Not Verified; AVM GmbH; AVM Bluetooth Audio-Treiber>
R3 ITECIR (ITE CIR Driver) - c:\windows\system32\drivers\itecir.sys <Not Verified; IET Tech. Inc.; IT8712 IT8705 CIR>
R3 LVPrcMon (Logitech LVPrcMon Driver) - c:\windows\system32\drivers\lvprcmon.sys

S3 AVMBTPARALLEL (AVM Bluetooth Druckeranschluss) - c:\windows\system32\drivers\avmbtpar.sys <Not Verified; AVM GmbH; AVM Bluetooth Parallel Port>
S3 AVMBTSERIAL (AVM Bluetooth Kommunikationsanschluss) - c:\windows\system32\drivers\avmbtser.sys <Not Verified; AVM GmbH; AVM Bluetooth Kommunikationsanschluss>
S3 AVMCOWAN (AVM ISDN CoNDIS WAN CAPI Treiber) - c:\windows\system32\drivers\avmcowan.sys <Not Verified; AVM GmbH; AVM CoNDIS WAN CAPI 2.0 Driver>
S3 bfubase (BlueFRITZ! USB (WinXP/2000)) - c:\windows\system32\drivers\bfubase.sys <Not Verified; AVM Berlin; Driver for BlueFRITZ!USB>
S3 CAPI_CIP (AVM Bluetooth CAPI-Controller) - c:\windows\system32\drivers\capi_cip.sys <Not Verified; AVM Berlin; Driver for AVM Bluetooth CAPI-Controller>
S3 catchme - c:\combofix\catchme.sys (file missing)
S3 NETBFPAN (AVM Bluetooth Netzwerkadapter) - c:\windows\system32\drivers\netbfpan.sys <Not Verified; AVM Berlin; AVM Bluetooth Netzwerkadapter>
S3 TS111_USB (T-Sinus 111data Driver) - c:\windows\system32\drivers\ts111usb.sys <Not Verified; Deutsche Telekom AG; T-Sinus 111 card>
S3 w32n5323 (w32n5323 Protocol Driver) - c:\progra~1\dt\dt11mb~1\instal~1\winxp\w32n5323.sys (file missing)


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 AAV UpdateService - c:\programme\gemeinsame dateien\aav\aavus.exe <Not Verified; ; AAV - Online Update Dienst>
R2 AdobeActiveFileMonitor4.0 (Adobe Active File Monitor V4) - c:\programme\adobe\photoshop elements 4.0\photoshopelementsfileagent.exe
R2 AntiVirScheduler (Avira AntiVir Personal – Free Antivirus Planer) - "c:\programme\avira\antivir personaledition classic\sched.exe" <Not Verified; Avira GmbH; AntiVir Workstation>
R2 Apple Mobile Device - "c:\programme\gemeinsame dateien\apple\mobile device support\bin\applemobiledeviceservice.exe" <Not Verified; Apple, Inc.; Apple Mobile Device Service>
R2 AVM BT Connection Service - c:\programme\avmclient\avmbtservice.exe

S2 AVM BT PAN Service - c:\programme\avmclient\panapp.exe <Not Verified; AVM Berlin; AVM Bluetooth PAN>


-- Device Manager: Disabled ----------------------------------------------------

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: VIA-kompatibler Fast Ethernet-Adapter
Device ID: PCI\VEN_1106&DEV_3065&SUBSYS_22001565&REV_78\3&61AAA01&0&90
Manufacturer: VIA Technologies, Inc.
Name: VIA-kompatibler Fast Ethernet-Adapter
PNP Device ID: PCI\VEN_1106&DEV_3065&SUBSYS_22001565&REV_78\3&61AAA01&0&90
Service: FETNDIS


-- Scheduled Tasks -------------------------------------------------------------

2008-04-15 18:37:04 276 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job


-- Files created between 2008-06-16 and 2008-07-16 -----------------------------

2008-07-16 09:25:12 53248 --a------ C:\WINDOWS\PSEXESVC.EXE <Not Verified; Sysinternals; Sysinternals PsExec>
2008-07-16 08:50:38 0 d-------- C:\Programme\Navilog1
2008-07-16 08:42:55 0 dr-h----- C:\Dokumente und Einstellungen\Administrator\Recent
2008-07-16 08:41:34 0 d-------- C:\Programme\CCleaner
2008-07-16 08:12:40 0 d-------- C:\Dokumente und Einstellungen\Administrator\Start Menu
2008-07-16 08:12:10 0 d-------- C:\cmdcons
2008-07-16 08:10:59 68096 --a------ C:\WINDOWS\zip.exe
2008-07-16 08:10:59 49152 --a------ C:\WINDOWS\VFind.exe
2008-07-16 08:10:59 212480 --a------ C:\WINDOWS\swxcacls.exe <Not Verified; SteelWerX; SteelWerX Extended Configurator ACLists>
2008-07-16 08:10:59 136704 --a------ C:\WINDOWS\swsc.exe <Not Verified; SteelWerX; SteelWerX Service Controller>
2008-07-16 08:10:59 161792 --a------ C:\WINDOWS\swreg.exe <Not Verified; SteelWerX; SteelWerX Registry Editor>
2008-07-16 08:10:59 98816 --a------ C:\WINDOWS\sed.exe
2008-07-16 08:10:59 80412 --a------ C:\WINDOWS\grep.exe
2008-07-16 08:10:59 89504 --a------ C:\WINDOWS\fdsv.exe <Not Verified; Smallfrogs Studio; >
2008-07-15 19:19:57 0 d-------- C:\Programme\Sunbelt Software
2008-07-15 18:20:03 4560 --a------ C:\WINDOWS\system32\tmp.reg
2008-07-15 00:59:46 0 d-------- C:\Programme\Panda Security
2008-07-14 21:49:54 0 d-------- C:\Programme\Avira
2008-07-14 20:05:09 0 d-------- C:\Programme\Spyware Doctor
2008-07-13 07:53:15 56 --ah----- C:\WINDOWS\system32\ezsidmv.dat
2008-07-13 07:52:55 0 d-------- C:\Programme\Skype
2008-07-13 07:52:54 0 d-------- C:\Programme\Gemeinsame Dateien\Skype
2008-07-12 16:01:34 458752 --a------ C:\WINDOWS\amcap.exe <Not Verified; Microsoft Corporation; DirectX 9.0 Sample>
2008-07-12 16:01:34 0 d-------- C:\Programme\USB 2.0 PC Camera


-- Find3M Report ---------------------------------------------------------------

2008-07-15 23:50:56 0 d-------- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Skype
2008-07-15 21:52:57 0 d-------- C:\Programme\common files
2008-07-15 17:45:37 0 d-------- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\skypePM
2008-07-14 20:06:34 320094 --a------ C:\WINDOWS\system32\perfh007.dat
2008-07-14 20:06:34 49174 --a------ C:\WINDOWS\system32\perfc007.dat
2008-07-14 20:05:09 0 d-------- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\PC Tools
2008-07-14 19:40:07 0 d-------- C:\Programme\eMule
2008-07-13 18:51:34 0 d-------- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla
2008-07-13 12:07:53 0 d-------- C:\Programme\StarMoney 6.0
2008-07-13 07:59:12 0 d-------- C:\Programme\Java
2008-07-13 07:52:54 0 d-------- C:\Programme\Gemeinsame Dateien
2008-07-12 16:01:33 0 d--h----- C:\Programme\InstallShield Installation Information
2008-07-12 16:01:23 0 d-------- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\InstallShield
2008-06-10 02:09:50 0 d-------- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\think-cell
2008-06-09 23:40:40 0 d-------- C:\Programme\think-cell


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VTTimer"="VTTimer.exe" [2003-08-20 05:56 C:\WINDOWS\system32\VTTimer.exe]
"Cmaudio"="cmicnfg.cpl" []
"RemoteControl"="C:\Programme\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [2003-12-08 17:35]
"InCD"="C:\Programme\Ahead\InCD\InCD.exe" [2004-04-06 19:36]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50]
"SunJavaUpdateSched"="C:\Programme\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27]
"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe" [2003-09-01 13:42]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 00:58 C:\WINDOWS\system32\bthprops.cpl]
"Adobe Photo Downloader"="C:\Programme\Adobe\Photoshop Elements 4.0\apdproxy.exe" [2005-09-09 02:18]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2005-12-09 15:32]
"LogitechCameraAssistant"="C:\Programme\Logitech\Video\CameraAssistant.exe" [2005-12-07 10:26]
"LogitechVideo[inspector]"="C:\Programme\Logitech\Video\InstallHelper.exe" [2005-12-07 10:33]
"LogitechCameraService(E)"="C:\WINDOWS\system32\ElkCtrl.exe" [2004-11-01 17:22]
"WinampAgent"="C:\Programme\Winamp\winampa.exe" [2006-06-21 19:14]
"Sony Ericsson PC Suite"="C:\Programme\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2006-11-24 01:06]
"Adobe Reader Speed Launcher"="C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 20:51]
"AVMBlueClient"="C:\Programme\avmclient\bluefritz!.exe" [2003-09-17 09:00]
"QuickTime Task"="C:\Programme\QuickTime\qttask.exe" [2008-03-28 23:37]
"iTunesHelper"="C:\Programme\iTunes\iTunesHelper.exe" [2008-03-30 10:36]
"snp2std"="C:\WINDOWS\vsnp2std.exe" [2006-12-04 11:58]
"avgnt"="C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-12 10:06]
"SunServer"="C:\Programme\Sunbelt Software\CounterSpy\Consumer\sunserver.exe" [2005-11-11 16:47]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:57]
"ATI Remote Control"="C:\Programme\ATI Multimedia\RemCtrl\ATIRW.exe" [2005-05-10 16:21]
"swg"="C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-24 10:47]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)
"HideLegacyLogonScripts"=0 (0x0)
"HideLogoffScripts"=0 (0x0)
"RunLogonScriptSync"=1 (0x1)
"RunStartupScriptSync"=0 (0x0)
"HideStartupScripts"=0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"HideLegacyLogonScripts"=0 (0x0)
"HideLogoffScripts"=0 (0x0)
"RunLogonScriptSync"=1 (0x1)
"RunStartupScriptSync"=0 (0x0)
"HideStartupScripts"=0 (0x0)
"disableregistrytools"=0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PSEXESVC]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@="Volume shadow copy"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Dokumente und Einstellungen^Administrator^Startmenü^Programme^Autostart^DT 11Mbps WLAN USB Station.lnk]
path=C:\Dokumente und Einstellungen\Administrator\Startmenü\Programme\Autostart\DT 11Mbps WLAN USB Station.lnk
backup=C:\WINDOWS\pss\DT 11Mbps WLAN USB Station.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Brockhaus-Direktsuche.lnk]
path=C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Brockhaus-Direktsuche.lnk
backup=C:\WINDOWS\pss\Brockhaus-Direktsuche.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DeviceDiscovery]
C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager]
"C:\Programme\HP\hpcoretech\hpcmpmgr.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
"C:\Programme\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs BthServ


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0d9c7dec-a610-11d9-aaa8-0030f1ae3134}]
AutoRun\command- E:\Steuern\Steuerprogramm\2008\StartCenter.exe
open\command- E:\Steuern\Steuerprogramm\2008\StartCenter.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{59ce876e-7ef8-11dc-ae0e-001aad8b4c2a}]
AutoRun\command- I:\Steuern\Steuerprogramm\2008\StartCenter.exe
open\command- I:\Steuern\Steuerprogramm\2008\StartCenter.exe

-- Hosts -----------------------------------------------------------------------

8782 more entries in hosts file.


-- End of Deckard's System Scanner: finished at 2008-07-16 18:54:51 ------------

Und nun?

#15 Hallo dopa

zwei so ähnliche nicknames.... da muss man aufpassen, dass man nicht durcheinander kommt

ich finde nichts mehr, scanne dennoch mit Malwarebytes + poste den report
http://virus-protect.org/artikel/tools/malwarebytes.html
__________
MfG Sabina

rund um die PC-Sicherheit