Hallo!

Mein Antivir gibt mir bei jedem Neustart diesen Fund an.
Ich habe schon einige Beiträge im Netz zu dem Trojaner gefunden, die meisten von Ende letzten Jahres, aber noch keine Lösung.
Einmal wurde empfohlen mit Killbox eine Datei zu löschen die aber bei mir nicht existiert.
Ein anderer Versuch mit SDFix im abgesicherten Modus hat ihn auch nicht wegbekommen.
Kann mir jemand weiterhelfen?

Hier das Hijackthis-Log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:41:08, on 29.04.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\AntiVir PersonalEdition Premium\avguard.exe
C:\Programme\Gemeinsame Dateien\ArcSoft\Connection Service\Bin\ACService.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe
C:\Programme\AntiVir PersonalEdition Premium\sched.exe
C:\Programme\AntiVir PersonalEdition Premium\avesvc.exe
C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
C:\Programme\Gemeinsame Dateien\Portrait Displays\Shared\DTSRVC.exe
C:\Programme\Java\jre6\bin\jqs.exe
C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
C:\Programme\NetLimiter 2 Pro\nlsvc.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\Gemeinsame Dateien\Acronis\Fomatik\TrueImageTryStartService.exe
C:\Programme\AntiVir PersonalEdition Premium\avmailc.exe
C:\Programme\NetLimiter 2 Pro\NLClient.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Programme\AntiVir PersonalEdition Premium\avgnt.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Acronis\TrueImageHome\TrueImageMonitor.exe
C:\Programme\Acronis\TrueImageHome\TimounterMonitor.exe
C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe
C:\Programme\Portrait Displays\Pivot Software\wpctrl.exe
C:\Programme\Portrait Displays\HP My Display\DTHtml.exe
C:\Programme\Gemeinsame Dateien\Nokia\MPlatform\NokiaMServer.exe
C:\Programme\Gemeinsame Dateien\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Programme\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\nod6441.exe
C:\Programme\Gemeinsame Dateien\Portrait Displays\Shared\HookManager.exe
C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
C:\Garmin\gStart.exe
C:\Programme\DAEMON Tools Lite\daemon.exe
C:\Programme\Skype\Phone\Skype.exe
C:\Programme\Veoh Networks\VeohWebPlayer\veohwebplayer.exe
C:\Programme\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Programme\Pinnacle\Shared Files\Programs\Scheduler\PCLEScheduler.exe
C:\Programme\MSI\ArcSoft TotalMedia\TMMonitor.exe
C:\Programme\Skype\Plugin Manager\skypePM.exe
C:\Programme\Portrait Displays\Pivot Software\floater.exe
C:\Programme\Opera\opera.exe
C:\Programme\Gemeinsame Dateien\ArcSoft\Connection Service\Bin\ArcCon.ac
C:\Programme\Trend Micro\HijackThis\HijackThis.exe
C:\Programme\AntiVir PersonalEdition Premium\avwsc.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.at/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www6.inode.at/config/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Veoh Web Player Video Finder - {0FBB9689-D3D7-4f7a-A2E2-585B10099BFC} - C:\Programme\Veoh Networks\VeohWebPlayer\VeohIEToolbar.dll
O3 - Toolbar: Veoh Video Compass - {52836EB0-631A-47B1-94A6-61F9D9112DAE} - C:\Programme\Veoh Networks\Veoh Video Compass\SearchRecsPlugin.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [OSSelectorReinstall] C:\Programme\Gemeinsame Dateien\Acronis\Acronis Disk Director\oss_reinstall.exe
O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Premium\avgnt.exe" /min
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Programme\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programme\Gemeinsame Dateien\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Programme\Acronis\TrueImageHome\TrueImageMonitor.exe
O4 - HKLM\..\Run: [AcronisTimounterMonitor] C:\Programme\Acronis\TrueImageHome\TimounterMonitor.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [PivotSoftware] "C:\Programme\Portrait Displays\Pivot Software\wpctrl.exe"
O4 - HKLM\..\Run: [DT HPW] C:\Programme\Portrait Displays\HP My Display\DTHtml.exe -startup_folder
O4 - HKLM\..\Run: [TrayServer] C:\Programme\MAGIX\Movies2go_III_Download_version\TrayServer .exe
O4 - HKLM\..\Run: [NokiaMServer] C:\Programme\Gemeinsame Dateien\Nokia\MPlatform\NokiaMServer /watchfiles
O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Programme\Gemeinsame Dateien\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [ctfmon] nod6441.exe
O4 - HKLM\..\RunServices: [ctfmon] nod6441.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [gStart] C:\Garmin\gStart.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Programme\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [Skype] "C:\Programme\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [VeohPlugin] "C:\Programme\Veoh Networks\VeohWebPlayer\veohwebplayer.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Acrobat - Schnellstart.lnk = ?
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Programme\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Programme\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Nokia Nseries PC Suite.lnk = C:\Programme\Nokia\NNPCS\RunLauncher.exe
O4 - Global Startup: Pinnacle PCTV Scheduler.lnk = C:\Programme\Pinnacle\Shared Files\Programs\Scheduler\PCLEScheduler.exe
O4 - Global Startup: TMMonitor.lnk = C:\Programme\MSI\ArcSoft TotalMedia\TMMonitor.exe
O8 - Extra context menu item: An vorhandenes PDF anfügen - res://C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - res://C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - res://C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - res://C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - res://C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: In Adobe PDF konvertieren - res://C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: In vorhandene PDF-Datei konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - res://C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - res://C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Barra di ricerca di Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsof...?1236425912546
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1236425906468
O16 - DPF: {8FEFF364-6A5F-4966-A917-A3AC28411659} (SopCore Control) - http://www.mariatv.it/SOPCORE.CAB
O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IPSUploader Control) - http://as.photoprintit.de/ips-opdata...PSUploader.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft - C:\Programme\Gemeinsame Dateien\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir PersonalEdition Premium MailGuard (AntiVirMailService) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Premium\avmailc.exe
O23 - Service: AntiVir PersonalEdition Premium Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Premium\sched.exe
O23 - Service: AntiVir PersonalEdition Premium Guard (AntiVirService) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Premium\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AntiVir PersonalEdition Premium MailGuard Hilfsdienst (AVEService) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Premium\avesvc.exe
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Programme\Gemeinsame Dateien\Portrait Displays\Shared\DTSRVC.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Programme\MAGIX\Common\Database\bin\fbserver.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
O23 - Service: NetLimiter (nlsvc) - Locktime Software - C:\Programme\NetLimiter 2 Pro\nlsvc.exe
O23 - Service: NMIndexingService - Nero AG - C:\Programme\Gemeinsame Dateien\Nero\Lib\NMIndexingService.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - C:\Programme\WinPcap\rpcapd.exe
O23 - Service: ServiceLayer - Nokia. - C:\Programme\Nokia\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: Acronis Try And Decide Service (TryAndDecideService) - Unknown owner - C:\Programme\Gemeinsame Dateien\Acronis\Fomatik\TrueImageTryStartService.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Programme\TuneUpUtilities2006\WinStylerThemeSvc.exe
O24 - Desktop Component 0: (no name) - file:///C:/DOKUME~1/ADMINI~1/LOKALE~1/Temp/msohtmlclip1/01/clip_image001.jpg

--
End of file - 14760 bytes

Und hier der Schlußreport von SDFix:

SDFix: Version 1.240
Run by Administrator on 29.04.2009 at 08:13

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix

Checking Services :


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


Checking Files :

No Trojan Files Found






Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-29 08:26:00
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\ACPI\PNP0F1 3\4&1e850c4&0\LogConf]
"BasicConfigVector"=hex(a):88,00,00,00,0f,00,00,00,00,00,00, 00,00,00,00,00,00,00,00,00,00,..
"BootConfig"=hex(8):01,00,00,00,0f,00,00,00,00,00,00,00,01,0 0,01,00,03,00,00,00,01,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cf g]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cf g\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Programme\DAEMON Tools Lite\"
"h0"=dword:00000000
"khjeh"=hex:a2,6a,cc,ff,82,23,82,12,4d,0a,f7,e5,30,59,c9,1b, ae,0b,87,e8,ae,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cf g\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,1d,18,dd,b4,3b,94,43,68,6d,29,69,41,0b, 8c,12,92,63,..
"khjeh"=hex:4f,7c,9b,7a,4b,0e,5d,05,d7,72,4d,02,d3,a0,2d,0f, 7f,b9,db,d1,6a,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cf g\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:49,12,87,a6,b6,07,a8,99,7b,5b,98,eb,eb,cb,84,73, 77,21,19,ab,2a,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Vax347s \Config\jdgg40]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Vax347s \Config\jdgg41]
"ujdew"=hex:20,02,00,00,b0,f2,98,7b,44,fa,24,61,18,44,09,a0, 4b,bf,ef,70,11,..
"ljej40"=hex:97,c8,d5,8d,b7,19,1f,d4,9f,f3,f8,04,9c,6b,70,80 ,54,53,aa,69,2b,..
"ljej41"=hex:58,c8,d5,8d,cf,19,1f,d4,9e,f3,f9,04,9d,6b,70,80 ,54,53,aa,69,1b,..
"ljej42"=hex:58,c8,d5,8d,cf,19,1f,d4,9e,f3,f9,04,9d,6b,70,80 ,54,53,aa,69,1b,..
"ljej43"=hex:58,c8,d5,8d,cf,19,1f,d4,9e,f3,f9,04,9d,6b,70,80 ,54,53,aa,69,1b,..
"ljej44"=hex:58,c8,d5,8d,cf,19,1f,d4,9e,f3,f9,04,9d,6b,70,80 ,54,53,aa,69,1b,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Vax347s \Config\jdgg42]
"ujdew"=hex:20,02,00,00,b0,f2,98,7b,60,a2,7c,f2,18,44,09,a0, af,be,ef,70,1e,..
"ljej40"=hex:eb,c8,d5,8d,b7,19,1f,d4,9f,f3,f8,04,9c,6b,70,80 ,54,53,aa,69,0b,..
"ljej41"=hex:58,c8,d5,8d,cf,19,1f,d4,9e,f3,f9,04,9d,6b,70,80 ,54,53,aa,69,1b,..
"ljej42"=hex:58,c8,d5,8d,cf,19,1f,d4,9e,f3,f9,04,9d,6b,70,80 ,54,53,aa,69,1b,..
"ljej43"=hex:58,c8,d5,8d,cf,19,1f,d4,9e,f3,f9,04,9d,6b,70,80 ,54,53,aa,69,1b,..
"ljej44"=hex:58,c8,d5,8d,cf,19,1f,d4,9e,f3,f9,04,9d,6b,70,80 ,54,53,aa,69,1b,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Vax347s \Config\jdgg43]
"ujdew"=hex:20,02,00,00,b0,f2,98,7b,bd,5c,22,40,18,44,09,a0, 95,be,ef,70,1e,..
"ljej40"=hex:f1,c8,d5,8d,b7,19,1f,d4,9f,f3,f8,04,9c,6b,70,80 ,54,53,aa,69,09,..
"ljej41"=hex:58,c8,d5,8d,cf,19,1f,d4,9e,f3,f9,04,9d,6b,70,80 ,54,53,aa,69,1b,..
"ljej42"=hex:58,c8,d5,8d,cf,19,1f,d4,9e,f3,f9,04,9d,6b,70,80 ,54,53,aa,69,1b,..
"ljej43"=hex:58,c8,d5,8d,cf,19,1f,d4,9e,f3,f9,04,9d,6b,70,80 ,54,53,aa,69,1b,..
"ljej44"=hex:58,c8,d5,8d,cf,19,1f,d4,9e,f3,f9,04,9d,6b,70,80 ,54,53,aa,69,1b,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\ACPI\PNP0F13\4& 1e850c4&0\LogConf]
"BasicConfigVector"=hex(a):88,00,00,00,0f,00,00,00,00,00,00, 00,00,00,00,00,00,00,00,00,00,..
"BootConfig"=hex(8):01,00,00,00,0f,00,00,00,00,00,00,00,01,0 0,01,00,03,00,00,00,01,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19 659239224E364682FA4BAF72C53EA4]
"p0"="C:\Programme\DAEMON Tools Lite\"
"h0"=dword:00000000
"khjeh"=hex:a2,6a,cc,ff,82,23,82,12,4d,0a,f7,e5,30,59,c9,1b, ae,0b,87,e8,ae,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19 659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,1d,18,dd,b4,3b,94,43,68,6d,29,69,41,0b, 8c,12,92,63,..
"khjeh"=hex:4f,7c,9b,7a,4b,0e,5d,05,d7,72,4d,02,d3,a0,2d,0f, 7f,b9,db,d1,6a,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19 659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:49,12,87,a6,b6,07,a8,99,7b,5b,98,eb,eb,cb,84,73, 77,21,19,ab,2a,..

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion \System]
"OODEFRAG10.00.00.01WORKSTATION"="C3777BEECC27A4FB58F2C8E935 476D79EAF1AE09FC3D76410AD3E03070327F5DBCA16AD3FA8E5D2E4CAD48 9EB44399FC1F84196683DFAED7A22C5CEF517F4DB644B840054DFBAF8201 A67FD43DFA85DB7811502EE0C2E5B41F2C657FE2E5D645F11DF82CE03965 404595E935F49D4C659F4371256198A5589F14DA5FBC3CB8547CC4D32B35 60CB208B424A1BE62A0A615DFEBC9E127BECC74CFEBC9E127BECC74CFEBC 9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C A6A0AC4980AC7933BA7FD869164D6794BA7FD869164D6794C038D530D6EB 34520EB0F228D5561F77DAB11FDBC2769D302242F0B5C0610CB77F24E008 336A7D30E5679663CB4B5D077C42CC6D110CBD8AD58509C1377A6F98ED16 9BE4493171D1F67D7942A4AAAC6E7C8ADA49B969008FD7FBB5032D311EAF E9C27BCF3C4A399A2ECA34A0F1D87E769E62DF50B5C3E3615E9FA80523AA C49BBEE4ED1E2D6D4D3F0EEB92B91B40B80D37E722CBD1D65C4734AE49B6 E813821BCDFC978714D51B192AC193315E4DB645B1FB1FE32FDC4F2C392B 2F6BA419EA910B4ECCA8BB4483252DEEE98AC8EFC4D30CC30826419B981F 62DAA95C50ED0707FE5E998243FADA83D3DCFD2F411DA593D7A74008D1D5 885333C83722B8C8D12845F93B781D436A79EF366CED7CCC0F813DD560DD 7DD4609ECAC290BD02E43DC38F2F25D40F667071666C03F7087CAB4074BF 3562B568577C56DA9E139F012BCE2052FD41B4361C75AF33C6E142AD9915 CC99BFB33EE1998C19E67C67DC5EF4DFD0F99FD07D059339D903ED2561E2 6A6AA8DC3455AF154510EA01FEE856C566348D8019752CABEF8F8617E39F 6AA5A3CEFDC67B2C775DEDEFB7072AA4FE00BE2B5586AC8956853E726A70 C812BA0341F1D658B104D69719B47D9DB6101BDC33C93F6D51C767717EFD 4FD3F0A2028BAE2B5257270AE126C38FCF28130146AEEAB5F0DDB0D29DD2 27741148E25BC3D3CF75224CDF52816DDBD2D6D0E0B2ECCB02BCA7422AAD 0E1320B9A21ADAA75774F9EC0C8316D1F1584573CC87F5C5518E894DB3C9 CE409B9BC6D688D946D9E90BF654EB8F35624554568F817D5BBD09D704FC F96768D784DEECF7DC5B4BA879368412ADC55DC45F52D9E357A8CD807D86 6A8171536DA4564ED56F4CB6412B5B9B56AD563E6419F8C810D347C2C0DA 6E852939A6888FBAF261BCB11848B1E036649158F9D6D1671FB0A9665C4C 577BEA3C1FA2BAC4AF139295CC5794B05D29063D4FE1C3B0E1183288D046 3404ECF55A1AA0E1E10D6589BE69289DAC5339CB9BD51FC0F13007FB68D0 9DC283730FC2F592F6BE64A6F85ED76063E5DCD769701963818E567E63C4 4810214F11627EBA4B1B5BA51E1E6BB70F020733B62D4C25779E6E0A580A D08730CF5D01375FB01FBDB081A57E416F1B6B5B91"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion \Uninstall\{E9F81423-211E-46B6-9AE0-38568BC5CF6F}]
"DisplayName"="Alcohol 120%"

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services :




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\shareda ccess\parameters\firewallpolicy\standardprofile\authorizedap plications\list]
"C:\\Dokumente und Einstellungen\\Administrator\\Desktop\\Programme\\utorrent 1.6.exe"="C:\\Dokumente und Einstellungen\\Administrator\\Desktop\\Programme\\utorrent 1.6.exe:*:Enabled:µTorrent"
"C:\\Programme\\Internet Explorer\\IEXPLORE.EXE"="C:\\Programme\\Internet Explorer\\IEXPLORE.EXE:*isabled:Internet Explorer"
"J:\\Programme\\Microsoft Games\\Rise of Nations\\rise.exe"="J:\\Programme\\Microsoft Games\\Rise of Nations\\rise.exe:*isabled:Rise of Nations"
"C:\\Programme\\Langenscheidt T1 7_0\\StdAlone\\MT_Alone.exe"="C:\\Programme\\Langenscheidt T1 7_0\\StdAlone\\MT_Alone.exe:*isabled:T1 Standalone"
"C:\\Programme\\gnucash\\bin\\gnucash-bin.exe"="C:\\Programme\\gnucash\\bin\\gnucash-bin.exe:*:Enabled:GnuCash Free Finance Manager"
"C:\\Programme\\gnucash\\bin\\gconfd-2.exe"="C:\\Programme\\gnucash\\bin\\gconfd-2.exe:*:Enabled:GConf Settings Manager"
"C:\\Programme\\Windows Media Player\\wmplayer.exe"="C:\\Programme\\Windows Media Player\\wmplayer.exe:*isabled:Windows Media Player"
"J:\\Programme\\poc\\poc2008\\Poc3D2008.exe"="J:\\Programme\ \poc\\poc2008\\Poc3D2008.exe:*isabled:Poc3D2008"
"C:\\Programme\\EA GAMES\\Battlefield 2\\BF2.exe"="C:\\Programme\\EA GAMES\\Battlefield 2\\BF2.exe:*:Enabled:Battlefield 2"
"C:\\Programme\\Tele2\\SupportCenter\\SupportCenter.exe"="C: \\Programme\\Tele2\\SupportCenter\\SupportCenter.exe:*:Enabl ed:Tele2 Support Center"
"J:\\Programme\\TmNationsForever\\TmForever.exe"="J:\\Progra mme\\TmNationsForever\\TmForever.exe:*:Enabled:TmForever"
"C:\\Programme\\Mozilla Firefox\\firefox.exe"="C:\\Programme\\Mozilla Firefox\\firefox.exe:*:Enabled:Firefox"
"C:\\Programme\\Electronic Arts\\EADM\\Core.exe"="C:\\Programme\\Electronic Arts\\EADM\\Core.exe:*isabled:EA Download Manager"
"C:\\WINDOWS\\system32\\PnkBstrA.exe"="C:\\WINDOWS\\system32 \\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\\WINDOWS\\system32\\PnkBstrB.exe"="C:\\WINDOWS\\system32 \\PnkBstrB.exe:*:Enabled:PnkBstrB"
"J:\\Programme\\Ubisoft\\Far Cry 2\\bin\\FarCry2 -GameProfile_AllWeaponsUnlock 1.exe"="J:\\Programme\\Ubisoft\\Far Cry 2\\bin\\FarCry2 -GameProfile_AllWeaponsUnlock 1.exe:*isabled:Far Cry® 2"
"C:\\Programme\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=" C:\\Programme\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe:*: Enabled:Logitech Desktop Messenger"
"C:\\Programme\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"="C:\\Programme\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe:*:Enabled:Logitech Harmony Remote Software 7"
"C:\\Programme\\SopCast\\adv\\SopAdver.exe"="C:\\Programme\\ SopCast\\adv\\SopAdver.exe:*isabled:SopCast Adver"
"C:\\Programme\\VideoLAN\\VLC\\vlc.exe"="C:\\Programme\\Vide oLAN\\VLC\\vlc.exe:*:Enabled:VLC media player"
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"="C:\\Program Files\\Real\\RealPlayer\\realplay.exe:*:Enabled:RealPlayer"
"C:\\Programme\\MSI\\ArcSoft TotalMedia\\TotalMedia.exe"="C:\\Programme\\MSI\\ArcSoft TotalMedia\\TotalMedia.exe:LocalSubNet:Enabled:ArcSoft TotalMedia 3.5"
"C:\\Programme\\Veoh Networks\\VeohWebPlayer\\veohwebplayer.exe"="C:\\Programme\\ Veoh Networks\\VeohWebPlayer\\veohwebplayer.exe:*:Enabled:Veoh Web Player "
"C:\\Programme\\Microsoft Games\\Age of Empires II\\EMPIRES2.ICD"="C:\\Programme\\Microsoft Games\\Age of Empires II\\EMPIRES2.ICD:*isabled:Age of Empires II"
"C:\\Programme\\Opera\\opera.exe"="C:\\Programme\\Opera\\ope ra.exe:*isabled:Opera Internet Browser"
@=":*:Enabled:ctfmon"
"C:\\Programme\\Skype\\Phone\\Skype.exe"="C:\\Programme\\Sky pe\\Phone\\Skype.exe:*:Enabled:Skype"


Danke für eure Hilfe!
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\shareda ccess\parameters\firewallpolicy\domainprofile\authorizedappl ications\list]
"C:\\Programme\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=" C:\\Programme\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe:*: Enabled:Logitech Desktop Messenger"
"C:\\Programme\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"="C:\\Programme\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe:*:Enabled:Logitech Harmony Remote Software 7"

Remaining Files :



Files with Hidden Attributes :

Mon 26 Jan 2009 1,740,632 A.SHR --- "C:\Programme\Spybot - Search & Destroy\SDUpdate.exe"
Mon 26 Jan 2009 5,365,592 A.SHR --- "C:\Programme\Spybot - Search & Destroy\SpybotSD.exe"
Thu 5 Mar 2009 2,260,480 A.SHR --- "C:\Programme\Spybot - Search & Destroy\TeaTimer.exe"
Wed 13 Jun 2007 1,030,717 ..SHR --- "C:\WINDOWS\system32\nod6441.exe"
Mon 24 Sep 2007 4,348 A.SH. --- "C:\Dokumente und Einstellungen\All Users\DRM\DRMv1.bak"
Fri 8 Aug 2008 0 A.SH. --- "C:\Dokumente und Einstellungen\All Users\DRM\Cache\Indiv01.tmp"
Thu 8 Nov 2001 20,480 A..H. --- "C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\Office Ordner\DA Dolmetsch\~WRL1459.tmp"
Mon 6 Oct 2003 33,792 A..H. --- "C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\Office Ordner\Word Dateien\~WRL0005.tmp"
Tue 14 Oct 2003 35,328 A..H. --- "C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\Office Ordner\Word Dateien\~WRL0610.tmp"
Thu 15 Feb 2001 193,024 A..HR --- "C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\Office Ordner\Word Dateien\Seminararbeit\~WRL0251.tmp"
Thu 15 Feb 2001 193,024 A..HR --- "C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\Office Ordner\Word Dateien\Seminararbeit\~WRL0594.tmp"
Thu 15 Feb 2001 193,024 A..HR --- "C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\Office Ordner\Word Dateien\Seminararbeit\~WRL1109.tmp"
Thu 15 Feb 2001 190,976 A..HR --- "C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\Office Ordner\Word Dateien\Seminararbeit\~WRL1601.tmp"
Thu 15 Feb 2001 194,048 A..HR --- "C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\Office Ordner\Word Dateien\Seminararbeit\~WRL1872.tmp"
Thu 15 Feb 2001 192,512 A..HR --- "C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\Office Ordner\Word Dateien\Seminararbeit\~WRL2000.tmp"
Thu 15 Feb 2001 193,024 A..HR --- "C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\Office Ordner\Word Dateien\Seminararbeit\~WRL2897.tmp"
Thu 15 Feb 2001 193,024 A..HR --- "C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\Office Ordner\Word Dateien\Seminararbeit\~WRL3569.tmp"
Sun 17 Jun 2001 23,040 A..HR --- "C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\Office Ordner\Word Dateien\Uni-Dolmetsch\~WRL1478.tmp"
Sun 17 Jun 2001 21,504 A..HR --- "C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\Office Ordner\Word Dateien\Uni-Dolmetsch\~WRL2043.tmp"

Finished!

Ach ja, Fundort war C:\a.bat

Auch Combofix hat nichts geholfen.