Hallo,
ich helfe hier einem Freund, der sich wohl selbst verschuldet einen "Hijacker" auf den PC geholt hat! Hauptsächlich scheint nur der Internet Explorer betroffen zu sein ... sicher bin ich aber nicht.

AntiVir wurde installiert ... lässt sich aber nicht updaten. (evtl steht dazu mehr im hijack log)
SpyBot durchlaufen lassen, dieser hat den gesagten win32.agent.gvu gefunden - habe ich löschen lassen.

Das hat ihn jedoch wohl nicht geplättet ... weiterhin kommen unter anderem porno einschübe bei Google und vista zeigt an, dass das system von einem Trojaner befallen ist!

Nun, da ich mit Trojaner-Bekämpfung keine Erfahrung habe bräuchte ich eure hilfe ... konnte wirklich kein brauchbares programm finden und auch kein lösungsansatz. Mir ist es noch nichtmal gelungen ihn wirklich zu identifizieren :-/

Hier ist der Hijack Log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:42:16, on 18.02.2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16609)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\avmwlanstick\FRITZWLANMini.exe
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avcenter.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\SearchFilterHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://de.rd.yahoo.com/customize/ycomp/defaults/sp/*http://de.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://www.google.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://de.intl.acer.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h**p://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://de.intl.acer.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = h**p://de.rd.yahoo.com/customize/ycomp/defaults/su/*http://de.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = fritz.box;192.168.178.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar mit Pop-Up-Blocker - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\4411\toolbaru.dll
O1 - Hosts: ::1 localhost
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\PROGRA~1\ICQTOO~1\4411\toolbaru.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Adobe PDF Reader Link Helper - {463F66BC-3B6F-4FDE-969C-94F594FECE07} - C:\Windows\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Windows\system32\ActiveToolBand.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar mit Pop-Up-Blocker - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\4411\toolbaru.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [AVMWlanClient] C:\Program Files\avmwlanstick\FRITZWLANMini.exe
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe (User 'Default user')
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: LUMIX Simple Viewer.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O13 - Gopher Prefix:
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: ePerformance Service (AcerMemUsageCheckService) - Unknown owner - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Automatisches LiveUpdate - Scheduler - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Acer\Empowering Technology\eMode\PCM\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Acer\Empowering Technology\eMode\PCM\Kernel\TV\CLSched.exe
O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

--
End of file - 9247 bytes

Die ieuser.exe und auch evtl avcenter.exe kommen mir komisch vor, könnte das daran liegen das die updatefunktion gestört wird ?!


Falls ihr weitere Berichte von Programmen braucht, bitte bescheid geben.

Ansonsten wäre ich für eine recht genau Anleitung dankbar ... und wenn man eine formatierung vermeiden könnte wäre ich noch viel dankbarer!

Hoffe jemand kann helfen, per google oder sonst bin ich nicht wirklich weiter gekommen :-((

Gruß

Halli hallo.

Das HJT log ist sauber.

1) Deaktiviere die Systemwiederherstellung auf allen Laufwerken.

2) Deinstalliere Java über die Systemsteuerung.

3) Blacklight bitte laufen lassen und das log posten..

4) Lasse Silentrunners laufen und poste die logFiles..

5) Folge dieser Anleitung.

6) Run Combofix. Poste den erscheinenden Text.

7) Durchsuche mit Lavasoft und Spybot-S&D sowie deinem AV-Prog (alle drei mit aktuellen Signaturen!) dein System jeweils 2x. Erst im normalen und dann im abgesicherten Modus (F8 beim Hochfahren).

8) Räume mit cCleaner auf ( die Registry musst du mehrmals durchsuchen und bereinigen lassen).

9) Poste ein frisches HijackThis log sowie einen iClean Bericht (Prog in eigenem Ordner öffnen->"Yes"->File->Report).

10) Danach machst du einen eScan nach Anleitung in meiner Signatur und postest das log.

So, habe nun einige Test durchgeführt. Erfolgreich waren sie allerdings eher nicht wie es mir scheint :-/

Blacklight log:

02/19/08 19:07:06 [Info]: BlackLight Engine 1.0.67 initialized
02/19/08 19:07:06 [Info]: OS: 6.0 build 6000 ()
02/19/08 19:07:07 [Note]: 7019 4
02/19/08 19:07:07 [Note]: 7005 0
02/19/08 19:07:14 [Note]: 7006 0
02/19/08 19:07:14 [Note]: 7027 0
02/19/08 19:07:15 [Note]: 7026 0
02/19/08 19:07:15 [Note]: 7026 0
02/19/08 19:07:18 [Note]: FSRAW library version 1.7.1024
02/19/08 19:11:36 [Note]: 7007 0

Hier der SilentRunners log:

"Silent Runners.vbs", revision 55, http://www.silentrunners.org/
Operating System: Windows Vista
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"Sidebar" = "C:\Program Files\Windows Sidebar\sidebar.exe /autoRun" [MS]
"Acer Tour Reminder" = (empty string) [file not found]
"WMPNSCFG" = "C:\Program Files\Windows Media Player\WMPNSCFG.exe" [MS]
"swg" = "C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" ["Google Inc."]
"SpybotSD TeaTimer" = "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" ["Safer Networking Limited"]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"Windows Defender" = "C:\Program Files\Windows Defender\MSASCui.exe -hide"
"RtHDVCpl" = "RtHDVCpl.exe" ["Realtek Semiconductor"]
"Acer Tour" = (empty string) [file not found]
"NvSvc" = "RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart" [MS]
"NvCplDaemon" = "RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup" [MS]
"NvMediaCenter" = "RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit" [MS]
"eRecoveryService" = (empty string) [file not found]
"HP Software Update" = "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" ["Hewlett-Packard Co."]
"AVMWlanClient" = "C:\Program Files\avmwlanstick\FRITZWLANMini.exe" ["AVM Berlin"]
"SMSERIAL" = "C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe" ["Motorola Inc."]
"avgnt" = ""C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min" ["Avira GmbH"]
"ISTray" = ""C:\Users\zink\Downloads\clrav\Spyware Doctor\pctsTray.exe"" ["PC Tools"]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{02478D38-C3F9-4EFB-9B51-7695ECA05670}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Yahoo! Toolbar Helper"
\InProcServer32\(Default) = "C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll" ["Yahoo! Inc."]
{055FD26D-3A88-4e15-963D-DC8493744B1D}\(Default) = "XTTBPos00"
-> {HKLM...CLSID} = "XTTBPos00 Class"
\InProcServer32\(Default) = "C:\PROGRA~1\ICQTOO~1\4411\toolbaru.dll" ["IE Toolbar"]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)
-> {HKLM...CLSID} = "AcroIEHlprObj Class"
\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]
{463F66BC-3B6F-4FDE-969C-94F594FECE07}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Adobe PDF Reader Link Helper"
\InProcServer32\(Default) = "C:\Windows\AcroIEHelper.dll" ["Adobe"]
{53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Spybot-S&D IE Protection"
\InProcServer32\(Default) = "C:\PROGRA~1\SPYBOT~1\SDHelper.dll" ["Safer Networking Limited"]
{83A2F9B1-01A2-4AA5-87D1-45B6B8505E96}\(Default) = (no title provided)
-> {HKLM...CLSID} = "ShowBarObj Class"
\InProcServer32\(Default) = "C:\Windows\system32\ActiveToolBand.dll" ["HiTRUST"]
{AA58ED58-01DD-4d91-8333-CF10577473F7}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Google Toolbar Helper"
\InProcServer32\(Default) = "c:\program files\google\googletoolbar1.dll" ["Google Germany GmbH"]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"
-> {HKLM...CLSID} = "DesktopContext Class"
\InProcServer32\(Default) = "C:\Windows\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C}" = "Microsoft Office OneNote Namespace Extension for Windows Desktop Search"
-> {HKLM...CLSID} = "Microsoft Office OneNote Namespace Extension for Windows Desktop Search"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\ONFILTER.DLL" [MS]
"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\msohev.dll" [MS]
"{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}" = "Microsoft Office Metadata Handler"
-> {HKLM...CLSID} = "Microsoft Office Metadata Handler"
\InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll" [MS]
"{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97}" = "Microsoft Office Thumbnail Handler"
-> {HKLM...CLSID} = "Microsoft Office Thumbnail Handler"
\InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll" [MS]
"{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper"
-> {HKLM...CLSID} = "NVIDIA CPL Extension"
\InProcServer32\(Default) = "C:\Windows\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{45AC2688-0253-4ED8-97DE-B5370FA7D48A}" = "Shell Extension for Malware scanning"
-> {HKLM...CLSID} = "Shell Extension for Malware scanning"
\InProcServer32\(Default) = "C:\Program Files\Avira\AntiVir PersonalEdition Classic\shlext.dll" ["Avira GmbH"]

HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\
<<!>> "BootExecute" = "autocheck autochk *"|"lsdelete" [null data]

HKLM\SOFTWARE\Classes\PROTOCOLS\Filter\
<<!>> text/xml\CLSID = "{807563E5-5146-11D5-A672-00B0D022E945}"
-> {HKLM...CLSID} = "Microsoft Office InfoPath XML Mime Filter"
\InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL" [MS]

HKLM\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\
{F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info"
-> {HKLM...CLSID} = "PDF Shell Extension"
\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."]

HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\
EDSshellExt\(Default) = "{29FF7AB0-BE34-4992-A30B-53A9D86EE239}"
-> {HKLM...CLSID} = "eDSshlExt Class"
\InProcServer32\(Default) = "C:\Windows\system32\eDSshellExt.dll" ["HiTRUST"]
Shell Extension for Malware scanning\(Default) = "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}"
-> {HKLM...CLSID} = "Shell Extension for Malware scanning"
\InProcServer32\(Default) = "C:\Program Files\Avira\AntiVir PersonalEdition Classic\shlext.dll" ["Avira GmbH"]

HKLM\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\
EDSshellExt\(Default) = "{29FF7AB0-BE34-4992-A30B-53A9D86EE239}"
-> {HKLM...CLSID} = "eDSshlExt Class"
\InProcServer32\(Default) = "C:\Windows\system32\eDSshellExt.dll" ["HiTRUST"]

HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\
Shell Extension for Malware scanning\(Default) = "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}"
-> {HKLM...CLSID} = "Shell Extension for Malware scanning"
\InProcServer32\(Default) = "C:\Program Files\Avira\AntiVir PersonalEdition Classic\shlext.dll" ["Avira GmbH"]


Group Policies {GPedit.msc branch and setting}:
-----------------------------------------------

Note: detected settings may not have any effect.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\

"ConsentPromptBehaviorAdmin" = (REG_DWORD) dword:0x00000002
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
User Account Control: Behavior Of The Elevation Prompt For Administrators In Admin Approval Mode}

"ConsentPromptBehaviorUser" = (REG_DWORD) dword:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
User Account Control: Behavior Of The Elevation Prompt For Standard Users}

"EnableInstallerDetection" = (REG_DWORD) dword:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
User Account Control: Detect Application Installations And Prompt For Elevation}

"EnableLUA" = (REG_DWORD) dword:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
User Account Control: Run All Administrators In Admin Approval Mode}

"EnableSecureUIAPaths" = (REG_DWORD) dword:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
User Account Control: Only elevate UIAccess applications that are installed in secure locations}

"EnableVirtualization" = (REG_DWORD) dword:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
User Account Control: Virtualize file and registry write failures to per-user locations}

"PromptOnSecureDesktop" = (REG_DWORD) dword:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
User Account Conrol: Switch to the secure desktop when prompting for elevation}

"shutdownwithoutlogon" = (REG_DWORD) dword:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Shutdown: Allow system to be shut down without having to log on}

"undockwithoutlogon" = (REG_DWORD) dword:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Devices: Allow undock without having to log on}

"FilterAdministratorToken" = (REG_DWORD) dword:0x00000000
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
User Account Control: Admin Approval Mode for the Built-in Administrator Account}


Active Desktop and Wallpaper:
-----------------------------

Active Desktop may be disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

Displayed if Active Desktop enabled and wallpaper not set by Group Policy:
HKCU\Software\Microsoft\Internet Explorer\Desktop\General\
"Wallpaper" = "C:\Windows\Web\Wallpaper\img7.jpg"

Displayed if Active Desktop disabled and wallpaper not set by Group Policy:
HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Windows\Web\Wallpaper\img7.jpg"


Enabled Screen Saver:
---------------------

HKCU\Control Panel\Desktop\
"SCRNSAVE.EXE" = "C:\Windows\ACER(W~1.SCR" (Acer(Wide).scr) [null data]


Startup items in "zink" & "All Users" startup folders:
------------------------------------------------------

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
"Adobe Reader - Schnellstart" -> shortcut to: "C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe" ["Adobe Systems Incorporated"]
"HP Digital Imaging Monitor" -> shortcut to: "C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe" ["Hewlett-Packard Co."]
"LUMIX Simple Viewer" -> shortcut to: "C:\Program Files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe" ["Matsushita Electric Industrial Co., Ltd."]
"Microsoft Office" -> shortcut to: "C:\Program Files\Microsoft Office\Office10\OSA.EXE -b -l" [MS]


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\system32\NLAapi.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000004\LibraryPath = "%SystemRoot%\system32\napinsp.dll" [MS]
000000000005\LibraryPath = "%SystemRoot%\system32\pnrpnsp.dll" [MS]
000000000006\LibraryPath = "%SystemRoot%\system32\pnrpnsp.dll" [MS]

Transport Service Providers

HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 22


Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\
"{5CBE3B7C-1E47-477E-A7DD-396DB0476E29}"
-> {HKLM...CLSID} = "Acer eDataSecurity Management"
\InProcServer32\(Default) = "C:\Windows\system32\eDStoolbar.dll" ["HiTRUST"]

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
"{855F3B16-6D32-4FE6-8A56-BBB695989046}"
-> {HKLM...CLSID} = "ICQ Toolbar"
\InProcServer32\(Default) = "C:\PROGRA~1\ICQTOO~1\4411\toolbaru.dll" ["IE Toolbar"]
"{2318C2B1-4965-11D4-9B18-009027A5CD4F}"
-> {HKLM...CLSID} = "&Google"
\InProcServer32\(Default) = "c:\program files\google\googletoolbar1.dll" ["Google Germany GmbH"]

HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\
"{5CBE3B7C-1E47-477E-A7DD-396DB0476E29}" = (no title provided)
-> {HKLM...CLSID} = "Acer eDataSecurity Management"
\InProcServer32\(Default) = "C:\Windows\system32\eDStoolbar.dll" ["HiTRUST"]
"{EF99BD32-C1FB-11D2-892F-0090271D4F88}" = (no title provided)
-> {HKLM...CLSID} = "Yahoo! Toolbar mit Pop-Up-Blocker"
\InProcServer32\(Default) = "C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll" ["Yahoo! Inc."]
"{855F3B16-6D32-4FE6-8A56-BBB695989046}" = (no title provided)
-> {HKLM...CLSID} = "ICQ Toolbar"
\InProcServer32\(Default) = "C:\PROGRA~1\ICQTOO~1\4411\toolbaru.dll" ["IE Toolbar"]
"{2318C2B1-4965-11D4-9B18-009027A5CD4F}" = (no title provided)
-> {HKLM...CLSID} = "&Google"
\InProcServer32\(Default) = "c:\program files\google\googletoolbar1.dll" ["Google Germany GmbH"]

Explorer Bars

HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\

HKLM\SOFTWARE\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Recherchieren"
Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL" [MS]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\
{2670000A-7350-4F3C-8081-5663EE0C6C49}\
"ButtonText" = "An OneNote senden"
"MenuText" = "An OneNote s&enden"
"CLSIDExtension" = "{48E73304-E1D6-4330-914C-F5F514E3486C}"
-> {HKLM...CLSID} = "Send to OneNote from Internet Explorer button"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll" [MS]

{92780B25-18CC-41C8-B9BE-3C9C571A8263}\
"ButtonText" = "Research"

{DFB852A3-47F8-48C4-A200-58CAB36FD2A2}\
"MenuText" = "Spybot - Search & Destroy Configuration"
"CLSIDExtension" = "{53707962-6F74-2D53-2644-206D7942484F}"
-> {HKLM...CLSID} = "Spybot-S&D IE Protection"
\InProcServer32\(Default) = "C:\PROGRA~1\SPYBOT~1\SDHelper.dll" ["Safer Networking Limited"]

{E59EB121-F339-4851-A3BA-FE49C35617C2}\
"ButtonText" = "ICQ6"
"MenuText" = "ICQ6"
"Exec" = "C:\Program Files\ICQ6\ICQ.exe" ["ICQ, Inc."]


Miscellaneous IE Hijack Points
------------------------------

HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\
<<H>> "{EF99BD32-C1FB-11D2-892F-0090271D4F88}" = (no title provided)
-> {HKLM...CLSID} = "Yahoo! Toolbar mit Pop-Up-Blocker"
\InProcServer32\(Default) = "C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll" ["Yahoo! Inc."]
<<H>> "{855F3B16-6D32-4fe6-8A56-BBB695989046}" = (no title provided)
-> {HKLM...CLSID} = "ICQ Toolbar"
\InProcServer32\(Default) = "C:\PROGRA~1\ICQTOO~1\4411\toolbaru.dll" ["IE Toolbar"]


HOSTS file
----------

C:\Windows\System32\drivers\etc\HOSTS

maps: 7909 domain names to IP addresses,
1 of the IP addresses is *not* localhost!


Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

Ad-Aware 2007 Service, aawservice, ""C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe"" ["Lavasoft"]
AntiVir PersonalEdition Classic Guard, AntiVirService, ""C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe"" ["Avira GmbH"]
AntiVir PersonalEdition Classic Planer, AntiVirScheduler, ""C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe"" ["Avira GmbH"]
Automatische WLAN-Konfiguration, Wlansvc, "C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted" {"C:\Windows\System32\wlansvc.dll" [MS]}
CNG-Schlüsselisolation, KeyIso, "C:\Windows\system32\lsass.exe" [MS]
CyberLink Background Capture Service (CBCS), CLCapSvc, ""C:\Acer\Empowering Technology\eMode\PCM\Kernel\TV\CLCapSvc.exe"" [empty string]
Cyberlink RichVideo Service(CRVS), RichVideo, ""C:\Program Files\CyberLink\Shared Files\RichVideo.exe"" [empty string]
CyberLink Task Scheduler (CTS), CLSched, ""C:\Acer\Empowering Technology\eMode\PCM\Kernel\TV\CLSched.exe"" [empty string]
eDSService.exe, eDataSecurity Service, ""C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe"" ["HiTRSUT"]
ePerformance Service, AcerMemUsageCheckService, "C:\Acer\Empowering Technology\ePerformance\MemCheck.exe" [null data]
eRecovery Service, eRecoveryService, "C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe" [null data]
Extensible Authentication-Protokoll, EapHost, "C:\Windows\System32\svchost.exe -k netsvcs" {"C:\Windows\System32\eapsvc.dll" [MS]}
HP CUE DeviceDiscovery Service, hpqddsvc, "C:\Windows\system32\svchost.exe -k hpdevmgmt" {"C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll" ["Hewlett-Packard Co."]}
hpqcxs08, hpqcxs08, "C:\Windows\system32\svchost.exe -k hpdevmgmt" {"C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll" ["Hewlett-Packard Co."]}
LightScribeService Direct Disc Labeling Service, LightScribeService, ""C:\Program Files\Common Files\LightScribe\LSSrvc.exe"" ["Hewlett-Packard Company"]
Net Driver HPZ12, Net Driver HPZ12, "C:\Windows\System32\svchost.exe -k HPZ12" {"C:\Windows\system32\HPZinw12.dll" ["Hewlett-Packard"]}
PC Tools Auxiliary Service, sdAuxService, "C:\Users\zink\Downloads\clrav\Spyware Doctor\pctsAuxs.exe" ["PC Tools"]
PC Tools Security Service, sdCoreService, "C:\Users\zink\Downloads\clrav\Spyware Doctor\pctsSvc.exe" ["PC Tools"]
Pml Driver HPZ12, Pml Driver HPZ12, "C:\Windows\System32\svchost.exe -k HPZ12" {"C:\Windows\system32\HPZipm12.dll" ["Hewlett-Packard"]}
SBSD Security Center Service, SBSDWSCService, "C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe" ["Safer Networking Ltd."]
Windows Driver Foundation - Benutzermodus-Treiberframework, wudfsvc, "C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted" {"C:\Windows\System32\WUDFSvc.dll" [MS]}
Windows Installer, msiserver, "C:\Windows\system32\msiexec /V" [MS]
Windows Media Player-Netzwerkfreigabedienst, WMPNetworkSvc, ""C:\Program Files\Windows Media Player\wmpnetwk.exe"" [MS]
Windows-Bilderfassung, stisvc, "C:\Windows\system32\svchost.exe -k imgsvc" {"C:\Windows\System32\wiaservc.dll" [MS]}
Windows-Sicherung, SDRSVC, "C:\Windows\system32\svchost.exe -k SDRSVC" {"C:\Windows\System32\SDRSVC.dll" [MS]}
Zugriff auf Eingabegeräte, hidserv, "C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted" {"C:\Windows\system32\hidserv.dll" [MS]}


Print Monitors:
---------------

HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors\
LIDIL hpzlllhn\Driver = "hpzlllhn.dll" ["Hewlett-Packard Company"]
Send To Microsoft OneNote Monitor\Driver = "msonpmon.dll" [MS]


---------- (launch time: 2008-02-19 19:17:51)
<<!>>: Suspicious data at a malware launch point.
<<H>>: Suspicious data at a browser hijack point.

+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ To search all directories of local fixed drives for DESKTOP.INI
DLL launch points, use the -supp parameter or answer "No" at the
first message box and "Yes" at the second message box.
---------- (total run time: 59 seconds, including 7 seconds for message boxes)











SmitfraudFix log:
Scheint irgendwie nicht funktioniert zu haben ... stand „Zugriff verweigert“ mehrmals in den DOS-Fenstern. Wobei wohl doch ein kleines Dokument erstellt wurde:
Allerdings gab es keine Rapport.txt sondern dies ist die Process.txt im gleichen Verzeichnis.
Habe auch keine Ahnung warum er den Zugriff verweigert, kenne mich einfach nicht mit Vista und diesem PC aus :-/

C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\avmwlanstick\FRITZWLANMini.exe
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe
C:\Windows\System32\rundll32.exe
C:\Users\zink\Downloads\clrav\Spyware Doctor\pctsTray.exe
C:\Windows\system32\rundll32.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cscript.exe


Das ComboFix scheint auch nicht richtig zu laufen ... startet zwar aber es beendet sich dann auch gleich wieder. Ohne irgendeinen Text oder log ?!

So, nun mache ich mal weiter. Kann man bis jetzt denn schon was sagen ?

Deaktiviere bitte den Spybot TeaTimer Resident.


Dateien Online überprüfen lassen:

* Suche die Seite Virtustotal auf, klicke auf den Button „Durchsuchen“ und suche folgende Datei/Dateien:
(lass auch die versteckten Dateien anzeigen!)

C:\Windows\system32\eDSshellExt.dll
C:\Windows\system32\eDStoolbar.dll

Lade nun nacheinander jede/alle Datei/Dateien hoch, und warte bis der Scan vorbei ist. (kann bis zu 2 Minuten dauern.)
* Poste im Anschluss das Ergebnis der Auswertung, alles abkopieren und in einen Beitrag einfügen.
(Wichtig: Auch die Größenangabe sowie den HASH mit kopieren!)

So, die Scans waren wohl beide negativ:

Datei eDSshellExt.dll empfangen 2008.02.20 19:41:53 (CET)
Status: Laden ... Wartend Warten Überprüfung Beendet Nicht gefunden Gestoppt


Ergebnis: 0/32 (0%)

Antivirus Version letzte aktualisierung Ergebnis
AhnLab-V3 2008.2.20.0 2008.02.20 -
AntiVir 7.6.0.67 2008.02.20 -
Authentium 4.93.8 2008.02.20 -
Avast 4.7.1098.0 2008.02.20 -
AVG 7.5.0.516 2008.02.20 -
BitDefender 7.2 2008.02.20 -
CAT-QuickHeal 9.50 2008.02.18 -
ClamAV 0.92.1 2008.02.20 -
DrWeb 4.44.0.09170 2008.02.20 -
eSafe 7.0.15.0 2008.02.20 -
eTrust-Vet 31.3.5550 2008.02.20 -
Ewido 4.0 2008.02.20 -
FileAdvisor 1 2008.02.20 -
Fortinet 3.14.0.0 2008.02.19 -
F-Prot 4.4.2.54 2008.02.19 -
F-Secure 6.70.13260.0 2008.02.20 -
Ikarus T3.1.1.20 2008.02.20 -
Kaspersky 7.0.0.125 2008.02.20 -
McAfee 5233 2008.02.20 -
Microsoft 1.3204 2008.02.20 -
NOD32v2 2889 2008.02.20 -
Norman 5.80.02 2008.02.20 -
Panda 9.0.0.4 2008.02.20 -
Prevx1 V2 2008.02.20 -
Rising 20.32.22.00 2008.02.20 -
Sophos 4.26.0 2008.02.20 -
Sunbelt 3.0.884.0 2008.02.19 -
Symantec 10 2008.02.20 -
TheHacker 6.2.9.224 2008.02.19 -
VBA32 3.12.6.1 2008.02.17 -
VirusBuster 4.3.26:9 2008.02.20 -
Webwasher-Gateway 6.6.2 2008.02.20 -
weitere Informationen
File size: 315392 bytes
MD5: 8a8cb6fa490de82b6c6456a421b56f83
SHA1: d756d78ed1043c834c81c543cb40d0655a6769f8
PEiD: -



//////////////////////////////////////////////////////////////////////////////////////

Datei eDStoolbar.dll empfangen 2008.02.20 19:54:29 (CET)
Status: (( Laden ... Wartend Warten Überprüfung Beendet Nicht gefunden Gestoppt )) Hö, ist aber durchgelaufen, keine Fehler. Beim abkopieren war das auch nich sichtbar ?!?


Ergebnis: 0/32 (0%)


Antivirus Version letzte aktualisierung Ergebnis
AhnLab-V3 2008.2.20.0 2008.02.20 -
AntiVir 7.6.0.67 2008.02.20 -
Authentium 4.93.8 2008.02.20 -
Avast 4.7.1098.0 2008.02.20 -
AVG 7.5.0.516 2008.02.20 -
BitDefender 7.2 2008.02.20 -
CAT-QuickHeal 9.50 2008.02.18 -
ClamAV 0.92.1 2008.02.20 -
DrWeb 4.44.0.09170 2008.02.20 -
eSafe 7.0.15.0 2008.02.20 -
eTrust-Vet 31.3.5550 2008.02.20 -
Ewido 4.0 2008.02.20 -
FileAdvisor 1 2008.02.20 -
Fortinet 3.14.0.0 2008.02.19 -
F-Prot 4.4.2.54 2008.02.19 -
F-Secure 6.70.13260.0 2008.02.20 -
Ikarus T3.1.1.20 2008.02.20 -
Kaspersky 7.0.0.125 2008.02.20 -
McAfee 5233 2008.02.20 -
Microsoft 1.3204 2008.02.20 -
NOD32v2 2889 2008.02.20 -
Norman 5.80.02 2008.02.20 -
Panda 9.0.0.4 2008.02.20 -
Prevx1 V2 2008.02.20 -
Rising 20.32.22.00 2008.02.20 -
Sophos 4.26.0 2008.02.20 -
Sunbelt 3.0.884.0 2008.02.19 -
Symantec 10 2008.02.20 -
TheHacker 6.2.9.224 2008.02.19 -
VBA32 3.12.6.1 2008.02.17 -
VirusBuster 4.3.26:9 2008.02.20 -
Webwasher-Gateway 6.6.2 2008.02.20 -
weitere Informationen
File size: 151552 bytes
MD5: c1a82a92aab6d66c90cf027c17153746
SHA1: cbc509840e2f413ab9c3e3d0f8e5e8c3bf9a7a66
PEiD: -



So, mein Kollege hat sich den SpyDoctor besorgt ... der hat ne ganze Menge gefunden ...und anscheinend auch bereinigt, wobei er sie glaube nur in "Quarantaine" geschoben. Aber der meint das System wäre sauber!

Werde jetzt mal alles im abgesicherten Modus probieren... aber irgendwie is das alles komisch. Wurde denn schon was bei den logs gefunden ? Werde auch noch den CCleaner laufen lassen.

///// EDIT /////

ComboFix lief nun, hier der log:

ComboFix 08-02-19.2 - zink 2008-02-20 20:13:23.1 - NTFSx86
Microsoft® Windows Vista™ Home Basic 6.0.6000.0.1252.1.1031.18.265 [GMT 1:00]
ausgeführt von:: C:\Users\zink\Downloads\Trjoaner Bekämpfung\ComboFix.exe
.

((((((((((((((((((((((( Dateien erstellt von 2008-01-20 bis 2008-02-20 ))))))))))))))))))))))))))))))
.

2008-02-20 20:09 . 2008-02-20 20:09 <DIR> d-------- C:\Program Files\CCleaner
2008-02-19 12:32 . 2008-02-19 12:32 <DIR> d-------- C:\Users\zink\AppData\Roaming\PC Tools
2008-02-19 12:32 . 2008-02-20 20:09 <DIR> d-a------ C:\Users\All Users\TEMP
2008-02-19 12:32 . 2008-02-20 20:09 <DIR> d-a------ C:\PROGRA~2\TEMP
2008-02-19 12:32 . 2007-12-10 14:53 81,288 --a------ C:\Windows\System32\drivers\iksyssec.sys
2008-02-19 12:32 . 2007-12-10 14:53 66,952 --a------ C:\Windows\System32\drivers\iksysflt.sys
2008-02-19 12:32 . 2007-12-10 14:53 41,864 --a------ C:\Windows\System32\drivers\ikfilesec.sys
2008-02-19 12:32 . 2007-12-10 14:53 29,576 --a------ C:\Windows\System32\drivers\kcom.sys
2008-02-18 21:41 . 2008-02-18 21:41 <DIR> d-------- C:\Program Files\Trend Micro
2008-02-18 21:00 . 2008-02-18 21:01 <DIR> d-------- C:\Users\All Users\Lavasoft
2008-02-18 21:00 . 2008-02-18 21:00 <DIR> d-------- C:\Program Files\Lavasoft
2008-02-18 21:00 . 2008-02-18 21:01 <DIR> d-------- C:\PROGRA~2\Lavasoft
2008-02-18 20:58 . 2008-02-18 20:58 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-02-17 23:02 . 2008-02-17 23:02 194,560 --a------ C:\Windows\System32\WebClnt.dll
2008-02-17 23:02 . 2008-02-17 23:02 110,080 --a------ C:\Windows\System32\drivers\mrxdav.sys
2008-02-17 22:58 . 2008-02-17 22:58 3,504,696 --a------ C:\Windows\System32\ntkrnlpa.exe
2008-02-17 22:58 . 2008-02-17 22:58 3,470,392 --a------ C:\Windows\System32\ntoskrnl.exe
2008-02-17 22:58 . 2008-02-17 22:58 1,060,920 --a------ C:\Windows\System32\drivers\ntfs.sys
2008-02-17 22:58 . 2008-02-17 22:58 211,000 --a------ C:\Windows\System32\drivers\volsnap.sys
2008-02-17 22:58 . 2008-02-17 22:58 154,624 --a------ C:\Windows\System32\drivers\nwifi.sys
2008-02-17 22:58 . 2008-02-17 22:58 109,624 --a------ C:\Windows\System32\drivers\ataport.sys
2008-02-17 22:58 . 2008-02-17 22:58 45,112 --a------ C:\Windows\System32\drivers\pciidex.sys
2008-02-17 22:58 . 2008-02-17 22:58 21,560 --a------ C:\Windows\System32\drivers\atapi.sys
2008-02-17 22:58 . 2008-02-17 22:58 15,928 --a------ C:\Windows\System32\drivers\pciide.sys
2008-02-17 22:56 . 2008-02-17 22:56 4,247,552 --a------ C:\Windows\System32\GameUXLegacyGDFs.dll
2008-02-17 22:56 . 2008-02-17 22:56 1,686,528 --a------ C:\Windows\System32\gameux.dll
2008-02-17 22:56 . 2008-02-17 22:56 803,328 --a------ C:\Windows\System32\drivers\tcpip.sys
2008-02-17 22:56 . 2008-02-17 22:56 216,632 --a------ C:\Windows\System32\drivers\netio.sys
2008-02-17 22:56 . 2008-02-17 22:56 167,424 --a------ C:\Windows\System32\tcpipcfg.dll
2008-02-17 22:56 . 2008-02-17 22:56 24,064 --a------ C:\Windows\System32\netcfg.exe
2008-02-17 22:56 . 2008-02-17 22:56 22,016 --a------ C:\Windows\System32\netiougc.exe
2008-02-17 22:56 . 2008-02-17 22:56 11,776 --a------ C:\Windows\System32\sbunattend.exe
2008-02-17 15:38 . 2008-02-17 15:38 <DIR> d-------- C:\Windows\Avira
2008-02-17 15:38 . 2008-02-17 15:38 <DIR> d-------- C:\Program Files\Avira
2008-02-17 14:26 . 2008-02-18 14:01 <DIR> d-------- C:\Users\All Users\Spybot - Search & Destroy
2008-02-17 14:26 . 2008-02-17 21:50 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-02-17 14:26 . 2008-02-18 14:01 <DIR> d-------- C:\PROGRA~2\Spybot - Search & Destroy
2008-02-16 20:33 . 2008-02-16 20:33 <DIR> d-------- C:\Program Files\Files-Secure
2008-02-16 18:08 . 2008-02-16 18:08 50 --a------ C:\tmp.bat
2008-02-09 16:52 . 2008-02-09 16:52 <DIR> d-------- C:\Users\All Users\Google
2008-02-09 16:47 . 2008-02-09 16:52 <DIR> d-------- C:\Program Files\Google
2008-02-05 20:19 . 2008-02-16 18:12 <DIR> d-------- C:\Users\zink\AppData\Roaming\DivX
2008-02-05 20:08 . 2008-02-05 20:08 <DIR> d-------- C:\Program Files\Common Files\PX Storage Engine
2008-01-22 18:36 . 2008-02-05 20:11 <DIR> d-------- C:\Program Files\DivX

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-18 12:51 --------- d-----w C:\Program Files\Windows Mail
2008-02-18 12:50 --------- d-----w C:\Program Files\Windows Sidebar
2008-02-17 21:56 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-02-17 21:56 449,536 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-02-17 21:56 2,144,256 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-02-17 21:56 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-02-17 21:53 824,832 ----a-w C:\Windows\System32\wininet.dll
2008-02-17 21:53 56,320 ----a-w C:\Windows\System32\iesetup.dll
2008-02-17 21:53 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-02-17 21:53 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
2008-02-17 21:12 --------- d-----w C:\Users\zink\AppData\Roaming\ICQ
2008-02-16 21:11 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-01-27 20:16 --------- d-----w C:\PROGRA~2\CyberLink
2008-01-27 10:26 --------- d-----w C:\Users\zink\AppData\Roaming\Printer Info Cache
2008-01-27 10:26 --------- d-----w C:\Users\zink\AppData\Roaming\Image Zone Express
2008-01-19 14:54 --------- d-----w C:\Program Files\LiveUpdate
2008-01-19 14:53 --------- d-----w C:\Program Files\mobile PhoneTools
2008-01-19 14:52 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-19 14:52 --------- d-----w C:\PROGRA~2\BVRP Software
2008-01-05 14:33 --------- d-----w C:\Program Files\Windows Defender
2008-01-05 14:25 87,040 ----a-w C:\Windows\System32\msoert2.dll
2008-01-05 14:25 39,424 ----a-w C:\Windows\System32\ACCTRES.dll
2008-01-05 14:25 205,824 ----a-w C:\Windows\System32\msoeacct.dll
2008-01-05 14:24 704,000 ----a-w C:\Windows\System32\PhotoScreensaver.scr
2008-01-05 14:23 67,584 ----a-w C:\Windows\System32\wlanhlp.dll
2008-01-05 14:23 542,720 ----a-w C:\Windows\System32\sysmain.dll
2008-01-05 14:23 502,784 ----a-w C:\Windows\System32\wlansvc.dll
2008-01-05 14:23 47,104 ----a-w C:\Windows\System32\wlanapi.dll
2008-01-05 14:23 297,984 ----a-w C:\Windows\System32\wlansec.dll
2008-01-05 14:23 290,816 ----a-w C:\Windows\System32\wlanmsm.dll
2008-01-05 14:23 258,232 ----a-w C:\Windows\system32\drivers\acpi.sys
2008-01-05 14:23 24,064 ----a-w C:\Windows\System32\wtsapi32.dll
2008-01-05 14:23 2,923,520 ----a-w C:\Windows\explorer.exe
2008-01-05 14:23 2,027,008 ----a-w C:\Windows\System32\win32k.sys
2008-01-05 14:22 49,664 ----a-w C:\Windows\System32\csrsrv.dll
2008-01-05 14:22 376,320 ----a-w C:\Windows\System32\winsrv.dll
2008-01-05 14:18 414,208 ----a-w C:\Windows\System32\msscp.dll
2008-01-05 14:17 86,016 ----a-w C:\Windows\System32\icfupgd.dll
2008-01-05 14:17 63,488 ----a-w C:\Windows\system32\drivers\mpsdrv.sys
2008-01-05 14:17 396,800 ----a-w C:\Windows\System32\MPSSVC.dll
2008-01-05 14:17 392,192 ----a-w C:\Windows\System32\FirewallAPI.dll
2008-01-05 14:17 16,896 ----a-w C:\Windows\System32\wfapigp.dll
2008-01-05 14:16 61,952 ----a-w C:\Windows\System32\cmifw.dll
2008-01-05 14:16 23,040 ----a-w C:\Windows\system32\drivers\tunnel.sys
2008-01-05 14:16 178,688 ----a-w C:\Windows\System32\iphlpsvc.dll
2008-01-05 14:16 15,360 ----a-w C:\Windows\system32\drivers\TUNMP.SYS
2008-01-05 14:16 1,191,936 ----a-w C:\Windows\System32\msxml3.dll
2008-01-05 14:14 9,728 ----a-w C:\Windows\System32\LAPRXY.DLL
2008-01-05 14:14 223,232 ----a-w C:\Windows\System32\WMASF.DLL
2008-01-05 14:14 1,327,104 ----a-w C:\Windows\System32\quartz.dll
2008-01-05 14:10 84,992 ----a-w C:\Windows\system32\drivers\srvnet.sys
2008-01-05 14:10 58,368 ----a-w C:\Windows\system32\drivers\mrxsmb20.sys
2008-01-05 14:10 130,048 ----a-w C:\Windows\system32\drivers\srv2.sys
2008-01-05 14:10 101,888 ----a-w C:\Windows\system32\drivers\mrxsmb.sys
2008-01-05 14:05 --------- d-----w C:\Program Files\MSXML 4.0
2008-01-04 21:59 524,288 ----a-w C:\Windows\System32\DivXsm.exe
2008-01-04 21:58 3,596,288 ----a-w C:\Windows\System32\qt-dx331.dll
2008-01-04 21:58 200,704 ----a-w C:\Windows\System32\ssldivx.dll
2008-01-04 21:58 1,044,480 ----a-w C:\Windows\System32\libdivx.dll
2008-01-04 21:57 823,296 ----a-w C:\Windows\System32\divx_xx0c.dll
2008-01-04 21:57 823,296 ----a-w C:\Windows\System32\divx_xx07.dll
2008-01-04 21:57 81,920 ----a-w C:\Windows\System32\dpl100.dll
2008-01-04 21:57 802,816 ----a-w C:\Windows\System32\divx_xx11.dll
2008-01-04 21:57 682,496 ----a-w C:\Windows\System32\DivX.dll
2008-01-04 21:57 593,920 ----a-w C:\Windows\System32\dpuGUI11.dll
2008-01-04 21:57 57,344 ----a-w C:\Windows\System32\dpv11.dll
2008-01-04 21:57 53,248 ----a-w C:\Windows\System32\dpuGUI10.dll
2008-01-04 21:57 344,064 ----a-w C:\Windows\System32\dpus11.dll
2008-01-04 21:57 294,912 ----a-w C:\Windows\System32\dpu11.dll
2008-01-04 21:57 294,912 ----a-w C:\Windows\System32\dpu10.dll
2008-01-04 21:57 196,608 ----a-w C:\Windows\System32\dtu100.dll
2008-01-04 21:56 156,992 ----a-w C:\Windows\System32\DivXCodecVersionChecker.exe
2008-01-04 21:56 12,288 ----a-w C:\Windows\System32\DivXWMPExtType.dll
2008-01-04 13:18 8,147,968 ----a-w C:\Windows\System32\wmploc.DLL
2008-01-04 13:18 7,680 ----a-w C:\Windows\System32\spwmp.dll
2008-01-04 13:18 4,096 ----a-w C:\Windows\System32\dxmasf.dll
2008-01-04 13:18 356,864 ----a-w C:\Windows\System32\MediaMetadataHandler.dll
2008-01-04 13:16 57,856 ----a-w C:\Windows\System32\SLUINotify.dll
2008-01-04 13:16 566,784 ----a-w C:\Windows\System32\SLCommDlg.dll
2008-01-04 13:16 39,936 ----a-w C:\Windows\System32\slcinst.dll
2008-01-04 13:16 351,232 ----a-w C:\Windows\System32\SLUI.exe
2008-01-04 13:16 33,280 ----a-w C:\Windows\System32\slwmi.dll
2008-01-04 13:16 268,288 ----a-w C:\Windows\System32\mcbuilder.exe
2008-01-04 13:16 223,232 ----a-w C:\Windows\System32\SLC.dll
2008-01-04 13:16 2,605,568 ----a-w C:\Windows\System32\SLsvc.exe
2008-01-04 13:16 186,368 ----a-w C:\Windows\System32\SLLUA.exe
2008-01-04 13:15 84,480 ----a-w C:\Windows\System32\INETRES.dll
2008-01-04 13:15 788,992 ----a-w C:\Windows\System32\rpcrt4.dll
2008-01-04 13:15 737,792 ----a-w C:\Windows\System32\inetcomm.dll
2008-01-04 13:15 1,335,296 ----a-w C:\Windows\System32\msxml6.dll
2008-01-04 13:13 633,856 ----a-w C:\Windows\System32\user32.dll
2008-01-04 13:13 5,120 ----a-w C:\Windows\System32\wmi.dll
2008-01-04 13:13 152,576 ----a-w C:\Windows\System32\imagehlp.dll
2008-01-04 13:13 12,800 ----a-w C:\Windows\system32\drivers\fs_rec.sys
2008-01-04 13:10 750,080 ----a-w C:\Windows\System32\qmgr.dll
2007-12-29 15:50 --------- d-----w C:\Program Files\ICQ6
2007-12-29 15:44 --------- d-----w C:\Program Files\ICQToolbar
2007-12-29 15:40 --------- d-----w C:\Users\zink\AppData\Roaming\InstallShield
2007-12-29 10:47 --------- d-----w C:\Users\zink\AppData\Roaming\Panasonic
2007-12-29 10:43 --------- d-----w C:\Program Files\Panasonic
.

(((((((((((((((((((((((((((( Autostart Punkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Hinweis* leere Eintrage & legitime Standardeintrage werden nicht angezeigt.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-02-17 22:56 1232896]
"Acer Tour Reminder"="" []
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 13:34 201728]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2008-02-09 16:52 171448]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2008-01-05 15:20 1006264]
"RtHDVCpl"="RtHDVCpl.exe" [2007-02-15 10:07 4390912 C:\Windows\RtHDVCpl.exe]
"Acer Tour"="" []
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-04-06 07:21 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-04-06 07:21 8429568]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-04-06 07:21 81920]
"eRecoveryService"="" []
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 21:52 49152]
"AVMWlanClient"="C:\Program Files\avmwlanstick\FRITZWLANMini.exe" [2007-02-02 17:26 283136]
"SMSERIAL"="C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe" [2006-10-09 12:43 729088]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2007-08-31 12:25 249896]
"ISTray"="C:\Users\zink\Downloads\clrav\Spyware Doctor\pctsTray.exe" [2007-12-10 14:53 1103752]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Acer Tour Reminder"="C:\Acer\AcerTour\Reminder.exe" [2007-02-15 17:39 151552]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Reader - Schnellstart.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 03:44:06 29696]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2007-01-02 21:40:10 210520]
LUMIX Simple Viewer.lnk - C:\Program Files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe [2007-12-29 11:43:41 57344]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360]

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Empowering Technology Launcher.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Empowering Technology Launcher.lnk
backup=C:\Windows\pss\Empowering Technology Launcher.lnk.CommonStartup
backupExtension=.CommonStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acer Empowering Technology Monitor]
--a------ 2007-01-24 09:27 319488 C:\Acer\Empowering Technology\SysMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acer Tour Reminder]
--a------ 2007-02-15 17:39 151552 C:\Acer\AcerTour\Reminder.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eDataSecurity Loader]
--a------ 2007-02-06 23:04 464168 C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService]
--a------ 2007-01-12 20:24 151552 C:\Acer\Empowering Technology\eMode\PCM\PCMService.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WarReg_PopUp]
--a------ 2006-11-05 21:48 57344 C:\Acer\WR_PopUp\WarReg_PopUp.exe

R0 PSDFilter;PSDFilter;C:\Windows\system32\DRIVERS\psdfilter.sys [2007-02-06 23:04]
R0 PSDNServ;PSDNSERVER;C:\Windows\system32\drivers\PSDNServ.sys [2007-02-06 23:04]
R0 psdvdisk;psdvdisk;C:\Windows\system32\drivers\psdvdisk.sys [2007-02-06 23:04]
R2 eDataSecurity Service;eDSService.exe;"C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe" [2007-02-06 23:04]
R2 int15;int15;C:\Acer\Empowering Technology\eRecovery\int15.sys [2006-12-07 18:12]
R2 SBSDWSCService;SBSD Security Center Service;C:\Program Files\Spybot []
R3 MRV6X32P;Vista 32 Bit ursprünglicher WiFi-Treiber;C:\Windows\system32\DRIVERS\MRVW13B.sys [2006-11-02 08:30]
R3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\system32\DRIVERS\yk60x86.sys [2006-11-09 02:52]
S2 Automatisches LiveUpdate - Scheduler;Automatisches LiveUpdate - Scheduler;"C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe" []
S3 avmeject;AVM Eject;C:\Windows\system32\drivers\avmeject.sys [2007-01-26 01:00]
S3 FWLANUSB;AVM FRITZ!WLAN;C:\Windows\system32\DRIVERS\fwlanusb.sys [2007-01-26 01:00]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0ea6566b-9e75-11dc-abfe-0019210024b4}]
\shell\AutoRun\command - J:\Player\Player.exe "Diashow\Neue Diashow.ads"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4e98b984-a4c5-11dc-9d54-0019210024b4}]
\shell\AutoRun\command - J:\pushinst.exe

.
Inhalt des "geplante Tasks" Ordners
"2008-02-01 19:01:54 C:\Windows\Tasks\Norton Internet Security - Vollständige Systemprüfung ausführen - zink.job"
- c:\PROGRA~1\NORTON~1\NORTON~1\Navw32.exe
"2008-02-20 17:23:13 C:\Windows\Tasks\WebReg Deskjet F300 series.job"
- C:\Program Files\HP\Digital Imaging\bin\hpqwrg.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-20 20:17:28
Windows 6.0.6000 NTFS

detected NTDLL code modification:
ZwClose

Scanne versteckte Prozesse...

Scanne versteckte Autostart Einträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
Zeit der Fertigstellung: 2008-02-20 20:19:31
.
2008-02-18 13:06:52 --- E O F ---

Poste mal bitte den SpyDoctor Bericht. Denn im combofix log sind noch schädliche Dateien zu sehen..