Hallo zusammen!
Ich bin nicht gerade das, was man als komputerprofi bezeichnen würde und deshalb hoffe ich nocheinmal mehr dass ihr mir dementsprechend helfen könnt!

ich habe mich im internet schlau gemacht und herausgefunden dass ich durch die installation von antivirgear einen großen fehler gemacht habe.. ich habe das programm allerdings schon wieder gelöscht! nur unachtsamkeit und meinem "fachwissen habe ich mir allerdings den gleichen fehler (mit anderem programm) nochmals erlaubt!

nach weiterer suche im internet habe ich den ordner viedo atcive x access gelöscht und mir anschließend HijackThis downgeloaded!

hab mir folgendes Logfile erstellt:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:23:02, on 24.09.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Network Associates\Common Framework\FrameworkService.exe
C:\Programme\Network Associates\VirusScan\Mcshield.exe
C:\Programme\Network Associates\VirusScan\VsTskMgr.exe
C:\Programme\Microsoft SQL Server\MSSQL$MESONIC\Binn\sqlservr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\Programme\Roxio\MyDVD\MyDVD\USBDeviceService.exe
C:\Programme\Network Associates\VirusScan\SHSTAT.EXE
C:\Programme\Network Associates\Common Framework\UpdaterUI.exe
C:\Programme\Sony\HotKey Utility\HKserv.exe
D:\SPMgr.exe
C:\Programme\Java\jre1.5.0_04\bin\jusched.exe
C:\Programme\Sony\HotKey Utility\HKWnd.exe
C:\Programme\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Programme\Roxio\MyDVD\MyDVD\DetectorApp.exe
C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe
C:\Programme\ATnotes\ATnotes.exe
C:\Programme\Internet Explorer\IEXPLORE.EXE
C:\Programme\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Programme\Siemens\Gigaset USB Stick 108\Gcc.exe
C:\Programme\Siemens\Gigaset USB Stick 108\OdHost.exe
C:\Programme\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\System32\Rundll32.exe
C:\Programme\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.at/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.168.24.2:3128
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - D:\Programme\ICQToolbar\toolbaru.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1C3C4699-B285-475F-BE47-0B26088CE876} - C:\Programme\Video ActiveX Access\iesplg.dll (file missing)
O2 - BHO: rightonadz.biz browser optimizer - {36A91CEC-6C71-4758-B492-397BFC8E96A2} - C:\WINDOWS\system32\gzmrotate.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Viewpoint Toolbar BHO - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\Programme\Viewpoint\Viewpoint Toolbar\ViewBarBHO.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar2.dll
O2 - BHO: adssite - {F31B3634-12AA-41ca-B021-0685C3B3E4CA} - C:\WINDOWS\system32\nsh12D3.dll
O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Programme\Viewpoint\Viewpoint Toolbar\ViewBar.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar2.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Programme\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - D:\Programme\ICQToolbar\toolbaru.dll (file missing)
O3 - Toolbar: Mein PONSline - {A6F74643-242A-A7A4-8DD5-AB40B9E25345} - (no file)
O3 - Toolbar: Adssite Toolbar - {41C29B07-6F91-4966-91BE-2E2841643C83} - C:\Programme\Adssite Advanced Toolbar\toolbar.dll
O3 - Toolbar: Protection Bar - {F06E2ABE-3A50-4079-BE25-FC100D9EAA25} - C:\Programme\Video ActiveX Access\iesbpl.dll (file missing)
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [ShStatEXE] "C:\Programme\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Programme\Network Associates\Common Framework\UpdaterUI.exe"
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programme\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [HKSERV.EXE] C:\Programme\Sony\HotKey Utility\HKserv.exe
O4 - HKLM\..\Run: [SonyPowerCfg] D:\SPMgr.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [OpwareSE2] "C:\Programme\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [OPSE reminder] "C:\Programme\ScanSoft\OmniPageSE2.0\EregGer\Ereg.exe" -r "C:\Programme\ScanSoft\OmniPageSE2.0\EregGer\ereg.ini"
O4 - HKLM\..\Run: [ICQ Lite] "D:\Programme\ICQLite\ICQLite.exe" -minimize
O4 - HKLM\..\Run: [webHancer Agent] "C:\Program Files\webHancer\Programs\whAgent.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [DetectorApp] C:\Programme\Roxio\MyDVD\MyDVD\DetectorApp.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\GEMEIN~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [hid_start] C:\WINDOWS\System32\Rundll32.exe "C:\WINDOWS\system32\gzmrotate.dll" DllVerify
O4 - HKLM\..\Run: [{58-8E-EF-F0-ZN}] C:\DOKUME~1\Manuel\LOKALE~1\Temp\BundleDownloader\22.ex_ P2D002
O4 - HKLM\..\RunOnce: [iMeshBar Uninstall] rundll32 C:\PROGRA~1\UNINST~1.DLL,O -2
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ATnotes.exe] C:\Programme\ATnotes\ATnotes.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programme\Gemeinsame Dateien\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Programme\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [EA Core] C:\Programme\Electronic Arts\EA Downloader\Core.exe -silent
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: TA_Start.lnk = C:\Dokumente und Einstellungen\Manuel\Lokale Einstellungen\Temp\BundleDownloader\22.ex_
O4 - Global Startup: Acrobat Assistant.lnk = C:\Programme\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Gigaset WLAN Adapter Monitor.lnk = C:\Programme\Siemens\Gigaset USB Stick 108\Gcc.exe
O4 - Global Startup: Service Manager.lnk = C:\Programme\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programme\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Google Search - res://c:\programme\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &ICQ Toolbar Search - res://D:\Programme\ICQToolbar\toolbaru.dll/SEARCH.HTML
O8 - Extra context menu item: &Translate English Word - res://c:\programme\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: &Viewpoint Search - res://C:\Programme\Viewpoint\Viewpoint Toolbar\ViewBar.dll/CXTSEARCH.HTML
O8 - Extra context menu item: Backward Links - res://c:\programme\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\programme\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Easy-WebPrint - Drucken - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint - Schnelldruck - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint - Vorschau - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint - Zu Druckliste hinzufügen - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\programme\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\programme\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O12 - Plugin for .pdf: C:\Programme\Internet Explorer\PLUGINS\nppdf32.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.hakhollabrunn.ac.at
O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} (MetaStreamCtl Class) - https://components.viewpoint.com/MTSInstallers/MetaStream3.cab?url=http://www.viewpoint.com/cgi-bin/installer.v4/vet_install_popup.pl?1&4&04.00.05.04&unknown&unknown&http://www9.volvo.com/truck/3dtruckconfigurator2/all/fh16.asp
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = nhl.local
O17 - HKLM\Software\..\Telephony: DomainName = nhl.local
O17 - HKLM\System\CCS\Services\Tcpip\..\{4D09F4F5-19DF-4FCF-AED7-15D16507752B}: NameServer = 213.33.99.70,80.120.17.70
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = nhl.local
O22 - SharedTaskScheduler: flensburg - {d6ef030a-a235-41ba-9ead-89b6ff542f00} - C:\WINDOWS\system32\pluwue.dll (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Programme\Gemeinsame Dateien\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Programme\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Programme\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Programme\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: RadClock - Unknown owner - C:\WINDOWS\system32\RadClock.exe
O23 - Service: USBDeviceService - Unknown owner - C:\Programme\Roxio\MyDVD\MyDVD\USBDeviceService.exe

--
End of file - 12264 bytes


--------------------------
ich hoffe ich habe dabei nicht allzuviel falsch gemacht und ihr könnt mir helfen
bitte nicht vergessen dass ich eher zu den Laien zu zählen bin!
vielen dank für eure hilfe!!!
mfg m_leeb

Anleitung SmitfraudFix:

Lade dir dieses Tool -> SmitfraudFix
-Boote im abgesicherten Modus
-Starte es dann und lass das System Reinigen. (Option 2)



-Poste danach wie in der Anleitung beschrieben, das Ergebnis des Scans, die C:\rapport.txt

danke mal für diesen tipp
ich werde mein bestes tun!
mfg

hier habe ich dir rapport.txt datei:
SmitFraudFix v2.227

Scan done at 15:54:18,08, 24.09.2007
Run from C:\Dokumente und Einstellungen\Manuel\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{d6ef030a-a235-41ba-9ead-89b6ff542f00}"="flensburg"

[HKEY_CLASSES_ROOT\CLSID\{d6ef030a-a235-41ba-9ead-89b6ff542f00}\InProcServer32]
@="C:\WINDOWS\system32\pluwue.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{d6ef030a-a235-41ba-9ead-89b6ff542f00}\InProcServer32]
@="C:\WINDOWS\system32\pluwue.dll"


»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» hosts


127.0.0.1 localhost

»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

C:\DOKUME~1\ALLUSE~1.WIN\STARTM~1\Online Security Guide.url Deleted
C:\DOKUME~1\ALLUSE~1.WIN\STARTM~1\Security Troubleshooting.url Deleted
C:\DOKUME~1\Manuel\FAVORI~1\Online Security Test.url Deleted
C:\Programme\AntiVirGear 3.7\ Deleted

»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{4D09F4F5-19DF-4FCF-AED7-15D16507752B}: NameServer=213.33.99.70,80.120.17.70
HKLM\SYSTEM\CS1\Services\Tcpip\..\{4D09F4F5-19DF-4FCF-AED7-15D16507752B}: NameServer=213.33.99.70,80.120.17.70
HKLM\SYSTEM\CS3\Services\Tcpip\..\{4D09F4F5-19DF-4FCF-AED7-15D16507752B}: NameServer=213.33.99.70,80.120.17.70


»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{d6ef030a-a235-41ba-9ead-89b6ff542f00}"="flensburg"

[HKEY_CLASSES_ROOT\CLSID\{d6ef030a-a235-41ba-9ead-89b6ff542f00}\InProcServer32]
@="C:\WINDOWS\system32\pluwue.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{d6ef030a-a235-41ba-9ead-89b6ff542f00}\InProcServer32]
@="C:\WINDOWS\system32\pluwue.dll"



»»»»»»»»»»»»»»»»»»»»»»»» End

und jetzt!?!
mfg

Smitfraudfix hat nicht alles gefunden!

ComboFix

-Lade dir das Tool hier herunter -> KLICK
-Starte nun die combofix.exe, bestätige mit (Y)es, lass die Bereinigung durchlaufen
und kopiere nun den Text ab, und füge ihn in deinen Beitrag im Board ein!

Dann noch mal Smitfraudfix wie eben laufen lassen und das Log posten.

Filelist

1. Lade das filelist.zip auf deinen Desktop herunter.
2. Entpacke die Zip-Datei auf deinen Desktop (mit einem Packprogramm), öffne die nun auf deinem Destop vorhandene filelist.bat mit einem Doppelklick auf die Datei
3. Dein Editor (Textverarbeitungsprogramm) wird sich öffnen
4. Markiere von diesem Inhalt aus jedem Verzeichnis jeweils die letzten 30 Tage, wähle kopieren, füge diese Dateien in deinem nächsten Beitrag ein.

Dies sind die Verzeichnisse von denen wir jeweils die letzten 30 Tage sehen wollen:
Verzeichnis von C:\
Verzeichnis von C:\WINDOWS\system32
Verzeichnis von C:\WINDOWS
Verzeichnis von C:\WINDOWS\Prefetch (Windows XP)
Verzeichnis von C:\WINDOWS\tasks
Verzeichnis von C:\WINDOWS\Temp
Verzeichnis von C:\DOCUME~1\Name\LOCALS~1\Temp
Credits to Karl83 / KarlKarl

Also mit dem ComboFix gab es bei mir einige Probleme:
nach dem Durchlauf der Reiningung (es wurden einige Stufen aufgezählt...) schlug ein automatischer Neustart fehl und ich bekam den blauen bildschirm mit "schwerwiegender fehler" etc.!

hier sind jedoch die verzeichnisse (jeweils die letzten 30 tage) ... ich hoffe das bringt was!

Verzeichnis von C:\

2007-09-24 20:03 535,875,584 hiberfil.sys
2007-09-24 15:54 2,640 rapport.txt
2007-09-24 00:12 30,729 crashAddress.txt

Verzeichnis von C:\WINDOWS\system32

2007-09-24 20:06 1,179,402 perfh009.dat
2007-09-24 20:06 602,068 perfc009.dat
2007-09-24 20:06 1,505,154 perfh007.dat
2007-09-24 20:06 697,472 perfc007.dat
2007-09-24 20:06 3,742 PerfStringBackup.INI
2007-09-24 20:03 13,002 wpa.dbl
2007-09-24 15:54 0 tmp.txt
2007-09-24 15:54 4,504 tmp.reg
2007-09-18 09:16 40,315 gzmrot-uninst.exe
2007-09-18 09:16 79,882 adssite-remove.exe
2007-09-12 12:46 62,464 gzmrotate.dll
2007-09-06 04:50 17,474,680 MRT.exe
2007-09-06 00:22 289,144 VCCLSID.exe
2007-08-29 19:06 249,852 TZLog.log

Verzeichnis von C:\WINDOWS\Prefetch

2007-09-24 20:06 29,172 WMIPRVSE.EXE-0D449B4F.pf
2007-09-24 20:06 24,898 WMIADAP.EXE-32F99497.pf
2007-09-24 20:06 82,348 IEXPLORE.EXE-360BBB5C.pf
2007-09-24 20:05 20,032 MOBSYNC.EXE-0EFADB79.pf
2007-09-24 20:05 78,658 DWWIN.EXE-2C373FB7.pf
2007-09-24 20:04 119,904 WUAUCLT.EXE-1360D60A.pf
2007-09-24 20:04 29,086 USERINIT.EXE-0743FDA9.pf
2007-09-24 20:04 50,976 POWERPNT.EXE-345BE1B3.pf
2007-09-24 20:04 20,510 REGSVR32.EXE-396DEA2C.pf
2007-09-24 20:04 1,088,058 NTOSBOOT-B00DFAAD.pf
2007-09-24 16:31 58,714 NOTEPAD.EXE-2F2D61E1.pf
2007-09-24 16:16 16,764 VERCLSID.EXE-28F52AD2.pf
2007-09-24 15:59 29,416 WGATRAY.EXE-350D4455.pf
2007-09-24 15:37 62,556 ICQLITE.EXE-27EB5A87.pf
2007-09-24 14:54 34,162 AU_.EXE-17000160.pf
2007-09-24 14:24 19,616 TASKMGR.EXE-06144C13.pf
2007-09-24 14:19 75,258 RUNDLL32.EXE-61CC0D7C.pf
2007-09-24 14:18 50,480 DRWTSN32.EXE-01DDCF15.pf
2007-09-24 14:12 35,992 RUNDLL32.EXE-3F254C92.pf
2007-09-24 13:33 82,220 DUMPREP.EXE-0AF2BF67.pf
2007-09-24 01:07 99,836 WMPLAYER.EXE-017735B5.pf
2007-09-24 00:53 72,810 BEARSHARE.EXE-22CC2AD5.pf
2007-09-24 00:07 76,296 MANAGER07.EXE-38B7302D.pf
2007-09-22 21:32 59,384 RUNDLL32.EXE-4EE39BB6.pf
2007-09-22 20:52 88,622 WMPLAYER.EXE-017735B4.pf
2007-09-22 20:38 80,334 WMPLAYER.EXE-017735B3.pf
2007-09-21 18:31 41,424 WINZIP32.EXE-2F3C90C9.pf
2007-09-21 05:07 13,958 RUNDLL32.EXE-6E8D4657.pf
2007-09-20 13:52 26,636 AGENT.EXE-04D86242.pf
2007-09-20 13:51 12,856 ISUSPM.EXE-0D47C79C.pf
2007-09-19 18:50 57,698 DFRGNTFS.EXE-38C3807C.pf
2007-09-19 18:50 16,498 DEFRAG.EXE-2858C7E2.pf
2007-09-19 18:50 373,210 Layout.ini
2007-09-18 00:13 78,354 WMPLAYER.EXE-017735B1.pf
2007-09-16 20:55 20,488 RUNDLL32.EXE-41FB74E5.pf
2007-09-15 13:14 70,990 MSIMN.EXE-2E3AC8DB.pf
2007-09-15 01:39 65,258 MSNMSGR.EXE-0B0F9290.pf
2007-09-14 17:47 22,162 ZPLAYER.EXE-2230A905.pf
2007-09-14 17:03 20,982 MCSCRIPT.EXE-06C12F1E.pf
2007-09-14 17:03 21,222 MCUPDATE.EXE-05F6C622.pf
2007-09-08 17:18 16,634 RUNDLL32.EXE-7215828E.pf
2007-09-08 17:18 76,222 PHOTOSHP.EXE-37572EC3.pf
2007-09-08 17:09 45,902 ACRORD32INFO.EXE-3AD69296.pf
2007-09-08 17:07 99,642 WINWORD.EXE-218A1AF8.pf
2007-09-08 16:18 23,650 SETUP.EXE-00FAC559.pf
2007-09-08 16:17 7,152 QT3GPPFLATTEN.EXE-0856913B.pf
2007-09-08 16:17 75,624 FFMPEG.EXE-335A8E6C.pf
2007-09-08 16:16 19,332 3GP_CONVERTER.EXE-3731FA52.pf
2007-09-08 16:16 7,426 AVSCHECK.EXE-1A20789A.pf
2007-09-08 15:34 24,164 RUNDLL32.EXE-5E6F207D.pf
2007-09-08 15:34 24,308 RUNDLL32.EXE-46122CFA.pf
2007-09-08 14:32 32,148 RUNDLL32.EXE-3AE85716.pf
2007-09-08 14:32 32,484 RUNDLL32.EXE-4DE6ABA9.pf
2007-09-08 14:31 29,424 RUNDLL32.EXE-3F777136.pf
2007-09-08 14:31 27,880 RUNDLL32.EXE-57492CA2.pf
2007-09-08 14:30 27,304 RUNDLL32.EXE-4150D622.pf
2007-09-08 14:29 27,638 RUNDLL32.EXE-50B5C57E.pf
2007-09-08 14:27 29,428 RUNDLL32.EXE-5E84FFBA.pf
2007-09-08 14:06 16,486 RUNDLL32.EXE-4D165A71.pf
2007-09-07 14:55 81,474 HELPSVC.EXE-1C192440.pf
2007-09-07 08:38 29,190 RUNDLL32.EXE-4C1B3145.pf
2007-09-07 08:38 33,280 RUNDLL32.EXE-696F2A94.pf
2007-09-07 08:10 16,486 RUNDLL32.EXE-766C6BB3.pf
2007-09-05 03:28 18,606 RUNDLL32.EXE-50A0D04F.pf
2007-09-05 02:57 26,348 DIVXSM.EXE-052AE590.pf
2007-09-05 00:43 22,254 RUNDLL32.EXE-552B536E.pf
2007-09-04 22:06 17,098 RUNDLL32.EXE-7487E34E.pf
2007-09-04 22:04 25,420 RUNDLL32.EXE-5BD8A836.pf
2007-09-04 16:07 24,744 RUNDLL32.EXE-5FB62B09.pf
2007-09-04 16:07 24,562 RUNDLL32.EXE-40D217DD.pf
2007-09-04 15:02 19,224 USNSVC.EXE-39BD0D0B.pf
2007-09-04 10:15 16,486 RUNDLL32.EXE-5B9F4A2F.pf
2007-09-04 10:11 16,486 RUNDLL32.EXE-48F58BB1.pf
2007-09-04 09:59 28,966 FFMPEG.EXE-2F5A0451.pf
2007-09-04 09:53 20,826 3GP_CONVERTER.EXE-0933D87D.pf
2007-09-04 09:53 8,154 AVSCHECK.EXE-2BC06317.pf
2007-09-04 09:51 27,350 SETUP.EXE-03C9C583.pf
2007-09-04 09:50 3,408 FFMPEG.EXE-016B1D23.pf
2007-09-04 09:49 7,170 ATOMCHANGER.EXE-316B55FA.pf
2007-09-04 09:49 15,566 3GP_CONVERTER.EXE-357D95BB.pf
2007-09-04 09:44 5,268 MESSAGEBOX.EXE-18B00B46.pf
2007-09-04 09:44 6,656 SHUTDOWN.EXE-1132BD1A.pf
2007-09-04 09:44 3,440 AVSCHECK.EXE-189BBFA6.pf
2007-09-04 09:32 26,940 FLVPLAYER.EXE-1AD552AE.pf
2007-09-04 09:30 14,830 RUNDLL32.EXE-6EEE0EC9.pf
2007-09-03 11:14 42,376 RUNDLL32.EXE-6700A4A0.pf
2007-08-31 18:17 2,640 RUNDLL32.EXE-453420C4.pf
2007-08-30 23:06 16,486 RUNDLL32.EXE-3B75B76F.pf
2007-08-30 22:47 16,426 RUNDLL32.EXE-63DA62D6.pf
2007-08-30 22:23 45,598 THEMESCREATOR.EXE-04579873.pf
2007-08-30 22:05 16,486 RUNDLL32.EXE-66822FB7.pf
2007-08-30 21:18 23,644 RUNDLL32.EXE-72F27B40.pf
2007-08-30 21:17 23,734 RUNDLL32.EXE-50854CFC.pf
2007-08-30 21:15 34,018 THEMESCREATOR-V3.17.B4.EXE-03F54ABE.pf
2007-08-30 21:14 22,718 RUNDLL32.EXE-4AA1433B.pf
2007-08-30 13:38 18,116 RUNDLL32.EXE-693123C7.pf
2007-08-30 12:56 31,746 SAPISVR.EXE-01935425.pf
2007-08-30 12:56 28,818 RUNDLL32.EXE-66AA8248.pf
2007-08-30 11:57 16,486 RUNDLL32.EXE-6D223DAB.pf
2007-08-30 11:50 21,604 ODHOST.EXE-191FCC90.pf
2007-08-30 11:50 22,194 WZQKPICK.EXE-28392457.pf
2007-08-30 11:50 25,800 SQLMANGR.EXE-07A2C011.pf
2007-08-30 11:50 12,212 READER_SL.EXE-2A604B5A.pf
2007-08-30 11:50 10,954 ACROTRAY.EXE-13B05561.pf
2007-08-30 11:50 18,758 CORE.EXE-188297D2.pf
2007-08-30 11:50 13,802 ATNOTES.EXE-1603798A.pf
2007-08-30 11:50 5,010 ISSCH.EXE-0CA829D3.pf
2007-08-30 11:50 14,360 ISUSPM.EXE-375F0166.pf
2007-08-30 11:50 25,830 HKSERV.EXE-19BD6D27.pf
2007-08-30 11:50 14,624 DAEMON.EXE-08834E39.pf
2007-08-30 11:50 19,596 UPDATERUI.EXE-23B9083F.pf
2007-08-30 11:50 16,646 SHSTAT.EXE-0240FD44.pf
2007-08-30 11:50 10,956 CTFMON.EXE-05E57A5E.pf
2007-08-30 11:49 60,682 EXPLORER.EXE-02121B1A.pf
2007-08-30 11:49 18,908 ATI2EVXX.EXE-07A42849.pf
2007-08-30 11:49 5,992 ATIPRBXX.EXE-0B7C0042.pf
2007-08-30 11:49 9,224 ATIPTAXX.EXE-362CCF09.pf
2007-08-30 11:49 15,714 MPNOTIFY.EXE-240461D6.pf
2007-08-30 11:40 6,110 LOGON.SCR-24ADF392.pf
2007-08-30 11:20 16,486 RUNDLL32.EXE-3EA62109.pf
2007-08-30 11:16 10,522 RUNONCE.EXE-01CA3A2F.pf
2007-08-30 11:15 29,192 RUNDLL32.EXE-63CCACB5.pf
2007-08-29 19:08 94,414 ACRORD32.EXE-0ABDA372.pf
2007-08-29 19:06 51,898 UPDATE.EXE-33C870DA.pf
2007-08-29 19:06 5,078 TZCHANGE.EXE-0A83DDF5.pf
2007-08-29 19:05 28,416 UPDATE.EXE-235E9B16.pf
2007-08-29 12:58 7,840 ADOBE GAMMA LOADER.EXE-0C2694E8.pf
2007-08-28 23:26 13,534 UNINST.EXE-1F124E75.pf
2007-08-28 23:26 14,932 UNINSTALLER.EXE-056F804C.pf
2007-08-28 20:09 55,962 UPDATE.EXE-14A99CB9.pf

Verzeichnis von C:\WINDOWS

2007-09-24 20:03 0 0.log
2007-09-24 20:03 1,410,604 WindowsUpdate.log
2007-09-24 20:03 50 wiaservc.log
2007-09-24 20:03 159 wiadebug.log
2007-09-24 20:03 2,048 bootstat.dat
2007-09-24 15:55 161,532 setupact.log
2007-09-24 15:51 179,632 ntbtlog.txt
2007-09-24 15:49 32,622 SchedLgU.Txt
2007-09-14 17:03 512 randseed.rnd
2007-09-13 12:23 155,469 wmsetup.log
2007-08-30 11:17 657,779 setupapi.log
2007-08-29 19:07 211,484 ntdtcsetup.log
2007-08-29 19:07 349,656 comsetup.log
2007-08-29 19:07 1,189,924 iis6.log
2007-08-29 19:07 1,374 imsins.log
2007-08-29 19:07 54,152 ocmsn.log
2007-08-29 19:07 471,952 tsoc.log
2007-08-29 19:07 43,979 tabletoc.log
2007-08-29 19:07 7,975 KB939683.log
2007-08-29 19:07 61,788 medctroc.Log
2007-08-29 19:07 153,011 netfxocm.log
2007-08-29 19:07 486,697 ocgen.log
2007-08-29 19:07 51,364 msgsocm.log
2007-08-29 19:07 1,017,974 FaxSetup.log
2007-08-29 19:07 322,530 msmqinst.log
2007-08-29 19:06 1,374 imsins.BAK
2007-08-29 19:06 22,450 KB933360.log

Verzeichnis von C:\WINDOWS\tasks

2007-09-24 20:03 6 SA.DAT
2007-09-12 08:58 276 AppleSoftwareUpdate.job
2001-08-23 14:00 65 desktop.ini

Verzeichnis von C:\WINDOWS\temp

2007-09-24 20:04 409 WGANotify.settings
2007-09-24 20:03 16,384 Perflib_Perfdata_1f0.dat
2007-09-24 20:03 255 WGAErrLog.txt
2007-09-24 15:58 16,384 Perflib_Perfdata_1f8.dat
2007-09-04 09:47 16,384 Perflib_Perfdata_758.dat
2007-08-29 12:56 16,384 Perflib_Perfdata_744.dat
2007-08-20 15:42 16,384 Perflib_Perfdata_788.dat

Verzeichnis von C:\DOKUME~1\Manuel\LOKALE~1\Temp

2007-09-24 20:07 155,010 filelist.txt
2007-09-24 20:03 406 jusched.log
2007-03-23 03:07 2,478 filelist.bat

gibt es denn das Logfile? Sollte unter c:\ComboFix.txt liegen.

Anleitung Avenger:

1.) Lade dir das Tool Avenger und speichere es auf dem Desktop:



2.) Klicke nun auf die Option „Input Script manually“ -> klicke jetzt auf die Lupe und kopiere folgenden Text rein:

Files to delete:
C:\WINDOWS\system32\gzmrot-uninst.exe
C:\WINDOWS\system32\adssite-remove.exe
C:\WINDOWS\system32\gzmrotate.dll
C:\WINDOWS\Prefetch\AU_.EXE-17000160.pf
C:\WINDOWS\randseed.rnd
C:\WINDOWS\system32\nsh12D3.dll
Folder to delete:
C:\Programme\Video ActiveX Access
C:\Programme\Adssite Advanced Toolbar

3.) Klicke nun auf die „grüne Ampel“, das Script fängt an zu arbeiten.



4.) Danach das System unverzüglich neu starten lassen
5.) Lass eScan nochmal laufen, erstelle und poste ein neues Logfile.
Poste ausserdem den Inhalt der C:\avenger.txt Datei.

Beachte meine Ergänzung!

also ComboFix hat beim 2ten mal anscheinend doch geklappt:
hier ist das ergebnis:
ComboFix 07-09-21.2 - "Manuel" 2007-09-24 20:30:18.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1031.18.129 [GMT 2:00]
.

((((((((((((((((((((((( Dateien erstellt von 2007-08-24 bis 2007-09-24 ))))))))))))))))))))))))))))))
.

2007-09-24 20:27 <DIR> d-------- C:\DOKUME~1\MANUEL~1.LEE\Lokale Einstellungenkale Einstellungen
2007-09-24 19:55 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-09-24 15:54 4,504 --a------ C:\WINDOWS\system32\tmp.reg
2007-09-24 15:46 53,248 --a------ C:\WINDOWS\system32\Process.exe
2007-09-24 15:46 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2007-09-24 15:46 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2007-09-24 15:46 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2007-09-24 15:04 <DIR> d-------- C:\Programme\Trend Micro
2007-09-24 14:33 <DIR> d-------- C:\Programme\Enigma Software Group
2007-09-24 14:02 <DIR> d-------- C:\Programme\MalwareBurn 7.1
2007-09-24 00:47 <DIR> d-a------ C:\DOKUME~1\ALLUSE~1.WIN\ANWEND~1\TEMP
2007-09-18 09:16 79,882 --a------ C:\WINDOWS\system32\adssite-remove.exe
2007-09-18 09:16 40,315 --a------ C:\WINDOWS\system32\gzmrot-uninst.exe
2007-09-18 09:16 <DIR> d-------- C:\Programme\Adssite Games Collection
2007-09-18 09:16 <DIR> d-------- C:\Programme\Adssite Advanced Toolbar
2007-09-18 09:16 <DIR> d-------- C:\DOKUME~1\Manuel\ANWEND~1\Adssite Advanced Toolbar
2007-09-12 12:46 62,464 --a------ C:\WINDOWS\system32\gzmrotate.dll
2007-08-30 21:15 <DIR> d-------- C:\Programme\Sony Ericsson

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-24 12:57 --------- d-------- C:\Programme\MultiRes
2007-09-23 20:38 --------- d--h----- C:\Programme\InstallShield Installation Information
2007-09-15 18:24 --------- d-------- C:\Programme\MSN Messenger
2007-09-14 17:47 --------- d-------- C:\Programme\Zoom Player
2007-08-19 20:53 --------- d-------- C:\DOKUME~1\Manuel\ANWEND~1\temp
2007-08-04 17:27 --------- d-------- C:\DOKUME~1\ALLUSE~1.WIN\ANWEND~1\Google
2007-07-30 19:19 92504 --a------ C:\WINDOWS\system32\cdm.dll
2007-07-30 19:19 549720 --a------ C:\WINDOWS\system32\wuapi.dll
2007-07-30 19:19 53080 --a------ C:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19 43352 --a------ C:\WINDOWS\system32\wups2.dll
2007-07-30 19:19 325976 --a------ C:\WINDOWS\system32\wucltui.dll
2007-07-30 19:19 203096 --a------ C:\WINDOWS\system32\wuweb.dll
2007-07-30 19:19 1712984 --a------ C:\WINDOWS\system32\wuaueng.dll
2007-07-30 19:18 33624 --a------ C:\WINDOWS\system32\wups.dll
2007-06-26 08:08 1104896 --a------ C:\WINDOWS\system32\msxml3.dll
.

(((((((((((((((((((((((((((( Autostart Punkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.

*Hinweis* leere Eintrage & legitime Standardeintrage werden nicht angezeigt.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{36A91CEC-6C71-4758-B492-397BFC8E96A2}]
2007-09-12 12:46 62464 --a------ C:\WINDOWS\system32\gzmrotate.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F31B3634-12AA-41ca-B021-0685C3B3E4CA}]
C:\WINDOWS\system32\nsh12D3.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AtiPTA"="atiptaxx.exe" [2004-09-16 04:10 C:\WINDOWS\system32\atiptaxx.exe]
"Synchronization Manager"="C:\WINDOWS\system32\mobsync.exe" [2004-08-04 09:58]
"ShStatEXE"="C:\Programme\Network Associates\VirusScan\SHSTAT.exe" [2003-03-21 08:00]
"McAfeeUpdaterUI"="C:\Programme\Network Associates\Common Framework\UpdaterUI.exe" [2003-02-26 13:00]
"DAEMON Tools-1033"="C:\Programme\D-Tools\daemon.exe" [2004-08-22 18:05]
"HKSERV.EXE"="C:\Programme\Sony\HotKey Utility\HKserv.exe" [2004-06-29 15:49]
"SonyPowerCfg"="D:\SPMgr.exe" [2004-06-29 22:45]
"SunJavaUpdateSched"="C:\Programme\Java\jre1.5.0_04\bin\jusched.exe" [2005-06-03 03:52]
"Mouse Suite 98 Daemon"="ICO.EXE" []
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" []
"OpwareSE2"="C:\Programme\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" [2003-05-08 12:00]
"OPSE reminder"="C:\Programme\ScanSoft\OmniPageSE2.0\EregGer\Ereg.exe" [2003-07-07 10:29]
"ICQ Lite"="D:\Programme\ICQLite\ICQLite.exe" [2006-07-11 12:06]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2005-08-26 06:33]
"DetectorApp"="C:\Programme\Roxio\MyDVD\MyDVD\DetectorApp.exe" [2005-08-31 07:15]
"ISUSPM Startup"="C:\PROGRA~1\GEMEIN~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 17:50]
"ISUSScheduler"="C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe" [2004-07-27 17:50]
"hid_start"="C:\WINDOWS\system32\gzmrotate.dll" [2007-09-12 12:46]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 09:57]
"ATnotes.exe"="C:\Programme\ATnotes\ATnotes.exe" [2005-01-05 15:45]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Programme\Gemeinsame Dateien\Ahead\lib\NMBgMonitor.exe" []
"msnmsgr"="C:\Programme\MSN Messenger\msnmsgr.exe" [2007-01-19 12:55]
"EA Core"="C:\Programme\Electronic Arts\EA Downloader\Core.exe" [2006-06-09 03:35]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runonce]
"ICQ Lite"=D:\Programme\ICQLite\ICQLite.exe -trayboot

C:\DOKUME~1\ALLUSE~1.WIN\STARTM~1\PROGRA~1\AUTOST~1\
Acrobat Assistant.lnk - C:\Programme\Adobe\Acrobat 5.0\Distillr\AcroTray.exe [2005-03-04 13:38:07]
Adobe Gamma Loader.exe.lnk - C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe [2004-09-02 13:55:14]
Adobe Reader - Schnellstart.lnk - C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 05:44:06]
Gigaset WLAN Adapter Monitor.lnk - C:\Programme\Siemens\Gigaset USB Stick 108\Gcc.exe [2006-03-18 06:26:43]
Service Manager.lnk - C:\Programme\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2002-12-17 17:23:32]
WinZip Quick Pick.lnk - C:\Programme\WinZip\WZQKPICK.EXE [2006-04-27 13:25:43]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{d6ef030a-a235-41ba-9ead-89b6ff542f00}"= C:\WINDOWS\system32\pluwue.dll [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{35B2861B-2B26-4691-9FF0-09083722C736}"= C:\WINDOWS\System32\RadExe.dll [2004-10-01 21:34 204800]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 nwprovau

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1086457705-1335635349-416618028-2223\Scripts\Logon\0\0]
"Script"=logon.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1086457705-1335635349-416618028-2291\Scripts\Logon\0\0]
"Script"=logon.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1086457705-1335635349-416618028-8117\Scripts\Logon\0\0]
"Script"=logon.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1086457705-1335635349-416618028-8121\Scripts\Logon\0\0]
"Script"=logon.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1086457705-1335635349-416618028-9424\Scripts\Logon\0\0]
"Script"=logon.bat

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Dokumente und Einstellungen^All Users.WINDOWS^Startmenü^Programme^Autostart^InterVideo WinCinema Manager.lnk]
path=C:\Dokumente und Einstellungen\All Users.WINDOWS\Startmenü\Programme\Autostart\InterVideo WinCinema Manager.lnk
backup=C:\WINDOWS\pss\InterVideo WinCinema Manager.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray]
"D:\Programme\SlySoft\CloneCD\CloneCDTray.exe" /s

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadwin PrintScreen 2.6]
C:\Programme\Gadwin Systems\PrintScreen\PrintScreen.exe /nosplash

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Programme\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
"C:\Programme\MSN Messenger\MsnMsgr.Exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Programme\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VAIO Update 2]
"C:\Programme\Sony\VAIO Update 2\VAIOUpdt.exe" /Stationary

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ViewMgr]
C:\Programme\Viewpoint\Viewpoint Manager\ViewMgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WeatherCast]
"C:\Programme\WeatherCast\Weather.exe" /q

R2 MSSQL$MESONIC;MSSQL$MESONIC;C:\Programme\Microsoft SQL Server\MSSQL$MESONIC\Binn\sqlservr.exe -sMESONIC
R3 CBTNDIS5;CBTNDIS5 NDIS Protocol Driver;\??\C:\WINDOWS\system32\CBTNDIS5.SYS
R3 odysseyIM4;Odyssey Network Agent Miniport;C:\WINDOWS\system32\DRIVERS\odysseyIM4.sys
R3 RadProbe;Radeon Probe Driver;C:\WINDOWS\system32\DRIVERS\RadProbe.sys
S2 MPManF60;MPMan F60 USB Driver;C:\WINDOWS\system32\Drivers\MPManF60.sys
S3 AR5523;Gigaset USB Stick 108;C:\WINDOWS\system32\DRIVERS\ar5523.sys
S3 ATHFMWDL;GigaSet USB Stick 108 Bootloader driver;C:\WINDOWS\system32\Drivers\ATHFMWDL.sys
S3 DMSKSSRh;DMSKSSRh;\??\C:\DOKUME~1\Manuel\LOKALE~1\Temp\DMSKSSRh.sys
S3 sonypvs1;Sony Digital Imaging Video2;C:\WINDOWS\system32\DRIVERS\sonypvs1.sys
S3 SQLAgent$MESONIC;SQLAgent$MESONIC;C:\Programme\Microsoft SQL Server\MSSQL$MESONIC\Binn\sqlagent.EXE -i MESONIC

.
Inhalt des "geplante Tasks" Ordners
"2007-09-12 06:58:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Programme\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-24 20:31:45
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-09-24 20:33:17
C:\ComboFix-quarantined-files.txt ... 2007-09-24 20:32
C:\ComboFix2.txt ... 2007-09-24 20:27
.
--- E O F ---


-----------------------------------
-----------------------------------
-----------------------------------

und hier das ergebnis vom SmitfraudFix dass ich jetzt allerdings im normalen modus ausgeführt habe!
SmitFraudFix v2.227

Scan done at 20:36:52,40, 24.09.2007
Run from C:\Dokumente und Einstellungen\Manuel\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{d6ef030a-a235-41ba-9ead-89b6ff542f00}"="flensburg"

[HKEY_CLASSES_ROOT\CLSID\{d6ef030a-a235-41ba-9ead-89b6ff542f00}\InProcServer32]
@="C:\WINDOWS\system32\pluwue.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{d6ef030a-a235-41ba-9ead-89b6ff542f00}\InProcServer32]
@="C:\WINDOWS\system32\pluwue.dll"


»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» hosts


127.0.0.1 localhost

»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files


»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{4D09F4F5-19DF-4FCF-AED7-15D16507752B}: NameServer=213.33.99.70,80.120.17.70
HKLM\SYSTEM\CS1\Services\Tcpip\..\{4D09F4F5-19DF-4FCF-AED7-15D16507752B}: NameServer=213.33.99.70,80.120.17.70
HKLM\SYSTEM\CS3\Services\Tcpip\..\{45C1BEFC-2885-40F7-9998-AA55405A1A98}: DhcpNameServer=192.168.2.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{4D09F4F5-19DF-4FCF-AED7-15D16507752B}: NameServer=213.33.99.70,80.120.17.70
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.2.1


»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{d6ef030a-a235-41ba-9ead-89b6ff542f00}"="flensburg"

[HKEY_CLASSES_ROOT\CLSID\{d6ef030a-a235-41ba-9ead-89b6ff542f00}\InProcServer32]
@="C:\WINDOWS\system32\pluwue.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{d6ef030a-a235-41ba-9ead-89b6ff542f00}\InProcServer32]
@="C:\WINDOWS\system32\pluwue.dll"



»»»»»»»»»»»»»»»»»»»»»»»» End


und die verzeichnisse der letzten 30 tage findet ihr bereits im vorhergehendem beitrag!
ich hoffe ihr könnt etwas damit anfangen!
mfg

Dann jetzt bitte den Avenger, wie oben beschrieben.

folgendes ergebnis:
Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\vgdpdjfd

*******************

Script file located at: \??\C:\vugmcesg.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

File C:\WINDOWS\system32\gzmrot-uninst.exe deleted successfully.
File C:\WINDOWS\system32\adssite-remove.exe deleted successfully.
File C:\WINDOWS\system32\gzmrotate.dll deleted successfully.
File C:\WINDOWS\Prefetch\AU_.EXE-17000160.pf deleted successfully.
File C:\WINDOWS\randseed.rnd deleted successfully.


File C:\WINDOWS\system32\nsh12D3.dll not found!
Deletion of file C:\WINDOWS\system32\nsh12D3.dll failed!

Could not process line:
C:\WINDOWS\system32\nsh12D3.dll
Status: 0xc0000034



File Folder to delete: not found!
Deletion of file Folder to delete: failed!

Could not process line:
Folder to delete:
Status: 0xc0000034



File C:\Programme\Video ActiveX Access not found!
Deletion of file C:\Programme\Video ActiveX Access failed!

Could not process line:
C:\Programme\Video ActiveX Access
Status: 0xc0000034



Error: C:\Programme\Adssite Advanced Toolbar is a folder, not a file!
Deletion of file C:\Programme\Adssite Advanced Toolbar failed!

Could not process line:
C:\Programme\Adssite Advanced Toolbar
Status: 0xc00000ba


Completed script processing.

*******************

Finished! Terminate.

----------------------

da gibt es diesen punkt mit video activeX ... - diesen ordner habe ich bereits händisch gelöscht - ich weiß zwar nicht ob das wichtig ist aber ich sags mal dazu!
mfg

Hab mich vertippt! Bitte Avenger noch mal mit diesem Script

Zitat von BataAlexander

Anleitung Avenger:

1.) Lade dir das Tool Avenger und speichere es auf dem Desktop:



2.) Klicke nun auf die Option „Input Script manually“ -> klicke jetzt auf die Lupe und kopiere folgenden Text rein:

3.) Klicke nun auf die „grüne Ampel“, das Script fängt an zu arbeiten.



4.) Danach das System unverzüglich neu starten lassen
Poste den Inhalt der C:\avenger.txt Datei.

bin ich froh dass sich auch profis mal einen fehler erlauben!
aber ich bin dir natürlich für deine hilfe sehr dankbar!

also jetzt hab ich folgendes für dich:
Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\lvcwgqgb

*******************

Script file located at: \??\C:\WINDOWS\system32\gaddbteb.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:



Folder C:\Programme\Video ActiveX Access not found!
Deletion of folder C:\Programme\Video ActiveX Access failed!

Could not process line:
C:\Programme\Video ActiveX Access
Status: 0xc0000034

Folder C:\Programme\Adssite Advanced Toolbar deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

--------------------------------------------------
--------------------------------------------------

hat es jetzt (bis auf den ordner video activex acces den ich bereits händisch gelöscht habe) geklappt!?

Ja, hat geklappt


- Lade Dir noch AVG.reg.
Download, doppelklicken und die Meldung bejahen.

- Bitte jetzt ein neues HJT Logfile!

ich hoffe du hast gute nachrichten für mich!?
bitteschön:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:23:33, on 24.09.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Network Associates\Common Framework\FrameworkService.exe
C:\Programme\Network Associates\VirusScan\Mcshield.exe
C:\Programme\Network Associates\VirusScan\VsTskMgr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Microsoft SQL Server\MSSQL$MESONIC\Binn\sqlservr.exe
C:\Programme\Network Associates\VirusScan\SHSTAT.EXE
C:\Programme\Network Associates\Common Framework\UpdaterUI.exe
C:\Programme\Sony\HotKey Utility\HKserv.exe
D:\SPMgr.exe
C:\Programme\Java\jre1.5.0_04\bin\jusched.exe
C:\Programme\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
D:\Programme\ICQLite\ICQLite.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Roxio\MyDVD\MyDVD\USBDeviceService.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Programme\Roxio\MyDVD\MyDVD\DetectorApp.exe
C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Sony\HotKey Utility\HKWnd.exe
C:\Programme\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Programme\Siemens\Gigaset USB Stick 108\Gcc.exe
C:\Programme\Siemens\Gigaset USB Stick 108\OdHost.exe
C:\WINDOWS\system32\notepad.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Programme\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.168.24.2:3128
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - D:\Programme\ICQToolbar\toolbaru.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: rightonadz.biz browser optimizer - {36A91CEC-6C71-4758-B492-397BFC8E96A2} - C:\WINDOWS\system32\gzmrotate.dll (file missing)
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Viewpoint Toolbar BHO - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\Programme\Viewpoint\Viewpoint Toolbar\ViewBarBHO.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar2.dll
O2 - BHO: adssite - {F31B3634-12AA-41ca-B021-0685C3B3E4CA} - C:\WINDOWS\system32\nsh12D3.dll (file missing)
O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Programme\Viewpoint\Viewpoint Toolbar\ViewBar.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar2.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Programme\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - D:\Programme\ICQToolbar\toolbaru.dll (file missing)
O3 - Toolbar: Mein PONSline - {A6F74643-242A-A7A4-8DD5-AB40B9E25345} - (no file)
O3 - Toolbar: Adssite Toolbar - {41C29B07-6F91-4966-91BE-2E2841643C83} - C:\Programme\Adssite Advanced Toolbar\toolbar.dll (file missing)
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [ShStatEXE] "C:\Programme\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Programme\Network Associates\Common Framework\UpdaterUI.exe"
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programme\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [HKSERV.EXE] C:\Programme\Sony\HotKey Utility\HKserv.exe
O4 - HKLM\..\Run: [SonyPowerCfg] D:\SPMgr.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [OpwareSE2] "C:\Programme\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [OPSE reminder] "C:\Programme\ScanSoft\OmniPageSE2.0\EregGer\Ereg.exe" -r "C:\Programme\ScanSoft\OmniPageSE2.0\EregGer\ereg.ini"
O4 - HKLM\..\Run: [ICQ Lite] "D:\Programme\ICQLite\ICQLite.exe" -minimize
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [DetectorApp] C:\Programme\Roxio\MyDVD\MyDVD\DetectorApp.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\GEMEIN~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [hid_start] C:\WINDOWS\System32\Rundll32.exe "C:\WINDOWS\system32\gzmrotate.dll" DllVerify
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ATnotes.exe] C:\Programme\ATnotes\ATnotes.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programme\Gemeinsame Dateien\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Programme\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [EA Core] C:\Programme\Electronic Arts\EA Downloader\Core.exe -silent
O4 - HKCU\..\RunOnce: [ICQ Lite] D:\Programme\ICQLite\ICQLite.exe -trayboot
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Acrobat Assistant.lnk = C:\Programme\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Gigaset WLAN Adapter Monitor.lnk = C:\Programme\Siemens\Gigaset USB Stick 108\Gcc.exe
O4 - Global Startup: Service Manager.lnk = C:\Programme\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programme\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Google Search - res://c:\programme\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &ICQ Toolbar Search - res://D:\Programme\ICQToolbar\toolbaru.dll/SEARCH.HTML
O8 - Extra context menu item: &Translate English Word - res://c:\programme\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: &Viewpoint Search - res://C:\Programme\Viewpoint\Viewpoint Toolbar\ViewBar.dll/CXTSEARCH.HTML
O8 - Extra context menu item: Backward Links - res://c:\programme\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\programme\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Easy-WebPrint - Drucken - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint - Schnelldruck - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint - Vorschau - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint - Zu Druckliste hinzufügen - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\programme\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\programme\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O12 - Plugin for .pdf: C:\Programme\Internet Explorer\PLUGINS\nppdf32.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.hakhollabrunn.ac.at
O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} (MetaStreamCtl Class) - https://components.viewpoint.com/MTSInstallers/MetaStream3.cab?url=http://www.viewpoint.com/cgi-bin/installer.v4/vet_install_popup.pl?1&4&04.00.05.04&unknown&unknown&http://www9.volvo.com/truck/3dtruckconfigurator2/all/fh16.asp
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = nhl.local
O17 - HKLM\Software\..\Telephony: DomainName = nhl.local
O17 - HKLM\System\CCS\Services\Tcpip\..\{4D09F4F5-19DF-4FCF-AED7-15D16507752B}: NameServer = 213.33.99.70,80.120.17.70
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = nhl.local
O22 - SharedTaskScheduler: flensburg - {d6ef030a-a235-41ba-9ead-89b6ff542f00} - C:\WINDOWS\system32\pluwue.dll (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Programme\Gemeinsame Dateien\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Programme\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Programme\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Programme\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: RadClock - Unknown owner - C:\WINDOWS\system32\RadClock.exe
O23 - Service: USBDeviceService - Unknown owner - C:\Programme\Roxio\MyDVD\MyDVD\USBDeviceService.exe

--
End of file - 11106 bytes

Sorry, mein Fehler

- Lade Dir noch AVG.reg.
Download, doppelklicken und die Meldung bejahen.