Tojanisches Pferd/Hijacker- "YourPrivacyGuard.com / pcsecuresystem.com"

A. Trierweiler

Hallo Undoreal!

Danke für die Antwort. War ein paar Tage nicht da, deshalb erst jetzt meine Antwort. Leider hat der letzte Säuberungsvorgang nicht viel gebracht.
Hier ist der gekürzte iClean log:

iclean log 31.10.2007 23:30:57

Windows XP SP2, Using advanced Kernel functions

Processes
---------
596 - \SystemRoot\System32\smss.exe - \SystemRoot\System32\smss.exe
672 - \??\C:\WINDOWS\system32\csrss.exe - \??\C:\WINDOWS\system32\csrss.exe
696 - \??\C:\WINDOWS\system32\winlogon.exe - \??\C:\WINDOWS\system32\winlogon.exe
752 - C:\WINDOWS\system32\services.exe - Anwendung für Dienste und Controller
764 - C:\WINDOWS\system32\lsass.exe - LSA Shell (Export Version)
924 - C:\WINDOWS\system32\svchost.exe - Generic Host Process for Win32 Services
976 - C:\WINDOWS\system32\svchost.exe - Generic Host Process for Win32 Services
1224 - C:\WINDOWS\system32\svchost.exe - Generic Host Process for Win32 Services
1344 - C:\WINDOWS\system32\svchost.exe - Generic Host Process for Win32 Services
1428 - C:\WINDOWS\system32\svchost.exe - Generic Host Process for Win32 Services
1508 - C:\Programme\Lavasoft\Ad-Aware 2007\aawservice.exe - Ad-Aware 2007 Service (Signed)
1752 - C:\WINDOWS\Explorer.EXE - Windows Explorer
1904 - C:\WINDOWS\RTHDCPL.EXE - Realtek HD Audio Control Panel
1920 - C:\WINDOWS\mHotkey.exe - Multimedia Keyboard Driver
1928 - C:\WINDOWS\system32\CmUCReye.exe - CmCardMonitor MFC Application
1936 - C:\Programme\Home Cinema\PowerDVD\PDVDServ.exe - PowerDVD RC Service
1960 - C:\Programme\Medion Info Display\MdionLCM.exe - LCM Controller for Medion
1968 - C:\Programme\Audio\Winamp\winampa.exe - C:\Programme\Audio\Winamp\winampa.exe
1976 - C:\Programme\QuickTime\qttask.exe - C:\Programme\QuickTime\qttask.exe
1984 - Application Lau - Application Lau
1992 - C:\Programme\Softwin\BitDefender10\bdmcon.exe - BitDefender Management Console
2000 - C:\Programme\Softwin\BitDefender10\bdagent.exe - BDAgent Application
2008 - C:\WINDOWS\system32\RUNDLL32.EXE - Eine DLL-Datei als Anwendung ausführen
2028 - C:\Programme\Skype\Phone\Skype.exe - Skype. Take a deep breath (Signed)
180 - C:\Programme\Messenger\msmsgs.exe - Windows Messenger
188 - GoogleToolbarNo - GoogleToolbarNo
200 - C:\PROGRA~1\COOLSPOT\PERSON~1\PID.EXE - http://www.personalid.de
224 - C:\Programme\Windows Media Player\WMPNSCFG.exe - Windows Media Player Network Sharing Service Configuration Application
196 - C:\Programme\Spybot - Search & Destroy\TeaTimer.exe - System settings protector (Signed)
424 - C:\WINDOWS\system32\spoolsv.exe - Spooler SubSystem App
(Hidden) 512 - CapabilityManag - CapabilityManag
1580 - C:\Programme\Gemeinsame Dateien\Teleca Shared\Generic.exe - Generic Device Management Executable.
1812 - C:\Programme\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe - CAPI_Worker Module
1864 - C:\Programme\Skype\Plugin Manager\skypePM.exe - Skype Extras Manager (Signed)
1268 - C:\Programme\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe - CLCapSvc Module
1292 - C:\Programme\Home Cinema\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe - NT CLMLServer
1264 - C:\Programme\ewido anti-spyware 4.0\guard.exe - ewido anti-spyware guard
1704 - C:\WINDOWS\system32\svchost.exe - Generic Host Process for Win32 Services
2052 - C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe - C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
2084 - C:\WINDOWS\system32\nvsvc32.exe - NVIDIA Driver Helper Service, Version 93.71
2236 - C:\Programme\CyberLink\Shared Files\RichVideo.exe - RichVideo Module
2444 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe - X10 Module
2592 - C:\Programme\Gemeinsame Dateien\Softwin\BitDefender Communicator\xcommsvr.exe - BitDefender Communicator Server
2732 - C:\Programme\Gemeinsame Dateien\Softwin\BitDefender Update Service\livesrv.exe - BitDefender Security Service
2860 - C:\Programme\Gemeinsame Dateien\Softwin\BitDefender Scan Server\bdss.exe - C:\Programme\Gemeinsame Dateien\Softwin\BitDefender Scan Server\bdss.exe
2908 - C:\Programme\Windows Media Player\WMPNetwk.exe - Windows Media Player-Netzwerkfreigabedienst
3140 - C:\Programme\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe - CLSched Module
3560 - C:\Programme\Softwin\BitDefender10\vsserv.exe - BitDefender Security Service
1540 - C:\WINDOWS\System32\alg.exe - Application Layer Gateway Service
3404 - C:\Programme\Internet Explorer\IEXPLORE.EXE - Internet Explorer
2400 - C:\Programme\Internet Explorer\IEXPLORE.EXE - Internet Explorer
2744 - C:\Programme\Hijackthis\puefung.com\HijackThis.exe - HijackThis (Signed)
3480 - C:\WINDOWS\system32\NOTEPAD.EXE - Editor
2584 - C:\Programme\iClean\iclean.exe - Interactive Cleaner

Services
--------
c:\programme\lavasoft\ad-aware 2007\aawservice.exe=aawservice
C:\WINDOWS\system32\alg.exe=ALG
C:\WINDOWS\system32\svchost.exe=AudioSrv
c:\programme\gemeinsame dateien\softwin\bitdefender scan server\bdss.exe=bdss
C:\WINDOWS\system32\svchost.exe=BITS
C:\WINDOWS\system32\svchost.exe=Browser
c:\programme\home cinema\powercinema\kernel\tv\clcapsvc.exe=CLCapSvc
c:\programme\home cinema\powercinema\kernel\tv\clsched.exe=CLSched
C:\WINDOWS\system32\svchost.exe=CryptSvc
c:\programme\home cinema\powercinema\kernel\clml_ntservice\clmlserver.exe=CyberLink Media Library Service
C:\WINDOWS\system32\svchost.exe=DcomLaunch
C:\WINDOWS\system32\svchost.exe=Dhcp
C:\WINDOWS\system32\svchost.exe=Dnscache
C:\WINDOWS\system32\svchost.exe=ERSvc
C:\WINDOWS\system32\services.exe=Eventlog
c:\windows\system32\svchost.exe=EventSystem
c:\programme\ewido anti-spyware 4.0\guard.exe=ewido anti-spyware 4.0 guard
C:\WINDOWS\system32\svchost.exe=FastUserSwitchingCompatibility
C:\WINDOWS\system32\svchost.exe=helpsvc
C:\WINDOWS\system32\svchost.exe=HidServ
C:\WINDOWS\system32\svchost.exe=HTTPFilter
C:\WINDOWS\system32\svchost.exe=lanmanserver
C:\WINDOWS\system32\svchost.exe=lanmanworkstation
c:\programme\gemeinsame dateien\lightscribe\lssrvc.exe=LightScribeService
c:\programme\gemeinsame dateien\softwin\bitdefender update service\livesrv.exe=LIVESRV
C:\WINDOWS\system32\svchost.exe=LmHosts
C:\WINDOWS\system32\svchost.exe=Netman
C:\WINDOWS\system32\svchost.exe=Nla
C:\WINDOWS\system32\nvsvc32.exe=NVSvc
C:\WINDOWS\system32\services.exe=PlugPlay
C:\WINDOWS\system32\lsass.exe=PolicyAgent
C:\WINDOWS\system32\lsass.exe=ProtectedStorage
C:\WINDOWS\system32\svchost.exe=RasMan
c:\programme\cyberlink\shared files\richvideo.exe=RichVideo
C:\WINDOWS\system32\svchost.exe=RpcSs
C:\WINDOWS\system32\lsass.exe=SamSs
C:\WINDOWS\system32\svchost.exe=Schedule
C:\WINDOWS\system32\svchost.exe=seclogon
C:\WINDOWS\system32\svchost.exe=SENS
C:\WINDOWS\system32\svchost.exe=SharedAccess
C:\WINDOWS\system32\svchost.exe=ShellHWDetection
C:\WINDOWS\system32\spoolsv.exe=Spooler
C:\WINDOWS\system32\svchost.exe=SSDPSRV
C:\WINDOWS\system32\svchost.exe=TapiSrv
C:\WINDOWS\system32\svchost.exe=TermService
C:\WINDOWS\system32\svchost.exe=Themes
C:\WINDOWS\system32\svchost.exe=TrkWks
C:\WINDOWS\system32\svchost.exe=upnphost
c:\programme\softwin\bitdefender10\vsserv.exe=VSSERV
C:\WINDOWS\system32\svchost.exe=W32Time
C:\WINDOWS\system32\svchost.exe=WebClient
C:\WINDOWS\system32\svchost.exe=winmgmt
c:\programme\windows media player\wmpnetwk.exe=WMPNetworkSvc
C:\WINDOWS\system32\svchost.exe=wscsvc
C:\WINDOWS\system32\svchost.exe=wuauserv
C:\WINDOWS\system32\svchost.exe=WZCSVC
c:\progra~1\common~1\x10\common\x10nets.exe=x10nets
c:\programme\gemeinsame dateien\softwin\bitdefender communicator\xcommsvr.exe=XCOMM

Registry
--------
000=HKCU\Run: MSMSGS="c:\programme\messenger\msmsgs.exe" /background
000=HKCU\Run: Personal ID=c:\progra~1\coolspot\person~1\pid.exe
000=HKCU\Run: Skype="c:\programme\skype\phone\skype.exe" /nosplash /minimized
000=HKCU\Run: SpybotSD TeaTimer=c:\programme\spybot - search & destroy\teatimer.exe
000=HKCU\Run: swg=c:\programme\google\googletoolbarnotifier\googletoolbarnotifier.exe
000=HKCU\Run: WMPNSCFG=c:\programme\windows media player\wmpnscfg.exe
000=HKLM\Run: ALDI_SUED_FotoSuite_Download="c:\programme\aldi sued foto service\aldi_foto_service\fotosuite.exe" /autorun
000=HKLM\Run: AntivirusRegistration=c:\programme\ca\etrust antivirus\register.exe
000=HKLM\Run: BDAgent="c:\programme\softwin\bitdefender10\bdagent.exe"
000=HKLM\Run: BDMCon="c:\programme\softwin\bitdefender10\bdmcon.exe" /reg
000=HKLM\Run: CHotkey=c:\windows\mhotkey.exe
000=HKLM\Run: CmUCRRun=c:\windows\system32\cmucreye.exe
000=HKLM\Run: IMJPMIG8.1="c:\windows\ime\imjp8_1\imjpmig.exe" /spoil /remadvdef /migration32
000=HKLM\Run: InstantOn="c:\programme\cyberlink\powercinema linux\ion_install.exe
000=HKLM\Run: MedionVFD="c:\programme\medion info display\mdionlcm.exe"
000=HKLM\Run: MSPY2002=c:\windows\system32\ime\pintlgnt\imscinst.exe
000=HKLM\Run: NeroFilterCheck=c:\windows\system32\nerocheck.exe
000=HKLM\Run: NvCplDaemon=c:\windows\system32\nvcpl.dll
000=HKLM\Run: NvMediaCenter=c:\windows\system32\nvmctray.dll
000=HKLM\Run: nwiz=c:\windows\system32\nwiz.exe
000=HKLM\Run: PHIME2002A=c:\windows\system32\ime\tintlgnt\tintsetp.exe /imename
000=HKLM\Run: PHIME2002ASync=c:\windows\system32\ime\tintlgnt\tintsetp.exe /sync
000=HKLM\Run: QuickTime Task="c:\programme\quicktime\qttask.exe" -atboottime
000=HKLM\Run: RemoteControl="c:\programme\home cinema\powerdvd\pdvdserv.exe"
000=HKLM\Run: RTHDCPL=c:\windows\rthdcpl.exe
000=HKLM\Run: Sony Ericsson PC Suite="c:\programme\sony ericsson\mobile2\application launcher\application launcher.exe" /startoptions
000=HKLM\Run: WinampAgent=c:\programme\audio\winamp\winampa.exe
001=Firewall bypass: C:\Programme\Skype\Phone\Skype.exe=c:\programme\skype\phone\skype.exe
020=SSODL: bxsbang=c:\windows\bxsbang.dll
020=SSODL: CDBurn=C:\WINDOWS\system32\shell32.dll
020=SSODL: ocgrep=c:\windows\ocgrep.dll
020=SSODL: PostBootReminder=C:\WINDOWS\system32\shell32.dll
020=SSODL: SysTray=c:\windows\system32\stobject.dll
020=SSODL: WebCheck=C:\WINDOWS\system32\webcheck.dll
020=SSODL: WPDShServiceObj=c:\windows\system32\wpdshserviceobj.dll
030=BHO: {02478D38-C3F9-4EFB-9B51-7695ECA05670}=c:\programme\yahoo!\companion\installs\cpn\yt.dll (Yahoo! Toolbar Helper)
030=BHO: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=c:\programme\adobe\acrobat 7.0\activex\acroiehelper.dll (AcroIEHlprObj Class)
030=BHO: {22BF413B-C6D2-4d91-82A9-A0F997BA588C}=c:\programme\skype\toolbars\internet explorer\skypeieplugin.dll (Skype add-on (mastermind))
030=BHO: {53707962-6F74-2D53-2644-206D7942484F}=c:\progra~1\spybot~1\sdhelper.dll (Spybot-S&D IE Protection)
030=BHO: {AA58ED58-01DD-4d91-8333-CF10577473F7}=c:\programme\google\googletoolbar3.dll (Google Toolbar Helper)
030=BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D}=c:\programme\google\googletoolbarnotifier\2.0.301.7164\swg.dll (Google Toolbar Notifier BHO)
031=Toolbar: {01E04581-4EEE-11D0-BFE9-00AA005B4383}=C:\WINDOWS\system32\browseui.dll
031=Toolbar: {0E5CBF21-D15F-11D0-8301-00AA005B4383}=C:\WINDOWS\system32\shell32.dll
031=Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F}=c:\programme\google\googletoolbar3.dll
031=Toolbar: {EF99BD32-C1FB-11D2-892F-0090271D4F88}=c:\programme\yahoo!\companion\installs\cpn\yt.dll
031=Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F}=c:\programme\google\googletoolbar3.dll
031=Toolbar: {EF99BD32-C1FB-11D2-892F-0090271D4F88}=c:\programme\yahoo!\companion\installs\cpn\yt.dll


Startup Folders
---------------
Common: desktop.ini
Personal: desktop.ini
Personal: hamachi.lnk -> C:\PROGRA~1\Hamachi\hamachi.exe

HOSTS
-----
127.0.0.1 localhost