Komme einfach allein nicht weiter hab schon probiert mit dem neuen Navilog zu arbeiten aber, als ich es damals benutze war es noch einfacher...

Hab erstmal diesen Log erstellt da ich mich hier en bissel umgeschaut hab und dies iwie immer gewünscht war. Ich sehe in dem Log reingarnix hoffe ihr seid da besser


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:40:54, on 19.11.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Programme\ICQ6Toolbar\ICQ Service.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Programme\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\programme\steam\steam.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Programme\Messenger\msmsgs.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
C:\Programme\Skype\Phone\Skype.exe
C:\Programme\Samurize\Client.exe
C:\PROGRA~1\ICQ6.5\ICQ.exe
C:\Programme\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Programme\Skype\Plugin Manager\skypePM.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\Programme\Skype\Toolbars\Shared\SkypeNames.exe
C:\Programme\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://de.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://de.yahoo.com
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll
R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_06\bin\ssv.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [StartCCC] "C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [upload curb default new] C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Lies shim upload curb\junk pop.exe
O4 - HKCU\..\Run: [Steam] "c:\programme\steam\steam.exe" -silent
O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [close owns] C:\DOKUME~1\Ice\ANWEND~1\THEPRO~1\MORESTUPID.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Skype] "C:\Programme\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ICQ] "C:\PROGRA~1\ICQ6.5\ICQ.exe" silent
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Client Default.lnk = C:\Programme\Samurize\Client.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://icq.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
O23 - Service: Avira AntiVir Personal – Free Antivirus Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ICQ Service - Unknown owner - C:\Programme\ICQ6Toolbar\ICQ Service.exe

--
End of file - 5714 bytes




Wie geasagt mein IE öfnnet immer Riesiege Werbefenster obwohl ich ihn eigentlich nie benutzt hab

hoffe ihr könnt mir weiterhelfen

lg believe

Hallo und

sieht sehr nach Swizzor aus, arbeite darum bitte zunächst diese Anleitung ab
http://www.trojaner-board.de/69886-a...-beachten.html
dann sehen wir weiter.

EDIT: Was sagt SpyBot, findet er nicht zufällig Lop o.ä.?

MFG

Vielen dank erstma ein dickes sry fürs übersehen der Anleitung diese proxys also CCC und maleware haben zwar was gefunden aber Problem besteht weiterhin aber ein Riesen thx schonmal im vorraus

Edit: Ich weiß nicht welche infos ihr nun von mir braucht bitte um Aufklärung^^

Hallo

Ich weiß nicht welche infos ihr nun von mir braucht bitte um Aufklärung^^

alle

poste bitte das Log von Malwarebytes hierher (zu finden unter Scanberichte), poste bitte auch die Berichte von RSIT (zu finden unter C:\rsit\log.txt und C:\rsit\info.txt)
Sollte nicht alles in einen Beitrag passen, kannst du es in mehrere Beiträge aufteilen!

MFG

Logfile of random's system information tool 1.06 (written by random/random)
Run by xxx at 2009-11-20 00:18:44
Microsoft Windows XP Home Edition Service Pack 2
System drive C: has 30 GB (33%) free of 90 GB
Total RAM: 2047 MB (35% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:18:49, on 20.11.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Programme\ICQ6Toolbar\ICQ Service.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Programme\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\programme\steam\steam.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Programme\Messenger\msmsgs.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
C:\Programme\Skype\Phone\Skype.exe
C:\Programme\Samurize\Client.exe
C:\PROGRA~1\ICQ6.5\ICQ.exe
C:\Programme\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Programme\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Programme\Mozilla Firefox\firefox.exe
C:\Programme\Skype\Toolbars\Shared\SkypeNames.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Dokumente und Einstellungen\Ice\Desktop\RSIT.exe
C:\Programme\Trend Micro\HijackThis\Ice.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://de.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://de.yahoo.com
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll
R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_06\bin\ssv.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [StartCCC] "C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [upload curb default new] C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Lies shim upload curb\junk pop.exe
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [Steam] "c:\programme\steam\steam.exe" -silent
O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [close owns] C:\DOKUME~1\Ice\ANWEND~1\THEPRO~1\MORESTUPID.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Skype] "C:\Programme\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ICQ] "C:\PROGRA~1\ICQ6.5\ICQ.exe" silent
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Client Default.lnk = C:\Programme\Samurize\Client.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://icq.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
O23 - Service: Avira AntiVir Personal – Free Antivirus Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ICQ Service - Unknown owner - C:\Programme\ICQ6Toolbar\ICQ Service.exe

--
End of file - 5947 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
C:\WINDOWS\tasks\B16F03349184B2D0.job
C:\WINDOWS\tasks\Driver Robot.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
Yahoo! Companion BHO

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Programme\Java\jre1.6.0_06\bin\ssv.dll [2008-03-25 509328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{855F3B16-6D32-4fe6-8A56-BBB695989046} - ICQToolBar - C:\Programme\ICQ6Toolbar\ICQToolBar.dll [2008-06-12 958712]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"avgnt"=C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe [2008-02-12 262401]
"SkyTel"=C:\WINDOWS\SkyTel.EXE [2007-06-15 1826816]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2007-07-05 16380416]
"Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2005-05-03 69632]
"StartCCC"=C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2009-02-25 61440]
"upload curb default new"=C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Lies shim upload curb\junk pop.exe [2009-11-19 831488]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Malwarebytes' Anti-Malware"=C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe [2009-08-03 419088]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Steam"=c:\programme\steam\steam.exe [2009-06-11 1217784]
"MSMSGS"=C:\Programme\Messenger\msmsgs.exe [2004-10-13 1694208]
"close owns"=C:\DOKUME~1\Ice\ANWEND~1\THEPRO~1\MORESTUPID.exe [2009-11-14 487424]
"SpybotSD TeaTimer"=C:\Programme\Spybot - Search & Destroy\TeaTimer.exe [2009-03-05 2260480]
"Skype"=C:\Programme\Skype\Phone\Skype.exe [2009-07-16 25604904]
"ICQ"=C:\PROGRA~1\ICQ6.5\ICQ.exe [2009-03-01 172792]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
C:\WINDOWS\system32\ctfmon.exe [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DriverCD]
F:\Run.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Programme\Messenger\msmsgs.exe [2004-10-13 1694208]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Programme\Java\jre1.6.0_06\bin\jusched.exe [2008-03-25 144784]

C:\Dokumente und Einstellungen\Ice\Startmenü\Programme\Autostart
Client Default.lnk - C:\Programme\Samurize\Client.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2009-02-25 155648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Programme\ICQLite\ICQLite.exe"="C:\Programme\ICQLite\ICQLite.exe:*:Enabled:ICQ Lite"
"C:\Programme\ICQ6\ICQ.exe"="C:\Programme\ICQ6\ICQ.exe:*:Enabled:ICQ6"
"C:\Programme\ICQ6.5\ICQ.exe"="C:\Programme\ICQ6.5\ICQ.exe:*:Enabled:ICQ6"
"D:\Programme\EA GAMES\Battlefield 2\BF2.exe"="D:\Programme\EA GAMES\Battlefield 2\BF2.exe:*:Enabled:Battlefield 2"
"C:\Programme\Anno 1701\Anno1701.exe"="C:\Programme\Anno 1701\Anno1701.exe:*:Enabled:Anno 1701"
"C:\Dokumente und Einstellungen\Ice\Desktop\Warcraft III\Frozen Throne.exe"="C:\Dokumente und Einstellungen\Ice\Desktop\Warcraft III\Frozen Throne.exe:*:Enabled:Frozen Throne"
"C:\Programme\Skype\Phone\Skype.exe"="C:\Programme\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e735023b-080b-11dd-b42a-806d6172696f}]
shell\AutoRun\command - F:\Setup.exe


======List of files/folders created in the last 1 months======

2009-11-20 00:18:44 ----D---- C:\rsit
2009-11-19 19:33:00 ----D---- C:\Dokumente und Einstellungen\Ice\Anwendungsdaten\Malwarebytes
2009-11-19 19:32:55 ----D---- C:\Programme\Malwarebytes' Anti-Malware
2009-11-19 19:32:55 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
2009-11-19 19:26:45 ----D---- C:\Programme\CCleaner
2009-11-19 17:40:47 ----D---- C:\Programme\Trend Micro
2009-11-19 17:22:57 ----A---- C:\OS_v.txt
2009-11-19 17:22:57 ----A---- C:\cleannavi.txt
2009-11-19 17:15:35 ----SHD---- C:\Config.Msi
2009-11-19 16:06:11 ----D---- C:\Programme\Navilog1
2009-11-14 09:01:47 ----D---- C:\Programme\The proxy
2009-11-11 01:06:50 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$
2009-11-11 01:06:46 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$
2009-11-11 01:06:41 ----HDC---- C:\WINDOWS\$NtUninstallKB959426$
2009-11-11 01:06:37 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$
2009-11-11 01:06:32 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$
2009-11-11 01:06:28 ----HDC---- C:\WINDOWS\$NtUninstallKB935448$
2009-11-11 01:06:23 ----HDC---- C:\WINDOWS\$NtUninstallKB955839$
2009-11-11 01:06:07 ----HDC---- C:\WINDOWS\$NtUninstallKB972260$
2009-11-11 01:06:01 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$
2009-11-11 01:05:57 ----HDC---- C:\WINDOWS\$NtUninstallKB960225$
2009-11-11 01:05:52 ----HDC---- C:\WINDOWS\$NtUninstallKB973346$
2009-11-11 01:05:38 ----HDC---- C:\WINDOWS\$NtUninstallKB956572$
2009-11-11 01:05:32 ----HDC---- C:\WINDOWS\$NtUninstallKB961501$
2009-11-11 01:05:28 ----HDC---- C:\WINDOWS\$NtUninstallKB938464-v2$
2009-11-11 01:05:24 ----HDC---- C:\WINDOWS\$NtUninstallKB971633$
2009-11-11 01:05:19 ----HDC---- C:\WINDOWS\$NtUninstallKB952069_WM9$
2009-11-11 01:05:13 ----HDC---- C:\WINDOWS\$NtUninstallKB952004$
2009-11-11 01:04:52 ----HDC---- C:\WINDOWS\$NtUninstallKB957097$
2009-11-11 01:04:47 ----HDC---- C:\WINDOWS\$NtUninstallKB958687$
2009-11-11 01:04:43 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$
2009-11-11 01:04:37 ----HDC---- C:\WINDOWS\$NtUninstallKB967715$
2009-11-11 01:04:33 ----HDC---- C:\WINDOWS\$NtUninstallKB929399$
2009-11-11 01:04:14 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$
2009-11-11 01:04:07 ----HDC---- C:\WINDOWS\$NtUninstallKB959772_WM11$
2009-11-11 01:04:02 ----HDC---- C:\WINDOWS\$NtUninstallKB951748$
2009-11-11 01:03:56 ----HDC---- C:\WINDOWS\$NtUninstallKB970238$
2009-11-11 01:03:52 ----HDC---- C:\WINDOWS\$NtUninstallKB960803$
2009-11-11 01:03:47 ----HDC---- C:\WINDOWS\$NtUninstallKB968537$
2009-11-11 01:03:43 ----HDC---- C:\WINDOWS\$NtUninstallKB954600$
2009-11-11 01:03:38 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$
2009-11-11 01:03:34 ----HDC---- C:\WINDOWS\$NtUninstallKB961371$
2009-11-11 01:03:29 ----HDC---- C:\WINDOWS\$NtUninstallKB955069$
2009-11-11 01:03:25 ----HDC---- C:\WINDOWS\$NtUninstallKB956802$
2009-11-11 01:03:22 ----D---- C:\Programme\MSXML 4.0
2009-11-11 01:03:12 ----HDC---- C:\WINDOWS\$NtUninstallKB954154_WM11$
2009-11-11 01:03:12 ----A---- C:\WINDOWS\system32\wmpns.dll
2009-11-11 01:03:07 ----HDC---- C:\WINDOWS\$NtUninstallKB936782_WMP11$
2009-11-11 01:02:40 ----N---- C:\WINDOWS\system32\spmsg.dll
2009-11-11 01:02:39 ----HDC---- C:\WINDOWS\$NtUninstallKB923561$
2009-11-10 22:51:06 ----D---- C:\Dokumente und Einstellungen\Ice\Anwendungsdaten\becker
2009-11-10 22:45:07 ----D---- C:\Programme\Becker
2009-11-10 10:48:37 ----SHD---- C:\found.001
2009-11-10 10:44:28 ----HDC---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\~0
2009-11-10 10:44:21 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Lavasoft
2009-11-10 09:34:26 ----D---- C:\WINDOWS\system32\CatRoot_bak
2009-11-08 01:54:47 ----D---- C:\Programme\alaplaya
2009-11-01 18:41:21 ----D---- C:\Programme\IrfanView
2009-10-28 15:09:37 ----D---- C:\Dokumente und Einstellungen\Ice\Anwendungsdaten\skypePM
2009-10-28 15:08:13 ----D---- C:\Dokumente und Einstellungen\Ice\Anwendungsdaten\Skype
2009-10-28 15:07:50 ----D---- C:\Programme\Gemeinsame Dateien\Skype
2009-10-28 15:07:47 ----RD---- C:\Programme\Skype
2009-10-28 15:07:41 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Skype

======List of files/folders modified in the last 1 months======

2009-11-20 00:18:49 ----D---- C:\WINDOWS\Prefetch
2009-11-19 22:49:36 ----D---- C:\WINDOWS\Temp
2009-11-19 21:55:11 ----D---- C:\WINDOWS\system32\config
2009-11-19 21:14:53 ----D---- C:\WINDOWS\system32\CatRoot2
2009-11-19 21:10:54 ----D---- C:\WINDOWS\system32\drivers
2009-11-19 21:10:54 ----D---- C:\WINDOWS\system32
2009-11-19 19:32:55 ----RD---- C:\Programme
2009-11-19 19:30:29 ----D---- C:\Programme\Mozilla Firefox
2009-11-19 19:30:19 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
2009-11-19 19:29:55 ----D---- C:\WINDOWS\Minidump
2009-11-19 19:29:55 ----D---- C:\WINDOWS\Debug
2009-11-19 19:29:55 ----D---- C:\WINDOWS
2009-11-19 17:17:39 ----D---- C:\Programme\Gemeinsame Dateien
2009-11-19 17:17:31 ----SD---- C:\WINDOWS\Tasks
2009-11-19 17:17:24 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Google
2009-11-19 17:17:22 ----SHD---- C:\WINDOWS\Installer
2009-11-19 17:15:27 ----DC---- C:\WINDOWS\system32\DRVSTORE
2009-11-19 16:43:21 ----D---- C:\Programme\Steam
2009-11-19 16:40:46 ----N---- C:\WINDOWS\SchedLgU.Txt
2009-11-14 09:02:27 ----D---- C:\Dokumente und Einstellungen\Ice\Anwendungsdaten\The proxy
2009-11-14 09:02:23 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Lies shim upload curb
2009-11-11 01:47:38 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-11-11 01:42:59 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-11-11 01:42:59 ----D---- C:\WINDOWS\system32\wbem
2009-11-11 01:42:59 ----D---- C:\WINDOWS\AppPatch
2009-11-11 01:06:52 ----HD---- C:\WINDOWS\inf
2009-11-11 01:06:50 ----HD---- C:\WINDOWS\$hf_mig$
2009-11-11 01:06:38 ----D---- C:\Programme\Messenger
2009-11-11 01:06:26 ----D---- C:\WINDOWS\system32\CatRoot
2009-11-11 01:06:15 ----D---- C:\Programme\Internet Explorer
2009-11-11 01:05:29 ----D---- C:\WINDOWS\WinSxS
2009-11-08 01:51:57 ----HD---- C:\Programme\InstallShield Installation Information
2009-11-02 03:24:16 ----D---- C:\Dokumente und Einstellungen\Ice\Anwendungsdaten\Google
2009-11-01 18:41:23 ----D---- C:\Programme\Google
2009-10-28 14:07:17 ----A---- C:\WINDOWS\WORDPAD.INI

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Amfilter;A4Tech Mouse Filter Driver; C:\WINDOWS\system32\DRIVERS\Amfilter.sys [2006-01-11 8704]
R1 avgio;avgio; \??\C:\Programme\Avira\AntiVir PersonalEdition Classic\avgio.sys []
R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2008-03-04 79424]
R1 kbdhid;Tastatur-HID-Treiber; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2004-08-04 14848]
R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2007-11-08 21248]
R2 atksgt;atksgt; C:\WINDOWS\system32\DRIVERS\atksgt.sys [2009-07-13 271360]
R2 lirsgt;lirsgt; C:\WINDOWS\system32\DRIVERS\lirsgt.sys [2009-07-13 18048]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2009-02-25 3565568]
R3 ATIAVAIW;ATI T200 Unified AVStream service; C:\WINDOWS\system32\DRIVERS\atinavt2.sys [2009-02-04 170496]
R3 avgntflt;avgntflt; \??\C:\Programme\Avira\AntiVir PersonalEdition Classic\avgntflt.sys []
R3 catchme;catchme; \??\C:\DOKUME~1\Ice\LOKALE~1\Temp\catchme.sys []
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2005-01-07 138752]
R3 hidusb;Microsoft HID Class-Treiber; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2004-08-04 9600]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2007-07-18 4547584]
R3 mouhid;Maus-HID-Treiber; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-18 12288]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2006-11-27 58368]
R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2006-11-27 19968]
R3 ROOTMODEM;Microsoft Legacy Modem Driver; C:\WINDOWS\System32\Drivers\RootMdm.sys [2004-08-04 5888]
R3 usbccgp;Microsoft Standard-USB-Haupttreiber; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-04 31616]
R3 usbehci;Miniporttreiber für erweiterten Microsoft USB 2.0-Hostcontroller; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-04 26624]
R3 usbhub;Microsoft USB-Standardhubtreiber; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-04 57600]
R3 usbohci;Miniporttreiber für Microsoft USB Open Host-Controller; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2004-08-04 17024]
S1 AmdK7;AMD K7-Prozessortreiber; C:\WINDOWS\system32\DRIVERS\amdk7.sys [2004-08-04 41472]
S1 AmdK8;AMD Processor Driver; C:\WINDOWS\system32\DRIVERS\AmdK8.sys [2005-03-09 36352]
S1 sysaob;sysaob; \??\C:\WINDOWS\system32\drivers\sysaob.sys []
S3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2005-07-26 3644032]
S3 Amusbprt;A4Tech HID-compliant Mouse Driver; C:\WINDOWS\system32\DRIVERS\Amusbprt.sys [2006-05-09 13312]
S3 CCDECODE;Untertiteldecoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-08-03 17024]
S3 EagleNT;EagleNT; \??\C:\WINDOWS\system32\drivers\EagleNT.sys []
S3 gdrv;gdrv; \??\C:\WINDOWS\gdrv.sys []
S3 GMSIPCI;GMSIPCI; \??\F:\INSTALL\GMSIPCI.SYS []
S3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2009-05-07 25280]
S3 Moufiltr;Mouse Test Driver; C:\WINDOWS\system32\DRIVERS\Moufiltr.sys [2005-08-06 9661]
S3 MPE;BDA MPE-Filter; C:\WINDOWS\system32\DRIVERS\MPE.sys [2004-08-03 15360]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink-Konvertierung; C:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-03 5504]
S3 NABTSFEC;NABTS/FEC VBI-Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-03 85376]
S3 NdisIP;Microsoft TV-/Videoverbindung; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-08-03 10880]
S3 nenum13E;nenum13E; \??\C:\DOKUME~1\Ice\LOKALE~1\Temp\nenum13E.sys []
S3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2004-08-03 1897408]
S3 SISNIC;SiS-PCI-Fast Ethernet- Adaptertreiber; C:\WINDOWS\system32\DRIVERS\sisnic.sys [2004-08-03 32768]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-08-03 11136]
S3 streamip;BDA-IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-08-03 15360]
S3 USBSTOR;USB-Massenspeichertreiber; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
S3 WSTCODEC;World Standard Teletext-Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-03 19328]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AntiVirScheduler;Avira AntiVir Personal – Free Antivirus Planer; C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe [2008-03-07 68865]
R2 AntiVirService;Avira AntiVir Personal – Free Antivirus Guard; C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe [2008-03-26 147201]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2009-02-25 602112]
R2 ICQ Service;ICQ Service; C:\Programme\ICQ6Toolbar\ICQ Service.exe [2008-06-10 222456]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2009-02-25 593920]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 WMPNetworkSvc;Windows Media Player-Netzwerkfreigabedienst; C:\Programme\Windows Media Player\WMPNetwk.exe [2006-11-03 920576]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2004-08-04 14336]

-----------------EOF-----------------

Und hier noch der Maleware log
sry noma für meine unwissenheit


Malwarebytes' Anti-Malware 1.40
Datenbank Version: 2657
Windows 5.1.2600 Service Pack 2

19.11.2009 20:11:54
mbam-log-2009-11-19 (20-11-54).txt

Scan-Methode: Vollständiger Scan (C:\|D:\|E:\|)
Durchsuchte Objekte: 166839
Laufzeit: 32 minute(s), 14 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 1
Infizierte Registrierungswerte: 1
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_CLASSES_ROOT\MIME\Database\Content Type\application/x-zix (Trojan.Lop) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{ee91f4cc-6ba2-424c-a1fe-64910ccb6a42} (Trojan.Lop) -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)