Trojaner-Board - Trojaner "TR/Crypt.XPACK.Gen" ,Log zur Auswertung

Ich habe ein Problem mit den Trojaner " TR/Crypt.XPACK.Gen "
habe meinen Log unten stehen:

ComboFix 08-05-19.4 - Heiko 2008-05-20 21:28:57.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1031.18.611 [GMT 2:00]
ausgeführt von:: C:\Dokumente und Einstellungen\Heiko\Eigene Dateien\ComboFix.exe
* Neuer Wiederherstellungspunkt wurde erstellt

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

(((((((((((((((((((((((((((((((((((( Weitere L”schungen ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Programme\AntiSpywareMaster
C:\Temp\1cb
C:\Temp\1cb\syscheck.log
C:\WINDOWS\cookies.ini
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\MlmSttwa.ini
C:\WINDOWS\system32\MlmSttwa.ini2
C:\WINDOWS\system32\MSINET.oca
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\system32\sgsnoxjn.ini
C:\WINDOWS\system32\umueqxjj.ini

.
((((((((((((((((((((((( Dateien erstellt von 2008-04-20 bis 2008-05-20 ))))))))))))))))))))))))))))))
.

2008-05-19 19:42 . 2008-05-19 19:42 <DIR> d-------- C:\Dokumente und Einstellungen\Heiko\Anwendungsdaten\Apple Computer
2008-05-19 19:36 . 2008-05-19 19:39 <DIR> d-------- C:\Programme\QuickTime
2008-05-19 19:35 . 2008-05-19 19:35 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Apple Computer
2008-05-19 19:34 . 2008-05-19 19:34 <DIR> d-------- C:\Programme\Apple Software Update
2008-05-19 19:34 . 2008-05-19 19:34 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Apple
2008-05-19 19:25 . 2008-05-19 19:25 <DIR> d-------- C:\Programme\Gemeinsame Dateien\xing shared
2008-05-19 18:53 . 2008-05-19 18:53 <DIR> d-------- C:\Programme\Avira
2008-05-19 18:53 . 2008-05-19 18:53 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Avira
2008-05-19 17:58 . 2008-05-19 17:58 <DIR> d-------- C:\Programme\Pop up Blocker
2008-05-19 17:34 . 2008-05-19 17:34 109,807 --a------ C:\WINDOWS\BM53cb9016.xml
2008-05-18 17:13 . 2008-05-18 17:13 <DIR> d-------- C:\Dokumente und Einstellungen\Heiko\Anwendungsdaten\Yahoo!
2008-05-18 17:13 . 2008-05-18 17:13 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Yahoo! Companion
2008-05-18 17:09 . 2008-05-18 17:09 <DIR> d-------- C:\Programme\Yahoo!
2008-05-18 17:09 . 2008-05-18 17:09 <DIR> d-------- C:\Programme\FLV Player
2008-05-18 17:09 . 2008-05-18 17:09 1,024 --ah----- C:\Dokumente und Einstellungen\Default User\NTUSER.DAT.LOG
2008-05-18 16:29 . 2008-05-18 16:29 <DIR> d-------- C:\WINDOWS\system32\rDA
2008-05-18 16:29 . 2008-05-18 16:29 <DIR> d-------- C:\WINDOWS\system32\logXv01
2008-05-18 16:29 . 2008-05-18 16:29 <DIR> d-------- C:\WINDOWS\system32\emL1
2008-05-18 16:29 . 2008-05-18 16:29 <DIR> d-------- C:\WINDOWS\system32\3056v
2008-05-18 16:29 . 2008-05-18 16:29 <DIR> d-------- C:\Temp\dmpxp32
2008-05-18 16:29 . 2008-05-20 21:29 <DIR> d-------- C:\Temp
2008-05-18 16:29 . 2008-05-18 16:29 <DIR> d-------- C:\Programme\winvi
2008-05-18 16:29 . 2008-05-18 16:29 371,553 --a------ C:\Temp\nEzts0230.exe
2008-05-18 16:29 . 2008-05-18 16:29 52,736 --a------ C:\WINDOWS\system32\hgGaaaYP.dll
2008-05-17 14:31 . 2008-05-17 14:31 <DIR> d-------- C:\Programme\GTA San Andreas
2008-05-17 14:22 . 2008-05-17 14:22 717,296 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-05-17 14:21 . 2008-05-17 14:21 <DIR> d-------- C:\Dokumente und Einstellungen\Heiko\Anwendungsdaten\DAEMON Tools
2008-05-07 21:21 . 2008-05-20 15:15 <DIR> d-------- C:\Dokumente und Einstellungen\Heiko\Anwendungsdaten\OpenOffice.org2
2008-05-07 21:15 . 2008-05-07 21:15 <DIR> d-------- C:\Programme\OpenOffice.org 2.4
2008-05-06 12:35 . 2004-05-14 16:53 462,848 --a------ C:\WINDOWS\system32\ltkrn13n.dll
2008-05-06 12:35 . 2004-05-14 16:53 450,560 --a------ C:\WINDOWS\system32\ltimg13n.dll
2008-05-06 12:35 . 2004-05-14 16:53 401,408 --a------ C:\WINDOWS\system32\lfcmp13n.dll
2008-05-06 12:35 . 2004-05-14 16:53 299,008 --a------ C:\WINDOWS\system32\ltdis13n.dll
2008-05-06 12:35 . 2004-01-12 02:09 206,336 --a------ C:\WINDOWS\system32\ltefx13n.dll
2008-05-06 12:35 . 2004-05-14 16:53 163,840 --a------ C:\WINDOWS\system32\ltfil13n.dll
2008-05-06 12:35 . 2003-11-04 15:10 69,632 --a------ C:\WINDOWS\system32\lfgif13n.dll
2008-05-06 12:35 . 2004-05-14 16:53 57,344 --a------ C:\WINDOWS\system32\lfbmp13n.dll
2008-05-05 21:43 . 2008-05-05 21:43 <DIR> d-------- C:\Programme\BitTorrent
2008-05-05 21:43 . 2008-05-19 19:21 <DIR> d-------- C:\Program Files
2008-05-05 21:43 . 2008-05-18 20:58 <DIR> d-------- C:\Dokumente und Einstellungen\Heiko\Anwendungsdaten\BitTorrent
2008-05-02 14:13 . 2008-05-20 19:58 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Google Updater
2008-05-01 20:40 . 2007-12-10 14:24 159,458 --a------ C:\WINDOWS\system32\nvapps.nvb
2008-05-01 20:39 . 2008-05-01 20:39 <DIR> d-------- C:\NVIDIA
2008-05-01 20:28 . 2008-05-01 20:28 <DIR> d-------- C:\Programme\SystemRequirementsLab
2008-04-30 22:35 . 2008-04-30 22:35 <DIR> d-------- C:\Programme\Gemeinsame Dateien\CyberLink
2008-04-30 22:35 . 2008-04-30 22:35 <DIR> d-------- C:\Programme\CyberLink
2008-04-30 22:35 . 2008-04-30 22:35 <DIR> d-------- C:\Dokumente und Einstellungen\Heiko\Anwendungsdaten\CyberLink
2008-04-30 22:35 . 2008-05-04 15:22 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CyberLink
2008-04-30 22:22 . 2008-04-30 22:22 <DIR> d-------- C:\Dokumente und Einstellungen\Heiko\Anwendungsdaten\Media Player Classic
2008-04-30 22:21 . 2008-04-30 22:21 <DIR> d-------- C:\Programme\Real Alternative
2008-04-30 22:11 . 2008-04-30 22:11 <DIR> d-------- C:\Programme\Real
2008-04-30 22:11 . 2008-05-02 14:14 <DIR> d-------- C:\Programme\Google
2008-04-30 22:11 . 2008-05-19 19:23 <DIR> d-------- C:\Programme\Gemeinsame Dateien\Real
2008-04-28 19:37 . 2008-04-28 19:37 <DIR> d-------- C:\Programme\Joost
2008-04-28 19:37 . 2008-05-05 16:41 <DIR> d-------- C:\Dokumente und Einstellungen\Heiko\Anwendungsdaten\Joost
2008-04-24 15:12 . 2008-05-20 15:14 <DIR> d-------- C:\Programme\Steam
2008-04-23 15:21 . 2008-04-23 15:21 <DIR> d-------- C:\Dokumente und Einstellungen\Heiko\Anwendungsdaten\ICQ Toolbar
2008-04-23 15:09 . 2008-04-30 19:29 <DIR> d-------- C:\Programme\ICQToolbar
2008-04-23 15:08 . 2008-04-23 15:10 <DIR> d-------- C:\Dokumente und Einstellungen\Heiko\Anwendungsdaten\ICQ
2008-04-23 15:07 . 2008-04-23 15:10 <DIR> d-------- C:\Programme\ICQ6
2008-04-23 15:07 . 2008-04-23 15:07 <DIR> d-------- C:\Dokumente und Einstellungen\Heiko\Anwendungsdaten\InstallShield
2008-04-22 18:42 . 2008-04-22 18:42 <DIR> d-------- C:\Image
2008-04-22 18:06 . 2008-04-22 18:06 <DIR> d-------- C:\Programme\Free M4a to MP3 Converter
2008-04-22 17:05 . 2008-04-22 17:05 <DIR> d-------- C:\Programme\M4A to MP3 Converter
2008-04-22 17:05 . 2006-10-23 16:31 898,048 --a------ C:\WINDOWS\system32\NCTAudioCompress3.dll
2008-04-22 17:05 . 2002-01-05 05:37 344,064 --a------ C:\WINDOWS\system32\msvcr70.dll
2008-04-22 17:05 . 2006-10-23 16:32 254,464 --a------ C:\WINDOWS\system32\NCTAudioFile3.dll
2008-04-22 17:05 . 2001-03-13 14:49 140,288 --a------ C:\WINDOWS\system32\COMDLG32.OCX
2008-04-22 17:05 . 2005-06-10 13:48 61,440 --a------ C:\WINDOWS\system32\FoxButtonX.ocx
2008-04-22 17:05 . 2006-10-23 16:33 46,592 --a------ C:\WINDOWS\system32\NCTAudioFormatSettings3.dll
2008-04-22 17:03 . 2008-04-22 17:03 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Messenger Plus!
2008-04-22 16:53 . 2008-04-22 16:53 <DIR> d---s---- C:\Dokumente und Einstellungen\Heiko\UserData
2008-04-22 16:52 . 2008-04-22 16:52 <DIR> d-------- C:\Programme\Messenger Plus! Live
2008-04-22 16:45 . 2008-04-22 16:53 <DIR> d-------- C:\Dokumente und Einstellungen\Heiko\Contacts
2008-04-22 16:39 . 2008-04-22 16:39 268 --ah----- C:\sqmdata00.sqm
2008-04-22 16:39 . 2008-04-22 16:39 244 --ah----- C:\sqmnoopt00.sqm
2008-04-22 13:36 . 2008-04-22 13:36 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
2008-04-22 13:36 . 2008-04-22 13:36 <DIR> d-------- C:\Programme\Windows Live
2008-04-22 13:34 . 2008-04-22 13:34 <DIR> d-------- C:\Dokumente und Einstellungen\LocalService\Startmen
2008-04-22 13:03 . 2004-07-17 11:40 19,528 --a------ C:\WINDOWS\003606_.tmp
2008-04-22 13:02 . 2008-05-19 20:55 <DIR> d-------- C:\Programme\eMule
2008-04-22 12:35 . 2008-04-22 12:35 <DIR> d--hs---- C:\WINDOWS\ftpcache
2008-04-22 12:35 . 2008-04-22 12:35 <DIR> d-------- C:\Dokumente und Einstellungen\Heiko\Anwendungsdaten\Logitech
2008-04-22 12:33 . 2008-04-22 12:33 <DIR> d-------- C:\Programme\Gemeinsame Dateien\Logitech
2008-04-22 12:33 . 2008-04-22 12:33 81,920 -r------- C:\WINDOWS\bwUnin-6.1.4.68-8876480L.exe
2008-04-22 12:33 . 2004-06-08 12:35 71,533 --------- C:\WINDOWS\system32\drivers\LMOUKE.sys
2008-04-22 12:33 . 2004-06-08 12:35 54,817 --------- C:\WINDOWS\system32\drivers\L8042MOU.SYS
2008-04-22 12:33 . 2004-08-04 00:42 53,248 --a------ C:\WINDOWS\system32\drivers\i8042prt.sys
2008-04-22 12:33 . 2004-08-04 00:46 25,216 --a------ C:\WINDOWS\system32\drivers\kbdclass.sys
2008-04-22 12:32 . 2008-04-22 12:33 <DIR> d-------- C:\Programme\Logitech
2008-04-22 12:32 . 2004-06-08 12:36 13,105 --a------ C:\WINDOWS\system32\drivers\L8042Kbd.sys
2008-04-22 12:21 . 2004-08-03 23:08 142,976 --a------ C:\WINDOWS\system32\drivers\usbport.sys
2008-04-22 12:21 . 2004-08-04 00:57 77,312 --a------ C:\WINDOWS\system32\usbui.dll
2008-04-22 12:21 . 2004-08-03 23:08 57,600 --a------ C:\WINDOWS\system32\drivers\usbhub.sys
2008-04-22 12:21 . 2004-08-03 23:08 26,624 --a------ C:\WINDOWS\system32\drivers\usbehci.sys
2008-04-22 12:21 . 2004-08-04 00:57 7,168 --a------ C:\WINDOWS\system32\hccoin.dll
2008-04-22 12:19 . 2008-04-22 12:19 <DIR> d-------- C:\WINDOWS\system32\Lang
2008-04-22 12:19 . 2008-04-22 12:19 940,794 --a------ C:\WINDOWS\system32\LoopyMusic.wav
2008-04-22 12:19 . 2008-04-22 12:19 146,650 --a------ C:\WINDOWS\system32\BuzzingBee.wav
2008-04-22 12:17 . 2003-10-03 16:28 45,056 --a------ C:\WINDOWS\system32\vusetup.dll
2008-04-22 12:17 . 2005-06-07 03:51 11,264 --a------ C:\WINDOWS\system32\drivers\vulfntr.sys
2008-04-22 12:17 . 2005-01-06 04:02 6,912 --a------ C:\WINDOWS\system32\drivers\vulfnth.sys
2008-04-22 12:15 . 2008-04-22 12:15 <DIR> d-------- C:\WUTemp
2008-04-22 12:14 . 2004-11-18 10:42 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2008-04-22 11:55 . 2002-06-14 18:46 19,274 --a------ C:\WINDOWS\001207_.tmp
2008-04-22 11:43 . 1998-11-17 13:44 328,704 --a------ C:\WINDOWS\IsUn0407.exe
2008-04-21 21:55 . 2005-02-23 18:12 9,298,432 --------- C:\WINDOWS\system32\RTLCPL.exe
2008-04-21 21:55 . 2005-02-24 14:20 2,311,680 --------- C:\WINDOWS\system32\drivers\alcxwdm.sys
2008-04-21 21:55 . 2005-02-03 15:13 294,912 --------- C:\WINDOWS\alcupd.exe
2008-04-21 21:55 . 2005-03-02 20:21 200,704 --------- C:\WINDOWS\alcrmv.exe
2008-04-21 21:55 . 2002-02-05 13:54 141,016 --------- C:\WINDOWS\system32\alsndmgr.wav
2008-04-21 21:55 . 2004-10-27 15:47 40,960 --------- C:\WINDOWS\system32\ChCfg.exe
2008-04-21 21:50 . 2008-04-21 21:50 <DIR> d-------- C:\Programme\Winamp Toolbar
2008-04-21 21:50 . 2008-04-21 21:50 <DIR> d-------- C:\Programme\Winamp Remote
2008-04-21 21:50 . 2008-04-21 21:50 <DIR> d-------- C:\Programme\Alwil Software
2008-04-21 21:50 . 2008-04-21 21:50 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Winamp Toolbar
2008-04-21 21:50 . 2008-04-21 21:52 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\OrbNetworks
2008-04-21 21:49 . 2008-04-21 21:51 <DIR> d-------- C:\Programme\Winamp
2008-04-21 21:49 . 2008-04-21 21:51 <DIR> d-------- C:\Dokumente und Einstellungen\Heiko\Anwendungsdaten\Winamp
2008-04-21 21:46 . 2008-05-19 19:19 <DIR> d-------- C:\Instal_Tmp
2008-04-21 21:40 . 2008-04-21 21:40 <DIR> d---s---- C:\WINDOWS\system32\Microsoft
2008-04-21 21:36 . 2008-05-17 14:31 <DIR> d--h----- C:\Programme\InstallShield Installation Information
2008-04-21 21:35 . 2008-04-21 21:35 <DIR> d-------- C:\WINDOWS\Downloaded Installations
2008-04-21 21:35 . 2008-04-21 21:35 <DIR> d-------- C:\Programme\NETGEAR
2008-04-21 21:35 . 2008-04-21 21:35 <DIR> d-------- C:\OEMSettings

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-22 09:54 155,995 ----a-w C:\WINDOWS\java\Packages\B1ZZHB7T.ZIP
2008-04-21 14:46 --------- d-----w C:\Programme\microsoft frontpage
2008-04-21 14:45 --------- d-----w C:\Programme\Online-Dienste
2008-04-21 14:43 --------- d-----w C:\Programme\Gemeinsame Dateien\Dienste
2006-03-15 12:19 280,576 ----a-w C:\WINDOWS\inf\WG311v3\WG311v3XP.sys
2006-03-15 12:19 280,576 ----a-w C:\WINDOWS\inf\WG311v3\WG311v3.sys
2006-03-15 12:19 212,992 ----a-w C:\WINDOWS\inf\WG311v3\CopyWHQLDriver.exe
.

(((((((((((((((((((((((((((( Autostart Punkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Hinweis* leere Eintrage & legitime Standardeintrage werden nicht angezeigt.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7F94F13C-F6FF-4345-A60B-6613F31491BC}]
C:\WINDOWS\system32\awttSmlM.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F9DF827A-8FA7-48A3-B268-CA4DB563EA40}]
2008-05-18 16:29 52736 --a------ C:\WINDOWS\system32\hgGaaaYP.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= "C:\Programme\Winamp Toolbar\winamptb.dll" [2008-03-20 00:36 1267040]

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Programme\Winamp Toolbar\winamptb.dll [2008-03-20 00:36 1267040]

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:57 15360]
"Orb"="C:\Programme\Winamp Remote\bin\OrbTray.exe" [2008-04-01 03:54 507904]
"LDM"="C:\Programme\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [2008-04-22 12:33 20480]
"Steam"="c:\programme\steam\steam.exe" [2008-04-24 15:18 1271032]
"swg"="C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-05-02 14:13 68856]
"BitTorrent"="C:\Programme\BitTorrent\bittorrent.exe" [2007-09-08 01:01 43008]
"WinUpdater"="C:\Program Files\winvi\update.exe" [ ]
"WebSUpdater"="C:\Program Files\winvi\wupda.exe" [ ]
"Pop up Blocker"="C:\Programme\Pop up Blocker\pd.exe" [2007-01-12 23:43 1190400]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776]
"nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe]
"WinampAgent"="C:\Programme\Winamp\winampa.exe" [ ]
"RTHDCPL"="RTHDCPL.EXE" [2006-09-11 19:58 16264192 C:\WINDOWS\RTHDCPL.EXE]
"SkyTel"="SkyTel.EXE" [2006-05-15 21:04 2879488 C:\WINDOWS\SkyTel.exe]
"RemoteControl8"="C:\Programme\CyberLink\PowerDVD8\PDVD8Serv.exe" [2008-03-20 20:23 83240]
"PDVD8LanguageShortcut"="C:\Programme\CyberLink\PowerDVD8\Language\Language.exe" [2007-12-14 11:36 50472]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920]
"avgnt"="C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-12 10:06 262401]
"TkBellExe"="C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" [2008-05-19 19:21 185896]
"QuickTime Task"="C:\Programme\QuickTime\qttask.exe" [2008-03-28 23:37 413696]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:57 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{F9DF827A-8FA7-48A3-B268-CA4DB563EA40}"= C:\WINDOWS\system32\hgGaaaYP.dll [2008-05-18 16:29 52736]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\hgGaaaYP]
hgGaaaYP.dll 2008-05-18 16:29 52736 C:\WINDOWS\system32\hgGaaaYP.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Programme\\Winamp Remote\\bin\\OrbTray.exe"=
"C:\\Programme\\Logitech\\Desktop Messenger\\8876480\\Program\\backWeb-8876480.exe"=
"C:\\Programme\\ICQ6\\ICQ.exe"=
"C:\\Programme\\eMule\\emule.exe"=
"C:\\Programme\\Steam\\SteamApps\\punkmasterxt\\counter-strike source\\hl2.exe"=
"C:\\Programme\\Steam\\SteamApps\\punkmasterxt\\day of defeat source\\hl2.exe"=
"C:\\Programme\\CyberLink\\PowerDVD8\\PowerDVD8.exe"=
"C:\\Programme\\BitTorrent\\bittorrent.exe"=
"C:\\Programme\\Joost\\xulrunner\\tvprunner.exe"=
"C:\\Programme\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Programme\\Windows Live\\Messenger\\livecall.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 19:31]
S3 PciCon;PciCon;D:\PciCon.sys []

.
Inhalt des "geplante Tasks" Ordners
"2008-05-19 17:35:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Programme\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-20 21:33:52
Windows 5.1.2600 Service Pack 2 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostart Eintr„ge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\hgGaaaYP.dll

PROCESS: C:\WINDOWS\explorer.exe
-> C:\Programme\Logitech\SetPoint\lgscroll.dll
.
------------------------ Other Running Processes ------------------------
.
C:\Programme\Alwil Software\Avast4\aswUpdSv.exe
C:\Programme\Alwil Software\Avast4\ashServ.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Programme\Alwil Software\Avast4\ashMaiSv.exe
C:\Programme\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wuauclt.exe.wusetup.360078.bak\
C:\WINDOWS\system32\rundll32.exe
C:\Programme\Google\Google Updater\GoogleUpdater.exe
C:\Programme\Logitech\SetPoint\KEM.exe
C:\Programme\Logitech\SetPoint\KHALMNPR.exe
C:\Programme\NETGEAR\WG311v3\wlancfg5.exe
C:\Programme\Alwil Software\Avast4\Setup\avast.setup
.
**************************************************************************
.
Zeit der Fertigstellung: 2008-05-20 21:38:40 - machine was rebooted
ComboFix-quarantined-files.txt 2008-05-20 19:38:13

13 Verzeichnis(se), 89,343,311,872 Bytes frei
15 Verzeichnis(se), 89,417,064,448 Bytes frei

269