Hallo,
Also das Problem ist, dass mein PC immer nach einer minute Neu startet, wenn ich ihn Hochfahre. (Die Datei lsll/lsasrv.dll[Bin nicht mehr genau sicher, welche der beiden] wird beendet und dann läuft der Minuten-CountDown)

Das Problem trat erst auf, seit ich mir Panda runtergeladen habe, und tritt komischerweise nicht mehr auf, wenn ich Panda im Abgesicherten Modus Lösche.

Nun bin ich ein wenig Verunsichert, da mir ein Bekannter gesagt hat, dass es ein Trojaner sein könnte.



Der file sieht so aus:
Logfile of HijackThis v1.99.1
Scan saved at 23:26:51, on 28.03.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SYSTEM32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\soundman.exe
C:\Programme\T-Online\DSL-Manager\TODslMgr.exe
C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToADiMon.exe
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
G:\Programme\ICQLite\ICQLite.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\MSN Messenger\MsnMsgr.Exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Dokumente und Einstellungen\Admin\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - G:\Programme\ICQToolbar\toolbaru.dll
O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - G:\Programme\ICQToolbar\toolbaru.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Programme\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - G:\Programme\ICQToolbar\toolbaru.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Programme\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [SoundMan] soundman.exe
O4 - HKLM\..\Run: [T-Online DSL-Manager] "C:\Programme\T-Online\DSL-Manager\TODslMgr.exe"
O4 - HKLM\..\Run: [REGSHAVE] C:\Programme\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [ToADiMon.exe] C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToADiMon.exe -TOnlineAutodialStart
O4 - HKLM\..\Run: [EPSON Stylus D68 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE /P23 "EPSON Stylus D68 Series" /O6 "USB001" /M "Stylus D68"
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [ICQ Lite] G:\Programme\ICQLite\ICQLite.exe -minimize
O4 - HKLM\..\Run: [C:\DOKUME~1\Admin\LOKALE~1\Temp\\p08promo] C:\DOKUME~1\Admin\LOKALE~1\Temp\\p08promo.exe
O4 - HKLM\..\Run: [C:\DOKUME~1\Admin\LOKALE~1\Temp\\panda_updater] C:\DOKUME~1\Admin\LOKALE~1\Temp\\panda_updater.exe
O4 - HKLM\..\RunServices: [RunAlert] C:\Programme\MSI\PC Alert III\AService.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programme\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Programme\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\RunOnce: [ICQ Lite] G:\Programme\ICQLite\ICQLite.exe -trayboot
O4 - Global Startup: Exif Launcher.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - G:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - G:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Programme\PokerStars.NET\PokerStarsUpdate.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O10 - Broken Internet access because of LSP provider 'spacklsp.dll' missing
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Unknown owner - C:\Programme\AntiVir PersonalEdition Classic\sched.exe (file missing)
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Unknown owner - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Unknown owner - C:\Programme\Gemeinsame Dateien\Panda Software\PavShld\pavprsrv.exe (file missing)
O23 - Service: T-Online DSL-Manager (TODslService) - T-Systems International GmbH - C:\Programme\T-Online\DSL-Manager\TODslSvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe



Wenn es keine Umstände macht, würde ich gerne um Antworten/Vorschläge bitten, die ich als Computerleie auch umsetzen kann. Also langsam und verständlich. ^^'

Schonmal vielen Dank.

Nabend.

Also dein log sieht sauber asu und die Probleme wären nicht typisch für einen Schädling.

Fixe mit HijackThis bitte folgende Einträge:

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM..Run: [COKUME~1AdminLOKALE~1Temp\p08promo] COKUME~1AdminLOKALE~1Temp\p08promo.exe
O4 - HKLM..Run: [COKUME~1AdminLOKALE~1Temp\panda_updater] COKUME~1AdminLOKALE~1Temp\panda_updater.exe

Danach lasse CCleaner laufen und such dir ein anderes AV-Prog..

Danke.
Hab alles gemacht, wie du es gesacht hast.
Könntest mir noch ein AV-Programm an's Herz legen? Wäre nett.

Avira AntiVir hab ich mir schon runtergeladen, aber anscheinend läuft das nicht.
"AntiVir Guard - Dienst gestoppt" steht da, und in derem Support hab ich nichts gefunden.

"AntiVir Guard - Dienst gestoppt" steht da, und in derem Support hab ich nichts gefunden.

gut, das du das sagst!

Wenn 2 AntiViren Proggis nicht mehr laufen ist es höchst Unwahrscheinlich, dass diese Anomalien zufällig auftauchen.
Entweder stimmt etwas an deinem System nicht oder da verhindert wirklich etwas den Start der Programme.

1) Deaktiviere die Systemwiederherstellung auf allen Laufwerken.

2) Deinstalliere Java über die Systemsteuerung.

3) Blacklight bitte laufen lassen und das log posten..

4) Lasse Silentrunners laufen und poste das logFile

5) Folge dieser Anleitung.

6) Run Combofix. Poste den erscheinenden Text.

7) Überprüfe dein System mit SASW.

8) Durchsuche mit dem Kaspersky Online Scanner dein System.

9) Räume mit cCleaner auf ( die Registry musst du mehrmals durchsuchen und bereinigen lassen).

10) Poste ein frisches HijackThis log sowie einen iClean Bericht (Prog in eigenem Ordner öffnen->"Yes"->File->Report).
Hinweis zum iClean Bericht:Kürze im log bitte die 032 und 033 redirected Einträge. (Diese wurden von Spybot erstellt.)

11) Danach machst du einen eScan nach Anleitung in meiner Signatur und postest das log.

Hallo.
Also die Systemwiederherstellung is aus, aber das Java Programm find ich nicht. Suche ich bei "Start/Systemsteuerung/Software/Programme ändern oder entfernen" falsch?

Soll ich das alles im Normalen Modus machen, oder im Abgesichertem?

Und was ist ein eScan?

'tschuldige für de Arbeit die ich dir mach'. Danke aber schonmal ^^'

Hallo.
Kann ich die Java Programme auch einzeln, einfach so, also "normal" löschen?
Das mit dem eScan hat sich erledigt. ^^'

Kann ich die Java Programme auch einzeln, einfach so, also "normal" löschen?

Welche JavaProgramme meinst du? Es sollte eigentlich nur ein "Sun" Java Produkt dort sein..
Den Schritt kannst du sonst aber auch einfach weglassen..

Blacklight-Log:
03/30/08 16:43:25 [Info]: BlackLight Engine 1.0.67 initialized
03/30/08 16:43:25 [Info]: OS: 5.1 build 2600 (Service Pack 2)
03/30/08 16:43:25 [Note]: 7019 4
03/30/08 16:43:25 [Note]: 7005 0
03/30/08 16:43:26 [Note]: 7006 0
03/30/08 16:43:26 [Note]: 7011 596
03/30/08 16:43:26 [Note]: 7026 0
03/30/08 16:43:27 [Note]: 7026 0
03/30/08 16:43:28 [Note]: FSRAW library version 1.7.1024
03/30/08 16:45:28 [Note]: 2000 1012
03/30/08 16:45:49 [Note]: 7007 0

SilentRunners-Log:
"Silent Runners.vbs", revision 56, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS]
"MsnMsgr" = ""C:\Programme\MSN Messenger\MsnMsgr.Exe" /background" [MS]
"Skype" = ""C:\Programme\Skype\Phone\Skype.exe" /nosplash /minimized" ["Skype Technologies S.A."]
"EPSON Stylus D68 Series" = "C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE /P23 "EPSON Stylus D68 Series" /M "Stylus D68" /EF "HKCU"" ["SEIKO EPSON CORPORATION"]

HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\ {++}
"ICQ Lite" = "G:\Programme\ICQLite\ICQLite.exe -trayboot" ["ICQ Ltd."]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"SoundMan" = "soundman.exe" ["Avance Logic, Inc."]
"T-Online DSL-Manager" = ""C:\Programme\T-Online\DSL-Manager\TODslMgr.exe"" ["T-Systems International GmbH"]
"REGSHAVE" = "C:\Programme\REGSHAVE\REGSHAVE.EXE /AUTORUN" ["FUJI PHOTO FILM CO., LTD."]
"ToADiMon.exe" = "C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToADiMon.exe -TOnlineAutodialStart" ["T-Online International AG, Marmiko IT-Solutions GmbH"]
"EPSON Stylus D68 Series" = "C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE /P23 "EPSON Stylus D68 Series" /O6 "USB001" /M "Stylus D68"" ["SEIKO EPSON CORPORATION"]
"TkBellExe" = ""C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot" ["RealNetworks, Inc."]
"ZoneAlarm Client" = ""C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe"" ["Zone Labs, LLC"]
"ICQ Lite" = "G:\Programme\ICQLite\ICQLite.exe -minimize" ["ICQ Ltd."]
"avgnt" = ""C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min" ["Avira GmbH"]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{02478D38-C3F9-4EFB-9B51-7695ECA05670}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Yahoo! Toolbar Helper"
\InProcServer32\(Default) = "C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll" ["Yahoo! Inc."]
{055FD26D-3A88-4e15-963D-DC8493744B1D}\(Default) = (no title provided)
-> {HKLM...CLSID} = "XTTBPos00 Class"
\InProcServer32\(Default) = "G:\Programme\ICQToolbar\toolbaru.dll" ["IE Toolbar"]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)
-> {HKLM...CLSID} = "AcroIEHlprObj Class"
\InProcServer32\(Default) = "C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx" [empty string]
{9030D464-4C02-4ABF-8ECC-5164760863C6}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Windows Live Sign-in Helper"
\InProcServer32\(Default) = "C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll" [MS]
{E99421FB-68DD-40F0-B4AC-B7027CAE2F1A}\(Default) = (no title provided)
-> {HKLM...CLSID} = "EpsonToolBandKicker Class"
\InProcServer32\(Default) = "C:\Programme\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll" ["SEIKO EPSON CORPORATION"]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "CPL-Erweiterung für Anzeigeverschiebung"
-> {HKLM...CLSID} = "CPL-Erweiterung für Anzeigeverschiebung"
\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Erweiterung für HyperTerminal-Icons"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data]
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"
-> {HKLM...CLSID} = "Portable Media Devices Menu"
\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
"{8e9d6600-f84a-11ce-8daa-00aa004a5691}" = "Shell extensions for NetWare"
-> {HKLM...CLSID} = "NetWare Objects"
\InProcServer32\(Default) = "nwprovau.dll" [MS]
"{e3f2bac0-099f-11cf-8daa-00aa004a5691}" = "Shell extensions for NetWare"
-> {HKLM...CLSID} = "NetWare UNC Folder Menu"
\InProcServer32\(Default) = "nwprovau.dll" [MS]
"{52c68510-09a0-11cf-8daa-00aa004a5691}" = "Shell extensions for NetWare"
-> {HKLM...CLSID} = "NetWare Hood Verbs"
\InProcServer32\(Default) = "nwprovau.dll" [MS]
"{73B24247-042E-4EF5-ADC2-42F62E6FD654}" = "ICQ Lite Shell Extension"
-> {HKLM...CLSID} = "MCLiteShellExt Class"
\InProcServer32\(Default) = "G:\Programme\ICQLite\ICQLiteShell.dll" [empty string]
"{45AC2688-0253-4ED8-97DE-B5370FA7D48A}" = "Shell Extension for Malware scanning"
-> {HKLM...CLSID} = "Shell Extension for Malware scanning"
\InProcServer32\(Default) = "C:\Programme\Avira\AntiVir PersonalEdition Classic\shlext.dll" ["Avira GmbH"]
"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler"
-> {HKLM...CLSID} = "Outlook-Dateisymbolerweiterung"
\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office\OLKFSTUB.DLL" [MS]
"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player"
-> {HKLM...CLSID} = "RealOne Player Context Menu Class"
\InProcServer32\(Default) = "G:\Programme\rpshell.dll" ["RealNetworks, Inc."]
"{D9872D13-7651-4471-9EEE-F0A00218BEBB}" = "Multiscan"
-> {HKLM...CLSID} = "ZLAVShExt Class"
\InProcServer32\(Default) = "C:\Programme\Zone Labs\ZoneAlarm\zlavscan.dll" ["Zone Labs, LLC"]
"{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D}" = "Messenger Sharing Folders"
-> {HKLM...CLSID} = "Meine freigegebenen Ordner"
\InProcServer32\(Default) = "C:\Programme\MSN Messenger\fsshext.8.1.0178.00.dll" [MS]
"{B327765E-D724-4347-8B16-78AE18552FC3}" = "NeroDigitalIconHandler"
-> {HKLM...CLSID} = "NeroDigitalIconHandler Class"
\InProcServer32\(Default) = "C:\Programme\Gemeinsame Dateien\Nero\Lib\NeroDigitalExt.dll" ["Nero AG"]
"{7F1CF152-04F8-453A-B34C-E609530A9DC8}" = "NeroDigitalPropSheetHandler"
-> {HKLM...CLSID} = "NeroDigitalPropSheetHandler Class"
\InProcServer32\(Default) = "C:\Programme\Gemeinsame Dateien\Nero\Lib\NeroDigitalExt.dll" ["Nero AG"]

HKLM\SYSTEM\CurrentControlSet\Control\Lsa\
<<!>> "Authentication Packages" = "msv1_0"|"nwprovau"

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
<<!>> AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."]

HKLM\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\
{7D4D6379-F301-4311-BEBA-E26EB0561882}\(Default) = "NeroDigitalExt.NeroDigitalColumnHandler"
-> {HKLM...CLSID} = "NeroDigitalColumnHandler Class"
\InProcServer32\(Default) = "C:\Programme\Gemeinsame Dateien\Nero\Lib\NeroDigitalExt.dll" ["Nero AG"]

HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\
ICQLiteMenu\(Default) = "{73B24247-042E-4EF5-ADC2-42F62E6FD654}"
-> {HKLM...CLSID} = "MCLiteShellExt Class"
\InProcServer32\(Default) = "G:\Programme\ICQLite\ICQLiteShell.dll" [empty string]
Shell Extension for Malware scanning\(Default) = "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}"
-> {HKLM...CLSID} = "Shell Extension for Malware scanning"
\InProcServer32\(Default) = "C:\Programme\Avira\AntiVir PersonalEdition Classic\shlext.dll" ["Avira GmbH"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data]
ZLAVShExt\(Default) = "{D9872D13-7651-4471-9EEE-F0A00218BEBB}"
-> {HKLM...CLSID} = "ZLAVShExt Class"
\InProcServer32\(Default) = "C:\Programme\Zone Labs\ZoneAlarm\zlavscan.dll" ["Zone Labs, LLC"]

HKLM\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\
ICQLiteMenu\(Default) = "{73B24247-042E-4EF5-ADC2-42F62E6FD654}"
-> {HKLM...CLSID} = "MCLiteShellExt Class"
\InProcServer32\(Default) = "G:\Programme\ICQLite\ICQLiteShell.dll" [empty string]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data]

HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\
NetWareUNCMenu\(Default) = "{e3f2bac0-099f-11cf-8daa-00aa004a5691}"
-> {HKLM...CLSID} = "NetWare UNC Folder Menu"
\InProcServer32\(Default) = "nwprovau.dll" [MS]
Shell Extension for Malware scanning\(Default) = "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}"
-> {HKLM...CLSID} = "Shell Extension for Malware scanning"
\InProcServer32\(Default) = "C:\Programme\Avira\AntiVir PersonalEdition Classic\shlext.dll" ["Avira GmbH"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data]
ZLAVShExt\(Default) = "{D9872D13-7651-4471-9EEE-F0A00218BEBB}"
-> {HKLM...CLSID} = "ZLAVShExt Class"
\InProcServer32\(Default) = "C:\Programme\Zone Labs\ZoneAlarm\zlavscan.dll" ["Zone Labs, LLC"]


Group Policies {GPedit.msc branch and setting}:
-----------------------------------------------

Note: detected settings may not have any effect.

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\

"DisableTaskMgr" = (REG_DWORD) dword:0x00000000
{User Configuration|Administrative Templates|System|Ctrl+Alt+Del Options|
Remove Task Manager}

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\

"shutdownwithoutlogon" = (REG_DWORD) dword:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Shutdown: Allow system to be shut down without having to log on}

"undockwithoutlogon" = (REG_DWORD) dword:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Devices: Allow undock without having to log on}


Active Desktop and Wallpaper:
-----------------------------

Active Desktop may be disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

Displayed if Active Desktop enabled and wallpaper not set by Group Policy:
HKCU\Software\Microsoft\Internet Explorer\Desktop\General\
"Wallpaper" = "C:\WINDOWS\web\wallpaper\Grüne Idylle.bmp"

Displayed if Active Desktop disabled and wallpaper not set by Group Policy:
HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\WINDOWS\web\wallpaper\Grüne Idylle.bmp"


Enabled Screen Saver:
---------------------

HKCU\Control Panel\Desktop\
"SCRNSAVE.EXE" = "C:\WINDOWS\system32\scrnsave.scr" [MS]


Startup items in "Admin" & "All Users" startup folders:
-------------------------------------------------------

C:\Dokumente und Einstellungen\All Users.WINDOWS\Startmenü\Programme\Autostart
"Exif Launcher" -> shortcut to: "C:\Programme\FinePixViewer\QuickDCF.exe" ["FUJI PHOTO FILM CO., LTD."]
"Microsoft Office" -> shortcut to: "C:\Programme\Microsoft Office\Office\OSA9.EXE -b -l" [MS]


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000004\LibraryPath = "%SystemRoot%\System32\nwprovau.dll" [MS]

Transport Service Providers

HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
spacklsp.dll [null data], 01 - 05, 11
%SystemRoot%\system32\mswsock.dll [MS], 06 - 08, 12 - 26
%SystemRoot%\system32\rsvpsp.dll [MS], 09 - 10


Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\
"{855F3B16-6D32-4FE6-8A56-BBB695989046}"
-> {HKLM...CLSID} = "ICQ Toolbar"
\InProcServer32\(Default) = "G:\Programme\ICQToolbar\toolbaru.dll" ["IE Toolbar"]

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
"{855F3B16-6D32-4FE6-8A56-BBB695989046}"
-> {HKLM...CLSID} = "ICQ Toolbar"
\InProcServer32\(Default) = "G:\Programme\ICQToolbar\toolbaru.dll" ["IE Toolbar"]
"{EE5D279F-081B-4404-994D-C6B60AAEBA6D}"
-> {HKLM...CLSID} = "EPSON Web-To-Page"
\InProcServer32\(Default) = "C:\Programme\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll" ["SEIKO EPSON CORPORATION"]

HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\
"{855F3B16-6D32-4FE6-8A56-BBB695989046}" = (no title provided)
-> {HKLM...CLSID} = "ICQ Toolbar"
\InProcServer32\(Default) = "G:\Programme\ICQToolbar\toolbaru.dll" ["IE Toolbar"]
"{EE5D279F-081B-4404-994D-C6B60AAEBA6D}" = (no title provided)
-> {HKLM...CLSID} = "EPSON Web-To-Page"
\InProcServer32\(Default) = "C:\Programme\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll" ["SEIKO EPSON CORPORATION"]
"{EF99BD32-C1FB-11D2-892F-0090271D4F88}" = (no title provided)
-> {HKLM...CLSID} = "Yahoo! Toolbar mit Pop-Up-Blocker"
\InProcServer32\(Default) = "C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll" ["Yahoo! Inc."]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\
{B863453A-26C3-4E1F-A54D-A2CD196348E9}\
"ButtonText" = "ICQ Lite"
"MenuText" = "ICQ Lite"
"Exec" = "G:\Programme\ICQLite\ICQLite.exe" ["ICQ Ltd."]

{FA9B9510-9FCB-4CA0-818C-5D0987B47C4D}\
"ButtonText" = "PokerStars.net"
"Exec" = "C:\Programme\PokerStars.NET\PokerStarsUpdate.exe" ["PokerStars"]

{FB5F1910-F110-11D2-BB9E-00C04F795683}\
"ButtonText" = "Messenger"
"MenuText" = "Windows Messenger"
"Exec" = "C:\Programme\Messenger\msmsgs.exe" [MS]


Miscellaneous IE Hijack Points
------------------------------

HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\
<<H>> "{855F3B16-6D32-4fe6-8A56-BBB695989046}" = (no title provided)
-> {HKLM...CLSID} = "ICQ Toolbar"
\InProcServer32\(Default) = "G:\Programme\ICQToolbar\toolbaru.dll" ["IE Toolbar"]
<<H>> "{EF99BD32-C1FB-11D2-892F-0090271D4F88}" = (no title provided)
-> {HKLM...CLSID} = "Yahoo! Toolbar mit Pop-Up-Blocker"
\InProcServer32\(Default) = "C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll" ["Yahoo! Inc."]


Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

Ati HotKey Poller, Ati HotKey Poller, "C:\WINDOWS\system32\Ati2evxx.exe" ["ATI Technologies Inc."]
Client Service für NetWare, NWCWorkstation, "C:\WINDOWS\system32\svchost.exe -k netsvcs" {"C:\WINDOWS\System32\nwwks.dll" [MS]}
T-Online DSL-Manager, TODslService, ""C:\Programme\T-Online\DSL-Manager\TODslSvc.exe"" ["T-Systems International GmbH"]
TrueVector Internet Monitor, vsmon, "C:\WINDOWS\system32\ZoneLabs\vsmon.exe -service" ["Zone Labs, LLC"]
Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS]


---------- (launch time: 2008-03-30 16:46:26)
<<!>>: Suspicious data at a malware launch point.
<<H>>: Suspicious data at a browser hijack point.

+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ To search all directories of local fixed drives for DESKTOP.INI
DLL launch points, use the -supp parameter or answer "No" at the
first message box and "Yes" at the second message box.
---------- (total run time: 89 seconds, including 4 seconds for message boxes)

ComboFix-Log:
ComboFix 08-03-27.3 - Admin 2008-03-30 17:02:49.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1031.18.664 [GMT 2:00]
ausgeführt von:: C:\Dokumente und Einstellungen\Admin\Desktop\Antivirenkram\ComboFix.exe
* Neuer Wiederherstellungspunkt wurde erstellt

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((( Dateien erstellt von 2008-02-28 bis 2008-03-30 ))))))))))))))))))))))))))))))
.

2008-03-30 03:42 . 2008-03-30 03:42 <DIR> d-------- C:\Programme\Yahoo!
2008-03-29 02:03 . 2008-03-29 02:03 <DIR> d-------- C:\Logs
2008-03-29 02:01 . 2008-03-29 02:01 <DIR> d-------- C:\Programme\CCleaner
2008-03-29 02:00 . 2008-03-29 02:00 <DIR> d-------- C:\Programme\Avira
2008-03-29 02:00 . 2008-03-29 02:00 <DIR> d-------- C:\Dokumente und Einstellungen\All Users.WINDOWS\Anwendungsdaten\Avira
2008-03-20 02:13 . 2008-03-21 15:44 92,544 --a------ C:\WINDOWS\system32\drivers\av5flt.sys
2008-03-20 02:04 . 2008-03-20 02:04 <DIR> d-------- C:\Dokumente und Einstellungen\All Users.WINDOWS\Anwendungsdaten\sentinel
2008-03-20 02:01 . 2008-03-20 02:01 <DIR> d-------- C:\Dokumente und Einstellungen\All Users.WINDOWS\Anwendungsdaten\Backup
2008-03-20 01:55 . 2008-03-28 23:42 <DIR> d-------- C:\Programme\Gemeinsame Dateien\Panda Software
2008-03-14 01:06 . 2008-03-14 01:06 41,296 --a------ C:\WINDOWS\system32\xfcodec.dll
2008-03-11 01:51 . 2008-03-11 01:51 <DIR> d-------- C:\Programme\MP3 Player Utilities V1.28
2008-03-11 01:51 . 2003-08-31 04:54 1,782,272 -ra------ C:\WINDOWS\$ACTSDK$.FW
2008-03-11 01:51 . 2003-08-31 04:54 6,850 -ra------ C:\WINDOWS\Disktool.INI
2008-03-11 01:51 . 2003-08-31 04:54 5,628 -ra------ C:\WINDOWS\fwupgrade.ini
2008-03-11 01:51 . 2003-08-31 04:58 3,677 -ra------ C:\WINDOWS\PlaySnd.INI

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-30 15:06 --------- d-----w C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Skype
2008-03-30 14:36 --------- d-----w C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Xfire
2008-03-30 14:19 --------- d-----w C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\skypePM
2008-03-28 21:19 86,528 ----a-w C:\WINDOWS\system32\VACFix.exe
2008-03-26 06:50 82,432 ----a-w C:\WINDOWS\system32\IEDFix.exe
2008-03-20 00:17 2,658,304 ----a-w C:\WINDOWS\Internet Logs\xDB2.tmp
2008-03-20 00:01 --------- d--h--w C:\Programme\InstallShield Installation Information
2008-02-02 14:25 5,296,566 ----a-w C:\WINDOWS\Internet Logs\tvDebug.zip
2008-02-01 23:46 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll
2008-01-18 22:32 32 ----a-w C:\Dokumente und Einstellungen\All Users.WINDOWS\Anwendungsdaten\ezsid.dat
2008-01-10 00:36 94,208 ----a-w C:\WINDOWS\DIIUnin.exe
2008-01-10 00:08 21,840 ----atw C:\WINDOWS\system32\SIntfNT.dll
2008-01-10 00:08 17,212 ----atw C:\WINDOWS\system32\SIntf32.dll
2008-01-10 00:08 12,067 ----atw C:\WINDOWS\system32\SIntf16.dll
2007-07-03 00:39 1,406,464 ----a-w C:\WINDOWS\Internet Logs\xDB1.tmp
.

(((((((((((((((((((((((((((( Autostart Punkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Hinweis* leere Eintrage & legitime Standardeintrage werden nicht angezeigt.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2002-12-31 14:00 15360]
"MsnMsgr"="C:\Programme\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:55 5674352]
"Skype"="C:\Programme\Skype\Phone\Skype.exe" [2007-12-07 16:08 21686568]
"EPSON Stylus D68 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.exe" [2005-01-25 06:00 98304]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"ICQ Lite"="G:\Programme\ICQLite\ICQLite.exe" [2006-07-27 20:12 3142236]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="soundman.exe" [2001-05-29 19:02 124416 C:\WINDOWS\soundman.exe]
"T-Online DSL-Manager"="C:\Programme\T-Online\DSL-Manager\TODslMgr.exe" [2005-07-14 15:32 720896]
"REGSHAVE"="C:\Programme\REGSHAVE\REGSHAVE.exe" [2002-02-04 23:32 53248]
"ToADiMon.exe"="C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToADiMon.exe" [2005-06-27 15:32 278528]
"EPSON Stylus D68 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.exe" [2005-01-25 06:00 98304]
"TkBellExe"="C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" [2007-05-24 01:19 180269]
"ZoneAlarm Client"="C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe" [2007-03-09 01:02 919280]
"ICQ Lite"="G:\Programme\ICQLite\ICQLite.exe" [2006-07-27 20:12 3142236]
"avgnt"="C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2007-08-31 13:25 249896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"RunAlert"="C:\Programme\MSI\PC Alert III\AService.exe" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2002-12-31 14:00 15360]
"InfoCockpit"="C:\Programme\T-Online\T-Online_Software_6\Info-Cockpit\IC_START.exe" [2006-08-02 19:56 176128]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"G:\\World of Warcraft\\WoW-2.0.3.6299-to-2.0.5.6320-deDE-downloader.exe"=
"G:\\Programme\\ICQLite\\ICQLite.exe"=
"G:\\World of Warcraft\\WoW-2.0.6.6337-to-2.0.7.6383-deDE-downloader.exe"=
"G:\\World of Warcraft\\WoW-2.0.7.6383-to-2.0.8.6403-deDE-downloader.exe"=
"C:\\Programme\\Activision\\Call of Duty 2\\CoD2MP_s.exe"=
"G:\\World of Warcraft\\WoW-2.0.10.6448-to-2.0.12.6546-deDE-downloader.exe"=
"G:\\World of Warcraft\\BackgroundDownloader.exe"=
"G:\\Programme\\Xfire\\Xfire.exe"=
"C:\\Programme\\MSN Messenger\\msnmsgr.exe"=
"C:\\Programme\\MSN Messenger\\livecall.exe"=
"G:\\World of Warcraft\\WoW-2.0.5.6320-to-2.0.6.6337-deDE-downloader.exe"=
"G:\\World of Warcraft\\WoW-2.0.3-deDE-downloader.exe"=
"G:\\World of Warcraft\\WoW-2.0.8.6403-to-2.0.10.6448-deDE-downloader.exe"=
"G:\\World of Warcraft\\Launcher.exe"=
"C:\\Programme\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724
"6112:TCP"= 6112:TCP:Blizzard Downloader

R1 VIAPFD;VIAPFD;C:\WINDOWS\system32\Drivers\VIAPFD.SYS [2001-05-04 17:24]
R3 TODslService;T-Online DSL-Manager;"C:\Programme\T-Online\DSL-Manager\TODslSvc.exe" [2005-07-14 15:31]
S1 ShldDrv;Panda File Shield Driver;C:\WINDOWS\system32\DRIVERS\ShlDrv51.sys []
S2 PavProc;Panda Process Protection Driver;C:\WINDOWS\system32\DRIVERS\PavProc.sys []
S3 MIINPazX;MIINPazX NDIS Protocol Driver;C:\PROGRA~1\GEMEIN~1\MARMIK~1\MInfraIS\MIINPazX.SYS [2006-05-22 07:40]
S3 MTOnlPktAlyX;MTOnlPktAlyX NDIS Protocol Driver;C:\PROGRA~1\T-Online\T-ONLI~1\BASIS-~1\Basis1\MTOnlPktAlyX.SYS [2005-09-28 11:58]

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-30 17:06:15
Windows 5.1.2600 Service Pack 2 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostart Eintr„ge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Programme\FinePixViewer\QuickDCF.exe
C:\WINDOWS\system32\wdfmgr.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2008-03-30 17:07:49 - machine was rebooted
ComboFix-quarantined-files.txt 2008-03-30 15:07:46
11 Verzeichnis(se), 34,215,477,248 Bytes frei
13 Verzeichnis(se), 34,149,486,592 Bytes frei


Hijackthis-Log:
Logfile of HijackThis v1.99.1
Scan saved at 12:11:32, on 01.04.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\soundman.exe
C:\Programme\T-Online\DSL-Manager\TODslMgr.exe
C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToADiMon.exe
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
G:\Programme\ICQLite\ICQLite.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE
C:\Programme\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Programme\FinePixViewer\QuickDCF.exe
C:\Programme\T-Online\DSL-Manager\TODslSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Dokumente und Einstellungen\Admin\Desktop\Antivirenkram\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - G:\Programme\ICQToolbar\toolbaru.dll
R3 - URLSearchHook: Yahoo! Toolbar mit Pop-Up-Blocker - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: XTTBPos00 Class - {055FD26D-3A88-4e15-963D-DC8493744B1D} - G:\Programme\ICQToolbar\toolbaru.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Programme\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - G:\Programme\ICQToolbar\toolbaru.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Programme\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Yahoo! Toolbar mit Pop-Up-Blocker - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SoundMan] soundman.exe
O4 - HKLM\..\Run: [T-Online DSL-Manager] "C:\Programme\T-Online\DSL-Manager\TODslMgr.exe"
O4 - HKLM\..\Run: [REGSHAVE] C:\Programme\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [ToADiMon.exe] C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToADiMon.exe -TOnlineAutodialStart
O4 - HKLM\..\Run: [EPSON Stylus D68 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE /P23 "EPSON Stylus D68 Series" /O6 "USB001" /M "Stylus D68"
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [ICQ Lite] G:\Programme\ICQLite\ICQLite.exe -minimize
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\RunServices: [RunAlert] C:\Programme\MSI\PC Alert III\AService.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programme\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Programme\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [EPSON Stylus D68 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE /P23 "EPSON Stylus D68 Series" /M "Stylus D68" /EF "HKCU"
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Programme\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\RunOnce: [ICQ Lite] G:\Programme\ICQLite\ICQLite.exe -trayboot
O4 - Global Startup: Exif Launcher.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - G:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - G:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Programme\PokerStars.NET\PokerStarsUpdate.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O10 - Broken Internet access because of LSP provider 'spacklsp.dll' missing
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/german/partner/de/kavwebscan_unicode.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Programme\Yahoo!\Common\yinsthelper.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Programme\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Unknown owner - C:\Programme\AntiVir PersonalEdition Classic\sched.exe (file missing)
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Unknown owner - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Unknown owner - C:\Programme\Gemeinsame Dateien\Panda Software\PavShld\pavprsrv.exe (file missing)
O23 - Service: T-Online DSL-Manager (TODslService) - T-Systems International GmbH - C:\Programme\T-Online\DSL-Manager\TODslSvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

iClean-Log:
iclean log 01.04.2008 00:24:59

Windows XP SP2, Using advanced Kernel functions

Processes
---------
556 - \SystemRoot\System32\smss.exe - \SystemRoot\System32\smss.exe
624 - \??\C:\WINDOWS\system32\csrss.exe - \??\C:\WINDOWS\system32\csrss.exe
652 - \??\C:\WINDOWS\system32\winlogon.exe - \??\C:\WINDOWS\system32\winlogon.exe
696 - C:\WINDOWS\system32\services.exe - Anwendung für Dienste und Controller
708 - C:\WINDOWS\system32\lsass.exe - LSA Shell (Export Version)
864 - C:\WINDOWS\system32\Ati2evxx.exe - ATI External Event Utility EXE Module
876 - C:\WINDOWS\system32\svchost.exe - Generic Host Process for Win32 Services
948 - C:\WINDOWS\system32\svchost.exe - Generic Host Process for Win32 Services
1200 - C:\WINDOWS\system32\svchost.exe - Generic Host Process for Win32 Services
1248 - C:\WINDOWS\system32\svchost.exe - Generic Host Process for Win32 Services
1552 - C:\WINDOWS\system32\svchost.exe - Generic Host Process for Win32 Services
1580 - C:\WINDOWS\system32\ZoneLabs\vsmon.exe - TrueVector Service (Signed)
184 - C:\WINDOWS\system32\spoolsv.exe - Spooler SubSystem App
1104 - C:\WINDOWS\system32\Ati2evxx.exe - ATI External Event Utility EXE Module
1164 - C:\WINDOWS\Explorer.EXE - Windows Explorer
1472 - C:\WINDOWS\system32\wdfmgr.exe - Windows User Mode Driver Manager
1916 - C:\WINDOWS\soundman.exe - Avance Sound Effect Manager
1936 - C:\Programme\T-Online\DSL-Manager\TODslMgr.exe - DSL-Manager Application
1952 - C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToADiMon.exe - T-Online Verbindungsassistent Monitor
1992 - C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe - RealNetworks Scheduler
300 - C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe - ZoneAlarm Client (Signed)
580 - C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe - Antivirus System Tray Tool
592 - C:\WINDOWS\system32\ctfmon.exe - CTF Loader
888 - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE - EPSON Status Monitor 3
1060 - C:\Programme\FinePixViewer\QuickDCF.exe - Exif Launcher
2484 - C:\WINDOWS\System32\alg.exe - Application Layer Gateway Service
3004 - C:\Programme\T-Online\DSL-Manager\TODslSvc.exe - DSL-Manager Service
3072 - C:\WINDOWS\system32\svchost.exe - Generic Host Process for Win32 Services
1912 - C:\Programme\internet explorer\iexplore.exe - Internet Explorer
(Hidden) 1376 - WLLoginProxy.ex - WLLoginProxy.ex
3860 - C:\Programme\Mozilla Firefox\firefox.exe - Firefox (Signed)
2136 - C:\Dokumente und Einstellungen\Admin\Desktop\Antivirenkram\iclean.exe - Interactive Cleaner

Services
--------
C:\WINDOWS\system32\alg.exe=ALG
C:\WINDOWS\system32\ati2evxx.exe=Ati HotKey Poller
C:\WINDOWS\system32\svchost.exe=AudioSrv
C:\WINDOWS\system32\svchost.exe=BITS
C:\WINDOWS\system32\svchost.exe=Browser
C:\WINDOWS\system32\svchost.exe=CryptSvc
C:\WINDOWS\system32\svchost.exe=DcomLaunch
C:\WINDOWS\system32\svchost.exe=Dhcp
C:\WINDOWS\system32\svchost.exe=dmserver
C:\WINDOWS\system32\svchost.exe=Dnscache
C:\WINDOWS\system32\svchost.exe=ERSvc
C:\WINDOWS\system32\services.exe=Eventlog
c:\windows\system32\svchost.exe=EventSystem
C:\WINDOWS\system32\svchost.exe=FastUserSwitchingCompatibility
C:\WINDOWS\system32\svchost.exe=helpsvc
C:\WINDOWS\system32\svchost.exe=HTTPFilter
C:\WINDOWS\system32\svchost.exe=lanmanserver
C:\WINDOWS\system32\svchost.exe=lanmanworkstation
C:\WINDOWS\system32\svchost.exe=LmHosts
C:\WINDOWS\system32\svchost.exe=Netman
C:\WINDOWS\system32\svchost.exe=Nla
C:\WINDOWS\system32\svchost.exe=NWCWorkstation
C:\WINDOWS\system32\services.exe=PlugPlay
C:\WINDOWS\system32\lsass.exe=PolicyAgent
C:\WINDOWS\system32\lsass.exe=ProtectedStorage
C:\WINDOWS\system32\svchost.exe=RasMan
C:\WINDOWS\system32\svchost.exe=RemoteRegistry
C:\WINDOWS\system32\svchost.exe=RpcSs
C:\WINDOWS\system32\lsass.exe=SamSs
C:\WINDOWS\system32\svchost.exe=Schedule
C:\WINDOWS\system32\svchost.exe=seclogon
C:\WINDOWS\system32\svchost.exe=SENS
C:\WINDOWS\system32\svchost.exe=SharedAccess
C:\WINDOWS\system32\svchost.exe=ShellHWDetection
C:\WINDOWS\system32\spoolsv.exe=Spooler
C:\WINDOWS\system32\svchost.exe=srservice
C:\WINDOWS\system32\svchost.exe=SSDPSRV
C:\WINDOWS\system32\svchost.exe=TapiSrv
C:\WINDOWS\system32\svchost.exe=TermService
C:\WINDOWS\system32\svchost.exe=Themes
c:\programme\t-online\dsl-manager\todslsvc.exe=TODslService
C:\WINDOWS\system32\svchost.exe=TrkWks
c:\windows\system32\wdfmgr.exe=UMWdf
c:\windows\system32\zonelabs\vsmon.exe=vsmon
C:\WINDOWS\system32\svchost.exe=W32Time
C:\WINDOWS\system32\svchost.exe=WebClient
C:\WINDOWS\system32\svchost.exe=winmgmt
C:\WINDOWS\system32\svchost.exe=wscsvc
C:\WINDOWS\system32\svchost.exe=wuauserv
C:\WINDOWS\system32\svchost.exe=WZCSVC

Registry
--------
000=HKCU\Run: CTFMON.EXE=c:\windows\system32\ctfmon.exe
000=HKCU\Run: EPSON Stylus D68 Series=c:\windows\system32\spool\drivers\w32x86\3\e_fatiaae.exe /p23 "epson stylus d68 series" /m "stylus d68" /ef "hkcu"
000=HKCU\Run: MsnMsgr="c:\programme\msn messenger\msnmsgr.exe" /background
000=HKCU\Run: Skype="c:\programme\skype\phone\skype.exe" /nosplash /minimized
000=HKCU\Run: SUPERAntiSpyware=c:\programme\superantispyware\superantispyware.exe
000=HKLM\Run: avgnt="c:\programme\avira\antivir personaledition classic\avgnt.exe" /min
000=HKLM\Run: EPSON Stylus D68 Series=c:\windows\system32\spool\drivers\w32x86\3\e_fatiaae.exe /p23 "epson stylus d68 series" /o6 "usb001" /m "stylus d68"
000=HKLM\Run: ICQ Lite=g:\programme\icqlite\icqlite.exe
000=HKLM\Run: REGSHAVE=c:\programme\regshave\regshave.exe /autorun
000=HKLM\Run: SoundMan=c:\windows\soundman.exe
000=HKLM\Run: TkBellExe="c:\programme\gemeinsame dateien\real\update_ob\realsched.exe" -osboot
000=HKLM\Run: ToADiMon.exe=c:\programme\t-online\t-online_software_6\basis-software\basis1\toadimon.exe
000=HKLM\Run: T-Online DSL-Manager="c:\programme\t-online\dsl-manager\todslmgr.exe"
000=HKLM\Run: ZoneAlarm Client="c:\programme\zone labs\zonealarm\zlclient.exe"
000=HKLM\RunServices: RunAlert=c:\programme\msi\pc alert iii\aservice.exe
001=Firewall bypass: %windir%\system32\sessmgr.exe=c:\windows\system32\sessmgr.exe
001=Firewall bypass: C:\Programme\Activision\Call of Duty 2\CoD2MP_s.exe=c:\programme\activision\call of duty 2\cod2mp_s.exe
001=Firewall bypass: C:\Programme\Skype\Phone\Skype.exe=c:\programme\skype\phone\skype.exe
001=Firewall bypass: G:\Meins!\AoM\AOM.exe=g:\meins!\aom\aom.exe
001=Firewall bypass: G:\Meins!\AoM\aomx.exe=g:\meins!\aom\aomx.exe
001=Firewall bypass: G:\Programme\ICQLite\ICQLite.exe=g:\programme\icqlite\icqlite.exe
001=Firewall bypass: G:\Programme\Microsoft Games\Age of Empires II\empires2.exe=g:\programme\microsoft games\age of empires ii\empires2.exe
001=Firewall bypass: G:\Programme\Xfire\Xfire.exe=g:\programme\xfire\xfire.exe
001=Firewall bypass: G:\World of Warcraft\BackgroundDownloader.exe=g:\world of warcraft\backgrounddownloader.exe
001=Firewall bypass: G:\World of Warcraft\Launcher.exe=g:\world of warcraft\launcher.exe
001=Firewall bypass: G:\World of Warcraft\WoW-2.0.10.6448-to-2.0.12.6546-deDE-downloader.exe=g:\world of warcraft\wow-2.0.10.6448-to-2.0.12.6546-dede-downloader.exe
001=Firewall bypass: G:\World of Warcraft\WoW-2.0.3.6299-to-2.0.5.6320-deDE-downloader.exe=g:\world of warcraft\wow-2.0.3.6299-to-2.0.5.6320-dede-downloader.exe
001=Firewall bypass: G:\World of Warcraft\WoW-2.0.3-deDE-downloader.exe=g:\world of warcraft\wow-2.0.3-dede-downloader.exe
001=Firewall bypass: G:\World of Warcraft\WoW-2.0.5.6320-to-2.0.6.6337-deDE-downloader.exe=g:\world of warcraft\wow-2.0.5.6320-to-2.0.6.6337-dede-downloader.exe
001=Firewall bypass: G:\World of Warcraft\WoW-2.0.6.6337-to-2.0.7.6383-deDE-downloader.exe=g:\world of warcraft\wow-2.0.6.6337-to-2.0.7.6383-dede-downloader.exe
001=Firewall bypass: G:\World of Warcraft\WoW-2.0.7.6383-to-2.0.8.6403-deDE-downloader.exe=g:\world of warcraft\wow-2.0.7.6383-to-2.0.8.6403-dede-downloader.exe
001=Firewall bypass: G:\World of Warcraft\WoW-2.0.8.6403-to-2.0.10.6448-deDE-downloader.exe=g:\world of warcraft\wow-2.0.8.6403-to-2.0.10.6448-dede-downloader.exe
004=AntiVirus Disable Notify is ON (Default is OFF)
003=Updates Disable Notify is ON (Default is OFF)
020=SSODL: CDBurn=C:\WINDOWS\system32\shell32.dll
020=SSODL: PostBootReminder=C:\WINDOWS\system32\shell32.dll
020=SSODL: SysTray=c:\windows\system32\stobject.dll
020=SSODL: WebCheck=C:\WINDOWS\system32\webcheck.dll
030=BHO: {02478D38-C3F9-4EFB-9B51-7695ECA05670}=c:\programme\yahoo!\companion\installs\cpn\yt.dll (Yahoo! Toolbar Helper)
030=BHO: {055FD26D-3A88-4e15-963D-DC8493744B1D}=g:\programme\icqtoolbar\toolbaru.dll (XTTBPos00 Class)
030=BHO: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=c:\programme\adobe\acrobat 5.0\reader\activex\acroiehelper.ocx (AcroIEHlprObj Class)
030=BHO: {9030D464-4C02-4ABF-8ECC-5164760863C6}=c:\programme\gemeinsame dateien\microsoft shared\windows live\windowslivelogin.dll (Windows Live Sign-in Helper)
030=BHO: {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A}=c:\programme\epson\epson web-to-page\epson web-to-page.dll (EpsonToolBandKicker Class)
031=Toolbar: {01E04581-4EEE-11D0-BFE9-00AA005B4383}=C:\WINDOWS\system32\browseui.dll
031=Toolbar: {0E5CBF21-D15F-11D0-8301-00AA005B4383}=C:\WINDOWS\system32\shell32.dll
031=Toolbar: {855F3B16-6D32-4FE6-8A56-BBB695989046}=g:\programme\icqtoolbar\toolbaru.dll
031=Toolbar: {EE5D279F-081B-4404-994D-C6B60AAEBA6D}=c:\programme\epson\epson web-to-page\epson web-to-page.dll
031=Toolbar: {EF99BD32-C1FB-11D2-892F-0090271D4F88}=c:\programme\yahoo!\companion\installs\cpn\yt.dll
031=Toolbar: {855F3B16-6D32-4fe6-8A56-BBB695989046}=g:\programme\icqtoolbar\toolbaru.dll
031=Toolbar: {EE5D279F-081B-4404-994D-C6B60AAEBA6D}=c:\programme\epson\epson web-to-page\epson web-to-page.dll
031=Toolbar: {EF99BD32-C1FB-11D2-892F-0090271D4F88}=c:\programme\yahoo!\companion\installs\cpn\yt.dll

Startup Folders
---------------
Common: exif launcher.lnk -> C:\PROGRA~1\FINEPI~1\QuickDCF.exe
Common: microsoft office.lnk -> C:\PROGRA~1\MICROS~2\Office\OSA9.EXE
Personal: desktop.ini

HOSTS
-----
127.0.0.1 localhost





Den eScan hab ich gemacht, aber es erschien leider kein Text zum Posten

Hab ich was vergessen/Falsch gemacht? :/

Oder is meinem PC garnich mehr zu helfen? :x