Problem mit Explorer & Systemwiederherstellung

Kri · 14.12.2008, 14:46

Hallo zusammen,

ich hatte hier begonnen zu schreiben, da meine Problematik exakt die gleiche als die von "MAslaner", dabei habe ich gegen die Boardregeln verstoßen, wofür ich mich hier nocheinmal entschuldige.

Als erstes hab ich HJT drüber laufen lassen: Log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 05:24:16, on 14.12.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\ProgZ\Microsoft Office\Office12\GrooveMonitor.exe
C:\Programme\Microsoft IntelliType Pro\itype.exe
C:\WINDOWS\system32\rundll32.exe
C:\ProgZ\cFosSpeed\cFosSpeed.exe
C:\Programme\Synaptics\SynTP\SynTPEnh.exe
C:\Programme\FreePDF_XP\fpassist.exe
C:\ProgZ\DNsoft.be\DNsoft.be WiFi SiStr\WiFi SiStr.exe
C:\Programme\Microsoft IntelliType Pro\dpupdchk.exe
C:\ProgZ\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Programme\Bonjour\mDNSResponder.exe
C:\ProgZ\cFosSpeed\spd.exe
C:\WINDOWS\system32\svchost.exe
C:\ProgZ\Borland\InterBase\bin\ibguard.exe
C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\atwtusb.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\ProgZ\Borland\InterBase\bin\ibserver.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\ProgZ\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
F2 - REG:system.ini: UserInit=c:\windows\system32\userinit.exe,C:\ProgZ\KGB\MPK.exe
O1 - Hosts: 66.98.148.65 auto.search.msn.com
O1 - Hosts: 66.98.148.65 auto.search.msn.es
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: CmjBrowserHelperObject Object - {07A11D74-9D25-4fea-A833-8B0D76A5577A} - C:\ProgZ\Mindjet\MindManager 7\Mm7InternetExplorer.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\ProgZ\MICROS~1\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [GrooveMonitor] "C:\ProgZ\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [itype] "C:\Programme\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [BIH] C:\WINDOWS\system32\rundll32.exe bih.dll,InitGauge
O4 - HKLM\..\Run: [cFosSpeed] C:\ProgZ\cFosSpeed\cFosSpeed.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\ProgZ\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [AnyDVD] C:\ProgZ\SlySoft\AnyDVD\AnyDVDtray.exe
O4 - HKCU\..\Run: [WiFiSiStr] C:\ProgZ\DNsoft.be\DNsoft.be WiFi SiStr\WiFi SiStr.exe
O4 - HKLM\..\Policies\Explorer\Run: [Mpk.exe] C:\ProgZ\KGB\Mpk.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Microsoft Office Outlook 2007.lnk = ?
O4 - Startup: Samurize.lnk = C:\ProgZ\Samurize\Client.exe
O4 - Startup: SysTool.lnk = C:\ProgZ\SysTool\SysTool.exe
O8 - Extra context menu item: &NeoTrace It! - C:\ProgZ\NEOTRA~1\NTXcontext.htm
O8 - Extra context menu item: Hinzufügen zu Kaspersky Anti-Banner - C:\ProgZ\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Statistik für Web-Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ProgZ\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ProgZ\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ProgZ\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: Send to Mindjet MindManager - {941E1A34-C6AF-4baa-A973-224F9C3E04BF} - C:\ProgZ\Mindjet\MindManager 7\Mm7InternetExplorer.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\ProgZ\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\ProgZ\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra button: Klicke hier um das Projekt xp-AntiSpy zu unterstützen - {0e921e80-267a-42aa-aee4-60b9a1222a44} - C:\ProgZ\xp-AntiSpy\sponsoring\sponsor.html (HKCU)
O9 - Extra 'Tools' menuitem: Unterstützung für xp-AntiSpy - {0e921e80-267a-42aa-aee4-60b9a1222a44} - C:\ProgZ\xp-AntiSpy\sponsoring\sponsor.html (HKCU)
O9 - Extra button: NeoTrace It! - {9885224C-1217-4c5f-83C2-00002E6CEF2B} - C:\ProgZ\NEOTRA~1\NTXtoolbar.htm (HKCU)
O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v4.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\ProgZ\MICROS~1\Office12\GR99D3~1.DLL
O20 - AppInit_DLLs: C:\ProgZ\KASPER~1\KASPER~1.0\adialhk.dll
O20 - Winlogon Notify: crypt - C:\WINDOWS\
O20 - Winlogon Notify: wvjtyi - C:\WINDOWS\SYSTEM32\wvjtyi.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\ProgZ\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Programme\Bonjour\mDNSResponder.exe
O23 - Service: cFosSpeed System Service (cFosSpeedS) - cFos Software GmbH - C:\ProgZ\cFosSpeed\spd.exe
O23 - Service: FCI - Unknown owner - C:\WINDOWS\system32\svchost.exe:ext.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\ProgZ\MAGIX\Common\Database\bin\fbserver.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: ICF (icf) - Unknown owner - C:\WINDOWS\system32\svchost.exe:ext.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: InterBase Guardian (InterBaseGuardian) - Borland Software Corporation - C:\ProgZ\Borland\InterBase\bin\ibguard.exe
O23 - Service: InterBase Server (InterBaseServer) - Borland Software Corporation - C:\ProgZ\Borland\InterBase\bin\ibserver.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\ProgZ\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: StyleXPService - Unknown owner - C:\Programme\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: UPnPService - Magix AG - C:\Programme\Gemeinsame Dateien\MAGIX Shared\UPnPService\UPnPService.exe
O23 - Service: WTService - Unknown owner - C:\WINDOWS\system32\atwtusb.exe

--
End of file - 8586 bytes

Dann hab ich "MBAM" drüber laufen lassen, da hat er mir aber nach dem Restart die Dateien nicht gelöscht, da ich die "mbam.exe" in "test.exe" umbennen musste, da das Programm sonst vom Virus geblockt wurde: Log:

Malwarebytes' Anti-Malware 1.31
Datenbank Version: 1456
Windows 5.1.2600 Service Pack 2

14.12.2008 08:23:08
mbam-log-2008-12-14 (08-23-08).txt

Scan-Methode: Vollständiger Scan (C:\|D:\|)
Durchsuchte Objekte: 223131
Laufzeit: 2 hour(s), 17 minute(s), 59 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 2
Infizierte Registrierungsschlüssel: 15
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 2
Infizierte Verzeichnisse: 1
Infizierte Dateien: 36

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
C:\WINDOWS\system32\wvjtyi.dll (Trojan.FakeAlert) -> Delete on reboot.
C:\WINDOWS\system32\wvjtyi32.dll (Trojan.FakeAlert) -> Delete on reboot.

Infizierte Registrierungsschlüssel:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wvjtyi (Trojan.FakeAlert) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ati3jqxx (Rootkit.Agent) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\ati3jqxx (Rootkit.Agent) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\ati3jqxx (Rootkit.Agent) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ati3jqxx (Rootkit.Agent) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\tdss (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\restore (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fci (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\fci (Rootkit.ADS) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\fci (Rootkit.ADS) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\icf (Rootkit.ADS) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\icf (Rootkit.ADS) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\icf (Rootkit.ADS) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt (Trojan.Downloader) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: c:\windows\system32\ -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: system32\ -> Quarantined and deleted successfully.

Infizierte Verzeichnisse:
C:\WINDOWS\system32\IE updates (Adware.Agent) -> Quarantined and deleted successfully.

Infizierte Dateien:
C:\WINDOWS\system32\wvjtyi.dll (Trojan.FakeAlert) -> Delete on reboot.
C:\WINDOWS\system32\wvjtyi32.dll (Trojan.FakeAlert) -> Delete on reboot.
C:\WINDOWS\Adobe Pdf Money Guide.exe (Adware.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\ebook_library.dll (Adware.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\Checker.exe (Adware.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\TDSSbrsr.dll (Trojan.TDSS) -> Delete on reboot.
C:\WINDOWS\system32\TDSSoiqh.dll (Trojan.TDSS) -> Delete on reboot.
C:\WINDOWS\system32\TDSSpaxt.dll (Trojan.TDSS) -> Delete on reboot.
C:\WINDOWS\system32\TDSSriqp.dll (Trojan.TDSS) -> Delete on reboot.
C:\WINDOWS\system32\TDSSxfum.dll (Trojan.TDSS) -> Delete on reboot.
C:\WINDOWS\system32\drivers\ati3jqxx.sys (Rootkit.Agent) -> Delete on reboot.
C:\WINDOWS\system32\drivers\TDSSmqlt.sys (Trojan.TDSS) -> Delete on reboot.
C:\WINDOWS\Temp\akk10.tmp (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\qpm7.tmp (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\uig2.tmp (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\yyl1C.tmp (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\BN1A.tmp (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\BN5.tmp (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\BN59.tmp (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\BN7.tmp (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\BN8.tmp (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\BNF.tmp (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\IE updates\Roulette Cheat Guide - Make Money Online TODAY.url (Adware.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\IE updates\sexYsexlog.url (Adware.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\Crack.txt (Rogue.Link) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\How To Use The Checker.pdf (Rogue.Link) -> Quarantined and deleted successfully.
C:\WINDOWS\Quick Money Guide.pdf (Rogue.Link) -> Quarantined and deleted successfully.
C:\WINDOWS\Read Me First.txt (Rogue.Link) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\svchost.exe:ext.exe (Rootkit.ADS) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\Kri\Favoriten\Error Cleaner.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\Kri\Favoriten\Privacy Protector.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\Kri\Favoriten\Spyware&Malware Protection.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\TDSScfub.log (Trojan.TDSS) -> Delete on reboot.
C:\WINDOWS\system32\TDSSlxwp.dll (Rootkit.Agent) -> Delete on reboot.
C:\WINDOWS\system32\TDSSoeqh.dll (Rootkit.Agent) -> Delete on reboot.

Dann hab ich die "test.exe" wieder in "mbam.exe" zurückumbenannt und das ganze nochmal laufen lassen: Log:

Malwarebytes' Anti-Malware 1.31
Datenbank Version: 1456
Windows 5.1.2600 Service Pack 2

14.12.2008 13:20:52
mbam-log-2008-12-14 (13-20-52).txt

Scan-Methode: Vollständiger Scan (C:\|D:\|)
Durchsuchte Objekte: 223199
Laufzeit: 2 hour(s), 17 minute(s), 0 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 1
Infizierte Registrierungsschlüssel: 8
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 7

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
C:\WINDOWS\system32\wvjtyi.dll (Trojan.FakeAlert) -> Delete on reboot.

Infizierte Registrierungsschlüssel:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wvjtyi (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ati3jqxx (Rootkit.Agent) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\ati3jqxx (Rootkit.Agent) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\ati3jqxx (Rootkit.Agent) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ati3jqxx (Rootkit.Agent) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\restore (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\icf (Rootkit.ADS) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\icf (Rootkit.ADS) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\WINDOWS\system32\wvjtyi.dll (Trojan.FakeAlert) -> Delete on reboot.
C:\System Volume Information\_restore{363705E3-18DA-47DE-BC8B-B374215ABDF6}\RP211\A0101815.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\ati3jqxx.sys (Rootkit.Agent) -> Delete on reboot.
C:\WINDOWS\Temp\BN5.tmp (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\svchost.exe:ext.exe (Rootkit.ADS) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\Kri\Lokale Einstellungen\Temp\TDSS2b64.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\Kri\Lokale Einstellungen\Temp\TDSS2b83.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.

(Fortsetzung folgt..)

Kri · 14.12.2008, 14:49

Dann habe ich nach Anweisung von "Argus" weitere Schritte durchgeführt: (SDFIX & HJT)

SDFIX-Log

SDFix: Version 1.240
Run by Administrator on 14.12.2008 at 14:08

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix

Checking Services :

Rootkit Found :
C:\WINDOWS\system32\drivers\ATI3JQXX.sys - Rootkit Pandex/Cutwail - Protect.sys

Name :
restore
TDSSserv.sys
ATI3JQXX

Path :
\??\C:\WINDOWS\system32\drivers\restore.sys
\systemroot\system32\drivers\TDSSmqlt.sys
System32\Drivers\ati3jqxx.sys

restore - Deleted
TDSSserv.sys - Deleted
ATI3JQXX - Deleted

Restoring Default Security Values
Restoring Default Hosts File

Rebooting

Service ATI3JQXX - Deleted after Reboot

Checking Files :

Trojan Files Found:

C:\485035~1 - Deleted
C:\DOKUME~1\ADMINI~1.-AN\LOKALE~1\Temp\tmp6.tmp - Deleted
C:\WINDOWS\system32\drivers\setup\cmd.txt - Deleted
C:\WINDOWS\system32\drivers\setup\hosts\server.txt - Deleted
C:\WINDOWS\system32\drivers\setup\irc\server.txt - Deleted
C:\WINDOWS\system32\drivers\setup\mswinsck.ocx - Deleted
C:\WINDOWS\system32\drivers\setup\servers.txt - Deleted
C:\WINDOWS\system32\drivers\setup\startup.reg - Deleted
C:\WINDOWS\system32\drivers\TDSSmqlt.sys - Deleted
C:\WINDOWS\system32\TDSSosvd.dat - Deleted
C:\WINDOWS\SYSTEM32\TDSSOSVD.dat - Deleted
C:\WINDOWS\system32\drivers\ATI3JQXX.sys - Deleted

Removing Temp Files

ADS Check :

C:\WINDOWS\system32
:{4B9A1497-0817-47C4-9612-D6A1C53ACF57} 12
:{DA6227CB-326B-4B4D-9A81-04B61F1538DD} 12
Total size: 24 bytes.
system32: deleted 24 bytes in 2 streams.

Checking for remaining Streams

C:\WINDOWS\system32
No streams found.

Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-14 14:28:33
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

Remaining Services :

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\ProgZ\\Miranda IM\\miranda32.exe"="C:\\ProgZ\\Miranda IM\\miranda32.exe:*:Enabled:Miranda IM"
"C:\\ProgZ\\Azureus\\Azureus.exe"="C:\\ProgZ\\Azureus\\Azureus.exe:*:Enabled:Azureus"
"C:\\WINDOWS\\Adobe Pdf Money Guide.exe"="C:\\WINDOWS\\Adobe Pdf Money Guide.exe:*:Enabled:Adobe Pdf Money Guide"
"C:\\Programme\\Bonjour\\mDNSResponder.exe"="C:\\Programme\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\\ProgZ\\BearShare\\BearShare.exe"="C:\\ProgZ\\BearShare\\BearShare.exe:*:Enabled:BearShare"
"C:\\ProgZ\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"="C:\\ProgZ\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe:*:Enabled:BlueSoleil"
"C:\\ProgZ\\xchat\\xchat.exe"="C:\\ProgZ\\xchat\\xchat.exe:*:Enabled:XChat IRC Client"
"C:\\ProgZ\\Microsoft Office\\Office12\\OUTLOOK.EXE"="C:\\ProgZ\\Microsoft Office\\Office12\\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\\ProgZ\\Microsoft Office\\Office12\\GROOVE.EXE"="C:\\ProgZ\\Microsoft Office\\Office12\\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\\ProgZ\\Microsoft Office\\Office12\\ONENOTE.EXE"="C:\\ProgZ\\Microsoft Office\\Office12\\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\\WINDOWS\\system32\\PnkBstrA.exe"="C:\\WINDOWS\\system32\\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\\WINDOWS\\system32\\PnkBstrB.exe"="C:\\WINDOWS\\system32\\PnkBstrB.exe:*:Enabled:PnkBstrB"
"C:\\ProgZ\\Kaspersky Lab\\Kaspersky Internet Security 7.0\\avp.exe"="C:\\ProgZ\\Kaspersky Lab\\Kaspersky Internet Security 7.0\\avp.exe:*:Enabled:Kaspersky Anti-Virus"
"C:\\ProgZ\\CSpace\\CSpace.exe"="C:\\ProgZ\\CSpace\\CSpace.exe:*:Enabled:CSpace"
"C:\\Dokumente und Einstellungen\\Kri\\Lokale Einstellungen\\Temp\\java_ee_sdk-5_05-windows-ml.exe2\\package\\jre\\bin\\javaw.exe"="C:\\Dokumente und Einstellungen\\Kri\\Lokale Einstellungen\\Temp\\java_ee_sdk-5_05-windows-ml.exe2\\package\\jre\\bin\\javaw.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\\Dokumente und Einstellungen\\Kri\\Desktop\\eclipse\\eclipse.exe"="C:\\Dokumente und Einstellungen\\Kri\\Desktop\\eclipse\\eclipse.exe:*:Enabled:eclipse"
"C:\\ProgZ\\KGB\\Mpk.exe"="C:\\ProgZ\\KGB\\Mpk.exe:*:Enabled:TCP\\IP"
"C:\\ProgZ\\KGB\\MpkView.exe"="C:\\ProgZ\\KGB\\MpkView.exe:*:Enabled:TCP\\IP"
"C:\\ProgZ\\ASoft\\AutoExit\\AutoExit.exe"="C:\\ProgZ\\ASoft\\AutoExit\\AutoExit.exe:*:Enabled:Public Release Version"
"C:\\Dokumente und Einstellungen\\Kri\\Desktop\\soldatserver263\\soldatserver.exe"="C:\\Dokumente und Einstellungen\\Kri\\Desktop\\soldatserver263\\soldatserver.exe:*:Enabled:soldatserver"
"C:\\GameZ\\Soldat\\Soldat.exe"="C:\\GameZ\\Soldat\\Soldat.exe:*:Enabled:Soldat"
"C:\\GameZ\\Ascaron Entertainment\\Sacred 2 - Fallen Angel\\system\\s2gs.exe"="C:\\GameZ\\Ascaron Entertainment\\Sacred 2 - Fallen Angel\\system\\s2gs.exe:*:Enabled:Sacred 2 Game Server"
"C:\\GameZ\\Ascaron Entertainment\\Sacred 2 - Fallen Angel\\system\\sacred2.exe"="C:\\GameZ\\Ascaron Entertainment\\Sacred 2 - Fallen Angel\\system\\sacred2.exe:*:Enabled:Sacred 2"
"C:\\ProgZ\\ICQ6\\ICQ.exe"="C:\\ProgZ\\ICQ6\\ICQ.exe:*:Enabled:ICQ6"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

Remaining Files :

File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes :

Thu 10 Apr 2008 48 ..SH. --- "C:\WINDOWS\S961857DD.tmp"
Wed 3 May 2006 163,328 ..SHR --- "C:\WINDOWS\system32\flvDX.dll"
Wed 21 Feb 2007 31,232 ..SHR --- "C:\WINDOWS\system32\msfDX.dll"
Mon 17 Dec 2007 27,648 ..SH. --- "C:\WINDOWS\system32\Smab0.dll"
Mon 4 Oct 2004 417,792 A..H. --- "C:\Programme\Canon\Canon Setup Utility 2.3\Maint.exe"
Thu 27 May 2004 61,440 A..H. --- "C:\Programme\Canon\Canon Setup Utility 2.3\uinstrsc.dll"
Sun 5 Mar 2006 1,134,592 A..H. --- "C:\ProgZ\DNsoft.be\DNsoft.be WiFi SiStr\DevExpress.XtraEditors3.dll"
Sun 5 Mar 2006 1,028,096 A..H. --- "C:\ProgZ\DNsoft.be\DNsoft.be WiFi SiStr\DevExpress.XtraBars3.dll"
Sun 5 Mar 2006 397,312 A..H. --- "C:\ProgZ\DNsoft.be\DNsoft.be WiFi SiStr\DevExpress.Data3.dll"
Sun 5 Mar 2006 1,748,992 A..H. --- "C:\ProgZ\DNsoft.be\DNsoft.be WiFi SiStr\DevExpress.Utils3.dll"
Fri 12 Jan 2007 6,054,400 A..HR --- "C:\ProgZ\DNsoft.be\DNsoft.be WiFi SiStr\ieframe.dll"
Wed 2 May 2007 102,400 A..HR --- "C:\ProgZ\DNsoft.be\DNsoft.be WiFi SiStr\WiFi SiStr UST.exe"
Sun 26 Jun 2005 616,448 ..SHR --- "C:\ProgZ\eRightSoft\SUPER\cygwin1.dll"
Tue 21 Jun 2005 45,568 ..SHR --- "C:\ProgZ\eRightSoft\SUPER\cygz.dll"
Thu 13 Mar 2008 13,824 A.SHR --- "C:\ProgZ\eRightSoft\SUPER\DXdump.exe"
Sat 10 May 2008 72,704 ..SHR --- "C:\ProgZ\eRightSoft\SUPER\Setup.exe"
Tue 2 Oct 2007 16,896 A.SHR --- "C:\ProgZ\eRightSoft\SUPER\_Setup.dll"
Sun 13 Apr 2008 0 A.SH. --- "C:\Dokumente und Einstellungen\All Users\DRM\Cache\Indiv01.tmp"
Tue 4 Jun 2002 84,992 ...HR --- "C:\ProgZ\eRightSoft\SUPER\mencoder\14_43260.dll"
Tue 4 Jun 2002 44,032 ...HR --- "C:\ProgZ\eRightSoft\SUPER\mencoder\28_83260.dll"
Tue 10 Dec 2002 73,766 ...HR --- "C:\ProgZ\eRightSoft\SUPER\mencoder\atrc3260.dll"
Tue 10 Dec 2002 65,575 ...HR --- "C:\ProgZ\eRightSoft\SUPER\mencoder\cook3260.dll"
Sun 9 Jun 2002 36,864 ...HR --- "C:\ProgZ\eRightSoft\SUPER\mencoder\ddnt3260.dll"
Tue 4 Jun 2002 20,480 ...HR --- "C:\ProgZ\eRightSoft\SUPER\mencoder\dnet3260.dll"
Tue 10 Dec 2002 102,437 ...HR --- "C:\ProgZ\eRightSoft\SUPER\mencoder\drv13260.dll"
Tue 10 Dec 2002 176,165 ...HR --- "C:\ProgZ\eRightSoft\SUPER\mencoder\drv23260.dll"
Tue 10 Dec 2002 208,935 ...HR --- "C:\ProgZ\eRightSoft\SUPER\mencoder\drv33260.dll"
Tue 10 Dec 2002 217,127 ...HR --- "C:\ProgZ\eRightSoft\SUPER\mencoder\drv43260.dll"
Sun 9 Jun 2002 40,448 ...HR --- "C:\ProgZ\eRightSoft\SUPER\mencoder\dspr3260.dll"
Sun 4 Nov 2001 225,280 ...HR --- "C:\ProgZ\eRightSoft\SUPER\mencoder\ivvideo.dll"
Tue 10 Apr 2001 225,280 ...HR --- "C:\ProgZ\eRightSoft\SUPER\mencoder\qtmlClient.dll"
Fri 20 Feb 2004 232,960 ...HR --- "C:\ProgZ\eRightSoft\SUPER\mencoder\raac.dll"
Sun 9 Jun 2002 525,824 ...HR --- "C:\ProgZ\eRightSoft\SUPER\mencoder\rnco3260.dll"
Tue 10 Dec 2002 245,805 ...HR --- "C:\ProgZ\eRightSoft\SUPER\mencoder\rnlt3260.dll"
Tue 10 Dec 2002 45,093 ...HR --- "C:\ProgZ\eRightSoft\SUPER\mencoder\rv103260.dll"
Tue 10 Dec 2002 98,341 ...HR --- "C:\ProgZ\eRightSoft\SUPER\mencoder\rv203260.dll"
Tue 10 Dec 2002 94,247 ...HR --- "C:\ProgZ\eRightSoft\SUPER\mencoder\rv303260.dll"
Tue 10 Dec 2002 90,151 ...HR --- "C:\ProgZ\eRightSoft\SUPER\mencoder\rv403260.dll"
Tue 10 Dec 2002 102,439 ...HR --- "C:\ProgZ\eRightSoft\SUPER\mencoder\sipr3260.dll"
Sun 9 Jun 2002 49,152 ...HR --- "C:\ProgZ\eRightSoft\SUPER\mencoder\tokr3260.dll"
Thu 20 Mar 2008 5,632 ..SHR --- "C:\ProgZ\eRightSoft\SUPER\spk\1stRun.exe"
Wed 10 Dec 2008 444 ...HR --- "C:\Dokumente und Einstellungen\Kri\Anwendungsdaten\SecuROM\UserData\securom_v7_01.bak"

Finished!

HiJackThis-Log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:33:53, on 14.12.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\ProgZ\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Programme\Bonjour\mDNSResponder.exe
C:\ProgZ\cFosSpeed\spd.exe
C:\ProgZ\Borland\InterBase\bin\ibguard.exe
C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\atwtusb.exe
C:\ProgZ\Borland\InterBase\bin\ibserver.exe
C:\ProgZ\Microsoft Office\Office12\GrooveMonitor.exe
C:\Programme\Microsoft IntelliType Pro\itype.exe
C:\WINDOWS\system32\rundll32.exe
C:\ProgZ\cFosSpeed\cFosSpeed.exe
C:\Programme\Synaptics\SynTP\SynTPEnh.exe
C:\Programme\FreePDF_XP\fpassist.exe
C:\Programme\Microsoft IntelliType Pro\dpupdchk.exe
C:\ProgZ\DNsoft.be\DNsoft.be WiFi SiStr\WiFi SiStr.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\ProgZ\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: CmjBrowserHelperObject Object - {07A11D74-9D25-4fea-A833-8B0D76A5577A} - C:\ProgZ\Mindjet\MindManager 7\Mm7InternetExplorer.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\ProgZ\MICROS~1\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [GrooveMonitor] "C:\ProgZ\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [itype] "C:\Programme\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [BIH] C:\WINDOWS\system32\rundll32.exe bih.dll,InitGauge
O4 - HKLM\..\Run: [cFosSpeed] C:\ProgZ\cFosSpeed\cFosSpeed.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe
O4 - HKCU\..\Run: [AnyDVD] C:\ProgZ\SlySoft\AnyDVD\AnyDVDtray.exe
O4 - HKCU\..\Run: [WiFiSiStr] C:\ProgZ\DNsoft.be\DNsoft.be WiFi SiStr\WiFi SiStr.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Microsoft Office Outlook 2007.lnk = ?
O4 - Startup: Samurize.lnk = C:\ProgZ\Samurize\Client.exe
O4 - Startup: SysTool.lnk = C:\ProgZ\SysTool\SysTool.exe
O8 - Extra context menu item: &NeoTrace It! - C:\ProgZ\NEOTRA~1\NTXcontext.htm
O8 - Extra context menu item: Hinzufügen zu Kaspersky Anti-Banner - C:\ProgZ\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Statistik für Web-Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ProgZ\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ProgZ\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ProgZ\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: Send to Mindjet MindManager - {941E1A34-C6AF-4baa-A973-224F9C3E04BF} - C:\ProgZ\Mindjet\MindManager 7\Mm7InternetExplorer.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\ProgZ\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\ProgZ\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra button: Klicke hier um das Projekt xp-AntiSpy zu unterstützen - {0e921e80-267a-42aa-aee4-60b9a1222a44} - C:\ProgZ\xp-AntiSpy\sponsoring\sponsor.html (HKCU)
O9 - Extra 'Tools' menuitem: Unterstützung für xp-AntiSpy - {0e921e80-267a-42aa-aee4-60b9a1222a44} - C:\ProgZ\xp-AntiSpy\sponsoring\sponsor.html (HKCU)
O9 - Extra button: NeoTrace It! - {9885224C-1217-4c5f-83C2-00002E6CEF2B} - C:\ProgZ\NEOTRA~1\NTXtoolbar.htm (HKCU)
O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v4.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\ProgZ\MICROS~1\Office12\GR99D3~1.DLL
O20 - AppInit_DLLs: C:\ProgZ\KASPER~1\KASPER~1.0\adialhk.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\ProgZ\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Programme\Bonjour\mDNSResponder.exe
O23 - Service: cFosSpeed System Service (cFosSpeedS) - cFos Software GmbH - C:\ProgZ\cFosSpeed\spd.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\ProgZ\MAGIX\Common\Database\bin\fbserver.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: InterBase Guardian (InterBaseGuardian) - Borland Software Corporation - C:\ProgZ\Borland\InterBase\bin\ibguard.exe
O23 - Service: InterBase Server (InterBaseServer) - Borland Software Corporation - C:\ProgZ\Borland\InterBase\bin\ibserver.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\ProgZ\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: StyleXPService - Unknown owner - C:\Programme\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: UPnPService - Magix AG - C:\Programme\Gemeinsame Dateien\MAGIX Shared\UPnPService\UPnPService.exe
O23 - Service: WTService - Unknown owner - C:\WINDOWS\system32\atwtusb.exe

--
End of file - 7691 bytes

Viele liebe Grüße
Kri

Argus · 14.12.2008, 14:56

Entferne auf C:\SDFix\ backups Papierkorb leeren

MalwareBytes' Anti-Malware
Wähle bei Reiter:
“Scanner”> "Quickscan durchfuehren".
“Update “> klicke “Suche nache Aktualisierungen“
“Einstellungen“ hake an “Beende Inter Explorer während des Löschvorgangs“
Scan laufen lassen

Kri · 14.12.2008, 15:13

Hallo Argus,

vielen Dank für die schnelle Antwort!
C:\SDFix\backups habe ich gelöscht.

Die mbam-Einstellungen und das Update habe ich auch gemacht, hier die Log vom Quickscan:

Malwarebytes' Anti-Malware 1.31
Datenbank Version: 1499
Windows 5.1.2600 Service Pack 2

14.12.2008 15:09:24
mbam-log-2008-12-14 (15-09-24).txt

Scan-Methode: Quick-Scan
Durchsuchte Objekte: 56807
Laufzeit: 5 minute(s), 29 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

Heisst das ich bin Virenfrei?

Viele liebe Grüße
Und herzlichen Dank!
Kri

Argus · 14.12.2008, 15:22

Java
Dein Java software ist veraltet,
Download Java Runtime Environment (JRE) 6u11 zum Desktop

Entferne ueber "Start -> Einstellungen -> Systemsteuerung -> Software
Die aeltere Versionen von Java Runtime Environment (JRE of J2SE)
Nachdem alles entfernt wurde --->Rechner neu starten
Schliesse alle Programme auch dein Webbrowser
Installiere jetzt vom Desktop aus ---> jre-6u11-windows-i586-p-s.exe

Systemwiederherstellung (de)aktivieren

Happy Surfing again

Kri · 15.12.2008, 04:38

Ich wollte mich recht herzlich bei dir bedanken, es funktioniert wieder alles tadellos. Vielen Dank!

Viele liebe Grüße
Kri

Problem mit Explorer & Systemwiederherstellung

Log-Analyse und Auswertung: Problem mit Explorer & Systemwiederherstellung