virus will einfach nicht verschwinden

ArmeRuki · 08.02.2009, 20:14

oki hab ich =(

ComboFix 09-02-07.01 - ***** 2009-02-08 20:01:53.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium *************** [GMT 1:00]
ausgeführt von:: c:\users\*****\Desktop\ComboFix.exe
AV: Avira AntiVir PersonalEdition *On-access scanning enabled* (Updated)
* Neuer Wiederherstellungspunkt wurde erstellt
.

(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\gaopdxcounter
D:\Autorun.inf
d:\recycler\S-3-8-49-100029251-100015219-100016303-9347.com

.
((((((((((((((((((((((( Dateien erstellt von 2009-01-08 bis 2009-02-08 ))))))))))))))))))))))))))))))
.

2009-02-08 18:27 . 2009-02-08 18:27 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-02-08 18:27 . 2009-01-14 16:11 38,496 --a------ c:\windows\System32\drivers\mbamswissarmy.sys
2009-02-08 18:27 . 2009-01-14 16:11 15,504 --a------ c:\windows\System32\drivers\mbam.sys
2009-02-08 17:41 . 2009-02-08 17:41 250 --a------ c:\windows\gmer.ini
2009-02-08 01:10 . 2009-02-08 01:10 <DIR> d-------- c:\users\All Users\SUPERAntiSpyware.com
2009-02-08 01:09 . 2009-02-08 17:21 <DIR> d-------- c:\users\Rukisama\AppData\Roaming\SUPERAntiSpyware.com
2009-02-08 01:09 . 2009-02-08 17:20 <DIR> d-------- c:\program files\SUPERAntiSpyware
2009-02-08 00:00 . 2009-02-08 00:00 <DIR> d-------- c:\users\*****\AppData\Roaming\Malwarebytes
2009-02-08 00:00 . 2009-02-08 00:00 <DIR> d-------- c:\users\All Users\Malwarebytes
2009-02-07 18:56 . 2009-02-07 19:37 <DIR> d-------- c:\program files\Unlocker
2009-02-07 17:45 . 2009-02-07 23:50 <DIR> d-------- c:\program files\AmoK
2009-02-07 16:24 . 2009-02-07 16:24 <DIR> d-------- c:\program files\Trend Micro
2009-02-07 15:53 . 2009-02-08 09:14 <DIR> d-------- c:\users\All Users\Lavasoft
2009-02-06 15:23 . 2009-02-08 18:10 <DIR> d-------- c:\program files\WinClamAVShield
2009-02-06 15:10 . 2009-02-08 16:00 <DIR> d-------- c:\users\*****\AppData\Roaming\Spyware Terminator
2009-02-06 15:10 . 2009-02-08 16:03 <DIR> d-------- c:\users\All Users\Spyware Terminator
2009-02-06 15:10 . 2009-02-08 16:03 <DIR> d-------- c:\program files\Spyware Terminator
2009-02-06 15:10 . 2009-02-06 15:10 142,592 --a------ c:\windows\System32\drivers\sp_rsdrv2.sys
2009-01-25 13:41 . 2009-01-25 13:41 <DIR> d-------- c:\program files\SystemRequirementsLab
2009-01-25 13:17 . 2009-02-01 12:00 <DIR> d-------- c:\users\All Users\FLEXnet
2009-01-25 13:14 . 2009-01-25 13:14 <DIR> d-------- c:\users\******\AppData\Roaming\SYSTEMAX Software Development
2009-01-25 13:14 . 2009-01-25 13:14 <DIR> d-------- c:\users\All Users\SYSTEMAX Software Development
2009-01-25 13:09 . 2009-01-25 13:09 <DIR> d-------- c:\program files\Adobe Media Player
2009-01-25 13:05 . 2009-01-25 13:05 <DIR> d-------- c:\program files\Common Files\Adobe AIR
2009-01-25 09:45 . 2009-02-02 20:24 <DIR> d-------- c:\users\*****\AppData\Roaming\Download Manager
2009-01-25 09:14 . 2009-01-25 09:14 <DIR> d-------- c:\users\****\AppData\Roaming\Corel
2009-01-25 09:14 . 2009-01-25 09:15 2,828 --ahs---- c:\users\All Users\KGyGaAvL.sys
2009-01-25 09:14 . 2009-01-25 09:15 2,828 --ahs---- c:\programdata\KGyGaAvL.sys
2009-01-25 09:14 . 2009-01-25 09:15 88 -r-hs---- c:\users\All Users\F705BFA2F0.sys
2009-01-25 09:14 . 2009-01-25 09:15 88 -r-hs---- c:\programdata\F705BFA2F0.sys
2009-01-25 09:11 . 2009-01-25 09:25 <DIR> d-------- c:\users\All Users\Corel
2009-01-25 08:48 . 2009-01-25 08:48 <DIR> d-------- c:\program files\Common Files\Corel
2009-01-25 00:00 . 2009-01-25 00:01 <DIR> d-------- c:\program files\Serif
2009-01-15 10:15 . 2008-12-16 03:42 288,768 --a------ c:\windows\System32\drivers\srv.sys
2009-01-12 12:27 . 2009-01-12 12:27 <DIR> d-------- c:\program files\Common Files\Scanner

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-08 17:10 --------- d-----w c:\users\******\AppData\Roaming\OpenOffice.org2
2009-02-08 15:03 --------- d-----w c:\programdata\Spyware Terminator
2009-02-08 08:14 --------- d-----w c:\programdata\Lavasoft
2009-02-08 00:10 --------- d-----w c:\programdata\SUPERAntiSpyware.com
2009-02-07 23:00 --------- d-----w c:\programdata\Malwarebytes
2009-02-07 22:18 --------- d-----w c:\program files\Google
2009-02-07 22:09 --------- d-----w c:\program files\AskBarDis
2009-02-07 10:21 --------- d-----w c:\programdata\Idol Surf Love
2009-02-07 10:20 --------- d-----w c:\programdata\That Face Camp Shim
2009-02-07 10:19 --------- d-----w c:\program files\MSN Messenger
2009-02-07 10:19 --------- d-----w c:\program files\Messenger Plus! Live
2009-02-07 10:19 --------- d-----w c:\program files\Circle Developement
2009-02-05 20:41 --------- d-----w c:\programdata\Spybot - Search & Destroy
2009-02-05 20:37 --------- d-----w c:\program files\Spybot - Search & Destroy
2009-02-03 20:37 --------- d-----w c:\program files\Common Files\Adobe
2009-02-01 11:00 --------- d-----w c:\programdata\FLEXnet
2009-01-25 13:00 --------- d-----w c:\programdata\NVIDIA
2009-01-25 12:14 --------- d-----w c:\programdata\SYSTEMAX Software Development
2009-01-25 08:25 --------- d-----w c:\programdata\Corel
2009-01-25 08:06 --------- d-----w c:\program files\Corel
2009-01-24 23:09 --------- d-----w c:\users\Rukisama\AppData\Roaming\gtk-2.0
2009-01-24 23:01 --------- d--h--w c:\program files\InstallShield Installation Information
2009-01-15 10:05 911,872 ----a-w c:\windows\System32\wininet.dll
2009-01-15 10:05 43,008 ----a-w c:\windows\System32\licmgr10.dll
2009-01-15 10:04 18,944 ----a-w c:\windows\System32\corpol.dll
2009-01-15 10:04 132,096 ----a-w c:\windows\System32\ieUnatt.exe
2009-01-15 10:04 109,568 ----a-w c:\windows\System32\PDMSetup.exe
2009-01-15 10:04 109,056 ----a-w c:\windows\System32\iesysprep.dll
2009-01-15 10:04 107,520 ----a-w c:\windows\System32\RegisterIEPKEYs.exe
2009-01-15 10:04 107,008 ----a-w c:\windows\System32\SetIEInstalledDate.exe
2009-01-15 10:04 103,936 ----a-w c:\windows\System32\SetDepNx.exe
2009-01-15 10:03 72,704 ----a-w c:\windows\System32\admparse.dll
2009-01-15 10:03 71,680 ----a-w c:\windows\System32\iesetup.dll
2009-01-15 10:03 66,560 ----a-w c:\windows\System32\wextract.exe
2009-01-15 10:03 420,352 ----a-w c:\windows\System32\vbscript.dll
2009-01-15 10:02 169,472 ----a-w c:\windows\System32\iexpress.exe
2009-01-15 10:01 34,304 ----a-w c:\windows\System32\imgutil.dll
2009-01-15 10:00 48,128 ----a-w c:\windows\System32\mshtmler.dll
2009-01-15 10:00 45,568 ----a-w c:\windows\System32\mshta.exe
2009-01-15 09:50 156,160 ----a-w c:\windows\System32\msls31.dll
2009-01-15 09:21 --------- d-----w c:\program files\Windows Mail
2009-01-07 10:28 453,152 ----a-w c:\windows\System32\NVUNINST.EXE
2009-01-05 16:08 --------- d-----w c:\program files\CCleaner
2008-12-13 18:38 --------- d-----w c:\users\******\AppData\Roaming\Ahead
2008-06-08 08:20 174 --sha-w c:\program files\desktop.ini
2007-06-13 15:29 44,227,910 ----a-w c:\users\*****\FF X - Lösungen für Mana-sama.zip
.

(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccleaner"="c:\program files\CCleaner\ccleaner.exe" [2008-12-19 1434864]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-01-21 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSConfig"="c:\windows\system32\msconfig.exe" [2008-01-19 227840]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2007-01-29 30248]
"IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2007-01-29 46632]
"PPort11reminder"="c:\program files\ScanSoft\PaperPort\Ereg\Ereg.exe" [2007-02-01 255528]
"BrMfcWnd"="c:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2007-03-12 663552]
"ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2007-01-26 65536]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-01-15 13683232]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-01-15 92704]
"SpywareTerminator"="c:\program files\Spyware Terminator\SpywareTerminatorShield.exe" [2009-02-06 2267136]

c:\users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 2.3.lnk - c:\program files\OpenOffice.org 2.3\program\quickstart.exe [2007-08-17 393216]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
BTTray.lnk - c:\program files\ANYCOM\Blue USB-200-250\BTTray.exe [2007-01-19 711472]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Google Updater.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Google Updater.lnk
backup=c:\windows\pss\Google Updater.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
backup=c:\windows\pss\WinZip Quick Pick.lnk.CommonStartup
backupExtension=.CommonStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ADMINTICK]
c:\programdata\Bags team team.piwgey0 [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CAMP SHIM EXIT HECK]
c:\programdata\Settings Fast Setup.5vh5us [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-10-15 01:04 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Corel Painter Essentials 21a]
--a------ 2004-03-18 16:19 733184 c:\program files\Corel\Corel Painter Essentials 2\registration.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2006-01-12 15:40 155648 c:\program files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a------ 2009-01-15 08:19 13683232 c:\windows\System32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
--a------ 2009-01-15 08:19 92704 c:\windows\System32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvSvc]
--a------ 2009-01-15 08:19 641568 c:\windows\System32\nvsvc.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
--a------ 2008-01-21 16:07 68856 c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a------ 2006-05-25 18:35 35328 c:\program files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{2623317E-E514-4E02-8133-E1306FC3D638}"= UDP:c:\program files\Common Files\aol\acs\AOLDial.exe:AOL Optimized Dial-In
"{90AD48A2-48A6-4B8E-8629-ED1EC0E3CE01}"= TCP:c:\program files\Common Files\aol\acs\AOLDial.exe:AOL Optimized Dial-In
"{30A2F0E8-FDF3-4049-96B1-8C47BDD96536}"= UDP:c:\program files\Common Files\aol\acs\AOLacsd.exe:AOL Optimized Dial-In
"{30985F1F-088B-4378-AC72-B4D461824FDD}"= TCP:c:\program files\Common Files\aol\acs\AOLacsd.exe:AOL Optimized Dial-In
"{DB73D4C3-F34C-4A5C-9DD1-5167A77D5CC1}"= UDP:c:\program files\AOL 9.0 VR\waol.exe:AOL
"{2D17821F-A832-411A-B90D-C8819612D622}"= TCP:c:\program files\AOL 9.0 VR\waol.exe:AOL
"{15BD0A84-C2F8-4DD9-8D78-552ABD76430C}"= UDP:c:\program files\Common Files\aol\TopSpeed\3.0\aoltpsd3.exe:AOL TopSpeed
"{1FF14F72-AF40-4D30-93BE-4260AA892646}"= TCP:c:\program files\Common Files\aol\TopSpeed\3.0\aoltpsd3.exe:AOL TopSpeed
"{C8434D74-9CC9-461F-846E-48EB83B57395}"= UDP:c:\program files\Common Files\aol\Loader\aolload.exe:AOL Loader
"{60DF8DA8-243A-496F-9920-633FFF0ECD05}"= TCP:c:\program files\Common Files\aol\Loader\aolload.exe:AOL Loader
"{E4CD0D24-3935-4549-B17C-18B1FBF540B8}"= UDP:c:\program files\Common Files\aol\System Information\sinf.exe:AOL System Information
"{FC4AA18C-2302-4CAA-BD5B-2B4E1BB11833}"= TCP:c:\program files\Common Files\aol\System Information\sinf.exe:AOL System Information
"{177042F4-AA0D-435F-BEDB-6228A1D86C82}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"{6F37A576-E0CA-4414-840C-2203FACF2227}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"{6EA87918-B3CB-4220-AC00-81A82B1D2295}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"{E55CF1AB-9B1F-4023-A9A1-3CDB95C99579}"= UDP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"{4FE8CDA4-7BE4-4429-B0A3-DF279DC54648}"= TCP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"TCP Query User{93841736-17B2-4AD8-A0C8-DA622C6D5BBE}c:\\program files\\internet explorer\\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{F41F1645-52BA-4AC6-93CC-8D932E1ED65C}c:\\program files\\internet explorer\\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"TCP Query User{9522BB89-F5F5-4936-9807-FC8C7E9BB120}c:\\users\\****\\appdata\\local\\virtualstore\\program files\\metin2_germany\\metin2.bin"= UDP:c:\users\****\appdata\local\virtualstore\program files\metin2_germany\metin2.bin:metin2.bin
"UDP Query User{908AE2E3-322B-4878-AB28-FE9492526B87}c:\\users\\****\\appdata\\local\\virtualstore\\program files\\metin2_germany\\metin2.bin"= TCP:c:\users\*****\appdata\local\virtualstore\program files\metin2_germany\metin2.bin:metin2.bin
"TCP Query User{9FC80991-DCFC-4D0F-A4D3-0BC1E807D3A6}c:\\users\\****\\appdata\\local\\virtualstore\\program files\\metin2_germany\\metin2.bin"= UDP:c:\users\***\appdata\local\virtualstore\program files\metin2_germany\metin2.bin:metin2.bin
"UDP Query User{712F2345-FB9C-458A-BC21-E0A326086058}c:\\users\\*****\\appdata\\local\\virtualstore\\program files\\metin2_germany\\metin2.bin"= TCP:c:\users\****\appdata\local\virtualstore\program files\metin2_germany\metin2.bin:metin2.bin
"TCP Query User{CDB298AC-D337-4E05-87C7-2C57D9DE835B}c:\\program files\\metin2_germany\\metin2.bin"= UDP:c:\program files\metin2_germany\metin2.bin:metin2
"UDP Query User{66F6024F-26DC-4970-8FA8-CAE7633DDE2C}c:\\program files\\metin2_germany\\metin2.bin"= TCP:c:\program files\metin2_germany\metin2.bin:metin2
"TCP Query User{C53622E6-FC82-4B04-BF91-0143610CFBDA}c:\\program files\\icqlite\\icqlite.exe"= UDP:c:\program files\icqlite\icqlite.exe:ICQLite
"UDP Query User{144D6735-DAD2-4E4A-A732-05C625C4C7B3}c:\\program files\\icqlite\\icqlite.exe"= TCP:c:\program files\icqlite\icqlite.exe:ICQLite
"{2C995458-0870-4A5F-8D37-3A752DEDAC15}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{E849F722-E114-4571-B7EF-70172692E0FE}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{B31EA56A-71A5-4C69-948B-7E27694208AC}"= UDP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{51394488-0735-4B32-A940-2BCA9E26B4D9}"= TCP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"TCP Query User{DE01C0AB-B07E-497C-9F9E-747F11D6C451}c:\\users\\****\\emule\\emule.exe"= UDP:c:\users\rukisama\emule\emule.exe:emule.exe
"UDP Query User{612D9EDD-2E08-437A-8D4A-FB4B2AFDCDEC}c:\\users\\*****\\emule\\emule.exe"= TCP:c:\users\rukisama\emule\emule.exe:emule.exe
"TCP Query User{6874ABA9-5524-47C0-931A-D4AB79F91463}c:\\users\\*****\\appdata\\local\\temp\\temp1_vbalink1.zip\\visualboyadvance.exe"= UDP:c:\users\rukisama\appdata\local\temp\temp1_vbalink1.zip\visualboyadvance.exe:visualboyadvance.exe
"UDP Query User{FAAF3C28-53F1-4B19-8B5D-4806E74C6BD2}c:\\users\\****\\appdata\\local\\temp\\temp1_vbalink1.zip\\visualboyadvance.exe"= TCP:c:\users\rukisama\appdata\local\temp\temp1_vbalink1.zip\visualboyadvance.exe:visualboyadvance.exe
"TCP Query User{03AAEC0D-3F74-40C3-A34F-D54B078BEB91}c:\\users\\****\\appdata\\local\\temp\\temp4_vbalink1.zip\\visualboyadvance.exe"= UDP:c:\users\rukisama\appdata\local\temp\temp4_vbalink1.zip\visualboyadvance.exe:visualboyadvance.exe
"UDP Query User{B4B36B41-683B-455A-B7F5-14E9E172CD8A}c:\\users\\****\\appdata\\local\\temp\\temp4_vbalink1.zip\\visualboyadvance.exe"= TCP:c:\users\rukisama\appdata\local\temp\temp4_vbalink1.zip\visualboyadvance.exe:visualboyadvance.exe
"TCP Query User{38A01691-0E10-42C0-B850-6DEF1C1A9153}c:\\users\\*****\\appdata\\local\\temp\\temp6_vbalink2.zip\\visualboyadvance.exe"= UDP:c:\users\rukisama\appdata\local\temp\temp6_vbalink2.zip\visualboyadvance.exe:visualboyadvance.exe
"UDP Query User{5699461F-2C75-43EB-86DE-1F5C1B550500}c:\\users\\****\\appdata\\local\\temp\\temp6_vbalink2.zip\\visualboyadvance.exe"= TCP:c:\users\rukisama\appdata\local\temp\temp6_vbalink2.zip\visualboyadvance.exe:visualboyadvance.exe
"TCP Query User{3B814CAC-7733-4283-B6AF-72140C2F5A79}c:\\users\\*****\\appdata\\local\\temp\\temp10_vbalink1.zip\\visualboyadvance.exe"= UDP:c:\users\rukisama\appdata\local\temp\temp10_vbalink1.zip\visualboyadvance.exe:visualboyadvance.exe
"UDP Query User{BD9E6784-D756-48D0-A566-937BC7D056DD}c:\\users\\****\\appdata\\local\\temp\\temp10_vbalink1.zip\\visualboyadvance.exe"= TCP:c:\users\rukisama\appdata\local\temp\temp10_vbalink1.zip\visualboyadvance.exe:visualboyadvance.exe

R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\System32\drivers\sp_rsdrv2.sys [2009-02-06 142592]

--- Andere Dienste/Treiber im Speicher ---

*Deregistered* - avgio
*Deregistered* - avipbb

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{19c86c72-c018-11db-9d48-806e6f6e6963}]
\shell\AutoRun\command - H:\Autorun.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Inhalt des "geplante Tasks" Ordners

2009-02-08 c:\windows\Tasks\Auf Updates für Windows Live Toolbar prüfen.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 11:20]

2009-02-08 c:\windows\Tasks\User_Feed_Synchronization-{D82A5C8A-8E4B-492A-BCF5-F85C17D021C6}.job
- c:\windows\system32\msfeedssync.exe [2009-01-15 11:01]
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -

MSConfigStartUp-ICQ Lite - c:\program files\ICQLite\ICQLite.exe
MSConfigStartUp-Performance Center - c:\program files\Ascentive\Performance Center\APCMain.exe
MSConfigStartUp-SunJavaUpdateSched - c:\program files\Java\jre1.6.0_05\bin\jusched.exe

.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
mStart Page = hxxp://de.yahoo.com
uSearchURL,(Default) = hxxp://de.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://de.search.yahoo.com
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Bild an &Bluetooth-Gerät senden... - c:\program files\ANYCOM\Blue USB-200-250\btsendto_ie_ctx.htm
IE: Seite an &Bluetooth-Gerät senden... - c:\program files\ANYCOM\Blue USB-200-250\btsendto_ie.htm
FF - ProfilePath - c:\users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\btiijb5u.default\
FF - prefs.js: browser.search.selectedEngine -
FF - prefs.js: keyword.URL - hxxp://www.crawler.com/search/dispatcher.aspx?tp=aus&tbid=60341&qkw=
1 Datei(en) verschoben.
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll

---- FIREFOX Richtlinien ----
FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-08 20:05:25
Windows 6.0.6001 Service Pack 1 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
Zeit der Fertigstellung: 2009-02-08 20:07:46
ComboFix-quarantined-files.txt 2009-02-08 19:07:44

Vor Suchlauf: 19 Verzeichnis(se), 406.900.367.360 Bytes frei
Nach Suchlauf: 19 Verzeichnis(se), 407,041,138,688 Bytes frei

249 --- E O F --- 2009-01-30 14:38:42

john.doe · 08.02.2009, 20:26

Was ist dein Laufwerk H:?

ciao, andreas

p.s.: YouTube - Happy birthday Rukisama~!!

ArmeRuki · 08.02.2009, 20:33

mein laufwerk ? ist eigentlich C:

hehe (^__^) mein lieblings sänger heißt wie ich

john.doe · 08.02.2009, 20:45

Schau mal in deinen Arbeitsplatz. Was ist das Laufwerk H:?

Lade LopSD auf den Desktop,
Doppelklick um es zu starten, tippe D (Deutsch), [Enter] und tippe 1.
Poste anschliessend die Datei LopR.txt

ciao, andreas

p.s.: Lies mal hier den letzten Absatz: http://www.trojaner-board.de/68645-s...tml#post406248

ArmeRuki · 08.02.2009, 20:54

aso ja da ist H: dabei aber glaub das ist von meiner intergrierten festplatte oder wie man das nennt (>_<) bin mir aber nicht sicher ob das es ist (^__^) hihi also das mit den countdown hab ich nicht mehr das war ja wegen dem troja pferdchen

~Ruki~

john.doe · 08.02.2009, 21:16

Lade LopSD auf den Desktop,
Doppelklick um es zu starten, tippe D (Deutsch), [Enter] und tippe 1.
Poste anschliessend die Datei LopR.txt

ciao, andreas

ArmeRuki · 08.02.2009, 21:26

okii

~Ruki~

ArmeRuki · 08.02.2009, 21:33

ah dieses That Face Camp Shim ist das trojanische pferd (>__<)

--------------------\\ Lop S&D 4.2.5-0 XP/Vista

Microsoft® Windows Vista™ Home Premium ( v6.0.6001 ) Service Pack 1
X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 CPU 4300 @ 1.80GHz )
BIOS : Phoenix - AwardBIOS v6.00PG
USER : **( Administrator )
BOOT : Normal boot
Antivirus : Avira AntiVir PersonalEdition 8.0.1.15 (Activated)
C:\ (Local Disk) - NTFS - Total:445 Go (Free:379 Go)
D:\ (Local Disk) - FAT32 - Total:19 Go (Free:15 Go)
E:\ (USB)
F:\ (USB)
G:\ (USB)
H:\ (CD or DVD)
I:\ (CD or DVD)

"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
Option : [1] ( 08.02.2009|21:21 )

[ UAC => 1 ]

--------------------\\ Ordner Verzeichnis unter Local

[03.02.2009|21:31] C:\Users\***\AppData\Local\Adobe
[02.05.2007|13:56] C:\Users\***\AppData\Local\Ahead
[19.02.2007|14:07] C:\Users\****\AppData\Local\Anwendungsdaten
[19.02.2007|14:07] C:\Users\****\AppData\Local\AOL
[25.09.2008|10:14] C:\Users\****\AppData\Local\d3d9caps.dat
[06.02.2009|23:34] C:\Users\****\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[03.09.2008|02:23] C:\Users\*****\AppData\Local\eMule
[04.02.2009|17:51] C:\Users\****\AppData\Local\GDIPFONTCACHEV1.DAT
[22.02.2007|22:06] C:\Users\****\AppData\Local\Google
[08.02.2009|18:04] C:\Users\****\AppData\Local\IconCache.db
[05.02.2009|20:50] C:\Users\****\AppData\Local\Microsoft
[02.11.2008|18:40] C:\Users\****\AppData\Local\Microsoft Games
[21.01.2008|14:33] C:\Users\****\AppData\Local\Mozilla
[30.01.2009|18:53] C:\Users\****\AppData\Local\Paint.NET
[08.09.2008|12:52] C:\Users\****\AppData\Local\Scansoft
[08.02.2009|21:18] C:\Users\****\AppData\Local\Temp
[19.02.2007|14:07] C:\Users\****\AppData\Local\Temporary Internet Files
[19.02.2007|14:07] C:\Users\*****\AppData\Local\Verlauf
[20.02.2007|07:34] C:\Users\****\AppData\Local\VirtualStore
[4|Datei(en),] C:\Users\*****\AppData\Local\Bytes
[17|Verzeichnis(se),] C:\Users\*****\AppData\Local\Bytes frei

--------------------\\ Geplante Aufgaben unter C:\Windows\Tasks

[08.02.2009 21:20][--ah-----] C:\Windows\tasks\User_Feed_Synchronization-{D82A5C8A-8E4B-492A-BCF5-F85C17D021C6}.job
[08.02.2009 21:20][--a------] C:\Windows\tasks\Auf Updates für Windows Live Toolbar prüfen.job
[08.02.2009 18:07][--ah-----] C:\Windows\tasks\SA.DAT
[08.02.2009 18:04][--a------] C:\Windows\tasks\SCHEDLGU.TXT

--------------------\\ Ordner Verzeichnis unter C:\ProgramData

[14.11.2008|11:52] C:\ProgramData\{0350E4F4-2ADE-4D5A-923F-F27A6BDDF482}
[28.06.2007|20:30] C:\ProgramData\addr_file.html
[03.02.2009|21:33] C:\ProgramData\Adobe
[19.02.2007|14:03] C:\ProgramData\Anwendungsdaten
[17.11.2007|19:04] C:\ProgramData\AOL
[02.11.2006|14:02] C:\ProgramData\Application Data
[21.11.2008|18:40] C:\ProgramData\Azureus
[06.01.2008|23:28] C:\ProgramData\Bags team team.24di5d
[21.12.2007|20:51] C:\ProgramData\Bags team team.25iwdb
[07.02.2009|15:06] C:\ProgramData\Bags team team.3duaem4
[28.12.2007|18:33] C:\ProgramData\Bags team team.4qs8m3
[06.01.2008|23:06] C:\ProgramData\Bags team team.72dwbx
[07.02.2009|12:05] C:\ProgramData\Bags team team.94wa0t
[07.02.2009|12:54] C:\ProgramData\Bags team team.amm6lk
[06.01.2008|22:44] C:\ProgramData\Bags team team.b2iym0
[07.02.2009|12:28] C:\ProgramData\Bags team team.b4e8t6
[07.02.2009|13:17] C:\ProgramData\Bags team team.dvdjjc9
[07.02.2009|11:20] C:\ProgramData\Bags team team.g4vjh
[07.02.2009|15:29] C:\ProgramData\Bags team team.g8ipmo9
[07.02.2009|14:00] C:\ProgramData\Bags team team.h1aj42
[07.02.2009|14:44] C:\ProgramData\Bags team team.hp64c
[07.02.2009|13:38] C:\ProgramData\Bags team team.i7plcty
[07.02.2009|11:20] C:\ProgramData\Bags team team.l4sx1k1
[04.01.2008|16:23] C:\ProgramData\Bags team team.nmhbb
[07.02.2009|11:42] C:\ProgramData\Bags team team.o4kfd1
[07.02.2009|14:22] C:\ProgramData\Bags team team.tkf7k
[06.01.2008|22:22] C:\ProgramData\Bags team team.ua2scp
[04.01.2008|16:23] C:\ProgramData\Bags team team.wrdx175
[06.01.2008|23:49] C:\ProgramData\Bags team team.y9hs0
[08.09.2008|12:27] C:\ProgramData\Brother
[10.05.2007|16:54] C:\ProgramData\BullGuard
[25.01.2009|09:25] C:\ProgramData\Corel
[02.11.2006|14:02] C:\ProgramData\Desktop
[02.11.2006|14:02] C:\ProgramData\Documents
[19.02.2007|14:03] C:\ProgramData\Dokumente
[18.03.2008|13:05] C:\ProgramData\ebay
[03.09.2008|02:23] C:\ProgramData\eMule
[25.01.2009|09:15] C:\ProgramData\F705BFA2F0.sys
[19.02.2007|14:03] C:\ProgramData\Favoriten
[02.11.2006|14:02] C:\ProgramData\Favorites
[01.02.2009|12:00] C:\ProgramData\FLEXnet
[07.02.2009|23:17] C:\ProgramData\Google
[07.02.2009|11:21] C:\ProgramData\Idol Surf Love
[08.09.2008|12:30] C:\ProgramData\InstallShield
[25.01.2009|09:15] C:\ProgramData\KGyGaAvL.sys
[08.02.2009|09:14] C:\ProgramData\Lavasoft
[07.02.2009|11:20] C:\ProgramData\license bolt settings.jtn91
[08.02.2009|00:00] C:\ProgramData\Malwarebytes
[10.07.2007|14:52] C:\ProgramData\Messenger Plus!
[21.06.2008|17:21] C:\ProgramData\Microsoft
[22.12.2006|10:05] C:\ProgramData\Nero
[25.01.2009|14:00] C:\ProgramData\NVIDIA
[08.02.2009|19:59] C:\ProgramData\restart.txt
[08.09.2008|12:30] C:\ProgramData\ScanSoft
[04.01.2008|16:23] C:\ProgramData\Settings Fast Setup.5vh5us
[05.02.2009|21:41] C:\ProgramData\Spybot - Search & Destroy
[08.02.2009|16:03] C:\ProgramData\Spyware Terminator
[02.11.2006|14:02] C:\ProgramData\Start Menu
[19.02.2007|14:03] C:\ProgramData\Startmenü
[08.02.2009|01:10] C:\ProgramData\SUPERAntiSpyware.com
[25.01.2009|13:14] C:\ProgramData\SYSTEMAX Software Development
[02.11.2006|14:02] C:\ProgramData\Templates
[07.02.2009|11:20] C:\ProgramData\That Face Camp Shim
[22.12.2006|09:37] C:\ProgramData\Viewpoint
[19.02.2007|14:03] C:\ProgramData\Vorlagen
[14.07.2008|20:32] C:\ProgramData\WinZip
[17.11.2007|00:03] C:\ProgramData\Yahoo!
[28|Datei(en),] C:\ProgramData\Bytes
[41|Verzeichnis(se),] C:\ProgramData\Bytes frei

--------------------\\ Ordner Verzeichnis unter C:\Program Files

[23.07.2008|18:38] C:\Program Files\7-Zip
[03.02.2009|21:34] C:\Program Files\Adobe
[25.01.2009|13:09] C:\Program Files\Adobe Media Player
[08.06.2007|18:01] C:\Program Files\Adverts
[11.12.2007|18:42] C:\Program Files\Alwil Software
[07.02.2009|23:50] C:\Program Files\AmoK
[08.02.2009|19:59] C:\Program Files\AntiVir PersonalEdition Classic
[19.07.2007|03:16] C:\Program Files\ANYCOM
[19.02.2007|14:44] C:\Program Files\ArcorOnline
[07.02.2009|23:09] C:\Program Files\AskBarDis
[28.06.2007|20:42] C:\Program Files\a-squared Free
[21.06.2008|17:16] C:\Program Files\Belkin
[08.09.2008|12:58] C:\Program Files\Brother
[05.01.2009|17:08] C:\Program Files\CCleaner
[07.02.2009|11:19] C:\Program Files\Circle Developement
[08.02.2009|20:03] C:\Program Files\Common Files
[25.01.2009|09:06] C:\Program Files\Corel
[02.12.2008|20:34] C:\Program Files\EA GAMES
[03.09.2008|02:23] C:\Program Files\eMule
[19.02.2007|14:03] C:\Program Files\Gemeinsame Dateien [C:\Program Files\Common Files]
[23.08.2008|12:18] C:\Program Files\GIMP-2.0
[07.02.2009|23:18] C:\Program Files\Google
[23.08.2008|11:46] C:\Program Files\ICQLite
[25.01.2009|00:01] C:\Program Files\InstallShield Installation Information
[29.01.2009|11:19] C:\Program Files\Internet Explorer
[16.03.2007|18:34] C:\Program Files\JoWooD
[14.11.2008|11:52] C:\Program Files\KPSA-home
[03.11.2008|15:45] C:\Program Files\LimeWire
[08.02.2009|18:27] C:\Program Files\Malwarebytes' Anti-Malware
[07.02.2009|11:19] C:\Program Files\Messenger Plus! Live
[02.11.2006|13:37] C:\Program Files\Microsoft Games
[08.06.2008|09:11] C:\Program Files\Movie Maker
[08.02.2009|17:21] C:\Program Files\Mozilla Firefox
[02.11.2006|13:37] C:\Program Files\MSBuild
[07.02.2009|11:19] C:\Program Files\MSN Messenger
[09.09.2008|02:00] C:\Program Files\MSXML 4.0
[22.12.2006|09:49] C:\Program Files\Nero
[20.04.2007|15:57] C:\Program Files\Nintendo DS Emulator
[08.09.2008|12:31] C:\Program Files\Nuance
[21.03.2008|19:12] C:\Program Files\OpenOffice.org 2.2
[21.03.2008|19:12] C:\Program Files\OpenOffice.org 2.3
[30.10.2008|17:29] C:\Program Files\Paint.NET
[08.09.2008|12:58] C:\Program Files\Reallusion
[02.11.2006|13:37] C:\Program Files\Reference Assemblies
[02.06.2007|12:47] C:\Program Files\Samsung
[08.09.2008|12:28] C:\Program Files\ScanSoft
[25.01.2009|00:01] C:\Program Files\Serif
[16.09.2008|13:24] C:\Program Files\SimPE
[20.09.2008|19:27] C:\Program Files\Sims2Pack Clean Installer
[05.02.2009|21:37] C:\Program Files\Spybot - Search & Destroy
[08.02.2009|20:57] C:\Program Files\Spyware Terminator
[08.02.2009|17:20] C:\Program Files\SUPERAntiSpyware
[25.01.2009|13:41] C:\Program Files\SystemRequirementsLab
[07.02.2009|16:24] C:\Program Files\Trend Micro
[02.11.2006|14:01] C:\Program Files\Uninstall Information
[07.02.2009|19:37] C:\Program Files\Unlocker
[26.01.2007|11:31] C:\Program Files\VIA
[10.05.2007|17:17] C:\Program Files\VideoLAN
[22.12.2006|09:37] C:\Program Files\Viewpoint
[05.05.2007|21:03] C:\Program Files\Winamp
[08.02.2009|20:57] C:\Program Files\WinClamAVShield
[08.06.2008|09:11] C:\Program Files\Windows Calendar
[08.06.2008|09:11] C:\Program Files\Windows Collaboration
[08.06.2008|09:11] C:\Program Files\Windows Defender
[08.06.2008|09:11] C:\Program Files\Windows Journal
[08.06.2007|18:01] C:\Program Files\Windows Live
[01.12.2007|07:49] C:\Program Files\Windows Live Toolbar
[15.01.2009|10:21] C:\Program Files\Windows Mail
[08.06.2008|09:11] C:\Program Files\Windows Media Player
[19.02.2007|14:03] C:\Program Files\Windows NT
[08.06.2008|09:11] C:\Program Files\Windows Photo Gallery
[08.06.2008|09:11] C:\Program Files\Windows Sidebar
[02.06.2007|12:46] C:\Program Files\XviD
[16.11.2008|16:10] C:\Program Files\Yahoo!
[0|Datei(en),] C:\Program Files\Bytes
[76|Verzeichnis(se),] C:\Program Files\Bytes frei

--------------------\\ Ordner Verzeichnis unter C:\Program Files\Common Files

[03.02.2009|21:37] C:\Program Files\Common Files\Adobe
[25.01.2009|13:05] C:\Program Files\Common Files\Adobe AIR
[22.12.2006|10:05] C:\Program Files\Common Files\Ahead
[17.11.2007|19:05] C:\Program Files\Common Files\aol
[25.01.2009|08:48] C:\Program Files\Common Files\Corel
[08.09.2008|12:29] C:\Program Files\Common Files\InstallShield
[22.12.2006|09:55] C:\Program Files\Common Files\LightScribe
[25.01.2009|08:53] C:\Program Files\Common Files\microsoft shared
[22.12.2006|09:37] C:\Program Files\Common Files\Nullsoft
[12.01.2009|12:27] C:\Program Files\Common Files\Scanner
[08.09.2008|12:29] C:\Program Files\Common Files\ScanSoft Shared
[02.11.2006|12:18] C:\Program Files\Common Files\Services
[02.11.2006|12:18] C:\Program Files\Common Files\SpeechEngines
[02.06.2007|12:47] C:\Program Files\Common Files\ST System Shared
[02.06.2007|12:45] C:\Program Files\Common Files\SWF Studio
[08.06.2008|09:11] C:\Program Files\Common Files\System
[0|Datei(en),] C:\Program Files\Common Files\Bytes
[18|Verzeichnis(se),] C:\Program Files\Common Files\Bytes frei

--------------------\\ Process

( 54 Processes )

iexplore.exe ~ [PID:3076]
iexplore.exe ~ [PID:2164]

--------------------\\ Ueberpruefung mit S_Lop

C:\ProgramData\Bags team team.g4vjh
C:\ProgramData\Bags team team.hp64c
C:\ProgramData\Bags team team.nmhbb
C:\ProgramData\Bags team team.tkf7k
C:\ProgramData\Bags team team.y9hs0
C:\ProgramData\license bolt settings.jtn91
C:\ProgramData\Bags team team.24di5d
C:\ProgramData\Bags team team.25iwdb
C:\ProgramData\Bags team team.4qs8m3
C:\ProgramData\Bags team team.72dwbx
C:\ProgramData\Bags team team.94wa0t
C:\ProgramData\Bags team team.amm6lk
C:\ProgramData\Bags team team.b2iym0
C:\ProgramData\Bags team team.b4e8t6
C:\ProgramData\Bags team team.h1aj42
C:\ProgramData\Bags team team.o4kfd1
C:\ProgramData\Bags team team.ua2scp
C:\ProgramData\Settings Fast Setup.5vh5us
C:\ProgramData\Bags team team.3duaem4
C:\ProgramData\Bags team team.dvdjjc9
C:\ProgramData\Bags team team.g8ipmo9
C:\ProgramData\Bags team team.i7plcty
C:\ProgramData\Bags team team.l4sx1k1
C:\ProgramData\Bags team team.wrdx175

--------------------\\ Suche nach Lop Dateien - Ordnern

C:\ProgramData\That Face Camp Shim
C:\ProgramData\That Face Camp Shim\Cool Coal.dat
C:\ProgramData\That Face Camp Shim\Cool Coal.exe
C:\Program Files\Adverts
C:\Program Files\Circle Developement
C:\Program Files\Circle Developement\Uninstall.exe

--------------------\\ Suche innerhalb der Registry

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

..... OK !

--------------------\\ Ueberpruefung der Hosts Datei
Hosts Datei SAUBER

--------------------\\ Suche nach verborgenen Dateien mit Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-08 21:21:26
Windows 6.0.6001 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 19

--------------------\\ Suche nach anderen Infektionen

--------------------\\ Cracks & Keygens ..

C:\Users\****\Favorites\YouTube - Stick Figures On Crack 2.URL

[F:11][D:6]-> C:\Users\*****\AppData\Local\Temp
[F:27][D:1]-> C:\Users\****\AppData\Roaming\MICROS~1\Windows\Cookies
[F:31][D:4]-> C:\Users\*****\AppData\Local\MICROS~1\Windows\TEMPOR~1\content.IE5
[F:26566][D:153]-> C:\$Recycle.Bin

1 - "C:\Lop SD\LopR_1.txt" - 08.02.2009|21:28 - Option : [1]

--------------------\\ Scan beendet um 21:28:30
[ UAC => 1 ]

john.doe · 08.02.2009, 21:45

Zitat:

ah dieses That Face Camp Shim ist das trojanische pferd

Ja, eines von weiteren.

Lass das Programm gleich noch einmal laufen. Tippe D (Deutsch), [Enter] und tippe 2.

H: ist übrigens dein CD/DVD-Laufwerk.

ciao, andreas

ArmeRuki · 08.02.2009, 22:06

ah oki hihi dachte meine inti festplatte (^__^) so hab ich

--------------------\\ Lop S&D 4.2.5-0 XP/Vista

Microsoft® Windows Vista™ Home Premium ( v6.0.6001 ) Service Pack 1
X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 CPU 4300 @ 1.80GHz )
BIOS : Phoenix - AwardBIOS v6.00PG
USER : ***** ( Administrator )
BOOT : Normal boot
Antivirus : Avira AntiVir PersonalEdition 8.0.1.15 (Activated)
C:\ (Local Disk) - NTFS - Total:445 Go (Free:378 Go)
D:\ (Local Disk) - FAT32 - Total:19 Go (Free:15 Go)
E:\ (USB)
F:\ (USB)
G:\ (USB)
H:\ (CD or DVD)
I:\ (CD or DVD)

"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
Option : [2] ( 08.02.2009|21:52 )

[ UAC => 1 ]

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ FIX

Geloescht ! - C:\ProgramData\That Face Camp Shim\Cool Coal.dat
Geloescht ! - C:\ProgramData\That Face Camp Shim\Cool Coal.exe
Geloescht ! - C:\Program Files\Circle Developement\Uninstall.exe
Geloescht ! - C:\ProgramData\Bags team team.g4vjh
Geloescht ! - C:\ProgramData\Bags team team.hp64c
Geloescht ! - C:\ProgramData\Bags team team.nmhbb
Geloescht ! - C:\ProgramData\Bags team team.tkf7k
Geloescht ! - C:\ProgramData\Bags team team.y9hs0
Geloescht ! - C:\ProgramData\license bolt settings.jtn91
Geloescht ! - C:\ProgramData\Bags team team.24di5d
Geloescht ! - C:\ProgramData\Bags team team.25iwdb
Geloescht ! - C:\ProgramData\Bags team team.4qs8m3
Geloescht ! - C:\ProgramData\Bags team team.72dwbx
Geloescht ! - C:\ProgramData\Bags team team.94wa0t
Geloescht ! - C:\ProgramData\Bags team team.amm6lk
Geloescht ! - C:\ProgramData\Bags team team.b2iym0
Geloescht ! - C:\ProgramData\Bags team team.b4e8t6
Geloescht ! - C:\ProgramData\Bags team team.h1aj42
Geloescht ! - C:\ProgramData\Bags team team.o4kfd1
Geloescht ! - C:\ProgramData\Bags team team.ua2scp
Geloescht ! - C:\ProgramData\Settings Fast Setup.5vh5us
Geloescht ! - C:\ProgramData\Bags team team.3duaem4
Geloescht ! - C:\ProgramData\Bags team team.dvdjjc9
Geloescht ! - C:\ProgramData\Bags team team.g8ipmo9
Geloescht ! - C:\ProgramData\Bags team team.i7plcty
Geloescht ! - C:\ProgramData\Bags team team.l4sx1k1
Geloescht ! - C:\ProgramData\Bags team team.wrdx175
Geloescht ! - C:\ProgramData\That Face Camp Shim
Geloescht ! - C:\Program Files\Adverts
Geloescht ! - C:\Program Files\Circle Developement
-
[ Hosts Datei ] .. Wiederhergestellt

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

Geloescht ! - C:\Program Files\Viewpoint
Geloescht ! - C:\PROGRA~2\Viewpoint

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

--------------------\\ Ordner Verzeichnis unter Local

[03.02.2009|21:31] C:\Users\**\AppData\Local\Adobe
[02.05.2007|13:56] C:\Users\****\AppData\Local\Ahead
[19.02.2007|14:07] C:\Users\****\AppData\Local\Anwendungsdaten
[19.02.2007|14:07] C:\Users\****\AppData\Local\AOL
[25.09.2008|10:14] C:\Users\*****\AppData\Local\d3d9caps.dat
[06.02.2009|23:34] C:\Users\****\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[03.09.2008|02:23] C:\Users****\AppData\Local\eMule
[04.02.2009|17:51] C:\Users\****\AppData\Local\GDIPFONTCACHEV1.DAT
[22.02.2007|22:06] C:\Users\****\AppData\Local\Google
[08.02.2009|18:04] C:\Users\****\AppData\Local\IconCache.db
[05.02.2009|20:50] C:\Users\*****\AppData\Local\Microsoft
[02.11.2008|18:40] C:\Users\*****\AppData\Local\Microsoft Games
[21.01.2008|14:33] C:\Users\*****\AppData\Local\Mozilla
[30.01.2009|18:53] C:\Users\****\AppData\Local\Paint.NET
[08.09.2008|12:52] C:\Users\*****\AppData\Local\Scansoft
[08.02.2009|21:52] C:\Users\*****\AppData\Local\Temp
[19.02.2007|14:07] C:\Users\*****\AppData\Local\Temporary Internet Files
[19.02.2007|14:07] C:\Users\*****\AppData\Local\Verlauf
[20.02.2007|07:34] C:\Users\***\AppData\Local\VirtualStore
[4|Datei(en),] C:\Users\****\AppData\Local\Bytes
[17|Verzeichnis(se),] C:\Users\****\AppData\Local\Bytes frei

--------------------\\ Geplante Aufgaben unter C:\Windows\Tasks

[08.02.2009 21:50][--ah-----] C:\Windows\tasks\User_Feed_Synchronization-{D82A5C8A-8E4B-492A-BCF5-F85C17D021C6}.job
[08.02.2009 21:20][--a------] C:\Windows\tasks\Auf Updates für Windows Live Toolbar prüfen.job
[08.02.2009 18:07][--ah-----] C:\Windows\tasks\SA.DAT
[08.02.2009 18:04][--a------] C:\Windows\tasks\SCHEDLGU.TXT

--------------------\\ Ordner Verzeichnis unter C:\ProgramData

[14.11.2008|11:52] C:\ProgramData\{0350E4F4-2ADE-4D5A-923F-F27A6BDDF482}
[28.06.2007|20:30] C:\ProgramData\addr_file.html
[03.02.2009|21:33] C:\ProgramData\Adobe
[19.02.2007|14:03] C:\ProgramData\Anwendungsdaten
[17.11.2007|19:04] C:\ProgramData\AOL
[02.11.2006|14:02] C:\ProgramData\Application Data
[21.11.2008|18:40] C:\ProgramData\Azureus
[08.09.2008|12:27] C:\ProgramData\Brother
[10.05.2007|16:54] C:\ProgramData\BullGuard
[25.01.2009|09:25] C:\ProgramData\Corel
[02.11.2006|14:02] C:\ProgramData\Desktop
[02.11.2006|14:02] C:\ProgramData\Documents
[19.02.2007|14:03] C:\ProgramData\Dokumente
[18.03.2008|13:05] C:\ProgramData\ebay
[03.09.2008|02:23] C:\ProgramData\eMule
[25.01.2009|09:15] C:\ProgramData\F705BFA2F0.sys
[19.02.2007|14:03] C:\ProgramData\Favoriten
[02.11.2006|14:02] C:\ProgramData\Favorites
[01.02.2009|12:00] C:\ProgramData\FLEXnet
[07.02.2009|23:17] C:\ProgramData\Google
[07.02.2009|11:21] C:\ProgramData\Idol Surf Love
[08.09.2008|12:30] C:\ProgramData\InstallShield
[25.01.2009|09:15] C:\ProgramData\KGyGaAvL.sys
[08.02.2009|09:14] C:\ProgramData\Lavasoft
[08.02.2009|00:00] C:\ProgramData\Malwarebytes
[10.07.2007|14:52] C:\ProgramData\Messenger Plus!
[21.06.2008|17:21] C:\ProgramData\Microsoft
[22.12.2006|10:05] C:\ProgramData\Nero
[25.01.2009|14:00] C:\ProgramData\NVIDIA
[08.02.2009|19:59] C:\ProgramData\restart.txt
[08.09.2008|12:30] C:\ProgramData\ScanSoft
[05.02.2009|21:41] C:\ProgramData\Spybot - Search & Destroy
[08.02.2009|16:03] C:\ProgramData\Spyware Terminator
[02.11.2006|14:02] C:\ProgramData\Start Menu
[19.02.2007|14:03] C:\ProgramData\Startmenü
[08.02.2009|01:10] C:\ProgramData\SUPERAntiSpyware.com
[25.01.2009|13:14] C:\ProgramData\SYSTEMAX Software Development
[02.11.2006|14:02] C:\ProgramData\Templates
[19.02.2007|14:03] C:\ProgramData\Vorlagen
[14.07.2008|20:32] C:\ProgramData\WinZip
[17.11.2007|00:03] C:\ProgramData\Yahoo!
[4|Datei(en),] C:\ProgramData\Bytes
[39|Verzeichnis(se),] C:\ProgramData\Bytes frei

--------------------\\ Ordner Verzeichnis unter C:\Program Files

[23.07.2008|18:38] C:\Program Files\7-Zip
[03.02.2009|21:34] C:\Program Files\Adobe
[25.01.2009|13:09] C:\Program Files\Adobe Media Player
[11.12.2007|18:42] C:\Program Files\Alwil Software
[07.02.2009|23:50] C:\Program Files\AmoK
[08.02.2009|19:59] C:\Program Files\AntiVir PersonalEdition Classic
[19.07.2007|03:16] C:\Program Files\ANYCOM
[19.02.2007|14:44] C:\Program Files\ArcorOnline
[07.02.2009|23:09] C:\Program Files\AskBarDis
[28.06.2007|20:42] C:\Program Files\a-squared Free
[21.06.2008|17:16] C:\Program Files\Belkin
[08.09.2008|12:58] C:\Program Files\Brother
[05.01.2009|17:08] C:\Program Files\CCleaner
[08.02.2009|20:03] C:\Program Files\Common Files
[25.01.2009|09:06] C:\Program Files\Corel
[02.12.2008|20:34] C:\Program Files\EA GAMES
[03.09.2008|02:23] C:\Program Files\eMule
[19.02.2007|14:03] C:\Program Files\Gemeinsame Dateien [C:\Program Files\Common Files]
[23.08.2008|12:18] C:\Program Files\GIMP-2.0
[07.02.2009|23:18] C:\Program Files\Google
[23.08.2008|11:46] C:\Program Files\ICQLite
[25.01.2009|00:01] C:\Program Files\InstallShield Installation Information
[29.01.2009|11:19] C:\Program Files\Internet Explorer
[16.03.2007|18:34] C:\Program Files\JoWooD
[14.11.2008|11:52] C:\Program Files\KPSA-home
[03.11.2008|15:45] C:\Program Files\LimeWire
[08.02.2009|18:27] C:\Program Files\Malwarebytes' Anti-Malware
[07.02.2009|11:19] C:\Program Files\Messenger Plus! Live
[02.11.2006|13:37] C:\Program Files\Microsoft Games
[08.06.2008|09:11] C:\Program Files\Movie Maker
[08.02.2009|17:21] C:\Program Files\Mozilla Firefox
[02.11.2006|13:37] C:\Program Files\MSBuild
[07.02.2009|11:19] C:\Program Files\MSN Messenger
[09.09.2008|02:00] C:\Program Files\MSXML 4.0
[22.12.2006|09:49] C:\Program Files\Nero
[20.04.2007|15:57] C:\Program Files\Nintendo DS Emulator
[08.09.2008|12:31] C:\Program Files\Nuance
[21.03.2008|19:12] C:\Program Files\OpenOffice.org 2.2
[21.03.2008|19:12] C:\Program Files\OpenOffice.org 2.3
[30.10.2008|17:29] C:\Program Files\Paint.NET
[08.09.2008|12:58] C:\Program Files\Reallusion
[02.11.2006|13:37] C:\Program Files\Reference Assemblies
[02.06.2007|12:47] C:\Program Files\Samsung
[08.09.2008|12:28] C:\Program Files\ScanSoft
[25.01.2009|00:01] C:\Program Files\Serif
[16.09.2008|13:24] C:\Program Files\SimPE
[20.09.2008|19:27] C:\Program Files\Sims2Pack Clean Installer
[05.02.2009|21:37] C:\Program Files\Spybot - Search & Destroy
[08.02.2009|20:57] C:\Program Files\Spyware Terminator
[08.02.2009|17:20] C:\Program Files\SUPERAntiSpyware
[25.01.2009|13:41] C:\Program Files\SystemRequirementsLab
[07.02.2009|16:24] C:\Program Files\Trend Micro
[02.11.2006|14:01] C:\Program Files\Uninstall Information
[07.02.2009|19:37] C:\Program Files\Unlocker
[26.01.2007|11:31] C:\Program Files\VIA
[10.05.2007|17:17] C:\Program Files\VideoLAN
[05.05.2007|21:03] C:\Program Files\Winamp
[08.02.2009|20:57] C:\Program Files\WinClamAVShield
[08.06.2008|09:11] C:\Program Files\Windows Calendar
[08.06.2008|09:11] C:\Program Files\Windows Collaboration
[08.06.2008|09:11] C:\Program Files\Windows Defender
[08.06.2008|09:11] C:\Program Files\Windows Journal
[08.06.2007|18:01] C:\Program Files\Windows Live
[01.12.2007|07:49] C:\Program Files\Windows Live Toolbar
[15.01.2009|10:21] C:\Program Files\Windows Mail
[08.06.2008|09:11] C:\Program Files\Windows Media Player
[19.02.2007|14:03] C:\Program Files\Windows NT
[08.06.2008|09:11] C:\Program Files\Windows Photo Gallery
[08.06.2008|09:11] C:\Program Files\Windows Sidebar
[02.06.2007|12:46] C:\Program Files\XviD
[16.11.2008|16:10] C:\Program Files\Yahoo!
[0|Datei(en),] C:\Program Files\Bytes
[73|Verzeichnis(se),] C:\Program Files\Bytes frei

--------------------\\ Ordner Verzeichnis unter C:\Program Files\Common Files

[03.02.2009|21:37] C:\Program Files\Common Files\Adobe
[25.01.2009|13:05] C:\Program Files\Common Files\Adobe AIR
[22.12.2006|10:05] C:\Program Files\Common Files\Ahead
[17.11.2007|19:05] C:\Program Files\Common Files\aol
[25.01.2009|08:48] C:\Program Files\Common Files\Corel
[08.09.2008|12:29] C:\Program Files\Common Files\InstallShield
[22.12.2006|09:55] C:\Program Files\Common Files\LightScribe
[25.01.2009|08:53] C:\Program Files\Common Files\microsoft shared
[22.12.2006|09:37] C:\Program Files\Common Files\Nullsoft
[12.01.2009|12:27] C:\Program Files\Common Files\Scanner
[08.09.2008|12:29] C:\Program Files\Common Files\ScanSoft Shared
[02.11.2006|12:18] C:\Program Files\Common Files\Services
[02.11.2006|12:18] C:\Program Files\Common Files\SpeechEngines
[02.06.2007|12:47] C:\Program Files\Common Files\ST System Shared
[02.06.2007|12:45] C:\Program Files\Common Files\SWF Studio
[08.06.2008|09:11] C:\Program Files\Common Files\System
[0|Datei(en),] C:\Program Files\Common Files\Bytes
[18|Verzeichnis(se),] C:\Program Files\Common Files\Bytes frei

--------------------\\ Process

( 54 Processes )

... OK !

--------------------\\ Ueberpruefung mit S_Lop

Kein Lop Ordner gefunden !

--------------------\\ Suche nach Lop Dateien - Ordnern

Kein Lop Ordner gefunden !

--------------------\\ Suche innerhalb der Registry

..... OK !

--------------------\\ Ueberpruefung der Hosts Datei

Hosts Datei SAUBER

--------------------\\ Suche nach verborgenen Dateien mit Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-08 21:54:41
Windows 6.0.6001 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 19

--------------------\\ Suche nach anderen Infektionen

--------------------\\ Cracks & Keygens ..

C:\Users\******\Favorites\YouTube - Stick Figures On Crack 2.URL

[F:11][D:7]-> C:\Users*****\AppData\Local\Temp
[F:34][D:1]-> C:\Users\******\AppData\Roaming\MICROS~1\Windows\Cookies
[F:38][D:4]-> C:\Users\****\AppData\Local\MICROS~1\Windows\TEMPOR~1\content.IE5
[F:26566][D:153]-> C:\$Recycle.Bin

1 - "C:\Lop SD\LopR_1.txt" - 08.02.2009|21:28 - Option : [1]
2 - "C:\Lop SD\LopR_2.txt" - 08.02.2009|22:02 - Option : [2]

--------------------\\ Scan beendet um 22:02:37
[ UAC => 1 ]

john.doe · 08.02.2009, 22:27

Gut, die sind auch weg. LopSD deinstallieren. Davon in Zukunft die Hände weg:

Zitat:

[21.11.2008|18:40] C:\ProgramData\Azureus
[03.09.2008|02:23] C:\ProgramData\eMule
c:\program files\LimeWire\LimeWire.exe

Damit hast du dir vermutlich ein Teil der Schädlinge ins Haus geholt:

Zitat:

[10.07.2007|14:52] C:\ProgramData\Messenger Plus!

Hast du die Deinstallationen alle durchgeführt? Ich sehe da noch Unmengen an Resten.

ciao, andreas

ArmeRuki · 08.02.2009, 22:34

ui =( wie Deinstallationen meinste mit lobSD ?

john.doe · 08.02.2009, 22:43

Z.B. Spyware Terminator, Spybot, ...

Ich bastel dir mal ein Skript, das dauert etwas.

ciao, andreas

ArmeRuki · 08.02.2009, 22:46

oki danke (^__^)

~Ruki~

john.doe · 08.02.2009, 23:16

1.) Scripten mit Combofix

Öffne den Editor (Start => Zubehör => Editor ) kopiere nun folgenden Text in das weiße Feld:

Code:

ATTFilter

KILLALL::

Folder::
c:\program files\Unlocker
c:\users\Rukisama\AppData\Roaming\Spyware Terminator
c:\users\All Users\Spyware Terminator
c:\program files\Spyware Terminator
c:\programdata\Spyware Terminator
c:\program files\Google
c:\program files\AskBarDis
c:\programdata\Spybot - Search & Destroy
c:\program files\Spybot - Search & Destroy
C:\ProgramData\Google
C:\ProgramData\That Face Camp Shim

File::
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Google Updater.lnk
c:\windows\pss\Google Updater.lnk.CommonStartup
C:\Users\Rukisama\AppData\Local\GDIPFONTCACHEV1.DAT

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ADMINTICK]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CAMP SHIM EXIT HECK]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]

Dirlook::
c:\programdata\Idol Surf Love

Speichere diese Datei nun auf dem Desktop unter -> cfscript.txt

Nun die Datei cfscript.txt mit der rechten Maustaste auf das Sysmbol von Combofix ziehen!

Danach das Combofix nochmal ausführen, das System neu starten und das Log von Combofix posten

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann.

2.) Reinige mehrfach die Registry mit dem CCleaner, solange, bis keine Fehler mehr gefunden werden.

ciao, andreas

virus will einfach nicht verschwinden

Log-Analyse und Auswertung: virus will einfach nicht verschwinden