Trojaner-Board - abnow.com nervt unter WIN XP Pro 32 Bit

Guten Morgen. Einmal der DDS.txt:
Code:
.

DDS (Ver_2011-08-26.01) - NTFSx86 

Internet Explorer: 8.0.6001.18702  BrowserJavaVersion: 1.6.0_22

Run by Paulchen at 22:47:43 on 2012-02-23

Microsoft Windows XP Professional  5.1.2600.3.1252.49.1031.18.1023.388 [GMT 1:00]

.

AV: Avira Desktop *Enabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}

.

============== Running Processes ===============

.

C:\WINDOWS\system32\svchost.exe -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Programme\Avira\AntiVir Desktop\sched.exe

C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe

F:\Adobe\Acrobat 7.0\Distillr\Acrotray.exe

C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe

C:\Programme\Canon\MyPrinter\BJMyPrt.exe

C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Programme\Avira\AntiVir Desktop\avgnt.exe

C:\Programme\Duden\Duden Korrektor\DKtray.exe

C:\Programme\Duden\Duden Korrektor\DKCore.exe

C:\Programme\Office-Bibliothek\officebib.exe

C:\Programme\Gemeinsame Dateien\AAV\aavus.exe

C:\Programme\Avira\AntiVir Desktop\avguard.exe

C:\Programme\Java\jre6\bin\jqs.exe

C:\Programme\Google\Update\GoogleUpdate.exe

C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\WINDOWS\System32\snmp.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Programme\TuneUp Utilities 2012\TuneUpUtilitiesService32.exe

C:\Programme\Canon\CAL\CALMAIN.exe

C:\Programme\Avira\AntiVir Desktop\avshadow.exe

C:\Programme\TuneUp Utilities 2012\TuneUpUtilitiesApp32.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Programme\Mozilla Firefox\firefox.exe

C:\Programme\Mozilla Firefox\plugin-container.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.google.de/

uDefault_Search_URL = hxxp://www.google.com/ie

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

BHO: Adobe PDF Reader: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\programme\gemeinsame dateien\adobe\acrobat\activex\AcroIEHelper.dll

BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - f:\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll

BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\programme\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\programme\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - f:\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll

uRun: [Duden Korrektor SysTray] c:\programme\duden\duden korrektor\DKtray.exe

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRunOnce: [FlashPlayerUpdate] c:\windows\system32\macromed\flash\FlashUtil9d.exe

mRun: [Ptipbmf] rundll32.exe ptipbmf.dll,SetWriteCacheMode

mRun: [ISUSPM Startup] c:\progra~1\gemein~1\instal~1\update~1\ISUSPM.exe -startup

mRun: [ISUSScheduler] "c:\programme\gemeinsame dateien\installshield\updateservice\issch.exe" -start

mRun: [Acrobat Assistant 7.0] "f:\adobe\acrobat 7.0\distillr\Acrotray.exe"

mRun: [SunJavaUpdateSched] "c:\programme\gemeinsame dateien\java\java update\jusched.exe"

mRun: [CanonMyPrinter] c:\programme\canon\myprinter\BJMyPrt.exe /logon

mRun: [AdobeCS4ServiceManager] "c:\programme\gemeinsame dateien\adobe\cs4servicemanager\CS4ServiceManager.exe" -launchedbylogin

mRun: [Malwarebytes' Anti-Malware] "c:\programme\malwarebytes' anti-malware\mbamgui.exe" /starttray

mRun: [avgnt] "c:\programme\avira\antivir desktop\avgnt.exe" /min

dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: Convert link target to Adobe PDF - f:\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Convert link target to existing PDF - f:\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert selected links to Adobe PDF - f:\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

IE: Convert selected links to existing PDF - f:\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: Convert selection to Adobe PDF - f:\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Convert selection to existing PDF - f:\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert to Adobe PDF - f:\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Convert to existing PDF - f:\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Nach Microsoft &Excel exportieren - c:\progra~1\micros~2\office10\EXCEL.EXE/3000

IE: Nach Microsoft E&xel exportieren - c:\progra~1\micros~2\office12\EXCEL.EXE/3000

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\programme\messenger\msmsgs.exe

DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204

DPF: {33564D57-0000-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB

DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1328726847312

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

TCP: DhcpNameServer = 192.168.178.1

TCP: Interfaces\{A3ABAC37-BA51-4951-897D-DCBBAA9ABE25} : DhcpNameServer = 192.168.178.1

Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\programme\gemeinsame dateien\microsoft shared\web folders\PKMCDO.DLL

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\dokumente und einstellungen\paulchen.paule\anwendungsdaten\mozilla\firefox\profiles\fhjkjkdq.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig?hl=de

FF - prefs.js: network.proxy.type - 0

FF - plugin: c:\dokumente und einstellungen\paulchen.paule\anwendungsdaten\mozilla\firefox\profiles\fhjkjkdq.default\extensions\{f8cc37c3-cbeb-4a00-8cbf-26a88693f0c5}\plugins\npagent.dll

FF - plugin: c:\dokumente und einstellungen\paulchen.paule\anwendungsdaten\mozilla\plugins\npgoogletalk.dll

FF - plugin: c:\dokumente und einstellungen\paulchen.paule\anwendungsdaten\mozilla\plugins\npgtpo3dautoplugin.dll

FF - plugin: c:\dokumente und einstellungen\paulchen.paule\lokale einstellungen\anwendungsdaten\google\update\1.3.21.99\npGoogleUpdate3.dll

FF - plugin: c:\programme\google\google earth\plugin\npgeplugin.dll

FF - plugin: c:\programme\google\picasa3\npPicasa3.dll

FF - plugin: c:\programme\google\update\1.3.21.99\npGoogleUpdate3.dll

FF - plugin: c:\programme\java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: c:\programme\mozilla firefox\plugins\npagent.dll

FF - plugin: c:\programme\mozilla firefox\plugins\npdeployJava1.dll

FF - plugin: c:\programme\mozilla firefox\plugins\npwachk.dll

.

============= SERVICES / DRIVERS ===============

.

R0 viasraid;viasraid;c:\windows\system32\drivers\viasraid.sys [2003-12-12 77312]

R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [2012-2-21 36000]

R2 AAV UpdateService;AAV UpdateService;c:\programme\gemeinsame dateien\aav\aavus.exe [2007-10-4 122880]

R2 AntiVirSchedulerService;Avira Planer;c:\programme\avira\antivir desktop\sched.exe [2012-2-21 86224]

R2 AntiVirService;Avira Echtzeit Scanner;c:\programme\avira\antivir desktop\avguard.exe [2012-2-21 110032]

R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2012-2-21 74640]

R2 MBAMService;MBAMService;c:\programme\malwarebytes' anti-malware\mbamservice.exe [2012-2-21 652360]

R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\programme\tuneup utilities 2012\TuneUpUtilitiesService32.exe [2011-12-14 1514304]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-2-21 20464]

R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\programme\tuneup utilities 2012\TuneUpUtilitiesDriver32.sys [2011-12-12 10064]

S2 gupdate;Google Update Service (gupdate);c:\programme\google\update\GoogleUpdate.exe [2010-11-9 136176]

S3 A3AB;D-Link AirPro 802.11a/b Wireless Adapter Service(A3AB);c:\windows\system32\drivers\A3AB.sys [2004-9-2 396480]

S3 gupdatem;Google Update-Dienst (gupdatem);c:\programme\google\update\GoogleUpdate.exe [2010-11-9 136176]

S3 SetupNTGLM7X;SetupNTGLM7X;\??\h:\ntglm7x.sys --> h:\NTGLM7X.sys [?]

S3 st3wolf;st3wolf;c:\windows\system32\drivers\st3wolf.sys --> c:\windows\system32\drivers\st3wolf.sys [?]

S3 SXDS10;soft Xpansion Dispatch Service;c:\programme\gemeinsame dateien\soft xpansion\SXDS10.exe [2010-11-8 149504]

.

=============== Created Last 30 ================

.

2012-02-23 12:22:56        --------        d-sh--w-        c:\dokumente und einstellungen\paulchen.paule\PrivacIE

2012-02-21 21:24:51        --------        d-----w-        c:\dokumente und einstellungen\paulchen.paule\anwendungsdaten\Avira

2012-02-21 21:16:44        --------        d-----w-        c:\dokumente und einstellungen\paulchen.paule\lokale einstellungen\anwendungsdaten\PCHealth

2012-02-21 21:15:04        74640        ----a-w-        c:\windows\system32\drivers\avgntflt.sys

2012-02-21 21:15:04        36000        ----a-w-        c:\windows\system32\drivers\avkmgr.sys

2012-02-21 21:15:03        --------        d-----w-        c:\programme\Avira

2012-02-21 21:12:34        --------        d-sh--w-        c:\dokumente und einstellungen\paulchen.paule\IETldCache

2012-02-21 19:16:24        --------        d-----w-        c:\windows\ie8updates

2012-02-21 19:15:47        --------        dc-h--w-        c:\windows\ie8

2012-02-21 18:58:59        --------        d-----w-        c:\programme\MSXML 4.0

2012-02-21 18:56:00        6144        -c----w-        c:\windows\system32\dllcache\iecompat.dll

2012-02-21 18:55:48        602112        -c----w-        c:\windows\system32\dllcache\msfeeds.dll

2012-02-21 18:55:48        55296        -c----w-        c:\windows\system32\dllcache\msfeedsbs.dll

2012-02-21 18:55:46        743424        -c----w-        c:\windows\system32\dllcache\iedvtool.dll

2012-02-21 18:55:46        247808        -c----w-        c:\windows\system32\dllcache\ieproxy.dll

2012-02-21 18:55:46        2000384        -c----w-        c:\windows\system32\dllcache\iertutil.dll

2012-02-21 18:55:46        12800        -c----w-        c:\windows\system32\dllcache\xpshims.dll

2012-02-21 18:55:45        11082240        -c----w-        c:\windows\system32\dllcache\ieframe.dll

2012-02-21 18:38:05        --------        d-----w-        c:\windows\ServicePackFiles

2012-02-21 18:38:00        294912        ------w-        c:\programme\windows media player\dlimport.exe

2012-02-21 18:36:55        19569        ----a-w-        c:\windows\002605_.tmp

2012-02-21 18:17:57        --------        d-----w-        c:\dokumente und einstellungen\paulchen.paule\anwendungsdaten\Malwarebytes

2012-02-21 18:17:51        --------        d-----w-        c:\dokumente und einstellungen\all users.windows\anwendungsdaten\Malwarebytes

2012-02-21 18:17:50        20464        ----a-w-        c:\windows\system32\drivers\mbam.sys

2012-02-21 18:17:50        --------        d-----w-        c:\programme\Malwarebytes' Anti-Malware

2012-02-21 09:46:06        --------        d-sha-r-        C:\cmdcons

2012-02-14 21:29:50        --------        d-----w-        C:\TDSSKiller_Quarantine

2012-02-11 13:51:40        --------        d-----w-        c:\dokumente und einstellungen\paulchen.paule\lokale einstellungen\anwendungsdaten\Microsoft Corporation

2012-02-11 09:28:18        98816        ----a-w-        c:\windows\sed.exe

2012-02-11 09:28:18        518144        ----a-w-        c:\windows\SWREG.exe

2012-02-11 09:28:18        256000        ----a-w-        c:\windows\PEV.exe

2012-02-11 09:28:18        208896        ----a-w-        c:\windows\MBR.exe

2012-02-09 09:34:10        --------        d-----w-        C:\FRST

2012-02-08 20:59:26        409600        ----a-w-        c:\programme\mozilla firefox\kaspersky rescue2usb\rescue2usb.exe

2012-02-08 20:59:26        28160        ----a-w-        c:\programme\mozilla firefox\kaspersky rescue2usb\syslinux.exe

2012-02-08 20:59:26        237849        ----a-w-        c:\programme\mozilla firefox\kaspersky rescue2usb\grub.exe

2012-02-08 20:09:02        --------        d-----w-        c:\programme\TrojanHunter 5.5

2012-02-08 19:30:37        --------        d-----w-        c:\programme\PC Tools Security

2012-02-08 19:14:17        --------        d-----w-        c:\dokumente und einstellungen\all users.windows\anwendungsdaten\PC Tools

2012-02-06 09:38:05        0        --sha-w-        c:\windows\system32\dds_log_trash.cmd

.

==================== Find3M  ====================

.

2011-12-30 10:33:05        414368        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl

2011-12-17 19:43:23        916992        ----a-w-        c:\windows\system32\wininet.dll

2011-12-17 19:43:23        43520        ------w-        c:\windows\system32\licmgr10.dll

2011-12-17 19:43:23        1469440        ------w-        c:\windows\system32\inetcpl.cpl

2011-12-16 12:22:58        385024        ------w-        c:\windows\system32\html.iec

2011-12-14 11:23:40        31552        ----a-w-        c:\windows\system32\TURegOpt.exe

.

============= FINISH: 22:48:22,53 ===============
und der Attache.txt im Anhang.
Ich bin von Fr. bis So. nicht zu Hause und wünsche ein erholsames Wochenende.

Gruß

Carsten