Hallo habe ein Problem. Immer wenn ich ins Internet will kommt folgende Fehlermeldung!:

Siehe Anhang!

System Error! Attention! Some dangerous trojan horses detected in your System. Microdoft Windows XP files corrupted. This may lead to the destruction of important files in C:\\WINDOWS. Download protection Software now! Click oK to download the antispyware.

Wenn ich auf OK klicke will es IEAV.exe runterladen. Habe ich natürlich nicht gemacht!! Ist nur beim IE so, mit Firefox gehts!! Beim IE fliege ich nach einiger Zeit auch raus!!

Und wenn ich auf google gehe und einen Suchbegriff eingebe kommt das Hier:
!!Siehe Anhang!!

Außerdem lassen sich die Windows Updates nicht mehr installieren. Runterladen ja, aber dann kommt die Meldung: Folgende Updates wurden nicht installiert....

Hier mal die HijackLog:

Logfile of Trend Micro HijackThis v2.0.2

[edit]
bitte editiere zukünftig deine links, wie es dir u.a. hier angezeigt wird:
http://www.trojaner-board.de/22771-a...tml#post171958

danke
GUA
[/edit]

Hier noch COMBOFIX Log:

ComboFix 08-06-11.7 - OpTiKinG 2008-06-15 12:17:00.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1031.18.551 [GMT 2:00]
ausgeführt von:: C:\Dokumente und Einstellungen\OpTiKinG\Desktop\Alles Mögl\Programme\Setups\ComboFix.exe
* Neuer Wiederherstellungspunkt wurde erstellt
* Resident AV is active

.

(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\smp.bat
C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Anwendungsdaten\Microsoft\Windows Media\10.0\WMSDKNSD.XML

.
((((((((((((((((((((((( Dateien erstellt von 2008-05-15 bis 2008-06-15 ))))))))))))))))))))))))))))))
.

2008-06-15 00:18 . 2006-05-05 11:41 453,120 -----c--- C:\WINDOWS\system32\dllcache\mrxsmb.sys
2008-06-14 22:22 . 2008-06-14 22:22 <DIR> d-------- C:\Programme\Ashampoo
2008-06-14 22:03 . 2004-08-04 14:00 1,875,968 --a--c--- C:\WINDOWS\system32\dllcache\msir3jp.lex
2008-06-14 22:02 . 2004-08-04 14:00 13,463,552 --a--c--- C:\WINDOWS\system32\dllcache\hwxjpn.dll
2008-06-14 21:57 . 2008-06-14 23:12 <DIR> d-------- C:\WINDOWS\LastGood
2008-06-14 21:56 . 2008-06-14 21:56 488 -rah----- C:\WINDOWS\system32\logonui.exe.manifest
2008-06-14 21:55 . 2008-06-14 21:55 749 -rah----- C:\WINDOWS\WindowsShell.Manifest
2008-06-14 21:55 . 2008-06-14 21:55 749 -rah----- C:\WINDOWS\system32\wuaucpl.cpl.manifest
2008-06-14 21:55 . 2008-06-14 21:55 749 -rah----- C:\WINDOWS\system32\sapi.cpl.manifest
2008-06-14 21:55 . 2008-06-14 21:55 749 -rah----- C:\WINDOWS\system32\ncpa.cpl.manifest
2008-06-14 19:51 . 2008-06-15 01:15 <DIR> d-------- C:\Programme\Spyware Doctor
2008-06-14 19:51 . 2008-06-14 19:51 <DIR> d-------- C:\Dokumente und Einstellungen\OpTiKinG\Anwendungsdaten\PC Tools
2008-06-14 19:51 . 2007-12-10 13:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2008-06-14 19:51 . 2007-12-10 13:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2008-06-14 19:51 . 2008-02-01 11:55 42,376 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2008-06-14 19:51 . 2007-12-10 13:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2008-06-13 23:17 . 2008-06-13 23:17 281,088 --a------ C:\WINDOWS\topost8x.dll
2008-06-13 17:00 . 2008-06-13 17:00 <DIR> dr------- C:\Dokumente und Einstellungen\LocalService\Favoriten
2008-06-12 22:48 . 2008-06-12 22:48 <DIR> d-------- C:\Dokumente und Einstellungen\Pascal\Anwendungsdaten\Nero
2008-06-12 22:47 . 2007-03-31 15:31 <DIR> d--h----- C:\Dokumente und Einstellungen\Pascal\Vorlagen
2008-06-12 22:47 . 2006-09-05 16:14 <DIR> dr------- C:\Dokumente und Einstellungen\Pascal\Startmenü
2008-06-12 22:47 . 2006-09-05 16:17 <DIR> d--h----- C:\Dokumente und Einstellungen\Pascal\Netzwerkumgebung
2008-06-12 22:47 . 2008-06-15 12:22 <DIR> d--h----- C:\Dokumente und Einstellungen\Pascal\Lokale Einstellungen
2008-06-12 22:47 . 2008-06-12 22:47 <DIR> dr------- C:\Dokumente und Einstellungen\Pascal\Favoriten
2008-06-12 22:47 . 2008-06-12 22:47 <DIR> dr------- C:\Dokumente und Einstellungen\Pascal\Eigene Dateien
2008-06-12 22:47 . 2006-09-05 16:17 <DIR> d--h----- C:\Dokumente und Einstellungen\Pascal\Druckumgebung
2008-06-12 22:47 . 2006-09-05 16:23 <DIR> d-------- C:\Dokumente und Einstellungen\Pascal\Anwendungsdaten\ATI
2008-06-12 22:47 . 2008-06-12 22:48 <DIR> dr-h----- C:\Dokumente und Einstellungen\Pascal\Anwendungsdaten
2008-06-12 22:47 . 2008-06-12 22:47 <DIR> d-------- C:\Dokumente und Einstellungen\Pascal
2008-06-12 21:49 . 2004-08-04 14:00 1,086,058 -ra------ C:\WINDOWS\SETDF.tmp
2008-06-10 19:03 . 2008-06-10 20:52 594 --ahs---- C:\WINDOWS\system32\efxqcfox.ini
2008-06-05 21:11 . 2008-06-05 21:11 <DIR> d-------- C:\Dokumente und Einstellungen\OpTiKinG\Anwendungsdaten\Smart PC Solutions
2008-06-05 20:56 . 2008-06-05 21:11 <DIR> d-------- C:\Programme\Smart PC Solutions
2008-06-05 20:56 . 2008-06-05 20:56 <DIR> d-------- C:\Programme\Recuva
2008-06-05 18:10 . 2008-06-05 18:10 <DIR> d-------- C:\Programme\OO Software
2008-06-03 23:01 . 2008-06-03 23:01 <DIR> d-------- C:\phenomedia
2008-05-31 20:37 . 2008-06-09 22:20 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-05-31 20:37 . 2008-05-31 20:37 1,409 --a------ C:\WINDOWS\QTFont.for
2008-05-29 17:15 . 2008-05-29 17:15 <DIR> d-------- C:\Programme\Beneton Movie GIF
2008-05-27 23:26 . 2008-05-27 23:26 <DIR> d-------- C:\WINDOWS\PreviewSoft
2008-05-27 23:26 . 2008-05-27 23:26 <DIR> d-------- C:\WINDOWS\Noslip
2008-05-27 23:26 . 2008-05-27 23:26 <DIR> d-------- C:\Programme\Ulead Systems
2008-05-27 23:26 . 2008-05-27 23:26 4,808 --a------ C:\WINDOWS\system32\gaeffect.sti
2008-05-27 23:26 . 2008-05-27 23:26 3,176 --a------ C:\WINDOWS\system32\gafilter.sti
2008-05-27 23:26 . 2008-05-31 16:58 528 --ah----- C:\os466477.bin
2008-05-27 23:26 . 2008-05-31 16:58 513 --ah----- C:\WINDOWS\system32\ws344069.ocx
2008-05-27 23:26 . 2008-05-31 16:58 326 --a------ C:\WINDOWS\ULEAD32.INI
2008-05-22 21:07 . 2008-05-22 21:07 <DIR> d-------- C:\Programme\QIP
2008-05-22 15:11 . 2008-05-22 15:11 <DIR> d-------- C:\Programme\HDD Health
2008-05-22 15:06 . 2008-05-22 15:06 <DIR> d-------- C:\Programme\HD Tune
2008-05-17 20:45 . 2008-05-17 20:45 <DIR> d-------- C:\Programme\Eidos
2008-05-17 20:44 . 2008-05-17 20:44 <DIR> d-------- C:\WINDOWS\system32\xlive

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-14 23:35 --------- d-----w C:\Dokumente und Einstellungen\OpTiKinG\Anwendungsdaten\LimeWire
2008-06-14 23:18 --------- d---a-w C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP
2008-06-14 23:17 --------- d-----w C:\Programme\AVIConverter
2008-06-14 19:54 1,691 ----a-w C:\WINDOWS\inf\COM122.tmp
2008-06-14 17:38 --------- d-----w C:\Programme\PokerStars
2008-06-12 20:26 1,691 ----a-w C:\WINDOWS\inf\COM11A.tmp
2008-06-09 13:20 --------- d-----w C:\Programme\Activision
2008-06-05 19:08 --------- d-----w C:\Dokumente und Einstellungen\OpTiKinG\Anwendungsdaten\DivX
2008-06-01 16:35 --------- d-----w C:\Programme\PokerStars.NET
2008-05-30 22:34 --------- d-----w C:\Programme\Sony Ericsson
2008-05-30 22:34 --------- d-----w C:\Programme\Gemeinsame Dateien\Teleca Shared
2008-05-27 21:26 --------- d--h--w C:\Programme\InstallShield Installation Information
2008-05-14 16:15 --------- d-----w C:\Programme\Gemeinsame Dateien\Macromedia Shared
2008-05-14 16:14 --------- d-----w C:\Programme\Gemeinsame Dateien\Macromedia
2008-05-14 16:13 --------- d-----w C:\Programme\Macromedia
2008-05-12 17:49 --------- d-----w C:\Programme\Gemeinsame Dateien\PokerStars.com
2008-05-10 15:49 --------- d-----w C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DVD Shrink
2008-05-07 15:30 --------- d-----w C:\Programme\LimeWire
2008-05-05 21:15 --------- d-----w C:\Programme\Advanced GIF Animator
2008-05-05 21:06 --------- d-----w C:\Dokumente und Einstellungen\OpTiKinG\Anwendungsdaten\Obsidium
2008-05-04 10:04 --------- d-----w C:\Programme\Virtual Earth 3D
2008-04-30 15:28 --------- d-----w C:\Programme\DivX
2008-04-30 15:24 --------- d-----w C:\Programme\Google
2008-04-28 19:23 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
2008-04-28 19:23 --------- d-----w C:\Programme\Gemeinsame Dateien\xing shared
2008-04-28 19:23 --------- d-----w C:\Programme\Gemeinsame Dateien\Real
2008-04-26 15:46 --------- d-----w C:\Programme\Ubi Soft
2008-04-26 15:42 --------- d-----w C:\Programme\Red Storm Entertainment
2008-04-19 13:00 8,192 --sha-w C:\WINDOWS\o2cLicStore.bin
2008-04-18 15:56 --------- d-----w C:\Programme\EA SPORTS
2008-04-18 10:24 --------- d-----w C:\Programme\Picture It! Premium 10
2008-03-31 21:25 831,488 ----a-w C:\WINDOWS\system32\divx_xx0a.dll
2008-03-31 21:25 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2008-03-31 21:25 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2008-03-31 21:25 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2008-03-31 21:25 682,496 ----a-w C:\WINDOWS\system32\DivX.dll
2008-03-31 21:25 161,096 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-03-21 20:30 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2008-03-21 20:30 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2008-03-21 20:30 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2008-03-21 20:30 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2008-03-21 20:28 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2008-03-21 20:28 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2008-03-21 20:28 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2008-03-21 20:28 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2008-03-21 20:28 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2008-03-21 20:28 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2008-03-21 20:28 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2008-03-21 20:28 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2008-03-21 20:28 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2006-10-08 10:20 234 ----a-w C:\Dokumente und Einstellungen\OpTiKinG\Anwendungsdaten\wklnhst.dat
2003-02-28 10:32 11,776 ----a-w C:\WINDOWS\inf\dt154stickoem_wxp.exe
2002-11-14 20:32 55,808 ----a-w C:\WINDOWS\inf\devcon154stick.exe
.

(((((((((((((((((((((((((((( Autostart Punkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Hinweis* leere Eintrage & legitime Standardeintrage werden nicht angezeigt.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B095AF15-2FB6-4239-95AD-D1E27ECC11C7}]
2008-06-13 23:17 281088 --a------ C:\WINDOWS\topost8x.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{cb9c7c4a-4b05-4444-891e-7212708b68e0}]
C:\WINDOWS\system32\cxtirkkd.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NCLaunch"="C:\WINDOWS\NCLAUNCH.EXe" [2006-12-30 22:30 40960]
"Automatisch EPSON Stylus CX3600 Series auf LT-WOHNZIMMER"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.exe" [2004-03-04 05:00 98304]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="REM C:\Programme\Gemeinsame Dateien\Nero\Lib\NMIndexStoreSvr.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Programme\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"\\WOHNZIMMER\EPSON Stylus CX3600 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.exe" [2004-03-04 05:00 98304]
"Automatisch EPSON Stylus CX3600 Series auf WOHNZIMMER"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.exe" [2004-03-04 05:00 98304]
"avgnt"="C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" [2008-04-19 14:36 262401]
"ATICCC"="C:\Programme\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 17:41 45056]
"PinnacleDriverCheck"="C:\WINDOWS\system32\PSDrvCheck.exe" [2004-03-10 16:26 406016]
"Automatisch EPSON Stylus CX3600 Series auf LT-WOHNZIMMER"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.exe" [2004-03-04 05:00 98304]
"\\lt-wohnzimmer\EPSON Stylus CX3600 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.exe" [2004-03-04 05:00 98304]
"NeroFilterCheck"="C:\Programme\Gemeinsame Dateien\Nero\Lib\NeroCheck.exe" [2007-03-01 15:57 153136]
"NBKeyScan"="C:\Programme\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-12-03 15:21 2213160]
"TkBellExe"="C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" [2008-04-28 21:23 185896]
"BMbf38a165"="C:\WINDOWS\system32\pjmmgujp.dll" [ ]
"RTHDCPL"="RTHDCPL.EXE" [2006-06-28 14:54 16248320 C:\WINDOWS\RTHDCPL.EXE]
"SkyTel"="SkyTel.EXE" [2006-05-16 18:04 2879488 C:\WINDOWS\SkyTel.exe]
"AntiSpyWare2Guard"="C:\Programme\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWare2Guard.exe" [2007-07-18 03:35 2327040]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 14:00 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"tscuninstall"="C:\WINDOWS\system32\tscupgrd.exe" [2004-08-04 14:00 44544]

C:\Dokumente und Einstellungen\All Users\Startmen�\Programme\Autostart\
Microsoft Office.lnk - C:\Programme\Microsoft Office\Office\OSA9.EXE [1999-04-29 23:00:00 65588]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\awtrRlIb]
awtrRlIb.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\Google\GO333C~1\GOEC62~1.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.MJPG"= Pvmjpg21.dll
"VIDC.PIM1"= pclepim1.dll

[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Google Updater.lnk]
path=C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Google Updater.lnk
backup=C:\WINDOWS\pss\Google Updater.lnkCommon Startup

[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Sinus 154 stick WLAN Manager.lnk]
path=C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Sinus 154 stick WLAN Manager.lnk
backup=C:\WINDOWS\pss\Sinus 154 stick WLAN Manager.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare]
C:\Programme\BearShare\BearShare.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
--a------ 2006-11-12 12:48 157592 C:\Programme\DAEMON Tools\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
--a------ 2008-04-30 17:24 157696 C:\Programme\Google\Google Desktop Search\GoogleDesktop.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ Lite]
--a------ 2006-07-11 12:15 3144800 C:\Programme\ICQLite\ICQLite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Meta Default Ref Online]
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Ball Dash Meta Default\teamblah.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mouse-o-meter]
C:\WINDOWS\TEMP\MOUSE.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2004-10-13 18:24 1694208 C:\Programme\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Muscbrigade]
--a------ 2005-12-20 10:18 40960 c:\Musicbrigade\Musicbrigade.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Programme\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SDTray]
C:\Programme\Spyware Doctor\SDTrayApp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
--a------ 2006-05-16 18:04 2879488 C:\WINDOWS\SkyTel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
C:\Programme\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\STYLEXP]
C:\Programme\TGTSoft\StyleXP\StyleXP.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
--a------ 2007-06-13 18:19 68856 C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2008-04-28 21:23 185896 C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a------ 2007-10-10 07:28 36352 C:\Programme\Winamp1\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WindowSect]
C:\DOKUME~1\OpTiKinG\ANWEND~1\ONCEAI~1\Jump Glue.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winlogons.exe]
C:\Programme\Free KGB Key Logger\winlogons.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\{BC0B9256-088C-1031-0815-060510060031}]
C:\Programme\Gemeinsame Dateien\{BC0B9256-088C-1031-0815-060510060031}\Update.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"gusvc"=2 (0x2)
"SPYWAREfighterRP"=3 (0x3)
"StyleXPService"=2 (0x2)
"SBCSSvc"=2 (0x2)
"AVG Anti-Spyware Guard"=2 (0x2)
"FirebirdServerMAGIXInstance"=3 (0x3)
"Bonjour Service"=2 (0x2)
"sdCoreService"=2 (0x2)
"sdAuxService"=2 (0x2)
"PnkBstrA"=2 (0x2)
"NMIndexingService"=3 (0x3)
"LYUIVJC"=3 (0x3)
"FLEXnet Licensing Service"=3 (0x3)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Dokumente und Einstellungen\\OpTiKinG\\Desktop\\Counterstike Condition Zero\\Condition Zero\\czero.exe"=
"C:\\Programme\\LimeWire\\LimeWire.exe"=
"C:\\Programme\\EA GAMES\\Need for Speed Underground 2\\speed2.exe"=
"C:\\Programme\\Valve\\hlds.exe"=
"C:\\Programme\\Valve\\hl.exe"=
"C:\\Programme\\DATA BECKER\\America Gold Edition\\America.exe"=
"C:\\WINDOWS\\system32\\dplaysvr.exe"=
"C:\\Programme\\EA GAMES\\Need for Speed Most Wanted\\speed_loader.exe"=
"C:\\Dokumente und Einstellungen\\OpTiKinG\\Desktop\\Counterstike Condition Zero\\Condition Zero\\hlds.exe"=
"C:\\Dokumente und Einstellungen\\OpTiKinG\\Desktop\\Counterstike Condition Zero\\Condition Zero\\hltv.exe"=
"C:\\Programme\\ICQLite\\ICQLite.exe"=
"C:\\Programme\\EA GAMES\\Need for Speed Most Wanted\\speed.exe"=
"C:\\MAGIX\\mp3_maker_2005_SE\\mp3maker.exe"=
"C:\\Programme\\EA SPORTS\\FIFA 07\\fifa07.exe"=
"C:\\Programme\\Trillian\\trillian.exe"=
"C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\SAGENT4.EXE"=
"C:\\Programme\\Eidos Interactive\\Gut Gemischt 2\\GutGemischt2.exe"=
"C:\\Programme\\Messenger\\msmsgs.exe"=
"C:\\Programme\\Electronic Arts\\Command & Conquer 3\\RetailExe\\1.0\\cnc3game.dat"=
"C:\\Programme\\Midway Games\\Stranglehold\\Binaries\\Retail-Stranglehold.exe"=
"C:\\Programme\\EA SPORTS\\FIFA 08\\FIFA08.exe"=
"C:\\Programme\\World of Padman\\wop.exe"=
"C:\\Programme\\Electronic Arts\\Need for Speed ProStreet\\nfs.exe"=
"C:\\Programme\\Bonjour\\mDNSResponder.exe"=
"C:\\Programme\\Eidos\\Kane and Lynch Dead Men\\kaneandlynch.exe"=
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"C:\\Programme\\Internet Explorer\\IEXPLORE.EXE"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3587:TCP"= 3587:TCP:Windows-Peer-zu-Peer-Gruppierung
"3540:UDP"= 3540:UDP:Peer Name Resolution-Protokoll (PNRP)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R2 AASW2_Service;Ashampoo AntiSpyWare 2 Service;C:\Programme\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWareService.exe [2007-07-18 15:11]
R2 MZCCntrl;T-Online WLAN Adapter Steuerungsdienst;C:\Programme\Gemeinsame Dateien\Marmiko Shared\MZCCntrl.exe [2005-11-15 13:02]
R3 SCREAMINGBDRIVER;Screaming Bee Audio;C:\WINDOWS\system32\drivers\ScreamingBAudio.sys [2007-08-24 16:44]
S3 MACNDIS5;MACNDIS5 NDIS Protocol Driver;C:\PROGRA~1\GEMEIN~1\MARMIK~1\MACNDIS5.SYS [2005-11-24 12:36]
S3 MotDev;Motorola Inc. USB Device;C:\WINDOWS\system32\DRIVERS\motodrv.sys [2006-12-14 01:39]
S3 p2pgasvc;Peernetzwerk-Gruppenauthentifizierung;C:\WINDOWS\system32\svchost.exe [2004-08-04 14:00]
S3 p2pimsvc;Peernetzwerkidentitäts-Manager;C:\WINDOWS\system32\svchost.exe [2004-08-04 14:00]
S3 p2psvc;Peernetzwerk;C:\WINDOWS\system32\svchost.exe [2004-08-04 14:00]
S3 PNRPSvc;Peer Name Resolution-Protokoll;C:\WINDOWS\system32\svchost.exe [2004-08-04 14:00]
S3 UPnPService;UPnPService;C:\Programme\Gemeinsame Dateien\MAGIX Shared\UPnPService\UPnPService.exe [2006-12-14 18:00]
S3 Wdm1;Vivanco USB Link Cable Driver;C:\WINDOWS\system32\Drivers\usbbc.sys [2002-11-18 08:00]
S4 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;C:\Programme\MAGIX\Common\Database\bin\fbserver.exe [2005-11-17 16:18]
S4 LYUIVJC;LYUIVJC;C:\DOKUME~1\OpTiKinG\LOKALE~1\Temp\LYUIVJC.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc

*Newly Created Service* - CATCHME
.
Inhalt des "geplante Tasks" Ordners
"2008-06-15 05:00:00 C:\WINDOWS\Tasks\AED15AE891CECD54.job"
- c:\dokume~1\optiking\anwend~1\onceai~1\bits close web.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-15 12:22:47
Windows 5.1.2600 Service Pack 2 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostart Einträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
Zeit der Fertigstellung: 2008-06-15 12:27:20
ComboFix-quarantined-files.txt 2008-06-15 10:26:34
ComboFix2.txt 2008-06-13 20:06:27

46 Verzeichnis(se), 173,052,149,760 Bytes frei
49 Verzeichnis(se), 173,095,686,144 Bytes frei

293 --- E O F --- 2008-06-15 00:01:33


BITTE HELFT MIR!!!! :aplaus::Boogie

Da ist aber einiges an Müll im System. Werte diese Dateien

C:\WINDOWS\topost8x.dll
C:\WINDOWS\system32\cxtirkkd.dll
C:\WINDOWS\system32\pjmmgujp.dll
C:\WINDOWS\system32\tscupgrd.exe

bei virustotal.com aus und poste alle Ergebnisse. Laß danach auch mal Malwarebytes Anti-Malware durchlaufen, danach sehen wir weiter.

Datei topost8x.dll empfangen 2008.06.15 15:01:30 (CET)
Status: Laden ... Wartend Warten Überprüfung Beendet Nicht gefunden Gestoppt
Ergebnis: 5/32 (15.63%)
Laden der Serverinformationen...
Ihre Datei wartet momentan auf Position: ___.
Geschätzte Startzeit is zwischen ___ und ___ .
Dieses Fenster bis zum Abschluss des Scans nicht schließen.
Der Scanner, welcher momentan Ihre Datei bearbeitet ist momentan gestoppt. Wir warten einige Sekunden um Ihr Ergebnis zu erstellen.
Falls Sie längern als fünf Minuten warten, versenden Sie bitte die Datei erneut.
Ihre Datei wird momentan von VirusTotal überprüft,
Ergebnisse werden sofort nach der Generierung angezeigt.
Filter Filter
Drucken der Ergebnisse Drucken der Ergebnisse
Datei existiert nicht oder dessen Lebensdauer wurde überschritten
Dienst momentan gestoppt. Ihre Datei befindet sich in der Warteschlange (position: ). Diese wird abgearbeitet, wenn der Dienst wieder startet.

SIe können auf einen automatischen reload der homepage warten, oder ihre email in das untere formular eintragen. Klicken Sie auf "Anfragen", damit das System sie benachrichtigt wenn die Überprüfung abgeschlossen ist.
Email:

Antivirus Version letzte aktualisierung Ergebnis
AhnLab-V3 2008.6.13.1 2008.06.13 -
AntiVir 7.8.0.55 2008.06.14 -
Authentium 5.1.0.4 2008.06.14 -
Avast 4.8.1195.0 2008.06.15 -
AVG 7.5.0.516 2008.06.14 Adware Generic3.GSX
BitDefender 7.2 2008.06.15 -
CAT-QuickHeal 9.50 2008.06.14 -
ClamAV 0.92.1 2008.06.15 -
DrWeb 4.44.0.09170 2008.06.15 -
eSafe 7.0.15.0 2008.06.12 -
eTrust-Vet 31.6.5873 2008.06.14 -
Ewido 4.0 2008.06.15 -
F-Prot 4.4.4.56 2008.06.12 -
F-Secure 6.70.13260.0 2008.06.14 -
Fortinet 3.14.0.0 2008.06.15 -
GData 2.0.7306.1023 2008.06.15 -
Ikarus T3.1.1.26.0 2008.06.15 -
Kaspersky 7.0.0.125 2008.06.15 -
McAfee 5317 2008.06.13 -
Microsoft 1.3604 2008.06.15 Trojan:Win32/Delflob.I
NOD32v2 3187 2008.06.15 Win32/Adware.IeDefender.NFF
Norman 5.80.02 2008.06.13 -
Panda 9.0.0.4 2008.06.15 -
Prevx1 V2 2008.06.15 Cloaked Malware
Rising 20.48.61.00 2008.06.15 -
Sophos 4.30.0 2008.06.15 -
Sunbelt 3.0.1145.1 2008.06.05 -
Symantec 10 2008.06.15 Downloader.MisleadApp
TheHacker 6.2.92.350 2008.06.14 -
VBA32 3.12.6.7 2008.06.14 -
VirusBuster 4.3.26:9 2008.06.12 -
Webwasher-Gateway 6.6.2 2008.06.15 -
weitere Informationen
File size: 281088 bytes
MD5...: 62712854049f1caca4ca93edcafc9e84
SHA1..: 00c56ff6e48c74babbc0adfab28703c6dba5a726
SHA256: 5d5a7dca6f9261ee4a4ebfe06e0cc81527daf95461c9ba07e2159e97a7c16b10
SHA512: 519cab22b820af59524be5fa38bc35e926bb5d78b67ebadc2d8d0013a00de4f4
caf9b6e12ed4e8a67073c7bac7120f7851711674fb9ff1a8025057ed6661a6a9
PEiD..: ASPack v2.12
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x4f0001
timedatestamp.....: 0x2a425e19 (Fri Jun 19 22:22:17 1992)
machinetype.......: 0x14c (I386)

( 10 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0xc8000 0x34600 8.00 306eb99da2d939fd91d32770d2a834ac
.itext 0xc9000 0x2000 0x800 7.37 06885af0c22a8df360486942b5d5c9cc
.data 0xcb000 0x3000 0x1000 7.61 81f90720314bf5a8e54281c5172a2dd1
.bss 0xce000 0x4000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
.idata 0xd2000 0x3000 0xe00 7.93 2a8b7e14171171ef33d9c90f62dcbeb6
.edata 0xd5000 0x1000 0x200 1.87 63c08ace8d73089458810175aa699bd5
.reloc 0xd6000 0xc000 0x6800 7.99 161fb5a888c165a66507d846b09a7297
.rsrc 0xe2000 0xe000 0x5a00 7.59 19e59aba7135d6ec302d64f591e8bd43
.aspack 0xf0000 0x2000 0x1600 5.73 01466451b2772f390cda7ee8a462c7ca
.adata 0xf2000 0x1000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e

( 15 imports )
> kernel32.dll: GetProcAddress, GetModuleHandleA, LoadLibraryA
> oleaut32.dll: SysFreeString
> advapi32.dll: RegQueryValueExA
> user32.dll: GetKeyboardType
> user32.dll: CreateWindowExA
> gdi32.dll: UnrealizeObject
> version.dll: VerQueryValueA
> advapi32.dll: RegSetValueExA
> ole32.dll: IsEqualGUID
> oleaut32.dll: CreateErrorInfo
> ole32.dll: CreateStreamOnHGlobal
> oleaut32.dll: SafeArrayPtrOfIndex
> comctl32.dll: _TrackMouseEvent
> shell32.dll: ShellExecuteA
> advapi32.dll: ConvertStringSecurityDescriptorToSecurityDescriptorA

( 4 exports )
DllCanUnloadNow, DllGetClassObject, DllRegisterServer, DllUnregisterServer
Prevx info: TOPOST16A.DLL - Prevx
packers (Kaspersky): ASPack
packers (F-Prot): Aspack

die anderen find ich nich...

Lösch mal bitte ein paar Sachen mit dem Avenger - geh dazu so vor aber kopiere ins Textfeld bei Input your here das hier rein:

Files to delete:
C:\WINDOWS\SETDF.tmp
C:\WINDOWS\system32\efxqcfox.ini
C:\WINDOWS\system32\gafilter.sti
C:\os466477.bin
C:\WINDOWS\system32\ws344069.ocx
C:\WINDOWS\inf\COM122.tmp
C:\WINDOWS\inf\COM11A.tmp
C:\WINDOWS\system32\cxtirkkd.dll
C:\WINDOWS\system32\pjmmgujp.dll
C:\Dokumente und Einstellungen\OpTiKinG\Lokale Einstellungen\Temp\LYUIVJC.exe
C:\WINDOWS\Tasks\AED15AE891CECD54.job
c:\dokume~1\optiking\anwend~1\onceai~1\bits close web.exe
C:\WINDOWS\topost8x.dll
C:\WINDOWS\system32\tscupgrd.exe


Registry keys to delete:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B095AF15-2FB6-4239-95AD-D1E27ECC11C7}
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{cb9c7c4a-4b05-4444-891e-7212708b68e0}
HKLM\software\microsoft\windows nt\currentversion\winlogon\notify\awtrRlIb

Registry values to delete:
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run | NCLaunch
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run | BMbf38a165
HKLM\software\microsoft\windows nt\currentversion\winlogon\notify | awtrRlIb
         

Rechner rebooten - avenger Log posten. Falls Du jetzt schn Malwarebytes durchlaufen lassen hattest macht das nix.

Bearshare solltest Du unbedingt deinstallieren und nie wieder verwenden!! Limewire ist ebenso fragwürdig. Wenn Du munter weiter Tauschbörsen nutzt, um Dir Appz und Gamez zu ziehen, mußt Du Dich nicht wundern, wenn Dein System die Pest bekommt.

C:\Programme\Free KGB Key Logger\winlogons.exe

Key Logger? Bewußt installiert??

Folge dann auch nochmal bitte dem Link zu silentrunner in meiner Signatur und poste das Logfile.

hab Malwarebytes durchlaufen lassen. jetzt is des problem schon weg!! Soll ich trotzdem noch des mit dem avenger machen???

PS: Bearshare ist schon ewig deinstalliert. Un der Keylogger war absicht is aber auch schon ewig deinstalliert!!!

//////////////////////////////////////////
Avenger Pre-Processor log
//////////////////////////////////////////

Platform: Windows XP (build 2600, Service Pack 2)
Sun Jun 15 18:06:50 2008

18:06:42: Error: Invalid registry syntax in command:
"HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|NCLaunch"
Only registry keys under the HKEY_LOCAL_MACHINE hive are accessible to this program.
Skipping line. (Registry value deletion mode)


//////////////////////////////////////////


Logfile of The Avenger Version 2.0, (c) by Swandog46
Swandog46's Public Anti-Malware Tools

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File "C:\WINDOWS\SETDF.tmp" deleted successfully.
File "C:\WINDOWS\system32\efxqcfox.ini" deleted successfully.
File "C:\WINDOWS\system32\gafilter.sti" deleted successfully.
File "C:\os466477.bin" deleted successfully.
File "C:\WINDOWS\system32\ws344069.ocx" deleted successfully.
File "C:\WINDOWS\inf\COM122.tmp" deleted successfully.
File "C:\WINDOWS\inf\COM11A.tmp" deleted successfully.

Error: file "C:\WINDOWS\system32\cxtirkkd.dll" not found!
Deletion of file "C:\WINDOWS\system32\cxtirkkd.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "C:\WINDOWS\system32\pjmmgujp.dll" not found!
Deletion of file "C:\WINDOWS\system32\pjmmgujp.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "C:\Dokumente und Einstellungen\OpTiKinG\Lokale Einstellungen\Temp\LYUIVJC.exe" not found!
Deletion of file "C:\Dokumente und Einstellungen\OpTiKinG\Lokale Einstellungen\Temp\LYUIVJC.exe" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist

File "C:\WINDOWS\Tasks\AED15AE891CECD54.job" deleted successfully.

Error: file "c:\dokume~1\optiking\anwend~1\onceai~1\bits close web.exe" not found!
Deletion of file "c:\dokume~1\optiking\anwend~1\onceai~1\bits close web.exe" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "C:\WINDOWS\topost8x.dll" not found!
Deletion of file "C:\WINDOWS\topost8x.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist

File "C:\WINDOWS\system32\tscupgrd.exe" deleted successfully.

Error: registry key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B095AF15-2FB6-4239-95AD-D1E27ECC11C7}" not found!
Deletion of registry key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B095AF15-2FB6-4239-95AD-D1E27ECC11C7}" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist

Registry key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{cb9c7c4a-4b05-4444-891e-7212708b68e0}" deleted successfully.
Registry key "HKLM\software\microsoft\windows nt\currentversion\winlogon\notify\awtrRlIb" deleted successfully.

Error: could not delete registry value "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|BMbf38a165"
Deletion of registry value "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|BMbf38a165" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: could not delete registry value "HKLM\software\microsoft\windows nt\currentversion\winlogon\notify|awtrRlIb"
Deletion of registry value "HKLM\software\microsoft\windows nt\currentversion\winlogon\notify|awtrRlIb" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Completed script processing.

*******************

Finished! Terminate.


Der Silent Runners.vbs Log passt hier nich rein!!!

Ok soweit. Das silentrunners Log könntest Du hier als Anhang posten oder alternativ bei file-upload.net hochladen und hier verlinken. Poste bitte auch noch neues HijackThis logfile aber diesmal regelkonform!!

TEIL 2

Active Desktop and Wallpaper:
-----------------------------

Active Desktop may be disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

Displayed if Active Desktop enabled and wallpaper not set by Group Policy:
HKCU\Software\Microsoft\Internet Explorer\Desktop\General\
"Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp"

Displayed if Active Desktop disabled and wallpaper not set by Group Policy:
HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Dokumente und Einstellungen\OpTiKinG\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp"


Windows Portable Device AutoPlay Handlers
-----------------------------------------

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\

BridgeCS3ImportMediaOnArrival\
"Provider" = "Adobe Bridge CS3"
"InvokeProgID" = "Adobe.adobebridge"
"InvokeVerb" = "launch"
HKLM\SOFTWARE\Classes\Adobe.adobebridge\shell\launch\command\(Default) = "C:\Programme\Adobe\Adobe Bridge CS3\bridgeproxy.exe -v %1" ["Adobe Systems, Inc."]

dMCAudioCDInput\
"Provider" = "dMC Audio CD Input"
"InvokeProgID" = "dMC.AudioCD.Autorun"
"InvokeVerb" = "open"
HKLM\SOFTWARE\Classes\dMC.AudioCD.Autorun\shell\open\command\(Default) = ""C:\Programme\Illustrate\dBpowerAMP\CDGrab.exe"" ["Illustrate"]

DVDneXtCOPYPlayDVDMovieOnArrival\
"Provider" = "DVDneXtCOPY"
"InvokeProgID" = "DVDneXtCOPY"
"InvokeVerb" = "PlayDVDMovieOnArrival_DVDneXtCOPY"
HKLM\SOFTWARE\Classes\DVDneXtCOPY\shell\PlayDVDMovieOnArrival_DVDneXtCOPY\Command\(Default) = ""C:\Programme\DVDneXtCOPY2\DVDneXtCOPY2.exe" /WORK /NEW /SOURCE="%1"" [file not found]

IviDVDEventHandler\
"Provider" = "InterVideo WinDVD"
"InvokeProgID" = "Ivi.MediaFile"
"InvokeVerb" = "play"
HKLM\SOFTWARE\Classes\Ivi.MediaFile\shell\play\command\(Default) = "C:\Programme\InterVideo\WinDVD\WinDVD.exe %1" ["InterVideo Inc."]

IviVideoCDHandler\
"Provider" = "InterVideo WinDVD"
"InvokeProgID" = "Ivi.MediaFile"
"InvokeVerb" = "play"
HKLM\SOFTWARE\Classes\Ivi.MediaFile\shell\play\command\(Default) = "C:\Programme\InterVideo\WinDVD\WinDVD.exe %1" ["InterVideo Inc."]

MSPictureIt10ViewOnArrival\
"Provider" = "Microsoft Foto Designer-Bibliothek - Import-Assistent"
"InvokeProgID" = "Microsoft.Picture.It.10.AutoPlay"
"InvokeVerb" = "AutoPlay"
HKLM\SOFTWARE\Classes\Microsoft.Picture.It.10.AutoPlay\shell\AutoPlay\Command\(Default) = "C:\Programme\Picture It! Premium 10\imprtwiz.exe /invoke={D0551EC1-5A78-11cf-9DBE-00AA00A70BB5}" [MS]

MSWPDShellNamespaceHandler\
"Provider" = "@%SystemRoot%\System32\WPDShextRes.dll,-501"
"CLSID" = "{A55803CC-4D53-404c-8557-FD63DBA95D24}"
"InitCmdLine" = " "
-> {HKLM...CLSID} = "WPDShextAutoplay"
\LocalServer32\(Default) = "C:\WINDOWS\system32\WPDShextAutoplay.exe" [MS]

MXCDRBurningCDArrival\
"Provider" = "MAGIX Goya"
"InvokeProgID" = "Magix.MXCDR"
"InvokeVerb" = "Show"
HKLM\SOFTWARE\Classes\Magix.MXCDR\shell\Show\DropTarget\CLSID = "{FF482932-87EF-409E-9C02-48E9FF861CBF}"
-> {HKLM...CLSID} = "MXCDR AutoplayClass"
\LocalServer32\(Default) = "C:\Programme\MAGIX\Goya_burnR_mxcdr\Goya.exe" ["MAGIX AG"]

MXFotomakerBrowseOnArrival\
"Provider" = "MAGIX Digital Foto Maker 2007"
"InvokeProgID" = "Magix.Fotomaker"
"InvokeVerb" = "Brws"
HKLM\SOFTWARE\Classes\Magix.Fotomaker\shell\Brws\DropTarget\CLSID = "{51BD566E-A02D-4387-9A82-D929EA8C20B0}"
-> {HKLM...CLSID} = "MXFotomaker Autoplay Class"
\LocalServer32\(Default) = "C:\Programme\MAGIX\Foto_Manager_2007\FotoMaker.exe" ["MAGIX"]

MXFotomakerBurningCDArrival\
"Provider" = "MAGIX Digital Foto Maker 2007"
"InvokeProgID" = "Magix.Fotomaker"
"InvokeVerb" = "Burn"
HKLM\SOFTWARE\Classes\Magix.Fotomaker\shell\Burn\DropTarget\CLSID = "{51BD566E-A02D-4387-9A82-D929EA8C20B0}"
-> {HKLM...CLSID} = "MXFotomaker Autoplay Class"
\LocalServer32\(Default) = "C:\Programme\MAGIX\Foto_Manager_2007\FotoMaker.exe" ["MAGIX"]

MXFotomakerPlayAudioOnArrival\
"Provider" = "MAGIX Digital Foto Maker 2007"
"InvokeProgID" = "Magix.Fotomaker"
"InvokeVerb" = "PlayA"
HKLM\SOFTWARE\Classes\Magix.Fotomaker\shell\PlayA\DropTarget\CLSID = "{51BD566E-A02D-4387-9A82-D929EA8C20B0}"
-> {HKLM...CLSID} = "MXFotomaker Autoplay Class"
\LocalServer32\(Default) = "C:\Programme\MAGIX\Foto_Manager_2007\FotoMaker.exe" ["MAGIX"]

MXFotomakerPlayCDOnArrival\
"Provider" = "MAGIX Digital Foto Maker 2007"
"InvokeProgID" = "Magix.Fotomaker"
"InvokeVerb" = "PlayCD"
HKLM\SOFTWARE\Classes\Magix.Fotomaker\shell\PlayCD\DropTarget\CLSID = "{51BD566E-A02D-4387-9A82-D929EA8C20B0}"
-> {HKLM...CLSID} = "MXFotomaker Autoplay Class"
\LocalServer32\(Default) = "C:\Programme\MAGIX\Foto_Manager_2007\FotoMaker.exe" ["MAGIX"]

MXFotomakerShowPicturesOnArrival\
"Provider" = "MAGIX Digital Foto Maker 2007"
"InvokeProgID" = "Magix.Fotomaker"
"InvokeVerb" = "ShwPic"
HKLM\SOFTWARE\Classes\Magix.Fotomaker\shell\ShwPic\DropTarget\CLSID = "{51BD566E-A02D-4387-9A82-D929EA8C20B0}"
-> {HKLM...CLSID} = "MXFotomaker Autoplay Class"
\LocalServer32\(Default) = "C:\Programme\MAGIX\Foto_Manager_2007\FotoMaker.exe" ["MAGIX"]

MXMP3MakerBrowseOnArrival\
"Provider" = "MAGIX MP3 Maker 12"
"InvokeProgID" = "Magix.MP3Maker"
"InvokeVerb" = "Brws"
HKLM\SOFTWARE\Classes\Magix.MP3Maker\shell\Brws\DropTarget\CLSID = "{C783A282-958A-4684-9093-AB409B3834E0}"
-> {HKLM...CLSID} = "MXMP3Maker Autoplay Class"
\LocalServer32\(Default) = "C:\Programme\MAGIX\Music_Manager_2007\MP3Maker.exe" ["MAGIX"]

MXMP3MakerBurningCDArrival\
"Provider" = "MAGIX MP3 Maker 12"
"InvokeProgID" = "Magix.MP3Maker"
"InvokeVerb" = "Burn"
HKLM\SOFTWARE\Classes\Magix.MP3Maker\shell\Burn\DropTarget\CLSID = "{C783A282-958A-4684-9093-AB409B3834E0}"
-> {HKLM...CLSID} = "MXMP3Maker Autoplay Class"
\LocalServer32\(Default) = "C:\Programme\MAGIX\Music_Manager_2007\MP3Maker.exe" ["MAGIX"]

MXMP3MakerPlayAudioOnArrival\
"Provider" = "MAGIX MP3 Maker 12"
"InvokeProgID" = "Magix.MP3Maker"
"InvokeVerb" = "PlayA"
HKLM\SOFTWARE\Classes\Magix.MP3Maker\shell\PlayA\DropTarget\CLSID = "{C783A282-958A-4684-9093-AB409B3834E0}"
-> {HKLM...CLSID} = "MXMP3Maker Autoplay Class"
\LocalServer32\(Default) = "C:\Programme\MAGIX\Music_Manager_2007\MP3Maker.exe" ["MAGIX"]

MXMP3MakerPlayCDOnArrival\
"Provider" = "MAGIX MP3 Maker 12"
"InvokeProgID" = "Magix.MP3Maker"
"InvokeVerb" = "PlayCD"
HKLM\SOFTWARE\Classes\Magix.MP3Maker\shell\PlayCD\DropTarget\CLSID = "{C783A282-958A-4684-9093-AB409B3834E0}"
-> {HKLM...CLSID} = "MXMP3Maker Autoplay Class"
\LocalServer32\(Default) = "C:\Programme\MAGIX\Music_Manager_2007\MP3Maker.exe" ["MAGIX"]

MXMP3MakerPlayVideoOnArrival\
"Provider" = "MAGIX MP3 Maker 12"
"InvokeProgID" = "Magix.MP3Maker"
"InvokeVerb" = "PlayV"
HKLM\SOFTWARE\Classes\Magix.MP3Maker\shell\PlayV\DropTarget\CLSID = "{C783A282-958A-4684-9093-AB409B3834E0}"
-> {HKLM...CLSID} = "MXMP3Maker Autoplay Class"
\LocalServer32\(Default) = "C:\Programme\MAGIX\Music_Manager_2007\MP3Maker.exe" ["MAGIX"]

MXMP3MakerShowPicturesOnArrival\
"Provider" = "MAGIX MP3 Maker 12"
"InvokeProgID" = "Magix.MP3Maker"
"InvokeVerb" = "ShwPic"
HKLM\SOFTWARE\Classes\Magix.MP3Maker\shell\ShwPic\DropTarget\CLSID = "{C783A282-958A-4684-9093-AB409B3834E0}"
-> {HKLM...CLSID} = "MXMP3Maker Autoplay Class"
\LocalServer32\(Default) = "C:\Programme\MAGIX\Music_Manager_2007\MP3Maker.exe" ["MAGIX"]

MXSuiteBurningCDArrival\
"Provider" = "MAGIX Goya burnR"
"InvokeProgID" = "Magix.MXSuite"
"InvokeVerb" = "Show"
HKLM\SOFTWARE\Classes\Magix.MXSuite\shell\Show\DropTarget\CLSID = "{F9AD4E4F-B992-4B84-AC51-9F990D5F4738}"
-> {HKLM...CLSID} = "MAGIXSuite Autoplay Class"
\LocalServer32\(Default) = "C:\Programme\MAGIX\Goya_burnR\Goya.exe" ["MAGIX AG"]

MxVideoDeLuxeBurningCDArrival\
"Provider" = "MAGIX Video deLuxe 2005/2006 PLUS"
"InvokeProgID" = "Magix.videodeLuxe"
"InvokeVerb" = "Show"
HKLM\SOFTWARE\Classes\Magix.videodeLuxe\shell\Show\DropTarget\CLSID = "{1810360D-0FC7-474B-ABC1-84E96BF51D2F}"
-> {HKLM...CLSID} = "videodeLuxe AutoplayClass"
\LocalServer32\(Default) = "K:\ProgramZ 'n GameZ\VideoDeluxe\videodeLuxe.exe" [file not found]

MxVideoDeLuxeVideoCameraArrival\
"Provider" = "MAGIX Video deLuxe 2005/2006 PLUS"
"ProgID" = "Magix.videodeLuxe"
HKLM\SOFTWARE\Classes\Magix.videodeLuxe\CLSID\(Default) = "{1810360D-0FC7-474B-ABC1-84E96BF51D2F}"
-> {HKLM...CLSID} = "videodeLuxe AutoplayClass"
\LocalServer32\(Default) = "K:\ProgramZ 'n GameZ\VideoDeluxe\videodeLuxe.exe" [file not found]

NeroAutoPlay8AudioToNeroDigital\
"Provider" = "Nero Burning ROM"
"InvokeProgID" = "Nero.AutoPlay8"
"InvokeVerb" = "AudioToNeroDigital_PlayCDAudioOnArrival"
HKLM\SOFTWARE\Classes\Nero.AutoPlay8\shell\AudioToNeroDigital_PlayCDAudioOnArrival\command\(Default) = "C:\Programme\Nero\Nero8\Nero Burning Rom\nero.exe /Dialog:SaveTracks %L" ["Nero AG"]

NeroAutoPlay8CDAudio\
"Provider" = "Nero Express"
"InvokeProgID" = "Nero.AutoPlay8"
"InvokeVerb" = "CDAudio_HandleCDBurningOnArrival"
HKLM\SOFTWARE\Classes\Nero.AutoPlay8\shell\CDAudio_HandleCDBurningOnArrival\command\(Default) = "C:\Programme\Nero\Nero8\Nero Burning Rom\nero.exe -w /New:AudioCD" ["Nero AG"]

NeroAutoPlay8CopyCD\
"Provider" = "Nero Burning ROM"
"InvokeProgID" = "Nero.AutoPlay8"
"InvokeVerb" = "CopyCD_PlayMusicFilesOnArrival"
HKLM\SOFTWARE\Classes\Nero.AutoPlay8\shell\CopyCD_PlayMusicFilesOnArrival\command\(Default) = "C:\Programme\Nero\Nero8\Nero Burning Rom\nero.exe /DialogiscCopy %L" ["Nero AG"]

NeroAutoPlay8DataDisc_CD\
"Provider" = "Nero Express"
"InvokeProgID" = "Nero.AutoPlay8"
"InvokeVerb" = "DataDisc_CD_HandleCDBurningOnArrival"
HKLM\SOFTWARE\Classes\Nero.AutoPlay8\shell\DataDisc_CD_HandleCDBurningOnArrival\command\(Default) = "C:\Programme\Nero\Nero8\Nero Burning Rom\nero.exe -w /New:ISODisc /Media:CD %L" ["Nero AG"]

NeroAutoPlay8DataDisc_DVD\
"Provider" = "Nero Express"
"InvokeProgID" = "Nero.AutoPlay8"
"InvokeVerb" = "DataDisc_DVD_HandleDVDBurningOnArrival"
HKLM\SOFTWARE\Classes\Nero.AutoPlay8\shell\DataDisc_DVD_HandleDVDBurningOnArrival\command\(Default) = "C:\Programme\Nero\Nero8\Nero Burning Rom\nero.exe -w /New:ISODisc /MediaVD %L" ["Nero AG"]

NeroAutoPlay8LaunchNeroStartSmart\
"Provider" = "Nero StartSmart"
"InvokeProgID" = "Nero.AutoPlay8"
"InvokeVerb" = "LaunchNeroStartSmart_HandleDVDBurningOnArrival"
HKLM\SOFTWARE\Classes\Nero.AutoPlay8\shell\LaunchNeroStartSmart_HandleDVDBurningOnArrival\command\(Default) = "C:\Programme\Nero\Nero8\Nero StartSmart\NeroStartSmart.exe /AutoPlay" ["Nero AG"]

NeroAutoPlay8PlayAudioCD\
"Provider" = "Nero ShowTime"
"InvokeProgID" = "Nero.AutoPlay8"
"InvokeVerb" = "PlayAudioCD_PlayMusicFilesOnArrival"
HKLM\SOFTWARE\Classes\Nero.AutoPlay8\shell\PlayAudioCD_PlayMusicFilesOnArrival\command\(Default) = "C:\Programme\Nero\Nero8\Nero ShowTime\ShowTime.exe /Play %L" ["Nero AG"]

NeroAutoPlay8PlayDVD\
"Provider" = "Nero ShowTime"
"InvokeProgID" = "Nero.AutoPlay8"
"InvokeVerb" = "PlayDVD_PlayVideoFilesOnArrival"
HKLM\SOFTWARE\Classes\Nero.AutoPlay8\shell\PlayDVD_PlayVideoFilesOnArrival\command\(Default) = "C:\Programme\Nero\Nero8\Nero ShowTime\ShowTime.exe /Play %L" ["Nero AG"]

NeroAutoPlay8RipCD\
"Provider" = "Nero Burning ROM"
"InvokeProgID" = "Nero.AutoPlay8"
"InvokeVerb" = "RipCD_PlayCDAudioOnArrival"
HKLM\SOFTWARE\Classes\Nero.AutoPlay8\shell\RipCD_PlayCDAudioOnArrival\command\(Default) = "C:\Programme\Nero\Nero8\Nero Burning Rom\nero.exe /Dialog:SaveTracks %L" ["Nero AG"]

NeroAutoPlay8TranscodeVideo\
"Provider" = "Nero Recode"
"InvokeProgID" = "Nero.AutoPlay8"
"InvokeVerb" = "TranscodeVideo_PlayDVDMovieOnArrival"
HKLM\SOFTWARE\Classes\Nero.AutoPlay8\shell\TranscodeVideo_PlayDVDMovieOnArrival\command\(Default) = "C:\Programme\Nero\Nero8\Nero Recode\Recode.exe /New:CopyDVDVideo" ["Nero AG"]

NeroAutoPlay8VideoCapture\
"Provider" = "Nero Vision"
"ProgID" = "Shell.HWEventHandlerShellExecute"
"InitCmdLine" = ""C:\Programme\Nero\Nero8\Nero Vision\NeroVision.exe" /New:VideoCapture"
HKLM\SOFTWARE\Classes\Shell.HWEventHandlerShellExecute\CLSID\(Default) = "{FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}"
-> {HKLM...CLSID} = "ShellExecute HW Event Handler"
\LocalServer32\(Default) = "rundll32.exe shell32.dll,SHCreateLocalServerRunDll {FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}" [MS]

NeroAutoPlay8ViewPhotos\
"Provider" = "Nero PhotoSnap Viewer"
"InvokeProgID" = "Nero.AutoPlay8"
"InvokeVerb" = "ViewPhotos_ShowPicturesOnArrival"
HKLM\SOFTWARE\Classes\Nero.AutoPlay8\shell\ViewPhotos_ShowPicturesOnArrival\command\(Default) = "C:\Programme\Nero\Nero8\Nero PhotoSnap\PhotoSnapViewer.exe /" ["Nero AG"]

PCLEVideoCameraArrival\
"Provider" = "Pinnacle Studio"
"ProgID" = "Shell.HWEventHandlerShellExecute"
"InitCmdLine" = "C:\Programme\Pinnacle\Studio 9\programs\studio.exe"
HKLM\SOFTWARE\Classes\Shell.HWEventHandlerShellExecute\CLSID\(Default) = "{FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}"
-> {HKLM...CLSID} = "ShellExecute HW Event Handler"
\LocalServer32\(Default) = "rundll32.exe shell32.dll,SHCreateLocalServerRunDll {FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}" [MS]

RPCDBurningOnArrival\
"Provider" = "RealPlayer"
"InvokeProgID" = "RealPlayer.CDBurn.6"
"InvokeVerb" = "open"
HKCU\Software\Classes\RealPlayer.CDBurn.6\shell\open\command\(Default) = ""C:\Program Files\Real\RealPlayer\RealPlay.exe" /burn "%1"" ["RealNetworks, Inc."]

RPDeviceOnArrival\
"Provider" = "RealPlayer"
"ProgID" = "RealPlayer.HWEventHandler"
HKLM\SOFTWARE\Classes\RealPlayer.HWEventHandler\CLSID\(Default) = "{67E76F1D-BDE2-4052-913C-2752366192D2}"
-> {HKLM...CLSID} = "RealNetworks Scheduler"
\LocalServer32\(Default) = ""C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -autoplay" ["RealNetworks, Inc."]

RPPlayCDAudioOnArrival\
"Provider" = "RealPlayer"
"InvokeProgID" = "RealPlayer.AudioCD.6"
"InvokeVerb" = "play"
HKCU\Software\Classes\RealPlayer.AudioCD.6\shell\play\command\(Default) = ""C:\Program Files\Real\RealPlayer\RealPlay.exe" /play %1 " ["RealNetworks, Inc."]

RPPlayDVDMovieOnArrival\
"Provider" = "RealPlayer"
"InvokeProgID" = "RealPlayer.DVD.6"
"InvokeVerb" = "play"
HKCU\Software\Classes\RealPlayer.DVD.6\shell\play\command\(Default) = ""C:\Program Files\Real\RealPlayer\RealPlay.exe" /dvd %1 " ["RealNetworks, Inc."]

RPPlayMediaOnArrival\
"Provider" = "RealPlayer"
"InvokeProgID" = "RealPlayer.AutoPlay.6"
"InvokeVerb" = "open"
HKCU\Software\Classes\RealPlayer.AutoPlay.6\shell\open\command\(Default) = ""C:\Program Files\Real\RealPlayer\RealPlay.exe" /autoplay "%1"" ["RealNetworks, Inc."]

VLCPlayCDAudioOnArrival\
"Provider" = "VideoLAN VLC media player"
"InvokeProgID" = "VLC.CDAudio"
"InvokeVerb" = "play"
HKLM\SOFTWARE\Classes\VLC.CDAudio\shell\play\command\(Default) = "C:\Programme\VideoLAN\VLC\vlc.exe --started-from-file cdda:%1" ["VideoLAN Team"]

VLCPlayDVDMovieOnArrival\
"Provider" = "VideoLAN VLC media player"
"InvokeProgID" = "VLC.DVDMovie"
"InvokeVerb" = "play"
HKLM\SOFTWARE\Classes\VLC.DVDMovie\shell\play\command\(Default) = "C:\Programme\VideoLAN\VLC\vlc.exe --started-from-file dvd:%1" ["VideoLAN Team"]

WinampMTPHandler\
"Provider" = "Winamp"
"ProgID" = "Shell.HWEventHandlerShellExecute"
"InitCmdLine" = "C:\Programme\Winamp1\winamp.exe"
HKLM\SOFTWARE\Classes\Shell.HWEventHandlerShellExecute\CLSID\(Default) = "{FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}"
-> {HKLM...CLSID} = "ShellExecute HW Event Handler"
\LocalServer32\(Default) = "rundll32.exe shell32.dll,SHCreateLocalServerRunDll {FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}" [MS]


Startup items in "OpTiKinG" & "All Users" startup folders:
----------------------------------------------------------

C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart
"Microsoft Office" -> shortcut to: "C:\Programme\Microsoft Office\Office\OSA9.EXE -b -l" [MS]


Enabled Scheduled Tasks:
------------------------

"AED15AE891CECD54" -> launches: "c:\dokume~1\optiking\anwend~1\onceai~1\bits close web.exe" [file not found]


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "C:\WINDOWS\system32\pnrpnsp.dll" [MS]
000000000002\LibraryPath = "C:\WINDOWS\system32\pnrpnsp.dll" [MS]
000000000003\LibraryPath = "C:\Programme\Bonjour\mdnsNSP.dll" ["Apple Computer, Inc."]
000000000004\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000005\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000006\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 38
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05


Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
"{855F3B16-6D32-4FE6-8A56-BBB695989046}"
-> {HKLM...CLSID} = "ICQ Toolbar"
\InProcServer32\(Default) = "C:\Programme\ICQToolbar\toolbaru.dll" ["IE Toolbar"]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Konsole"
"CLSIDExtension" = "{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC}"
-> {HKCU...CLSID} = "Java Plug-in 1.6.0_05"
\InProcServer32\(Default) = "C:\Programme\Java\jre1.6.0_05\bin\ssv.dll" ["Sun Microsystems, Inc."]
-> {HKLM...CLSID} = "Java Plug-in 1.6.0_05"
\InProcServer32\(Default) = "C:\Programme\Java\jre1.6.0_05\bin\npjpi160_05.dll" ["Sun Microsystems, Inc."]

{94EDF7B4-4272-4AF3-8F8B-4E2F68E225B7}\
"ButtonText" = "PacificPoker4"
"Exec" = "C:\PROGRA~1\PACIFI~1\pacificpoker.exe" ["Cassava Ent."]

{B205A35E-1FC4-4CE3-818B-899DBBB3388C}\

{B863453A-26C3-4E1F-A54D-A2CD196348E9}\
"ButtonText" = "ICQ Lite"
"MenuText" = "ICQ Lite"
"Exec" = "C:\Programme\ICQLite\ICQLite.exe" ["ICQ Ltd."]

{F4430FE8-2638-42E5-B849-800749B94EED}\
"ButtonText" = "PartyPoker.net"
"MenuText" = "PartyPoker.net"

{FB5F1910-F110-11D2-BB9E-00C04F795683}\
"ButtonText" = "Messenger"
"MenuText" = "Windows Messenger"
"Exec" = "C:\Programme\Messenger\msmsgs.exe" [MS]


Miscellaneous IE Hijack Points
------------------------------

HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\
<<H>> "{855F3B16-6D32-4fe6-8A56-BBB695989046}" = (no title provided)
-> {HKLM...CLSID} = "ICQ Toolbar"
\InProcServer32\(Default) = "C:\Programme\ICQToolbar\toolbaru.dll" ["IE Toolbar"]


Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

AntiVir PersonalEdition Classic Guard, AntiVirService, "C:\Programme\AntiVir PersonalEdition Classic\avguard.exe" ["Avira GmbH"]
AntiVir PersonalEdition Classic Planer, AntiVirScheduler, "C:\Programme\AntiVir PersonalEdition Classic\sched.exe" ["Avira GmbH"]
Ashampoo AntiSpyWare 2 Service, AASW2_Service, "C:\Programme\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWareService.exe" [null data]
Ati HotKey Poller, Ati HotKey Poller, "C:\WINDOWS\system32\Ati2evxx.exe" ["ATI Technologies Inc."]
Einfache TCP/IP-Dienste, SimpTcp, "C:\WINDOWS\system32\tcpsvcs.exe" [MS]
IPv6-Hilfsdienst, 6to4, "C:\WINDOWS\system32\svchost.exe -k netsvcs" {"C:\WINDOWS\System32\6to4svc.dll" [MS]}
Nero BackItUp Scheduler 3, Nero BackItUp Scheduler 3, "C:\Programme\Nero\Nero8\Nero BackItUp\NBService.exe" ["Nero AG"]
T-Online WLAN Adapter Steuerungsdienst, MZCCntrl, "C:\Programme\Gemeinsame Dateien\Marmiko Shared\MZCCntrl.exe" ["T-Online International AG, Marmiko IT-Solutions GmbH"]


Print Monitors:
---------------

HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors\
LPR Port\Driver = "lprmon.dll" [MS]
Microsoft Shared Fax Monitor\Driver = "FXSMON.DLL" [MS]

Und hier noch Hijack Log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:49:06, on 15.06.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWareService.exe
C:\Programme\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
C:\Programme\Gemeinsame Dateien\Marmiko Shared\MZCCntrl.exe
C:\Programme\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE
C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe
C:\Programme\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Programme\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWare2Guard.exe
C:\WINDOWS\NCLAUNCH.EXe
C:\WINDOWS\System32\svchost.exe
C:\Programme\ATI Technologies\ATI.ACE\cli.exe
C:\Programme\ATI Technologies\ATI.ACE\cli.exe
C:\Programme\Messenger\msmsgs.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Programme\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWare2.exe
C:\Programme\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Nachrichten - Service - Shopping bei t-online.de
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Live Search
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Live Search
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: (no name) - {f83c6003-6fe1-4814-9b52-272bd8a64c77} - (no file)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [\\WOHNZIMMER\EPSON Stylus CX3600 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P39 "\\WOHNZIMMER\EPSON Stylus CX3600 Series" /O6 "USB001" /M "Stylus CX3600"
O4 - HKLM\..\Run: [Automatisch EPSON Stylus CX3600 Series auf WOHNZIMMER] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P53 "Automatisch EPSON Stylus CX3600 Series auf WOHNZIMMER" /O21 "\\WOHNZIMMER\Drucker3" /M "Stylus CX3600"
O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [ATICCC] "C:\Programme\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [Automatisch EPSON Stylus CX3600 Series auf LT-WOHNZIMMER] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P56 "Automatisch EPSON Stylus CX3600 Series auf LT-WOHNZIMMER" /O42 "\\LT-WOHNZIMMER\EPSON Stylus CX3600 Series" /M "Stylus CX3600"
O4 - HKLM\..\Run: [\\lt-wohnzimmer\EPSON Stylus CX3600 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P42 "\\lt-wohnzimmer\EPSON Stylus CX3600 Series" /O6 "USB001" /M "Stylus CX3600"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programme\Gemeinsame Dateien\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Programme\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [AntiSpyWare2Guard] C:\Programme\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWare2Guard.exe
O4 - HKCU\..\Run: [NCLaunch] C:\WINDOWS\NCLAUNCH.EXe
O4 - HKCU\..\Run: [Automatisch EPSON Stylus CX3600 Series auf LT-WOHNZIMMER] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P56 "Automatisch EPSON Stylus CX3600 Series auf LT-WOHNZIMMER" /M "Stylus CX3600" /EF "HKCU"
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -trayboot
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Add to Windows &Live Favorites - Add to Windows Live Favorites
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: PacificPoker4 - {94EDF7B4-4272-4af3-8F8B-4E2F68E225B7} - C:\PROGRA~1\PACIFI~1\pacificpoker.exe
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {4BFD075D-C36E-4F28-BB0A-5D472795197A} (PowerLoader Class) - http://**p://w*w.powerchallenge.com/...owerLoader.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://**p://update.microsoft.com/wi...?1213477884859
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GO333C~1\GOEC62~1.DLL
O23 - Service: Ashampoo AntiSpyWare 2 Service (AASW2_Service) - Unknown owner - C:\Programme\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWareService.exe
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Programme\Gemeinsame Dateien\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: T-Online WLAN Adapter Steuerungsdienst (MZCCntrl) - T-Online International AG, Marmiko IT-Solutions GmbH - C:\Programme\Gemeinsame Dateien\Marmiko Shared\MZCCntrl.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Programme\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: UPnPService - Magix AG - C:\Programme\Gemeinsame Dateien\MAGIX Shared\UPnPService\UPnPService.exe

--
End of file - 9004 bytes


DAS PROBLEM DAS DIE WINDOWS UPDATES NICHT INSTALLIERT WERDEN KÖNNEN BESTEHT WEITERHIN!!!!!!!!!!!!!

Zitat von jinchiller

DAS PROBLEM DAS DIE WINDOWS UPDATES NICHT INSTALLIERT WERDEN KÖNNEN BESTEHT WEITERHIN!!!!!!!!!!!!!

Schrei bitte nicht und reparier Deine Shift und 1-Taste.
Es hat niemals jmd gesagt daß nach erfolgter sogenannter Bereinigung Dein System nun wieder so zuverlässig arbeitet wie ein frisch aufgesetztes. Jede Installation und Deinstallation läßt das System altern - irgendwann ist soviel rauf und runterinstalliert worden, daß nur noch formatieren und neu installieren hilft. Ich habe den Eindruck bei Deinem PC ist es soweit aus ihm wieder ne Jungfrau zu machen

Hat auch den Vorteil, daß man Altlasten endlich loswird. Jungfrau eben.