Naja was soll man machen =/

Hier ist 4)^^
Blacklight:
11/29/08 00:19:10 [Info]: BlackLight Engine 2.2.1092 initialized
11/29/08 00:19:10 [Info]: OS: 5.1 build 2600 (Service Pack 2)
11/29/08 00:19:10 [Note]: 7019 4
11/29/08 00:19:10 [Note]: 7005 0
11/29/08 00:19:17 [Note]: 7006 0
11/29/08 00:19:17 [Note]: 7011 1664
11/29/08 00:19:17 [Note]: 7035 0
11/29/08 00:19:17 [Note]: 7026 0
11/29/08 00:19:17 [Note]: 7026 0
11/29/08 00:19:19 [Note]: FSRAW library version 1.7.1024
11/29/08 00:22:13 [Note]: 7007 0


Und Malwarebytes Anti-Malware
Malwarebytes' Anti-Malware 1.30
Datenbank Version: 1433
Windows 5.1.2600 Service Pack 2

29.11.2008 01:00:10
mbam-log-2008-11-29 (01-00-10).txt

Scan-Methode: Vollständiger Scan (C:\|D:\|)
Durchsuchte Objekte: 118935
Laufzeit: 26 minute(s), 34 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 5
Infizierte Registrierungsschlüssel: 12
Infizierte Registrierungswerte: 5
Infizierte Dateiobjekte der Registrierung: 5
Infizierte Verzeichnisse: 5
Infizierte Dateien: 47

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
C:\WINDOWS\system32\gafuyowo.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\tosokevo.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\nukatojo.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\wogutopa.dll (Trojan.Vundo) -> Delete on reboot.
c:\WINDOWS\system32\dakegopu.dll (Trojan.BHO) -> Delete on reboot.

Infizierte Registrierungsschlüssel:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c8ab6c4f-30b5-4251-9062-e9a242f3ab09} (Trojan.BHO.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c8ab6c4f-30b5-4251-9062-e9a242f3ab09} (Trojan.BHO.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c8ab6c4f-30b5-4251-9062-e9a242f3ab09} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.BHO) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{9afb8248-617f-460d-9366-d71cdeda3179} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{037c7b8a-151a-49e6-baed-cc05fcb50328} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1a93c934-025b-4c3a-b38e-9654a7003239} (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6f282b65-56bf-4bd1-a8b2-a4449a05863d} (Adware.Gamesbar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\tdss (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\447d57b9 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\muwadayupu (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.BHO) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ssodl (Trojan.BHO) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpm474e6425 (Trojan.Agent) -> Delete on reboot.

Infizierte Dateiobjekte der Registrierung:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo) -> Data: c:\windows\system32\tosokevo.dll -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo) -> Data: c:\windows\system32\tosokevo.dll -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo) -> Data: system32\tosokevo.dll -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.BHO) -> Data: c:\windows\system32\dakegopu.dll -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.BHO) -> Data: system32\dakegopu.dll -> Delete on reboot.

Infizierte Verzeichnisse:
C:\Programme\Antivirus 2009 (Rogue.Antivirus 2009) -> Quarantined and deleted successfully.
C:\Programme\InternetGameBox (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programme\InternetGameBox\ressources (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programme\InternetGameBox\ressources\favoris (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programme\InternetGameBox\skins (Adware.EGDAccess) -> Quarantined and deleted successfully.

Infizierte Dateien:
C:\WINDOWS\system32\gafuyowo.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\owoyufag.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\jisagoyi.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\iyogasij.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\laroriwa.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\awiroral.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\tayanage.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\eganayat.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\zuyisuro.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\orusiyuz.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\nukatojo.dll (Trojan.BHO.H) -> Delete on reboot.
C:\WINDOWS\system32\tosokevo.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\wogutopa.dll (Trojan.Vundo) -> Delete on reboot.
c:\WINDOWS\system32\dakegopu.dll (Trojan.BHO) -> Delete on reboot.
C:\WINDOWS\system32\deluguba.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\pikumivu.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\TDSSbrsr.dll (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\TDSSoiqh.dll (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\TDSSriqp.dll (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\tehunevo.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\bisomasu.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\jibuvuna.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\cmdow.exe (Malware.Tool) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\TDSSpqlt.sys (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\TDSS2a85.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\TDSS2ce7.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\TDSS2de1.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\TDSS2edb.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\TDSS31c9.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\TDSScb78.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\Programme\InternetGameBox\InternetGameBox.exe (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programme\InternetGameBox\language (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programme\InternetGameBox\ressources\AttenteOff.html (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programme\InternetGameBox\ressources\AttenteOn.html (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programme\InternetGameBox\ressources\configv2_en.xml (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programme\InternetGameBox\ressources\configv2_es.xml (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programme\InternetGameBox\ressources\configv2_fr.xml (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programme\InternetGameBox\ressources\favoris\defaultv2.swf (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programme\InternetGameBox\skins\skinv2.skn (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\TDSSlxwp.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\TDSS272a.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\TDSSc723.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\Besitzer\Lokale Einstellungen\Temp\TDSSa6a1.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\Besitzer\Lokale Einstellungen\Temp\TDSSb8ea.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\Besitzer\Lokale Einstellungen\Temp\TDSSb8fa.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\Besitzer\Lokale Einstellungen\Temp\TDSSbb3c.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\TDSStkdu.log (Trojan.TDSS) -> Quarantined and deleted successfully.

Hier der Link für 5.

Man ich hoffe echt,dass das so richtig ist

Und 6.

Und 7. und letztends

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:33:25, on 29.11.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Programme\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Programme\CyberLink\PowerDVD\PDVDServ.exe
C:\Programme\Winamp\winampa.exe
C:\Programme\Java\jre1.6.0_07\bin\jusched.exe
C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
C:\WINDOWS\vsnpstd3.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\Programme\Windows Live\Messenger\MsnMsgr.Exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Programme\Ulead Systems\Ulead Photo Express 2 SE\CalCheck.exe
C:\PROGRA~1\GEMEIN~1\Nokia\MPAPI\MPAPI3s.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\Gemeinsame Dateien\PCSuite\Services\ServiceLayer.exe
C:\Programme\Skype\Phone\Skype.exe
C:\Programme\Skype\Plugin Manager\skypePM.exe
C:\Programme\TeamViewer3\TeamViewer.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\Dokumente und Einstellungen\Besitzer\Desktop\qlketzd.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mystart.magentic.com/english/
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar2.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programme\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programme\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar2.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Programme\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [RemoteControl] C:\Programme\CyberLink\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Programme\Winamp\winampa.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [PE2CKFNT SE] C:\Programme\Ulead Systems\Ulead Photo Express 2 SE\ChkFont.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PcSync] C:\Programme\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programme\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Programme\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [idle 01] C:\DOKUME~1\Besitzer\ANWEND~1\PLANIN~1\bold logo mode.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [muwadayupu] Rundll32.exe "C:\WINDOWS\system32\wogutopa.dll",s (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Acrobat - Schnellstart.lnk = ?
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Photo Express Calendar Checker SE.lnk = C:\Programme\Ulead Systems\Ulead Photo Express 2 SE\CalCheck.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Programme\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: In Adobe PDF konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: In vorhandene PDF-Datei konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/DE-DE/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1223386906142
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - C:\Programme\Gemeinsame Dateien\PCSuite\Services\ServiceLayer.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Programme\TuneUpUtilities2004\WinStylerThemeSvc.exe

--
End of file - 9725 bytes


So,ich hoffe das wars jetzt xD (Und ich hoff,ich hab richtig geschaut wegen Links und privaten Infos)

Wir sind noch nicht fertig

1.) Folgende Dateien bei Virustotal.com auswerten lassen und alle Ergebnisse posten, und zwar so, daß man die der einzelnen Virenscanner sehen kann. Bitte mit Dateigrößen und Prüfsummen:

C:\Dokumente und Einstellungen\Besitzer\Desktop\qlketzd.com
C:\DOKUME~1\Besitzer\ANWEND~1\PLANIN~1\bold logo mode.exe
         

Die Tilden durch die richtigen Dateinamen ersetzen. Der erste Ordner heißt "Dokumente und Einstellungen".

qlketzd.com

Antivirus Version letzte aktualisierung Ergebnis
AhnLab-V3 2008.11.28.2 2008.11.28 -
AntiVir 7.9.0.36 2008.11.28 -
Authentium 5.1.0.4 2008.11.28 -
Avast 4.8.1281.0 2008.11.28 -
AVG 8.0.0.199 2008.11.29 -
BitDefender 7.2 2008.11.29 -
CAT-QuickHeal 10.00 2008.11.28 -
ClamAV 0.94.1 2008.11.28 -
DrWeb 4.44.0.09170 2008.11.29 -
eSafe 7.0.17.0 2008.11.27 Suspicious File
eTrust-Vet 31.6.6234 2008.11.28 -
Ewido 4.0 2008.11.28 -
F-Prot 4.4.4.56 2008.11.28 -
F-Secure 8.0.14332.0 2008.11.29 -
Fortinet 3.117.0.0 2008.11.29 -
GData 19 2008.11.29 -
Ikarus T3.1.1.45.0 2008.11.28 -
K7AntiVirus 7.10.537 2008.11.28 -
Kaspersky 7.0.0.125 2008.11.29 -
McAfee 5448 2008.11.28 -
McAfee+Artemis 5448 2008.11.28 -
Microsoft 1.4104 2008.11.29 -
NOD32 3650 2008.11.28 -
Norman 5.80.02 2008.11.28 -
Panda 9.0.0.4 2008.11.29 Suspicious file
PCTools 4.4.2.0 2008.11.28 -
Prevx1 V2 2008.11.29 -
Rising 21.05.42.00 2008.11.28 -
SecureWeb-Gateway 6.7.6 2008.11.28 -
Sophos 4.36.0 2008.11.29 -
Sunbelt 3.1.1832.2 2008.11.27 -
Symantec 10 2008.11.28 -
TheHacker 6.3.1.1.166 2008.11.28 -
TrendMicro 8.700.0.1004 2008.11.28 -
VBA32 3.12.8.9 2008.11.28 -
ViRobot 2008.11.28.1491 2008.11.28 -
VirusBuster 4.5.11.0 2008.11.28 -
weitere Informationen
File size: 401720 bytes
MD5...: e8269245566be948f6a219135b434160
SHA1..: 1ac255b76ef692ea6c09d4840dcd28c67c5d6bfe
SHA256: 3c253bfd385c7f245f3c6131e58cbe22c0d03073a828b9938f923f00562d7c2d
SHA512: bed5aa905b0b940e99489c19835c1c199878ab7455bff84748b94a0577db8d8e
ebd66c96a3fc6db110bb6fde95947837860eb701c01cb65cb73488c7a464bae8
ssdeep: 6144:KCjUfQ7DbE66sVHdkyUkEYn+nVewn+ob/xIytqi20dcUSGreicGGSzMZY:K
CjUSbEAVG95YnNsr2ytL2cc3Gr1
PEiD..: UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser
TrID..: File type identification
UPX compressed Win32 Executable (39.5%)
Win32 EXE Yoda's Crypter (34.3%)
Win32 Executable Generic (11.0%)
Win32 Dynamic Link Library (generic) (9.8%)
Generic Win/DOS Executable (2.5%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x542830
timedatestamp.....: 0x466838c1 (Thu Jun 07 16:56:33 2007)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
UPX0 0x1000 0xfc000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
UPX1 0xfd000 0x46000 0x45a00 7.93 8764d7eac0301131e6c79e4aa30317bf
.rsrc 0x143000 0x1b000 0x1ae00 4.69 5f1a0873640fcdb4a281dbf91049814f

( 2 imports )
> KERNEL32.DLL: LoadLibraryA, GetProcAddress, VirtualProtect, ExitProcess
> MSVBVM60.DLL: -

( 0 exports )
ThreatExpert info: <a href='http://www.threatexpert.com/report.aspx?md5=e8269245566be948f6a219135b434160' target='_blank'>http://www.threatexpert.com/report.aspx?md5=e8269245566be948f6a219135b434160</a>
packers (Kaspersky): PE_Patch.UPX, UPX
packers (F-Prot): UPX

Und last but not least
bold_logo_mode.exe

Antivirus Version letzte aktualisierung Ergebnis
AhnLab-V3 2008.11.28.2 2008.11.28 -
AntiVir 7.9.0.36 2008.11.28 -
Authentium 5.1.0.4 2008.11.28 W32/Swizzor-based.2!Maximus
Avast 4.8.1281.0 2008.11.28 Win32:Swizzor-N
AVG 8.0.0.199 2008.11.28 -
BitDefender 7.2 2008.11.29 Trojan.Swizzor.2
CAT-QuickHeal 10.00 2008.11.28 -
ClamAV 0.94.1 2008.11.28 -
DrWeb 4.44.0.09170 2008.11.29 Trojan.Swizzor.based
eSafe 7.0.17.0 2008.11.27 -
eTrust-Vet 31.6.6234 2008.11.28 -
Ewido 4.0 2008.11.28 -
F-Prot 4.4.4.56 2008.11.28 W32/Swizzor-based.2!Maximus
F-Secure 8.0.14332.0 2008.11.29 Trojan.Win32.Obfuscated.gen
Fortinet 3.117.0.0 2008.11.29 W32/Obfuscated!tr
GData 19 2008.11.28 Trojan.Swizzor.2
Ikarus T3.1.1.45.0 2008.11.28 Trojan.Swizzor.1
K7AntiVirus 7.10.537 2008.11.28 -
Kaspersky 7.0.0.125 2008.11.29 Trojan.Win32.Obfuscated.gen
McAfee 5448 2008.11.28 -
McAfee+Artemis 5448 2008.11.28 -
Microsoft 1.4104 2008.11.29 -
NOD32 3650 2008.11.28 -
Norman 5.80.02 2008.11.28 -
Panda 9.0.0.4 2008.11.29 Adware/Lop
PCTools 4.4.2.0 2008.11.28 -
Prevx1 V2 2008.11.29 -
Rising 21.05.42.00 2008.11.28 Trojan.DL.Win32.Swizzor.cx
SecureWeb-Gateway 6.7.6 2008.11.28 -
Sophos 4.36.0 2008.11.29 -
Sunbelt 3.1.1832.2 2008.11.27 -
Symantec 10 2008.11.28 -
TheHacker 6.3.1.1.166 2008.11.28 -
TrendMicro 8.700.0.1004 2008.11.28 -
VBA32 3.12.8.9 2008.11.28 OScope.Trojan.BagsWay.C
ViRobot 2008.11.28.1491 2008.11.28 -
VirusBuster 4.5.11.0 2008.11.28 -
weitere Informationen
File size: 509440 bytes
MD5...: 671f32380554fb0f97ef09278c56b63b
SHA1..: 954616c926df2aef357a70eb91f8960c18ff7f01
SHA256: be49356f56407e61559bda6dcc5a7f6f2f3bbf13c4c671576847d169e12d33c6
SHA512: b0e0e6a41ec01c060d6939762dd097c1e9905e86a8a09fbe1c455e501070b9b4
8ab78115f7ad43f1332a5d803828a5358c80a8b35b9f3369452cdac151de7dde
ssdeep: 12288:PlS+3zM5M2o9IDdYXvgDUtUN+O+ct+NzXXV6na/tDpUFbm:NBM5pBrDUtU
LyBnknapEK
PEiD..: Armadillo v1.71
TrID..: File type identification
Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x412b98
timedatestamp.....: 0x473f8813 (Sun Nov 18 00:32:19 2007)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x27a52 0x27c00 6.37 6c8eed0d23f6f098f86bcca05b2d6f3c
.rdata 0x29000 0x36954 0x33c00 8.00 c7148b0ed75cbb47596771c9a0ec846c
.data 0x60000 0x1b7dd 0x1b800 7.36 25d57300a252d7516f5b87f85effe61b
.rsrc 0x7c000 0x51bb 0x5200 4.30 77191f4cc426764b75535bded9eb7019

( 5 imports )
> KERNEL32.dll: GetProcAddress, SetEnvironmentVariableA, GetModuleHandleA, GetTimeZoneInformation, GetFileType, CompareStringA, GetCurrentProcess, GetOEMCP, SetFilePointer, InitializeCriticalSection, CompareStringW, EnterCriticalSection, EnumResourceNamesW, LCMapStringA, LeaveCriticalSection, FlushFileBuffers, SetStdHandle, GetModuleFileNameA, GetLocalTime, GetEnvironmentVariableW, GetCurrentProcessId, SetLastError, CreateMutexA, GetLogicalDrives, GetStartupInfoA, MultiByteToWideChar, OpenWaitableTimerW, GetPrivateProfileSectionNamesA, InterlockedExchange, TerminateProcess, GetTickCount, IsBadWritePtr, GetCommandLineA, CompareFileTime, GlobalFlags, OpenMutexA, GetACP, QueryPerformanceCounter, ExitProcess, CloseHandle, HeapAlloc, HeapCreate, WriteFile, GetConsoleTitleW, DeleteCriticalSection, VirtualFree, LoadLibraryA, GetCPInfo, VirtualAlloc, GetVersion, TlsGetValue, HeapReAlloc, GetCurrentThreadId, LCMapStringW, GetAtomNameA, HeapFree, SetCriticalSectionSpinCount, SetWaitableTimer, TlsSetValue, GetLastError, GetEnvironmentStringsW, GetStringTypeA, WideCharToMultiByte, HeapDestroy, WaitForDebugEvent, GetStringTypeW, GetCurrentThread, FreeEnvironmentStringsW, FreeEnvironmentStringsA, GetSystemTime, ReadFile, GetEnvironmentStrings, VirtualQuery, TlsFree, InterlockedDecrement, SetHandleCount, GetStdHandle, GetSystemTimeAsFileTime, UnhandledExceptionFilter, GetSystemDefaultLCID, TlsAlloc, RtlUnwind, InterlockedIncrement
> USER32.dll: SendIMEMessageExW, DefWindowProcW, MessageBoxW, SetPropW, RegisterClassA, SetForegroundWindow, SetUserObjectInformationA, GrayStringW, ShowWindow, DestroyWindow, DdeQueryNextServer, DdeKeepStringHandle, RegisterClassExA, FindWindowExW, CreateWindowExW, VkKeyScanA
> comdlg32.dll: ChooseFontA, LoadAlterBitmap, ChooseFontW
> comctl32.dll: ImageList_LoadImageA, InitCommonControlsEx, ImageList_SetFlags, ImageList_GetImageCount, ImageList_SetDragCursorImage, DrawInsert, ImageList_GetIcon, ImageList_BeginDrag, ImageList_AddIcon, ImageList_Add, ImageList_Destroy, ImageList_Write, ImageList_DragShowNolock, DestroyPropertySheetPage, ImageList_GetFlags, CreateMappedBitmap, ImageList_DragMove, ImageList_SetBkColor, ImageList_Create, DrawStatusText
> ADVAPI32.dll: CryptSignHashW, RegEnumValueW, RegEnumKeyExA, RegEnumKeyExW, RegQueryValueW

( 0 exports )

voll viele böse Viren

1. Starte Hijackthis, Do a system scan only, markiere

O4 - HKCU\..\Run: [idle 01] C:\DOKUME~1\Besitzer\ANWEND~1\PLANIN~1\bold logo mode.exe
         

klick auf Fix checked

2. Starte im abgesicherten Modus (F8) und löschen den Ordner

c:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\plan inside
         

So beim Löschen des Ordners kam jetzt die Fehlermeldung:
Die Datei "0" ist eine Systemdatei.
Das System oder bestimmte Anwendungen können möglicherweise nicht fehlerfrei ausgeführt werden,wenn sie gelöscht wird.Möchten Sie den Löschvorgang durchführen?
Auf ja klicken?
Bevor noch was anderes kommt hab ich noch ne Frage ö.ö
Und zwar:Wie siehts jetzt mit Avira und so aus,Avira ist noch drauf,am besten Deinstallieren oder?
Und voll danke für die Hilfe,ich könnt dich abknutschen

1. Deaktiviere zeitweilig dein Antivirenscanner
2. Download LOP-uninstall zum Desktop
3. Führe bei Uninstall verification die siebenstellige Zahl ein und klicke Uninstall
4. Klicke bei Legal notice ok
5. Schließe alle Fenster und klicke ok
6. Warte…..und klicke bei Uninstall complete for all users ok

Zu früh gefreut,siehe oben xD

1. Download Deljob.exe zum Desktop
2. Doppelklick auf Deljob.exe
3. Ein logfile wird sich öffnen (logit.txt)
4. Kopiere den Inhalt des Berichts logit.txt in diesen Thread.

Sry, das ich nicht antworten konnte, habe mit 4 Fenstern gekämpft.

Ach macht nichts
Hilfst mir ja schon genug,dass du überhaupt antwortest^^
Und hier der Log

--------------------------------------------------------
Backups created in C:\deljob

AE220942918D8066.job
--------------------------------------------------------
Files in Windows Tasks folder

Auf Updates f�r Windows Live Toolbar pr�fen.job
--------------------------------------------------------
Export App Data folders
--------------------------------------------------------
Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: 447D-5716

Verzeichnis von C:\ProgramData

24.11.2008 07:32 <DIR> .
24.11.2008 07:32 <DIR> ..
24.11.2008 07:32 <DIR> RDPLAT~1.0 RD Platinum v5.0
0 Datei(en) 0 Bytes
3 Verzeichnis(se), 19.158.147.072 Bytes frei
--------------------------------------------------------
All User Accounts
--------------------------------------------------------
Administrator
All Users
Besitzer
--------------------------------------------------------

Auch wenns nicht meine Frage wegen dem Ordner
c:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\plan inside
beantwortet,wegen der Fehlermeldung^^

Kontrolliere nochmal, ob der noch da ist, falls ja, löschen, egal wie Windows warnt und mault.
Anschliessend rede ein ernstes Wort mit deiner Freundin und lasse dabei die Begriffe InternetGameBox und RD Platinum fallen.

wars das denn jetzt?^^
Und ernstes Wort red ich wohl eher mit ihrer Mama xD
Und wie siehts nun am besten,wie schon gefragt mit Avira aus?
Deinstallieren?
Wenn ja,könntest du ein besseres Virenschutzprogramm empfehlen,also Freeware^^
Und nochmals voll fett Danke für die Hilfe =)