Problem mit Internetverbindung !! Bitte um Hilfe!!

Peoples · 11.09.2008, 16:35

Hy,

seit gestern habe ich folgendes Problem, ich bekomme mit Programmen wie, Anti Virus (Update), Java (Update), diverse Poker Software und dem Mozilla Firefox keine Verbindung zum Internet.

ImageShack - Hosting :: firefoxkk6.jpg

ImageShack - Hosting :: java2wv8.jpg

ImageShack - Hosting :: pokerzi9.jpg

ImageShack - Hosting :: antivirushw5.jpg

Ich hab dann mal alle Firewall Programme ausgeschaltet, sowie die Router Firewall und die Windwos Firewall und getestet, aber immernoch das gleiche Problem. Dann habe ich Java nochmal erneut runtergeladen und versucht neu zu instalieren, doch dann kommt das ImageShack - Hosting :: javafg3.jpg.

,

Irgendwas blockt die Verbindungen von diesen Programmen, Internet Explorer und andere Programme wie z.B. Live Messenger funktionieren einwandfrei und lassen sich auch Updaten!!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:20:38, on 11.09.2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.17184)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Hp\QuickPlay\QPService.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Hp\HP Software Update\hpwuSchd2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Intertops Poker - {A2AB1320-B1B6-40fd-A694-8197D8596FFD} - C:\Microgaming\Poker\IntertopsMPP\MPPoker.exe (file missing)
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Program Files\PokerStars.NET\PokerStarsUpdate.exe
O13 - Gopher Prefix:
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A901F54C-293F-4A46-A88E-8FA9F24C4A1F}: NameServer = 192.168.2.1
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O20 - Winlogon Notify: __c001B6A9 - C:\Windows\system32\__c001B6A9.dat (file missing)
O20 - Winlogon Notify: __c0030D06 - C:\Windows\system32\__c0030D06.dat (file missing)
O20 - Winlogon Notify: __c003FA10 - C:\Windows\system32\__c003FA10.dat (file missing)
O20 - Winlogon Notify: __c004742E - C:\Windows\system32\__c004742E.dat (file missing)
O20 - Winlogon Notify: __c005B75B - C:\Windows\system32\__c005B75B.dat (file missing)
O20 - Winlogon Notify: __c005BF1D - C:\Windows\system32\__c005BF1D.dat (file missing)
O20 - Winlogon Notify: __c005FC51 - C:\Windows\system32\__c005FC51.dat (file missing)
O20 - Winlogon Notify: __c006B6CC - C:\Windows\system32\__c006B6CC.dat (file missing)
O20 - Winlogon Notify: __c006E730 - C:\Windows\system32\__c006E730.dat (file missing)
O20 - Winlogon Notify: __c006FB10 - C:\Windows\system32\__c006FB10.dat (file missing)
O20 - Winlogon Notify: __c007C666 - C:\Windows\system32\__c007C666.dat (file missing)
O20 - Winlogon Notify: __c00879DB - C:\Windows\system32\__c00879DB.dat (file missing)
O20 - Winlogon Notify: __c0088100 - C:\Windows\system32\__c0088100.dat (file missing)
O20 - Winlogon Notify: __c008E109 - C:\Windows\system32\__c008E109.dat (file missing)
O20 - Winlogon Notify: __c008FB88 - C:\Windows\system32\__c008FB88.dat (file missing)
O20 - Winlogon Notify: __c009503A - C:\Windows\system32\__c009503A.dat (file missing)
O20 - Winlogon Notify: __c0095784 - C:\Windows\system32\__c0095784.dat (file missing)
O20 - Winlogon Notify: __c00B20F6 - C:\Windows\system32\__c00B20F6.dat (file missing)
O20 - Winlogon Notify: __c00C8BD2 - C:\Windows\system32\__c00C8BD2.dat (file missing)
O20 - Winlogon Notify: __c00D5E11 - C:\Windows\system32\__c00D5E11.dat (file missing)
O20 - Winlogon Notify: __c00E76E1 - C:\Windows\system32\__c00E76E1.dat (file missing)
O20 - Winlogon Notify: __c00EB729 - C:\Windows\system32\__c00EB729.dat (file missing)
O20 - Winlogon Notify: __c00EF2AA - C:\Windows\system32\__c00EF2AA.dat (file missing)
O23 - Service: Avira AntiVir Personal - Free Antivirus Planer (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatisches LiveUpdate - Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\Windows\system32\brsvc01a.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Kennwortprüfung (ISPwdSvc) - Unknown owner - c:\Program Files\Norton Internet Security\isPwdSvc.exe (file missing)
O23 - Service: LibUsb-Win32 - Daemon, Version 0.1.10.1 (libusbd) - http://libusb-win32.sourceforge.net - C:\Windows\system32\libusbd-nt.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe

--
End of file - 14565 bytes

Danke

MFG

Peoples

cosinus · 11.09.2008, 20:15

Hallo und

Code:

ATTFilter

O20 - Winlogon Notify: __c001B6A9 - C:\Windows\system32\__c001B6A9.dat (file missing)
O20 - Winlogon Notify: __c0030D06 - C:\Windows\system32\__c0030D06.dat (file missing)
O20 - Winlogon Notify: __c003FA10 - C:\Windows\system32\__c003FA10.dat (file missing)
O20 - Winlogon Notify: __c004742E - C:\Windows\system32\__c004742E.dat (file missing)
O20 - Winlogon Notify: __c005B75B - C:\Windows\system32\__c005B75B.dat (file missing)
O20 - Winlogon Notify: __c005BF1D - C:\Windows\system32\__c005BF1D.dat (file missing)
O20 - Winlogon Notify: __c005FC51 - C:\Windows\system32\__c005FC51.dat (file missing)
O20 - Winlogon Notify: __c006B6CC - C:\Windows\system32\__c006B6CC.dat (file missing)
O20 - Winlogon Notify: __c006E730 - C:\Windows\system32\__c006E730.dat (file missing)
O20 - Winlogon Notify: __c006FB10 - C:\Windows\system32\__c006FB10.dat (file missing)
O20 - Winlogon Notify: __c007C666 - C:\Windows\system32\__c007C666.dat (file missing)
O20 - Winlogon Notify: __c00879DB - C:\Windows\system32\__c00879DB.dat (file missing)
O20 - Winlogon Notify: __c0088100 - C:\Windows\system32\__c0088100.dat (file missing)
O20 - Winlogon Notify: __c008E109 - C:\Windows\system32\__c008E109.dat (file missing)
O20 - Winlogon Notify: __c008FB88 - C:\Windows\system32\__c008FB88.dat (file missing)
O20 - Winlogon Notify: __c009503A - C:\Windows\system32\__c009503A.dat (file missing)
O20 - Winlogon Notify: __c0095784 - C:\Windows\system32\__c0095784.dat (file missing)
O20 - Winlogon Notify: __c00B20F6 - C:\Windows\system32\__c00B20F6.dat (file missing)
O20 - Winlogon Notify: __c00C8BD2 - C:\Windows\system32\__c00C8BD2.dat (file missing)
O20 - Winlogon Notify: __c00D5E11 - C:\Windows\system32\__c00D5E11.dat (file missing)
O20 - Winlogon Notify: __c00E76E1 - C:\Windows\system32\__c00E76E1.dat (file missing)
O20 - Winlogon Notify: __c00EB729 - C:\Windows\system32\__c00EB729.dat (file missing)
O20 - Winlogon Notify: __c00EF2AA - C:\Windows\system32\__c00EF2AA.dat (file missing)

Diese Einträge gehören gefixt.

Acker diese Punkte für weitere Analysen ab:

1.) Poste ein neues Hijackthis Logfile, nimm dazu diese umbenannte hijackthis.exe

2.) Deaktiviere die Systemwiederherstellung, im Verlauf der Infektion wurden auch Malwaredateien in Wiederherstellungspunkten mitgesichert - die sind alle nun unbrauchbar, da ein Zurücksetzen des System durch einen Wiederherstellungspunkt das System wahrscheinlich wieder infizieren würde.

3.) Führe dieses MBR-Tool aus und poste die Ausgabe

4.) Blacklight und Malwarebytes Antimalware ausführen und Logfiles posten

5.) Führe Silentrunners nach dieser Anleitung aus und poste das Logfile (mit Codetags umschlossen), falls es zu groß sein sollte kannst Du es (gezippt) bei file-upload.net hochladen und hier verlinken.

6.) ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir das Tool hier herunter auf den Desktop -> KLICK

Das Programm jedoch noch nicht starten sondern zuerst folgendes tun:

Schliesse alle Anwendungen und Programme, vor allem deine Antiviren-Software und andere Hintergrundwächter, sowie deinen Internetbrowser.
Vermeide es auch explizit während das Combofix läuft die Maus und Tastatur zu benutzen.

Dann folgende Anleitung durchlesen und abarbeiten -> CCleaner Systembereinigung

Starte nun die combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen und lass dein System durchsuchen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte abkopieren und in deinen Beitrag einfügen. Das log findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Hinweis: Combofix verhindert die Autostart Funktion aller CD / DVD und USB - Laufwerken um so eine Verbeitung einzudämmen. Wenn es hierdurch zu Problemen kommt, diese im Thread posten.

Poste alle Logfiles bitte mit Codetags umschlossen (#-Button) also so:

HTML-Code:

[code] Hier das Logfile rein! [/code]

7.) Mach auch ein Filelisting mit diesem script:

Script abspeichern per Rechtsklick, speichern unter auf dem Desktop
Doppelklick auf listing8.cmd auf dem Desktop
nach kurzer Zeit erscheint eine listing.txt auf dem Desktop

Diese listing.txt z.B. bei File-Upload.net hochladen und hier verlinken, da dieses Logfile zu groß fürs Board ist.

Peoples · 12.09.2008, 02:18

Code:

ATTFilter

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:50:46, on 12.09.2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.17184)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Hp\QuickPlay\QPService.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Hp\HP Software Update\hpwuSchd2.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\F-Secure Internet Security\FSGUI\fsguidll.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Windows\system32\conime.exe
C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\User\Desktop\qlketzd.com

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DE_DE&c=71&bd=Pavilion&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DE_DE&c=71&bd=Pavilion&pf=laptop
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Intertops Poker - {A2AB1320-B1B6-40fd-A694-8197D8596FFD} - C:\Microgaming\Poker\IntertopsMPP\MPPoker.exe (file missing)
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe (file missing)
O13 - Gopher Prefix: 
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/pr01/resources/VistaMSNPUpldde-de.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A901F54C-293F-4A46-A88E-8FA9F24C4A1F}: NameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{DCDC484F-E29C-4E8F-B5A0-0794CE3C4364}: NameServer = 192.168.2.1
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: Avira AntiVir Personal - Free Antivirus Planer (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatisches LiveUpdate - Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\Windows\system32\brsvc01a.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Kennwortprüfung (ISPwdSvc) - Unknown owner - c:\Program Files\Norton Internet Security\isPwdSvc.exe (file missing)
O23 - Service: LibUsb-Win32 - Daemon, Version 0.1.10.1 (libusbd) - http://libusb-win32.sourceforge.net - C:\Windows\system32\libusbd-nt.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - Unknown owner - C:\Program Files\Spyware Doctor\pctsAuxs.exe (file missing)
O23 - Service: PC Tools Security Service (sdCoreService) - Unknown owner - C:\Program Files\Spyware Doctor\pctsSvc.exe (file missing)
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe

--
End of file - 14150 bytes

Code:

ATTFilter

Stealth MBR rootkit detector 0.2.4 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
kernel: error reading MBR

Blacklight: Not Items were found

Code:

ATTFilter

Malwarebytes' Anti-Malware 1.27
Datenbank Version: 1127
Windows 6.0.6001 Service Pack 1

12.09.2008 02:19:09
mbam-log-2008-09-12 (02-19-09).txt

Scan-Methode: Quick-Scan
Durchsuchte Objekte: 49094
Laufzeit: 4 minute(s), 47 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 2
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 4
Infizierte Dateien: 76

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_CLASSES_ROOT\AppID\{2ae4c401-aac4-4f41-9665-1ec88c3bdd7d} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\sysvol32.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
C:\Casino (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\data (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\xrs (Adware.Casino) -> Quarantined and deleted successfully.

Infizierte Dateien:
C:\Casino\bet-at-home.com Poker\blackjack.dll (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\browser.exe (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\browserhost.exe (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\cardlib.dll (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\common.dll (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\creditdebit.dll (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\db.dll (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\devlib.dll (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\devlibcomm.dll (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\fivecard.dll (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\games.xrs (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\id.xrs (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\languages.xrs (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\libeay32.dll (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\mfc80.dll (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\microsoft.vc80.crt.manifest (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\microsoft.vc80.mfc.manifest (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\mss32.dll (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\msvcp80.dll (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\msvcr80.dll (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\navigator.dll (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\omaha.dll (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\options.cfg (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\poker.dll (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\sc.dll (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\shfolder.dll (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\ssleay32.dll (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\texas.dll (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\UNWISE.EXE (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\UNWISE.INI (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\update.exe (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\vistaelevator.dll (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\xml.dll (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\data\browserdetect.js (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\data\main.js (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\data\xml_decoder.js (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\xrs\blackjack_game_panel.xrs (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\xrs\blackjack_main.xrs (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\xrs\common.xrs (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\xrs\creditdebit.xrs (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\xrs\ext_clientspecific.xrs (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\xrs\ext_creditdebit.xrs (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\xrs\ext_game.xrs (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\xrs\ext_general.xrs (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\xrs\ext_mc_main.xrs (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\xrs\ext_navigator.xrs (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\xrs\fcs_main.xrs (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\xrs\fc_join.xrs (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\xrs\fc_main.xrs (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\xrs\filemap.xrs (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\xrs\filerefs.xrs (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\xrs\gameclient.xrs (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\xrs\game_common.xrs (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\xrs\game_common_message.xrs (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\xrs\game_common_mini.xrs (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\xrs\game_panel.xrs (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\xrs\game_panel_mini.xrs (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\xrs\gizmo.xrs (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\xrs\mc_main.xrs (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\xrs\message.xrs (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\xrs\mtt_join.xrs (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\xrs\mtt_lobby.xrs (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\xrs\navigator.xrs (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\xrs\omaha_join.xrs (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\xrs\omaha_main.xrs (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\xrs\omaha_main_mini.xrs (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\xrs\optdef.xrs (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\xrs\poker_limits.xrs (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\xrs\sc_join.xrs (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\xrs\sc_main.xrs (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\xrs\soko_main.xrs (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\xrs\tel_main.xrs (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\xrs\texas_join.xrs (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\xrs\texas_main.xrs (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\xrs\texas_main_mini.xrs (Adware.Casino) -> Quarantined and deleted successfully.
C:\Casino\bet-at-home.com Poker\xrs\tournament_join.xrs (Adware.Casino) -> Quarantined and deleted successfully.

Silentrunners Log:
Silent.rtf ... at uploaded.to - Free File Hosting, Free Image Hosting, Free Music Hosting, Free Video Hosting, ...

Peoples · 12.09.2008, 02:24

Teil 2

Code:

ATTFilter

ComboFix 08-09-10.04 - User 2008-09-12  2:36:08.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium   6.0.6001.1.1252.1.1031.18.937 [GMT 2:00]
ausgeführt von:: C:\Users\User\Desktop\ComboFix.exe
 * Neuer Wiederherstellungspunkt wurde erstellt
.

((((((((((((((((((((((((((((((((((((   Weitere L”schungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Windows\system32\actskn43.ocx
C:\Windows\system32\drivers\npf.sys
C:\Windows\system32\Packet.dll
C:\Windows\system32\WanPacket.dll
C:\Windows\system32\wpcap.dll

.
(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_NPF
-------\Service_NPF


(((((((((((((((((((((((   Dateien erstellt von 2008-08-12 bis 2008-09-12  ))))))))))))))))))))))))))))))
.

2008-09-12 02:42 . 2008-09-12 02:43	283,052,133	--a------	C:\Windows\MEMORY.DMP
2008-09-12 02:20 . 2008-09-12 02:20	399,648	--a------	C:\Users\User\Silent Runners.vbs
2008-09-12 02:12 . 2008-09-12 02:12	<DIR>	d--------	C:\Users\User\AppData\Roaming\Malwarebytes
2008-09-12 02:12 . 2008-09-12 02:12	<DIR>	d--------	C:\Users\All Users\Malwarebytes
2008-09-12 02:12 . 2008-09-12 02:12	<DIR>	d--------	C:\ProgramData\Malwarebytes
2008-09-12 02:12 . 2008-09-12 02:12	<DIR>	d--------	C:\Program Files\Malwarebytes' Anti-Malware
2008-09-12 02:12 . 2008-09-08 00:11	38,528	--a------	C:\Windows\System32\drivers\mbamswissarmy.sys
2008-09-12 02:12 . 2008-09-08 00:11	17,200	--a------	C:\Windows\System32\drivers\mbam.sys
2008-09-12 01:25 . 2008-09-12 01:25	<DIR>	d--------	C:\Program Files\CCleaner
2008-09-11 21:00 . 2008-09-11 21:00	<DIR>	d--------	C:\Program Files\bet-at-home.com Poker
2008-09-11 19:55 . 2008-07-31 03:13	4,240,384	--a------	C:\Windows\System32\GameUXLegacyGDFs.dll
2008-09-11 19:55 . 2008-06-26 05:29	303,616	--a------	C:\Windows\System32\wmpeffects.dll
2008-09-11 19:55 . 2008-07-31 05:32	28,160	--a------	C:\Windows\System32\Apphlpdm.dll
2008-09-11 19:54 . 2008-08-02 03:01	625,152	--a------	C:\Windows\System32\drivers\dxgkrnl.sys
2008-09-11 19:54 . 2008-06-26 05:29	565,248	--a------	C:\Windows\System32\emdmgmt.dll
2008-09-11 19:54 . 2008-05-08 21:21	211,968	--a------	C:\Windows\System32\drivers\mrxsmb10.sys
2008-09-11 19:54 . 2008-05-20 04:07	148,480	--a------	C:\Windows\System32\drivers\nwifi.sys
2008-09-11 19:54 . 2008-06-26 05:29	45,056	--a------	C:\Windows\System32\dataclen.dll
2008-09-11 19:54 . 2008-08-02 05:26	36,864	--a------	C:\Windows\System32\cdd.dll
2008-09-11 19:16 . 2008-09-11 19:16	<DIR>	d--------	C:\Users\All Users\Simply Super Software
2008-09-11 19:16 . 2008-09-11 19:16	<DIR>	d--------	C:\ProgramData\Simply Super Software
2008-09-11 19:16 . 2008-09-11 19:16	<DIR>	d--------	C:\Program Files\Trojan Remover
2008-09-11 19:09 . 2008-09-11 19:10	<DIR>	d--------	C:\Users\All Users\Lavasoft
2008-09-11 19:09 . 2008-09-11 19:10	<DIR>	d--------	C:\ProgramData\Lavasoft
2008-09-11 04:55 . 2008-09-11 04:56	<DIR>	d--------	C:\Program Files\Full Tilt Poker
2008-09-03 15:01 . 2008-09-11 23:06	<DIR>	d--------	C:\Program Files\Spyware Doctor
2008-09-03 15:01 . 2008-08-25 11:36	81,288	--a------	C:\Windows\System32\drivers\iksyssec.sys
2008-09-03 15:01 . 2008-08-25 11:36	66,952	--a------	C:\Windows\System32\drivers\iksysflt.sys
2008-09-03 15:01 . 2008-08-25 11:36	40,840	--a------	C:\Windows\System32\drivers\ikfilesec.sys
2008-09-03 15:01 . 2008-06-02 15:19	29,576	--a------	C:\Windows\System32\drivers\kcom.sys
2008-09-03 14:48 . 2008-09-03 14:48	<DIR>	d--------	C:\Users\All Users\Avira
2008-09-03 14:48 . 2008-09-03 14:48	<DIR>	d--------	C:\ProgramData\Avira
2008-08-28 17:51 . 2008-07-19 07:09	1,811,656	--a------	C:\Windows\System32\wuaueng.dll
2008-08-28 17:51 . 2008-07-19 05:44	1,524,736	--a------	C:\Windows\System32\wucltux.dll
2008-08-28 17:51 . 2008-07-19 07:10	53,448	--a------	C:\Windows\System32\wuauclt.exe
2008-08-28 17:51 . 2008-07-19 07:10	45,768	--a------	C:\Windows\System32\wups2.dll
2008-08-28 17:50 . 2008-07-19 07:09	563,912	--a------	C:\Windows\System32\wuapi.dll
2008-08-28 17:50 . 2008-07-18 22:08	163,904	--a------	C:\Windows\System32\wuwebv.dll
2008-08-28 17:50 . 2008-07-19 05:44	83,456	--a------	C:\Windows\System32\wudriver.dll
2008-08-28 17:50 . 2008-07-19 07:10	36,552	--a------	C:\Windows\System32\wups.dll
2008-08-28 17:50 . 2008-07-18 20:44	31,232	--a------	C:\Windows\System32\wuapp.exe
2008-08-24 14:30 . 2008-09-11 22:54	54,156	--ah-----	C:\Windows\QTFont.qfn
2008-08-24 14:30 . 2008-08-31 21:20	1,409	--a------	C:\Windows\QTFont.for
2008-08-17 19:24 . 2008-08-17 19:24	<DIR>	d--------	C:\Users\User\AppData\Roaming\Talkback
2008-08-17 03:56 . 2008-09-03 15:12	<DIR>	d--------	C:\Users\User\AppData\Roaming\F-Secure
2008-08-17 03:48 . 2008-09-11 20:36	<DIR>	d--------	C:\Users\All Users\F-Secure
2008-08-17 03:48 . 2008-09-11 20:36	<DIR>	d--------	C:\ProgramData\F-Secure
2008-08-17 03:48 . 2007-05-25 15:15	572,784	--a------	C:\Windows\System32\msvcp50.dll
2008-08-17 03:48 . 2007-05-25 15:10	67,120	--a------	C:\Windows\System32\drivers\fsdfw.sys
2008-08-17 03:48 . 2007-05-25 15:09	35,024	--a------	C:\Windows\System32\drivers\fses.sys
2008-08-17 03:46 . 2008-09-11 20:44	<DIR>	d--------	C:\Program Files\F-Secure Internet Security
2008-08-17 03:45 . 2008-09-11 20:33	<DIR>	d--------	C:\Users\All Users\fssg
2008-08-17 03:45 . 2008-09-11 20:33	<DIR>	d--------	C:\ProgramData\fssg
2008-08-17 03:24 . 2008-08-17 03:24	0	--a------	C:\Windows\pestpatrol5.INI
2008-08-17 03:22 . 2008-08-17 03:22	<DIR>	d--------	C:\Users\All Users\CA
2008-08-17 03:22 . 2008-08-17 03:22	<DIR>	d--------	C:\ProgramData\CA
2008-08-17 03:22 . 2008-08-17 04:00	<DIR>	d--------	C:\Program Files\Common Files\Scanner
2008-08-16 18:05 . 2008-08-16 18:05	<DIR>	d--------	C:\Users\User\AppData\Roaming\TVU Networks
2008-08-16 18:05 . 2008-08-16 18:05	<DIR>	d--------	C:\Users\All Users\TVU Networks
2008-08-16 18:05 . 2008-08-16 18:05	<DIR>	d--------	C:\ProgramData\TVU Networks
2008-08-16 18:05 . 2008-08-17 03:10	<DIR>	d--------	C:\Program Files\TVUPlayer
2008-08-16 05:13 . 2008-08-16 05:13	<DIR>	d--------	C:\Program Files\Avira
2008-08-15 17:37 . 2008-08-19 18:38	<DIR>	d--------	C:\Program Files\Microsoft Silverlight
2008-08-15 16:54 . 2008-06-21 11:20	1,555,456	--a------	C:\Windows\System32\mshtml.tlb
2008-08-15 16:54 . 2008-06-21 13:49	830,464	--a------	C:\Windows\System32\wininet.dll
2008-08-15 15:09 . 2008-08-15 15:09	<DIR>	d--------	C:\Program Files\Trend Micro
2008-08-13 16:25 . 2008-07-16 03:32	2,048	--a------	C:\Windows\System32\tzres.dll
2008-08-13 08:53 . 2008-06-19 05:31	361,984	--a------	C:\Windows\System32\IPSECSVC.DLL
2008-08-13 08:46 . 2008-04-18 07:48	269,312	--a------	C:\Windows\System32\es.dll
2008-08-13 08:40 . 2008-04-10 07:12	738,304	--a------	C:\Windows\System32\inetcomm.dll

.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-11 23:28	---------	d-----w	C:\Program Files\XDCC Catcher
2008-09-11 23:25	---------	d-----w	C:\ProgramData\Spybot - Search & Destroy
2008-09-11 23:16	---------	d-----w	C:\Program Files\Java
2008-09-11 21:04	---------	d---a-w	C:\ProgramData\TEMP
2008-09-11 19:03	---------	d-----w	C:\Program Files\Messenger Plus! Live
2008-09-11 18:02	---------	d-----w	C:\ProgramData\Microsoft Help
2008-09-11 17:59	---------	d-----w	C:\Program Files\Microsoft Works
2008-09-11 17:42	---------	d-----w	C:\Program Files\Windows Mail
2008-09-11 17:42	---------	d-----w	C:\Program Files\WiFi-Manager
2008-09-11 17:42	---------	d-----w	C:\Program Files\TVAnts
2008-09-11 17:42	---------	d-----w	C:\Program Files\TuneUp Utilities 2008
2008-09-11 17:09	---------	d-----w	C:\Program Files\Common Files\Wise Installation Wizard
2008-09-11 03:49	---------	d-----w	C:\Program Files\Norton Security Scan
2008-09-11 03:00	---------	d-----w	C:\Program Files\PokerStars.NET
2008-09-11 02:55	---------	d--h--w	C:\Program Files\InstallShield Installation Information
2008-09-10 19:29	90,736	----a-w	C:\Users\User\AppData\Roaming\nvModes.dat
2008-09-03 12:54	---------	d-----w	C:\Program Files\Spybot - Search & Destroy
2008-08-27 12:21	---------	d-----w	C:\Program Files\Hp
2008-08-16 17:15	12,588	----a-w	C:\Users\User\AppData\Roaming\wklnhst.dat
2008-08-16 04:34	---------	d-----w	C:\Program Files\DVDVideoSoft
2008-08-16 04:34	---------	d-----w	C:\Program Files\Common Files\DVDVideoSoft
2008-08-16 04:30	---------	d-----w	C:\Program Files\Vistumbler
2008-08-16 04:29	---------	d-----w	C:\Program Files\WiFi Hopper
2008-08-16 04:14	---------	d-----w	C:\Program Files\Norton Internet Security
2008-08-15 17:24	---------	d-----w	C:\Program Files\Common Files\Symantec Shared
2008-08-15 16:54	---------	d-----w	C:\Program Files\Network Stumbler
2008-08-15 16:22	---------	d-----w	C:\ProgramData\Symantec
2008-08-09 16:14	1,484	----a-w	C:\Program Files\RecConfig.xml
2008-08-04 18:51	---------	d-----w	C:\Users\User\AppData\Roaming\OpenOffice.org2
2008-07-31 03:32	460,288	----a-w	C:\Windows\AppPatch\AcSpecfc.dll
2008-07-31 03:32	2,154,496	----a-w	C:\Windows\AppPatch\AcGenral.dll
2008-07-31 03:32	173,056	----a-w	C:\Windows\AppPatch\AcXtrnal.dll
2008-07-30 15:42	23,888	----a-w	C:\Windows\system32\drivers\COH_Mon.sys
2008-07-30 15:28	706	----a-w	C:\Windows\system32\drivers\COH_Mon.inf
2008-07-30 15:28	10,537	----a-w	C:\Windows\system32\drivers\COH_Mon.cat
2008-07-30 01:10	---------	d-----w	C:\Users\User\AppData\Roaming\dvdcss
2008-07-29 19:36	---------	d-----w	C:\ProgramData\DVD Shrink
2008-07-29 19:34	---------	d-----w	C:\Program Files\DVD Shrink
2008-07-29 19:23	---------	d-----w	C:\Program Files\Makayama Interactive
2008-07-27 23:43	---------	d-----w	C:\Users\User\AppData\Roaming\Microgaming
2008-07-27 23:20	---------	d-----w	C:\Program Files\DVDlabPro2
2008-07-22 13:37	696,320	----a-w	C:\Windows\System32\WiFiMan.dll
2008-06-26 03:29	801,280	----a-w	C:\Windows\System32\NaturalLanguage6.dll
2008-06-26 01:45	2,644,480	----a-w	C:\Windows\System32\NlsLexicons0009.dll
2008-06-26 01:45	12,240,896	----a-w	C:\Windows\System32\NlsLexicons0007.dll
2008-06-20 11:13	174	--sha-w	C:\Program Files\desktop.ini
2008-06-20 10:33	82,432	----a-w	C:\Windows\System32\axaltocm.dll
2008-06-20 10:33	101,888	----a-w	C:\Windows\System32\ifxcardm.dll
2008-06-12 05:28	541,696	----a-w	C:\Windows\AppPatch\AcLayers.dll
2005-10-24 21:11	1,460,736	----a-w	C:\Program Files\No23Recorder.exe
.

((((((((((((((((((((((((((((   Autostart Punkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Eintrage & legitime Standardeintrage werden nicht angezeigt.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-19 125952]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2005-02-17 221184]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2008-03-28 1045800]
"ccApp"="c:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-10-25 107112]
"QlbCtrl"="C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-02-13 159744]
"HP Health Check Scheduler"="C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2006-12-04 46704]
"hpWirelessAssistant"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-03-01 472776]
"WAWifiMessage"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-11 317128]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-10 385024]
"QPService"="C:\Program Files\HP\QuickPlay\QPService.exe" [2008-02-01 468264]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-12-03 2213160]
"NeroFilterCheck"="C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 153136]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-06-05 185896]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-06-28 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-06-28 8433664]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-06-28 81920]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2007-05-28 528384]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 583048]
"F-Secure TNB"="C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" [2007-05-25 740208]
"HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-01-15 267048]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"F-Secure Manager"="C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" [2007-05-25 183208]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"RtHDVCpl"="RtHDVCpl.exe" [2007-03-01 C:\Windows\RtHDVCpl.exe]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.i420"= i420vfw.dll
"vidc.yv12"= yv12vfw.dll
"msacm.avis"= ff_acm.acm

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"WindowsWelcomeCenter"=rundll32.exe oobefldr.dll,ShowWelcomeCenter

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SMSERIAL"=C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile\AuthorizedApplications\List]
"C:\\Program Files\\FlashFXP\\FlashFXP.exe"= C:\Program Files\FlashFXP\FlashFXP.exe:*:Enabled:FlashFXP v3

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{B2B26A55-0FC2-4DC5-83AA-B01F8450FEB2}"= UDP:C:\Program Files\bet-at-home.com Poker\poker.exe:bet-at-home.com Poker
"{71EBD5D4-5215-457C-8CCF-BAA51F599E76}"= TCP:C:\Program Files\bet-at-home.com Poker\poker.exe:bet-at-home.com Poker
"{6625C9F4-BD12-422B-A594-2992CEA6BA0B}"= UDP:C:\Program Files\Avira\AntiVir PersonalEdition Classic\avcenter.exe:Avira AntiVir Personal starten
"{EA5304A2-1FCF-41C7-A3CC-363A41E73F87}"= TCP:C:\Program Files\Avira\AntiVir PersonalEdition Classic\avcenter.exe:Avira AntiVir Personal starten
"TCP Query User{3AF91404-FAFD-4D22-A9BC-96C32BE9F8E8}C:\\program files\\windows live\\messenger\\msnmsgr.exe"= UDP:C:\program files\windows live\messenger\msnmsgr.exe:Windows Live Messenger
"UDP Query User{965603DB-F690-4A33-907F-71923E67E430}C:\\program files\\windows live\\messenger\\msnmsgr.exe"= TCP:C:\program files\windows live\messenger\msnmsgr.exe:Windows Live Messenger

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"C:\\Program Files\\FlashFXP\\FlashFXP.exe"= C:\Program Files\FlashFXP\FlashFXP.exe:*:Enabled:FlashFXP v3

R1 F-Secure HIPS;F-Secure HIPS;C:\Program Files\F-Secure Internet Security\HIPS\fshs.sys [2007-05-25 48176]
R1 FSES;F-Secure Email Scanning Driver;C:\Windows\system32\drivers\fses.sys [2007-05-25 35024]
R1 FSFW;F-Secure Firewall Driver;C:\Windows\system32\drivers\fsdfw.sys [2007-05-25 67120]
R1 fsvista;F-Secure Vista Support Driver;C:\Program Files\F-Secure Internet Security\Anti-Virus\minifilter\fsvista.sys [2007-05-25 13168]
R2 {22D78859-9CE9-4B77-BF18-AC83E81A9263};{22D78859-9CE9-4B77-BF18-AC83E81A9263};C:\Program Files\HP\QuickPlay\000.fcl [2008-02-01 03:35 41456]
R2 Automatisches LiveUpdate - Scheduler;Automatisches LiveUpdate - Scheduler;C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe [2007-09-26 554352]
R2 QPCapSvc;QuickPlay Background Capture Service (QBCS);C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe [2008-02-01 271760]
R2 QPSched;QuickPlay Task Scheduler (QTS);C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe [2008-02-01 112016]
R2 UxTuneUp;TuneUp Designerweiterung;C:\Windows\System32\svchost.exe [2008-01-19 21504]
R3 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\F-Secure Internet Security\Anti-Virus\minifilter\fsgk.sys [2007-05-25 59760]
R3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.10.1;C:\Windows\system32\drivers\libusb0.sys [2005-03-09 33792]
R3 SYMNDISV;SYMNDISV;C:\Windows\system32\Drivers\SYMNDISV.SYS [2008-03-07 37936]
S3 AF15BDA;Cinergy T USB XE (MKII) service;C:\Windows\system32\drivers\AF15BDA.sys [2006-11-20 283776]
S3 NETw2v32;Intel(R) PRO/Wireless 2200BG Netzwerkverbindungstreiber für Windows Vista;C:\Windows\system32\DRIVERS\NETw2v32.sys [2007-03-06 2595840]
S3 s716bus;Sony Ericsson Device 716 driver (WDM);C:\Windows\system32\DRIVERS\s716bus.sys [2007-06-29 83208]
S3 s716mdfl;Sony Ericsson Device 716 USB WMC Modem Filter;C:\Windows\system32\DRIVERS\s716mdfl.sys [2007-06-29 15112]
S3 s716mdm;Sony Ericsson Device 716 USB WMC Modem Driver;C:\Windows\system32\DRIVERS\s716mdm.sys [2007-06-29 108552]
S3 s716mgmt;Sony Ericsson Device 716 USB WMC Device Management Drivers (WDM);C:\Windows\system32\DRIVERS\s716mgmt.sys [2007-06-29 100360]
S3 s716nd5;Sony Ericsson Device 716 USB Ethernet Emulation SEMC716 (NDIS);C:\Windows\system32\DRIVERS\s716nd5.sys [2007-06-29 23176]
S3 s716obex;Sony Ericsson Device 716 USB WMC OBEX Interface;C:\Windows\system32\DRIVERS\s716obex.sys [2007-06-29 98568]
S3 s716unic;Sony Ericsson Device 716 USB Ethernet Emulation SEMC716 (WDM);C:\Windows\system32\DRIVERS\s716unic.sys [2007-06-29 98952]
S3 TuneUp.Defrag;TuneUp Drive Defrag-Dienst;C:\Windows\System32\TuneUpDefragService.exe [2008-01-11 307968]
S4 F-Secure Filter;F-Secure File System Filter;C:\Program Files\F-Secure Internet Security\Anti-Virus\Win2K\FSfilter.sys [2007-05-25 40048]
S4 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\F-Secure Internet Security\Anti-Virus\Win2K\FSrec.sys [2007-05-25 25456]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
.
Inhalt des "geplante Tasks" Ordners
.
.
------- Zus„tzlicher Scan -------
.
FireFox -: Profile - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\qv5nwc2p.default\
FF -: plugin - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-12 02:43:48
Windows 6.0.6001 Service Pack 1 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostart Eintr„ge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
------------------------ Weitere, laufende Prozesse ------------------------
.
C:\Windows\System32\audiodg.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\Windows\System32\brss01a.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32.exe
C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
C:\Windows\System32\libusbd-nt.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\F-Secure Internet Security\Common\FSMB32.EXE
C:\Program Files\F-Secure Internet Security\Common\FCH32.EXE
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsqh.exe
C:\Program Files\F-Secure Internet Security\Common\FAMEH32.EXE
C:\Windows\System32\conime.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Windows\System32\WerFault.exe
C:\Program Files\F-Secure Internet Security\FSAUA\program\fsaua.exe
C:\Program Files\F-Secure Internet Security\FWES\program\fsdfwd.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure Internet Security\FSAUA\program\fsus.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsav32.exe
C:\Windows\System32\rundll32.exe
C:\Windows\ehome\ehsched.exe
C:\Windows\ehome\ehrecvr.exe
C:\Windows\System32\wbem\unsecapp.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\F-Secure Internet Security\FSGUI\fsguidll.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Windows\servicing\TrustedInstaller.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2008-09-12  2:55:28 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2008-09-12 00:55:12

Pre-Run: 15 Verzeichnis(se), 59,995,574,272 Bytes frei
Post-Run: 25 Verzeichnis(se), 59,406,692,352 Bytes frei

308	--- E O F ---	2008-09-11 18:04:07

Listing:

listing.txt ... at uploaded.to - Free File Hosting, Free Image Hosting, Free Music Hosting, Free Video Hosting, ...

Danke!!!

Problem mit Internetverbindung !! Bitte um Hilfe!!

Plagegeister aller Art und deren Bekämpfung: Problem mit Internetverbindung !! Bitte um Hilfe!!