Antivirus 2009/ Virtumonde

squirrel22 · 24.12.2008, 11:02

Hallo nochmals!

Folgendes ist passiert: Pop Up von "Antivirus 2009". Hab es immer weggeklickt, aber es scheint doch was installiert zu haben, oder es war vorher schon was da. Counterspy drüberlaufen lassen, hat Virtumonde erkannt und in Quarantäne gesteckt. Das hat leider nichts genützt. Ist immer noch da... Habe auch einige dlls gelöscht (rujudagu, hatakuvu, etc.), nutzt natürlich auch nichts.
Bitte um Hilfe, anbei die Logs von hijack und gmer:

Code:

ATTFilter

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:48:41, on 24.12.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Apoint2K\Apoint.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Programme\Java\j2re1.4.2_05\bin\jusched.exe
C:\Programme\HPQ\Quick Launch Buttons\EabServr.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKAgent.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\Programme\HP\HP Software Update\HPWuSchd2.exe
C:\Programme\QuickTime\qttask.exe
C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programme\Cisco Systems\VPN Client\cvpnd.exe
C:\Programme\Apoint2K\Apntex.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\HP\Digital Imaging\bin\hpqtra08.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Programme\Sunbelt Software\CounterSpy\SBAMSvc.exe
C:\Programme\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\Sunbelt Software\CounterSpy\SBAMTray.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Programme\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Programme\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Programme\Sunbelt Software\CounterSpy\SBAMUI.exe
C:\Programme\Messenger\msmsgs.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\HPZinw12.exe
C:\Programme\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = h**p://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=DE_DE&c=Q105&bd=pavilion&pf=laptop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://www.orf.at/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DE_DE&c=Q105&bd=pavilion&pf=laptop
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = h**p://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DE_DE&c=Q105&bd=pavilion&pf=laptop
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {d9bc7ecb-3284-4c40-8772-acb2df98094c} - C:\WINDOWS\system32\vefukufe.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [Apoint] C:\Programme\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Cpqset] C:\Programme\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Programme\Gemeinsame Dateien\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Programme\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MSKAgent.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MskDetct.exe /startup
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Programme\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programme\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SBAMTray] C:\Programme\Sunbelt Software\CounterSpy\SBAMTray.exe
O4 - HKLM\..\Run: [CPM5c982117] Rundll32.exe "c:\windows\system32\hatakuvu.dll",a
O4 - HKLM\..\Run: [nogiwiyibe] Rundll32.exe "C:\WINDOWS\system32\rujudagu.dll",s
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programme\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [nogiwiyibe] Rundll32.exe "C:\WINDOWS\system32\rujudagu.dll",s (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Programme\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: VPN Client.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O10 - Broken Internet access because of LSP provider 'c:\programme\bonjour\mdnsnsp.dll' missing
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DE_DE&c=Q105&bd=pavilion&pf=laptop
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/de/4,0,0,90/mcinsctl.cab
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/de/1,0,0,23/mcgdmgr.cab
O20 - AppInit_DLLs: c:\windows\system32\zahuzihi.dll C:\WINDOWS\system32\dikemude.dll c:\windows\system32\robejaku.dll c:\windows\system32\hatakuvu.dll
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\robejaku.dll
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\robejaku.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Programme\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour-Dienst (Bonjour Service) - Unknown owner - C:\Programme\Bonjour\mDNSResponder.exe (file missing)
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Programme\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Cvpnmim - Unknown owner - (no file)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Programme\HPQ\SHARED\HPQWMI.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - McAfee, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: CounterSpy Antispyware (SBAMSvc) - Sunbelt Software - C:\Programme\Sunbelt Software\CounterSpy\SBAMSvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programme\Analog Devices\SoundMAX\SMAgent.exe

--
End of file - 9944 bytes

GMER:

Code:

ATTFilter

GMER 1.0.14.14536 - http://www.gmer.net
Autostart scan 2008-12-24 10:51:39
Windows 5.1.2600 Service Pack 2


HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems@Windows = %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16

HKLM\Software\Microsoft\Windows NT\CurrentVersion\ >>>
Winlogon@Userinit = C:\WINDOWS\system32\userinit.exe,
Windows@AppInit_DLLs = c:\windows\system32\zahuzihi.dll C:\WINDOWS\system32\dikemude.dll c:\windows\system32\robejaku.dll c:\windows\system32\hatakuvu.dll

HKLM\SYSTEM\CurrentControlSet\Services\ >>>
aawservice@ = C:\Programme\Lavasoft\Ad-Aware\aawservice.exe
Apple Mobile Device@ = "C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe"
Bonjour Service@ = C:\Programme\Bonjour\mDNSResponder.exe /*file not found*/
CVPND@ = "C:\Programme\Cisco Systems\VPN Client\cvpnd.exe"
MCVSRte@ = c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe /Embedding
MpfService@ = C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
MskService@ = C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
NVSvc@ = %SystemRoot%\system32\nvsvc32.exe
Pml Driver HPZ12@ = C:\WINDOWS\system32\HPZipm12.exe
SBAMSvc@ = "C:\Programme\Sunbelt Software\CounterSpy\SBAMSvc.exe"
SoundMAX Agent Service (default)@ = C:\Programme\Analog Devices\SoundMAX\SMAgent.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\Run >>>
@ApointC:\Programme\Apoint2K\Apoint.exe = C:\Programme\Apoint2K\Apoint.exe
@AGRSMMSGAGRSMMSG.exe = AGRSMMSG.exe
@NvCplDaemonRUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup = RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
@nwiznwiz.exe /install = nwiz.exe /install
@CpqsetC:\Programme\HPQ\Default Settings\cpqset.exe  ?     ??? ??B????| ????   ??B         ? ????B ? ???? = C:\Programme\HPQ\Default Settings\cpqset.exe  ?     ??? ??B????| ????   ??B         ? ????B ? ????
@SunJavaUpdateSchedC:\Programme\Java\j2re1.4.2_05\bin\jusched.exe = C:\Programme\Java\j2re1.4.2_05\bin\jusched.exe
@UpdateManager"C:\Programme\Gemeinsame Dateien\Sonic\Update Manager\sgtray.exe" /r = "C:\Programme\Gemeinsame Dateien\Sonic\Update Manager\sgtray.exe" /r
@eabconfg.cplC:\Programme\HPQ\Quick Launch Buttons\EabServr.exe /Start /*file not found*/ = C:\Programme\HPQ\Quick Launch Buttons\EabServr.exe /Start /*file not found*/
@VSOCheckTask"c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask = "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
@VirusScan Online"c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe" = "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
@MCAgentExec:\PROGRA~1\mcafee.com\agent\mcagent.exe = c:\PROGRA~1\mcafee.com\agent\mcagent.exe
@MCUpdateExeC:\PROGRA~1\mcafee.com\agent\mcupdate.exe = C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
@MSKAGENTEXEC:\PROGRA~1\McAfee\SPAMKI~1\MSKAgent.exe = C:\PROGRA~1\McAfee\SPAMKI~1\MSKAgent.exe
@MSKDetectorExeC:\PROGRA~1\McAfee\SPAMKI~1\MskDetct.exe /startup = C:\PROGRA~1\McAfee\SPAMKI~1\MskDetct.exe /startup
@MPFExeC:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe = C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
@HP Software UpdateC:\Programme\HP\HP Software Update\HPWuSchd2.exe = C:\Programme\HP\HP Software Update\HPWuSchd2.exe
@AppleSyncNotifierC:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe = C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
@QuickTime Task"C:\Programme\QuickTime\qttask.exe" -atboottime = "C:\Programme\QuickTime\qttask.exe" -atboottime
@iTunesHelper"C:\Programme\iTunes\iTunesHelper.exe" = "C:\Programme\iTunes\iTunesHelper.exe"
@Adobe Reader Speed Launcher"C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe" = "C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe"
@SBAMTrayC:\Programme\Sunbelt Software\CounterSpy\SBAMTray.exe = C:\Programme\Sunbelt Software\CounterSpy\SBAMTray.exe
@CPM5c982117Rundll32.exe "c:\windows\system32\hatakuvu.dll",a = Rundll32.exe "c:\windows\system32\hatakuvu.dll",a
@nogiwiyibeRundll32.exe "C:\WINDOWS\system32\rujudagu.dll",s = Rundll32.exe "C:\WINDOWS\system32\rujudagu.dll",s

HKCU\Software\Microsoft\Windows\CurrentVersion\Run >>>
@CTFMON.EXEC:\WINDOWS\system32\ctfmon.exe = C:\WINDOWS\system32\ctfmon.exe
@MSKAGENTEXEC:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe = C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
@MsnMsgr"C:\Programme\MSN Messenger\MsnMsgr.Exe" /background /*file not found*/ = "C:\Programme\MSN Messenger\MsnMsgr.Exe" /background /*file not found*/

HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad@SSODL = c:\windows\system32\hatakuvu.dll

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler@{EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} = c:\windows\system32\hatakuvu.dll

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved >>>
@{42071714-76d4-11d1-8b24-00a0c9068ff3} /*CPL-Erweiterung für Anzeigeverschiebung*/deskpan.dll /*file not found*/ = deskpan.dll /*file not found*/
@{596AB062-B4D2-4215-9F74-E9109B0A8153} /*Eigenschaftenseite für vorherige Versionen*/%SystemRoot%\system32\twext.dll = %SystemRoot%\system32\twext.dll
@{9DB7A13C-F208-4981-8353-73CC61AE2783} /*Vorherige Versionen*/%SystemRoot%\system32\twext.dll = %SystemRoot%\system32\twext.dll
@{00E7B358-F65B-4dcf-83DF-CD026B94BFD4} /*Autoplay for SlideShow*/(null) = 
@{692F0339-CBAA-47e6-B5B5-3B84DB604E87} /*Extensions Manager Folder*/%SystemRoot%\system32\extmgr.dll = %SystemRoot%\system32\extmgr.dll
@{1CDB2949-8F65-4355-8456-263E7C208A5D} /*Desktop Explorer*/C:\WINDOWS\system32\nvshell.dll = C:\WINDOWS\system32\nvshell.dll
@{1E9B04FB-F9E5-4718-997B-B8DA88302A47} /*Desktop Explorer Menu*/C:\WINDOWS\system32\nvshell.dll = C:\WINDOWS\system32\nvshell.dll
@{DEE12703-6333-4D4E-8F34-738C4DCC2E04} /*RecordNow! SendToExt*/C:\Programme\Sonic\RecordNow!\shlext.dll = C:\Programme\Sonic\RecordNow!\shlext.dll
@{1E9B04FB-F9E5-4718-997B-B8DA88302A48} /*nView Desktop Context Menu*/C:\WINDOWS\system32\nvshell.dll = C:\WINDOWS\system32\nvshell.dll
@{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} /*iTunes*/C:\Programme\iTunes\iTunesMiniPlayer.dll = C:\Programme\iTunes\iTunesMiniPlayer.dll

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ >>>
FileEraserShellExt@{D29FEC44-36A2-4865-AE5E-175C61587F1D} = C:\Programme\Sunbelt Software\CounterSpy\SBFE.DLL
SBAMScanShellExt@{D47F1671-0EAA-4c02-8AC9-960BB08DB951} = C:\Programme\Sunbelt Software\CounterSpy\SBAMScanShellExt.dll

HKLM\Software\Classes\*\shellex\ContextMenuHandlers@{CFC7205E-2792-4378-9591-3879CC6C9022} = c:\progra~1\mcafee.com\vso\mcvsshl.dll

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ >>>
FileEraserShellExt@{D29FEC44-36A2-4865-AE5E-175C61587F1D} = C:\Programme\Sunbelt Software\CounterSpy\SBFE.DLL
SBAMScanShellExt@{D47F1671-0EAA-4c02-8AC9-960BB08DB951} = C:\Programme\Sunbelt Software\CounterSpy\SBAMScanShellExt.dll

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers@{CFC7205E-2792-4378-9591-3879CC6C9022} = c:\progra~1\mcafee.com\vso\mcvsshl.dll

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects >>>
@{18DF081C-E8AD-4283-A596-FA578C2EBDC3}C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll = C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
@{d9bc7ecb-3284-4c40-8772-acb2df98094c}C:\WINDOWS\system32\vefukufe.dll = C:\WINDOWS\system32\vefukufe.dll

HKCU\Control Panel\Desktop@SCRNSAVE.EXE = C:\WINDOWS\system32\scrnsave.scr

HKLM\Software\Microsoft\Internet Explorer\Main >>>
@Default_Page_URLhttp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DE_DE&c=Q105&bd=pavilion&pf=laptop = h**p://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DE_DE&c=Q105&bd=pavilion&pf=laptop
@Start Pagehttp://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home = h**p://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
@Local Page%SystemRoot%\system32\blank.htm = %SystemRoot%\system32\blank.htm

HKCU\Software\Microsoft\Internet Explorer\Main >>>
@Start Pagehttp://www.orf.at/ = h**p://www.orf.at/
@Local PageC:\WINDOWS\system32\blank.htm = C:\WINDOWS\system32\blank.htm

HKLM\Software\Classes\PROTOCOLS\Handler\ >>>
dvd@CLSID = C:\WINDOWS\system32\msvidctl.dll
its@CLSID = C:\WINDOWS\system32\itss.dll
mhtml@CLSID = %SystemRoot%\system32\inetcomm.dll
ms-its@CLSID = C:\WINDOWS\system32\itss.dll
ms-itss@CLSID = C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\msitss.dll
tv@CLSID = C:\WINDOWS\system32\msvidctl.dll
wia@CLSID = C:\WINDOWS\system32\wiascr.dll

HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000004@LibraryPath = C:\Programme\Bonjour\mdnsNSP.dll /*file not found*/

C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart >>>
Adobe Gamma Loader.lnk = Adobe Gamma Loader.lnk
HP Digital Imaging Monitor.lnk = HP Digital Imaging Monitor.lnk
Microsoft Office.lnk = Microsoft Office.lnk
VPN Client.lnk = VPN Client.lnk

---- EOF - GMER 1.0.14 ----

So..hoffe dass alle bösen Links draussen sind

Danke schon mal für Eure Hilfe!!
lg & frohe Weihnachten,
Squirrel

Antivirus 2009/ Virtumonde

Log-Analyse und Auswertung: Antivirus 2009/ Virtumonde

Antivirus 2009/ Virtumonde

Ähnliche Themen: Antivirus 2009/ Virtumonde