Hallo erstmal neuerdings erhalte ich immer von antivir eine meldung über den Virus W32/Stanit habe schon sehr viele .exe dateien gelöscht aber es tauchen immer wieder welche auf.

Bin auf ein anders Antiviren programm umgestiegen wie man aus dem Log entnehmen kann dort habe ich heute noch keine meldung bekommen.
Und was könnte dieses programm sein C:\WINDOWS\system32\ctfmon.exe ?


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:08:06, on 11.12.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\SMSC\SetIcon.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Programme\Java\jre1.5.0_08\bin\jusched.exe
C:\Programme\Home Cinema\TV Enhance\TVEService.exe
C:\Programme\T-Eumex KommunikationsCenter\strtfx.exe
C:\Programme\T-Eumex KommunikationsCenter\sndml.exe
C:\Programme\T-Online\ISDN SpeedManager\tomcat.exe
C:\Programme\Motorola\SMSERIAL\sm56hlpr.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Programme\Sceneo\Bonavista\Services\ODSBC\ODSBCApp.exe
C:\Programme\BitDefender\BitDefender 2008\bdagent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
C:\Programme\RALINK\Common\RaUI.exe
C:\Programme\OpenOffice.org 2.2\program\soffice.exe
C:\Programme\OpenOffice.org 2.2\program\soffice.BIN
C:\Programme\Gemeinsame Dateien\Marmiko Shared\MZCCntrl.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Programme\Cyberlink\Shared files\RichVideo.exe
C:\Programme\Sceneo\Bonavista\Services\PVR\PVRService.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\Home Cinema\TV Enhance\Kernel\TV\TVECapSvc.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\Programme\Gemeinsame Dateien\BitDefender\BitDefender Communicator\xcommsvr.exe
C:\Programme\Home Cinema\TV Enhance\Kernel\TV\TVESched.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Programme\Gemeinsame Dateien\BitDefender\BitDefender Update Service\livesrv.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Spybot - Search & Destroy\SpybotSD.exe
C:\Programme\Opera\Opera.exe
C:\Dokumente und Einstellungen\Todesengel\Eigene Dateien\Downloads\HiJackThis202.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://users.iptelecom.net.ua/~codecs/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R3 - URLSearchHook: ChrisTV Add-on Toolbar - {1192a62b-4dbc-4d1f-b54e-d820a1be76be} - C:\Programme\ChrisTV_Add-on\tbChri.dll
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: ChrisTV Add-on Toolbar - {1192a62b-4dbc-4d1f-b54e-d820a1be76be} - C:\Programme\ChrisTV_Add-on\tbChri.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.5.0_08\bin\ssv.dll
O3 - Toolbar: ChrisTV Add-on Toolbar - {1192a62b-4dbc-4d1f-b54e-d820a1be76be} - C:\Programme\ChrisTV_Add-on\tbChri.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Programme\BitDefender\BitDefender 2008\IEToolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SetIcon] \Programme\SMSC\SetIcon.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre1.5.0_08\bin\jusched.exe"
O4 - HKLM\..\Run: [TVEService] "C:\Programme\Home Cinema\TV Enhance\TVEService.exe"
O4 - HKLM\..\Run: [strtfx] "C:\Programme\T-Eumex KommunikationsCenter\strtfx.exe"
O4 - HKLM\..\Run: [sndml] "C:\Programme\T-Eumex KommunikationsCenter\sndml.exe"
O4 - HKLM\..\Run: [ISDN SpeedManager] "C:\Programme\T-Online\ISDN SpeedManager\tomcat.exe"
O4 - HKLM\..\Run: [SMSERIAL] C:\Programme\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [TVBroadcast] C:\Programme\Sceneo\Bonavista\Services\ODSBC\ODSBCApp.exe
O4 - HKLM\..\Run: [WinVNC] "C:\Programme\UltraVNC\WinVNC.exe" -servicehelper
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Programme\BitDefender\BitDefender 2008\IEShow.exe"
O4 - HKLM\..\Run: [BDAgent] "C:\Programme\BitDefender\BitDefender 2008\bdagent.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LauncherStart] "C:\Programme\T-Eumex KommunikationsCenter\TrayLaunch.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.2.lnk = C:\Programme\OpenOffice.org 2.2\program\quickstart.exe
O4 - Global Startup: CAPIControl.lnk = ?
O4 - Global Startup: Ralink Wireless Utility.lnk = C:\Programme\RALINK\Common\RaUI.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{4DA4C906-DB3D-4D3D-A15F-15181D7873A0}: NameServer = 192.168.221.1
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender S.R.L. - C:\Programme\Gemeinsame Dateien\BitDefender\BitDefender Update Service\livesrv.exe
O23 - Service: T-Online WLAN Adapter Steuerungsdienst (MZCCntrl) - T-Online International AG, Marmiko IT-Solutions GmbH - C:\Programme\Gemeinsame Dateien\Marmiko Shared\MZCCntrl.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Programme\Cyberlink\Shared files\RichVideo.exe
O23 - Service: Sceneo PVR Service (srvcPVR) - Buhl Data Service GmbH - C:\Programme\Sceneo\Bonavista\Services\PVR\PVRService.exe
O23 - Service: TVEnhance Background Capture Service (TBCS) (TVECapSvc) - Unknown owner - C:\Programme\Home Cinema\TV Enhance\Kernel\TV\TVECapSvc.exe
O23 - Service: TVEnhance Task Scheduler (TTS)) (TVESched) - Unknown owner - C:\Programme\Home Cinema\TV Enhance\Kernel\TV\TVESched.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S.R.L. - C:\Programme\BitDefender\BitDefender 2008\vsserv.exe
O23 - Service: VNC Server (winvnc) - UltraVNC - C:\Programme\UltraVNC\WinVNC.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
O23 - Service: BitDefender Communicator (XCOMM) - Softwin - C:\Programme\Gemeinsame Dateien\BitDefender\BitDefender Communicator\xcommsvr.exe

--
End of file - 7934 bytes


Vielen Dank schon mal im Vorauss

Hi und Herzlich Willkommen im Trojaner-Board

W32/Stanit ist natürlich ein gemeiner Kerl, der soweit ich weiß,
nach und nach die Exe-Dateien infiziert. mal schauen, ob eine
Bereinigung bei dir noch möglich ist. Im Logfile ist jedenfalls nichts zu sehen.

* MWAV (eScan) - Free Antivirus
1. Lies dir folgende Anleitung genau durch und arbeite sie ab
-> Anleitung eScan
(Bei Updateproblemen -> Updateprobleme beheben
(Sollte der Hinweis erscheinen, dass du nur mit der Vollversion
die Funde löschen kannst, breche den Scan NICHT ab)
2. Poste im Anschluss das Ergebnis mit Hilfe der *find.bat'.
- rechte Maustaste auf den LINK 'find.bat' , dann "Ziel Speichern unter" -> Desktop)
- führe die find.bat aus
- das erstellte Log kopierst du ab und postest in deinen nächsten Beitrag
3. Entferne bitte nicht selber von escan alarmierte Funde.
Es sind erfahrungsgemäß viele Fehlalarme dabei

* Silentrunners Logfile
1. Lade dir das Tool -> Silentrunners
2. Entpacke das Script in einen Ordner deiner Wahl
3. Doppelklick auf -> Silent Runners -> Option Supplementary Searches auswählen
4. System wird nun überprüft, nach Beendigung wird eine Log-Datei erstellt
(Dein Antiviren-Scanner könnte eine Meldung wegen „bösartigem Script“
erstellen, ignoriere dieses und arbeite weiter!)
5. Dann öffne die Silent Runners xxx.txt mit einem Editor
und kopiere den gesamten Inhalt ab und füge ihn in einen Beitrag ein.
(die Datei wird im selben Ordner wie das Tool gespeichert)
Falls das Script eine Fehlermeldung ausgibt:
- starte regedit.exe über Start => Ausführen (oder Windowstaste+R)
- navigiere zu HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings
- stell sicher, dass dort die Zeichenfolge "Enabled" ist und den Wert 1 hat

* Filelist
1. Lade das filelist.zip auf deinen Desktop herunter.
2. Entpacke die Zip-Datei auf deinen Desktop (mit WINZIP), öffne die nun auf deinem Destop vorhandene filelist.bat mit einem Doppelklick auf die Datei
3. Dein Editor (Textverarbeitungsprogramm) wird sich öffnen
4. Markiere von diesem Inhalt aus jedem Verzeichnis jeweils die
letzten 30 Tage, wähle kopieren, füge diese Dateien in deinem
nächsten Beitrag ein.


Dies sind die Verzeichnisse von denen wir jeweils die letzten 30 Tage sehen wollen:
Verzeichnis von C:\
Verzeichnis von C:\WINDOWS\system32
Verzeichnis von C:\WINDOWS
Verzeichnis von C:\WINDOWS\Prefetch (Windows XP)
Verzeichnis von C:\WINDOWS\tasks
Verzeichnis von C:\WINDOWS\Temp
Verzeichnis von C:\DOCUME~1\Name\LOCALS~1\Temp

mfg Cleriker

--------------------------------------------------------------------------
Filelist
--------------------------------------------------------------------------



Verzeichnis von C:\

12.12.2007 18:18 43 filelist.txt
12.12.2007 14:15 2.145.386.496 pagefile.sys
11.12.2007 15:28 211 boot.ini




Verzeichnis von C:\WINDOWS

12.12.2007 17:34 116.182 WindowsUpdate.log
12.12.2007 14:20 5.167 KB941568.log
12.12.2007 14:20 15.389 KB942615.log
12.12.2007 14:19 4.959 KB944653.log
12.12.2007 14:19 5.604 KB942840.log
12.12.2007 14:19 5.354 KB942763.log
12.12.2007 14:15 0 0.log
12.12.2007 14:15 159 wiadebug.log
12.12.2007 14:15 50 wiaservc.log
12.12.2007 14:15 2.048 bootstat.dat
11.12.2007 22:32 1.100 SchedLgU.Txt
11.12.2007 17:34 121 bdagent.INI
11.12.2007 15:29 0 Sti_Trace.log
11.12.2007 15:28 227 system.ini
11.12.2007 15:28 507 win.ini
03.12.2007 17:32 69 NeroDigital.ini
03.12.2007 16:56 1.409 QTFont.for
03.12.2007 16:56 54.156 QTFont.qfn
01.12.2007 15:45 0 iplayer.INI
10.11.2007 00:16 311 game.ini



Verzeichnis von C:\WINDOWS\system32

11.12.2007 20:06 2.422 wpa.dbl
11.12.2007 17:31 81.984 bdod.bin
11.12.2007 12:19 119.744 FNTCACHE.DAT
25.11.2007 20:41 56 '
10.11.2007 00:27 138.876 nvapps.xml



Verzeichnis von C:\WINDOWS\Prefetch

12.12.2007 18:18 11.520 FIND.EXE-0EC32F1E.pf
12.12.2007 18:18 11.438 CMD.EXE-087B4001.pf
12.12.2007 18:17 37.776 WINRAR.EXE-3588DFE8.pf
12.12.2007 18:17 16.822 VERCLSID.EXE-3667BD89.pf
12.12.2007 18:17 34.206 WSCRIPT.EXE-32960AB9.pf
12.12.2007 18:14 92.188 WMIPRVSE.EXE-28F301A9.pf
12.12.2007 18:13 21.948 WORDPAD.EXE-1EFCC5C1.pf
12.12.2007 18:09 99.408 FIREFOX.EXE-0689EBE0.pf
12.12.2007 17:34 30.668 WUAUCLT.EXE-399A8E72.pf
12.12.2007 17:31 68.570 HELPSVC.EXE-2878DDA2.pf
12.12.2007 17:31 631.864 Layout.ini
12.12.2007 14:40 62.960 ACRORD32.EXE-153330F0.pf
12.12.2007 14:16 69.798 OPERA.EXE-24550E7A.pf
12.12.2007 14:16 32.396 WSCNTFY.EXE-1B24F5EB.pf
12.12.2007 14:16 28.818 ALG.EXE-0F138680.pf
12.12.2007 14:16 50.574 TVESCHED.EXE-0350D22A.pf
12.12.2007 14:16 28.838 IMAPI.EXE-0BF740A4.pf
12.12.2007 14:16 1.458.718 NTOSBOOT-B00DFAAD.pf
12.12.2007 14:16 20.118 RUNDLL32.EXE-35A483DA.pf
11.12.2007 22:32 17.312 LOGONUI.EXE-0AF22957.pf
11.12.2007 22:27 15.398 NOTEPAD.EXE-336351A9.pf
11.12.2007 20:44 96.486 CHECKT.EXE-00A933D2.pf
11.12.2007 20:08 24.732 REGSVR32.EXE-25EEFE2F.pf
11.12.2007 20:04 17.322 RUNONCE.EXE-2803F297.pf
11.12.2007 17:37 80.398 LOTROCLIENT.EXE-185868D7.pf
11.12.2007 17:35 27.052 CSC.EXE-1113BFA6.pf
11.12.2007 17:35 6.180 CVTRES.EXE-13DEB540.pf
11.12.2007 17:35 70.822 TURBINELAUNCHER.EXE-3A1FF145.pf
11.12.2007 17:34 95.808 SECCENTER.EXE-0E6D4A9E.pf
11.12.2007 17:34 120.384 MSIEXEC.EXE-2F8A8CAE.pf
11.12.2007 15:50 19.046 TASKMGR.EXE-20256C55.pf
10.12.2007 19:54 43.282 SCRIPT-FU.EXE-0D77E8FB.pf
10.12.2007 19:54 79.406 GIMP-2.4.EXE-0E3D66AF.pf
09.12.2007 17:46 12.892 RUNDLL32.EXE-451FC2C0.pf
09.12.2007 11:21 20.216 RUNDLL32.EXE-2A94BB85.pf
08.12.2007 22:30 55.168 NMIndexStoreSvr.exe-249DD3AC.pf
08.12.2007 22:30 55.222 NMINDEXINGSERVICE.EXE-1C758E9B.pf
08.12.2007 22:05 12.192 RUNDLL32.EXE-268BFF96.pf
08.12.2007 18:53 85.756 VLC.EXE-29851A71.pf



Verzeichnis von C:\WINDOWS\tasks

12.12.2007 14:15 6 SA.DAT



Verzeichnis von C:\WINDOWS\Temp

12.12.2007 14:15 0 JETAA0B.tmp
11.12.2007 17:34 15 report.dat
11.12.2007 17:32 164 kds.xml
11.12.2007 17:24 1.448 v_live_s.xml
11.12.2007 16:24 635 updateop.xml
07.12.2007 20:55 126 D653F3EC.TMP



Verzeichnis von C:\DOKUME~1\TODESE~1\LOKALE~1\Temp

12.12.2007 14:20 23.311 jusched.log
05.12.2007 02:03 963 D653F3EC.TMP
05.10.2007 21:59 25.753 German.bin


PS: Bei den Fehlenden sachen waren nur einträge von 2006 da.
Und bekomme In der Datei 'C:\Programme\ChrisTV_Add-on\tbChr1.dll'
wurde ein Virus oder unerwünschtes Programm 'ADSPY/Toolbar.LiveT' [ADSPY/Toolbar.LiveT] gefunden angezeigt.
--------------------------------------------------------------------------

--------------------------------------------------------------------------
Silentrunners
--------------------------------------------------------------------------

"Silent Runners.vbs", revision 55, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS]
"LauncherStart" = ""C:\Programme\T-Eumex KommunikationsCenter\TrayLaunch.exe"" ["Winfinity"]
"SpybotSD TeaTimer" = "C:\Programme\Spybot - Search & Destroy\TeaTimer.exe" ["Safer Networking Limited"]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS]
"nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]
"SetIcon" = "\Programme\SMSC\SetIcon.exe" ["Standard Microsystems Corp."]
"RTHDCPL" = "RTHDCPL.EXE" ["Realtek Semiconductor Corp."]
"SkyTel" = "SkyTel.EXE" ["Realtek Semiconductor Corp."]
"Alcmtr" = "ALCMTR.EXE" ["Realtek Semiconductor Corp."]
"Adobe Reader Speed Launcher" = ""C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe"" ["Adobe Systems Incorporated"]
"SunJavaUpdateSched" = ""C:\Programme\Java\jre1.5.0_08\bin\jusched.exe"" ["Sun Microsystems, Inc."]
"TVEService" = ""C:\Programme\Home Cinema\TV Enhance\TVEService.exe"" ["CyberLink Corp."]
"strtfx" = ""C:\Programme\T-Eumex KommunikationsCenter\strtfx.exe"" [empty string]
"sndml" = ""C:\Programme\T-Eumex KommunikationsCenter\sndml.exe"" [empty string]
"ISDN SpeedManager" = ""C:\Programme\T-Online\ISDN SpeedManager\tomcat.exe"" ["T-Systems International GmbH"]
"SMSERIAL" = "C:\Programme\Motorola\SMSERIAL\sm56hlpr.exe" ["Motorola Inc."]
"NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS]
"TVBroadcast" = "C:\Programme\Sceneo\Bonavista\Services\ODSBC\ODSBCApp.exe" ["ODSoft multimedia"]
"WinVNC" = ""C:\Programme\UltraVNC\WinVNC.exe" -servicehelper" ["UltraVNC"]
"avgnt" = ""C:\Programme\Avira\Avira Premium Security Suite\avgnt.exe" /min" ["Avira GmbH"]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Adobe PDF Reader"
\InProcServer32\(Default) = "C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]
{1192a62b-4dbc-4d1f-b54e-d820a1be76be}\(Default) = (no title provided)
-> {HKLM...CLSID} = "ChrisTV Add-on Toolbar"
\InProcServer32\(Default) = "C:\Programme\ChrisTV_Add-on\tbChri.dll" ["Conduit Ltd."]
{53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Spybot-S&D IE Protection"
\InProcServer32\(Default) = "C:\PROGRA~1\SPYBOT~1\SDHelper.dll" ["Safer Networking Limited"]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)
-> {HKLM...CLSID} = "SSVHelper Class"
\InProcServer32\(Default) = "C:\Programme\Java\jre1.5.0_08\bin\ssv.dll" ["Sun Microsystems, Inc."]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "CPL-Erweiterung für Anzeigeverschiebung"
-> {HKLM...CLSID} = "CPL-Erweiterung für Anzeigeverschiebung"
\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Erweiterung für HyperTerminal-Icons"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]
"{3028902F-6374-48b2-8DC6-9725E775B926}" = "IE Microsoft AutoComplete"
-> {HKLM...CLSID} = "IE Microsoft AutoComplete"
\InProcServer32\(Default) = "C:\WINDOWS\system32\browseui.dll" [MS]
"{EFA24E62-B078-11d0-89E4-00C04FC9E26E}" = "History Band"
-> {HKLM...CLSID} = "History Band"
\InProcServer32\(Default) = "C:\WINDOWS\system32\shdocvw.dll" [MS]
"{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"
-> {HKLM...CLSID} = "DesktopContext Class"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"
-> {HKLM...CLSID} = "Desktop Explorer"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"
-> {HKLM...CLSID} = "nView Desktop Context Menu"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{23170F69-40C1-278A-1000-000100020000}" = "7-Zip Shell Extension"
-> {HKLM...CLSID} = "7-Zip Shell Extension"
\InProcServer32\(Default) = "C:\Programme\7-Zip\7-zip.dll" ["Igor Pavlov"]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data]
"{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" = "OpenOffice.org Column Handler"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = ""C:\Programme\OpenOffice.org 2.2\program\shlxthdl.dll"" ["Sun Microsystems, Inc."]
"{087B3AE3-E237-4467-B8DB-5A38AB959AC9}" = "OpenOffice.org Infotip Handler"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = ""C:\Programme\OpenOffice.org 2.2\program\shlxthdl.dll"" ["Sun Microsystems, Inc."]
"{63542C48-9552-494A-84F7-73AA6A7C99C1}" = "OpenOffice.org Property Sheet Handler"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = ""C:\Programme\OpenOffice.org 2.2\program\shlxthdl.dll"" ["Sun Microsystems, Inc."]
"{3B092F0C-7696-40E3-A80F-68D74DA84210}" = "OpenOffice.org Thumbnail Viewer"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = ""C:\Programme\OpenOffice.org 2.2\program\shlxthdl.dll"" ["Sun Microsystems, Inc."]
"{45AC2688-0253-4ED8-97DE-B5370FA7D48A}" = "Shell Extension for Malware scanning"
-> {HKLM...CLSID} = "Shell Extension for Malware scanning"
\InProcServer32\(Default) = "C:\Programme\Avira\Avira Premium Security Suite\shlext.dll" ["Avira GmbH"]
"{e57ce731-33e8-4c51-8354-bb4de9d215d1}" = "Universelle Plug & Play-Geräte"
-> {HKLM...CLSID} = "Universelle Plug & Play-Geräte"
\InProcServer32\(Default) = "C:\WINDOWS\system32\upnpui.dll" [MS]
"{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper"
-> {HKLM...CLSID} = "NVIDIA CPL Extension"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{73B24247-042E-4EF5-ADC2-42F62E6FD654}" = "ICQ Lite Shell Extension"
-> {HKLM...CLSID} = "MCLiteShellExt Class"
\InProcServer32\(Default) = "C:\Programme\ICQLite\ICQLiteShell.dll" [empty string]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\
"WPDShServiceObj" = "{AAA288BA-9A4C-45B0-95D7-94D524869DB5}"
-> {HKLM...CLSID} = "WPDShServiceObj Class"
\InProcServer32\(Default) = "C:\WINDOWS\system32\WPDShServiceObj.dll" [MS]

HKLM\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}\(Default) = "OpenOffice.org Column Handler"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = ""C:\Programme\OpenOffice.org 2.2\program\shlxthdl.dll"" ["Sun Microsystems, Inc."]
{F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info"
-> {HKLM...CLSID} = "PDF Shell Extension"
\InProcServer32\(Default) = "C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."]

HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\
7-Zip\(Default) = "{23170F69-40C1-278A-1000-000100020000}"
-> {HKLM...CLSID} = "7-Zip Shell Extension"
\InProcServer32\(Default) = "C:\Programme\7-Zip\7-zip.dll" ["Igor Pavlov"]
DaemonShellExtImage\(Default) = "{40966797-8FFE-46C8-9EF8-7003F33CCF0F}"
-> {HKLM...CLSID} = "DaemonShellExtImage Class"
\InProcServer32\(Default) = "C:\Programme\DAEMON Tools Pro\imgshl32.dll" ["DT Soft Ltd."]
ICQLiteMenu\(Default) = "{73B24247-042E-4EF5-ADC2-42F62E6FD654}"
-> {HKLM...CLSID} = "MCLiteShellExt Class"
\InProcServer32\(Default) = "C:\Programme\ICQLite\ICQLiteShell.dll" [empty string]
Shell Extension for Malware scanning\(Default) = "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}"
-> {HKLM...CLSID} = "Shell Extension for Malware scanning"
\InProcServer32\(Default) = "C:\Programme\Avira\Avira Premium Security Suite\shlext.dll" ["Avira GmbH"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data]

HKLM\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\
7-Zip\(Default) = "{23170F69-40C1-278A-1000-000100020000}"
-> {HKLM...CLSID} = "7-Zip Shell Extension"
\InProcServer32\(Default) = "C:\Programme\7-Zip\7-zip.dll" ["Igor Pavlov"]
ICQLiteMenu\(Default) = "{73B24247-042E-4EF5-ADC2-42F62E6FD654}"
-> {HKLM...CLSID} = "MCLiteShellExt Class"
\InProcServer32\(Default) = "C:\Programme\ICQLite\ICQLiteShell.dll" [empty string]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data]

HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\
Shell Extension for Malware scanning\(Default) = "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}"
-> {HKLM...CLSID} = "Shell Extension for Malware scanning"
\InProcServer32\(Default) = "C:\Programme\Avira\Avira Premium Security Suite\shlext.dll" ["Avira GmbH"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data]


Group Policies {policy setting}:
--------------------------------

Note: detected settings may not have any effect.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\

"shutdownwithoutlogon" = (REG_DWORD) dword:0x00000001
{Shutdown: Allow system to be shut down without having to log on}

"undockwithoutlogon" = (REG_DWORD) dword:0x00000001
{Devices: Allow undock without having to log on}


Active Desktop and Wallpaper:
-----------------------------

Active Desktop may be disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

Displayed if Active Desktop enabled and wallpaper not set by Group Policy:
HKCU\Software\Microsoft\Internet Explorer\Desktop\General\
"Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp"

Displayed if Active Desktop disabled and wallpaper not set by Group Policy:
HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Dokumente und Einstellungen\Todesengel\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp"


Enabled Screen Saver:
---------------------

HKCU\Control Panel\Desktop\
"SCRNSAVE.EXE" = "C:\WINDOWS\system32\logon.scr" [MS]


Startup items in "Todesengel" & "All Users" startup folders:
------------------------------------------------------------

C:\Dokumente und Einstellungen\Todesengel\Startmenü\Programme\Autostart
"OpenOffice.org 2.2" -> shortcut to: "C:\Programme\OpenOffice.org 2.2\program\quickstart.exe" [null data]

C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart
"CAPIControl" -> shortcut to: "C:\Programme\Telekom\Eumex 200\Capictrl.exe" ["DeTeWe AG & Co."]
"Ralink Wireless Utility" -> shortcut to: "C:\Programme\RALINK\Common\RaUI.exe" ["Ralink Technology, Corp."]


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
avsda.dll ["Avira GmbH"], 01 - 02, 26
%SystemRoot%\system32\mswsock.dll [MS], 03 - 05, 08 - 25
%SystemRoot%\system32\rsvpsp.dll [MS], 06 - 07


Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
"{1192A62B-4DBC-4D1F-B54E-D820A1BE76BE}"
-> {HKLM...CLSID} = "ChrisTV Add-on Toolbar"
\InProcServer32\(Default) = "C:\Programme\ChrisTV_Add-on\tbChri.dll" ["Conduit Ltd."]

HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\
"{1192A62B-4DBC-4D1F-B54E-D820A1BE76BE}" = "ChrisTV Add-on Toolbar"
-> {HKLM...CLSID} = "ChrisTV Add-on Toolbar"
\InProcServer32\(Default) = "C:\Programme\ChrisTV_Add-on\tbChri.dll" ["Conduit Ltd."]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Konsole"
"CLSIDExtension" = "{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBC}"
-> {HKCU...CLSID} = "Java Plug-in 1.5.0_08"
\InProcServer32\(Default) = "C:\Programme\Java\jre1.5.0_08\bin\ssv.dll" ["Sun Microsystems, Inc."]
-> {HKLM...CLSID} = "Java Plug-in 1.5.0_08"
\InProcServer32\(Default) = "C:\Programme\Java\jre1.5.0_08\bin\npjpi150_08.dll" ["Sun Microsystems, Inc."]

{B863453A-26C3-4E1F-A54D-A2CD196348E9}\
"ButtonText" = "ICQ Lite"
"MenuText" = "ICQ Lite"
"Exec" = "C:\Programme\ICQLite\ICQLite.exe" ["ICQ Ltd."]

{DFB852A3-47F8-48C4-A200-58CAB36FD2A2}\
"MenuText" = "Spybot - Search & Destroy Configuration"
"CLSIDExtension" = "{53707962-6F74-2D53-2644-206D7942484F}"
-> {HKLM...CLSID} = "Spybot-S&D IE Protection"
\InProcServer32\(Default) = "C:\PROGRA~1\SPYBOT~1\SDHelper.dll" ["Safer Networking Limited"]

{FB5F1910-F110-11D2-BB9E-00C04F795683}\
"ButtonText" = "Messenger"
"MenuText" = "Windows Messenger"
"Exec" = "C:\Programme\Messenger\msmsgs.exe" [MS]


Miscellaneous IE Hijack Points
------------------------------

HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\
<<H>> "{1192a62b-4dbc-4d1f-b54e-d820a1be76be}" = (no title provided)
-> {HKLM...CLSID} = "ChrisTV Add-on Toolbar"
\InProcServer32\(Default) = "C:\Programme\ChrisTV_Add-on\tbChri.dll" ["Conduit Ltd."]


Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

Avira Premium Security Suite Firewall, AntiVirFirewallService, ""C:\Programme\Avira\Avira Premium Security Suite\avfwsvc.exe"" ["Avira GmbH"]
Avira Premium Security Suite Guard, AntiVirService, ""C:\Programme\Avira\Avira Premium Security Suite\avguard.exe"" ["Avira GmbH"]
Avira Premium Security Suite MailGuard, AntiVirMailService, ""C:\Programme\Avira\Avira Premium Security Suite\avmailc.exe"" ["Avira GmbH"]
Avira Premium Security Suite MailGuard Hilfsdienst, AVEService, ""C:\Programme\Avira\Avira Premium Security Suite\avesvc.exe"" ["Avira GmbH"]
Avira Premium Security Suite Planer, AntiVirScheduler, ""C:\Programme\Avira\Avira Premium Security Suite\sched.exe"" ["Avira GmbH"]
Avira Premium Security Suite WebGuard, antivirwebservice, ""C:\Programme\Avira\Avira Premium Security Suite\AVWEBGRD.EXE"" ["Avira GmbH"]
Cyberlink RichVideo Service(CRVS), RichVideo, ""C:\Programme\Cyberlink\Shared files\RichVideo.exe"" [empty string]
NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"]
Sceneo PVR Service, srvcPVR, "C:\Programme\Sceneo\Bonavista\Services\PVR\PVRService.exe" ["Buhl Data Service GmbH"]
T-Online WLAN Adapter Steuerungsdienst, MZCCntrl, "C:\Programme\Gemeinsame Dateien\Marmiko Shared\MZCCntrl.exe" ["T-Online International AG, Marmiko IT-Solutions GmbH"]
TVEnhance Background Capture Service (TBCS), TVECapSvc, ""C:\Programme\Home Cinema\TV Enhance\Kernel\TV\TVECapSvc.exe"" [empty string]
TVEnhance Task Scheduler (TTS)), TVESched, ""C:\Programme\Home Cinema\TV Enhance\Kernel\TV\TVESched.exe"" [empty string]
X10 Device Network Service, x10nets, "C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe" ["X10"]


Print Monitors:
---------------

HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors\
EPSON V5 2KMonitor\Driver = "EBPMON2.DLL" ["SEIKO EPSON CORPORATION"]
Eumex Fax Monitor\Driver = "wsfaxmon.dll" [null data]


---------- (launch time: 2007-12-12 18:17:12)
<<H>>: Suspicious data at a browser hijack point.

+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ To search all directories of local fixed drives for DESKTOP.INI
DLL launch points, use the -supp parameter or answer "No" at the
first message box and "Yes" at the second message box.
---------- (total run time: 19 seconds, including 2 seconds for message boxes)

--------------------------------------------------------------------------

Thread kann gelöscht werden amche den Pc jetzt einfach platt.