Hallo Zusammen!

Ich dürfte einen Virus bzw. Trojaner auf meinem PC haben. Ich habe versucht im abgesicherten Modus mein Avira Antivirus Personal zu starten - Leider bekomme ich beim starten des abgesicherten Modus die selbeFehlermeldung wie im normalen Modus -> Die Anwendung dwwin.exe konnte nicht gestartet werden......
Ich habe dann über den Taskmanager, der sich starten lässt versucht die .exe Datei meines Avira direkt zu starten....
Da bekomm ich aber wieder ne Fehlermeldung das die Datei beschädigt wurde -> " The Application module c:\programme\avira\antivir personaledition classic\avgnt.exe cannot be found or has been modified or destroyed. Please check your Installation!"

Glücklicherweise hat sich mit dem Befehl iexplore.exe ein IE Fenster öffnen lassen und ich hab versucht Avira neu zu installieren. Wenn ich das versuche kommt während der Installation folgende Fehlermeldung:
Die Datei C:\DOKUME~1\veronika\lokale~1\temp\rarsfx0\basic\setup.exe wurde verändert. Setup kann nicht forgesetzt werden

Damit war ich am Ende mit meiner Geduld und meinen Nerven und habe bissi gegoogelt wer mir helfen könnte und bin auf Euer Forum aufmerksam geworden.

Ich habe den CCCleaner einmal durchlaufen lassen, hab mir die Malwarebytes heruntergeladen und gestartet und da wurden nach XX Minuten gleich mal XX infizierte Objekte gefunden. Hab diese alle gelöscht und den Report gezogen:
Hier die Daten des Reports:

Malwarebytes' Anti-Malware 1.40
Datenbank Version: 2551
Windows 5.1.2600 Service Pack 3

09.09.2009 22:50:02
mbam-log-2009-09-09 (22-50-02).txt

Scan-Methode: Vollständiger Scan (C:\|F:\|)
Durchsuchte Objekte: 281936
Laufzeit: 1 hour(s), 5 minute(s), 9 second(s)

Infizierte Speicherprozesse: 1
Infizierte Speichermodule: 2
Infizierte Registrierungsschlüssel: 17
Infizierte Registrierungswerte: 13
Infizierte Dateiobjekte der Registrierung: 3
Infizierte Verzeichnisse: 5
Infizierte Dateien: 46

Infizierte Speicherprozesse:
C:\WINDOWS\system32\reader_s.exe (Trojan.Agent) -> Unloaded process successfully.

Infizierte Speichermodule:
c:\WINDOWS\system32\evdoserver.dll (Backdoor.Bot) -> Delete on reboot.
C:\WINDOWS\system32\msxml71.dll (Trojan.FakeAlert) -> Delete on reboot.

Infizierte Registrierungsschlüssel:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\evdoserver (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\evdoserver (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\evdoserver (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\xml.xml (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{500bca15-57a7-4eaf-8143-8c619470b13d} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{500bca15-57a7-4eaf-8143-8c619470b13d} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{500bca15-57a7-4eaf-8143-8c619470b13d} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\xml.xml.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127ad2-394b-70f5-c650-b97867baa1f7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127ad2-394b-70f5-c650-b97867baa1f7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\protect (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\protect (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\protect (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\AGprotect (Malware.Trace) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reader_s (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\UID (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\BuildW (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\FirstInstallFlag (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\guid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\i (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\mso (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\udso (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\uid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Ulrn (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Update (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\UpdateNew (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\mEv (Malware.Trace) -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Backdoor.Bot) -> Data: c:\windows\system32\twext.exe -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Backdoor.Bot) -> Data: system32\twext.exe -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.Userinit) -> Bad: (C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\twext.exe,) Good: (Userinit.exe) -> Quarantined and deleted successfully.

Infizierte Verzeichnisse:
C:\WINDOWS\system32\twain_32 (Backdoor.Bot) -> Delete on reboot.
C:\Programme\Protection System (Rogue.ProtectionSystem) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\twain_32 (Spyware.Zbot) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\twain_32 (Spyware.Zbot) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\stefan\Anwendungsdaten\twain_32 (Spyware.Zbot) -> Quarantined and deleted successfully.

Infizierte Dateien:
c:\WINDOWS\system32\evdoserver.dll (Backdoor.Bot) -> Delete on reboot.
C:\WINDOWS\system32\msxml71.dll (Trojan.FakeAlert) -> Delete on reboot.
C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Temporary Internet Files\Content.IE5\OD2WPYFS\w[1].bin (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Temporary Internet Files\Content.IE5\OD2WPYFS\w[2].bin (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Temporary Internet Files\Content.IE5\OD2WPYFS\w[3].bin (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Temporary Internet Files\Content.IE5\TPJXSE24\w[1].bin (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Temporary Internet Files\Content.IE5\TPJXSE24\w[2].bin (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Temporary Internet Files\Content.IE5\YTCVN2VT\w[1].bin (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Temporary Internet Files\Content.IE5\YTCVN2VT\w[2].bin (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Temporary Internet Files\Content.IE5\Z8O1LGBC\w[1].bin (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Temporary Internet Files\Content.IE5\Z8O1LGBC\w[2].bin (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Temporary Internet Files\Content.IE5\Z8O1LGBC\w[3].bin (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B2697773-C989-44EF-B498-7C9CA2FB314A}\RP501\A0101934.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B2697773-C989-44EF-B498-7C9CA2FB314A}\RP501\A0101935.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\dvdpaly.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\wiwow64.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\protect.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\VRTC.tmp (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\twain_32\local.ds (Backdoor.Bot) -> Delete on reboot.
C:\WINDOWS\system32\twain_32\user.ds (Backdoor.Bot) -> Delete on reboot.
C:\Programme\Protection System\mal.db (Rogue.ProtectionSystem) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\twain_32\user.ds (Spyware.Zbot) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\twain_32\user.ds (Spyware.Zbot) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\stefan\Anwendungsdaten\twain_32\user.ds (Spyware.Zbot) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\reader_s.exe (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\2.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\3.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\4.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\5.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\6.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\7.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\8.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\9.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\A.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\B.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\C.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\D.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\E.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\F.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\stefan\reader_s.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\FInstall.sys (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\twext.exe (Backdoor.Bot) -> Delete on reboot.
C:\WINDOWS\Tasks\{BB65B0FB-5712-401b-B616-E69AC55E2757}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\wiawow32.sys (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\msxm192z.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\Tasks\{7B02EF0B-A410-4938-8480-9BA26420A627}.job (Trojan.Downloader) -> Quarantined and deleted successfully.


......

Danach hab ich dann noch das Random System gestartet und folgenden LogFile Erhalten:

[I] Logfile of random's system information tool 1.06 (written by random/random)
Run by veronika at 2009-09-09 22:51:32
Microsoft Windows XP Professional Service Pack 3
System drive C: has 10 GB (25%) free of 40 GB
Total RAM: 2047 MB (64% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:51:38, on 09.09.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16876)
Boot mode: Normal

Running processes:
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\Java\jre6\bin\jqs.exe
C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\sofatnet.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\15.tmp
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Internet Explorer\IEXPLORE.EXE
C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Programme\Trend Micro\HijackThis\HijackThis.exe
C:\Programme\Malwarebytes' Anti-Malware\mbam.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\wiwow64.exe
C:\RSIT.exe
C:\Programme\Trend Micro\HijackThis\veronika.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.at/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\twext.exe,
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Programme\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Programme\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [Regedit32] C:\WINDOWS\system32\regedit.exe
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKLM\..\RunOnce: [ Malwarebytes Anti-Malware (reboot)] "C:\Programme\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [reader_s] C:\WINDOWS\system32\config\systemprofile\reader_s.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [reader_s] C:\WINDOWS\system32\config\systemprofile\reader_s.exe (User 'Default user')
O4 - Startup: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk = C:\Programme\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Startup: Picture Motion Browser Medien-Prüfung.lnk = C:\Programme\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O4 - Global Startup: Giganews Accelerator.lnk = C:\Programme\Giganews Accelerator\GiganewsAccelerator.exe
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www3.snapfish.at/SnapfishActivia.cab
O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://picasaweb.google.com/s/v/36.24/uploader2.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1171393639500
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IPSUploader Control) - http://asp08.photoprintit.de/microsite/2976/defaults/activex/IPSUploader.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Programme\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O23 - Service: AntiVirScheduler - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ASP.NET-Zustandsdienst (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
O23 - Service: Bonjour Service - Unknown owner - C:\Programme\Bonjour\mDNSResponder.exe (file missing)
O23 - Service: clr_optimization_v2.0.50727_32 - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
O23 - Service: Windows Presentation Foundation Font Cache 3.0.0.0 (FontCache3.0.0.0) - Unknown owner - c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
O23 - Service: gusvc - Google - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: IDriverT - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: ImapiService - Unknown owner - C:\WINDOWS\System32\imapi.exe
O23 - Service: InCDsrv - Unknown owner - C:\Programme\Ahead\InCD\InCDsrv.exe (file missing)
O23 - Service: iPod Service - Unknown owner - C:\Programme\iPod\bin\iPodService.exe (file missing)
O23 - Service: JavaQuickStarterService - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService - Hewlett-Packard Company - C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
O23 - Service: mnmsrvc - Unknown owner - C:\WINDOWS\System32\mnmsrvc.exe
O23 - Service: Distributed Transaction Coordinator (MSDTC) - Unknown owner - C:\WINDOWS\System32\msdtc.exe
O23 - Service: Netlogon - Unknown owner - C:\WINDOWS\TEMP\VRT13.tmp
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: sofatnet Service (sofatnet) - Sigma Designs In - C:\WINDOWS\system32\sofatnet.exe

--
End of file - 9696 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\Microsoft_Hardware_Launch_IPoint_exe.job
C:\WINDOWS\tasks\Microsoft_Hardware_Launch_IType_exe.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{22BF413B-C6D2-4d91-82A9-A0F997BA588C}]
Skype add-on (mastermind) - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL [2007-03-30 722472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll [2007-08-24 2212224]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Programme\Google\Google Toolbar\GoogleToolbar.dll [2009-06-14 259696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Programme\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll [2009-06-19 669168]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C84D72FE-E17D-4195-BB24-76C02E2E7C4E}]
Google Dictionary Compression sdch - C:\Programme\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll [2009-04-30 470512]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Programme\Java\jre6\bin\jp2ssv.dll [2009-07-25 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-07-25 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Programme\Google\Google Toolbar\GoogleToolbar.dll [2009-06-14 259696]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Regedit32"=C:\WINDOWS\system32\regedit.exe []

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
""= []
"Malwarebytes' Anti-Malware"=C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe [2009-08-03 419088]
" Malwarebytes Anti-Malware (reboot)"=C:\Programme\Malwarebytes' Anti-Malware\mbam.exe [2009-08-03 1295632]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 35840]
"swg"=C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2007-06-21 68856]

C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart
Giganews Accelerator.lnk - C:\Programme\Giganews Accelerator\GiganewsAccelerator.exe

C:\Dokumente und Einstellungen\veronika\Startmenü\Programme\Autostart
OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - C:\Programme\Microsoft Office\Office12\ONENOTEM.EXE
Picture Motion Browser Medien-Prüfung.lnk - C:\Programme\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2007-04-10 236928]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll [2007-08-24 2212224]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\vsmon]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Programme\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Programme\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Programme\Microsoft Office\Office12\GROOVE.EXE"="C:\Programme\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\Programme\Microsoft Office\Office12\ONENOTE.EXE"="C:\Programme\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"F:\Spiele\Warhammer\Warhammer.exe"="F:\Spiele\Warhammer\Warhammer.exe:*:Enabled:Warhammer®: Mark of Chaos™"
"C:\Dokumente und Einstellungen\stefan\Lokale Einstellungen\Temp\Warhammer Mark of Chaos Patcher\Updater.exe"="C:\Dokumente und Einstellungen\stefan\Lokale Einstellungen\Temp\Warhammer Mark of Chaos Patcher\Updater.exe:*:Enabled:Updater"
"C:\WINDOWS\system32\ZoneLabs\vsmon.exe"="C:\WINDOWS\system32\ZoneLabs\vsmon.exe:*:Enabled:TrueVector Service"
"C:\Programme\ICQLite\ICQLite.exe"="C:\Programme\ICQLite\ICQLite.exe:*:Enabled:ICQ Lite"
"C:\Programme\BitTorrent_DNA\dna.exe"="C:\Programme\BitTorrent_DNA\dna.exe:*:Enabled:BitTorrent DNA"
"F:\BitTorrent\bittorrent.exe"="F:\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent"
"F:\Spiele\World in Conflicts\wic.exe"="F:\Spiele\World in Conflicts\wic.exe:*:Enabled:WORLD IN CONFLICT"
"F:\Spiele\World in Conflicts\wic_online.exe"="F:\Spiele\World in Conflicts\wic_online.exe:*:Enabled:WORLD IN CONFLICT - Nur Online"
"F:\Spiele\World in Conflicts\wic_ds.exe"="F:\Spiele\World in Conflicts\wic_ds.exe:*:Enabled:WORLD IN CONFLICT - Dedizierter Server"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Programme\DNA\btdna.exe"="C:\Programme\DNA\btdna.exe:*:EnabledNA"
"C:\Programme\Skype\Phone\Skype.exe"="C:\Programme\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\Programme\Firaxis Games\Sid Meier's Civilization 4\Civilization4.exe"="C:\Programme\Firaxis Games\Sid Meier's Civilization 4\Civilization4.exe:*:Enabled:Sid Meier's Civilization 4"
"C:\Programme\TwonkyMedia\twonkymediaserver.exe"="C:\Programme\TwonkyMedia\twonkymediaserver.exe:*:Enabled:TwonkyMediaServer"
"C:\Programme\TwonkyMedia\twonkymedia.exe"="C:\Programme\TwonkyMedia\twonkymedia.exe:*:Enabled:TwonkyMedia"
"C:\Programme\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe"="C:\Programme\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe:*:Enabled:Logitech Harmony Remote Software 7"
"C:\Programme\Bonjour\mDNSResponder.exe"="C:\Programme\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Programme\iTunes\iTunes.exe"="C:\Programme\iTunes\iTunes.exe:*:Enabled:iTunes"
"F:\Spiele\Blood Bowl\BB.exe"="F:\Spiele\Blood Bowl\BB.exe:*:Enabled:Blood Bowl"
"F:\Spiele\Blood Bowl\Autorun\Exe\Autorun.exe"="F:\Spiele\Blood Bowl\Autorun\Exe\Autorun.exe:*:Enabled:Blood Bowl - AutoRun"
"C:\WINDOWS\system32\services.exe"="C:\WINDOWS\system32\services.exe:*:enabled:@shell32.dll,-1"
"C:\WINDOWS\Temp\VRT9.tmp"="C:\WINDOWS\Temp\VRT9.tmp:*:Enabled:installer"
"\??\C:\WINDOWS\system32\winlogon.exe"="\??\C:\WINDOWS\system32\winlogon.exe:*:enabled:@shell32.dll,-1"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Programme\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe"="C:\Programme\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe:*:Enabled:Logitech Harmony Remote Software 7"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{85731937-bb92-11db-b9d7-806d6172696f}]
shell\PlayWithPowerDVD\command - "C:\Programme\CyberLink DVD Solution\PowerDVD\PowerDVD.exe" "%l"


======List of files/folders created in the last 1 months======

2009-09-09 22:50:37 ----A---- C:\WINDOWS\gvgql.txt
2009-09-09 21:48:28 ----D---- C:\rsit
2009-09-09 21:48:18 ----A---- C:\RSIT.exe
2009-09-09 21:43:41 ----D---- C:\Dokumente und Einstellungen\veronika\Anwendungsdaten\Malwarebytes
2009-09-09 21:43:37 ----D---- C:\Programme\Malwarebytes' Anti-Malware
2009-09-09 21:43:37 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
2009-09-09 21:43:20 ----A---- C:\mbam-setup.exe
2009-09-09 21:39:52 ----D---- C:\Programme\CCleaner
2009-09-09 21:39:18 ----A---- C:\ccsetup223.exe
2009-09-09 21:27:44 ----D---- C:\Programme\Trend Micro
2009-09-09 21:21:19 ----A---- C:\avira.exe
2009-09-09 21:16:29 ----A---- C:\WINDOWS\system32\15.tmp
2009-09-09 21:16:27 ----A---- C:\WINDOWS\system32\14.tmp
2009-09-09 21:16:25 ----A---- C:\WINDOWS\system32\13.tmp
2009-09-09 20:56:59 ----A---- C:\WINDOWS\system32\12.tmp
2009-09-09 20:56:58 ----A---- C:\WINDOWS\system32\11.tmp
2009-09-09 20:25:21 ----D---- C:\WINDOWS\pss
2009-09-09 18:40:30 ----N---- C:\WINDOWS\system32\msxml71.dll
2009-09-09 08:08:58 ----HDC---- C:\WINDOWS\$NtUninstallKB968816_WM9$
2009-09-09 08:08:55 ----HDC---- C:\WINDOWS\$NtUninstallKB956844$
2009-09-09 08:08:26 ----HDC---- C:\WINDOWS\$NtUninstallKB971961$
2009-08-27 21:01:52 ----HDC---- C:\WINDOWS\$NtUninstallKB970653-v3$
2009-08-22 03:01:12 ----HDC---- C:\WINDOWS\$NtUninstallKB951978$
2009-08-22 03:01:06 ----HDC---- C:\WINDOWS\$NtUninstallKB956744$
2009-08-22 03:00:59 ----HDC---- C:\WINDOWS\$NtUninstallKB973540_WM9$
2009-08-22 03:00:55 ----HDC---- C:\WINDOWS\$NtUninstallKB954459$
2009-08-21 17:11:41 ----A---- C:\WINDOWS\system32\javaws.exe
2009-08-21 17:11:41 ----A---- C:\WINDOWS\system32\javaw.exe
2009-08-21 17:11:41 ----A---- C:\WINDOWS\system32\java.exe
2009-08-21 03:00:59 ----HDC---- C:\WINDOWS\$NtUninstallKB938464-v2$
2009-08-21 03:00:52 ----HDC---- C:\WINDOWS\$NtUninstallKB968389$
2009-08-20 21:06:00 ----D---- C:\WINDOWS\Prefetch
2009-08-20 20:12:03 ----HDC---- C:\WINDOWS\$NtUninstallKB973869$
2009-08-20 20:11:57 ----HDC---- C:\WINDOWS\$NtUninstallKB973815$
2009-08-20 20:11:50 ----HDC---- C:\WINDOWS\$NtUninstallKB973507$
2009-08-20 20:11:44 ----HDC---- C:\WINDOWS\$NtUninstallKB973354$
2009-08-20 20:11:35 ----HDC---- C:\WINDOWS\$NtUninstallKB971657$
2009-08-20 20:11:28 ----HDC---- C:\WINDOWS\$NtUninstallKB971633$
2009-08-20 20:11:21 ----HDC---- C:\WINDOWS\$NtUninstallKB971557$
2009-08-20 20:11:14 ----HDC---- C:\WINDOWS\$NtUninstallKB970238$
2009-08-20 20:11:04 ----HDC---- C:\WINDOWS\$NtUninstallKB968537$
2009-08-20 20:10:48 ----HDC---- C:\WINDOWS\$NtUninstallKB967715$
2009-08-20 20:10:35 ----HDC---- C:\WINDOWS\$NtUninstallKB961501$
2009-08-20 20:10:30 ----HDC---- C:\WINDOWS\$NtUninstallKB961373$
2009-08-20 20:10:22 ----HDC---- C:\WINDOWS\$NtUninstallKB961371$
2009-08-20 20:10:07 ----HDC---- C:\WINDOWS\$NtUninstallKB961118$
2009-08-20 20:09:59 ----HDC---- C:\WINDOWS\$NtUninstallKB960859$
2009-08-20 20:09:51 ----HDC---- C:\WINDOWS\$NtUninstallKB960803$
2009-08-20 20:09:43 ----HDC---- C:\WINDOWS\$NtUninstallKB960225$
2009-08-20 20:09:38 ----HDC---- C:\WINDOWS\$NtUninstallKB959426$
2009-08-20 20:09:31 ----HDC---- C:\WINDOWS\$NtUninstallKB958690$
2009-08-20 20:09:24 ----HDC---- C:\WINDOWS\$NtUninstallKB958687$
2009-08-20 20:09:17 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$
2009-08-20 20:09:10 ----HDC---- C:\WINDOWS\$NtUninstallKB957097$
2009-08-20 20:09:04 ----HDC---- C:\WINDOWS\$NtUninstallKB957095$
2009-08-20 20:08:59 ----HDC---- C:\WINDOWS\$NtUninstallKB956841$
2009-08-20 20:08:44 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$
2009-08-20 20:08:36 ----HDC---- C:\WINDOWS\$NtUninstallKB956802$
2009-08-20 20:08:27 ----HDC---- C:\WINDOWS\$NtUninstallKB956572$
2009-08-20 20:08:14 ----HDC---- C:\WINDOWS\$NtUninstallKB955069$
2009-08-20 20:08:06 ----HDC---- C:\WINDOWS\$NtUninstallKB954600$
2009-08-20 20:07:56 ----HDC---- C:\WINDOWS\$NtUninstallKB954211$
2009-08-20 20:07:46 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$
2009-08-20 20:07:40 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$
2009-08-20 20:07:32 ----HDC---- C:\WINDOWS\$NtUninstallKB952004$
2009-08-20 20:07:26 ----HDC---- C:\WINDOWS\$NtUninstallKB951748$
2009-08-20 20:07:19 ----HDC---- C:\WINDOWS\$NtUninstallKB951698$
2009-08-20 20:07:13 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$
2009-08-20 20:07:07 ----HDC---- C:\WINDOWS\$NtUninstallKB951376$
2009-08-20 20:06:57 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$
2009-08-20 20:06:50 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$
2009-08-20 20:06:43 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$
2009-08-20 20:06:35 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$
2009-08-20 20:06:30 ----HDC---- C:\WINDOWS\$NtUninstallKB938464$
2009-08-20 20:06:21 ----HDC---- C:\WINDOWS\$NtUninstallKB923561$
2009-08-20 19:59:03 ----D---- C:\WINDOWS\system32\de
2009-08-20 19:59:03 ----D---- C:\WINDOWS\l2schemas
2009-08-12 21:57:25 ----HDC---- C:\WINDOWS\$NtUninstallKB960859_0$
2009-08-12 21:57:07 ----HDC---- C:\WINDOWS\$NtUninstallKB971657_0$
2009-08-12 21:56:50 ----HDC---- C:\WINDOWS\$NtUninstallKB971557_0$
2009-08-12 21:56:32 ----HDC---- C:\WINDOWS\$NtUninstallKB973869_0$
2009-08-12 21:56:19 ----A---- C:\WINDOWS\system32\wmpns.dll
2009-08-12 21:56:01 ----HDC---- C:\WINDOWS\$NtUninstallKB973540_WM9L$
2009-08-12 21:55:07 ----HDC---- C:\WINDOWS\$NtUninstallKB973507_0$
2009-08-12 21:54:52 ----HDC---- C:\WINDOWS\$NtUninstallKB973354_0$
2009-08-12 21:53:00 ----HDC---- C:\WINDOWS\$NtUninstallKB958470$
2009-08-12 21:52:28 ----HDC---- C:\WINDOWS\$NtUninstallKB973815_0$
2009-08-12 21:52:05 ----HDC---- C:\WINDOWS\$NtUninstallKB971032$

======List of files/folders modified in the last 1 months======

2009-09-09 22:51:06 ----D---- C:\WINDOWS\system32
2009-09-09 22:50:37 ----D---- C:\WINDOWS
2009-09-09 22:50:02 ----SD---- C:\WINDOWS\Tasks
2009-09-09 22:50:02 ----RD---- C:\Programme
2009-09-09 22:46:28 ----SHD---- C:\WINDOWS\system32\twain_32
2009-09-09 22:19:23 ----SHD---- C:\WINDOWS\Installer
2009-09-09 22:19:18 ----D---- C:\WINDOWS\WinSxS
2009-09-09 21:48:29 ----D---- C:\WINDOWS\Temp
2009-09-09 21:43:38 ----D---- C:\WINDOWS\system32\drivers
2009-09-09 21:40:47 ----D---- C:\WINDOWS\Minidump
2009-09-09 21:40:47 ----D---- C:\WINDOWS\Debug
2009-09-09 21:04:08 ----N---- C:\WINDOWS\SchedLgU.Txt
2009-09-09 20:15:43 ----D---- C:\Dokumente und Einstellungen
2009-09-09 19:25:56 ----D---- C:\WINDOWS\system32\ZoneLabs
2009-09-09 19:22:42 ----D---- C:\WINDOWS\Internet Logs
2009-09-09 19:18:26 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-09-09 19:15:21 ----D---- C:\Programme\lg_fwupdate
2009-09-09 19:15:19 ----A---- C:\WINDOWS\lgfwup.ini
2009-09-09 19:14:51 ----D---- C:\Programme\WinRAR
2009-09-09 19:14:51 ----D---- C:\Programme\ratDVD
2009-09-09 19:14:51 ----D---- C:\Programme\HOTALBUMMyBOX
2009-09-09 19:14:51 ----D---- C:\Programme\Bonjour
2009-09-09 19:04:52 ----A---- C:\WINDOWS\system32\netdde.exe
2009-09-09 19:03:49 ----A---- C:\WINDOWS\system32\msdtc.exe
2009-09-09 19:03:18 ----A---- C:\WINDOWS\system32\mnmsrvc.exe
2009-09-09 18:57:08 ----A---- C:\WINDOWS\system32\imapi.exe
2009-09-09 18:46:01 ----A---- C:\WINDOWS\system32\clipsrv.exe
2009-09-09 18:43:57 ----D---- C:\Programme\Windows Media Player
2009-09-09 18:40:12 ----D---- C:\WINDOWS\system32\CatRoot2
2009-09-09 08:09:00 ----HD---- C:\WINDOWS\inf
2009-09-09 08:08:54 ----HD---- C:\WINDOWS\$hf_mig$
2009-09-09 08:08:53 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft Help
2009-09-08 21:12:53 ----A---- C:\WINDOWS\NeroDigital.ini
2009-09-02 17:44:32 ----D---- C:\WINDOWS\Microsoft.NET
2009-08-28 23:38:20 ----A---- C:\WINDOWS\system32\MRT.exe
2009-08-22 03:02:15 ----D---- C:\WINDOWS\system32\CatRoot
2009-08-21 17:11:37 ----D---- C:\Programme\Java
2009-08-21 17:11:17 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-08-20 21:05:14 ----D---- C:\WINDOWS\system32\Setup
2009-08-20 21:05:14 ----D---- C:\WINDOWS\AppPatch
2009-08-20 21:05:13 ----D---- C:\WINDOWS\system32\wbem
2009-08-20 21:05:12 ----RSD---- C:\WINDOWS\Fonts
2009-08-20 21:04:31 ----D---- C:\WINDOWS\security
2009-08-20 20:11:46 ----D---- C:\Programme\Outlook Express
2009-08-20 20:06:37 ----D---- C:\Programme\Messenger
2009-08-20 19:59:23 ----D---- C:\WINDOWS\Help
2009-08-20 19:59:16 ----D---- C:\WINDOWS\ehome
2009-08-20 19:59:15 ----D---- C:\WINDOWS\system32\inetsrv
2009-08-20 19:59:15 ----D---- C:\WINDOWS\network diagnostic
2009-08-20 19:59:15 ----D---- C:\WINDOWS\ime
2009-08-20 19:59:04 ----D---- C:\WINDOWS\system32\usmt
2009-08-20 19:59:04 ----D---- C:\WINDOWS\system32\de-de
2009-08-20 19:59:02 ----D---- C:\WINDOWS\system32\bits
2009-08-20 19:59:02 ----D---- C:\WINDOWS\peernet
2009-08-20 19:59:02 ----D---- C:\Programme\Movie Maker
2009-08-20 19:56:45 ----D---- C:\WINDOWS\system32\Restore
2009-08-20 19:56:45 ----D---- C:\WINDOWS\system32\npp
2009-08-20 19:56:44 ----D---- C:\WINDOWS\msagent
2009-08-20 19:56:43 ----D---- C:\WINDOWS\srchasst
2009-08-20 19:56:42 ----D---- C:\Programme\NetMeeting
2009-08-20 19:56:40 ----D---- C:\WINDOWS\system32\Com
2009-08-20 19:56:38 ----D---- C:\Programme\Windows NT
2009-08-20 19:56:34 ----D---- C:\Programme\Gemeinsame Dateien\System
2009-08-20 19:56:20 ----D---- C:\WINDOWS\system32\oobe
2009-08-20 19:56:17 ----D---- C:\WINDOWS\system
2009-08-20 19:53:22 ----D---- C:\WINDOWS\system32\ReinstallBackups
2009-08-20 19:53:15 ----HDC---- C:\WINDOWS\$NtServicePackUninstall$
2009-08-13 17:15:57 ----A---- C:\WINDOWS\system32\jscript.dll
2009-08-12 21:53:01 ----D---- C:\WINDOWS\ServicePackFiles
2009-08-11 20:41:10 ----RSD---- C:\WINDOWS\assembly

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 avgio;avgio; \??\C:\Programme\Avira\AntiVir PersonalEdition Classic\avgio.sys []
R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2009-06-07 75096]
R1 InCDPass;InCDPass; C:\WINDOWS\System32\DRIVERS\InCDPass.sys [2005-07-08 29696]
R1 incdrm;InCD Reader; C:\WINDOWS\system32\drivers\incdrm.sys [2006-11-02 28672]
R1 intelppm;Intel-Prozessortreiber; C:\WINDOWS\System32\DRIVERS\intelppm.sys [2008-04-14 40448]
R1 kbdhid;Tastatur-HID-Treiber; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14720]
R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2007-11-08 21248]
R2 atksgt;atksgt; C:\WINDOWS\system32\DRIVERS\atksgt.sys [2008-03-10 278728]
R2 EIO;EIO; \??\C:\WINDOWS\system32\drivers\EIO.sys []
R2 ElbyCDIO;ElbyCDIO Driver; C:\WINDOWS\System32\Drivers\ElbyCDIO.sys [2007-02-16 15440]
R2 irda;IrDA-Protokoll; C:\WINDOWS\System32\DRIVERS\irda.sys [2008-04-13 88192]
R2 lirsgt;lirsgt; C:\WINDOWS\system32\DRIVERS\lirsgt.sys [2008-03-10 25416]
R3 AnyDVD;AnyDVD; C:\WINDOWS\System32\Drivers\AnyDVD.sys [2007-02-19 68936]
R3 ElbyDelay;ElbyDelay; C:\WINDOWS\System32\Drivers\ElbyDelay.sys [2006-12-14 11984]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2009-03-19 23400]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\System32\DRIVERS\HDAudBus.sys [2005-01-07 138752]
R3 hidusb;Microsoft HID Class-Treiber; C:\WINDOWS\System32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2006-06-28 4304384]
R3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\WINDOWS\system32\drivers\mbamswissarmy.sys []
R3 mouhid;Maus-HID-Treiber; C:\WINDOWS\System32\DRIVERS\mouhid.sys [2001-08-18 12288]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2007-09-17 6853088]
R3 Point32;Microsoft IntelliPoint Filter Driver; C:\WINDOWS\system32\DRIVERS\point32.sys [2007-08-21 21760]
R3 Rasirda;WAN-Miniport (IrDA); C:\WINDOWS\System32\DRIVERS\rasirda.sys [2001-08-17 19584]
R3 RTL8023xp;Realtek 10/100/1000 NIC Family all in one NDIS XP Driver; C:\WINDOWS\System32\DRIVERS\Rtenicxp.sys [2005-11-16 78976]
R3 usbccgp;Microsoft Standard-USB-Haupttreiber; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbehci;Miniporttreiber für erweiterten Microsoft USB 2.0-Hostcontroller; C:\WINDOWS\System32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;USB2-aktivierter Hub; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbuhci;Miniporttreiber für universellen Microsoft USB-Hostcontroller; C:\WINDOWS\System32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R4 InCDfs;InCD File System; C:\WINDOWS\system32\drivers\InCDfs.sys [2005-07-08 99584]
S3 avgntflt;avgntflt; \??\C:\Programme\Avira\AntiVir PersonalEdition Classic\avgntflt.sys []
S3 irsir;Microsoft serieller Infrarottreiber; C:\WINDOWS\System32\DRIVERS\irsir.sys [2001-08-17 18688]
S3 jswmidin;jswmidin; \??\C:\DOKUME~1\stefan\LOKALE~1\Temp\jswmidin.sys []
S3 RemoteControl-USBLAN;RemoteControl-USBLAN; C:\WINDOWS\system32\DRIVERS\rcblan.sys [2007-01-24 39704]
S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2008-07-10 32000]
S3 usbaudio;USB-Audiotreiber (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-13 60032]
S3 usbprint;Microsoft USB-Druckerklasse; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;USB-Scannertreiber; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;USB-Massenspeichertreiber; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AntiVirScheduler;AntiVirScheduler; C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe [2008-10-24 89088]
R2 Apple Mobile Device;Apple Mobile Device; C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-06-05 144712]
R2 Irmon;Irmon; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
R2 JavaQuickStarterService;JavaQuickStarterService; C:\Programme\Java\jre6\bin\jqs.exe [2009-07-25 153376]
R2 LightScribeService;LightScribeService; C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe [2006-10-19 81920]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2007-09-17 176128]
R2 sofatnet;sofatnet Service; C:\WINDOWS\system32\sofatnet.exe [2001-08-18 113664]
S2 Bonjour Service;Bonjour Service; C:\Programme\Bonjour\mDNSResponder.exe []
S2 InCDsrv;InCDsrv; C:\Programme\Ahead\InCD\InCDsrv.exe []
S3 aspnet_state;ASP.NET-Zustandsdienst; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2009-09-09 215309]
S3 clr_optimization_v2.0.50727_32;clr_optimization_v2.0.50727_32; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2009-09-09 215309]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2009-09-09 215309]
S3 gusvc;gusvc; C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-04-30 182768]
S3 IDriverT;IDriverT; C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 90112]
S3 idsvc;idsvc; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 iPod Service;iPod Service; C:\Programme\iPod\bin\iPodService.exe []
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Programme\Microsoft Office\Office12\GrooveAuditService.exe [2007-08-24 68464]
S3 odserv;Microsoft Office Diagnostics Service; C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE [2007-08-24 443776]
S3 ose;Office Source Engine; C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S4 AntiVirService;AntiVirService; C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe [2008-10-24 171520]
S4 NetTcpPortSharing;Net.Tcp-Portfreigabedienst; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------
[/I]



Sodala.... Ich hoffe ich hab alles richtig gemacht und jemand von Euch kann mir helfen
Danke im Voraus für alle Tipps!

Liebe Grüße
Stefan

Hallo Stefan



Habe mir gerade mal das HJT Log angesehen. Lade bitte einmal folgende Dateien bei VirusTotal - Kostenloser online Viren- und Malwarescanner hoch:

C:\WINDOWS\system32\sofatnet.exe
C:\WINDOWS\system32\15.tmp
C:\WINDOWS\system32\wiwow64.exe
         

Poste anschließend bitte das Ergebnis. Starte auch HJT noch einmal und fixe erst einmal folgende Einträge:

O4 - HKUS\S-1-5-18\..\Run: [reader_s] C:\WINDOWS\system32\config\systemprofile\reader_s. exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [reader_s] C:\WINDOWS\system32\config\systemprofile\reader_s. exe (User 'Default user')
         

Gruß

Acid

Hallo,
Lade bitte auch diese Datei bei Virustotal hoch:

C:\WINDOWS\TEMP\VRT13.tmp
         

Ich wusste doch daß ich eine vergessen hatte. Danke Angelsboy.

Gruß

Acid

Hallo und danke für die Tipps!
Bin jetzt im Büro und werd die Anweisungen am Abend dann mal ausführen!
Liebe Grüße
Stefan