Hallo an alle Helfer,

heute hat es mich nun auch erwischt und das gleich 5x.

System: Windows XP
Virenprogramm: McAfee
Auszug Bericht siehe hier:

4.02.2008 11:37:15 No Action Taken c:\System Volume Information\_restore{9212D040-2885-4EA1-BA22-AE8D4E36355F}\RP559\A0080813.dll Vundo(Trojan)
04.02.2008 11:53:20 No Action Taken c:\WINDOWS\system32\hrsrpgcr.dll Vundo(Trojan)
04.02.2008 11:53:24 No Action Taken c:\WINDOWS\system32\ieidleos.dll Vundo(Trojan)
04.02.2008 11:55:37 No Action Taken c:\WINDOWS\system32\wvutspn.dll Downloader-ASN(Trojan)
04.02.2008 12:15:28 No Action Taken d:\Eigene Dateien\install\ACDSee\patch.exe BackDoor-CVT.dr(Trojan)

logfile HJT hier.....

ogfile of HijackThis v1.99.1
Scan saved at 14:10:03, on 07.02.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Intel\Wireless\Bin\EvtEng.exe
C:\Programme\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Network Associates\Common Framework\FrameworkService.exe
C:\Programme\Network Associates\VirusScan\Mcshield.exe
C:\Programme\Network Associates\VirusScan\VsTskMgr.exe
C:\Programme\Intel\Wireless\Bin\RegSrvc.exe
C:\Programme\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Programme\Analog Devices\SoundMAX\Smax4.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Programme\Synaptics\SynTP\SynTPLpr.exe
C:\Programme\Synaptics\SynTP\SynTPEnh.exe
C:\Programme\HPQ\Quick Launch Buttons\EabServr.exe
C:\Programme\Java\jre1.6.0_03\bin\jusched.exe
C:\Programme\Network Associates\VirusScan\SHSTAT.EXE
C:\Programme\Network Associates\Common Framework\UpdaterUI.exe
C:\Programme\Gemeinsame Dateien\Network Associates\TalkBack\TBMon.exe
C:\Programme\Intel\Wireless\Bin\ifrmewrk.exe
D:\PROGRA~1\DESKTO~1\DesktopTool.exe
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
C:\Programme\QuickTime\qttask.exe
D:\Programme\HP Share-to-Web\hpgs2wnd.exe
C:\Programme\Philips\SA33XX\Philips Device Manager\Bin\SA33XXDeviceManager.exe
D:\Programme\SPYWAREfighter\spftray.exe
C:\WINDOWS\system32\rundll32.exe
D:\Programme\HP Share-to-Web\hpgs2wnf.exe
C:\Programme\Skype\Phone\Skype.exe
D:\Programme\SPYWAREfighter\spfprc.exe
C:\Programme\Google\Google Updater\GoogleUpdater.exe
D:\Programme\OWPro2\tDictPro.exe
D:\Programme\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
D:\Programme\Webshots\WebshotsTray.exe
C:\Programme\Skype\Plugin Manager\skypePM.exe
C:\Programme\lotus\notes\NLNOTES.EXE
C:\Programme\lotus\notes\ntaskldr.EXE
C:\Programme\Mozilla Firefox\firefox.exe
C:\Programme\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
D:\Eigene Dateien\install\Software\HighJackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://www.teltarif.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h**p://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 149.204.132.10:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = eumex.ip;aww.*;aww2.*;149.*.*.*;*nsd.alcatel.de;x500.*;*nsd-alcatel.de;circee.*;<local>
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: {f4400bb1-44cd-b8db-59e4-52681e004815} - {518400e1-8625-4e95-bd8b-dc441bb0044f} - C:\WINDOWS\system32\colpmsmh.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: WebSpeechBHO Class - {83A30C59-3A50-49E6-9DAF-4923C4EA3C23} - C:\Programme\Gemeinsame Dateien\WebSpeech.4.0\LgxIEBar.dll
O2 - BHO: (no name) - {A95B2816-1D7E-4561-A202-68C0DE02353A} - C:\WINDOWS\system32\ppdgjsau.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O2 - BHO: (no name) - {D687439C-A33B-473B-9351-448DB4AC9810} - C:\WINDOWS\system32\spxcoios.dll
O2 - BHO: (no name) - {F14B4071-3585-470C-AF50-1B21C4AB298C} - C:\WINDOWS\system32\mlljj.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar3.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Programme\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Programme\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Programme\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Cpqset] C:\Programme\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Programme\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [UpdateManager] "C:\Programme\Gemeinsame Dateien\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [WatchDog] C:\Programme\InterVideo\DVD Check\DVDCheck.exe
O4 - HKLM\..\Run: [ShStatEXE] "C:\Programme\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Programme\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Programme\Gemeinsame Dateien\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [IntelZeroConfig] C:\Programme\Intel\Wireless\bin\ZCfgSvc.exe
O4 - HKLM\..\Run: [IntelWireless] C:\Programme\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [Desktop Tool 3] "D:\PROGRA~1\DESKTO~1\DesktopTool.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] D:\Programme\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [PhilipsSA33XXDM] C:\Programme\Philips\SA33XX\Philips Device Manager\Bin\SA33XXDeviceManager.exe OS_STARTUP
O4 - HKLM\..\Run: [spywarefighterguard] D:\Programme\SPYWAREfighter\spftray.exe
O4 - HKLM\..\Run: [48282ac9] rundll32.exe "C:\WINDOWS\system32\rrawtxhh.dll",b
O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Programme\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [H/PC Connection Agent] "D:\programme\wcescomm.exe"
O4 - Startup: office wörterbuch pro 2.lnk = D:\Programme\OWPro2\tDictPro.exe
O4 - Startup: Picture Motion Browser Medien-Prüfung.lnk = D:\Programme\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O4 - Startup: Webshots.lnk = D:\Programme\Webshots\WebshotsTray.exe
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: DVD Check.lnk = C:\Programme\InterVideo\DVD Check\DVDCheck.exe
O4 - Global Startup: Google Updater.lnk = C:\Programme\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: Image Fox Trial Version.lnk = ?
O4 - Global Startup: Instant Update.lnk = D:\Programme\InstUpDt.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: WebSpeech - {1CE4DE72-7FCC-4eb8-8F66-AE6A56A0A54D} - C:\Programme\Gemeinsame Dateien\WebSpeech.4.0\LgxIEBar.dll
O9 - Extra 'Tools' menuitem: Seite/Markierung vorlesen (WebSpeech) - {1CE4DE72-7FCC-4eb8-8F66-AE6A56A0A54D} - C:\Programme\Gemeinsame Dateien\WebSpeech.4.0\LgxIEBar.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {AE2B937E-EA7D-4A8D-888C-B68D7F72A3C4} (IPSUploader4 Control) - h**p://as.photoprintit.de/ips-opdata/layout/default01/activex/IPSUploader4.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - h**p://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IPSUploader Control) - h**p://as.photoprintit.de/ips-opdata/layout/default01/activex/IPSUploader.cab
O16 - DPF: {E55FD215-A32E-43FE-A777-A7E8F165F551} (Flatcast Viewer 4.15) - h**p://www.flatcast.info/objects/NpFv415.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: IntelWireless - C:\Programme\Intel\Wireless\Bin\LgNotify.dll
O20 - Winlogon Notify: ppdgjsau - C:\WINDOWS\SYSTEM32\ppdgjsau.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: EvtEng - Intel Corporation - C:\Programme\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Hotspot Manager (HotSpotFSvc) - Unknown owner - C:\Programme\Gemeinsame Dateien\T-COM\HotspotMgr\HotSpotFSvc.exe (file missing)
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Programme\HPQ\Shared\hpqwmi.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Programme\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Programme\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Programme\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Programme\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Programme\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programme\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: SPYWAREfighterRP - SpamFighter APS - D:\Programme\SPYWAREfighter\spfprc.exe

für Hilfe wäre ich dankbar auch wenn es nicht selbstverständlich ist.

Grüsse an alle anderen Trojanerbestückten und die Helfer dieses Forums
faserbruch65

Hi,

bitte Combofix und danach ein neues HJ-Log sowie ein Silentrunner-Log:

ComboFix:
Lade es von http://download.bleepingcomputer.com/sUBs/ComboFix.exe und speichert es auf den Desktop.
Alle Fenster schliessen und combofix.exe starten und bestätige die folgende Abfrage mit 1 und drücke Enter.

Der Scan mit Combofix kann einige Zeit in Anspruch nehmen, also habe etwas Geduld. Während des Scans bitte nichts am Rechner unternehmen
Es kann möglich sein, dass der Rechner zwischendurch neu gestartet wird.
Nach Scanende wird ein Report angezeigt, den bitte kopieren und in deinem Thread einfuegen.

SilentRunner:
Ziparchive in ein Verzeichnis auspacken, mit Doppelklick starten, "ja" auswählen.
Die erstellte Datei findet sich im gleichen Verzeichnis wo das Script hinkopiert wurde, bitte in Editor laden und posten.
http://www.silentrunners.org/Silent%20Runners.zip

Den Rest fixen wir dann per Hand...

Chris

Hallo Chris4You,

hier die benötigten neuen logfiles........

ComboFix 08-02.05.3 - ******* 2008-02-08 17:50:43.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1031.18.545 [GMT 1:00]
ausgeführt von:: C:\Dokumente und Einstellungen\*******\Desktop\ComboFix.exe
* Neuer Wiederherstellungspunkt wurde erstellt

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

(((((((((((((((((((((((((((((((((((( Weitere L”schungen ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\colpmsmh.dll
C:\WINDOWS\system32\drivers\UIUSetup.exe
C:\WINDOWS\system32\ekffyxsc.ini
C:\WINDOWS\system32\hhxtwarr.ini
C:\WINDOWS\system32\htuirypq.ini
C:\WINDOWS\system32\jekvgfdp.dll
C:\WINDOWS\system32\jjllm.ini
C:\WINDOWS\system32\jjllm.ini2
C:\WINDOWS\system32\jypdnibr.ini
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\ppdgjsau.dllbox
C:\WINDOWS\system32\rrawtxhh.dll
C:\WINDOWS\system32\rrhuvncv.ini
C:\WINDOWS\system32\smnsmbyb.ini
C:\WINDOWS\system32\soeldiei.ini
C:\WINDOWS\system32\usomghss.dll
D:\Autorun.inf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_NNSERV


((((((((((((((((((((((( Dateien erstellt von 2008-01-08 bis 2008-02-08 ))))))))))))))))))))))))))))))
.

2008-02-06 09:25 . 2008-02-06 09:25 90,688 --a------ C:\WINDOWS\system32\qpyriuth.dll
2008-02-05 15:12 . 2008-02-06 12:37 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AntiSpyInfo
2008-02-05 13:35 . 2008-02-05 13:35 <DIR> d-------- C:\Programme\Gemeinsame Dateien\Application
2008-02-05 13:35 . 2008-02-05 13:35 <DIR> d-a------ C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP
2008-01-31 18:09 . 2008-01-31 18:09 <DIR> d-------- C:\Programme\Avanquest update
2008-01-31 18:06 . 2008-01-31 18:09 <DIR> d-------- C:\Programme\Motorola Phone Tools
2008-01-31 18:06 . 2008-01-31 18:13 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\BVRP Software
2008-01-31 11:08 . 2008-01-31 11:08 0 --a------ C:\WINDOWS\pestpatrol5.INI
2008-01-30 09:43 . 2008-01-30 09:43 163,904 --a------ C:\WINDOWS\system32\ppdgjsau.dll
2008-01-28 12:19 . 2008-02-04 13:53 109 --a------ C:\WINDOWS\notesnsd.ini
2008-01-26 20:00 . 2008-02-01 17:22 <DIR> d-------- C:\Dokumente und Einstellungen\kremser\Anwendungsdaten\DVD Profiler
2008-01-23 12:51 . 2008-01-28 13:13 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-01-23 12:51 . 2008-01-23 12:51 1,409 --a------ C:\WINDOWS\QTFont.for

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-08 16:58 --------- d-----w C:\Dokumente und Einstellungen\*******\Anwendungsdaten\Skype
2008-02-08 16:26 --------- d-----w C:\Dokumente und Einstellungen\*******\Anwendungsdaten\skypePM
2008-02-08 11:08 --------- d-----w C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Google Updater
2008-02-07 07:50 --------- d-----w C:\Dokumente und Einstellungen\*******\Anwendungsdaten\ACD Systems
2008-02-07 07:50 --------- d-----w C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ACD Systems
2008-02-07 07:45 --------- d-----w C:\Programme\Gemeinsame Dateien\ACD Systems
2008-01-31 17:09 --------- d--h--w C:\Programme\InstallShield Installation Information
2008-01-31 17:07 92,064 ----a-w C:\Dokumente und Einstellungen\*******\mqdmmdm.sys
2008-01-31 17:07 9,232 ----a-w C:\Dokumente und Einstellungen\*******\mqdmmdfl.sys
2008-01-31 17:07 79,328 ----a-w C:\Dokumente und Einstellungen\*******\mqdmserd.sys
2008-01-31 17:07 66,656 ----a-w C:\Dokumente und Einstellungen\*******\mqdmbus.sys
2008-01-31 17:07 6,208 ----a-w C:\Dokumente und Einstellungen\*******\mqdmcmnt.sys
2008-01-31 17:07 5,936 ----a-w C:\Dokumente und Einstellungen\*******\mqdmwhnt.sys
2008-01-31 17:07 4,048 ----a-w C:\Dokumente und Einstellungen\*******\mqdmcr.sys
2008-01-31 17:06 25,600 ----a-w C:\WINDOWS\system32\drivers\usbsermptxp.sys
2008-01-31 17:06 25,600 ----a-w C:\Dokumente und Einstellungen\*******\usbsermptxp.sys
2008-01-31 17:06 22,768 ----a-w C:\Dokumente und Einstellungen\*******\usbsermpt.sys
2008-01-07 19:50 --------- d-----w C:\Dokumente und Einstellungen\*******\Anwendungsdaten\ArcSoft
2008-01-07 19:45 --------- d-----w C:\Programme\Gemeinsame Dateien\ArcSoft
2008-01-07 19:44 --------- d-----w C:\Programme\Philips
2008-01-07 19:44 --------- d-----w C:\Dokumente und Einstellungen\*******\Anwendungsdaten\InstallShield
2008-01-02 16:52 --------- d-----w C:\Programme\Google
2008-01-02 11:10 --------- d-----w C:\Programme\Skype
2008-01-01 22:29 --------- d-----w C:\Dokumente und Einstellungen\*******\Anwendungsdaten\MiniLyrics
2008-01-01 17:09 796,672 ----a-w C:\WINDOWS\GPInstall.exe
2007-12-31 23:06 --------- d-----w C:\Programme\Java
2007-12-31 17:59 --------- d-----w C:\Dokumente und Einstellungen\*******\Anwendungsdaten\Sony Corporation
2007-12-31 17:47 --------- d-----w C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sony Corporation
2007-12-31 12:29 32 ----a-w C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ezsid.dat
2007-12-31 12:29 --------- d-----w C:\Programme\Gemeinsame Dateien\Skype
2007-08-17 06:03 6,603 ---ha-w C:\Dokumente und Einstellungen\*******\hpothb07.dat
.

(((((((((((((((((((((((((((( Autostart Punkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Hinweis* leere Eintrage & legitime Standardeintrage werden nicht angezeigt.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A95B2816-1D7E-4561-A202-68C0DE02353A}]
2008-01-30 09:43 163904 --a------ C:\WINDOWS\system32\ppdgjsau.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D687439C-A33B-473B-9351-448DB4AC9810}]
2006-01-06 12:27 20103 --------- C:\WINDOWS\system32\spxcoios.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F14B4071-3585-470C-AF50-1B21C4AB298C}]
C:\WINDOWS\system32\mlljj.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Programme\Messenger\msmsgs.exe" [2004-10-13 17:24 1694208]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:57 15360]
"Skype"="C:\Programme\Skype\Phone\Skype.exe" [2007-12-07 15:08 21686568]
"H/PC Connection Agent"="D:\programme\wcescomm.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="C:\Programme\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 08:11 1388544]
"SoundMAX"="C:\Programme\Analog Devices\SoundMAX\Smax4.exe" [2004-09-23 11:41 860160]
"AGRSMMSG"="AGRSMMSG.exe" [2004-08-24 12:20 88363 C:\WINDOWS\AGRSMMSG.exe]
"SynTPLpr"="C:\Programme\Synaptics\SynTP\SynTPLpr.exe" [2004-11-04 19:40 98394]
"SynTPEnh"="C:\Programme\Synaptics\SynTP\SynTPEnh.exe" [2004-11-04 19:38 688218]
"Cpqset"="C:\Programme\HPQ\Default Settings\cpqset.exe" [2004-09-07 15:28 213054]
"eabconfg.cpl"="C:\Programme\HPQ\Quick Launch Buttons\EabServr.exe" [2004-12-03 12:24 290816]
"UpdateManager"="C:\Programme\Gemeinsame Dateien\Sonic\Update Manager\sgtray.exe" [2003-08-19 00:01 110592]
"SunJavaUpdateSched"="C:\Programme\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"WatchDog"="C:\Programme\InterVideo\DVD Check\DVDCheck.exe" [2004-12-08 17:44 184320]
"ShStatEXE"="C:\Programme\Network Associates\VirusScan\SHSTAT.exe" [2004-09-22 19:00 94208]
"McAfeeUpdaterUI"="C:\Programme\Network Associates\Common Framework\UpdaterUI.exe" [2004-08-06 02:50 139320]
"Network Associates Error Reporting Service"="C:\Programme\Gemeinsame Dateien\Network Associates\TalkBack\TBMon.exe" [2003-10-07 08:48 147514]
"IntelZeroConfig"="C:\Programme\Intel\Wireless\bin\ZCfgSvc.exe" [2005-05-31 21:46 401408]
"IntelWireless"="C:\Programme\Intel\Wireless\Bin\ifrmewrk.exe" [2005-06-03 00:31 385024]
"Desktop Tool 3"="D:\PROGRA~1\DESKTO~1\DesktopTool.exe" [2004-05-15 17:41 135168]
"TkBellExe"="C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" [2006-04-01 19:32 180269]
"QuickTime Task"="C:\Programme\QuickTime\qttask.exe" [2006-08-19 19:29 282624]
"Share-to-Web Namespace Daemon"="D:\Programme\HP Share-to-Web\hpgs2wnd.exe" [2002-04-17 09:42 69632]
"PhilipsSA33XXDM"="C:\Programme\Philips\SA33XX\Philips Device Manager\Bin\SA33XXDeviceManager.exe" [2007-08-07 10:30 884736]
"spywarefighterguard"="D:\Programme\SPYWAREfighter\spftray.exe" [2007-06-08 11:52 115608]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
C:\Programme\Intel\Wireless\Bin\LgNotify.dll 2005-05-31 21:46 110592 C:\Programme\Intel\Wireless\Bin\LgNotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ppdgjsau]
ppdgjsau.dll 2008-01-30 09:43 163904 C:\WINDOWS\system32\ppdgjsau.dll

R0 Achernar;Achernar - SCSI Command Filters;C:\WINDOWS\system32\Drivers\Achernar.sys [2004-02-11 14:34]
R3 Aldebaran;Aldebaran - SCSI Command Filters;C:\WINDOWS\system32\Drivers\Aldebaran.sys [2004-02-11 14:34]
R3 GTIPCI21;GTIPCI21;C:\WINDOWS\system32\DRIVERS\gtipci21.sys [2004-05-03 17:26]
R3 SpyFighter;SpyFighter Guard Device;D:\Programme\SPYWAREfighter\spyfighter.sys [2007-06-08 11:52]
R3 SPYWAREfighterRP;SPYWAREfighterRP;"D:\Programme\SPYWAREfighter\spfprc.exe" [2007-06-08 11:52]
S3 acfva;acfva;C:\WINDOWS\system32\DRIVERS\acfva.sys [2004-09-13 15:51]
S3 ap_bus;Thuraya SG-2520 USB Composite Device;C:\WINDOWS\system32\Drivers\ap_bus.sys []
S3 AVMUNET;Eumex 300 IP;C:\WINDOWS\system32\DRIVERS\avmunet.sys [2005-04-18 16:16]
S3 HotSpotFSvc;Hotspot Manager;"C:\Programme\Gemeinsame Dateien\T-COM\HotspotMgr\HotSpotFSvc.exe" []
S3 TSMPacket;T-DSL Manager Service;C:\WINDOWS\system32\DRIVERS\tsmpkt.sys []
S3 ZSMC211;USB PC Camera (ZS211);C:\WINDOWS\system32\Drivers\ZS211.sys [2006-07-25 04:47]

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, h**p://www.gmer.net
Rootkit scan 2008-02-08 17:58:40
Windows 5.1.2600 Service Pack 2 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostart Eintr„ge...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = C:\Programme\HPQ\Default Settings\cpqset.exe????????????7?3?9?5??`???? ???B???????????????B????????

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Programme\Intel\Wireless\Bin\EvtEng.exe
C:\Programme\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\System32\SCardSvr.exe
C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Programme\Network Associates\Common Framework\FrameworkService.exe
C:\Programme\Network Associates\VirusScan\Mcshield.exe
C:\Programme\Network Associates\VirusScan\VsTskMgr.exe
C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe
C:\Programme\Intel\Wireless\Bin\RegSrvc.exe
C:\Programme\Analog Devices\SoundMAX\SMAgent.exe
C:\Programme\Windows Media Player\WMPNetwk.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
D:\Programme\HP Share-to-Web\hpgs2wnf.exe
C:\Programme\Google\Google Updater\GoogleUpdater.exe
C:\Programme\Skype\Plugin Manager\skypePM.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2008-02-08 18:00:56 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-08 17:00:45
.
2008-01-09 11:38:20 --- E O F ---

muss 2 x posten da die Zeichen zu viel sind.
silent runner folgt.

vorab danke und einen schönen Freitagabend

Gruss
faserbruch65

und der silent runner.......

"Silent Runners.vbs", revision 55, h**p://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"MSMSGS" = ""C:\Programme\Messenger\msmsgs.exe" /background" [MS]
"ctfmon.exe" = "C:\WINDOWS\system32\ctfmon.exe" [MS]
"Skype" = ""C:\Programme\Skype\Phone\Skype.exe" /nosplash /minimized" ["Skype Technologies S.A."]
"H/PC Connection Agent" = ""D:\programme\wcescomm.exe"" [file not found]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"SoundMAXPnP" = "C:\Programme\Analog Devices\SoundMAX\SMax4PNP.exe" ["Analog Devices, Inc."]
"SoundMAX" = ""C:\Programme\Analog Devices\SoundMAX\Smax4.exe" /tray" ["Analog Devices, Inc."]
"AGRSMMSG" = "AGRSMMSG.exe" ["Agere Systems"]
"SynTPLpr" = "C:\Programme\Synaptics\SynTP\SynTPLpr.exe" ["Synaptics, Inc."]
"SynTPEnh" = "C:\Programme\Synaptics\SynTP\SynTPEnh.exe" ["Synaptics, Inc."]
"Cpqset" = "C:\Programme\HPQ\Default Settings\cpqset.exe" [null data]
"eabconfg.cpl" = "C:\Programme\HPQ\Quick Launch Buttons\EabServr.exe /Start" ["Hewlett-Packard "]
"UpdateManager" = ""C:\Programme\Gemeinsame Dateien\Sonic\Update Manager\sgtray.exe" /r" ["Sonic Solutions"]
"SunJavaUpdateSched" = ""C:\Programme\Java\jre1.6.0_03\bin\jusched.exe"" ["Sun Microsystems, Inc."]
"WatchDog" = "C:\Programme\InterVideo\DVD Check\DVDCheck.exe" ["InterVideo Inc."]
"ShStatEXE" = ""C:\Programme\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE" ["Network Associates, Inc."]
"McAfeeUpdaterUI" = ""C:\Programme\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey" ["Network Associates, Inc."]
"Network Associates Error Reporting Service" = ""C:\Programme\Gemeinsame Dateien\Network Associates\TalkBack\TBMon.exe"" ["Network Associates, Inc."]
"IntelZeroConfig" = "C:\Programme\Intel\Wireless\bin\ZCfgSvc.exe" ["Intel Corporation"]
"IntelWireless" = "C:\Programme\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless" ["Intel Corporation"]
"Desktop Tool 3" = ""D:\PROGRA~1\DESKTO~1\DesktopTool.exe"" ["Developed by www.eDrogene.com"]
"TkBellExe" = ""C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot" ["RealNetworks, Inc."]
"QuickTime Task" = ""C:\Programme\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."]
"Share-to-Web Namespace Daemon" = "D:\Programme\HP Share-to-Web\hpgs2wnd.exe" ["Hewlett-Packard"]
"PhilipsSA33XXDM" = "C:\Programme\Philips\SA33XX\Philips Device Manager\Bin\SA33XXDeviceManager.exe OS_STARTUP" ["Koninklijke Philips Electronics N.V."]
"spywarefighterguard" = "D:\Programme\SPYWAREfighter\spftray.exe" ["SPAMfighter"]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)
-> {HKLM...CLSID} = "AcroIEHlprObj Class"
\InProcServer32\(Default) = "C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]
{5CA3D70E-1895-11CF-8E15-001234567890}\(Default) = (no title provided)
-> {HKLM...CLSID} = "DriveLetterAccess"
\InProcServer32\(Default) = "C:\WINDOWS\system32\dla\tfswshx.dll" ["Sonic Solutions"]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)
-> {HKLM...CLSID} = "SSVHelper Class"
\InProcServer32\(Default) = "C:\Programme\Java\jre1.6.0_03\bin\ssv.dll" ["Sun Microsystems, Inc."]
{83A30C59-3A50-49E6-9DAF-4923C4EA3C23}\(Default) = "WebSpeechBHO Class"
-> {HKLM...CLSID} = "WebSpeechBHO Class"
\InProcServer32\(Default) = "C:\Programme\Gemeinsame Dateien\WebSpeech.4.0\LgxIEBar.dll" ["G DATA Software AG"]
{A95B2816-1D7E-4561-A202-68C0DE02353A}\(Default) = (no title provided)
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\ppdgjsau.dll" [null data]
{AA58ED58-01DD-4d91-8333-CF10577473F7}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Google Toolbar Helper"
\InProcServer32\(Default) = "c:\programme\google\googletoolbar3.dll" ["Google Germany GmbH"]
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Google Toolbar Notifier BHO"
\InProcServer32\(Default) = "C:\Programme\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll" ["Google Inc."]
{D687439C-A33B-473B-9351-448DB4AC9810}\(Default) = (no title provided)
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\spxcoios.dll" [null data]
{F14B4071-3585-470C-AF50-1B21C4AB298C}\(Default) = (no title provided)
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\mlljj.dll" [file not found]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "CPL-Erweiterung für Anzeigeverschiebung"
-> {HKLM...CLSID} = "CPL-Erweiterung für Anzeigeverschiebung"
\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Erweiterung für HyperTerminal-Icons"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]
"{2F603045-309F-11CF-9774-0020AFD0CFF6}" = "Synaptics Control Panel"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Programme\Synaptics\SynTP\SynTPCpl.dll" ["Synaptics, Inc."]
"{DEE12703-6333-4D4E-8F34-738C4DCC2E04}" = "RecordNow! SendToExt"
-> {HKLM...CLSID} = "RecordNow! SendToExt"
\InProcServer32\(Default) = "C:\Programme\Sonic\RecordNow!\shlext.dll" [null data]
"{5CA3D70E-1895-11CF-8E15-001234567890}" = "DriveLetterAccess"
-> {HKLM...CLSID} = "DriveLetterAccess"
\InProcServer32\(Default) = "C:\WINDOWS\system32\dla\tfswshx.dll" ["Sonic Solutions"]
"{E0D79304-84BE-11CE-9641-444553540000}" = "WinZip"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
"{E0D79305-84BE-11CE-9641-444553540000}" = "WinZip"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
"{E0D79306-84BE-11CE-9641-444553540000}" = "WinZip"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
"{E0D79307-84BE-11CE-9641-444553540000}" = "WinZip"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
"{59850401-6664-101B-B21C-00AA004BA90B}" = "Microsoft Office Binder Unbind"
-> {HKLM...CLSID} = "Microsoft Office Binder Unbind"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office\1031\UNBIND.DLL" [MS]
"{68f32140-2ca3-11d0-acc1-444553540000}" = "PicaView"
-> {HKLM...CLSID} = "PicaView Shell Extension"
\InProcServer32\(Default) = "C:\Programme\ACD Systems\Picaview\PicaView.dll" [file not found]
"{23170F69-40C1-278A-1000-000100020000}" = "7-Zip Shell Extension"
-> {HKLM...CLSID} = "7-Zip Shell Extension"
\InProcServer32\(Default) = "C:\Programme\7-Zip\7-zip.dll" ["Igor Pavlov"]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\
"WPDShServiceObj" = "{AAA288BA-9A4C-45B0-95D7-94D524869DB5}"
-> {HKLM...CLSID} = "WPDShServiceObj Class"
\InProcServer32\(Default) = "C:\WINDOWS\system32\WPDShServiceObj.dll" [MS]

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
<<!>> igfxcui\DLLName = "igfxsrvc.dll" ["Intel Corporation"]
<<!>> IntelWireless\DLLName = "C:\Programme\Intel\Wireless\Bin\LgNotify.dll" ["Intel Corporation"]
<<!>> ppdgjsau\DLLName = "ppdgjsau.dll" [null data]

HKLM\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\
{F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info"
-> {HKLM...CLSID} = "PDF Shell Extension"
\InProcServer32\(Default) = "C:\Programme\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."]

HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\
7-Zip\(Default) = "{23170F69-40C1-278A-1000-000100020000}"
-> {HKLM...CLSID} = "7-Zip Shell Extension"
\InProcServer32\(Default) = "C:\Programme\7-Zip\7-zip.dll" ["Igor Pavlov"]
PicaView\(Default) = "{68f32140-2ca3-11d0-acc1-444553540000}"
-> {HKLM...CLSID} = "PicaView Shell Extension"
\InProcServer32\(Default) = "C:\Programme\ACD Systems\Picaview\PicaView.dll" [file not found]
SPYWAREfighter\(Default) = "{44CB577A-837C-4C36-9C8D-80A1639B9333}"
-> {HKLM...CLSID} = "SpywarefighterExt Class"
\InProcServer32\(Default) = "D:\Programme\SPYWAREfighter\spfext.dll" ["Spamfighter"]
VirusScan\(Default) = "{cda2863e-2497-4c49-9b89-06840e070a87}"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Programme\Network Associates\VirusScan\shext.dll" ["Network Associates, Inc."]
WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]

HKLM\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\
7-Zip\(Default) = "{23170F69-40C1-278A-1000-000100020000}"
-> {HKLM...CLSID} = "7-Zip Shell Extension"
\InProcServer32\(Default) = "C:\Programme\7-Zip\7-zip.dll" ["Igor Pavlov"]
VirusScan\(Default) = "{cda2863e-2497-4c49-9b89-06840e070a87}"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Programme\Network Associates\VirusScan\shext.dll" ["Network Associates, Inc."]
WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]

HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\
SPYWAREfighter\(Default) = "{44CB577A-837C-4C36-9C8D-80A1639B9333}"
-> {HKLM...CLSID} = "SpywarefighterExt Class"
\InProcServer32\(Default) = "D:\Programme\SPYWAREfighter\spfext.dll" ["Spamfighter"]
VirusScan\(Default) = "{cda2863e-2497-4c49-9b89-06840e070a87}"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Programme\Network Associates\VirusScan\shext.dll" ["Network Associates, Inc."]
WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]


Group Policies {GPedit.msc branch and setting}:
-----------------------------------------------

Note: detected settings may not have any effect.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\

"shutdownwithoutlogon" = (REG_DWORD) dword:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Shutdown: Allow system to be shut down without having to log on}

"undockwithoutlogon" = (REG_DWORD) dword:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Devices: Allow undock without having to log on}


Active Desktop and Wallpaper:
-----------------------------

Active Desktop may be disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

Displayed if Active Desktop enabled and wallpaper not set by Group Policy:
HKCU\Software\Microsoft\Internet Explorer\Desktop\General\
"Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp"

Displayed if Active Desktop disabled and wallpaper not set by Group Policy:
HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\WINDOWS\webshots.bmp"


Startup items in "*******" & "All Users" startup folders:
---------------------------------------------------------

C:\Dokumente und Einstellungen\kremser\Startmenü\Programme\Autostart
"office wörterbuch pro 2" -> shortcut to: "D:\Programme\OWPro2\tDictPro.exe" ["Lingenio GmbH, Heidelberg"]
"Picture Motion Browser Medien-Prüfung" -> shortcut to: "D:\Programme\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe /nobaloononstart" ["Sony Corporation"]
"Webshots" -> shortcut to: "D:\Programme\Webshots\WebshotsTray.exe" ["The Webshots Corporation"]

C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart
"Adobe Reader - Schnellstart" -> shortcut to: "C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe" ["Adobe Systems Incorporated"]
"DVD Check" -> shortcut to: "C:\Programme\InterVideo\DVD Check\DVDCheck.exe" ["InterVideo Inc."]
"Google Updater" -> shortcut to: "C:\Programme\Google\Google Updater\GoogleUpdater.exe -systray -startup" ["Google"]
"Image Fox Trial Version" -> shortcut to: "C:\Programme\ACD Systems\ImageFox\ImageFox.exe" [file not found]
"Instant Update" -> shortcut to: "D:\Programme\InstUpDt.exe" [file not found]
"Microsoft Office" -> shortcut to: "C:\Programme\Microsoft Office\Office\OSA9.EXE -b -l" [MS]


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 04, 07 - 30
%SystemRoot%\system32\rsvpsp.dll [MS], 05 - 06


Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
"{2318C2B1-4965-11D4-9B18-009027A5CD4F}"
-> {HKLM...CLSID} = "&Google"
\InProcServer32\(Default) = "c:\programme\google\googletoolbar3.dll" ["Google Germany GmbH"]
"{F2CF5485-4E02-4F68-819C-B92DE9277049}"
-> {HKLM...CLSID} = "&Links"
\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]

HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\
"{2318C2B1-4965-11D4-9B18-009027A5CD4F}" = (no title provided)
-> {HKLM...CLSID} = "&Google"
\InProcServer32\(Default) = "c:\programme\google\googletoolbar3.dll" ["Google Germany GmbH"]

Explorer Bars

HKCU\Software\Microsoft\Internet Explorer\Explorer Bars\
{2D9700CB-A777-4DB0-96E1-1EBEBB7D1510}\(Default) = (no title provided)
-> {HKLM...CLSID} = "WebSpeech Reader"
\InProcServer32\(Default) = "C:\Programme\Gemeinsame Dateien\WebSpeech.4.0\LgxIEBar.dll" ["G DATA Software AG"]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Konsole"
"CLSIDExtension" = "{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC}"
-> {HKCU...CLSID} = "Java Plug-in 1.6.0_03"
\InProcServer32\(Default) = "C:\Programme\Java\jre1.6.0_03\bin\ssv.dll" ["Sun Microsystems, Inc."]
-> {HKLM...CLSID} = "Java Plug-in 1.6.0_03"
\InProcServer32\(Default) = "C:\Programme\Java\jre1.6.0_03\bin\npjpi160_03.dll" ["Sun Microsystems, Inc."]

{1CE4DE72-7FCC-4EB8-8F66-AE6A56A0A54D}\
"ButtonText" = "WebSpeech"
"MenuText" = "Seite/Markierung vorlesen (WebSpeech)"
"CLSIDExtension" = "{0854DA01-5BF8-4E9D-A0E9-3CD5500AFB8C}"
-> {HKLM...CLSID} = "WebSpeechCmd Class"
\InProcServer32\(Default) = "C:\Programme\Gemeinsame Dateien\WebSpeech.4.0\LgxIEBar.dll" ["G DATA Software AG"]

{2EAF5BB1-070F-11D3-9307-00C04FAE2D4F}\
"ButtonText" = "Create Mobile Favorite"
"CLSIDExtension" = "{2EAF5BB0-070F-11D3-9307-00C04FAE2D4F}"

{2EAF5BB2-070F-11D3-9307-00C04FAE2D4F}\
"MenuText" = "Create Mobile Favorite..."
"CLSIDExtension" = "{2EAF5BB0-070F-11D3-9307-00C04FAE2D4F}"

{FB5F1910-F110-11D2-BB9E-00C04F795683}\
"ButtonText" = "Messenger"
"MenuText" = "Windows Messenger"
"Exec" = "C:\Programme\Messenger\msmsgs.exe" [MS]


Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

EvtEng, EvtEng, "C:\Programme\Intel\Wireless\Bin\EvtEng.exe" ["Intel Corporation"]
Google Updater Service, gusvc, ""C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe"" ["Google"]
McAfee Framework Service, McAfeeFramework, "C:\Programme\Network Associates\Common Framework\FrameworkService.exe /ServiceStart" ["Network Associates, Inc."]
Network Associates McShield, McShield, ""C:\Programme\Network Associates\VirusScan\Mcshield.exe"" ["Network Associates, Inc."]
Network Associates Task Manager, McTaskManager, ""C:\Programme\Network Associates\VirusScan\VsTskMgr.exe"" ["Network Associates, Inc."]
RegSrvc, RegSrvc, "C:\Programme\Intel\Wireless\Bin\RegSrvc.exe" ["Intel Corporation"]
SoundMAX Agent Service, SoundMAX Agent Service (default), "C:\Programme\Analog Devices\SoundMAX\SMAgent.exe" ["Analog Devices, Inc."]
Spectrum24 Event Monitor, S24EventMonitor, "C:\Programme\Intel\Wireless\Bin\S24EvMon.exe" ["Intel Corporation "]
SPYWAREfighterRP, SPYWAREfighterRP, ""D:\Programme\SPYWAREfighter\spfprc.exe"" ["SpamFighter APS"]
Windows Media Player-Netzwerkfreigabedienst, WMPNetworkSvc, ""C:\Programme\Windows Media Player\WMPNetwk.exe"" [MS]


Print Monitors:
---------------

HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors\
HP Master Monitor\Driver = "HPBMMON.DLL" ["Hewlett-Packard"]
PDFCreator\Driver = "pdfcmnnt.dll" [null data]


---------- (launch time: 2008-02-08 18:21:42)
<<!>>: Suspicious data at a malware launch point.

+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ To search all directories of local fixed drives for DESKTOP.INI
DLL launch points, use the -supp parameter or answer "No" at the
first message box and "Yes" at the second message box.
---------- (total run time: 95 seconds, including 17 seconds for message boxes)

Hi,

da sind noch noch einige Dateien die mir nicht gefallen,
und die Silentrunner entdeckt hat:
C:\WINDOWS\system32\ppdgjsau.dll (?)
C:\WINDOWS\system32\spxcoios.dll (?)
C:\WINDOWS\system32\mlljj.dll (Virtumonde)
Oben auf der Seite --> auf Durchsuchen klicken --> Datei aussuchen (oder gleich die Datei mit korrektem Pfad einkopieren) --> Doppelklick auf die zu prüfende Datei --> klick auf "Send"... jetzt abwarten - dann mit der rechten Maustaste den Text markieren -> kopieren - einfügen
http://www.virustotal.com/flash/index_en.html

Poste das Ergebnis mit Filename

Falls eine Datei nicht erkannt wurde, aus dem Avengerscript löschen:
Avenger
http://filepony.de/download-the_avenger/
Input script manually (anhaken)
kopiere in: View/edit script

registry keys to delete:
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ppdgjsau

Files to delete:
C:\WINDOWS\system32\ppdgjsau.dll
C:\WINDOWS\system32\spxcoios.dll
C:\WINDOWS\system32\mlljj.dll

Klicke die gruene Ampel
das Script wird nun ausgeführt, dann wird der PC automatisch neustarten..

Dann lösche Combofix (Start->Ausführen->"combofix /u" reinschreiben (ohne ""),
lade ihn erneut runter und lasse ihn noch mal laufen (combofix wird immer
wieder neu erstellt (wie Dr. Web) um aktuell zu bleiben);
Poste das neue Combofix-Log und ein neues Silentrunner log.

Anleitung: Anleitung: DrWeb - CureIt - Anleitung
Aber bitte den Download von hier nutzen http://freedrweb.com/?lng=de

Chris
(Ich hoffe wir erwischen sie alle, bevor neue Componenten runtergeladen werden...
never ending story...)