Agent.exe - Ausfürbare Datei wurde verändert

#1 Hallo zusammen!

Ich habe, seitdem ich gestern iTunes ngeupdated habe, ständig das Problem dass Kapersky mich warnt, Agent.exe wäre geändert worden. Ausserdem behauptet Windows Vista plötzlich, es sei noch nicht aktiviert *grübel*

Könnt ihr mit dem log was anfangen? Nicht, dass ich mir was eingefangen habe. Der Schleppi ist doch noch so neu *seufz*

ComboFix 09-06-03.04 - Moritz 04.06.2009 11:46.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.49.1031.18.3066.1757 [GMT 2:00]
ausgeführt von:: c:\users\Moritz\Downloads\ComboFix.exe
AV: Kaspersky Security Suite CBE *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Security Suite CBE *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
SP: Kaspersky Security Suite CBE *disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\drivers\1025_ACER_AS8730.mrk
c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01007.Wdf
c:\windows\system32\drivers\Msft_Kernel_nuvotonhidgeneric_01007.Wdf
c:\windows\system32\drivers\Msft_Kernel_SynTP_01000.Wdf
c:\windows\system32\drivers\Msft_User_PCCSWpdDriver_01_05_00.Wdf
c:\windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf
c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
c:\windows\Temp\log.txt

.
((((((((((((((((((((((( Dateien erstellt von 2009-05-04 bis 2009-06-04 ))))))))))))))))))))))))))))))
.

2009-06-02 23:43 . 2009-06-02 23:43 -------- d-----w- c:\program files\iPod
2009-06-02 23:43 . 2009-06-02 23:43 -------- d-----w- c:\program files\iTunes
2009-06-02 23:34 . 2009-06-02 23:34 75048 ----a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 8.2.0.23\SetupAdmin.exe
2009-05-28 11:44 . 2009-06-02 23:38 -------- d-----w- c:\windows\LastGood.Tmp
2009-05-27 10:48 . 2009-05-27 10:48 -------- d-----w- c:\users\Moritz\AppData\Roaming\Blackberry Desktop
2009-05-27 10:27 . 2009-05-27 10:27 -------- d-----w- c:\users\Moritz\AppData\Roaming\Research In Motion
2009-05-27 10:20 . 2009-05-27 10:20 -------- d-----w- c:\program files\Common Files\PX Storage Engine
2009-05-27 10:19 . 2009-05-27 10:19 -------- d-----w- c:\program files\Common Files\Sonic Shared
2009-05-27 10:19 . 2009-05-27 10:19 -------- d-----w- c:\program files\Roxio
2009-05-27 10:13 . 2009-05-28 11:40 -------- d-----w- c:\program files\Common Files\Research In Motion
2009-05-26 11:49 . 2009-05-27 10:38 -------- d-----w- c:\users\Moritz\AppData\Roaming\Roxio
2009-05-26 11:00 . 2009-05-26 11:00 -------- d-----w- c:\programdata\InstallShield
2009-05-26 11:00 . 2009-05-26 11:00 -------- d-----w- c:\programdata\Sonic
2009-05-26 10:57 . 2009-05-27 10:19 -------- d-----w- c:\programdata\Roxio
2009-05-26 10:57 . 2009-05-27 10:20 -------- d-----w- c:\program files\Common Files\Roxio Shared
2009-05-26 10:52 . 2007-01-18 08:24 26496 ----a-w- c:\windows\system32\drivers\RimSerial.sys
2009-05-26 10:51 . 2009-05-26 10:51 -------- d-----w- c:\program files\Research In Motion
2009-05-26 10:09 . 2009-05-26 10:09 -------- d-----w- c:\users\Moritz\{bc628393-ec42-4474-8248-343bed500c1a}
2009-05-26 09:20 . 2009-02-09 05:37 91136 ----a-w- c:\windows\system32\nmwcdcls.dll
2009-05-26 09:20 . 2009-05-26 09:19 33849120 ----a-w- c:\programdata\Installations\{58FB2F9A-5F2D-40E8-82DF-4987E60AD8BD}\Nokia_PC_Suite_7_1_18_0_ger_web.exe
2009-05-26 09:20 . 2009-05-26 09:20 61440 ----a-w- c:\programdata\Installations\{58FB2F9A-5F2D-40E8-82DF-4987E60AD8BD}\Installer\CommonCustomActions\UninstPCSFEMsi.exe
2009-05-26 09:20 . 2009-05-26 09:20 8192 ----a-w- c:\programdata\Installations\{58FB2F9A-5F2D-40E8-82DF-4987E60AD8BD}\Installer\CommonCustomActions\UninstCCD.exe
2009-05-26 09:20 . 2009-05-26 09:20 10240 ----a-w- c:\programdata\Installations\{58FB2F9A-5F2D-40E8-82DF-4987E60AD8BD}\Installer\CommonCustomActions\UninstPCS.exe
2009-05-26 09:20 . 2009-05-26 10:03 -------- d-----w- c:\programdata\Installations
2009-05-24 23:09 . 2009-05-24 23:09 -------- d-----w- c:\programdata\TERMINAL Studio
2009-05-18 22:00 . 2009-05-18 22:00 -------- d-----w- c:\users\Moritz\sicherung 08.05
2009-05-16 01:11 . 2009-05-16 01:11 -------- d-----w- c:\windows\MyTempDll
2009-05-16 01:09 . 2007-01-16 16:15 962560 ----a-w- c:\windows\system32\GXAMP4D.dll
2009-05-16 01:09 . 2006-12-07 09:05 323584 ----a-w- c:\windows\system32\GXGM20.dll
2009-05-16 01:09 . 2002-02-26 04:11 255488 ----a-w- c:\windows\m3jpeg32.dll
2009-05-16 01:09 . 2001-05-04 10:05 413760 ----a-w- c:\windows\mpg4c32.dll
2009-05-16 01:09 . 2000-06-23 08:36 745984 ----a-w- c:\windows\ir50_32.dll
2009-05-09 10:40 . 2009-05-09 10:40 3643 ----a-w- c:\programdata\Kaspersky Lab\AVP7\Data\Updater\Temporary Files\temporaryFolder\bases\aspy\ForDiff\aphish.dat.com

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-04 09:46 . 2009-03-03 20:22 247606048 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-06-03 09:20 . 2009-03-03 20:22 -------- d-----w- c:\programdata\Kaspersky Lab
2009-06-03 09:20 . 2009-03-03 14:36 31966 ----a-w- c:\programdata\nvModes.dat
2009-06-02 23:54 . 2009-01-23 01:53 618442 ----a-w- c:\windows\system32\perfh007.dat
2009-06-02 23:54 . 2009-01-23 01:53 122842 ----a-w- c:\windows\system32\perfc007.dat
2009-06-02 23:46 . 2009-03-03 20:22 3299744 --sha-w- c:\windows\system32\drivers\fidbox.idx
2009-06-02 23:43 . 2009-03-28 13:02 -------- d-----w- c:\program files\Common Files\Apple
2009-06-02 23:41 . 2009-03-28 13:03 -------- d-----w- c:\program files\QuickTime
2009-06-01 07:50 . 2009-03-05 21:37 7592 ----a-w- c:\users\Moritz\AppData\Local\d3d9caps.dat
2009-05-28 11:32 . 2009-03-06 10:51 -------- d-----w- c:\users\Moritz\AppData\Roaming\InstallShield
2009-05-27 10:27 . 2009-03-03 19:29 117304 ----a-w- c:\users\Moritz\AppData\Local\GDIPFONTCACHEV1.DAT
2009-05-26 10:58 . 2009-05-26 09:25 -------- d-----w- c:\users\Moritz\AppData\Roaming\Nokia
2009-05-26 10:57 . 2009-01-22 18:16 -------- d-----w- c:\program files\Common Files\InstallShield
2009-05-26 10:20 . 2009-05-26 09:25 -------- d-----w- c:\users\Moritz\AppData\Roaming\PC Suite
2009-05-26 10:20 . 2009-05-26 09:25 -------- d-----w- c:\programdata\PC Suite
2009-05-26 10:09 . 2009-05-26 10:09 -------- d-----w- c:\program files\Common Files\PCSuite
2009-05-26 10:09 . 2009-05-26 10:09 -------- d-----w- c:\program files\Common Files\Nokia
2009-05-26 10:09 . 2009-05-26 09:20 -------- d-----w- c:\program files\Nokia
2009-05-26 10:08 . 2009-05-26 10:08 -------- d-----w- c:\program files\PC Connectivity Solution
2009-05-26 10:03 . 2009-05-26 10:03 8192 ----a-w- c:\programdata\Installations\{7694EC32-CB0E-4B35-9088-7B320CB1F4FE}\Installer\CommonCustomActions\UninstCCD.exe
2009-05-26 10:03 . 2009-05-26 10:03 61440 ----a-w- c:\programdata\Installations\{7694EC32-CB0E-4B35-9088-7B320CB1F4FE}\Installer\CommonCustomActions\UninstPCSFEMsi.exe
2009-05-26 10:03 . 2009-05-26 10:03 10240 ----a-w- c:\programdata\Installations\{7694EC32-CB0E-4B35-9088-7B320CB1F4FE}\Installer\CommonCustomActions\UninstPCS.exe
2009-05-26 10:03 . 2009-05-26 10:03 34217960 ----a-w- c:\programdata\Installations\{7694EC32-CB0E-4B35-9088-7B320CB1F4FE}\Nokia_PC_Suite_7_1_26_0_ger.exe
2009-05-26 09:24 . 2009-05-26 09:24 -------- d-----w- c:\program files\DIFX
2009-05-20 13:32 . 2009-03-03 20:22 94643 ----a-w- c:\windows\system32\drivers\klick.dat
2009-05-20 13:32 . 2009-03-03 20:22 105395 ----a-w- c:\windows\system32\drivers\klin.dat
2009-05-14 01:00 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-04-10 22:28 . 2009-04-10 22:28 -------- d-----w- c:\programdata\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-04-04 09:13 . 2009-04-04 09:13 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-03-19 14:32 . 2009-04-10 22:28 23400 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-03-19 14:32 . 2009-03-19 14:32 23400 ----a-w- c:\programdata\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}\x86\x86\GEARAspiWDM.sys
2009-03-17 03:38 . 2009-04-16 01:58 13824 ----a-w- c:\windows\system32\apilogen.dll
2009-03-17 03:38 . 2009-04-16 01:58 24064 ----a-w- c:\windows\system32\amxread.dll
2009-03-08 11:34 . 2009-05-21 21:10 914944 ----a-w- c:\windows\system32\wininet.dll
2009-03-08 11:34 . 2009-05-21 21:10 43008 ----a-w- c:\windows\system32\licmgr10.dll
2009-03-08 11:33 . 2009-05-21 21:10 18944 ----a-w- c:\windows\system32\corpol.dll
2009-03-08 11:33 . 2009-05-21 21:10 109056 ----a-w- c:\windows\system32\iesysprep.dll
2009-03-08 11:33 . 2009-05-21 21:10 109568 ----a-w- c:\windows\system32\PDMSetup.exe
2009-03-08 11:33 . 2009-05-21 21:10 107520 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2009-03-08 11:33 . 2009-05-21 21:10 107008 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2009-03-08 11:33 . 2009-05-21 21:10 103936 ----a-w- c:\windows\system32\SetDepNx.exe
2009-03-08 11:33 . 2009-05-21 21:10 132608 ----a-w- c:\windows\system32\ieUnatt.exe
2009-03-08 11:33 . 2009-05-21 21:10 420352 ----a-w- c:\windows\system32\vbscript.dll
2009-03-08 11:32 . 2009-05-21 21:10 72704 ----a-w- c:\windows\system32\admparse.dll
2009-03-08 11:32 . 2009-05-21 21:10 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-03-08 11:32 . 2009-05-21 21:10 66560 ----a-w- c:\windows\system32\wextract.exe
2009-03-08 11:32 . 2009-05-21 21:10 169472 ----a-w- c:\windows\system32\iexpress.exe
2009-03-08 11:31 . 2009-05-21 21:10 34816 ----a-w- c:\windows\system32\imgutil.dll
2009-03-08 11:31 . 2009-05-21 21:10 48128 ----a-w- c:\windows\system32\mshtmler.dll
2009-03-08 11:31 . 2009-05-21 21:10 45568 ----a-w- c:\windows\system32\mshta.exe
2009-03-08 11:22 . 2009-05-21 21:10 156160 ----a-w- c:\windows\system32\msls31.dll
.

(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2008-07-29 16:52 121392 ----a-w- c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2009-03-20 1312256]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2007-08-30 205480]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-04-25 1049896]
"BkupTray"="c:\program files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe" [2008-04-25 28672]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-11-22 13601312]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-11-22 92704]
"PLFSetI"="c:\windows\PLFSetI.exe" [2007-10-23 200704]
"LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2008-12-17 858632]
"ePower_DMC"="c:\program files\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2008-11-28 417792]
"eDataSecurity Loader"="c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe" [2008-07-29 526896]
"eAudio"="c:\program files\Acer\Empowering Technology\eAudio\eAudio.exe" [2008-09-11 544768]
"ArcadeDeluxeAgent"="c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" [2008-10-08 147456]
"CLMLServer"="c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe" [2008-10-08 167936]
"PlayMovie"="c:\program files\Acer Arcade Deluxe\PlayMovie\PMVService.exe" [2008-10-17 167936]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-10-14 4

#2 1. ist das nicht das ganze combofixlog. poste den inhalt von combofix.txt
2. arbeite die anleitung zur virenentfernung (erstellen neuer beiträge) ab und
http://board.protecus.de/t23187.htm
poste die logs.
woher hast du den itunes geladen, vom hersteller? wenn nein, poste den link aber unklickbar also
hxxp// usw.