Bitte benutze ComboFix! ich habe mich vertan...

hallo,
bitte das umsetzen, was ich gepostet habe.

Danke boston! Ich kenn mich mit ComboFix und VundoFix usw nicht so gut aus und wollte es deshalb erstmal so probieren ^.^
PS: meine anleitung war noch nicht fertig.

was nun? zuerst??

DANKE FÜR EURE BEMÜHUNGEN, ABER WAS ZUERST:aplaus:

combofix,
dann vundofix,
so wie ich es gepostet habe.

ok, wollte erst mal beides runterladen: dann blockiert mein bitdefender vutofix??? also kann ichs nicht nutzen (selbst als ich ihn ausgeschalten habe!)

???

Vutofix ? Das heißt Vundofix.
Solltest Du Vutofix runtergeladen haben , sofort runter.
Probiere es erst mal mit Combofix.
Was sagt dein Bitdefender zu Combofix ?

meinte ich ja ^^,

combofix log>>>>>>


ComboFix 08-03-05.3 - Jemall 2008-03-06 20:49:55.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1031.18.1207 [GMT 1:00]
ausgeführt von:: C:\Users\Jemall\Desktop\ComboFix.exe
* Neuer Wiederherstellungspunkt wurde erstellt
.

(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Windows\system32\awtuu.dll
C:\Windows\system32\mljgecb.dll
C:\Windows\system32\nnnoo.dll
C:\Windows\System32\uutwa.ini
C:\Windows\System32\uutwa.ini2
C:\Windows\system32\vqlkxjel.dll

.
((((((((((((((((((((((( Dateien erstellt von 2008-02-06 bis 2008-03-06 ))))))))))))))))))))))))))))))
.

2008-03-06 19:39 . 2008-03-06 20:00 <DIR> d----c--- C:\HiJackThis
2008-03-06 19:27 . 1998-07-30 17:41 306,688 --a--c--- C:\Windows\IsUn0407.exe
2008-03-06 19:14 . 1996-02-08 17:06 284,160 --a--c--- C:\Windows\unin0407.exe
2008-03-06 18:59 . 2008-03-06 20:55 <DIR> d----c--- C:\Program Files\a-squared Anti-Malware
2008-03-06 04:26 . 1998-07-30 12:51 305,152 --a--c--- C:\Windows\IsUninst.exe
2008-03-06 04:26 . 2000-12-06 00:00 209,608 --a--c--- C:\Windows\System32\TABCTL32.OCX
2008-03-06 04:26 . 2001-04-18 11:32 205,848 --a--c--- C:\Windows\System32\Threed32.ocx
2008-03-06 04:26 . 2000-02-02 22:07 140,288 --a--c--- C:\Windows\System32\comdlg32.ocx
2008-03-06 04:26 . 2000-12-06 00:00 109,248 --a--c--- C:\Windows\System32\MSWINSCK.OCX
2008-03-06 04:26 . 2000-07-15 00:00 101,888 --a--c--- C:\Windows\System32\VB6STKIT.DLL
2008-03-05 19:17 . 2008-03-05 19:17 <DIR> d----c--- C:\Users\Jemall\AppData\Roaming\teamspeak2
2008-03-05 19:17 . 2008-03-05 19:17 <DIR> d----c--- C:\Program Files\Teamspeak2_RC2
2008-03-05 19:17 . 2008-03-05 19:17 34,064 --a--c--- C:\Windows\System32\lhacm.acm
2008-03-05 17:00 . 2008-03-05 17:00 <DIR> d----c--- C:\Windows\System32\URTTEMP
2008-03-04 22:17 . 2008-03-04 22:17 <DIR> d----c--- C:\Users\Jemall\AppData\Roaming\InstallShield Installation Information
2008-03-04 18:22 . 2008-03-05 16:13 <DIR> d----c--- C:\Users\Jemall\AppData\Roaming\Hamachi
2008-03-04 18:21 . 2008-03-04 18:21 25,280 --a--c--- C:\Windows\System32\drivers\hamachi.sys
2008-03-04 17:47 . 2008-03-04 17:47 <DIR> d----c--- C:\Windows\45235788142C44BE8A4DDDE9A84492E5.TMP
2008-03-04 15:55 . 2008-03-04 15:55 <DIR> d----c--- C:\Users\Jemall\AppData\Roaming\PeerNetworking
2008-03-04 15:31 . 2008-03-04 15:31 <DIR> d----c--- C:\Program Files\Common Files\Steam
2008-03-03 14:55 . 2008-03-03 14:55 <DIR> d----c--- C:\Users\All Users\ATI
2008-03-03 14:55 . 2008-03-03 14:55 <DIR> d----c--- C:\ProgramData\ATI
2008-03-03 13:43 . 2008-03-03 13:43 <DIR> d----c--- C:\Windows\System32\AGEIA
2008-03-03 13:43 . 2008-03-03 13:43 <DIR> d----c--- C:\Program Files\AGEIA Technologies
2008-03-03 12:50 . 2008-03-03 12:51 6,113,439 --a--c--- C:\Users\Jemall\pci_filerecovery.exe
2008-03-01 11:24 . 2008-03-01 11:24 285 --a--c--- C:\Windows\game.ini
2008-02-29 18:14 . 2008-02-29 18:14 54 --a--c--- C:\Windows\wininit.ini
2008-02-29 17:58 . 2008-02-29 17:58 <DIR> d--h-c--- C:\Windows\PIF
2008-02-27 21:18 . 2008-03-03 14:10 <DIR> d----c--- C:\Users\Jemall\AppData\Roaming\Bioshock
2008-02-25 15:14 . 2008-02-25 15:14 <DIR> d----c--- C:\Windows\TweakVI
2008-02-25 15:14 . 2008-02-25 15:14 0 --a--c--- C:\Windows\System32\tviresource.val
2008-02-23 09:44 . 2008-02-23 13:27 <DIR> d----c--- C:\stalker
2008-02-22 10:13 . 2008-02-22 10:13 <DIR> d----c--- C:\Users\All Users\Adobe
2008-02-22 10:12 . 2008-02-22 10:13 <DIR> d----c--- C:\Program Files\Common Files\Adobe
2008-02-20 19:33 . 2008-03-06 20:45 <DIR> d----c--- C:\Program Files\Intelore
2008-02-18 19:49 . 2008-02-18 19:49 <DIR> d----c--- C:\Users\Jemall\AppData\Roaming\TuneUp Software
2008-02-18 19:49 . 2008-02-18 19:49 307,968 --a--c--- C:\Windows\System32\TuneUpDefragService.exe
2008-02-18 19:49 . 2008-02-18 04:32 28,416 --a--c--- C:\Windows\System32\uxtuneup.dll
2008-02-18 19:49 . 2008-02-18 04:32 16,640 --a--c--- C:\Windows\System32\authuitu.dll
2008-02-18 19:48 . 2008-02-18 19:48 <DIR> d----c--- C:\Users\All Users\TuneUp Software
2008-02-18 19:48 . 2008-02-18 19:48 <DIR> d----c--- C:\ProgramData\TuneUp Software
2008-02-18 19:48 . 2008-02-18 19:49 <DIR> d----c--- C:\Program Files\TuneUp Utilities 2008
2008-02-18 19:47 . 2008-03-04 17:47 <DIR> d----c--- C:\Program Files\Common Files\Wise Installation Wizard
2008-02-18 18:22 . 2008-02-18 18:22 <DIR> d----c--- C:\Users\Jemall\AppData\Roaming\Auslogics
2008-02-18 18:21 . 2008-02-18 18:21 <DIR> d----c--- C:\Program Files\Auslogics
2008-02-16 20:20 . 2008-02-16 20:20 1,892,120 --a--c--- C:\Windows\System32\AutoPartNt.exe
2008-02-16 20:20 . 2008-02-16 20:21 1,024 --a------ C:\Windows\System32\AutoPartNt.let
2008-02-16 20:07 . 2008-02-16 20:07 <DIR> d----c--- C:\Users\All Users\Acronis
2008-02-16 20:07 . 2008-02-16 20:07 <DIR> d----c--- C:\ProgramData\Acronis
2008-02-16 20:07 . 2008-02-16 20:07 441,760 --a--c--- C:\Windows\System32\drivers\timntr.sys
2008-02-16 20:07 . 2008-02-16 20:07 368,480 --a--c--- C:\Windows\System32\drivers\tdrpman.sys
2008-02-16 20:07 . 2008-02-16 20:07 129,248 --a--c--- C:\Windows\System32\drivers\snapman.sys
2008-02-16 20:07 . 2008-02-16 20:07 44,384 --a--c--- C:\Windows\System32\drivers\tifsfilt.sys
2008-02-16 19:32 . 2008-02-16 19:32 <DIR> d----c--- C:\Program Files\Common Files\Acronis
2008-02-16 19:32 . 2008-02-16 19:32 <DIR> d----c--- C:\Program Files\Acronis
2008-02-16 12:52 . 2008-01-10 06:50 1,244,672 --a--c--- C:\Windows\System32\mcmde.dll
2008-02-15 18:27 . 2008-02-15 18:27 21,504 --a--c--- C:\Windows\jestertb.dll
2008-02-15 18:25 . 2008-02-29 18:13 <DIR> d----c--- C:\Program Files\PCGH
2008-02-14 00:29 . 2008-02-14 00:29 194,560 --a------ C:\Windows\System32\WebClnt.dll
2008-02-14 00:29 . 2008-02-14 00:29 110,080 --a------ C:\Windows\System32\drivers\mrxdav.sys
2008-02-14 00:27 . 2008-02-14 00:27 3,504,696 --a------ C:\Windows\System32\ntkrnlpa.exe
2008-02-14 00:27 . 2008-02-14 00:27 3,470,392 --a------ C:\Windows\System32\ntoskrnl.exe
2008-02-14 00:27 . 2008-02-14 00:27 109,624 --a--c--- C:\Windows\System32\drivers\ataport.sys
2008-02-14 00:27 . 2008-02-14 00:27 45,112 --a--c--- C:\Windows\System32\drivers\pciidex.sys
2008-02-14 00:27 . 2008-02-14 00:27 21,560 --a--c--- C:\Windows\System32\drivers\atapi.sys
2008-02-14 00:27 . 2008-02-14 00:27 17,464 --a--c--- C:\Windows\System32\drivers\intelide.sys
2008-02-14 00:26 . 2008-02-14 00:26 4,247,552 --a------ C:\Windows\System32\GameUXLegacyGDFs.dll
2008-02-14 00:26 . 2008-02-14 00:26 1,686,528 --a------ C:\Windows\System32\gameux.dll
2008-02-14 00:26 . 2008-02-14 00:26 803,328 --a------ C:\Windows\System32\drivers\tcpip.sys
2008-02-14 00:26 . 2008-02-14 00:26 216,632 --a------ C:\Windows\System32\drivers\netio.sys
2008-02-14 00:26 . 2008-02-14 00:26 167,424 --a------ C:\Windows\System32\tcpipcfg.dll
2008-02-14 00:26 . 2008-02-14 00:26 154,624 --a------ C:\Windows\System32\drivers\nwifi.sys
2008-02-14 00:26 . 2008-02-14 00:26 24,064 --a------ C:\Windows\System32\netcfg.exe
2008-02-14 00:26 . 2008-02-14 00:26 22,016 --a------ C:\Windows\System32\netiougc.exe
2008-02-13 21:53 . 2007-11-14 12:42 113,168 --a--c--- C:\Windows\System32\drivers\vdrv9000.sys
2008-02-13 21:53 . 2006-09-20 11:42 11,392 --a--c--- C:\Windows\System32\drivers\HH9Help.sys
2008-02-13 21:52 . 2008-03-06 19:33 <DIR> d---sc--- C:\Users\Public\Virtual CDs
2008-02-13 21:52 . 2008-02-13 21:54 <DIR> d---sc--- C:\Users\Public\Virtual CD v9
2008-02-13 21:52 . 2008-02-13 21:54 <DIR> d---sc--- C:\Users\Jemall\Virtual CD v9
2008-02-13 21:52 . 2008-02-13 21:52 <DIR> d----c--- C:\Program Files\Virtual CD v9
2008-02-13 21:52 . 2007-04-16 13:58 1,097,728 --a--c--- C:\Windows\System32\NMSDVDX.dll
2008-02-13 21:52 . 2003-07-24 17:01 1,044,480 -----c--- C:\Windows\System32\ROBOEX32.DLL
2008-02-11 22:12 . 1995-08-15 01:00 721,168 --a--c--- C:\Windows\System32\VB40032.DLL
2008-02-11 22:12 . 1998-06-24 01:00 203,576 --a--c--- C:\Windows\System32\RICHTX32.OCX
2008-02-11 22:12 . 1995-08-15 01:00 35,648 --a--c--- C:\Windows\System32\VB4DE32.DLL
2008-02-11 22:11 . 2008-02-11 22:11 796,672 --a--c--- C:\Windows\GPInstall.exe
2008-02-11 22:11 . 1999-10-23 21:59 9,271 --a--c--- C:\Windows\Port_DE.gpl
2008-02-10 21:43 . 1999-03-17 18:20 183,296 -----c--- C:\Windows\Res2_uninst.exe
2008-02-09 01:09 . 2008-02-29 18:14 <DIR> d----c--- C:\Windows\uninstall\ResidentEvil3SaveGameEditor
2008-02-09 01:09 . 2008-02-09 01:09 <DIR> d----c--- C:\Windows\uninstall
2008-02-08 18:59 . 2008-02-08 18:59 0 --a--c--- C:\Windows\DXT6CD8.tmp
2008-02-08 18:59 . 2008-02-08 18:59 0 --a--c--- C:\Windows\DXT6C99.tmp
2008-02-08 18:59 . 2008-02-08 18:59 0 --a--c--- C:\Windows\DXT6C88.tmp
2008-02-08 18:59 . 2008-02-08 18:59 0 --a--c--- C:\Windows\DXT6C78.tmp
2008-02-08 18:08 . 2008-02-09 23:26 <DIR> d----c--- C:\Users\Jemall\AppData\Roaming\FinalBurner DATA
2008-02-08 16:06 . 2008-02-08 16:06 49 --a--c--- C:\Windows\dc_jill.INI
2008-02-08 15:40 . 2008-02-08 15:40 510 --a--c--- C:\Windows\WORDPAD.INI
2008-02-07 17:52 . 2008-02-07 17:52 <DIR> d----c--- C:\Users\Jemall\AppData\Roaming\FinalBurner Video DVD
2008-02-07 17:52 . 2008-02-07 17:52 <DIR> d----c--- C:\finalburner
2008-02-07 16:23 . 2008-02-07 16:23 <DIR> d----c--- C:\Program Files\FinalBurner

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-06 19:49 81,984 -c--a-w C:\Windows\System32\bdod.bin
2008-03-06 15:56 --------- dc----w C:\ProgramData\SecTaskMan
2008-03-04 18:15 --------- dc----w C:\Program Files\ATI
2008-03-04 17:03 --------- dc-h--w C:\Program Files\InstallShield Installation Information
2008-03-04 14:37 --------- dc----w C:\ProgramData\Media Center Programs
2008-03-03 13:54 --------- dc----w C:\Program Files\ATI Technologies
2008-03-02 23:58 --------- dc----w C:\Program Files\Futuremark
2008-03-02 23:32 --------- dc----w C:\Program Files\Common Files\InstallShield
2008-02-21 16:31 --------- dc----w C:\Program Files\ICQ6
2008-02-20 16:56 107,888 -c--a-w C:\Windows\System32\CmdLineExt.dll
2008-02-13 23:26 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-02-13 23:26 449,536 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-02-13 23:26 2,144,256 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-02-13 23:26 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-02-13 23:24 824,832 ----a-w C:\Windows\System32\wininet.dll
2008-02-13 23:24 56,320 ----a-w C:\Windows\System32\iesetup.dll
2008-02-13 23:24 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-02-13 23:24 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
2008-02-06 16:43 --------- dc--a-w C:\ProgramData\TEMP
2008-02-05 19:39 --------- dc----w C:\Program Files\Common Files\AVSMedia
2008-02-05 19:39 --------- dc----w C:\Program Files\AVSMedia
2008-02-05 02:15 --------- dc----w C:\Program Files\Windows Journal
2008-02-04 23:00 --------- dc----w C:\Program Files\Java
2008-02-04 22:59 --------- dc----w C:\Program Files\Common Files\Java
2008-02-04 21:46 --------- dc----w C:\Program Files\Lavalys
2008-02-04 21:44 229,888 ----a-w C:\Windows\System32\msshsq.dll
2008-02-04 19:26 278,984 -c--a-w C:\Windows\system32\drivers\atksgt.sys
2008-02-04 19:26 25,416 -c--a-w C:\Windows\system32\drivers\lirsgt.sys
2008-02-04 18:49 --------- dc----w C:\Program Files\Intel
2008-02-04 18:40 621,056 ----a-w C:\Windows\system32\drivers\dxgkrnl.sys
2008-02-04 18:40 36,864 ----a-w C:\Windows\System32\cdd.dll
2008-02-04 18:36 22,328 -c--a-w C:\Users\Jemall\AppData\Roaming\PnkBstrK.sys
2008-02-04 18:31 --------- dc----w C:\Program Files\Realtek
2008-02-04 18:20 --------- dc----w C:\Users\Jemall\AppData\Roaming\BitDefender
2008-02-04 18:20 --------- dc----w C:\ProgramData\BitDefender
2008-02-04 18:18 --------- dc----w C:\Program Files\Common Files\BitDefender
2008-02-04 18:18 --------- dc----w C:\Program Files\BitDefender
2008-02-04 18:00 --------- dc----w C:\Program Files\RivaTuner v2.06
2008-02-04 17:56 174 --sha-w C:\Program Files\desktop.ini
2008-02-04 17:53 --------- dc----w C:\Program Files\Windows Defender
2008-02-04 17:53 --------- dc----w C:\Program Files\Windows Calendar
2008-02-04 17:51 704,000 ----a-w C:\Windows\System32\PhotoScreensaver.scr
2008-02-04 17:51 67,584 ----a-w C:\Windows\System32\wlanhlp.dll
2008-02-04 17:51 542,720 ----a-w C:\Windows\System32\sysmain.dll
2008-02-04 17:51 502,784 ----a-w C:\Windows\System32\wlansvc.dll
2008-02-04 17:51 47,104 ----a-w C:\Windows\System32\wlanapi.dll
2008-02-04 17:51 297,984 ----a-w C:\Windows\System32\wlansec.dll
2008-02-04 17:51 290,816 ----a-w C:\Windows\System32\wlanmsm.dll
2008-02-04 17:51 258,232 -c--a-w C:\Windows\system32\drivers\acpi.sys
2008-02-04 17:51 24,064 ----a-w C:\Windows\System32\wtsapi32.dll
2008-02-04 17:51 2,923,520 ----a-w C:\Windows\explorer.exe
2008-02-04 17:51 2,027,008 ----a-w C:\Windows\System32\win32k.sys
2008-02-04 17:50 374,456 ----a-w C:\Windows\System32\mcupdate_GenuineIntel.dll
2008-02-04 17:49 8,147,968 ----a-w C:\Windows\System32\wmploc.DLL
2008-02-04 17:49 7,680 ----a-w C:\Windows\System32\spwmp.dll
2008-02-04 17:49 414,208 ----a-w C:\Windows\System32\msscp.dll
2008-02-04 17:49 4,096 ----a-w C:\Windows\System32\dxmasf.dll
2008-02-04 17:49 356,864 ----a-w C:\Windows\System32\MediaMetadataHandler.dll
2008-02-04 17:49 104,448 ----a-w C:\Windows\System32\DWWIN.EXE
2008-02-04 17:48 8,704 -c--a-w C:\Windows\System32\hcrstco.dll
2008-02-04 17:48 8,704 -c--a-w C:\Windows\System32\hccoin.dll
2008-02-04 17:48 73,216 -c--a-w C:\Windows\system32\drivers\usbccgp.sys
2008-02-04 17:48 5,888 -c--a-w C:\Windows\system32\drivers\usbd.sys
2008-02-04 17:48 38,400 -c--a-w C:\Windows\system32\drivers\usbehci.sys
2008-02-04 17:48 23,040 -c--a-w C:\Windows\system32\drivers\usbuhci.sys
2008-02-04 17:48 224,768 -c--a-w C:\Windows\system32\drivers\usbport.sys
2008-02-04 17:48 192,000 -c--a-w C:\Windows\system32\drivers\usbhub.sys
2008-02-04 17:47 57,856 ----a-w C:\Windows\System32\SLUINotify.dll
2008-02-04 17:47 566,784 ----a-w C:\Windows\System32\SLCommDlg.dll
2008-02-04 17:47 39,936 ----a-w C:\Windows\System32\slcinst.dll
2008-02-04 17:47 351,232 ----a-w C:\Windows\System32\SLUI.exe
2008-02-04 17:47 33,280 ----a-w C:\Windows\System32\slwmi.dll
2008-02-04 17:47 268,288 ----a-w C:\Windows\System32\mcbuilder.exe
2008-02-04 17:47 223,232 ----a-w C:\Windows\System32\SLC.dll
2008-02-04 17:47 2,605,568 ----a-w C:\Windows\System32\SLsvc.exe
2008-02-04 17:47 186,368 ----a-w C:\Windows\System32\SLLUA.exe
2008-02-04 17:45 53,760 -c--a-w C:\Windows\system32\drivers\hdaudbus.sys
2008-02-04 17:44 974,336 ----a-w C:\Windows\System32\crypt32.dll
2008-02-04 17:44 750,080 ----a-w C:\Windows\System32\qmgr.dll
2008-02-04 17:42 9,728 ----a-w C:\Windows\System32\LAPRXY.DLL
2008-02-04 17:42 223,232 ----a-w C:\Windows\System32\WMASF.DLL
2008-02-04 17:40 1,327,104 ----a-w C:\Windows\System32\quartz.dll
2008-02-04 17:39 84,992 ----a-w C:\Windows\system32\drivers\srvnet.sys
2008-02-04 17:39 58,368 ----a-w C:\Windows\system32\drivers\mrxsmb20.sys
2008-02-04 17:39 130,048 ----a-w C:\Windows\system32\drivers\srv2.sys
2008-02-04 17:39 101,888 ----a-w C:\Windows\system32\drivers\mrxsmb.sys
2008-02-04 17:38 788,992 ----a-w C:\Windows\System32\rpcrt4.dll
2008-02-04 17:37 84,480 ----a-w C:\Windows\System32\INETRES.dll
2008-02-04 17:37 737,792 ----a-w C:\Windows\System32\inetcomm.dll
2008-02-04 17:31 1,335,296 ----a-w C:\Windows\System32\msxml6.dll
2008-02-04 17:30 1,191,936 ----a-w C:\Windows\System32\msxml3.dll
2008-02-04 17:29 86,016 ----a-w C:\Windows\System32\icfupgd.dll
2008-02-04 17:29 63,488 ----a-w C:\Windows\system32\drivers\mpsdrv.sys
2008-02-04 17:29 61,952 ----a-w C:\Windows\System32\cmifw.dll
2008-02-04 17:29 396,800 ----a-w C:\Windows\System32\MPSSVC.dll
2008-02-04 17:29 392,192 ----a-w C:\Windows\System32\FirewallAPI.dll
2008-02-04 17:29 23,040 ----a-w C:\Windows\system32\drivers\tunnel.sys
2008-02-04 17:29 178,688 ----a-w C:\Windows\System32\iphlpsvc.dll
2008-02-04 17:29 16,896 ----a-w C:\Windows\System32\wfapigp.dll
2008-02-04 17:29 15,360 ----a-w C:\Windows\system32\drivers\TUNMP.SYS
.

(((((((((((((((((((((((((((( Autostart Punkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4

2. TEIL


REGEDIT4
*Hinweis* leere Eintrage & legitime Standardeintrage werden nicht angezeigt.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 13:35 125440]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BitDefender Antiphishing Helper"="C:\Program Files\BitDefender\BitDefender 2008\IEShow.exe" [2007-10-09 15:46 61440]
"BDAgent"="C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe" [2007-11-16 16:37 319488]
"RtHDVCpl"="RtHDVCpl.exe" [2006-12-29 19:11 4317184 C:\Windows\RtHDVCpl.exe]
"JMB36X IDE Setup"="C:\Windows\JM\JMInsIDE.exe" [2006-10-30 20:44 36864]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 12:35 90112]
"a-squared"="C:\Program Files\a-squared Anti-Malware\a2guard.exe" [2008-01-07 17:56 1816208]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{FBD29C3C-C642-4843-A627-6E54A947B511}"= C:\Windows\system32\nnnoo.dll [ ]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 relog_ap

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^SpeedFan.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SpeedFan.lnk
backup=C:\Windows\pss\SpeedFan.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^Users^Jemall^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^EVEREST Ultimate Edition.lnk]
path=C:\Users\Jemall\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EVEREST Ultimate Edition.lnk
backup=C:\Windows\pss\EVEREST Ultimate Edition.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acronis Scheduler2 Service]
--a--c--- 2007-12-03 11:06 140568 C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AcronisTimounterMonitor]
--a--c--- 2007-12-03 11:09 911184 C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a--c--- 2008-01-11 22:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
--a--c--- 2007-09-18 15:16 171464 C:\Program Files\DAEMON Tools\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RivaTunerStartupDaemon]
--a--c--- 2007-10-30 19:05 2650112 C:\Program Files\RivaTuner v2.06\RivaTuner.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
--a--c--- 2008-03-04 15:29 1266936 C:\Games\Steam\Steam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TrueImageMonitor.exe]
--a--c--- 2007-12-03 11:42 2622104 C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VC9Player]
--a--c--- 2007-12-03 14:03 197952 C:\Program Files\Virtual CD v9\System\VC9Play.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-2311767764-3581073868-3832261064-1000]
"EnableNotificationsRef"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{6A6CABB3-A18B-4C9F-92A0-34F569CA3109}"= UDP:C:\Games\Crytek\Crysis\Bin32\Crysis.exe:Crysis_32
"{FCB9A2F2-94A3-4830-AEBF-15484520E487}"= TCP:C:\Games\Crytek\Crysis\Bin32\Crysis.exe:Crysis_32
"{EF58BAF3-5528-459D-8E94-328CD83760ED}"= UDP:C:\Games\Crytek\Crysis\Bin32\CrysisDedicatedServer.exe:CrysisDedicatedServer_32
"{71F055F8-A90E-41F0-B1C0-FB5AEDD07A96}"= TCP:C:\Games\Crytek\Crysis\Bin32\CrysisDedicatedServer.exe:CrysisDedicatedServer_32
"{6DD98047-FA0D-4169-99F8-7E9A602F6B8C}"= UDP:C:\Windows\System32\PnkBstrA.exe:PnkBstrA
"{8A63A224-04C1-42B8-9392-F47DD02B590C}"= TCP:C:\Windows\System32\PnkBstrA.exe:PnkBstrA
"{2962165C-728E-421F-9EC2-949C755EFF15}"= UDP:C:\Windows\System32\PnkBstrB.exe:PnkBstrB
"{CB1E6CC8-8146-4AE5-AC38-1E73999420DC}"= TCP:C:\Windows\System32\PnkBstrB.exe:PnkBstrB
"{5298F613-73ED-45BC-82EB-4003AF8CE73B}"= UDP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
"{ECD9591E-85D2-4C55-9E54-473663976676}"= TCP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
"{1EE77B02-7F4A-49D9-9719-790CC9155555}"= UDP:C:\Games\Stranglehold\Binaries\Retail-Stranglehold.exe:Stranglehold
"{05016ED1-2A2A-4916-ABC7-3C4B52F44E52}"= TCP:C:\Games\Stranglehold\Binaries\Retail-Stranglehold.exe:Stranglehold
"{61EAA688-A091-49AA-AA63-B5C30D92ADAA}"= UDP:C:\Games\QUAKE Wars Demo 2\etqw.exe:Enemy Territory - QUAKE Wars(TM) Demo 2
"{8F759B43-F8E6-44BA-B7E0-03E58E01FE37}"= TCP:C:\Games\QUAKE Wars Demo 2\etqw.exe:Enemy Territory - QUAKE Wars(TM) Demo 2
"{BD0CA12B-AAEA-489A-A667-C1C17FA6E583}"= UDP:C:\Games\QUAKE Wars Demo 2\etqwded.exe:etqwded.exe
"{E4C04631-E331-44F5-9B5A-321618EA6E8B}"= TCP:C:\Games\QUAKE Wars Demo 2\etqwded.exe:etqwded.exe
"{1BB180EB-6D31-468C-8574-F79BFDDAA932}"= UDP:C:\Games\Steam\Steam.exe:Steam Client
"{423B0F13-972B-470C-BF41-D41B304BD2BE}"= TCP:C:\Games\Steam\Steam.exe:Steam Client
"{7505552B-B347-4134-AE01-07565A4E4304}"= UDP:C:\Games\Steam\SteamApps\common\Lost Planet Extreme Condition\LostPlanetDx10.exe:LostPlanetDX10
"{FDE69E41-DDC5-4A52-A0A5-0ECEB44BC3A9}"= TCP:C:\Games\Steam\SteamApps\common\Lost Planet Extreme Condition\LostPlanetDx10.exe:LostPlanetDX10
"{07C4743F-6CF0-45FD-855E-4B79EAE75280}"= UDP:C:\Games\Steam\SteamApps\common\Lost Planet Extreme Condition\LostPlanetDx9.exe:LostPlanetDX9
"{9580D6C4-FF4F-41D0-8089-980A72276121}"= TCP:C:\Games\Steam\SteamApps\common\Lost Planet Extreme Condition\LostPlanetDx9.exe:LostPlanetDX9
"{BE14EDBC-286E-4841-9701-2C51497F7D9F}"= UDP:C:\Games\Sid Meier's Civilization 4 Complete\Civilization4.exe:Sid Meier's Civilization 4 Complete
"{E585305F-551F-49A7-A292-1FF7F046CA50}"= TCP:C:\Games\Sid Meier's Civilization 4 Complete\Civilization4.exe:Sid Meier's Civilization 4 Complete
"{C114C0C2-90CE-4E04-8D8C-09C74FFD61AD}"= UDP:C:\Games\Sid Meier's Civilization 4 Complete\Warlords\Civ4Warlords.exe:Sid Meier's Civilization 4: Warlords
"{106A41BF-1A95-42B3-9FD9-A66EC24273B8}"= TCP:C:\Games\Sid Meier's Civilization 4 Complete\Warlords\Civ4Warlords.exe:Sid Meier's Civilization 4: Warlords
"{D7BA9BCF-EFFE-4B0B-93D9-494F17E3632F}"= UDP:C:\Games\Sid Meier's Civilization 4 Complete\Beyond the Sword\Civ4BeyondSword.exe:Sid Meier's Civilization 4: Beyond the Sword
"{33D24AED-A23C-40F5-B004-A6858404B18F}"= TCP:C:\Games\Sid Meier's Civilization 4 Complete\Beyond the Sword\Civ4BeyondSword.exe:Sid Meier's Civilization 4: Beyond the Sword
"{7657AAC0-99E6-400B-92EF-43603A7912A9}"= UDP:C:\Games\Unreal Tournament 3 Demo\Binaries\UT3Demo.exe:Unreal Tournament 3 Demo
"{2D6519F0-AF7B-4E74-859D-E47C125BA7BE}"= TCP:C:\Games\Unreal Tournament 3 Demo\Binaries\UT3Demo.exe:Unreal Tournament 3 Demo

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

R0 tdrpman;Acronis Try&Decide and Restore Points filter;C:\Windows\system32\DRIVERS\tdrpman.sys [2008-02-16 20:07]
R1 vdrv9000;vdrv9000;C:\Windows\system32\DRIVERS\vdrv9000.sys [2007-11-14 12:42]
R2 TryAndDecideService;Acronis Try And Decide Service;"C:\Program Files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe" [2007-12-03 12:01]
R2 UxTuneUp;TuneUp Designerweiterung;C:\Windows\System32\svchost.exe [2006-11-02 10:45]
R2 VC9SecS;Virtual CD v9 Management Service;C:\Program Files\Virtual CD v9\System\vc9secs.exe [2007-12-03 14:03]
R3 atikmdag;atikmdag;C:\Windows\system32\DRIVERS\atikmdag.sys [2008-01-22 22:39]
R3 physX32;physX32;C:\Windows\system32\DRIVERS\physX32.sys [2007-09-13 07:43]
R3 RTL8187;Realtek RTL8187 Wireless 802.11g 54Mbps USB 2.0 Network Adapter;C:\Windows\system32\DRIVERS\RTL8187.sys [2006-12-13 02:32]
R3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\system32\DRIVERS\yk60x86.sys [2007-12-06 09:51]
S3 HH9Help.sys;HH9Help.sys;C:\Windows\system32\drivers\HH9Help.sys [2006-09-20 11:42]
S3 Steam Client Service;Steam Client Service;C:\Program Files\Common Files\Steam\SteamService.exe [2008-03-04 15:31]
S3 TuneUp.Defrag;TuneUp Drive Defrag-Dienst;C:\Windows\System32\TuneUpDefragService.exe [2008-02-18 19:49]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bdx REG_MULTI_SZ scan

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2248bb13-d322-11dc-bcfa-806e6f6e6963}]
\shell\AutoRun\command - E:\AutoRunCD.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b14b822f-d580-11dc-b866-0018f3e02adb}]
\shell\AutoRun\command - F:\autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d7ffedff-da50-11dc-88d9-0018f3e02adb}]
\shell\AutoRun\command - H:\autorun.exe

.
Inhalt des "geplante Tasks" Ordners
"2008-03-06 19:55:01 C:\Windows\Tasks\1-Klick-Wartung.job"
- C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-06 20:55:44
Windows 6.0.6000 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostart Einträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Windows\system32\Ati2evxx.exe
C:\Windows\system32\Ati2evxx.exe
C:\Program Files\a-squared Anti-Malware\a2service.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Windows\ehome\ehmsas.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2008-03-06 20:58:11 - machine was rebooted
ComboFix-quarantined-files.txt 2008-03-06 19:58:07
.
2008-03-06 15:36:11 --- E O F ---

da arbeiten wir morgen noch weiter dran...für mich sieht das nicht gut aus

hmmmm... ok!!!
also Vundofix kann ich nicht runterladen, sofort in quarantäne!!


OMG ICH HONK!!! abgesichter modus??

Zitat von Jemall

ok, wollte erst mal beides runterladen: dann blockiert mein bitdefender vutofix??? also kann ichs nicht nutzen (selbst als ich ihn ausgeschalten habe!)

???

ich kann dein problem auch mangels bitdefender nicht nachvollziehen,
aber es spricht nichts dagegen, bitdefender für die dauer des vundofix-scans
runterzuschmeißen.

EDIT: bitte nach dem scan ein neues hijackthis-log.

also hat geklappt (hab bitdefender kurz runtergeworfen!) hier ist mein neuer LOG:>>>>

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:42:15, on 07.03.2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16609)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\RtHDVCpl.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Virtual CD v9\System\VC9Play.exe
C:\Program Files\Virtual CD v9\System\VC9Tray.exe
C:\Program Files\BitDefender\BitDefender 2008\seccenter.exe
C:\Program Files\BitDefender\BitDefender 2008\uiscan.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\HiJackThis\ABC.COM.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.daemonsearch.com/intl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2008\IEToolbar.dll
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\Windows\JM\JMInsIDE.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2008\IEShow.exe"
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe"
O4 - HKLM\..\Run: [MSConfig] "C:\Windows\system32\msconfig.exe" /auto
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O13 - Gopher Prefix:
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Malware\a2service.exe
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender S.R.L. - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: Acronis Try And Decide Service (TryAndDecideService) - Unknown owner - C:\Program Files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe
O23 - Service: Virtual CD v9 Management Service (VC9SecS) - H+H Software GmbH - C:\Program Files\Virtual CD v9\System\vc9secs.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S.R.L. - C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - BitDefender - C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe

--
End of file - 5003 bytes





IS GLAUB ICH KÜRZER ODER??
üprigens "a-Squared Anti Malware", hat auch noch paa Sachen gefunden (jedoch keine Vundo)

GOTT SEI DANK IS MEI PC WIEDER SCHNELLER!!! (ich wart noch kurz mit dem Bedanken; könnte dann länger werden!! )

das log ist sauber, allerdings solltest du java updaten.
dazu die alte version bei systemsteuerung/software deinstallieren
und hier die neue version herunterladen.
Java Runtime Environment - Download - CHIP Online

a-squared funde bitte posten.
und ich hatte dich auch um das vundofix-ergebnis vundofix.txt gebeten.

Ok, mach ich!!


A-squared log ist irgendwie keine txt datei sondern eine "db3-Datei"??

und bei der Vundofix Log is nich viel dabei rausgekommen!!!
>>>>

VundoFix V7.0.0

Scan started at 21:21:12 06.03.2008

Listing files found while scanning....

No infected files were found.


Beginning removal...