Blauer Desktop "Warning! Spyware Detected on your Computer!

ALI-B

Hallo, Bin Neu hier und habe nichtallzuviel Ahnung vom PC.
Würde mich über Hilfe sehr freuen.
Habe einen Bluen Desktop Hintergrund, in der miite befindet sich ein Rechteck mit der Beschriftung, "Warning! Spaware detected on your Computer!

Hab schon ein bisschen hier gestöbert und ein SDFix gemacht, hier mal die auswertung...


Danke...


SDFix: Version 1.190
Run by ALI-B on 10.06.2008 at 18:43

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix

Checking Services :


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting


Checking Files :

Trojan Files Found:

C:\DOKUME~1\ALI-B\LOKALE~1\Temp\media.php.bat - Deleted
C:\DOKUME~1\ALI-B\LOKALE~1\Temp\winpole32.exe.bat - Deleted





Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-10 18:48:01
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001060afd88f]
"00174b62ba54"=hex:77,12,a3,3b,f1,f6,d4,15,96,b0,8d,01,a8,bf,67,df
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:7e107cf7
"s2"=dword:4631f47f
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="d:\Programme\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:6c,92,be,4b,28,bc,d2,93,ef,51,71,c9,3c,69,48,4c,41,70,46,80,51,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,ce,af,4d,21,27,6c,2b,6c,ba,40,4a,a7,6e,4c,c5,23,20,..
"khjeh"=hex:79,0e,c5,7e,bb,53,1c,03,f9,a1,65,01,91,b6,e2,dc,31,29,11,64,bc,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:f9,5e,e0,19,e8,d1,c9,eb,6b,e7,3e,88,4a,70,2b,8b,4b,5e,f3,80,96,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\001060afd88f]
"00174b62ba54"=hex:77,12,a3,3b,f1,f6,d4,15,96,b0,8d,01,a8,bf,67,df
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="d:\Programme\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:6c,92,be,4b,28,bc,d2,93,ef,51,71,c9,3c,69,48,4c,41,70,46,80,51,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,ce,af,4d,21,27,6c,2b,6c,ba,40,4a,a7,6e,4c,c5,23,20,..
"khjeh"=hex:79,0e,c5,7e,bb,53,1c,03,f9,a1,65,01,91,b6,e2,dc,31,29,11,64,bc,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:f9,5e,e0,19,e8,d1,c9,eb,6b,e7,3e,88,4a,70,2b,8b,4b,5e,f3,80,96,..

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services :




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"D:\\Programme\\æTorrent\\utorrent.exe"="D:\\Programme\\æTorrent\\utorrent.exe:*:Enabled:æTorrent"
"D:\\Programme\\eMule\\emule.exe"="D:\\Programme\\eMule\\emule.exe:*:Enabled:eMule"
"C:\\Programme\\FlashFXP\\FlashFXP.exe"="C:\\Programme\\FlashFXP\\FlashFXP.exe:*:Enabled:FlashFXP v3"
"C:\\Programme\\MultiProxy\\MProxy.exe"="C:\\Programme\\MultiProxy\\MProxy.exe:*:Enabled:MultiProxy personal proxy server"
"C:\\Programme\\InterVideo\\DVD7\\WinDVD.exe"="C:\\Programme\\InterVideo\\DVD7\\WinDVD.exe:*:Enabled:WinDVD"
"C:\\Programme\\Gemeinsame Dateien\\Ahead\\Nero Web\\SetupX.exe"="C:\\Programme\\Gemeinsame Dateien\\Ahead\\Nero Web\\SetupX.exe:*:Enabled:Nero ProductSetup"
"C:\\Programme\\Gemeinsame Dateien\\Ahead\\Nero Web\\SetupXu.exe"="C:\\Programme\\Gemeinsame Dateien\\Ahead\\Nero Web\\SetupXu.exe:*:Enabled:Nero ProductSetup"
"C:\\Programme\\PPLive\\PPLive.exe"="C:\\Programme\\PPLive\\PPLive.exe:*:Enabled:PPLive"
"C:\\Programme\\Java\\jre1.5.0_10\\bin\\rmiregistry.exe"="C:\\Programme\\Java\\jre1.5.0_10\\bin\\rmiregistry.exe:*isabled:Java(TM) 2 Platform Standard Edition binary"
"C:\\Dokumente und Einstellungen\\ALI-B\\Lokale Einstellungen\\Temp\\Rar$EX29.391\\cl08seCu9\\cl08seCu9\\RouterRecorder.exe"="C:\\Dokumente und Einstellungen\\ALI-B\\Lokale Einstellungen\\Temp\\Rar$EX29.391\\cl08seCu9\\cl08seCu9\\RouterRecorder.exe:*isabled:RouterRecorder"
"C:\\WINDOWS\\system32\\dxdiag.exe"="C:\\WINDOWS\\system32\\dxdiag.exe:*isabled:Microsoft DirectX-Diagnoseprogramm"
"C:\\WINDOWS\\system32\\dpnsvr.exe"="C:\\WINDOWS\\system32\\dpnsvr.exe:*isabled:Microsoft DirectPlay8-Server"
"C:\\Programme\\Bonjour\\mDNSResponder.exe"="C:\\Programme\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\\Programme\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Programme\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Programme\\Windows Live\\Messenger\\livecall.exe"="C:\\Programme\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Programme\\FlashFXP\\FlashFXP.exe"="C:\\Programme\\FlashFXP\\FlashFXP.exe:*:Enabled:FlashFXP v3"
"C:\\Programme\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Programme\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Programme\\Windows Live\\Messenger\\livecall.exe"="C:\\Programme\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

Remaining Files :


File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes :

Sat 20 Jan 2007 4,348 A.SH. --- "C:\Dokumente und Einstellungen\All Users\DRM\DRMv1.bak"
Thu 18 Jan 2007 0 A.SH. --- "C:\Dokumente und Einstellungen\All Users\DRM\Cache\Indiv01.tmp"
Wed 9 Apr 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\2b81449fa4dc466aa723e9cde69e7537\BITD.tmp"
Thu 8 May 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\ccba472a05828aa2a3ee32c96c6466ca\BIT9.tmp"
Thu 5 Apr 2007 444 ...HR --- "C:\Dokumente und Einstellungen\ALI-B\Anwendungsdaten\SecuROM\UserData\securom_v7_01.bak"

Finished!