Trojaner-Board - Trojan-PSW.Win32.nilage.bvl Malewarebefall

Hi,

wollte das Programm "Regcleaner" installieren. Herauskam ein massiver Malwarebefall. Programm umging sofort G-Data Antivir (akuteller Stand) und meine Firewall Zonealarm (aktueller Stand)

System: Windows XP Prof, SP 2, Updates alle auf aktuellem Stand.

Virus befällt sofort auch USB Sticks etc. Internetzugang nicht mehr möglich. Alle Programme wie Hijack etc werden geblockt. Firewall und Virenprogramme lass sich nicht mehr starten: "Keine zulässige Win32-Anwendung bla bla".

Wie ihr drauf hinweist hab ich mich durch millionen Forenseiten gekämpft. Mit umbennen und diversen Tools hab ich zumindest geschafft endlich Logfiles erstellen zu können

Bisher is über diesen Virus nichts zu finden. Auser bei Kaspersky mit dem Hinweis das er nicht entfernt werden kann. Vielen Dank.

Hier mal die Logs von Hijack und Combofix und Trojan Remover

Code:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 21:56:13, on 13.08.2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16674)

Boot mode: Normal
 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\Explorer.EXE

C:\Scope_4_5\app\bin\sfp.exe

C:\WINDOWS\system32\LVCOMSX.EXE

C:\Programme\Gemeinsame Dateien\G DATA\AVKMail\AVKPOP.EXE

C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe

C:\WINDOWS\system32\ctfmon.exe

c:\programme\avira\antivir personaledition classic\avcenter.exe

C:\Programme\Avira\AntiVir PersonalEdition Classic\avscan.exe

C:\Programme\lecker\HijackThis.exe
 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www. **.com/home.php

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go. **.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go. **.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go. **com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go. ** com/fwlink/?LinkId=69157

O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - (no file)

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_03\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [InitPulsar] C:/Scope_4_5/app/bin/sfp.exe -s

O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE

O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe"

O4 - HKLM\..\Run: [TrojanScanner] C:\Programme\PETERPAN\Trjscan.exe

O4 - HKLM\..\Run: [AVK Mail Checker] "C:\Programme\Gemeinsame Dateien\G DATA\AVKMail\AVKPOP.EXE"

O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKALER DIENST')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETZWERKDIENST')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe (file missing)

O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe (file missing)

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe

O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe

O16 - DPF: {26FCCDF9-A7E1-452A-A73D-7BF7B4D0BA6C} (AOL Pictures Uploader Class) - http://o.aolcdn.com/pictures/ap/Resources/v2.15/cab/aolpPlugins.10.6.0.8.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1203038748468

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6u3-windows-i586-jc.cab

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL

O23 - Service: Adobe LM Service - Unknown owner - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Avira AntiVir Personal - Free Antivirus Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: ServiceLayer - Nokia. - C:\Programme\Gemeinsame Dateien\PCSuite\Services\ServiceLayer.exe

O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
 

--

End of file - 6205 bytes

Combofix

Code:

ComboFix 08-08-12.01 - Andy 2008-08-13 18:59:42.1 - NTFSx86

Microsoft Windows XP Professional  5.1.2600.2.1252.1.1031.18.1723 [GMT 2:00]

ausgeführt von:: E:\3.exe

 * Neuer Wiederherstellungspunkt wurde erstellt
 
 Achtung - Auf diesem PC ist keine Wiederherstellungskonsole installiert !!

.
 

((((((((((((((((((((((((((((((((((((   Weitere L”schungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.
 

C:\WINDOWS\system32\drivers\downld
 

.

(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))

.
 

-------\Legacy_SROSA
 
 

(((((((((((((((((((((((   Dateien erstellt von 2008-07-13 bis 2008-08-13  ))))))))))))))))))))))))))))))

.
 

2008-08-13 18:54 . 2008-08-13 18:54        <DIR>        d--------        C:\Programme\lecker

2008-08-13 18:48 . 2004-07-20 02:04        708,616        --a------        C:\WINDOWS\system32\drivers\mdelk.exe.vir

2008-08-13 18:39 . 2008-08-13 18:30        120,084        --a------        C:\WINDOWS\system32\drivers\srosa.sys.vir

2008-08-13 18:38 . 2008-08-13 18:39        <DIR>        d--------        C:\Programme\PETERPAN

2008-08-13 18:38 . 2008-08-13 18:38        <DIR>        d--------        C:\Dokumente und Einstellungen\Andy\Anwendungsdaten\Simply Super Software

2008-08-13 18:38 . 2008-08-13 18:38        <DIR>        d--------        C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Simply Super Software

2008-08-13 18:38 . 2006-05-25 15:52        162,304        --a------        C:\WINDOWS\system32\ztvunrar36.dll

2008-08-13 18:38 . 2003-02-02 20:06        153,088        --a------        C:\WINDOWS\system32\UNRAR3.dll

2008-08-13 18:38 . 2005-08-26 01:50        77,312        --a------        C:\WINDOWS\system32\ztvunace26.dll

2008-08-13 18:38 . 2002-03-06 01:00        75,264        --a------        C:\WINDOWS\system32\unacev2.dll

2008-08-13 18:38 . 2006-06-19 13:01        69,632        --a------        C:\WINDOWS\system32\ztvcabinet.dll

2008-08-13 18:23 . 2008-08-13 18:23        139,264        --a------        C:\WINDOWS\~GLC000b.TMP

2008-08-13 18:23 . 2008-08-13 18:23        0        --a------        C:\WINDOWS\~GLH000a.TMP

2008-08-13 13:54 . 2008-08-13 13:54        <DIR>        d--------        C:\Programme\tooggo

2008-08-13 13:54 . 2008-08-13 13:54        <DIR>        d--------        C:\Dokumente und Einstellungen\Andy\Anwendungsdaten\PC Tools

2008-08-13 13:54 . 2008-08-13 18:58        <DIR>        d-a------        C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP

2008-08-13 00:09 . 2008-08-13 13:54        <DIR>        d--------        C:\Programme\Spyware Doctor

2008-08-13 00:09 . 2008-06-10 21:22        81,288        --a------        C:\WINDOWS\system32\drivers\iksyssec.sys

2008-08-13 00:09 . 2008-06-02 15:19        66,952        --a------        C:\WINDOWS\system32\drivers\iksysflt.sys

2008-08-13 00:09 . 2008-06-02 15:19        42,376        --a------        C:\WINDOWS\system32\drivers\ikfilesec.sys

2008-08-13 00:09 . 2008-06-02 15:19        29,576        --a------        C:\WINDOWS\system32\drivers\kcom.sys

2008-08-12 23:08 . 2008-08-12 23:08        <DIR>        d--------        C:\Dokumente und Einstellungen\Michi\Anwendungsdaten\RegClean

2008-08-12 23:03 . 2008-08-12 23:03        <DIR>        d--------        C:\Programme\CCleaner

2008-08-12 22:58 . 2008-08-12 22:58        139,264        --a------        C:\WINDOWS\~GLC000a.TMP

2008-08-12 22:58 . 2008-08-12 22:58        139,264        --a------        C:\WINDOWS\~GLC0009.TMP

2008-08-12 22:58 . 2008-08-12 22:58        139,264        --a------        C:\WINDOWS\~GLC0008.TMP

2008-08-12 22:58 . 2008-08-12 22:58        0        --a------        C:\WINDOWS\~GLH0009.TMP

2008-08-12 22:58 . 2008-08-12 22:58        0        --a------        C:\WINDOWS\~GLH0008.TMP

2008-08-12 22:58 . 2008-08-12 22:58        0        --a------        C:\WINDOWS\~GLH0007.TMP

2008-08-12 22:57 . 2008-08-12 22:57        139,264        --a------        C:\WINDOWS\~GLC0007.TMP

2008-08-12 22:57 . 2008-08-12 22:57        139,264        --a------        C:\WINDOWS\~GLC0006.TMP

2008-08-12 22:57 . 2008-08-12 22:57        139,264        --a------        C:\WINDOWS\~GLC0005.TMP

2008-08-12 22:57 . 2008-08-12 22:57        139,264        --a------        C:\WINDOWS\~GLC0004.TMP

2008-08-12 22:57 . 2008-08-12 22:57        139,264        --a------        C:\WINDOWS\~GLC0003.TMP

2008-08-12 22:57 . 2008-08-12 22:57        0        --a------        C:\WINDOWS\~GLH0006.TMP

2008-08-12 22:57 . 2008-08-12 22:57        0        --a------        C:\WINDOWS\~GLH0005.TMP

2008-08-12 22:57 . 2008-08-12 22:57        0        --a------        C:\WINDOWS\~GLH0004.TMP

2008-08-12 22:57 . 2008-08-12 22:57        0        --a------        C:\WINDOWS\~GLH0003.TMP

2008-08-12 22:57 . 2008-08-12 22:57        0        --a------        C:\WINDOWS\~GLH0002.TMP

2008-08-12 22:37 . 2008-08-12 22:37        139,264        --a------        C:\WINDOWS\~GLC0002.TMP

2008-08-12 22:37 . 2008-08-12 22:37        139,264        --a------        C:\WINDOWS\~GLC0001.TMP

2008-08-12 22:37 . 2008-08-12 22:37        0        --a------        C:\WINDOWS\~GLH0001.TMP

2008-08-12 22:37 . 2008-08-12 22:37        0        --a------        C:\WINDOWS\~GLH0000.TMP

2008-08-12 22:02 . 2008-08-12 22:02        139,264        --a------        C:\WINDOWS\~GLC0000.TMP

2008-08-12 21:11 . 2008-08-12 21:25        <DIR>        d--------        C:\Programme\eMule49

2008-08-12 20:59 . 2008-08-13 13:54        <DIR>        d--------        C:\Programme\RegClean

2008-08-12 20:59 . 2008-08-12 21:06        <DIR>        d--------        C:\Dokumente und Einstellungen\Andy\Anwendungsdaten\RegClean

2008-08-12 19:15 . 2008-08-12 19:15        244        --ah-----        C:\sqmnoopt02.sqm

2008-08-12 19:15 . 2008-08-12 19:15        232        --ah-----        C:\sqmdata02.sqm

2008-08-11 13:25 . 2008-02-15 02:50        <DIR>        d--h-----        C:\Dokumente und Einstellungen\Michi\Vorlagen

2008-08-11 13:25 . 2008-02-15 02:43        <DIR>        dr-------        C:\Dokumente und Einstellungen\Michi\Startmen

2008-08-11 13:25 . 2008-02-15 02:43        <DIR>        d--h-----        C:\Dokumente und Einstellungen\Michi\Netzwerkumgebung

2008-08-11 13:25 . 2008-08-13 19:01        <DIR>        d--h-----        C:\Dokumente und Einstellungen\Michi\Lokale Einstellungen

2008-08-11 13:25 . 2008-08-11 13:25        <DIR>        dr-------        C:\Dokumente und Einstellungen\Michi\Favoriten

2008-08-11 13:25 . 2008-08-11 13:25        <DIR>        dr-------        C:\Dokumente und Einstellungen\Michi\Eigene Dateien

2008-08-11 13:25 . 2008-02-15 02:43        <DIR>        d--h-----        C:\Dokumente und Einstellungen\Michi\Druckumgebung

2008-08-11 13:25 . 2008-08-12 23:08        <DIR>        dr-h-----        C:\Dokumente und Einstellungen\Michi\Anwendungsdaten

2008-08-11 13:25 . 2008-08-11 13:25        <DIR>        d--------        C:\Dokumente und Einstellungen\Michi

2008-08-04 20:47 . 2008-08-04 20:47        34        --a------        C:\WINDOWS\cdplayer.ini

2008-08-04 20:44 . 2008-08-04 20:44        <DIR>        d--------        C:\Programme\Audiograbber

2008-08-04 20:44 . 2008-08-04 20:44        <DIR>        d--------        C:\Dokumente und Einstellungen\Andy\Anwendungsdaten\AD ON Multimedia

2008-07-26 21:52 . 2008-07-26 21:53        <DIR>        d--------        C:\Dokumente und Einstellungen\Andy\Anwendungsdaten\RapidGet

2008-07-19 19:01 . 2008-07-24 20:18        <DIR>        d--------        C:\Dokumente und Einstellungen\Andy\Anwendungsdaten\Nokia

2008-07-18 13:47 . 2008-08-12 21:46        9,461,792        --ahs----        C:\WINDOWS\system32\drivers\fidbox.dat

2008-07-18 13:47 . 2008-08-12 21:46        114,596        --ahs----        C:\WINDOWS\system32\drivers\fidbox.idx

2008-07-18 13:45 . 2008-07-18 13:45        <DIR>        d--------        C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MailFrontier

2008-07-18 13:44 . 2008-07-18 13:44        <DIR>        d--------        C:\Programme\Zone Labs
 

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-08-12 20:01        ---------        d-----w        C:\Programme\PowerAntiVirus 2005

2008-08-12 19:08        ---------        d-----w        C:\Programme\eMule

2008-07-30 18:15        ---------        d-----w        C:\Dokumente und Einstellungen\Andy\Anwendungsdaten\Nokia Multimedia Player

2008-07-30 17:49        ---------        d-----w        C:\Dokumente und Einstellungen\Andy\Anwendungsdaten\OpenOffice.org2

2008-07-18 11:19        ---------        d-----w        C:\Programme\Microsoft Silverlight

2008-07-10 17:31        ---------        d--h--w        C:\Programme\InstallShield Installation Information

2008-07-10 17:31        ---------        d-----w        C:\Programme\GIGABYTE

2008-07-10 17:19        15,600        ----a-w        C:\WINDOWS\gdrv.sys

2008-07-09 07:05        75,248        ----a-w        C:\WINDOWS\zllsputility.exe

2008-07-09 07:05        42,384        ----a-w        C:\WINDOWS\zllsputility_loc0407.dll

2008-07-01 18:58        ---------        d-----w        C:\Programme\ICQ6

2008-07-01 18:58        ---------        d-----w        C:\Dokumente und Einstellungen\Andy\Anwendungsdaten\ICQ

2008-06-20 10:45        360,320        ----a-w        C:\WINDOWS\system32\drivers\tcpip.sys

2008-06-20 10:44        138,368        ----a-w        C:\WINDOWS\system32\drivers\afd.sys

2008-06-20 09:52        225,920        ----a-w        C:\WINDOWS\system32\drivers\tcpip6.sys

2008-06-14 17:57        273,024        ------w        C:\WINDOWS\system32\drivers\bthport.sys

2008-02-29 21:07        32        ----a-w        C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ezsid.dat

.
 

(((((((((((((((((((((((((((((((((((((((((((((   AWF   ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

((((((((((((((((((((((((((((   Autostart Punkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

REGEDIT4

*Hinweis* leere Eintrage & legitime Standardeintrage werden nicht angezeigt.
 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:57 15360]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 02:41 8523776]

"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2005-07-19 18:32 221184]

"AVK Mail Checker"="C:\Programme\Gemeinsame Dateien\G DATA\AVKMail\AVKPOP.EXE" [2004-10-07 17:04 364544]

"ZoneAlarm Client"="C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe" [2008-08-13 18:39 919016]

"TrojanScanner"="C:\Programme\PETERPAN\Trjscan.exe" [2008-08-13 18:39 878672]

"InitPulsar"="C:/Scope_4_5/app/bin/sfp.exe" [2004-03-18 22:32 24576 C:\Scope_4_5\App\Bin\SFP.exe]
 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 01:57 15360]
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"vidc.ffds"= ffdshow.ax

"msacm.ac3filter"= ac3filter.acm
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]

--a------ 2004-08-04 01:57 15360 C:\WINDOWS\system32\ctfmon.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001
 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001
 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001
 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]

"DisableMonitoring"=dword:00000001
 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"C:\Programme\Gemeinsame Dateien\G DATA\AVKMail\AVKPop.exe"= C:\Programme\Gemeinsame Dateien\G DATA\AVKMail\AVKPop.exe:127.0.0.1/255.255.255.255:Enabled:AntiVirenKit eMail Virenblocker

"C:\\Programme\\eMule\\emule.exe"=

"C:\\Programme\\ICQ6\\ICQ.exe"=

"C:\\WINDOWS\\system32\\sessmgr.exe"=

"C:\\Programme\\Skype\\Phone\\Skype.exe"=

"C:\\Programme\\Windows Live\\Messenger\\msnmsgr.exe"=

"C:\\Programme\\Windows Live\\Messenger\\livecall.exe"=
 

R0 hotcore3;hotcore3;C:\WINDOWS\system32\drivers\hotcore3.sys [2007-08-21 04:38]

R1 Scope;WDM Driver for Scope;C:\WINDOWS\system32\drivers\scope.sys [2002-07-05 21:19]

S3 2nixA;2nixA;c:\scope_4_5\app\sys\2nixA.sys [2002-03-09 19:17]

S3 2nixWDM;2nixWDM;c:\scope_4_5\app\sys\2nixWDM.sys [2002-03-09 19:17]

S3 GDInterceptor;GDInterceptor;C:\WINDOWS\system32\interceptor.sys [2008-03-03 19:46]

S3 HookCentre;HookCentre;C:\WINDOWS\system32\drivers\HookCentre.sys [2008-03-03 19:46]

S3 InvVxD;InvVxD;c:\scope_4_5\app\sys\InvVxD.sys [2002-03-09 19:17]

S3 KGPar2;KGPar2;c:\scope_4_5\app\sys\KGPar2.sys [2002-03-09 19:17]

S3 KGPar3;KGPar3;c:\scope_4_5\app\sys\KGPar3.sys [2002-03-09 19:17]

S3 MArrFifo;MArrFifo;c:\scope_4_5\app\sys\MArrFifo.sys [2002-03-09 19:17]

S3 MFifoArr;MFifoArr;c:\scope_4_5\app\sys\MFifoArr.sys [2002-03-09 19:17]

S3 MidiAck;MidiAck;c:\scope_4_5\app\sys\MidiAck.sys [2002-03-09 19:17]

S3 MVC2VxD;MVC2VxD;c:\scope_4_5\app\sys\MVC2VxD.sys [2002-03-09 19:17]

S3 MVCVxD;MVCVxD;c:\scope_4_5\app\sys\MVCVxD.sys [2002-03-09 19:17]

S3 PC2VxD;PC2VxD;c:\scope_4_5\app\sys\PC2VxD.sys [2002-03-09 19:17]

S3 Spl2VxD;Spl2VxD;c:\scope_4_5\app\sys\Spl2VxD.sys [2002-03-09 19:18]

S3 TPlay;TPlay;c:\scope_4_5\app\sys\TPlay.sys [2002-03-09 19:18]

S3 TPRSync;TPRSync;c:\scope_4_5\app\sys\TPRSync.sys [2002-03-09 19:18]

S3 TPSync;TPSync;c:\scope_4_5\app\sys\TPSync.sys [2002-03-09 19:18]

S3 TRec;TRec;c:\scope_4_5\app\sys\TRec.sys [2002-03-09 19:18]

S3 TRSync;TRSync;c:\scope_4_5\app\sys\TRSync.sys [2002-03-09 19:18]

S3 TStretch;TStretch;c:\scope_4_5\app\sys\TStretch.sys [2002-05-03 19:55]

S3 VDATMot;VDATMot;c:\scope_4_5\app\sys\VDATMot.sys [2002-03-09 19:18]

S3 VPlay;VPlay;c:\scope_4_5\app\sys\VPlay.sys [2002-03-09 19:18]

S3 VRec;VRec;c:\scope_4_5\app\sys\VRec.sys [2002-03-09 19:18]

S3 VSTin;VSTin;c:\scope_4_5\app\sys\VSTin.sys [2002-03-09 19:18]

S3 VSTout;VSTout;c:\scope_4_5\app\sys\VSTout.sys [2002-03-09 19:18]

S3 VSTsync;VSTsync;c:\scope_4_5\app\sys\VSTsync.sys [2002-03-09 19:18]

S3 VxD2PC;VxD2PC;c:\scope_4_5\app\sys\VxD2PC.sys [2002-03-09 19:18]

S3 WaveIn16;WaveIn16;c:\scope_4_5\app\sys\WaveIn16.sys [2002-03-09 19:18]

S3 WaveOut16;WaveOut16;c:\scope_4_5\app\sys\WaveOut16.sys [2002-04-26 21:53]

S4 AVKService;AVK Service;C:\Programme\PowerAntiVirus 2005\AVKService.exe [2008-08-13 18:39]

S4 AVKWCtl;PAV Wächter;C:\Programme\PowerAntiVirus 2005\AVKWCtl.exe [2008-08-13 18:39]
 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b6f47444-dc09-11dc-bd54-001a4dfbe97d}]

\Shell\AutoRun\command - G:\nideiect.com

\Shell\explore\Command - G:\nideiect.com

\Shell\open\Command - G:\nideiect.com

.

Inhalt des "geplante Tasks" Ordners
 

2008-08-12 C:\WINDOWS\Tasks\RegClean Scheduled Scan.job

- C:\Programme\RegClean\RegClean.exe []
 

2008-08-12 C:\WINDOWS\Tasks\RegClean Scheduled Scan.job

- C:\Programme\RegClean [2008-08-13 13:54]

.

.

------- Zus„tzlicher Scan -------

.

FireFox -: Profile - C:\Dokumente und Einstellungen\Andy\Anwendungsdaten\Mozilla\Firefox\Profiles\he7ilmdu.default\

FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.uboot.com/music/ger
 
 

**************************************************************************
 

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-08-13 19:03:31

Windows 5.1.2600 Service Pack 2 NTFS
 

Scanne versteckte Prozesse...
 

Scanne versteckte Autostart Eintr„ge...
 

Scanne versteckte Dateien...
 

Scan erfolgreich abgeschlossen

versteckte Dateien: 0
 

**************************************************************************

.

------------------------ Weitere, laufende Prozesse ------------------------

.

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\wdfmgr.exe

C:\WINDOWS\system32\wscntfy.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2008-08-13 19:06:56 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2008-08-13 17:06:53
 

Pre-Run: 10 Verzeichnis(se), 15,689,895,936 Bytes frei

Post-Run: 13 Verzeichnis(se), 17,441,374,208 Bytes frei
 

216        --- E O F ---        2008-07-17 21:07:54