Hi Undoreal,
Hier kommt die auswertung von Virus Total.

Datei SmartPCTask.exe empfangen 2007.10.31 17:12:57 (CET)Antivirus Version letzte aktualisierung Ergebnis
AhnLab-V3 2007.10.31.1 2007.10.31 -
AntiVir 7.6.0.30 2007.10.31 -
Authentium 4.93.8 2007.10.30 -
Avast 4.7.1074.0 2007.10.31 -
AVG 7.5.0.503 2007.10.31 -
BitDefender 7.2 2007.10.31 -
CAT-QuickHeal 9.00 2007.10.31 -
ClamAV 0.91.2 2007.10.31 -
DrWeb 4.44.0.09170 2007.10.31 -
eSafe 7.0.15.0 2007.10.28 -
eTrust-Vet 31.2.5256 2007.10.31 -
Ewido 4.0 2007.10.31 -
FileAdvisor 1 2007.10.31 -
Fortinet 3.11.0.0 2007.10.19 -
F-Prot 4.3.2.48 2007.10.30 -
F-Secure 6.70.13030.0 2007.10.31 -
Ikarus T3.1.1.12 2007.10.31 -
Kaspersky 7.0.0.125 2007.10.31 -
McAfee 5152 2007.10.30 -
Microsoft 1.2908 2007.10.31 -
NOD32v2 2630 2007.10.31 -
Norman 5.80.02 2007.10.31 -
Panda 9.0.0.4 2007.10.31 Suspicious file
Prevx1 V2 2007.10.31 Heuristic: Suspicious File With Covert Attributes
Rising 19.47.21.00 2007.10.31 -
Sophos 4.23.0 2007.10.31 -
Sunbelt 2.2.907.0 2007.10.31 -
Symantec 10 2007.10.31 -
TheHacker 6.2.9.110 2007.10.27 -
VBA32 3.12.2.4 2007.10.28 -
VirusBuster 4.3.26:9 2007.10.31 -
Webwasher-Gateway 6.0.1 2007.10.31 Win32.ModifiedUPX.gen (suspicious)

weitere Informationen
File size: 770048 bytes
MD5: efbc9194247282513fc76e6c8409b2ef
SHA1: 61cb3c32ac63e8575f66878e1d8134726f26e723
packers: Armadillo
packers: Armadillo
Prevx info: Prevx

Hmmmm. Was ist das für ein Programm?

Nutzt du es häufig?

Ist die Quelle aus der du es hast vertrauenswürdig?

Also das Programm Smart PC hab ich aus der Computerbild, denk schon,dass das vertrauenswürdig ist.

Gut,

dann müssen wir uns dein System leider etwas genauer angucken:

-Deaktiviere die Systemwiederherstellung auf allen Laufwerken.

-Deinstalliere Java über die Systemsteuerung.

-Lasse Silentrunners laufen und poste die logFiles..


-Folge dieser Anleitung.

-Run Combofix. Poste den erscheinenden Text.

-Durchsuche mit Lavasoft und Spybot-S&D sowie deinem AV-Prog (alle drei mit aktuellen Signaturen!) dein System jeweils 2x. Erst im normalen und dann im abgesicherten Modus (F8 beim Hochfahren).

-Räume mit cCleaner auf ( die Registry musst du mehrmals durchsuchen und bereinigen lassen).

-Poste ein frisches HijackThis log sowie einen iClean Bericht (Prog in eigenem Ordner öffnen->"Yes"->File->Report).

-Danach machst du einen eScan nach Anleitung in meiner Signatur und postest das log.

Die ersten zwei Punkte sind schon mal abgehackt und hier kommt das LogFile
"Silent Runners.vbs", revision 52, Silent Runners - Adware? Disinfect, don't reformat!
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS]
"swg" = "C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" ["Google Inc."]

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"ATIPTA" = "C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe" ["ATI Technologies, Inc."]
"SoundMan" = "SOUNDMAN.EXE" ["Realtek Semiconductor Corp."]
"ATICCC" = ""C:\Programme\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay" [null data]
"WinampAgent" = "C:\Programme\Winamp\winampa.exe" [null data]
"avgnt" = ""C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min" ["Avira GmbH"]
"ZoneAlarm Client" = ""C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe"" ["Zone Labs, LLC"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Adobe PDF Reader"
\InProcServer32\(Default) = "C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Google Toolbar Notifier BHO"
\InProcServer32\(Default) = "C:\Programme\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll" ["Google Inc."]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Erweiterung für HyperTerminal-Icons"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]
"{45AC2688-0253-4ED8-97DE-B5370FA7D48A}" = "Shell Extension for Malware scanning"
-> {HKLM...CLSID} = "Shell Extension for Malware scanning"
\InProcServer32\(Default) = "C:\Programme\Avira\AntiVir PersonalEdition Classic\shlext.dll" ["Avira GmbH"]
"{D9872D13-7651-4471-9EEE-F0A00218BEBB}" = "Multiscan"
-> {HKLM...CLSID} = "ZLAVShExt Class"
\InProcServer32\(Default) = "C:\Programme\Zone Labs\ZoneAlarm\zlavscan.dll" ["Zone Labs, LLC"]
"{23170F69-40C1-278A-1000-000100020000}" = "7-Zip Shell Extension"
-> {HKLM...CLSID} = "7-Zip Shell Extension"
\InProcServer32\(Default) = "C:\Programme\7-Zip\7-zip.dll" ["Igor Pavlov"]
"{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" = "OpenOffice.org Column Handler"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = ""C:\Programme\Sun\StarOffice 8\program\shlxthdl.dll"" ["Sun Microsystems, Inc."]
"{087B3AE3-E237-4467-B8DB-5A38AB959AC9}" = "OpenOffice.org Infotip Handler"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = ""C:\Programme\Sun\StarOffice 8\program\shlxthdl.dll"" ["Sun Microsystems, Inc."]
"{63542C48-9552-494A-84F7-73AA6A7C99C1}" = "OpenOffice.org Property Sheet Handler"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = ""C:\Programme\Sun\StarOffice 8\program\shlxthdl.dll"" ["Sun Microsystems, Inc."]
"{3B092F0C-7696-40E3-A80F-68D74DA84210}" = "OpenOffice.org Thumbnail Viewer"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = ""C:\Programme\Sun\StarOffice 8\program\shlxthdl.dll"" ["Sun Microsystems, Inc."]
"{5E2121EE-0300-11D4-8D3B-444553540000}" = "Catalyst Context Menu extension"
-> {HKLM...CLSID} = "SimpleShlExt Class"
\InProcServer32\(Default) = "C:\Programme\ATI Technologies\ATI.ACE\atiacmxx.dll" [empty string]

HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\
"WPDShServiceObj" = "{AAA288BA-9A4C-45B0-95D7-94D524869DB5}"
-> {HKLM...CLSID} = "WPDShServiceObj Class"
\InProcServer32\(Default) = "C:\WINDOWS\system32\WPDShServiceObj.dll" [MS]

HKLM\System\CurrentControlSet\Control\Session Manager\
<<!>> "BootExecute" = "PDBoot.exe" ["Raxco Software, Inc."]|"autocheck autochk *"

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
<<!>> AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."]

HKLM\Software\Classes\Folder\shellex\ColumnHandlers\
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}\(Default) = "OpenOffice.org Column Handler"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = ""C:\Programme\Sun\StarOffice 8\program\shlxthdl.dll"" ["Sun Microsystems, Inc."]
{F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info"
-> {HKLM...CLSID} = "PDF Shell Extension"
\InProcServer32\(Default) = "C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
7-Zip\(Default) = "{23170F69-40C1-278A-1000-000100020000}"
-> {HKLM...CLSID} = "7-Zip Shell Extension"
\InProcServer32\(Default) = "C:\Programme\7-Zip\7-zip.dll" ["Igor Pavlov"]
Shell Extension for Malware scanning\(Default) = "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}"
-> {HKLM...CLSID} = "Shell Extension for Malware scanning"
\InProcServer32\(Default) = "C:\Programme\Avira\AntiVir PersonalEdition Classic\shlext.dll" ["Avira GmbH"]
ZLAVShExt\(Default) = "{D9872D13-7651-4471-9EEE-F0A00218BEBB}"
-> {HKLM...CLSID} = "ZLAVShExt Class"
\InProcServer32\(Default) = "C:\Programme\Zone Labs\ZoneAlarm\zlavscan.dll" ["Zone Labs, LLC"]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
7-Zip\(Default) = "{23170F69-40C1-278A-1000-000100020000}"
-> {HKLM...CLSID} = "7-Zip Shell Extension"
\InProcServer32\(Default) = "C:\Programme\7-Zip\7-zip.dll" ["Igor Pavlov"]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
Shell Extension for Malware scanning\(Default) = "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}"
-> {HKLM...CLSID} = "Shell Extension for Malware scanning"
\InProcServer32\(Default) = "C:\Programme\Avira\AntiVir PersonalEdition Classic\shlext.dll" ["Avira GmbH"]
ZLAVShExt\(Default) = "{D9872D13-7651-4471-9EEE-F0A00218BEBB}"
-> {HKLM...CLSID} = "ZLAVShExt Class"
\InProcServer32\(Default) = "C:\Programme\Zone Labs\ZoneAlarm\zlavscan.dll" ["Zone Labs, LLC"]


Group Policies {policy setting}:
--------------------------------

Note: detected settings may not have any effect.

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\

"NoCDBurning" = (REG_DWORD) hex:0x00000001
{unrecognized setting}

"NoRecentDocsHistory" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"ClearRecentDocsOnExit" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"HideClock" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoTrayItemsDisplay" = (REG_DWORD) hex:0x00000000
{Hide the notification area}

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\

"NoResolveTrack" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoPropertiesMyComputer" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoViewContextMenu" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoFileAssociate" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoFind" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoRun" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoClose" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"StartMenuLogoff" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoSMHelp" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel\

"Settings" = (REG_DWORD) hex:0x00000000
{Prevent the deletion of temporary Internet files and cookies}

HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel\

"SecurityTab" = (REG_DWORD) hex:0x00000000
{Disable the Security page}

"ConnectionsTab" = (REG_DWORD) hex:0x00000000
{Disable the Connections page}

"SecChangeSettings" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions\

"NoBrowserOptions" = (REG_DWORD) hex:0x00000000
{Tools menu: Disable Internet Options... menu option}

HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions\

"NoBrowserOptions" = (REG_DWORD) hex:0x00000000
{Tools menu: Disable Internet Options... menu option}

"NoBrowserSaveAs" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoFavorites" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoFileNew" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoFileOpen" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoTheaterMode" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\

"undockwithoutlogon" = (REG_DWORD) hex:0x00000001
{Devices: Allow undock without having to log on}

"ShutdownWithoutLogon" = (REG_DWORD) hex:0x00000001
{Shutdown: Allow system to be shut down without having to log on}

"NoDispCPL" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoDispBackgroundPage" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoDispSettingsPage" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoDispScrSavPage" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"DisableRegistryTools" = (REG_DWORD) hex:0x00000000
{unrecognized setting}


Active Desktop and Wallpaper:
-----------------------------

Active Desktop may be disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

Displayed if Active Desktop enabled and wallpaper not set by Group Policy:
HKCU\Software\Microsoft\Internet Explorer\Desktop\General\
"Wallpaper" = "C:\WINDOWS\web\wallpaper\Grüne Idylle.bmp"

Displayed if Active Desktop disabled and wallpaper not set by Group Policy:
HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\WINDOWS\web\wallpaper\Grüne Idylle.bmp"


Enabled Screen Saver:
---------------------

HKCU\Control Panel\Desktop\
"SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS]


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 15
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05


Toolbars, Explorer Bars, Extensions:
------------------------------------

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{E2E2DD38-D088-4134-82B7-F2BA38496583}\
"MenuText" = "@xpsp3res.dll,-20001"
"Exec" = "%windir%\Network Diagnostic\xpnetdiag.exe" [MS]


Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

AntiVir PersonalEdition Classic Guard, AntiVirService, ""C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe"" ["Avira GmbH"]
AntiVir PersonalEdition Classic Planer, AntiVirScheduler, ""C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe"" ["Avira GmbH"]
Ati HotKey Poller, Ati HotKey Poller, "C:\WINDOWS\system32\Ati2evxx.exe" ["ATI Technologies Inc."]
Google Updater Service, gusvc, ""C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe"" ["Google"]
PDScheduler, PDSched, "C:\Programme\Raxco\PerfectDisk\PDSched.exe" ["Raxco Software, Inc."]
StarWind iSCSI Service, StarWindService, "C:\Programme\Franzis\Alcohol Virtual CD + DVD\StarWind\StarWindService.exe" ["Rocket Division Software"]
TrueVector Internet Monitor, vsmon, "C:\WINDOWS\system32\ZoneLabs\vsmon.exe -service" ["Zone Labs, LLC"]


Print Monitors:
---------------

HKLM\System\CurrentControlSet\Control\Print\Monitors\
EPSON Stylus DX3800 Series 2KMonitor5E\Driver = "E_FLMACE.DLL" ["SEIKO EPSON CORPORATION"]


---------- (launch time: 2007-10-31 17:00:23)
<<!>>: Suspicious data at a malware launch point.

+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ To search all directories of local fixed drives for DESKTOP.INI
DLL launch points, use the -supp parameter or answer "No" at the
first message box and "Yes" at the second message box.
---------- (total run time: 68 seconds, including 7 seconds for message boxes)

Hier ist das Lofile von Combofix. Soll ich auchnoch die anderen beiden von SmitfraudFix reinposten?

ComboFix 07-10-29.1** - Rene 2007-10-31 17:41:40.1 - NTFSx86
ausgeführt von:: C:\Dokumente und Einstellungen\Rene\Lokale Einstellungen\Temporary Internet Files\Content.IE5\P05T52JW\ComboFix[1].exe
* Neuer Wiederherstellungspunkt wurde erstellt
.

(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\Cfx32.lic
C:\WINDOWS\system32\cfx32.ocx

.
((((((((((((((((((((((( Dateien erstellt von 2007-09-28 bis 2007-10-31 ))))))))))))))))))))))))))))))
.

2007-10-31 17:39 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-10-31 17:27 <DIR> d--h----- C:\Dokumente und Einstellungen\Administrator\Vorlagen
2007-10-31 17:27 <DIR> dr------- C:\Dokumente und Einstellungen\Administrator\Startmenü
2007-10-31 17:27 <DIR> d--h----- C:\Dokumente und Einstellungen\Administrator\Netzwerkumgebung
2007-10-31 17:27 <DIR> d--h----- C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen
2007-10-31 17:27 <DIR> d-------- C:\Dokumente und Einstellungen\Administrator\Favoriten
2007-10-31 17:27 <DIR> d--h----- C:\Dokumente und Einstellungen\Administrator\Druckumgebung
2007-10-31 17:27 <DIR> dr-h----- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten
2007-10-31 17:17 2,256 --a------ C:\WINDOWS\system32\tmp.reg
2007-10-31 17:16 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2007-10-31 17:16 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2007-10-31 17:16 53,248 --a------ C:\WINDOWS\system32\Process.exe
2007-10-31 17:16 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2007-10-31 17:16 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2007-10-30 19:08 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MailFrontier
2007-10-30 19:08 54,672 --a------ C:\WINDOWS\system32\vsutil_loc0407.dll
2007-10-30 19:08 42,384 --a------ C:\WINDOWS\zllsputility_loc0407.dll
2007-10-30 19:08 21,904 --a------ C:\WINDOWS\system32\imsinstall_loc0407.dll
2007-10-30 19:08 17,808 --a------ C:\WINDOWS\system32\imslsp_install_loc0407.dll
2007-10-30 19:07 110,360 --a------ C:\WINDOWS\system32\drivers\kl1.sys
2007-10-30 19:07 75,932 --a------ C:\WINDOWS\system32\drivers\klick.dat
2007-10-30 19:07 75,248 --a------ C:\WINDOWS\zllsputility.exe
2007-10-30 19:07 74,396 --a------ C:\WINDOWS\system32\drivers\klin.dat
2007-10-30 19:06 1,086,952 --a------ C:\WINDOWS\system32\zpeng24.dll
2007-10-30 18:10 <DIR> d-------- C:\WINDOWS\system32\ZoneLabs
2007-10-30 18:01 <DIR> d-------- C:\Programme\Avira
2007-10-30 18:01 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Avira
2007-10-19 17:04 <DIR> d-------- C:\Programme\Windows Resource Kits
2007-10-17 18:57 <DIR> d-------- C:\Dokumente und Einstellungen\Rene\Anwendungsdaten\WEBDE
2007-10-15 15:57 <DIR> d-a------ C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP
2007-10-13 16:25 <DIR> d-------- C:\Dokumente und Einstellungen\Rene\Anwendungsdaten\ATI
2007-10-04 10:48 <DIR> d-------- C:\Programme\The KMPlayer
2007-10-02 16:23 <DIR> d-------- C:\Dokumente und Einstellungen\Rene\Anwendungsdaten\RTPlayer
2007-10-02 10:17 <DIR> d-------- C:\Dokumente und Einstellungen\Rene\Shared
2007-10-02 10:14 <DIR> d-------- C:\Programme\Incomplete
2007-09-22 17:26 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Last.fm
2007-09-22 16:01 <DIR> d-------- C:\Programme\Lavasoft
2007-09-22 16:00 <DIR> d-------- C:\Programme\Gemeinsame Dateien\Wise Installation Wizard
2007-09-20 17:13 <DIR> d-------- C:\Programme\Last.fm
2007-09-16 14:50 <DIR> d-------- C:\Programme\Radiotracker
2007-09-16 14:50 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\RapidSolution
2007-09-15 16:57 <DIR> d-------- C:\Programme\LOADSTREET
2007-09-15 16:51 <DIR> d-------- C:\LOADSTREET
2007-09-15 16:42 <DIR> d-------- C:\Programme\Franzis
2007-09-13 16:38 639,224 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2007-09-09 11:55 284,160 --a------ C:\Dokumente und Einstellungen\Rene\Project1.exe
2007-09-09 10:22 1,938 --a------ C:\Dokumente und Einstellungen\Rene\HKLM_Run.reg
2007-09-09 10:22 886 --a------ C:\Dokumente und Einstellungen\Rene\HKCU_Run.reg
2007-09-09 10:22 396 --a------ C:\Dokumente und Einstellungen\Rene\HKCU_RunOnce.reg
2007-09-09 10:22 230 --a------ C:\Dokumente und Einstellungen\Rene\HKLM_RunOnce.reg
2007-09-09 10:21 125,712 --a------ C:\WINDOWS\system32\VB6DE.DLL
2007-09-09 09:05 <DIR> d-------- C:\Programme\Raxco
2007-09-09 09:05 <DIR> d-------- C:\Programme\Gemeinsame Dateien\Raxco
2007-09-09 09:05 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Raxco
2007-09-09 09:04 <DIR> d-------- C:\Computerbild PerfectDisk 7

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-31 15:07 --------- d-----w C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Google Updater
2007-10-30 14:32 --------- d-----w C:\Programme\Spyware Doctor
2007-10-30 13:50 --------- d-----w C:\Dokumente und Einstellungen\Rene\Anwendungsdaten\StarOffice8
2007-10-29 18:55 --------- d-----w C:\Programme\Warcraft III
2007-10-26 14:31 --------- d-----w C:\Programme\LimeWire
2007-10-20 14:32 --------- d-----w C:\Programme\Winamp
2007-10-13 15:20 --------- d-----w C:\Programme\ATI Technologies
2007-10-04 15:11 29,000 ----a-w C:\WINDOWS\system32\drivers\kcom.sys
2007-10-04 15:10 79,688 ----a-w C:\WINDOWS\system32\drivers\iksyssec.sys
2007-10-04 15:10 62,280 ----a-w C:\WINDOWS\system32\drivers\iksysflt.sys
2007-10-04 15:10 41,288 ----a-w C:\WINDOWS\system32\drivers\ikfilesec.sys
2007-09-19 19:02 --------- d-----w C:\Programme\Ashampoo
2007-09-13 15:45 --------- d-----w C:\Programme\WC3Banlist
2007-09-13 15:45 --------- d-----w C:\Programme\Ahead
2007-09-13 14:55 --------- d-----w C:\Programme\GIMP-2.0
2007-09-13 14:35 --------- d-----w C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ashampoo
2007-08-21 06:16 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-07-30 17:19 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
2007-07-30 17:19 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
2007-07-30 17:19 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
2007-07-30 17:19 43,352 ----a-w C:\WINDOWS\system32\wups2.dll
2007-07-30 17:19 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
2007-07-30 17:19 271,224 ----a-w C:\WINDOWS\system32\mucltui.dll
2007-07-30 17:19 207,736 ----a-w C:\WINDOWS\system32\muweb.dll
2007-07-30 17:19 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll
2007-07-30 17:19 1,712,984 ----a-w C:\WINDOWS\system32\wuaueng.dll
2007-07-30 17:18 33,624 ----a-w C:\WINDOWS\system32\wups.dll
2007-07-09 13:16 582,656 ----a-w C:\WINDOWS\system32\rpcrt4.dll
.

(((((((((((((((((((((((((((( Autostart Punkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Eintrage & legitime Standardeintrage werden nicht angezeigt.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-08-03 21:10]
"SoundMan"="SOUNDMAN.EXE" [2004-09-16 20:39 C:\WINDOWS\SOUNDMAN.EXE]
"ATICCC"="C:\Programme\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 15:41]
"WinampAgent"="C:\Programme\Winamp\winampa.exe" [2007-10-10 06:28]
"avgnt"="C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2007-10-30 18:05]
"ZoneAlarm Client"="C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe" [2007-06-21 21:54]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 13:00]
"swg"="C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-23 17:09]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"SSS6_Suite"="C:\Programme\Steganos Security Suite 6\sss.exe" /booting
"SSS6_SAFE"="C:\Programme\Steganos Security Suite 6\safe.exe" /booting
"SSS6_SPM"="C:\Programme\Steganos Security Suite 6\spm.exe" /booting

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"=0 (0x0)
"NoFileAssociate"=0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoRecentDocsHistory"=0 (0x0)
"NoTrayItemsDisplay"=0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice"

R0 Defrag32b;Defrag32Boot;C:\WINDOWS\system32\drivers\Defrag32b.sys
R0 SiSRaid;SiSRaid;C:\WINDOWS\system32\DRIVERS\SiSRaid.sys
R2 Defrag32;Defrag32;C:\WINDOWS\system32\drivers\Defrag32.sys
R2 PDSched;PDScheduler;C:\Programme\Raxco\PerfectDisk\PDSched.exe
R3 WinDSLa;WinDSL-Adapter (PPP-over-Ethernet);C:\WINDOWS\system32\DRIVERS\WinDSL.sys
S2 SLEE_503_DRIVER;Steganos Live Encryption Engine (Version 503) [Driver];\??\C:\WINDOWS\system32\drivers\SLEE503.sys
S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys
S3 TSMPacket;T-DSL Manager Service;C:\WINDOWS\system32\DRIVERS\tsmpkt.sys
S3 WinDSLp;%WinDSLp_Desc%;C:\WINDOWS\system32\DRIVERS\WinDSL.sys

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{24985ac6-639e-11dc-a6a8-454b47000031}]
AutoRun\command - I:\autoplay.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{777cd346-63aa-11dc-a6a9-454b47000031}]
AutoRun\command - D:\autoplay.exe

*Newly Created Service* - CATCHME
.
**************************************************************************

catchme 0.3.1239 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-31 17:44:05
Windows 5.1.2600 Service Pack 2 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostart Einträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
Zeit der Fertigstellung: 2007-10-31 17:44:47
.
--- E O F ---

Poste bitte alle Logs. Ja.

Hast du den eScan schon gemacht? IClean brauche ich auch noch.

Hast du mal eine Windows Reparation durchgeführt?