Mach bitte einfach das Log mit CF wie in der Anleitung beschrieben

das ist der bericht von combi fix

ComboFix 10-02-12.01 - Cecile 17.02.2010 14:27:24.1.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1015.596 [GMT 1:00]
Running from: c:\documents and settings\Cecile\Desktop\cofifix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {11638345-E4FC-4BEE-BB73-EC754659C5F6}
FW: Avira Firewall *enabled* {11638345-E4FC-4BEE-BB73-EC754659C5F6}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Start Menu\Programs\Startup\Bluetooth.lnk
c:\documents and settings\Cecile\Application Data\SystemProc
c:\recycler\S-1-5-21-1702280784-662691950-4043198955-1003
c:\recycler\S-1-5-21-2684140027-3040661829-210546423-1003
c:\recycler\S-1-5-21-3816753149-1207111628-141548857-1003
c:\recycler\S-1-5-21-57989841-2000478354-1547161642-1003
c:\windows\system32\Thumbs.db
D:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2010-01-17 to 2010-02-17 )))))))))))))))))))))))))))))))
.

2010-02-15 12:07 . 2010-02-15 12:07 -------- d-----w- c:\documents and settings\All Users\Application Data\UAB
2010-02-15 12:07 . 2010-02-15 12:07 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Drivers HeadQuarters
2010-02-15 12:07 . 2010-02-15 12:07 -------- d-----w- c:\documents and settings\Cecile\Local Settings\Application Data\PC_Drivers_Headquarters
2010-02-15 11:51 . 2010-02-15 11:51 -------- d-----w- c:\documents and settings\All Users\Application Data\ParetoLogic
2010-02-15 11:51 . 2010-02-15 11:51 -------- d-----w- c:\program files\Common Files\ParetoLogic
2010-02-15 11:51 . 2010-02-15 11:51 -------- d-----w- c:\documents and settings\All Users\Application Data\FileCure
2010-02-08 14:17 . 2010-02-08 14:27 -------- d-----w- c:\program files\trend micro
2010-02-08 14:17 . 2010-02-08 14:17 -------- d-----w- C:\rsit
2010-02-08 12:46 . 2010-02-08 12:46 -------- d-----w- c:\documents and settings\Cecile\Application Data\Malwarebytes
2010-02-08 12:46 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-08 12:46 . 2010-02-08 12:46 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-02-08 12:46 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-02-08 12:46 . 2010-02-08 12:46 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-02-08 12:19 . 2010-02-08 12:19 -------- d-----w- c:\program files\CCleaner
2010-02-08 01:00 . 2010-02-08 01:00 -------- d-----w- c:\documents and settings\Cecile\Application Data\TeamViewer
2010-02-08 01:00 . 2010-02-08 01:00 -------- d-----w- c:\documents and settings\Cecile\temp
2010-02-07 16:00 . 2010-02-07 15:52 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2010-02-07 16:00 . 2010-02-07 15:52 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2010-02-07 16:00 . 2010-02-07 15:52 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2010-02-07 16:00 . 2010-02-07 15:52 97608 ----a-w- c:\windows\system32\drivers\avfwot.sys
2010-02-07 16:00 . 2010-02-07 15:52 69632 ----a-w- c:\windows\system32\drivers\avfwim.sys
2010-02-07 16:00 . 2010-02-07 16:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2010-02-07 16:00 . 2010-02-07 16:00 -------- d-----w- c:\program files\Avira
2010-02-07 11:38 . 2010-02-15 12:05 -------- d-----w- c:\documents and settings\Cecile\Local Settings\Application Data\WMTools Downloaded Files
2010-02-07 09:18 . 2010-02-07 09:22 -------- d-----w- c:\program files\ICQ6.5
2010-02-03 21:42 . 2010-02-04 10:46 -------- d-----w- c:\documents and settings\Cecile\Application Data\FILEminimizerPictures
2010-02-03 21:42 . 2010-02-03 21:42 -------- d-----w- c:\program files\FILEminimizer Pictures
2010-02-02 11:44 . 2010-02-02 11:44 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2010-01-31 20:28 . 2010-01-31 20:36 -------- d-----w- c:\program files\Common Files\Symantec Shared
2010-01-31 20:22 . 2010-01-31 20:49 -------- d-----w- c:\documents and settings\All Users\Application Data\Norton
2010-01-31 20:22 . 2010-01-31 20:22 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec
2010-01-31 20:22 . 2010-01-31 20:22 -------- d-----w- c:\documents and settings\All Users\Application Data\NortonInstaller
2010-01-31 18:19 . 2010-02-07 09:03 -------- d-----w- c:\windows\system32\Adobe
2010-01-30 08:00 . 2010-01-30 08:00 -------- d-----w- c:\documents and settings\Cecile\Local Settings\Application Data\Unity
2010-01-26 11:18 . 2008-04-13 23:17 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-17 10:15 . 2009-06-30 15:55 -------- d-----w- c:\documents and settings\Cecile\Application Data\StarOffice8
2010-02-16 15:31 . 2009-07-01 19:10 4754 ----a-w- c:\documents and settings\Cecile\Application Data\wklnhst.dat
2010-02-13 05:12 . 2009-07-07 11:29 -------- d-----w- c:\documents and settings\Cecile\Application Data\Skype
2010-02-13 04:13 . 2009-07-07 11:34 -------- d-----w- c:\documents and settings\Cecile\Application Data\skypePM
2010-02-09 13:54 . 2009-07-08 02:07 -------- d-----w- c:\documents and settings\Cecile\Application Data\dvdcss
2010-02-07 15:52 . 2009-08-07 04:49 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2010-02-07 09:38 . 2008-06-24 13:04 -------- d-----w- c:\program files\Common Files\Adobe
2010-02-07 09:32 . 2009-07-07 11:51 -------- d-----w- c:\program files\ICQ6Toolbar
2010-02-07 09:29 . 2009-10-31 05:31 -------- d-----w- c:\program files\QuickTime
2010-02-07 09:21 . 2009-07-07 11:51 -------- d-----w- c:\documents and settings\All Users\Application Data\ICQ
2010-02-04 10:34 . 2009-06-30 15:56 1 ----a-w- c:\documents and settings\Cecile\Application Data\StarOffice8\user\uno_packages\cache\stamp.sys
2010-01-23 03:14 . 2009-11-13 03:52 -------- d-----w- c:\program files\Microsoft Silverlight
2010-01-18 06:30 . 2010-01-18 06:30 348160 ----a-w- c:\windows\system32\msvcr71.dll
2010-01-18 06:30 . 2010-01-18 06:30 499712 ----a-w- c:\windows\system32\msvcp71.dll
2010-01-09 15:03 . 2010-01-08 23:30 -------- d-----w- c:\program files\GameRaving Toolbar
2010-01-08 23:32 . 2010-01-08 23:32 -------- d-----w- c:\program files\BrowserZinc
2010-01-08 23:32 . 2010-01-08 23:32 -------- d-----w- c:\documents and settings\All Users\Application Data\BrowserZinc
2009-12-31 16:50 . 2008-04-25 05:06 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-21 19:14 . 2008-04-25 05:06 916480 ----a-w- c:\windows\system32\wininet.dll
2009-12-16 18:43 . 2008-04-25 05:00 343040 ----a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:08 . 2008-04-25 05:03 33280 ----a-w- c:\windows\system32\csrsrv.dll
2009-12-08 19:26 . 2008-04-25 05:05 2145280 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-12-08 18:43 . 2008-04-14 00:01 2023936 ----a-w- c:\windows\system32\ntkrnlpa.exe
2009-12-04 18:22 . 2008-04-25 05:05 455424 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2009-11-27 17:11 . 2008-04-25 05:05 1291776 ----a-w- c:\windows\system32\quartz.dll
2009-11-27 17:11 . 2008-04-14 05:42 17920 ----a-w- c:\windows\system32\msyuv.dll
2009-11-27 16:07 . 2008-04-25 05:05 28672 ----a-w- c:\windows\system32\msvidc32.dll
2009-11-27 16:07 . 2001-08-17 22:36 8704 ----a-w- c:\windows\system32\tsbyuv.dll
2009-11-27 16:07 . 2008-04-25 05:05 11264 ----a-w- c:\windows\system32\msrle32.dll
2009-11-27 16:07 . 2008-04-25 05:03 84992 ----a-w- c:\windows\system32\avifil32.dll
2009-11-27 16:07 . 2008-04-14 05:41 48128 ----a-w- c:\windows\system32\iyuv_32.dll
2009-11-26 13:01 . 2010-01-08 23:32 58744 ----a-w- c:\documents and settings\All Users\Application Data\BrowserZinc\browserzinc114.exe
2009-11-21 15:51 . 2008-04-25 05:03 471552 ----a-w- c:\windows\AppPatch\aclayers.dll
2008-05-07 08:34 . 2008-06-24 13:21 15523560 ----a-w- c:\program files\U1 Setup.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883840]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232]
"AdobeUpdater"="c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2008-09-26 2356088]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AsusTray"="c:\program files\EeePC\ACPI\AsTray.exe" [2008-06-03 98304]
"AsusACPIServer"="c:\program files\EeePC\ACPI\AsAcpiSvr.exe" [2008-06-03 479232]
"AsusEPCMonitor"="c:\program files\EeePC\ACPI\AsEPCMon.exe" [2008-05-20 94208]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-24 132496]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-12-19 135168]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-12-19 159744]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-12-19 131072]
"RTHDCPL"="RTHDCPL.EXE" [2008-04-28 16861696]
"SoundMan"="SOUNDMAN.EXE" [2006-07-21 86016]
"AlcWzrd"="ALCWZRD.EXE" [2006-05-04 2808832]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-03-28 413696]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-02-07 209153]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"Prnres"="c:\documents and settings\Cecile\Application Data\Adobe\Update\32ret.dat" [2010-02-05 216576]

c:\documents and settings\Cecile\Start Menu\Programs\Startup\
StarOffice 8.lnk - c:\program files\Sun\StarOffice 8\program\quickstart.exe [2007-8-17 122880]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
SuperHybridEngine.lnk - c:\program files\Asus\EeePC\Super Hybrid Engine\SuperHybridEngine.exe [2008-6-24 294912]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-10-15 00:04 39792 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
2009-07-26 15:44 3883840 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 avfwot;avfwot;c:\windows\system32\drivers\avfwot.sys [07.02.2010 17:00 97608]
R2 AntiVirFirewallService;Avira Firewall;c:\program files\Avira\AntiVir Desktop\avfwsvc.exe [07.02.2010 17:00 388865]
R2 AntiVirMailService;Avira AntiVir MailGuard;c:\program files\Avira\AntiVir Desktop\avmailc.exe [07.02.2010 17:00 194817]
R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [07.02.2010 17:00 108289]
R2 AntiVirWebService;Avira AntiVir WebGuard;c:\program files\Avira\AntiVir Desktop\avwebgrd.exe [07.02.2010 17:00 434945]
R2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [07.07.2009 12:51 222456]
R3 avfwim;AvFw Packet Filter Miniport;c:\windows\system32\drivers\avfwim.sys [07.02.2010 17:00 69632]
S3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys --> c:\windows\system32\drivers\massfilter.sys [?]
.
Contents of the 'Scheduled Tasks' folder

2010-02-09 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 13:57]

2010-02-15 c:\windows\Tasks\ParetoLogic Registration3.job
- c:\program files\Common Files\ParetoLogic\UUS3\UUS3.dll [2009-08-04 18:19]

2010-02-15 c:\windows\Tasks\ParetoLogic Update Version3.job
- c:\program files\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe [2009-08-04 18:19]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.theprizeday.com/today.php
uInternet Connection Wizard,ShellNext = hxxp://eeepc.asus.com/global
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send To Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
LSP: c:\program files\Avira\AntiVir Desktop\avsda.dll
FF - ProfilePath - c:\documents and settings\Cecile\Application Data\Mozilla\Firefox\Profiles\ctrmgbq8.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxps://my.screenname.aol.com/_cqr/login/login.psp?sitedomain=sns.webmail.aol.com&lang=de&locale=de&authLev=0&siteState=ver%3a4%7crt%3aSTANDARD%7cat%3aSNS%7cld%3awebmail.aol.com%7crp%3aLite%2 52fToday.aspx%7cuv%3aAOL%7clc%3ade-de%7cmt%3aAOL%7csnt%3aScreenName%7csid%3a0f9c157e-5c54-471d-8b07-7dd6f38e04f5&offerId=webmail-de-de&seamless=novl&xchk=false
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q=
FF - plugin: c:\documents and settings\Cecile\Local Settings\Application Data\Unity\WebPlayer\loader\npUnity3D32.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - ORPHANS REMOVED - - - -

AddRemove-UnityWebPlayer - c:\documents and settings\Cecile\Local Settings\Application Data\Unity\WebPlayer\Uninstall.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-17 14:32
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'lsass.exe'(1156)
c:\program files\Avira\AntiVir Desktop\avsda.dll
.
Completion time: 2010-02-17 14:34:58
ComboFix-quarantined-files.txt 2010-02-17 13:34

Pre-Run: 75.054.710.784 bytes free
Post-Run: 75.023.773.696 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=AlwaysOff

- - End Of File - - E350AA88D4EE61719B49B8C994F73934