Hallo,

meine Frau hat gestern einmal "kurz gesurft" (Sie sagte haupsächlich auf dieser Seite:w w w.x17online.com
Ergebnis:

Mein Antivir ist gelöscht und auch merkwürdigerweise meine ganzen anderen Spyware Programme wie ants und spybot.Wenn ich nun versuche Antivire neu zu installieren kommt die Meldung:
Datein konnten nicht alle entpackt werde und es geht nix...ich bin ratlos.
Kann mir hier bitte einmal jemand helfen?

Danke im vorraus und lg

Logfiles:
"Silent Runners.vbs", revision 52, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"ctfmon.exe" = "I:\WINDOWS\system32\ctfmon.exe" [MS]
"Spamihilator" = ""I:\Programme\Spamihilator\spamihilator.exe"" ["Michel Krämer"]
"Simple Star PhotoShow Media Manager" = "I:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe" ["Simple Star, Inc."]
"IBP" = "(empty string)" [file not found]
"SpybotSD TeaTimer" = "I:\Programme\Sicherheit\Spybot - Search & Destroy\TeaTimer.exe" [file not found]

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"NVMixerTray" = ""I:\Programme\NVIDIA Corporation\NvMixer\NVMixerTray.exe"" ["NVIDIA Corporation"]
"ATIPTA" = "I:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe" ["ATI Technologies, Inc."]
"EPSON Stylus C66 Series" = "I:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0S2.EXE /P23 "EPSON Stylus C66 Series" /O6 "USB002" /M "Stylus C66"" ["SEIKO EPSON CORPORATION"]
"Tweak UI" = "RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp" [MS]
"P2P Networking" = "I:\WINDOWS\system32\P2P Networking\P2P Networking.exe /AUTOSTART" [file not found]
"KernelFaultCheck" = "I:\WINDOWS\system32\dumprep 0 -k"
"Siemens SmartSync - ScheduleSync" = "C:\PROGRA~1\HANDYF~1\SMARTS~1\SCHEDU~1.EXE" [empty string]
"SunJavaUpdateSched" = ""I:\Programme\Java\jre1.6.0_01\bin\jusched.exe"" ["Sun Microsystems, Inc."]
"LVCOMS" = "I:\Programme\Gemeinsame Dateien\Logitech\QCDriver3\LVCOMS.EXE" ["Logitech Inc."]
"SNPSTD2" = "I:\WINDOWS\vsnpstd2.exe" [empty string]
"avgnt" = ""I:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min" [file not found]
"QuickTime Task" = ""I:\Programme\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."]
"TkBellExe" = ""I:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot" ["RealNetworks, Inc."]
"BluetoothAuthenticationAgent" = "rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent" [MS]
"RemoteControl" = "I:\Programme\CyberLink\PowerDVD\PDVDServ.exe" ["Cyberlink Corp."]
"CloneCDTray" = ""I:\Programme\SlySoft\CloneCD\CloneCDTray.exe" /s" ["SlySoft, Inc."]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{02478D38-C3F9-4EFB-9B51-7695ECA05670}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Yahoo! Toolbar Helper"
\InProcServer32\(Default) = "I:\Programme\Yahoo!\Companion\Installs\cpn1\yt.dll" ["Yahoo! Inc."]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)
-> {HKLM...CLSID} = "AcroIEHlprObj Class"
\InProcServer32\(Default) = "i:\programme\acrobat\Acrobat\ActiveX\AcroIEHelper.ocx" [empty string]
{53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Spybot-S&D IE Protection"
\InProcServer32\(Default) = "I:\PROGRA~1\SICHER~2\SPYBOT~1\SDHelper.dll" ["Safer Networking Limited"]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)
-> {HKLM...CLSID} = "SSVHelper Class"
\InProcServer32\(Default) = "I:\Programme\Java\jre1.6.0_01\bin\ssv.dll" ["Sun Microsystems, Inc."]
{AA58ED58-01DD-4d91-8333-CF10577473F7}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Google Toolbar Helper"
\InProcServer32\(Default) = "i:\programme\google\googletoolbar2.dll" ["Google Inc."]
{CC59E0F9-7E43-44FA-9FAA-8377850BF205}\(Default) = (no title provided)
-> {HKLM...CLSID} = "FDMIECookiesBHO Class"
\InProcServer32\(Default) = "I:\Programme\Free Download Manager\iefdmcks.dll" [null data]
{E99421FB-68DD-40F0-B4AC-B7027CAE2F1A}\(Default) = (no title provided)
-> {HKLM...CLSID} = "EpsonToolBandKicker Class"
\InProcServer32\(Default) = "I:\Programme\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll" ["SEIKO EPSON CORPORATION"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Erweiterung für HyperTerminal-Icons"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "I:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "I:\office\winrar\rarext.dll" [null data]
"{63542C48-9552-494A-84F7-73AA6A7C99C1}" = "OpenOffice Property Sheet Handler"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "I:\office\open_office\program\shlxthdl.dll" ["Sun Microsystems, Inc."]
"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player"
-> {HKLM...CLSID} = "RealOne Player Context Menu Class"
\InProcServer32\(Default) = "I:\Programme\Real\RealPlayer\rpshell.dll" ["RealNetworks, Inc."]
"{5E2121EE-0300-11D4-8D3B-444553540000}" = "Shredder extension"
-> {HKLM...CLSID} = "Shredder"
\InProcServer32\(Default) = "I:\WINDOWS\system32\ShredExt.dll" [empty string]
"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "I:\Programme\Microsoft Office\Office10\msohev.dll" [MS]
"{DEE12703-6333-4D4E-8F34-738C4DCC2E04}" = "RecordNow! SendToExt"
-> {HKLM...CLSID} = "RecordNow! SendToExt"
\InProcServer32\(Default) = "I:\Programme\Sonic\RecordNow!\shlext.dll" ["Sonic Solutions"]
"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler"
-> {HKLM...CLSID} = "Outlook File Icon Extension"
\InProcServer32\(Default) = "I:\Programme\Microsoft Office\Office10\OLKFSTUB.DLL" [MS]
"{5464D816-CF16-4784-B9F3-75C0DB52B499}" = "Yahoo! Mail"
-> {HKLM...CLSID} = "YMailShellExt Class"
\InProcServer32\(Default) = "I:\PROGRA~1\Yahoo!\Common\ymmapi.dll" ["Yahoo! Inc."]
"{ED65AC21-B24F-11d3-BA80-00C0CA16AA37}" = "Siemens Device"
-> {HKLM...CLSID} = "Siemens Device"
\InProcServer32\(Default) = "C:\Program Files\handyfotos_übertragen\DES\DESShellExt.dll" ["Siemens AG"]
"{ED65AC22-B24F-11d3-BA80-00C0CA16AA37}" = "Siemens Device ContextMenuHandler"
-> {HKLM...CLSID} = "Siemens Device ContextMenuHandler"
\InProcServer32\(Default) = "C:\Program Files\handyfotos_übertragen\DES\DESShellExt.dll" ["Siemens AG"]
"{ED65AC23-B24F-11d3-BA80-00C0CA16AA37}" = "Siemens SX1 PropertySheetHandler"
-> {HKLM...CLSID} = "Siemens Device PropertySheetHandler"
\InProcServer32\(Default) = "C:\Program Files\handyfotos_übertragen\DES\DESShellExt.dll" ["Siemens AG"]
"{acb4a560-3606-11d3-aef4-00104bd0f92d}" = "KodakShellExtension"
-> {HKLM...CLSID} = "KodakShellExtension"
\InProcServer32\(Default) = "I:\Programme\Gemeinsame Dateien\Kodak\ifscore\KodakShX.dll" ["Eastman Kodak Company"]
"{45AC2688-0253-4ED8-97DE-B5370FA7D48A}" = "Shell Extension for Malware scanning"
-> {HKLM...CLSID} = "Shell Extension for Malware scanning"
\InProcServer32\(Default) = "I:\Programme\AntiVir PersonalEdition Classic\shlext.dll" ["Avira GmbH"]
"{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}" = "iTunes"
-> {HKLM...CLSID} = "iTunes"
\InProcServer32\(Default) = "I:\Programme\iTunes\iTunesMiniPlayer.dll" ["Apple Computer, Inc."]
"{73B24247-042E-4EF5-ADC2-42F62E6FD654}" = "ICQ Lite Shell Extension"
-> {HKLM...CLSID} = "MCLiteShellExt Class"
\InProcServer32\(Default) = "I:\Programme\ICQLite\ICQLiteShell.dll" [empty string]
"{969223C0-26AA-11D0-90EE-444553540000}" = "Shell Extension"
-> {HKLM...CLSID} = "PGP Shell Extension"
\InProcServer32\(Default) = "pgpmn.dll" ["PGP Corporation"]
"{F8B14440-3785-11D1-B363-5C6F08C10000}" = "PGPdisk Shell Extension"
-> {HKLM...CLSID} = "PGPdisk Shell Extension"
\InProcServer32\(Default) = "PGPdiskSE.dll" [file not found]

HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\
<<!>> "load" = "I:\Programme\TBRIDGE\tbridge\Flatbed.exe" [null data]

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
<<!>> AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
East-TecEraser\(Default) = "{E0BD38EB-C8EC-11D2-B274-B493B003B125}"
-> {HKLM...CLSID} = "East-Tec Eraser Context Menu Shell Extension"
\InProcServer32\(Default) = "I:\PROGRA~1\EAST-T~1\eteshell.dll" [file not found]
ICQLiteMenu\(Default) = "{73B24247-042E-4EF5-ADC2-42F62E6FD654}"
-> {HKLM...CLSID} = "MCLiteShellExt Class"
\InProcServer32\(Default) = "I:\Programme\ICQLite\ICQLiteShell.dll" [empty string]
Shell Extension for Malware scanning\(Default) = "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}"
-> {HKLM...CLSID} = "Shell Extension for Malware scanning"
\InProcServer32\(Default) = "I:\Programme\AntiVir PersonalEdition Classic\shlext.dll" ["Avira GmbH"]
Shredder\(Default) = "{5E2121EE-0300-11D4-8D3B-444553540000}"
-> {HKLM...CLSID} = "Shredder"
\InProcServer32\(Default) = "I:\WINDOWS\system32\ShredExt.dll" [empty string]
VIDEOTRANS\(Default) = "{C8CA0A66-AF32-4D5E-879E-F0809ACEDC55}"
-> {HKLM...CLSID} = "AmvTransform Class"
\InProcServer32\(Default) = "I:\Programme\MyMPxPlayer.org\MP3 Player Utilities 3.68\AMVTools\AmvTransform.dll" [empty string]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "I:\office\winrar\rarext.dll" [null data]
Yahoo! Mail\(Default) = "{5464D816-CF16-4784-B9F3-75C0DB52B499}"
-> {HKLM...CLSID} = "YMailShellExt Class"
\InProcServer32\(Default) = "I:\PROGRA~1\Yahoo!\Common\ymmapi.dll" ["Yahoo! Inc."]
ZONERMenu\(Default) = "{7B793D33-DB64-11D0-8720-0020AF158EA5}"
-> {HKLM...CLSID} = "Zoner Explorer Extension"
\InProcServer32\(Default) = "I:\office\zoner_draw3\Program\FShEx30.dll" ["ZONER software, Ltd."]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
ICQLiteMenu\(Default) = "{73B24247-042E-4EF5-ADC2-42F62E6FD654}"
-> {HKLM...CLSID} = "MCLiteShellExt Class"
\InProcServer32\(Default) = "I:\Programme\ICQLite\ICQLiteShell.dll" [empty string]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "I:\office\winrar\rarext.dll" [null data]
ZONERMenu\(Default) = "{7B793D33-DB64-11D0-8720-0020AF158EA5}"
-> {HKLM...CLSID} = "Zoner Explorer Extension"
\InProcServer32\(Default) = "I:\office\zoner_draw3\Program\FShEx30.dll" ["ZONER software, Ltd."]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
East-TecEraser\(Default) = "{E0BD38EB-C8EC-11D2-B274-B493B003B125}"
-> {HKLM...CLSID} = "East-Tec Eraser Context Menu Shell Extension"
\InProcServer32\(Default) = "I:\PROGRA~1\EAST-T~1\eteshell.dll" [file not found]
Shell Extension for Malware scanning\(Default) = "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}"
-> {HKLM...CLSID} = "Shell Extension for Malware scanning"
\InProcServer32\(Default) = "I:\Programme\AntiVir PersonalEdition Classic\shlext.dll" ["Avira GmbH"]
Shredder\(Default) = "{5E2121EE-0300-11D4-8D3B-444553540000}"
-> {HKLM...CLSID} = "Shredder"
\InProcServer32\(Default) = "I:\WINDOWS\system32\ShredExt.dll" [empty string]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "I:\office\winrar\rarext.dll" [null data]
ZONERMenu\(Default) = "{7B793D33-DB64-11D0-8720-0020AF158EA5}"
-> {HKLM...CLSID} = "Zoner Explorer Extension"
\InProcServer32\(Default) = "I:\office\zoner_draw3\Program\FShEx30.dll" ["ZONER software, Ltd."]


Group Policies {GPedit.msc branch and setting}:
-----------------------------------------------

Note: detected settings may not have any effect.

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\

"NoWindowsUpdate" = (REG_DWORD) hex:0x00000000
{User Configuration|Administrative Templates|Start Menu and Taskbar|
Remove links and access to Windows Update}

"NoInstrumentation" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoFavoritesMenu" = (REG_DWORD) hex:0x00000000
{User Configuration|Administrative Templates|Start Menu and Taskbar|
Remove Favorites menu from Start Menu}

"ClearRecentDocsOnExit" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoLowDiskSpaceChecks" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoTrayItemsDisplay" = (REG_DWORD) hex:0x00000000
{User Configuration|Administrative Templates|Start Menu and Taskbar|
Hide the notification area}

"NoTrayContextMenu" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoSetTaskbar" = (REG_DWORD) hex:0x00000000
{User Configuration|Administrative Templates|Start Menu and Taskbar|
Prevent changes to Taskbar and Start Menu Settings}

"NoDrives" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoSharedDocuments" = (REG_DWORD) hex:0x00000000
{User Configuration|Administrative Templates|Windows Components|Windows Explorer|
Remove Shared Documents from My Computer}

"SpecifyDefaultButtons" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoNetworkConnections" = (REG_DWORD) hex:0x00000000
{User Configuration|Administrative Templates|Start Menu and Taskbar|
Remove Network Connections from Start Menu}

HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel\

"GeneralTab" = (REG_DWORD) hex:0x00000000
{User Configuration|Administrative Templates|Windows Components|Internet Explorer|Internet Control Panel|
Disable the General page}

"Settings" = (REG_DWORD) hex:0x00000000
{User Configuration|Administrative Templates|Windows Components|Internet Explorer|
Prevent the deletion of temporary Internet files and cookies}

"Cache" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"History" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"HomePage" = (REG_DWORD) hex:0x00000000
{User Configuration|Administrative Templates|Windows Components|Internet Explorer|
Disable changing home page settings}

"Colors" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"Fonts" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"Languages" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"SecurityTab" = (REG_DWORD) hex:0x00000000
{User Configuration|Administrative Templates|Windows Components|Internet Explorer|Internet Control Panel|
Disable the Security page}

"SecChangeSettings" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"ContentTab" = (REG_DWORD) hex:0x00000000
{User Configuration|Administrative Templates|Windows Components|Internet Explorer|Internet Control Panel|
Disable the Content page}

"Ratings" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"Certificates" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"Profiles" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"CertifPers" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"ConnectionsTab" = (REG_DWORD) hex:0x00000000
{User Configuration|Administrative Templates|Windows Components|Internet Explorer|Internet Control Panel|
Disable the Connections page}

"Proxy" = (REG_DWORD) hex:0x00000000
{User Configuration|Administrative Templates|Windows Components|Internet Explorer|
Disable changing proxy settings}

"ProgramsTab" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"CalendarContact" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"Check_If_Default" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"Messaging" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"AdvancedTab" = (REG_DWORD) hex:0x00000000
{User Configuration|Administrative Templates|Windows Components|Internet Explorer|Internet Control Panel|
Disable the Advanced page}

"Connwiz Admin Lock" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions\

"NoBrowserClose" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoBrowserContextMenu" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoBrowserOptions" = (REG_DWORD) hex:0x00000000
{User Configuration|Administrative Templates|Windows Components|Internet Explorer|Browser Menus|
Tools menu: Disable Internet Options... menu option}

"NoBrowserSaveAs" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoFavorites" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoFileNew" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoFileOpen" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoFindFiles" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoSelectDownloadDir" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoTheaterMode" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoNavButtons" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoPrinting" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\

"shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Shutdown: Allow system to be shut down without having to log on}

"undockwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Devices: Allow undock without having to log on}


Active Desktop and Wallpaper:
-----------------------------

Active Desktop may be disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState


Enabled Screen Saver:
---------------------

HKCU\Control Panel\Desktop\
"SCRNSAVE.EXE" = "I:\WINDOWS\System32\ssmypics.scr" [MS]


Startup items in "familie_muppet" & "All Users" startup folders:
--------------------------------------------------------------

I:\Dokumente und Einstellungen\familie_hees\Startmenü\Programme\Autostart
"FRITZ!DSL Internet" -> shortcut to: "I:\Programme\FRITZ!DSL\FritzDsl.exe" ["AVM Berlin"]
"FRITZ!DSL Protect" -> shortcut to: "I:\Programme\FRITZ!DSL\FwebProt.exe" ["AVM Berlin"]
"FRITZ!DSL Startcenter" -> shortcut to: "I:\Programme\FRITZ!DSL\StCenter.exe" ["AVM Berlin"]

I:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart
"Microsoft Office" -> shortcut to: "I:\Programme\Microsoft Office\Office10\OSA.EXE -b -l" [MS]
"NETGEAR ProSafe VPN Client" -> shortcut to: "I:\Programme\NETGEAR\NETGEAR ProSafe VPN Client\SafeCfg.exe" ["SafeNet"]
"Software Kodak EasyShare" -> shortcut to: "I:\Programme\Kodak\Kodak EasyShare software\bin\EasyShare.exe -hx" [null data]


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000004\LibraryPath = "I:\Programme\FRITZ!DSL\sarah.dll" ["AVM Berlin"]
000000000005\LibraryPath = "%SystemRoot%\system32\wshbth.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
I:\Programme\FRITZ!DSL\sarah.dll ["AVM Berlin"], 01 - 03, 09
%SystemRoot%\system32\mswsock.dll [MS], 04 - 06, 10 - 38
%SystemRoot%\system32\rsvpsp.dll [MS], 07 - 08


Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\
"{2318C2B1-4965-11D4-9B18-009027A5CD4F}"
-> {HKLM...CLSID} = "&Google"
\InProcServer32\(Default) = "i:\programme\google\googletoolbar2.dll" ["Google Inc."]

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
"{2318C2B1-4965-11D4-9B18-009027A5CD4F}"
-> {HKLM...CLSID} = "&Google"
\InProcServer32\(Default) = "i:\programme\google\googletoolbar2.dll" ["Google Inc."]
"{EE5D279F-081B-4404-994D-C6B60AAEBA6D}"
-> {HKLM...CLSID} = "EPSON Web-To-Page"
\InProcServer32\(Default) = "I:\Programme\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll" ["SEIKO EPSON CORPORATION"]
"{EF99BD32-C1FB-11D2-892F-0090271D4F88}"
-> {HKLM...CLSID} = "Yahoo! Toolbar"
\InProcServer32\(Default) = "I:\Programme\Yahoo!\Companion\Installs\cpn1\yt.dll" ["Yahoo! Inc."]

HKLM\Software\Microsoft\Internet Explorer\Toolbar\
"{EE5D279F-081B-4404-994D-C6B60AAEBA6D}" = (no title provided)
-> {HKLM...CLSID} = "EPSON Web-To-Page"
\InProcServer32\(Default) = "I:\Programme\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll" ["SEIKO EPSON CORPORATION"]
"{2318C2B1-4965-11D4-9B18-009027A5CD4F}" = (no title provided)
-> {HKLM...CLSID} = "&Google"
\InProcServer32\(Default) = "i:\programme\google\googletoolbar2.dll" ["Google Inc."]
"{EF99BD32-C1FB-11D2-892F-0090271D4F88}" = (no title provided)
-> {HKLM...CLSID} = "Yahoo! Toolbar"
\InProcServer32\(Default) = "I:\Programme\Yahoo!\Companion\Installs\cpn1\yt.dll" ["Yahoo! Inc."]
"{855F3B16-6D32-4FE6-8A56-BBB695989046}" = (no title provided)
-> {HKLM...CLSID} = "ICQ Toolbar"
\InProcServer32\(Default) = "I:\Programme\ICQToolbar\toolbaru.dll" ["ICQ Inc."]

Explorer Bars

HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\
{4528BBE0-4E08-11D5-AD55-00010333D0AD}\(Default) = (no title provided)
-> {HKLM...CLSID} = "&Yahoo! Messenger"
\InProcServer32\(Default) = "I:\PROGRA~1\Yahoo!\Common\yhexbmeses.dll" ["Yahoo! Inc."]

Extensions (Tools menu items, main toolbar menu buttons)

HKCU\Software\Microsoft\Internet Explorer\Extensions\
{0E921E80-267A-42AA-AEE4-60B9A1222A44}\
"ButtonText" = "Klicke hier um das Projekt xp-AntiSpy zu unterstützen"
"MenuText" = "Unterstützung für xp-AntiSpy"
"Exec" = "I:\Programme\xp-AntiSpy\sponsoring\sponsor.html" [null data]

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Konsole"
"CLSIDExtension" = "{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBC}"
-> {HKLM...CLSID} = "Java Plug-in 1.6.0_01"
\InProcServer32\(Default) = "I:\Programme\Java\jre1.6.0_01\bin\npjpi160_01.dll" ["Sun Microsystems, Inc."]

{4528BBE0-4E08-11D5-AD55-00010333D0AD}\
"ButtonText" = "Messenger"
"MenuText" = "Yahoo! Messenger"
"CLSIDExtension" = "{4C171D40-8277-11D5-AD55-00010333D0AD}"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "I:\PROGRA~1\Yahoo!\Common\yhexbmeses.dll" ["Yahoo! Inc."]

{B863453A-26C3-4E1F-A54D-A2CD196348E9}\
"ButtonText" = "ICQ Lite"
"MenuText" = "ICQ Lite"
"Exec" = "I:\Programme\ICQLite\ICQLite.exe" ["ICQ Ltd."]

{DFB852A3-47F8-48C4-A200-58CAB36FD2A2}\
"MenuText" = "Spybot - Search & Destroy Configuration"
"CLSIDExtension" = "{53707962-6F74-2D53-2644-206D7942484F}"
-> {HKLM...CLSID} = "Spybot-S&D IE Protection"
\InProcServer32\(Default) = "I:\PROGRA~1\SICHER~2\SPYBOT~1\SDHelper.dll" ["Safer Networking Limited"]

{FB5F1910-F110-11D2-BB9E-00C04F795683}\
"ButtonText" = "Messenger"
"MenuText" = "Windows Messenger"
"Exec" = "I:\Programme\Messenger\msmsgs.exe" [MS]

{FD9DE2B4-C926-4460-81C4-FC58C6F1062E}\
"ButtonText" = "SmartWhois"
"Exec" = "I:\PROGRA~1\SMARTW~1\SWMSIE~1.EXE" ["TamoSoft, Inc."]

{FF983118-58C7-4AD4-B5A7-691C39CB7B42}\
"MenuText" = "SmartWhois"
"Exec" = "I:\PROGRA~1\SMARTW~1\SWMSIE~1.EXE" ["TamoSoft, Inc."]


Miscellaneous IE Hijack Points
------------------------------

HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\
<<H>> "{EF99BD32-C1FB-11D2-892F-0090271D4F88}" = "*_" (unwritable string)
-> {HKLM...CLSID} = "Yahoo! Toolbar"
\InProcServer32\(Default) = "I:\Programme\Yahoo!\Companion\Installs\cpn1\yt.dll" ["Yahoo! Inc."]


Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

AntiVir Scheduler, AntiVirScheduler, "I:\Programme\AntiVir PersonalEdition Classic\sched.exe" [null data]
AVM IGD CTRL Service, AVM IGD CTRL Service, "I:\Programme\FRITZ!DSL\IGDCTRL.EXE" ["AVM Berlin"]
Bluetooth Support Service, BthServ, "I:\WINDOWS\system32\svchost.exe -k bthsvcs" {"I:\WINDOWS\System32\bthserv.dll" [MS]}
Machine Debug Manager, MDM, ""I:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe"" [MS]
MSSQL$FHU, MSSQL$FHU, "I:\Programme\Microsoft SQL Server\MSSQL$FHU\Binn\sqlservr.exe -sFHU" [null data]
MSSQLSERVER, MSSQLSERVER, "I:\Programme\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe -sMSSQLSERVER" [null data]
MySQL, MySQL, ""I:\Programme\MySQL\MySQL Server 4.1\bin\mysqld-nt" --defaults-file="I:\Programme\MySQL\MySQL Server 4.1\my.ini" MySQL" [null data]
PGPserv, PGPserv, "I:\WINDOWS\system32\PGPserv.exe" ["PGP Corporation"]
SafeNet IKE Service, IREIKE, ""I:\Programme\NETGEAR\NETGEAR ProSafe VPN Client\IreIKE.exe"" ["SafeNet"]
SafeNet Monitor Service, IPSECMON, ""I:\Programme\NETGEAR\NETGEAR ProSafe VPN Client\IPSecMon.exe"" ["SafeNet"]
Windows User Mode Driver Framework, UMWdf, "I:\WINDOWS\system32\wdfmgr.exe" [MS]


Keyboard Driver Filters:
------------------------

HKLM\System\CurrentControlSet\Control\Class\{4D36E96B-E325-11CE-BFC1-08002BE10318}\
"UpperFilters" = <<!>> "PGPsdkDriver" [file not found]


Print Monitors:
---------------

HKLM\System\CurrentControlSet\Control\Print\Monitors\
avm:\Driver = "avmprmon.dll" ["AVM Berlin GmbH"]
EPSON V6 2KMonitor\Driver = "EBPMON24.DLL" ["SEIKO EPSON CORPORATION"]
FRITZ!fax Color Port Monitor\Driver = "FritzColorPort.dll" ["AVM Berlin GmbH"]
FRITZ!fax Port Monitor\Driver = "FritzPort.dll" ["AVM Berlin GmbH"]
Kodak PD6000 Language Monitor\Driver = "PD6000LM.dll" ["Eastman Kodak Company"]
PDF Port\Driver = "I:\WINDOWS\System32\pdfports.dll" ["Adobe Systems Incorporated."]


---------- (launch time: 2007-11-06 19:35:12)
<<!>>: Suspicious data at a malware launch point.
<<H>>: Suspicious data at a browser hijack point.

+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ To search all directories of local fixed drives for DESKTOP.INI
DLL launch points, use the -supp parameter or answer "No" at the
first message box and "Yes" at the second message box.
---------- (total run time: 93 seconds, including 14 seconds for message boxes)


ComboFix 07-11-06.4 - familie_muppet 2007-11-06 19:40:33.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2634.2.1252.49.1031.18.185 [GMT 1:00]
ausgeführt von:: I:\Dokumente und Einstellungen\familie_muppet\Lokale Einstellungen\Temporary Internet Files\Content.IE5\IKZULHQS\ComboFix[1].exe
* Neuer Wiederherstellungspunkt wurde erstellt
.

(((((((((((((((((((((((((((((((((((( Weitere L”schungen ))))))))))))))))))))))))))))))))))))))))))))))))
.

I:\Dokumente und Einstellungen\familie_muppet\Anwendungsdaten\winantiviruspro2006freeinstall_es[1].exe
I:\Programme\winupdates
I:\WINDOWS\exefld
I:\WINDOWS\exefld\415807921.exe
I:\WINDOWS\regedit.com
I:\WINDOWS\system32\bszip.dll
I:\WINDOWS\system32\Cache
I:\WINDOWS\system32\cmd.com
I:\WINDOWS\system32\drivers\hidr.exe
I:\WINDOWS\system32\drivers\srosa.sys
I:\WINDOWS\system32\f3PSSavr.scr
I:\WINDOWS\system32\ping.com
I:\WINDOWS\system32\regedit.com
I:\WINDOWS\system32\tasklist.com
I:\WINDOWS\system32\taskmgr.com
I:\WINDOWS\system32\tracert.com
I:\WINDOWS\system32\wintems.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_SROSA
-------\srosa


((((((((((((((((((((((( Dateien erstellt von 2007-10-06 bis 2007-11-06 ))))))))))))))))))))))))))))))
.

2007-11-06 19:37 51,200 --a------ I:\WINDOWS\NirCmd.exe
2007-11-06 18:52 2,183,296 --a------ I:\WINDOWS\system32\ntoskrnl.exe
2007-11-06 18:52 2,183,296 --a--c--- I:\WINDOWS\system32\dllcache\ntoskrnl.exe
2007-11-06 18:13 <DIR> d-a------ I:\WINDOWS\zts2.exe
2007-11-06 18:13 <DIR> d-a------ I:\WINDOWS\system32\vcmgcd32.dll
2007-11-06 18:13 <DIR> d-a------ I:\WINDOWS\system32\systems.txt
2007-11-06 18:13 <DIR> d-a------ I:\WINDOWS\system32\iifgfgf.dll
2007-11-06 18:13 <DIR> d-a------ I:\WINDOWS\rundll16.exe
2007-11-06 18:13 <DIR> d-a------ I:\WINDOWS\rundl132.dll
2007-11-06 18:13 <DIR> d-a------ I:\WINDOWS\logo1_.exe
2007-11-06 18:13 22 --a------ I:\WINDOWS\REGBK00.ZIP
2007-11-06 18:00 153,600 --a------ I:\WINDOWS\R.COM
2007-11-06 18:00 140,800 --a------ I:\WINDOWS\system32\T.COM
2007-11-04 11:57 <DIR> d-------- I:\Dokumente und Einstellungen\familie_muppet\Anwendungsdaten\DVD Flick
2007-11-01 19:04 <DIR> d-------- I:\Dokumente und Einstellungen\familie_muppet\Anwendungsdaten\ImgBurn
2007-11-01 13:31 <DIR> d-------- I:\Programme\AVStoDVD
2007-10-29 20:58 <DIR> d-------- I:\Programme\TagTooga.com
2007-10-21 13:37 <DIR> d-------- I:\Programme\DaemonTools_WhenUSave_Installer
2007-10-20 17:09 <DIR> d-------- I:\spoolerlogs
2007-10-20 12:24 <DIR> d-------- I:\DVDTemp
2007-10-20 12:23 <DIR> d-------- I:\Programme\WinX DVD Author 5.5
2007-10-20 11:34 <DIR> d-------- I:\Programme\DVDlab
2007-10-18 21:33 <DIR> d-------- I:\Programme\PowerWare
2007-10-11 18:36 <DIR> d-------- I:\Programme\sofTRANS GmbH
2007-10-10 10:39 584,192 -----c--- I:\WINDOWS\system32\dllcache\rpcrt4.dll
2007-10-07 13:16 1,601,536 --a------ I:\WINDOWS\system32\MediaInfo.dll

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.
2007-11-06 18:59 --------- d-----w I:\Dokumente und Einstellungen\familie_muppet\Anwendungsdaten\FRITZ!
2007-11-06 18:52 --------- d-----w I:\Programme\xp_clean
2007-11-06 18:37 --------- d-----w I:\Dokumente und Einstellungen\familie_muppet\Anwendungsdaten\Free Download Manager
2007-11-06 17:50 --------- d-----w I:\Programme\FRITZ!DSL
2007-11-06 17:39 --------- d-----w I:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AntiVir PersonalEdition Classic
2007-11-06 17:23 --------- d-----w I:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
2007-11-06 17:04 --------- d-----w I:\Programme\tmx5
2007-11-06 16:02 --------- d-----w I:\Programme\Spamihilator
2007-11-01 19:49 --------- d-----w I:\Dokumente und Einstellungen\familie_muppet\Anwendungsdaten\IBP
2007-11-01 12:32 --------- d-----w I:\Programme\AviSynth 2.5
2007-10-23 10:44 --------- d-----w I:\Dokumente und Einstellungen\familie_muppet\Anwendungsdaten\Simple Star
2007-10-21 10:36 --------- d-----w I:\Programme\WinExpert
2007-10-12 19:40 --------- d-----w I:\Programme\billig_telefonieren
2007-10-11 17:52 --------- d--h--w I:\Programme\InstallShield Installation Information
2007-10-04 11:00 --------- d-----w I:\Dokumente und Einstellungen\muppetshow\Anwendungsdaten\PGP Corporation
2007-09-10 12:49 --------- d-----w I:\Programme\Winamp
2007-08-06 17:17 43,160 ----a-w I:\Dokumente und Einstellungen\familie_muppet\Anwendungsdaten\GDIPFONTCACHEV1.DAT
2006-05-03 09:06:54 163,328 --sh--r I:\WINDOWS\system32\flvDX.dll
2007-02-21 10:47:16 31,232 --sh--r I:\WINDOWS\system32\msfDX.dll
.

(((((((((((((((((((((((((((( Autostart Punkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Eintrage & legitime Standardeintrage werden nicht angezeigt.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NVMixerTray"="I:\Programme\NVIDIA Corporation\NvMixer\NVMixerTray.exe" [2004-06-03 19:51]
"ATIPTA"="I:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-08-25 11:52]
"EPSON Stylus C66 Series"="I:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0S2.exe" [2003-11-26 08:00]
"Tweak UI"="TWEAKUI.CPL" [2003-03-25 06:49 I:\WINDOWS\system32\tweakui.cpl]
"P2P Networking"="I:\WINDOWS\system32\P2P Networking\P2P Networking.exe" []
"Siemens SmartSync - ScheduleSync"="C:\PROGRA~1\HANDYF~1\SMARTS~1\SCHEDU~1.EXE" [2005-03-16 10:15]
"SunJavaUpdateSched"="I:\Programme\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 02:43]
"LVCOMS"="I:\Programme\Gemeinsame Dateien\Logitech\QCDriver3\LVCOMS.EXE" [2002-12-10 17:54]
"SNPSTD2"="I:\WINDOWS\vsnpstd2.exe" [2004-08-30 16:37]
"avgnt"="I:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" []
"QuickTime Task"="I:\Programme\QuickTime\qttask.exe" [2006-05-15 09:40]
"TkBellExe"="I:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" [2006-05-05 21:26]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 08:58 I:\WINDOWS\system32\bthprops.cpl]
"RemoteControl"="I:\Programme\CyberLink\PowerDVD\PDVDServ.exe" [2005-01-12 02:01]
"CloneCDTray"="I:\Programme\SlySoft\CloneCD\CloneCDTray.exe" [2006-09-28 20:21]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="I:\WINDOWS\system32\ctfmon.exe" [2004-08-04 08:57]
"Spamihilator"="I:\Programme\Spamihilator\spamihilator.exe" [2007-01-24 14:49]
"Simple Star PhotoShow Media Manager"="I:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe" [2006-01-13 22:22]
"IBP"="" []
"SpybotSD TeaTimer"="I:\Programme\Sicherheit\Spybot - Search & Destroy\TeaTimer.exe" []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoInstrumentation"=0 (0x0)
"NoFavoritesMenu"=0 (0x0)
"NoTrayItemsDisplay"=0 (0x0)
"NoTrayContextMenu"=0 (0x0)
"SpecifyDefaultButtons"=0 (0x0)

SafeBoot Registrierungsschl�ssel muss repariert werden. Dieser PC kann nicht im abgesicherten Modus starten.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\File system]
@="Driver Group"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vgasave.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}]
@="DiskDrive"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96A-E325-11CE-BFC1-08002BE10318}]
@="Hdc"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96B-E325-11CE-BFC1-08002BE10318}]
@="Keyboard"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96F-E325-11CE-BFC1-08002BE10318}]
@="Mouse"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E97D-E325-11CE-BFC1-08002BE10318}]
@="System"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]
@="Volume"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\I:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Acrobat Assistant.lnk]
path=I:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Acrobat Assistant.lnk
backup=I:\WINDOWS\pss\Acrobat Assistant.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\I:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Dienst-Manager.lnk]
path=I:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Dienst-Manager.lnk
backup=I:\WINDOWS\pss\Dienst-Manager.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\I:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Kodak software updater.lnk]
path=I:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Kodak software updater.lnk
backup=I:\WINDOWS\pss\Kodak software updater.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\I:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^MyWebSearch Email Plugin.lnk]
path=I:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\MyWebSearch Email Plugin.lnk
backup=I:\WINDOWS\pss\MyWebSearch Email Plugin.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\I:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Software Kodak EasyShare.lnk]
path=I:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Software Kodak EasyShare.lnk
backup=I:\WINDOWS\pss\Software Kodak EasyShare.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\I:^Dokumente und Einstellungen^familie_hees^Startmenü^Programme^Autostart^MyWebSearch Email Plugin.lnk]
path=I:\Dokumente und Einstellungen\familie_hees\Startmenü\Programme\Autostart\MyWebSearch Email Plugin.lnk
backup=I:\WINDOWS\pss\MyWebSearch Email Plugin.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\I:^Dokumente und Einstellungen^familie_hees^Startmenü^Programme^Autostart^OpenOffice.org 1.1.2.lnk]
path=I:\Dokumente und Einstellungen\familie_hees\Startmenü\Programme\Autostart\OpenOffice.org 1.1.2.lnk
backup=I:\WINDOWS\pss\OpenOffice.org 1.1.2.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\I:^Dokumente und Einstellungen^familie_hees^Startmenü^Programme^Autostart^Sonic CinePlayer Quick Launch.lnk]
path=I:\Dokumente und Einstellungen\familie_hees\Startmenü\Programme\Autostart\Sonic CinePlayer Quick Launch.lnk
backup=I:\WINDOWS\pss\Sonic CinePlayer Quick Launch.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\1&1 EasyLogin]
"I:\Programme\internet\1&1 EasyLogin\EasyLogin.exe" HIDE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ALDI_SUED_FotoSuite_Download]
"I:\Programme\ALDI Sued Foto Service\ALDI_Foto_Service\FotoSuite.exe" /autorun

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DB_AFD]
I:\Programme\DATA BECKER\XP optimal einstellen 3.0\DBAFD.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ImInstaller_IncrediMail]
I:\DOKUME~1\FAMILI~1\LOKALE~1\Temp\ImInstaller\IncrediMail\incredimail_install.exe -startup -product IncrediMail

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"I:\Programme\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
I:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sonic RecordNow!]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
I:\Programme\Java\j2re1.4.2_05\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"I:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Tweak UI]
RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateManager]
"I:\Programme\Gemeinsame Dateien\Sonic\Update Manager\sgtray.exe" /r

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WebCamRT.exe]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinMX]
C:\musika_peliculas\filesharing\WinMX\WinMX.exe -m

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winupdates]
I:\Programme\winupdates\winupdates.exe /auto

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\XPoe-Runtime]
I:\Programme\DATA BECKER\XP optimal einstellen 3.0\xpoerunt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"TapiSrv"=3 (0x3)
"wuauserv"=2 (0x2)
"Alerter"=2 (0x2)

R0 avgntmgr;avgntmgr;I:\WINDOWS\system32\drivers\avgntmgr.sys
R1 avgntdd;avgntdd;I:\WINDOWS\system32\DRIVERS\avgntdd.sys
R1 Cinemsup;Cinemsup;I:\WINDOWS\system32\drivers\Cinemsup.sys
R1 NETDSL;AVM PPP over Ethernet;I:\WINDOWS\system32\DRIVERS\netdsl.sys
R2 Crypto;Crypto;I:\WINDOWS\system32\drivers\Crypto.sys
R2 IPSECDRV;SafeNet IPSec Plugin;\??\I:\WINDOWS\system32\Drivers\IPSECDRV.sys
R2 MSSQL$FHU;MSSQL$FHU;I:\Programme\Microsoft SQL Server\MSSQL$FHU\Binn\sqlservr.exe -sFHU
R2 PGPdisk;PGPdisk;I:\WINDOWS\system32\drivers\PGPdisk.sys
R2 PGPsdkDriver;PGPsdkDriver;I:\WINDOWS\system32\Drivers\PGPsdk.sys
R2 ppsio;PrmxPPDev;I:\WINDOWS\system32\drivers\ppsio.sys
R2 SMTPSVC;Simple Mail Transfer Protocol (SMTP);I:\WINDOWS\system32\inetsrv\inetinfo.exe
R3 DniVap;SafeNet WAN Miniport (VA);I:\WINDOWS\system32\DRIVERS\vap.sys
R3 NETFWDSL;AVM FRITZ!web DSL PPP;I:\WINDOWS\system32\DRIVERS\NETFWDSL.SYS
S3 AVMCOWAN;AVM CoNDIS WAN CAPI Treiber;I:\WINDOWS\system32\DRIVERS\avmcowan.sys
S3 AVMDSLPPPOE;AVM DSL PPPoE CAPI-Treiber;I:\WINDOWS\system32\DRIVERS\avmdsloe.sys
S3 AVMNDSL;AVM DSL NDIS WAN CAPI Treiber;I:\WINDOWS\system32\DRIVERS\avmndsl.sys
S3 FDSLBASE;AVM FRITZ!Card DSL (WinXP/2000);I:\WINDOWS\system32\DRIVERS\fdslbase.sys
S3 snpstd2;Trek 310;I:\WINDOWS\system32\DRIVERS\snpstd2.sys
S3 SQLAgent$FHU;SQLAgent$FHU;I:\Programme\Microsoft SQL Server\MSSQL$FHU\Binn\sqlagent.EXE -i FHU

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
\Shell\AutoRun\command - G:\setup.exe

.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-06 19:59:39
Windows 5.1.2600 Service Pack 2 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostart Eintr„ge...

Scanne versteckte Dateien...

**************************************************************************
.
Zeit der Fertigstellung: 2007-11-06 20:02:25 - machine was rebooted
.
--- E O F ---

Hallo,

Zitat von Unwissender123

I:\WINDOWS\system32\drivers\hidr.exe

unter anderem dürftest du einen Bagle laufen haben, der für die deaktivierten AV-/Anti-Spyware-Programme verantwortlich sein könnte, in der Regel aber per Mail ankommt.

Ein HijackThis-Logfile und ein eScan wären von Interesse; Anleitungen dazu findest du im entsprechenden Unterforum.

Ferner unternimm bitte einen Scan mit Blacklight und poste auch dieses Log.

Hallo,
wie löscht man einen "Bagle"??
Hijackthis log ist hier anbei.

lg

1.)Ich kann den PC nicht mehr im abgesicherten Modus starten

2.)Ich komme zwar noch (manchmal) ins Internet, aber meine Fritzbox zeigt ständig an(keine Synchronisation/Kabel nicht verbunden, suche DSL Modem oder DSL-Router) Dies wird ständig angezeigt, auch wenn ich mal ins netz komme.

3.)Sytemwiederherstellung zu einem früheren Zeitpunkt von windos funktioniert nicht.

4.)Es befinden sich Programme die ich schon gelöscht hatte wieder in der Taskleiste und andere wurden einfach gelöscht

Hi,

Ohne Gewähr, Rootkit srosa gefunden (system32\drivers\srosa.sys)!
Neu aufsetzten ist wahrscheinlich das Beste...

Ohne Gewähr (Hardcore):
Avenger
avenger.zip - The Avenger
Input script manually (anhaken)
kopiere in: View/edit script

Files to delete:
I:\WINDOWS\system32\drivers\hidr.exe
I:\WINDOWS\system32\drivers\srosa.sys
I:\WINDOWS\system32\wintems.exe
I:\WINDOWS\system32\f3PSSavr.scr
I:\WINDOWS\system32\ping.com
I:\WINDOWS\system32\regedit.com
I:\WINDOWS\system32\tasklist.com
I:\WINDOWS\system32\taskmgr.com
I:\WINDOWS\system32\tracert.com

folders to delete:
I:\WINDOWS\exefnd

registry keys to delete:
HKLM\SYSTEM\CurrentControlSet\Services\srosa
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
HKLM\SYSTEM\CurrentControlSet\Services\pci32
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCI32

Abgesicherter Modus reparieren:
Downloade SafeMode Repair.zip
http://www.hijackthis-forum.de/attac...2&d=1187631899
entpacke es auf Deinen Desktop, mach einen Doppelklick auf die neu entstandene RegDatei um sie laufen zu lassen.
Klicke auf 'ok' > starte deinen Rechner in den normalen Modus auf.

Chris

Da war Chris schneller....

Tschuldigung Ralf!

Mit HJ muss noch gefixt werden, Antivir/Spyboot installieren und mit verschärften Einstellungen laufen lassen (Heuristik ein und Rootkitsuche ein)...

So, und jetzt erstmal:

Mahlzeit!


chris

@chris4you:
es kommt diese Fehlermeldung wenn ich das tun möchte.


//////////////////////////////////////////
Avenger Pre-Processor log
//////////////////////////////////////////

Fatal error: could not create new script file.
Error code: 0
Error logged to errorlog.txt. Aborting now!

Antivir konnte ich übrigens neu installieren und auch Spybot.
Werde nun an die zweite Anweisung gehen.

Hi,

stop!
Wir müssen erst den Rootkit löschen, daher Killbox:

Achtung: TEATIMER von Spybot muss deaktiviert sein, der stört sonst die Bereinigung!

Options: Delete on Reboot --> anhaken
reinkopieren:
I:\WINDOWS\system32\drivers\hidr.exe
I:\WINDOWS\system32\drivers\srosa.sys
I:\WINDOWS\system32\wintems.exe
I:\WINDOWS\system32\f3PSSavr.scr
I:\WINDOWS\system32\ping.com
I:\WINDOWS\system32\regedit.com
I:\WINDOWS\system32\tasklist.com
I:\WINDOWS\system32\taskmgr.com
I:\WINDOWS\system32\tracert.com
und klicke auf das rote Kreuz, wenn gefragt wird, ob "Do you want to reboot? "---- klicke auf "no",und kopiere das nächste rein, erst beim letzten auf "yes"

PC neustarten

Versuche danach noch mal den Avenger und danach HJ-fixen...

Wie von Franz vorgeschlagen noch einen Scan mit Blacklight...

Chris

Hi,

vielleicht wäre ja der Link zur Killbox noch ganz nützlich (ich werde alt)...
http://virus-protect.org/killbox.html

Chris

Hallo,
werde die Anweisungen versuchen.Komme allerdings jetzt nicht mehr ins Internet und der PC wird immer langsamer...schreibe von einem alten Laptop aus.
Wenn ich wüsste wie man Win XP neu installiert(Schritt für Schritt Anweisung da Laie,) würde ich das tun..ich würde am liebsten weinen, da ich hier viele daten und dinge drauf habe.

So nun habe ich folgendes gemacht:
1.)Killbox eingesetzt,
2.)Avenger erfolgreich laufen lassen und script eingesetzt.

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\qhblwsbj

*******************

Script file located at: \??\I:\kbphjgyr.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at I:\Avenger

*******************

Beginning to process script file:



File I:\WINDOWS\system32\drivers\hidr.exe not found!
Deletion of file I:\WINDOWS\system32\drivers\hidr.exe failed!

Could not process line:
I:\WINDOWS\system32\drivers\hidr.exe
Status: 0xc0000034



File I:\WINDOWS\system32\drivers\srosa.sys not found!
Deletion of file I:\WINDOWS\system32\drivers\srosa.sys failed!

Could not process line:
I:\WINDOWS\system32\drivers\srosa.sys
Status: 0xc0000034



File I:\WINDOWS\system32\wintems.exe not found!
Deletion of file I:\WINDOWS\system32\wintems.exe failed!

Could not process line:
I:\WINDOWS\system32\wintems.exe
Status: 0xc0000034



File I:\WINDOWS\system32\f3PSSavr.scr not found!
Deletion of file I:\WINDOWS\system32\f3PSSavr.scr failed!

Could not process line:
I:\WINDOWS\system32\f3PSSavr.scr
Status: 0xc0000034



File I:\WINDOWS\system32\ping.com not found!
Deletion of file I:\WINDOWS\system32\ping.com failed!

Could not process line:
I:\WINDOWS\system32\ping.com
Status: 0xc0000034



File I:\WINDOWS\system32\regedit.com not found!
Deletion of file I:\WINDOWS\system32\regedit.com failed!

Could not process line:
I:\WINDOWS\system32\regedit.com
Status: 0xc0000034



File I:\WINDOWS\system32\tasklist.com not found!
Deletion of file I:\WINDOWS\system32\tasklist.com failed!

Could not process line:
I:\WINDOWS\system32\tasklist.com
Status: 0xc0000034



File I:\WINDOWS\system32\taskmgr.com not found!
Deletion of file I:\WINDOWS\system32\taskmgr.com failed!

Could not process line:
I:\WINDOWS\system32\taskmgr.com
Status: 0xc0000034



File I:\WINDOWS\system32\tracert.com not found!
Deletion of file I:\WINDOWS\system32\tracert.com failed!

Could not process line:
I:\WINDOWS\system32\tracert.com
Status: 0xc0000034



Folder I:\WINDOWS\exefnd not found!
Deletion of folder I:\WINDOWS\exefnd failed!

Could not process line:
I:\WINDOWS\exefnd
Status: 0xc0000034



Registry key HKLM\SYSTEM\CurrentControlSet\Services\srosa not found!
Deletion of registry key HKLM\SYSTEM\CurrentControlSet\Services\srosa failed!

Could not process line:
HKLM\SYSTEM\CurrentControlSet\Services\srosa
Status: 0xc0000034



Registry key HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SRO SA not found!
Deletion of registry key HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SRO SA failed!

Could not process line:
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SRO SA
Status: 0xc0000034



Registry key HKLM\SYSTEM\CurrentControlSet\Services\pci32 not found!
Deletion of registry key HKLM\SYSTEM\CurrentControlSet\Services\pci32 failed!

Could not process line:
HKLM\SYSTEM\CurrentControlSet\Services\pci32
Status: 0xc0000034



Registry key HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCI 32 not found!
Deletion of registry key HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCI 32 failed!

Could not process line:
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCI 32
Status: 0xc0000034


Completed script processing.

*******************

Finished! Terminate.

3.)Werde nun versuchen Blacklight zu scanen...