Trojaner-Board - Storageprotector

Hallo,
ist mein 2.ter versuch.
Also habe auch das Problem das ich "Help & Supportcenter" und "Windows Update" seit einiger Zeit auf meinem Desktop habe...
zudem spinnt meine explorer.exe ein wenig und ich kan manchmal keine ordner öffnen.
Zudem kommen unter anderem auch regelmäßig diiese Fehlermeldungen:
Fehlermeldung - Fehlermeldung - Fehlermeldung

habe grad in einen anderen thread das selbe problem endeckt und habe einfach mal den anweisungen gefolgt und ein HiJackThis log erstellt und Combo Fix drüber laufen lassen...

Hier der HiJackThis Log:

Code:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 10:02:33, on 31.01.2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal
 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe

C:\Programme\IVT Corporation\BlueSoleil\BTNtService.exe

C:\WINDOWS\system32\kadkbmwk.exe

C:\WINDOWS\System32\svchost.exe

C:\Programme\CA\SharedComponents\CA_LIC\LogWatNT.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

C:\Programme\Stardock\Object Desktop\WindowBlinds\wbload.exe

C:\WINDOWS\system32\UAService7.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\Dit.exe

C:\WINDOWS\CNYHKey.exe

C:\WINDOWS\AGRSMMSG.exe

C:\Programme\Home Cinema\PowerCinema\PCMService.exe

C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe

C:\WINDOWS\system32\RunDll32.exe

C:\Programme\Ashampoo\Ashampoo FireWall\FireWall.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Programme\Messenger\msmsgs.exe

C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe

C:\Programme\Windows Media Player\WMPNSCFG.exe

C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexStoreSvr.exe

D:\PROGRA~1\MOZILL~1\FIREFOX.EXE

C:\WINDOWS\system32\taskmgr.exe

C:\Dokumente und Einstellungen\Patrick ****\Desktop\HiJackThis202.exe
 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = h**p://google.icq.com/search/search_frame.php

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://google.icq.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://google.daemonsearch.com/intl/

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = h**p://bar.baidu.com/sobar/defaultsearch.html

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = h**p://bar.baidu.com/sobar/defaultsearch.html

R3 - URLSearchHook: ICQ  Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll

O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

O2 - BHO: (no name) - {072F7427-CB66-42FE-A479-029EFA37AEE1} - C:\WINDOWS\system32\jkhhg.dll

O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Programme\Real\RealPlayer\rpbrowserrecordplugin.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Programme\Spybot - Search & Destroy\SDHelper.dll

O2 - BHO: (no name) - {6AA3809C-6261-456F-8FCA-43FE39ADC5E9} - C:\WINDOWS\system32\hgggeeb.dll

O2 - BHO: {c00ee7ca-4709-0c1a-0854-87782a23a0e6} - {6e0a32a2-8778-4580-a1c0-9074ac7ee00c} - C:\WINDOWS\system32\toabjjsv.dll

O2 - BHO: BandIE Class - {77FEF28E-EB96-44FF-B511-3185DEA48697} - C:\PROGRA~1\baidu\bar\BaiduBar.dll

O2 - BHO: (no name) - {A95B2816-1D7E-4561-A202-68C0DE02353A} - C:\WINDOWS\system32\obflaxcy.dll

O3 - Toolbar: ICQ  Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll

O3 - Toolbar: °Ù¶È³¬¼¶ËÑ°Ô - {B580CF65-E151-49C3-B73F-70B13FCA8E86} - C:\PROGRA~1\baidu\bar\BaiduBar.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [Verknüpfung mit der High Definition Audio-Eigenschaftenseite] HDAudPropShortcut.exe

O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd

O4 - HKLM\..\Run: [Dit] Dit.exe

O4 - HKLM\..\Run: [ledpointer] CNYHKey.exe

O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe

O4 - HKLM\..\Run: [PCMService] "C:\Programme\Home Cinema\PowerCinema\PCMService.exe"

O4 - HKLM\..\Run: [Realtime Monitor] C:\PROGRA~1\CA\ETRUST~1\realmon.exe -s

O4 - HKLM\..\Run: [kav] "C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"

O4 - HKLM\..\Run: [HbTools] C:\Programme\HbTools\Bin\4.7.7.0\HbtOEAddOn.exe

O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

O4 - HKLM\..\Run: [CmUsbSound] RunDll32 cmcnfgu.cpl,CMICtrlWnd

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [Ashampoo FireWall] "C:\Programme\Ashampoo\Ashampoo FireWall\FireWall.exe" -TRAY

O4 - HKLM\..\Run: [TrayServer] C:\MAGIX\Video_deluxe_2007_PLUS\TrayServer.exe

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Programme\Gemeinsame Dateien\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot

O4 - HKLM\..\Run: [PPort11reminder] "C:\Programme\ScanSoft\PaperPort\Ereg\Ereg.exe" -r "C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ScanSoft\PaperPort\11\Config\Ereg\Ereg.ini

O4 - HKLM\..\Run: [083b2e08] rundll32.exe "C:\WINDOWS\system32\tsxoxdhb.dll",b

O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe"

O4 - HKCU\..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\WMPNSCFG.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O8 - Extra context menu item: AlarmClock Wecker - C:\PROGRA~1\AlmClock\AlmClock.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\j2re1.4.2_05\bin\npjpi142_05.dll

O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\j2re1.4.2_05\bin\npjpi142_05.dll

O9 - Extra button: Web-Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll

O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL

O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe (file missing)

O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe (file missing)

O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll

O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe

O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe

O9 - Extra button: Wecker - {48B7ECC2-1846-4180-9673-4F4B864B3846} - C:\PROGRA~1\AlmClock\AlmClock.htm (HKCU)

O9 - Extra 'Tools' menuitem: AlarmClock Wecker - {48B7ECC2-1846-4180-9673-4F4B864B3846} - C:\PROGRA~1\AlmClock\AlmClock.htm (HKCU)

O9 - Extra button: MedionShop - {5CF0F1D2-1D22-499D-93A1-8126F28412F4} - h**p://w*w.medionshop.de/ (file missing) (HKCU)

O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - h**p://files.ea.com/downloads/rtpatch/v2/EARTPX.cab

O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - h**p://software-dl.real.com/12b59a1dbbc2c6658a05/netzip/RdxIE601_de.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - h**p://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1097566082250

O17 - HKLM\System\CCS\Services\Tcpip\..\{F80DEE3A-1D76-42EF-95EC-84B770162BEE}: NameServer = ****** ?

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL

O20 - Winlogon Notify: hgggeeb - C:\WINDOWS\SYSTEM32\hgggeeb.dll

O20 - Winlogon Notify: obflaxcy - C:\WINDOWS\SYSTEM32\obflaxcy.dll

O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Kaspersky Lab - C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe

O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Programme\IVT Corporation\BlueSoleil\BTNtService.exe

O23 - Service: CA-Lizenz-Client (CA_LIC_CLNT) - Computer Associates - C:\Programme\CA\SharedComponents\CA_LIC\lic98rmt.exe

O23 - Service: CA-Lizenzserver (CA_LIC_SRVR) - Computer Associates - C:\Programme\CA\SharedComponents\CA_LIC\lic98rmtd.exe

O23 - Service: DomainService -   - C:\WINDOWS\system32\kadkbmwk.exe

O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\MAGIX\Common\Database\bin\fbserver.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Ereignisprotokoll-Überwachung (LogWatch) - Computer Associates - C:\Programme\CA\SharedComponents\CA_LIC\LogWatNT.exe

O23 - Service: NBService - Nero AG - C:\Programme\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe

O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
 

--

End of file - 10734 bytes

er ist schon paar tage alt, aber das Problem war da schon da...

und der Log von Combo Fix

Code:

ComboFix 08-02.05.3 - Patrick **** 2008-02-08 16:14:31.1 - NTFSx86

Microsoft Windows XP Home Edition  5.1.2600.2.1252.1.1031.18.565 [GMT 1:00]

ausgeführt von:: C:\Dokumente und Einstellungen\Patrick ****\Desktop\ComboFix.exe

 * Neuer Wiederherstellungspunkt wurde erstellt
 
 WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.
 

((((((((((((((((((((((((((((((((((((   Weitere L”schungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.
 

C:\WINDOWS\system32\hgggeeb.dll

C:\WINDOWS\system32\jkhhg.dll

C:\WINDOWS\system32\obflaxcy.dll

C:\Dokumente und Einstellungen\Patrick ****\Lokale Einstellungen\Anwendungsdaten\baidu

C:\Programme\baidu

C:\Programme\baidu\bar\baidubar.dat

C:\Programme\baidu\bar\BaiduBar.dll

C:\Programme\baidu\bar\bang.ini

C:\Programme\baidu\bar\BDBar_tmp\BaiduBar.dll

C:\Programme\baidu\bar\img\imglist.bmp

C:\Programme\baidu\bar\img\logo.bmp

C:\Programme\HbTools

C:\Programme\HbTools\Bin\4.7.7.0\dBenderC.dll

C:\Programme\HbTools\Bin\HbtUninst.exe

C:\WINDOWS\hosts

C:\WINDOWS\regedit.com

C:\WINDOWS\system32\abbuktju.dll

C:\WINDOWS\system32\bdqeeaec.dll

C:\WINDOWS\system32\bhdxoxst.ini

C:\WINDOWS\system32\bpsuuwun.ini

C:\WINDOWS\system32\brdrldqo.exe

C:\WINDOWS\system32\ceaeeqdb.ini

C:\WINDOWS\system32\exlglqrq.ini

C:\WINDOWS\system32\expiorer.exe

C:\WINDOWS\system32\flixkxux.ini

C:\WINDOWS\system32\fmdnqklv.exe

C:\WINDOWS\system32\ghhkj.ini

C:\WINDOWS\system32\ghhkj.ini2

C:\WINDOWS\system32\gnxpbaqw.exe

C:\WINDOWS\system32\haucnajs.dll

C:\WINDOWS\system32\hgggeeb.dll

C:\WINDOWS\system32\iexp_log.txt

C:\WINDOWS\system32\iirobuqh.dll

C:\WINDOWS\system32\ixadugig.dll

C:\WINDOWS\system32\jkhhg.dll

C:\WINDOWS\system32\jsyyhyol.dll

C:\WINDOWS\system32\kadkbmwk.exe

C:\WINDOWS\system32\kqariutr.dll

C:\WINDOWS\system32\lertyoyb.ini

C:\WINDOWS\system32\lxxvlcag.exe

C:\WINDOWS\system32\mcrh.tmp

C:\WINDOWS\system32\mjydpnod.dll

C:\WINDOWS\system32\nbimptvc.ini

C:\WINDOWS\system32\nhmcvdvw.ini

C:\WINDOWS\system32\nipvkjpv.ini

C:\WINDOWS\system32\obflaxcy.dll

C:\WINDOWS\system32\obflaxcy.dllbox

C:\WINDOWS\system32\odatupxe.dll

C:\WINDOWS\system32\ohtreakh.dll

C:\WINDOWS\system32\oqqfioco.exe

C:\WINDOWS\system32\orhdmjsf.dll

C:\WINDOWS\system32\orjpdaek.ini

C:\WINDOWS\system32\owplfgjl.ini

C:\WINDOWS\system32\pwkbuycc.ini

C:\WINDOWS\system32\rwbnrfbn.dll

C:\WINDOWS\system32\rydlnybm.ini

C:\WINDOWS\system32\sdfdlyba.ini

C:\WINDOWS\system32\taskmgr.com

C:\WINDOWS\system32\taudbsqf.dll

C:\WINDOWS\system32\tluxpxuc.dll

C:\WINDOWS\system32\toabjjsv.dll

C:\WINDOWS\system32\ugqxvjku.ini

C:\WINDOWS\system32\ukjvxqgu.dll

C:\WINDOWS\system32\vdtkyvjt.ini

C:\WINDOWS\system32\weidoebr.dll

C:\WINDOWS\system32\wmknyelo.ini

C:\WINDOWS\system32\wroedvie.ini

C:\WINDOWS\system32\wvdvcmhn.dll

C:\WINDOWS\system32\xkmvdubw.dll

C:\WINDOWS\system32\xochnjjb.dll

C:\WINDOWS\system32\yjuigeqr.dll

C:\WINDOWS\system32\ymkcnfof.dll

C:\WINDOWS\system32\yrdsddct.ini

C:\WINDOWS\system32\yydxuyfr.dll
 

.

(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
 

.

-------\LEGACY_DOMAINSERVICE

-------\DomainService

-------\NPF
 
 

(((((((((((((((((((((((   Dateien erstellt von 2008-01-08 bis 2008-02-08  ))))))))))))))))))))))))))))))

.
 

2008-02-02 21:52 . 2004-08-04 00:57        159,232        --a------        C:\WINDOWS\system32\ptpusd.dll

2008-02-02 21:52 . 2004-08-03 22:58        15,104        --a------        C:\WINDOWS\system32\drivers\usbscan.sys

2008-02-02 21:52 . 2004-08-03 22:58        15,104        --a--c---        C:\WINDOWS\system32\dllcache\usbscan.sys

2008-02-02 21:52 . 2001-08-18 04:54        5,632        --a------        C:\WINDOWS\system32\ptpusb.dll

2008-01-28 22:18 . 2008-01-28 22:18        147,520        --a------        C:\WINDOWS\system32\ljgflpwo.dll

2008-01-25 21:17 . 2008-01-25 21:17        <DIR>        d--------        C:\Programme\Avant Browser

2008-01-25 21:17 . 2008-01-25 21:17        <DIR>        d--------        C:\Dokumente und Einstellungen\Patrick ****\Anwendungsdaten\Avant Profiles

2008-01-24 18:49 . 2008-02-02 16:26        21,840        --a----t-        C:\WINDOWS\system32\SIntfNT.dll

2008-01-24 18:49 . 2008-02-02 16:26        17,212        --a----t-        C:\WINDOWS\system32\SIntf32.dll

2008-01-24 18:49 . 2008-02-02 16:26        12,067        --a----t-        C:\WINDOWS\system32\SIntf16.dll

2008-01-24 18:35 . 2008-01-24 18:35        102,400        --a------        C:\WINDOWS\DIIUnin.exe

2008-01-24 18:35 . 2008-01-25 15:58        28,283        --a------        C:\WINDOWS\DIIUnin.dat

2008-01-24 18:35 . 2008-01-24 18:35        2,829        --a------        C:\WINDOWS\DIIUnin.pif
 

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-02-08 15:31        69,312,800        --sha-w        C:\WINDOWS\system32\drivers\fidbox.dat

2008-02-08 15:31        4,492,320        --sha-w        C:\WINDOWS\system32\drivers\fidbox2.dat

2008-02-08 15:31        17,408        ----a-w        C:\WINDOWS\system32\drivers\USBCRFT.SYS

2008-02-08 15:28        937,364        --sha-w        C:\WINDOWS\system32\drivers\fidbox.idx

2008-02-08 15:28        565,160        --sha-w        C:\WINDOWS\system32\drivers\fidbox2.idx

2008-02-08 15:11        ---------        d-----w        C:\Programme\mIRC

2008-02-06 17:04        19,934        ----a-w        C:\Dokumente und Einstellungen\Patrick ****\Anwendungsdaten\wklnhst.dat

2008-02-02 11:23        ---------        d--h--w        C:\Programme\InstallShield Installation Information

2008-02-02 11:23        ---------        d-----w        C:\Programme\Firaxis Games

2008-01-23 14:00        ---------        d-----w        C:\Programme\Ballerburg

2008-01-14 17:55        ---------        d-----w        C:\Programme\ICQ6

2008-01-12 22:55        ---------        d-----w        C:\Dokumente und Einstellungen\Patrick ****\Anwendungsdaten\ICQ

2008-01-11 21:14        ---------        d-----w        C:\Programme\TrackMania Nations ESWC

2008-01-06 19:08        ---------        d-----w        C:\Programme\XP Codec Pack

2008-01-03 21:38        ---------        d-----w        C:\Programme\RM to MP3 Converter

2007-12-26 12:53        ---------        d-----r        C:\Dokumente und Einstellungen\Patrick ****\Anwendungsdaten\Brother

2007-12-25 11:37        ---------        d-----w        C:\Programme\Brother

2007-12-25 11:26        ---------        d-----w        C:\Programme\Nuance

2007-12-25 11:25        ---------        d-----w        C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ScanSoft

2007-12-25 11:24        ---------        d-----w        C:\Programme\ScanSoft

2007-12-25 11:24        ---------        d-----w        C:\Programme\Gemeinsame Dateien\ScanSoft Shared

2007-12-25 11:23        ---------        d-----w        C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Brother

2007-12-17 18:15        ---------        d-----w        C:\Programme\No23 Recorder

2007-12-14 19:06        ---------        d-----w        C:\Programme\IVCsoft

2007-12-14 15:21        16        ---ha-w        C:\Programme\mxfilerelatedcache.mxc2

2007-12-14 15:13        ---------        d-----w        C:\Dokumente und Einstellungen\Patrick ****\Anwendungsdaten\MAGIX

2007-12-12 21:24        ---------        d-----w        C:\Programme\Riva

2007-12-12 21:24        ---------        d-----w        C:\Programme\Gemeinsame Dateien\SWF Studio

2007-12-12 21:15        ---------        d-----w        C:\Programme\eRightSoft

2007-12-12 20:51        ---------        d-----w        C:\Programme\Gemeinsame Dateien\xing shared

2007-12-12 20:51        ---------        d-----w        C:\Programme\Gemeinsame Dateien\Real

2007-12-11 18:10        ---------        d-----w        C:\Programme\THQ

2007-11-20 16:35        315,392        ----a-w        C:\WINDOWS\HideWin.exe

2007-11-16 11:47        86,416        ----a-w        C:\Dokumente und Einstellungen\Patrick ****\Anwendungsdaten\GDIPFONTCACHEV1.DAT

2007-09-13 15:10        6,556        ----a-w        C:\Dokumente und Einstellungen\Patrick ****\CachedXtraz.bin

2006-06-12 12:17        1        ----a-w        C:\Dokumente und Einstellungen\Patrick ****\SI.bin

2004-10-17 17:30        8        --sha-r        C:\WINDOWS\system32\32828BBAAC.sys

2003-08-16 18:56        579,584        --sha-r        C:\WINDOWS\system32\cd.exe

2006-05-03 09:06        163,328        --sh--r        C:\WINDOWS\system32\flvDX.dll

2007-02-21 10:47        31,232        --sh--r        C:\WINDOWS\system32\msfDX.dll

2006-11-13 06:27        700,427        --sha-r        C:\WINDOWS\system32\username.exe

.
 

((((((((((((((((((((((((((((   Autostart Punkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

REGEDIT4

*Hinweis* leere Eintrage & legitime Standardeintrage werden nicht angezeigt.
 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"MSMSGS"="C:\Programme\Messenger\msmsgs.exe" [2004-10-13 17:24 1694208]

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe" [2006-07-31 11:45 139264]

"WMPNSCFG"="C:\Programme\Windows Media Player\WMPNSCFG.exe" [2006-11-03 09:56 204288]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-10-04 17:14 8491008]

"nwiz"="nwiz.exe" [2007-10-04 17:14 1626112 C:\WINDOWS\system32\nwiz.exe]

"Verknüpfung mit der High Definition Audio-Eigenschaftenseite"="HDAudPropShortcut.exe" [2004-03-17 15:10 61952 C:\WINDOWS\system32\Hdaudpropshortcut.exe]

"Cmaudio"="cmicnfg.cpl" []

"Dit"="Dit.exe" [2004-07-20 17:18 90112 C:\WINDOWS\Dit.exe]

"ledpointer"="CNYHKey.exe" [2004-02-03 16:15 5794816 C:\WINDOWS\CNYHKey.exe]

"AGRSMMSG"="AGRSMMSG.exe" [2004-06-29 09:06 88363 C:\WINDOWS\AGRSMMSG.exe]

"PCMService"="C:\Programme\Home Cinema\PowerCinema\PCMService.exe" [2004-10-29 19:34 81920]

"Realtime Monitor"="C:\PROGRA~1\CA\ETRUST~1\realmon.exe" [ ]

"kav"="C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" [2006-03-21 16:02 139367]

"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-04 13:00 208952]

"CmUsbSound"="cmcnfgu.cpl" []

"NeroFilterCheck"="C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroCheck.exe" [2006-01-12 16:40 155648]

"Ashampoo FireWall"="C:\Programme\Ashampoo\Ashampoo FireWall\FireWall.exe" [2007-04-05 13:57 3251800]

"TrayServer"="C:\MAGIX\Video_deluxe_2007_PLUS\TrayServer.exe" [2006-10-04 15:41 86016]

"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-10-04 17:14 81920]

"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 17:07 61952 C:\WINDOWS\system32\HdAShCut.exe]

"RTHDCPL"="RTHDCPL.EXE" [2007-11-06 10:50 16855552 C:\WINDOWS\RTHDCPL.exe]

"SSBkgdUpdate"="C:\Programme\Gemeinsame Dateien\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 09:03 210472]

"PPort11reminder"="C:\Programme\ScanSoft\PaperPort\Ereg\Ereg.exe" [2007-02-01 13:46 255528]
 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 13:00 15360]
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB]

C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\fastload.dll 2001-12-20 22:34 24576 C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\fastload.dll
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=wbsys.dll
 

[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Adobe Reader - Schnellstart.lnk]

path=C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Reader - Schnellstart.lnk

backup=C:\WINDOWS\pss\Adobe Reader - Schnellstart.lnkCommon Startup
 

[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^BlueSoleil.lnk]

path=C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\BlueSoleil.lnk

backup=C:\WINDOWS\pss\BlueSoleil.lnkCommon Startup
 

[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^p6_erinnerung_18_demo.lnk]

path=C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\p6_erinnerung_18_demo.lnk

backup=C:\WINDOWS\pss\p6_erinnerung_18_demo.lnkCommon Startup
 

[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^WinZip Quick Pick.lnk]

path=C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\WinZip Quick Pick.lnk

backup=C:\WINDOWS\pss\WinZip Quick Pick.lnkCommon Startup
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]

--a------ 2005-05-03 18:43 69632 C:\WINDOWS\Alcmtr.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOLDialer]

--a------ 2004-11-09 21:36 497240 C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLDial.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BrMfcWnd]

--------- 2007-03-12 14:51 663552 C:\Programme\Brother\Brmfcmon\BrMfcWnd.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ControlCenter3]

--------- 2007-01-26 15:58 65536 C:\Programme\Brother\ControlCenter3\brctrcen.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CursorXP]

--a------ 2003-03-01 16:40 125440 D:\programme\Cursor\CursorXP.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ Lite]

C:\Programme\ICQLite\ICQLite.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndexSearch]

--a------ 2007-01-29 21:10 46632 C:\Programme\ScanSoft\PaperPort\IndexSearch.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]

--------- 2004-10-13 17:24 1694208 C:\Programme\Messenger\msmsgs.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBJ]

C:\Programme\Ahead\Nero BackItUp\NBJ.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PaperPort PTD]

--a------ 2007-01-29 21:12 30248 C:\Programme\ScanSoft\PaperPort\pptd40nt.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]

--a------ 2007-01-22 15:23 25368104 C:\Programme\Skype\Phone\Skype.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]

--a------ 2005-05-31 01:04 1415824 D:\Programme\Spybot - Search & Destroy\TeaTimer.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spyware Doctor]

D:\Programme\Spyware Doctor\swdoctor.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]

--a------ 2006-03-30 15:45 313472 C:\Programme\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]

--a------ 2006-11-03 09:56 204288 C:\Programme\Windows Media Player\WMPNSCFG.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ZoneAlarm Client]

C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"AOL ACS"=2 (0x2)
 

R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);C:\WINDOWS\system32\drivers\sfdrv01a.sys [2006-07-05 13:46]

R1 SSHDRV86;SSHDRV86;C:\WINDOWS\system32\drivers\SSHDRV86.sys [2005-12-20 23:00]

R2 ACEDRV09;ACEDRV09;C:\WINDOWS\system32\drivers\ACEDRV09.sys [2007-07-11 22:07]

R2 LogWatch;Ereignisprotokoll-Überwachung;C:\Programme\CA\SharedComponents\CA_LIC\LogWatNT.exe [2002-09-19 22:29]

R3 UKBFLT;UKBFLT;C:\WINDOWS\system32\DRIVERS\UKBFLT.sys [2003-12-19 16:13]

S3 3xHybrid;3xHybrid service;C:\WINDOWS\system32\DRIVERS\3xHybrid.sys [2004-10-06 14:10]

S3 BrScnUsb;Brother USB Still Image driver;C:\WINDOWS\system32\DRIVERS\BrScnUsb.sys [2004-10-15 12:50]

S3 CA_LIC_CLNT;CA-Lizenz-Client;C:\Programme\CA\SharedComponents\CA_LIC\lic98rmt.exe [2002-09-19 22:27]

S3 CA_LIC_SRVR;CA-Lizenzserver;C:\Programme\CA\SharedComponents\CA_LIC\lic98rmtd.exe [2002-09-19 22:41]

S3 CardReaderFilter;Card Reader Filter;C:\WINDOWS\system32\Drivers\USBCRFT.SYS [2008-02-08 16:31]

S3 cmudau;C-Media USB Sound Interface;C:\WINDOWS\system32\drivers\cmudau.sys [2005-06-22 10:26]

S3 cmudax;C-Media High Definition Audio Interface;C:\WINDOWS\system32\drivers\cmudax.sys [2004-10-01 13:58]

S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;C:\MAGIX\Common\Database\bin\fbserver.exe [2005-11-17 14:18]

S3 jatmlano;jatmlano;C:\DOKUME~1\PATRIC~1\LOKALE~1\Temp\jatmlano.sys []

S3 wbscr;Winbond Smartcard Reader for I/O;C:\WINDOWS\system32\drivers\wbscr.sys [2002-04-24 11:07]
 

.

Inhalt des "geplante Tasks" Ordners

"2008-02-08 08:00:00 C:\WINDOWS\Tasks\Neuer Task.job"

- C:\Programme\Empire Interactive\FlatOut Demo\FlatOutDemo.exe

.

**************************************************************************
 

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-02-08 16:30:46

Windows 5.1.2600 Service Pack 2 NTFS
 

Scanne versteckte Prozesse...
 

Scanne versteckte Autostart Eintr„ge...
 

Scanne versteckte Dateien...
 

Scan erfolgreich abgeschlossen 

versteckte Dateien: 0 
 

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------
 

PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.2180]

-> C:\Programme\Ashampoo\Ashampoo FireWall\spi.dll
 

PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2900.3156]

-> C:\WINDOWS\HKCYDLL.dll

.

------------------------ Other Running Processes ------------------------

.

C:\WINDOWS\System32\SCardSvr.exe

C:\Programme\IVT Corporation\BlueSoleil\BTNtService.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\UAService7.exe

C:\Programme\Windows Media Player\WMPNetwk.exe

C:\Programme\Stardock\Object Desktop\WindowBlinds\wbload.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\system32\RunDll32.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexStoreSvr.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2008-02-08 16:35:33 - machine was rebooted

ComboFix-quarantined-files.txt  2008-02-08 15:35:28

.

2008-01-09 10:49:50        --- E O F ---