Wie krieg ich "0006_regular[1].cab", oder auch "TR/HideRun.A.2" weg???
Es ist eine archivierte Datei und lässt sich lediglich erkennen.
Ich benutze Antivir- Luke Filewalker.

Ich habe gerade erst format c: hinter mir... also kann ich mir das wohl sparen.

Hallo@Vaj

aktuelles HijackThis:
http://www.downloads.subratam.org/hijackthis.zip

1.Log
Lade das Tool HijackThis:-->Button "scan" --> Button "save" --> es öffnet sich das Notepad, nun das
KOMPLETTES Log mit rechtem Mausklick abkopieren und ins Forum mit rechtem Mausklick "einfügen"--> kopieren

2.Log:
HijackThis<Config
List also minor sections (full) --««Häkchen setzen
List empty sections (complete) --««Häkchen setzen
HijackThis<Config<MiscTools<Generate StartupListlog
(es öffnet sich das Notepad [Texteditor], nun das KOMPLETTE Log abkopieren und posten)
.............................................................................................................

bei BEIDEN Logs, die ich moechte, oeffnet sich der Texteditor.

Dann musst du einfach ALLES kopieren, was da steht

mfg
Nikita

Achja übrigens... bei mir kommt ab und zu so n ekliger Gay-popup... hat das was mit dem trojaner zu tun?? Den Nachrichtendienst habe ich deaktiviert und beendet!


Logfile of HijackThis v1.98.2
Scan saved at 15:35:26, on 19.11.2003
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Programme\AVPersonal\AVWUPSRV.EXE
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\svchostings.exe
C:\WINNT\system32\internat.exe
C:\WINNT\system32\NOTEPAD.EXE
C:\Programme\Internet Explorer\IEXPLORE.EXE
C:\Programme\Skype\Phone\Skype.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Dokumente und Einstellungen\Vaj\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Start Upping] svchostings.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\RunServices: [Start Upping] svchostings.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [Start Upping] svchostings.exe
O8 - Extra context menu item: &Google Search - res://C:\Programme\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\Programme\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Programme\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://C:\Programme\Google\GoogleToolbar1.dll/cmsimilar.html
O17 - HKLM\System\CCS\Services\Tcpip\..\{3035211E-82BB-4E29-BF1C-33324DA8A57F}: NameServer = 213.148.130.10 213.148.129.10

Hallo@Vaj

Gehe in die Registry
Start<Ausfuehren<regedit

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Start Upping = svchostings.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
Start Upping = svchostings.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
Start Upping = svchostings.exe

Die folgenden Registrierungseinträge werden verändert:

HKLM\SOFTWARE\Microsoft\Ole\
EnableDCOM = "N"-->>aendere in "Y"

HKLM\SYSTEM\CurrentControlSet\Control\Lsa\
restrictanonymous = dword:00000001 -->>aendere in 0 ( dword:00000000 )


#öffne das HijackThis-->> Button "scan" -->> Häkchen setzen -->> Button "Fix checked" -->> PC neustarten

O4 - HKLM\..\Run: [Start Upping] svchostings.exe
O4 - HKLM\..\RunServices: [Start Upping] svchostings.exe
O4 - HKCU\..\Run: [Start Upping] svchostings.exe

neustarten

1.) öffne das HijackThis:
2.) HijackThis-->Config-->Misc Tools-->Delete a file on reboot
3.) kopiere rein:

C:\WINNT\system32\svchostings.exe

4.) PC startet automatisch neu.

#deinstalliere fuer 15 tage deinen Antivirus und lade:
eScan-Trial
http://www.mwti.net/antivirus/escan/esc ... ivirus.asp (15-Tage- trial-Freeversion)

<gehe in den abgesicherten Modus
http://www.tu-berlin.de/www/software/vi ... mode.shtml

klicke auf: awn2k3e.exe und scanne alles, was es zu scannen gibt.

Datentraegerbereinigung: und Löschen der Temporary-Dateien
<Start<Ausfuehren<cleanmgr
#Click:Temporäre Internet Files/Temporäre Internet Dateien, o.k.
#Click:Temporäre Dateien, o.k

Patches für die Betriebssystemschwachstellen, die von W32/Rbot-MA ausgenutzt werden, stehen von Microsoft zur Verfügung unter:

http://www.microsoft.com/technet/securi ... 4-012.mspx
http://www.microsoft.com/technet/securi ... 4-011.mspx



Dann poste das Log noch mal.

mfg
Nikita

sooo habe jetz alles so gemacht. Ich habe sogar noch einen weiteren wurm und noch einen Trojaner gefunden bzw. beide gelöscht!


StartupList report, 19.11.2003, 21:34:19
StartupList version: 1.52.2
Started from : C:\Dokumente und Einstellungen\Vaj\Desktop\HijackThis.EXE
Detected: Windows 2000 SP4 (WinNT 5.00.2195)
Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)
* Using default options
* Including empty and uninteresting sections
* Showing rarely important sections
==================================================

Running processes:

C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\PROGRA~1\eScan\TRAYSSER.EXE
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\internat.exe
C:\PROGRA~1\eScan\MAILDISP.EXE
C:\PROGRA~1\eScan\MAILSCAN.EXE
C:\PROGRA~1\eScan\SPOOLER.EXE
C:\PROGRA~1\eScan\kavss.exe
C:\WINNT\System32\locator.exe
C:\Programme\AVPersonal\AVWUPSRV.EXE
C:\Dokumente und Einstellungen\Vaj\Desktop\HijackThis.exe

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:
[C:\Dokumente und Einstellungen\Vaj\Startmenü\Programme\Autostart]
*No files*

Shell folders AltStartup:
*Folder not found*

User shell folders Startup:
*Folder not found*

User shell folders AltStartup:
*Folder not found*

Shell folders Common Startup:
[C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart]
*No files*

Shell folders Common AltStartup:
*Folder not found*

User shell folders Common Startup:
*Folder not found*

User shell folders Alternate Common Startup:
*Folder not found*

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINNT\system32\userinit.exe,

[HKLM\Software\Microsoft\Windows\CurrentVersion\Winlogon]
*Registry key not found*

[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
*Registry value not found*

[HKCU\Software\Microsoft\Windows\CurrentVersion\Winlogon]
*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

Synchronization Manager = mobsync.exe /logon
NvCplDaemon = RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
MailScan Dispatcher = "C:\Programme\eScan\LAUNCH.EXE"
eScan Updater = C:\PROGRA~1\eScan\TRAYICOS.EXE /App
eScan Monitor = C:\PROGRA~1\eScan\AVPMWrap.EXE

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

internat.exe = internat.exe

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run

*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*

--------------------------------------------------

File association entry for .EXE:
HKEY_CLASSES_ROOT\exefile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .COM:
HKEY_CLASSES_ROOT\comfile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .BAT:
HKEY_CLASSES_ROOT\batfile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .PIF:
HKEY_CLASSES_ROOT\piffile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .SCR:
HKEY_CLASSES_ROOT\scrfile\shell\open\command

(Default) = "%1" /S

--------------------------------------------------

File association entry for .HTA:
HKEY_CLASSES_ROOT\htafile\shell\open\command

(Default) = C:\WINNT\system32\mshta.exe "%1" %*

--------------------------------------------------

File association entry for .TXT:
HKEY_CLASSES_ROOT\txtfile\shell\open\command

(Default) = %SystemRoot%\system32\NOTEPAD.EXE %1

--------------------------------------------------

Enumerating Active Setup stub paths:
HKLM\Software\Microsoft\Active Setup\Installed Components
(* = disabled by HKCU twin)

[>{26923b43-4d38-484f-9b9e-de460746276c}] *
StubPath = "C:\WINNT\System32\shmgrate.exe" OCInstallUserConfigIE

[>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS] *
StubPath = RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

[>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] *
StubPath = "C:\WINNT\System32\shmgrate.exe" OCInstallUserConfigOE

[{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINNT\INF\mplayer2.inf,PerUserStub.NT

[{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install

[{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINNT\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT

[{6A5110B5-E14B-4268-A065-EF89FF33C325}] *
StubPath = regsvr32.exe /s /n /i:"S 2 true 3 true 4 true 5 true 6 true 7 true" initpki.dll

[{7790769C-0471-11d2-AF11-00C04FA35D02}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install

[{89820200-ECBD-11cf-8B85-00AA005B4340}] *
StubPath = regsvr32.exe /s /n /i:U shell32.dll

[{89820200-ECBD-11cf-8B85-00AA005B4383}] *
StubPath = %SystemRoot%\system32\ie4uinit.exe

[{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11}] *
StubPath = %SystemRoot%\system32\updcrl.exe -e -u %SystemRoot%\system32\verisignpub1.crl

--------------------------------------------------

Enumerating ICQ Agent Autostart apps:
HKCU\Software\Mirabilis\ICQ\Agent\Apps

*Registry key not found*

--------------------------------------------------

Load/Run keys from C:\WINNT\WIN.INI:

load=*INI section not found*
run=*INI section not found*

Load/Run keys from Registry:

HKLM\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKLM\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKLM\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKCU\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKCU\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\Windows: load=
HKCU\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=

--------------------------------------------------

Shell & screensaver key from C:\WINNT\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=(Kein)
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry key not found*
HKLM\..\Policies: Shell=*Registry value not found*

--------------------------------------------------

Checking for EXPLORER.EXE instances:

C:\WINNT\Explorer.exe: PRESENT!

C:\Explorer.exe: not present
C:\WINNT\Explorer\Explorer.exe: not present
C:\WINNT\System\Explorer.exe: not present
C:\WINNT\System32\Explorer.exe: not present
C:\WINNT\Command\Explorer.exe: not present
C:\WINNT\Fonts\Explorer.exe: not present

--------------------------------------------------

Checking for superhidden extensions:

.lnk: HIDDEN! (arrow overlay: yes)
.pif: HIDDEN! (arrow overlay: yes)
.exe: not hidden
.com: not hidden
.bat: not hidden
.hta: not hidden
.scr: not hidden
.shs: HIDDEN!
.shb: HIDDEN!
.vbs: not hidden
.vbe: not hidden
.wsh: not hidden
.scf: HIDDEN! (arrow overlay: NO!)
.url: HIDDEN! (arrow overlay: yes)
.js: not hidden
.jse: not hidden

--------------------------------------------------

Verifying REGEDIT.EXE integrity:

- Regedit.exe found in C:\WINNT
- .reg open command is normal (regedit.exe %1)
- Company name OK: 'Microsoft Corporation'
- Original filename OK: 'REGEDIT.EXE'
- File description: 'Registrierungs-Editor'

Registry check passed

--------------------------------------------------

Enumerating Browser Helper Objects:

(no name) - C:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
(no name) - c:\programme\google\googletoolbar1.dll - {AA58ED58-01DD-4d91-8333-CF10577473F7}

--------------------------------------------------

Enumerating Task Scheduler jobs:

*No jobs found*

--------------------------------------------------

Enumerating Download Program Files:

[DirectAnimation Java Classes]
CODEBASE = file://C:\WINNT\Java\classes\dajava.cab
OSD = C:\WINNT\Downloaded Program Files\DirectAnimation Java Classes.osd

[Microsoft XML Parser for Java]
CODEBASE = file://C:\WINNT\Java\classes\xmldso.cab
OSD = C:\WINNT\Downloaded Program Files\Microsoft XML Parser for Java.osd

[Update Class]
InProcServer32 = C:\WINNT\System32\iuctl.dll
CODEBASE = http://v4.windowsupdate.microsoft.com/C ... 5021064815

[Shockwave Flash Object]
InProcServer32 = C:\WINNT\system32\macromed\flash\Flash.ocx
CODEBASE = http://download.macromedia.com/pub/shoc ... wflash.cab

--------------------------------------------------

Enumerating Winsock LSP files:

NameSpace #1: C:\WINNT\System32\rnr20.dll
NameSpace #2: C:\WINNT\System32\winrnr.dll
Protocol #1: mwtsp.dll (file MISSING)
Protocol #2: mwtsp.dll (file MISSING)
Protocol #3: mwtsp.dll (file MISSING)
Protocol #4: mwtsp.dll (file MISSING)
Protocol #5: mwtsp.dll (file MISSING)
Protocol #6: mwtsp.dll (file MISSING)
Protocol #7: mwtsp.dll (file MISSING)
Protocol #8: mwtsp.dll (file MISSING)
Protocol #9: mwtsp.dll (file MISSING)
Protocol #10: mwtsp.dll (file MISSING)
Protocol #11: mwtsp.dll (file MISSING)
Protocol #12: mwtsp.dll (file MISSING)
Protocol #13: mwtsp.dll (file MISSING)
Protocol #14: mwtsp.dll (file MISSING)
Protocol #15: mwtsp.dll (file MISSING)
Protocol #16: mwtsp.dll (file MISSING)
Protocol #17: mwtsp.dll (file MISSING)
Protocol #18: C:\WINNT\system32\msafd.dll
Protocol #19: C:\WINNT\system32\msafd.dll
Protocol #20: C:\WINNT\system32\msafd.dll
Protocol #21: C:\WINNT\system32\rsvpsp.dll
Protocol #22: C:\WINNT\system32\rsvpsp.dll
Protocol #23: C:\WINNT\system32\msafd.dll
Protocol #24: C:\WINNT\system32\msafd.dll
Protocol #25: C:\WINNT\system32\msafd.dll
Protocol #26: C:\WINNT\system32\msafd.dll
Protocol #27: C:\WINNT\system32\msafd.dll
Protocol #28: C:\WINNT\system32\msafd.dll
Protocol #29: C:\WINNT\system32\msafd.dll
Protocol #30: C:\WINNT\system32\msafd.dll
Protocol #31: C:\WINNT\system32\msafd.dll
Protocol #32: C:\WINNT\system32\msafd.dll
Protocol #33: C:\WINNT\system32\msafd.dll
Protocol #34: C:\WINNT\system32\msafd.dll
Protocol #35: mwtsp.dll (file MISSING)

--------------------------------------------------

Enumerating Windows NT/2000/XP services

Microsoft ACPI-Treiber: System32\DRIVERS\ACPI.sys (system)
Umgebung für die AFD-Netzwerkunterstützung: \SystemRoot\System32\drivers\afd.sys (autostart)
Warndienst: %SystemRoot%\System32\services.exe (autostart)
AntiVir Service: "C:\Programme\AVPersonal\AVGUARD.EXE" (manual start)
Anwendungsverwaltung: %SystemRoot%\system32\services.exe (manual start)
Asynchroner RAS -Medientreiber: System32\DRIVERS\asyncmac.sys (manual start)
Standard-IDE/ESDI-Festplattencontroller: System32\DRIVERS\atapi.sys (system)
Protokoll für ATM ARP-Client: System32\DRIVERS\atmarpc.sys (manual start)
Audiostubtreiber: System32\DRIVERS\audstub.sys (manual start)
avgntdd: \??\C:\Programme\AVPersonal\AVGNTDD.SYS (manual start)
AntiVir Update: "C:\Programme\AVPersonal\AVWUPSRV.EXE" (autostart)
Broadcom NetXtreme Gigabit Ethernet: System32\DRIVERS\b57w2k.sys (manual start)
Intelligenter Hintergrundübertragungsdienst: %SystemRoot%\System32\svchost.exe -k BITSgroup (disabled)
Computerbrowser: %SystemRoot%\System32\services.exe (manual start)
Closed Caption Decoder: system32\DRIVERS\CCDECODE.sys (manual start)
CD-ROM-Laufwerktreiber: System32\DRIVERS\cdrom.sys (system)
Indexdienst: C:\WINNT\System32\cisvc.exe (disabled)
Ablagemappe: %SystemRoot%\system32\clipsrv.exe (manual start)
Creative Audio Driver (WDM): system32\drivers\ctaud2k.sys (manual start)
Gameport für Creative SB Live!: System32\DRIVERS\ctljystk.sys (manual start)
DHCP-Client: %SystemRoot%\System32\services.exe (manual start)
Datenträgertreiber: System32\DRIVERS\disk.sys (system)
Verwaltungsdienst für die Verwaltung logischer Datenträger: %SystemRoot%\System32\dmadmin.exe /com (manual start)
dmboot: System32\drivers\dmboot.sys (disabled)
Treiber für die Verwaltung logischer Datenträger: System32\drivers\dmio.sys (system)
dmload: System32\drivers\dmload.sys (system)
Verwaltung logischer Datenträger: %SystemRoot%\System32\services.exe (autostart)
Microsoft DirectMusic SW-Synthesizer (WDM): system32\drivers\DMusic.sys (manual start)
DNS-Client: %SystemRoot%\System32\services.exe (manual start)
eScan Server-Updater: C:\PROGRA~1\eScan\TRAYSSER.EXE (autostart)
Ereignisprotokoll: %SystemRoot%\system32\services.exe (autostart)
COM+-Ereignissystem: C:\WINNT\System32\svchost.exe -k netsvcs (manual start)
Faxdienst: %systemroot%\system32\faxsvc.exe (manual start)
Diskettencontrollertreiber: System32\DRIVERS\fdc.sys (manual start)
Diskettentreiber: System32\DRIVERS\flpydisk.sys (manual start)
Treiber für Datenträger-Manager: System32\DRIVERS\ftdisk.sys (system)
Gameport-Enumerator: System32\DRIVERS\gameenum.sys (manual start)
Standardpaketklassifizierung: System32\DRIVERS\msgpc.sys (manual start)
Creative Hardware Abstract Layer Driver: system32\drivers\ha10kx2k.sys (manual start)
Microsoft HID Class-Treiber: System32\DRIVERS\hidusb.sys (autostart)
i8042-Tastatur- und PS/2-Mausanschluss-Treiber: System32\DRIVERS\i8042prt.sys (system)
Filtertreiber für IP-Verkehr: System32\DRIVERS\ipfltdrv.sys (manual start)
IP/IP-Tunneltreiber: System32\DRIVERS\ipinip.sys (manual start)
IP-Netzwerkadressenübersetzer: System32\DRIVERS\ipnat.sys (manual start)
IPSEC-Treiber: System32\DRIVERS\ipsec.sys (manual start)
IR Enumerator Service: System32\DRIVERS\irenum.sys (manual start)
PnP-ISA/EISA-Bus-Treiber: System32\DRIVERS\isapnp.sys (system)
eScan Monitor Service: C:\PROGRA~1\eScan\avpm.exe /service (autostart)
Tastaturklassentreiber: System32\DRIVERS\kbdclass.sys (system)
Klif: \??\C:\WINNT\system32\Drivers\klif.sys (system)
Microsoft Kernel-Waveaudiomixer: system32\drivers\kmixer.sys (manual start)
Server: %SystemRoot%\System32\services.exe (manual start)
Arbeitsstationsdienst: %SystemRoot%\System32\services.exe (autostart)
TCP/IP-NetBIOS-Hilfsprogramm: %SystemRoot%\System32\services.exe (manual start)
Nachrichtendienst: %SystemRoot%\System32\services.exe (disabled)
NetMeeting-Remotedesktop-Freigabe: C:\WINNT\System32\mnmsrvc.exe (manual start)
Mausklassentreiber: System32\DRIVERS\mouclass.sys (system)
HID-Maustreiber: System32\DRIVERS\mouhid.sys (manual start)
BDA MPE Filter: system32\DRIVERS\MPE.sys (manual start)
MRXSMB: System32\DRIVERS\mrxsmb.sys (system)
Distributed Transaction Coordinator: C:\WINNT\System32\msdtc.exe (disabled)
Windows Installer: C:\WINNT\System32\MsiExec.exe /V (manual start)
Microsoft Streaming Service Proxy: system32\drivers\MSKSSRV.sys (manual start)
Microsoft Proxy für Streaming Clock: system32\drivers\MSPCLOCK.sys (manual start)
Microsoft Proxy für Streaming Quality Manager: system32\drivers\MSPQM.sys (manual start)
Microsoft Streaming Tee/Sink-to-Sink-Konvertierung: system32\drivers\MSTEE.sys (manual start)
Macronix MX987xx der Fast Ethernet-NT-Treiberfamilie: System32\DRIVERS\mxnic.sys (manual start)
NABTS/FEC VBI Codec: system32\DRIVERS\NABTSFEC.sys (manual start)
RAS-NDIS-TAPI-Treiber: System32\DRIVERS\ndistapi.sys (manual start)
NDIS-Benutzermodus-E/A-Protokoll: System32\DRIVERS\ndisuio.sys (manual start)
RAS-NDIS-WAN-Treiber: System32\DRIVERS\ndiswan.sys (manual start)
NetBIOS-Schnittstelle: System32\DRIVERS\netbios.sys (system)
NetBios über TCP/IP: System32\DRIVERS\netbt.sys (system)
Netzwerk-DDE-Dienst: %SystemRoot%\system32\netdde.exe (manual start)
Netzwerk-DDE-Serverdienst: %SystemRoot%\system32\netdde.exe (manual start)
NetDetect: \SystemRoot\system32\drivers\netdtect.sys (manual start)
Anmeldedienst: %SystemRoot%\System32\lsass.exe (manual start)
Netzwerkverbindungen: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
NT-LM-Sicherheitsdienst: %SystemRoot%\System32\lsass.exe (manual start)
Wechselmedien: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
nv: system32\DRIVERS\nv4_mini.sys (manual start)
NVIDIA Display Driver Service: %SystemRoot%\system32\nvsvc32.exe (autostart)
Filtertreiber für IPX-Verkehr: System32\DRIVERS\nwlnkflt.sys (manual start)
Treiber für IPX-Verkehrsweiterleitung: System32\DRIVERS\nwlnkfwd.sys (manual start)
Texas Instruments OHCI-konformer IEEE 1394-Hostcontroller: System32\DRIVERS\ohci1394.sys (system)
Creative OS Services Driver: system32\drivers\ctoss2k.sys (manual start)
Parallelklassentreiber: System32\DRIVERS\parallel.sys (manual start)
Treiber für parallelen Anschluss: System32\DRIVERS\parport.sys (system)
PCI-Bus-Treiber: System32\DRIVERS\pci.sys (system)
PCIIde: System32\DRIVERS\pciide.sys (system)
Plug & Play: %SystemRoot%\system32\services.exe (autostart)
IPSEC-Richtlinienagent: %SystemRoot%\System32\lsass.exe (manual start)
WAN-Miniport (PPTP): System32\DRIVERS\raspptp.sys (manual start)
Geschützter Speicher: %SystemRoot%\system32\services.exe (autostart)
Treiber für direkte Parallelverbindung: System32\DRIVERS\ptilink.sys (manual start)
PxHelp20: system32\DRIVERS\PxHelp20.sys (system)
Treiber für automatische RAS-Verbindung: System32\DRIVERS\rasacd.sys (system)
Verwaltung für automatische RAS-Verbindung: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
WAN-Miniport (L2TP): System32\DRIVERS\rasl2tp.sys (manual start)
RAS-Verbindungsverwaltung: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Parallelanschluss (direkt): System32\DRIVERS\raspti.sys (manual start)
Microsoft Streaming Network-RCA (Raw Channel Access): system32\drivers\RCA.sys (manual start)
Rdbss: System32\DRIVERS\rdbss.sys (system)
Filtertreiber für digitale CD-Audiowiedergabe: System32\DRIVERS\redbook.sys (system)
Routing und RAS: %SystemRoot%\System32\svchost.exe -k netsvcs (disabled)
Remote-Registrierungsdienst: %SystemRoot%\system32\regsvc.exe (manual start)
WAN Miniport (PPP over Ethernet Protocol): system32\DRIVERS\RMSPPPOE.SYS (manual start)
RPC-Locator: %SystemRoot%\System32\locator.exe (autostart)
Remoteprozeduraufruf (RPC): %SystemRoot%\system32\svchost -k rpcss (manual start)
QoS RSVP: %SystemRoot%\System32\rsvp.exe -s (manual start)
Sicherheitskontenverwaltung: %SystemRoot%\system32\lsass.exe (manual start)
Smartcard-Hilfsprogramm: %SystemRoot%\System32\SCardSvr.exe (manual start)
Smartcard: %SystemRoot%\System32\SCardSvr.exe (manual start)
Taskplaner: %SystemRoot%\system32\MSTask.exe (autostart)
Dienst "Ausführen als": %SystemRoot%\system32\services.exe (manual start)
Systemereignisbenachrichtigung: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Serenum-Filtertreiber: System32\DRIVERS\serenum.sys (manual start)
Treiber für seriellen Anschluss: System32\DRIVERS\serial.sys (system)
Gemeinsame Nutzung der Internetverbindung: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Silicon Image SiI 3112 SATARaid Controller: System32\DRIVERS\si3112r.sys (system)
BDA Slip De-Framer: system32\DRIVERS\SLIP.sys (manual start)
Druckwarteschlange: %SystemRoot%\system32\spoolsv.exe (autostart)
Srv: System32\DRIVERS\srv.sys (manual start)
BDA IPSink: system32\DRIVERS\StreamIP.sys (manual start)
Software-Bus-Treiber: System32\DRIVERS\swenum.sys (manual start)
Microsoft Kernel GS Wavetablesynthesizer: system32\drivers\swmidi.sys (manual start)
Microsoft System-Audiogerät: system32\drivers\sysaudio.sys (manual start)
Leistungsdatenprotokolle und Warnungen: %SystemRoot%\system32\smlogsvc.exe (manual start)
Telefonie: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
TCP/IP-Protokolltreiber: System32\DRIVERS\tcpip.sys (system)
Telnet: %SystemRoot%\system32\tlntsvr.exe (disabled)
Überwachung verteilter Verknüpfungen (Client): %SystemRoot%\system32\services.exe (manual start)
Universeller Microsoft USB-Hostcontrollertreiber: System32\DRIVERS\uhcd.sys (manual start)
Microcode Aktualisierungstreiber: System32\DRIVERS\update.sys (manual start)
Unterbrechungsfreie Spannungsversorgung: %SystemRoot%\System32\ups.exe (manual start)
Microsoft USB 2.0 Enhanced Host Controller Miniport Driver: System32\DRIVERS\usbehci.sys (manual start)
Microsoft USB-Standardhubtreiber: System32\DRIVERS\usbhub.sys (manual start)
USB 2.0 Root Hub Support: System32\DRIVERS\usbhub20.sys (manual start)
USB-Massenspeichertreiber: System32\DRIVERS\USBSTOR.SYS (manual start)
Hilfsprogramm-Manager: %SystemRoot%\System32\UtilMan.exe (manual start)
VgaSave: \SystemRoot\System32\drivers\vga.sys (system)
Windows-Zeitgeber: %SystemRoot%\System32\services.exe (manual start)
RAS-IP-ARP-Treiber: System32\DRIVERS\wanarp.sys (manual start)
Treiber für Microsoft WINMM-WDM-Audiokompatibilität: system32\drivers\wdmaud.sys (manual start)
Windows-Verwaltungsinstrumentation: %SystemRoot%\System32\WBEM\WinMgmt.exe (manual start)
Windows-Verwaltungsinstrumentations-Treibererweiterungen: %SystemRoot%\system32\Services.exe (manual start)
Windows-Socket 2.0 Non-IFS-Dienstanbieter-Unterstützungsumgebung: \SystemRoot\System32\drivers\ws2ifsl.sys (autostart)
World Standard Teletext Codec: system32\DRIVERS\WSTCODEC.SYS (manual start)
Automatische Updates: %systemroot%\system32\svchost.exe -k wugroup (autostart)
Drahtloskonfiguration: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)


--------------------------------------------------

Enumerating Windows NT logon/logoff scripts:
*No scripts set to run*

Windows NT checkdisk command:
BootExecute =

Windows NT 'Wininit.ini':
PendingFileRenameOperations: *Registry value not found*

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

Network.ConnectionTray: C:\WINNT\system32\NETSHELL.dll
WebCheck: C:\WINNT\system32\webcheck.dll
SysTray: stobject.dll

--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

*Registry key not found*

--------------------------------------------------

End of report, 28.277 bytes
Report generated in 0,094 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

Hallo@Vaj

Das Log ist sauber

So sichern Sie sich vor Viren, Trojanern und anderen ungebetenen Gästen
http://www.comsafe.de/

microsoft.public.de.security.heimanwender FAQ
http://faq.underflow.de/#SECTION000110000000000000000

#NT- Dienste sicher konfigurieren http://www.ntsvcfg.de/ oder www.dingens.org


Gruss
Nikita

Man bin ich froh... kann dir garnich genug danken

Allein hätt ich das nich hingekriegt. So was hartnäckiges hatte ich noch nie bisher!

Vielen vielen Dank

Vaj = Vajra? Bist Du das, Vajra / Schweiz? *g* &

noe bin ich nich...aber mein name wird auch von dem anime/manga Genocyber abgeleitet in dem der sog. Vajranoid sein Unwesen treibt

ich hab das gleiche problem wie Vaj .....
meine logs
1:
Logfile of HijackThis v1.99.0
Scan saved at 23:08:51, on 19.01.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\AVPersonal\AVGUARD.EXE
C:\Programme\AVPersonal\AVWUPSRV.EXE
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
C:\Programme\AVPersonal\AVGNT.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Ventrilo\Ventrilo.exe
C:\Programme\Winamp\Winamp.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Programme\WinRAR\WinRAR.exe
C:\DOKUME~1\TEH-XZ~1\LOKALE~1\Temp\Rar$EX00.469\HijackThis.exe

R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {34DEDCB8-1C23-1B84-5137-4B3654EDAFC0} - C:\WINDOWS\System32\rmfq.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Programme\Gemeinsame Dateien\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Win32 SSL Driver] winssv.exe
O4 - HKLM\..\Run: [USBHWDRV] C:\sst4.exe
O4 - HKLM\..\Run: [DeskAd Service] C:\Program Files\DeskAd Service\DeskAdServ.exe
O4 - HKLM\..\Run: [AVGCtrl] C:\Programme\AVPersonal\AVGNT.EXE /min
O4 - HKLM\..\RunServices: [Win32 SSL Driver] winssv.exe
O4 - HKLM\..\RunOnce: [Win32 SSL Driver] winssv.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Win32 SSL Driver] winssv.exe
O4 - HKCU\..\Run: [Fvfmqgc] C:\WINDOWS\System32\??oolsv.exe
O4 - HKCU\..\RunOnce: [Win32 SSL Driver] winssv.exe
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe (file missing)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v ... 1056968936
O23 - Service: AntiVir Service - H+BEDV Datentechnik GmbH - C:\Programme\AVPersonal\AVGUARD.EXE
O23 - Service: AntiVir Update - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe
O23 - Service: NVIDIA Driver Helper Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ScriptBlocking Service - Symantec Corporation - C:\PROGRA~1\GEMEIN~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe

2:
StartupList report, 19.01.2005, 23:11:34
StartupList version: 1.52.2
Started from : C:\DOKUME~1\TEH-XZ~1\LOKALE~1\Temp\Rar$EX19.984\HijackThis.EXE
Detected: Windows XP SP2 (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 SP2 (6.00.2900.2180)
* Using default options
* Including empty and uninteresting sections
* Showing rarely important sections
==================================================

Running processes:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\AVPersonal\AVGUARD.EXE
C:\Programme\AVPersonal\AVWUPSRV.EXE
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
C:\Programme\AVPersonal\AVGNT.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Ventrilo\Ventrilo.exe
C:\Programme\Winamp\Winamp.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Programme\WinRAR\WinRAR.exe
C:\DOKUME~1\TEH-XZ~1\LOKALE~1\Temp\Rar$EX19.984\HijackThis.exe

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:
[C:\Dokumente und Einstellungen\teh-xzyther\Startmenü\Programme\Autostart]
*No files*

Shell folders AltStartup:
*Folder not found*

User shell folders Startup:
*Folder not found*

User shell folders AltStartup:
*Folder not found*

Shell folders Common Startup:
[C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart]
*No files*

Shell folders Common AltStartup:
*Folder not found*

User shell folders Common Startup:
*Folder not found*

User shell folders Alternate Common Startup:
*Folder not found*

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,

[HKLM\Software\Microsoft\Windows\CurrentVersion\Winlogon]
*Registry key not found*

[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
*Registry value not found*

[HKCU\Software\Microsoft\Windows\CurrentVersion\Winlogon]
*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

NvCplDaemon = RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
Symantec NetDriver Monitor = C:\PROGRA~1\SYMNET~1\SNDMon.exe
SSC_UserPrompt = C:\Programme\Gemeinsame Dateien\Symantec Shared\Security Center\UsrPrmpt.exe
Win32 SSL Driver = winssv.exe

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce

Win32 SSL Driver = winssv.exe

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

Win32 SSL Driver = winssv.exe

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

CTFMON.EXE = C:\WINDOWS\system32\ctfmon.exe
Win32 SSL Driver = winssv.exe
Fvfmqgc = C:\WINDOWS\System32\??oolsv.exe
Steam =

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce

Win32 SSL Driver = winssv.exe

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run

*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*

--------------------------------------------------

File association entry for .EXE:
HKEY_CLASSES_ROOT\exefile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .COM:
HKEY_CLASSES_ROOT\comfile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .BAT:
HKEY_CLASSES_ROOT\batfile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .PIF:
HKEY_CLASSES_ROOT\piffile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .SCR:
HKEY_CLASSES_ROOT\scrfile\shell\open\command

(Default) = "%1" /S

--------------------------------------------------

File association entry for .HTA:
HKEY_CLASSES_ROOT\htafile\shell\open\command

(Default) = C:\WINDOWS\System32\mshta.exe "%1" %*

--------------------------------------------------

File association entry for .TXT:
HKEY_CLASSES_ROOT\txtfile\shell\open\command

(Default) = %SystemRoot%\system32\NOTEPAD.EXE %1

--------------------------------------------------

Enumerating Active Setup stub paths:
HKLM\Software\Microsoft\Active Setup\Installed Components
(* = disabled by HKCU twin)

[>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
StubPath = C:\WINDOWS\inf\unregmp2.exe /ShowWMP

[>{26923b43-4d38-484f-9b9e-de460746276c}] *
StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE

[>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS] *
StubPath = RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

[>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] *
StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

[{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] *
StubPath = %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

[{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install

[{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT

[{5945c046-1e7d-11d1-bc44-00c04fd912be}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser

[{6BF52A52-394A-11d3-B153-00C04F79FAA6}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub

[{7790769C-0471-11d2-AF11-00C04FA35D02}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install

[{89820200-ECBD-11cf-8B85-00AA005B4340}] *
StubPath = regsvr32.exe /s /n /i:U shell32.dll

[{89820200-ECBD-11cf-8B85-00AA005B4383}] *
StubPath = %SystemRoot%\system32\ie4uinit.exe

--------------------------------------------------

Enumerating ICQ Agent Autostart apps:
HKCU\Software\Mirabilis\ICQ\Agent\Apps

*Registry key not found*

--------------------------------------------------

Load/Run keys from C:\WINDOWS\WIN.INI:

load=*INI section not found*
run=*INI section not found*

Load/Run keys from Registry:

HKLM\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKLM\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKLM\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKCU\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKCU\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\Windows: load=
HKCU\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\System32\logon.scr
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry key not found*
HKLM\..\Policies: Shell=*Registry value not found*

--------------------------------------------------

Checking for EXPLORER.EXE instances:

C:\WINDOWS\Explorer.exe: PRESENT!

C:\Explorer.exe: not present
C:\WINDOWS\Explorer\Explorer.exe: not present
C:\WINDOWS\System\Explorer.exe: not present
C:\WINDOWS\System32\Explorer.exe: not present
C:\WINDOWS\Command\Explorer.exe: not present
C:\WINDOWS\Fonts\Explorer.exe: not present

--------------------------------------------------

Checking for superhidden extensions:

.lnk: HIDDEN! (arrow overlay: yes)
.pif: HIDDEN! (arrow overlay: yes)
.exe: not hidden
.com: not hidden
.bat: not hidden
.hta: not hidden
.scr: not hidden
.shs: HIDDEN!
.shb: HIDDEN!
.vbs: not hidden
.vbe: not hidden
.wsh: not hidden
.scf: HIDDEN! (arrow overlay: NO!)
.url: HIDDEN! (arrow overlay: yes)
.js: not hidden
.jse: not hidden

--------------------------------------------------

Verifying REGEDIT.EXE integrity:

- Regedit.exe found in C:\WINDOWS
- .reg open command is normal (regedit.exe %1)
- Company name OK: 'Microsoft Corporation'
- Original filename OK: 'REGEDIT.EXE'
- File description: 'Registrierungs-Editor'

Registry check passed

--------------------------------------------------

Enumerating Browser Helper Objects:

(no name) - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
(no name) - C:\WINDOWS\System32\rmfq.dll - {34DEDCB8-1C23-1B84-5137-4B3654EDAFC0}

--------------------------------------------------

Enumerating Task Scheduler jobs:

1-Klick-Wartung.job
Symantec NetDetect.job

--------------------------------------------------

Enumerating Download Program Files:

[{33564D57-0000-0010-8000-00AA00389B71}]
CODEBASE = http://download.microsoft.com/download/ ... mv9VCM.CAB

[WUWebControl Class]
InProcServer32 = C:\WINDOWS\System32\wuweb.dll
CODEBASE = http://v5.windowsupdate.microsoft.com/v ... 1056968936

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\system32\macromed\flash\flash.ocx
CODEBASE = http://download.macromedia.com/pub/shoc ... wflash.cab

--------------------------------------------------

Enumerating Winsock LSP files:

NameSpace #1: C:\WINDOWS\System32\mswsock.dll
NameSpace #2: C:\WINDOWS\System32\winrnr.dll
NameSpace #3: C:\WINDOWS\System32\mswsock.dll
Protocol #1: C:\WINDOWS\system32\mswsock.dll
Protocol #2: C:\WINDOWS\system32\mswsock.dll
Protocol #3: C:\WINDOWS\system32\mswsock.dll
Protocol #4: C:\WINDOWS\system32\rsvpsp.dll
Protocol #5: C:\WINDOWS\system32\rsvpsp.dll
Protocol #6: C:\WINDOWS\system32\mswsock.dll
Protocol #7: C:\WINDOWS\system32\mswsock.dll
Protocol #8: C:\WINDOWS\system32\mswsock.dll
Protocol #9: C:\WINDOWS\system32\mswsock.dll
Protocol #10: C:\WINDOWS\system32\mswsock.dll
Protocol #11: C:\WINDOWS\system32\mswsock.dll

--------------------------------------------------

Enumerating Windows NT/2000/XP services

Intel(r) 82801 Audiotreiber-Installationsdienst (WDM): system32\drivers\ac97intc.sys (manual start)
Microsoft ACPI-Treiber: System32\DRIVERS\ACPI.sys (system)
Microsoft Kernel-Echounterdrückung: system32\drivers\aec.sys (manual start)
Umgebung für die AFD-Netzwerkunterstützung: \SystemRoot\System32\drivers\afd.sys (system)
Intel AGP-Bus-Filter: System32\DRIVERS\agp440.sys (system)
Warndienst: %SystemRoot%\System32\svchost.exe -k LocalService (disabled)
Gatewaydienst auf Anwendungsebene: %SystemRoot%\System32\alg.exe (manual start)
AntiVir Service: C:\Programme\AVPersonal\AVGUARD.EXE (autostart)
Anwendungsverwaltung: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
Asynchroner RAS -Medientreiber: System32\DRIVERS\asyncmac.sys (manual start)
Standard-IDE/ESDI-Festplattencontroller: System32\DRIVERS\atapi.sys (system)
Protokoll für ATM ARP-Client: System32\DRIVERS\atmarpc.sys (manual start)
Windows Audio: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Audiostubtreiber: System32\DRIVERS\audstub.sys (manual start)
avgntdd: \??\C:\Programme\AVPersonal\AVGNTDD.SYS (manual start)
AntiVir Update: "C:\Programme\AVPersonal\AVWUPSRV.EXE" (autostart)
Intelligenter Hintergrundübertragungsdienst: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Computerbrowser: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Symantec Event Manager: "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe" (autostart)
Symantec Password Validation: "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccPwdSvc.exe" (manual start)
Symantec Settings Manager: "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe" (autostart)
CD-ROM-Laufwerktreiber: System32\DRIVERS\cdrom.sys (system)
Indexdienst: C:\WINDOWS\System32\cisvc.exe (manual start)
Ablagemappe: %SystemRoot%\system32\clipsrv.exe (disabled)
COM+-Systemanwendung: C:\WINDOWS\System32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235} (manual start)
Kryptografiedienste: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
DCOM-Server-Prozessstart: %SystemRoot%\system32\svchost -k DcomLaunch (autostart)
DHCP-Client: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Laufwerktreiber: System32\DRIVERS\disk.sys (system)
Verwaltungsdienst für die Verwaltung logischer Datenträger: %SystemRoot%\System32\dmadmin.exe /com (manual start)
dmboot: System32\drivers\dmboot.sys (disabled)
Treiber für die Verwaltung logischer Datenträger: System32\drivers\dmio.sys (system)
dmload: System32\drivers\dmload.sys (system)
Verwaltung logischer Datenträger: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Microsoft Kernel-DLS-Synthesizer: system32\drivers\DMusic.sys (manual start)
DNS-Client: %SystemRoot%\System32\svchost.exe -k NetworkService (autostart)
Microsoft Kernel-DRM-Audioentschlüsselung: system32\drivers\drmkaud.sys (manual start)
Fehlerberichterstattungsdienst: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Ereignisprotokoll: %SystemRoot%\system32\services.exe (autostart)
COM+-Ereignissystem: C:\WINDOWS\System32\svchost.exe -k netsvcs (manual start)
Kompatibilität für schnelle Benutzerumschaltung: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Diskettencontrollertreiber: System32\DRIVERS\fdc.sys (manual start)
Diskettenlaufwerktreiber: System32\DRIVERS\flpydisk.sys (manual start)
FltMgr: system32\drivers\fltmgr.sys (system)
Treiber für Volume-Manager: System32\DRIVERS\ftdisk.sys (system)
Gameport-Enumerator: System32\DRIVERS\gameenum.sys (manual start)
Standardpaketklassifizierung: System32\DRIVERS\msgpc.sys (manual start)
Hilfe und Support: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Eingabegerätezugang: %SystemRoot%\System32\svchost.exe -k netsvcs (disabled)
HTTP: System32\Drivers\HTTP.sys (manual start)
HTTP-SSL: %SystemRoot%\System32\svchost.exe -k HTTPFilter (manual start)
i8042-Tastatur- und PS/2-Mausanschluss-Treiber: System32\DRIVERS\i8042prt.sys (system)
IMAPI-CD-Brenn-COM-Dienste: C:\WINDOWS\System32\imapi.exe (manual start)
IntelIde: System32\DRIVERS\intelide.sys (system)
IPv6-Windows-Firewalltreiber: system32\drivers\ip6fw.sys (manual start)
Filtertreiber für IP-Verkehr: System32\DRIVERS\ipfltdrv.sys (manual start)
IP/IP-Tunneltreiber: System32\DRIVERS\ipinip.sys (manual start)
Übersetzer für IP-Netzwerkadressen: System32\DRIVERS\ipnat.sys (manual start)
IPSEC-Treiber: System32\DRIVERS\ipsec.sys (system)
IR-Enumeratordienst: System32\DRIVERS\irenum.sys (manual start)
PnP-ISA/EISA-Bus-Treiber: System32\DRIVERS\isapnp.sys (system)
Tastaturklassentreiber: System32\DRIVERS\kbdclass.sys (system)
Microsoft Kernel-Waveaudiomixer: system32\drivers\kmixer.sys (manual start)
Server: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Arbeitsstationsdienst: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
TCP/IP-NetBIOS-Hilfsprogramm: %SystemRoot%\System32\svchost.exe -k LocalService (autostart)
Nachrichtendienst: %SystemRoot%\System32\svchost.exe -k netsvcs (disabled)
NetMeeting-Remotedesktop-Freigabe: C:\WINDOWS\System32\mnmsrvc.exe (manual start)
Mausklassentreiber: System32\DRIVERS\mouclass.sys (system)
Redirector für WebDav-Client: System32\DRIVERS\mrxdav.sys (manual start)
MRXSMB: System32\DRIVERS\mrxsmb.sys (system)
Distributed Transaction Coordinator: C:\WINDOWS\System32\msdtc.exe (manual start)
Windows Installer: C:\WINDOWS\System32\msiexec.exe /V (manual start)
Microsoft Streaming Service Proxy: system32\drivers\MSKSSRV.sys (manual start)
Microsoft Proxy für Streaming Clock: system32\drivers\MSPCLOCK.sys (manual start)
Microsoft Proxy für Streaming Quality Manager: system32\drivers\MSPQM.sys (manual start)
Microsoft-Systemverwaltungs-BIOS-Treiber: System32\DRIVERS\mssmbios.sys (manual start)
RAS-NDIS-TAPI-Treiber: System32\DRIVERS\ndistapi.sys (manual start)
NDIS-Benutzermodus-E/A-Protokoll: System32\DRIVERS\ndisuio.sys (manual start)
RAS-NDIS-WAN-Treiber: System32\DRIVERS\ndiswan.sys (manual start)
NetBIOS-Schnittstelle: System32\DRIVERS\netbios.sys (system)
NetBios über TCP/IP: System32\DRIVERS\netbt.sys (system)
Netzwerk-DDE-Dienst: %SystemRoot%\system32\netdde.exe (disabled)
Netzwerk-DDE-Serverdienst: %SystemRoot%\system32\netdde.exe (disabled)
Anmeldedienst: %SystemRoot%\System32\lsass.exe (manual start)
Netzwerkverbindungen: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
NLA (Network Location Awareness): %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
NT-LM-Sicherheitsdienst: %SystemRoot%\System32\lsass.exe (manual start)
Wechselmedien: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
nv: System32\DRIVERS\nv4_mini.sys (manual start)
NVIDIA Driver Helper Service: %SystemRoot%\System32\nvsvc32.exe (autostart)
Filtertreiber für IPX-Verkehr: System32\DRIVERS\nwlnkflt.sys (manual start)
Treiber für IPX-Verkehrsweiterleitung: System32\DRIVERS\nwlnkfwd.sys (manual start)
Treiber für parallelen Anschluss: System32\DRIVERS\parport.sys (manual start)
PCI-Bus-Treiber: System32\DRIVERS\pci.sys (system)
Plug & Play: %SystemRoot%\system32\services.exe (autostart)
IPSEC-Dienste: %SystemRoot%\System32\lsass.exe (autostart)
WAN-Miniport (PPTP): System32\DRIVERS\raspptp.sys (manual start)
Prozessortreiber: System32\DRIVERS\processr.sys (system)
Geschützter Speicher: %SystemRoot%\system32\lsass.exe (autostart)
QoS-Paketplaner: System32\DRIVERS\psched.sys (manual start)
Treiber für direkte Parallelverbindung: System32\DRIVERS\ptilink.sys (manual start)
PxHelp20: System32\DRIVERS\PxHelp20.sys (system)
Treiber für automatische RAS-Verbindung: System32\DRIVERS\rasacd.sys (system)
Verwaltung für automatische RAS-Verbindung: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
WAN-Miniport (L2TP): System32\DRIVERS\rasl2tp.sys (manual start)
RAS-Verbindungsverwaltung: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Remotezugriff-PPPOE-Treiber: System32\DRIVERS\raspppoe.sys (manual start)
Parallelanschluss (direkt): System32\DRIVERS\raspti.sys (manual start)
Rdbss: System32\DRIVERS\rdbss.sys (system)
RDPCDD: System32\DRIVERS\RDPCDD.sys (system)
Treiber für Terminalserver-Geräteumleitung: System32\DRIVERS\rdpdr.sys (manual start)
Sitzungs-Manager für Remotedesktophilfe: C:\WINDOWS\system32\sessmgr.exe (manual start)
Filtertreiber für digitale CD-Audiowiedergabe: System32\DRIVERS\redbook.sys (system)
Routing und RAS: %SystemRoot%\System32\svchost.exe -k netsvcs (disabled)
Remote-Registrierung: %SystemRoot%\system32\svchost.exe -k LocalService (autostart)
RPC-Locator: %SystemRoot%\System32\locator.exe (manual start)
Remoteprozeduraufruf (RPC): %SystemRoot%\system32\svchost -k rpcss (autostart)
QoS-RSVP: %SystemRoot%\System32\rsvp.exe (manual start)
NT-Treiber für Realtek RTL8139(A/B/C)-basierten PCI-Fast Ethernetadapter: System32\DRIVERS\RTL8139.SYS (manual start)
Sicherheitskontenverwaltung: %SystemRoot%\system32\lsass.exe (autostart)
ScriptBlocking Service: C:\PROGRA~1\GEMEIN~1\SYMANT~1\SCRIPT~1\SBServ.exe (autostart)
Smartcard: %SystemRoot%\System32\SCardSvr.exe (manual start)
Taskplaner: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Secdrv: System32\DRIVERS\secdrv.sys (manual start)
Sekundäre Anmeldung: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Systemereignisbenachrichtigung: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Serenum-Filtertreiber: System32\DRIVERS\serenum.sys (manual start)
Treiber für seriellen Anschluss: System32\DRIVERS\serial.sys (system)
Windows-Firewall/Gemeinsame Nutzung der Internetverbindung: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Shellhardwareerkennung: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Symantec Network Drivers Service: C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe (manual start)
SPBBCDrv: \??\C:\Programme\Gemeinsame Dateien\Symantec Shared\SPBBC\SPBBCDrv.sys (manual start)
Symantec SPBBCSvc: C:\Programme\Gemeinsame Dateien\Symantec Shared\SPBBC\SPBBCSvc.exe (autostart)
Microsoft Kernel-Audiosplitter: system32\drivers\splitter.sys (manual start)
Druckwarteschlange: %SystemRoot%\system32\spoolsv.exe (autostart)
Filtertreiber für Systemwiederherstellung: System32\DRIVERS\sr.sys (system)
Systemwiederherstellungsdienst: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Srv: System32\DRIVERS\srv.sys (manual start)
SSDP-Suchdienst: %SystemRoot%\System32\svchost.exe -k LocalService (disabled)
SSHDRV65: \??\C:\WINDOWS\System32\drivers\SSHDRV65.sys (system)
Windows-Bilderfassung (WIA): %SystemRoot%\System32\svchost.exe -k imgsvc (manual start)
Software-Bus-Treiber: System32\DRIVERS\swenum.sys (manual start)
Microsoft Kernel GS Wavetablesynthesizer: system32\drivers\swmidi.sys (manual start)
MS Software Shadow Copy Provider: C:\WINDOWS\System32\dllhost.exe /Processid:{76467A14-D22C-4890-8B64-73A9D012FBBB} (manual start)
Symantec Core LC: C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe (autostart)
SYMDNS: \SystemRoot\System32\Drivers\SYMDNS.SYS (manual start)
SymEvent: \??\C:\Programme\Symantec\SYMEVENT.SYS (manual start)
SYMFW: \SystemRoot\System32\Drivers\SYMFW.SYS (manual start)
SYMIDS: \SystemRoot\System32\Drivers\SYMIDS.SYS (manual start)
SYMIDSCO: \??\C:\PROGRA~1\GEMEIN~1\SYMANT~1\SymcData\IDS-DI~1\20041209.018\symidsco.sys (manual start)
symlcbrd: \??\C:\WINDOWS\System32\drivers\symlcbrd.sys (autostart)
SYMNDIS: \SystemRoot\System32\Drivers\SYMNDIS.SYS (manual start)
SYMREDRV: \SystemRoot\System32\Drivers\SYMREDRV.SYS (manual start)
SYMTDI: \SystemRoot\System32\Drivers\SYMTDI.SYS (system)
Microsoft Kernel-Systemaudiogerät: system32\drivers\sysaudio.sys (manual start)
Leistungsdatenprotokolle und Warnungen: %SystemRoot%\system32\smlogsvc.exe (manual start)
Telefonie: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
TCP/IP-Protokolltreiber: System32\DRIVERS\tcpip.sys (system)
Terminal-Gerätetreiber: System32\DRIVERS\termdd.sys (system)
Terminaldienste: %SystemRoot%\System32\svchost -k DComLaunch (manual start)
Designs: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Telnet: C:\WINDOWS\System32\tlntsvr.exe (manual start)
Überwachung verteilter Verknüpfungen (Client): %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Microcode Updatetreiber: System32\DRIVERS\update.sys (manual start)
Universeller Plug & Play-Gerätehost: %SystemRoot%\System32\svchost.exe -k LocalService (disabled)
Unterbrechungsfreie Stromversorgung: %SystemRoot%\System32\ups.exe (manual start)
USB2-aktivierter Hub: System32\DRIVERS\usbhub.sys (manual start)
USB-Massenspeichertreiber: System32\DRIVERS\USBSTOR.SYS (manual start)
Miniporttreiber für universellen Microsoft USB-Hostcontroller: System32\DRIVERS\usbuhci.sys (manual start)
VGA-Anzeigecontroller.: \SystemRoot\System32\drivers\vga.sys (system)
Volumeschattenkopie: %SystemRoot%\System32\vssvc.exe (manual start)
Windows-Zeitgeber: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
RAS-IP-ARP-Treiber: System32\DRIVERS\wanarp.sys (manual start)
Treiber für Microsoft WINMM-WDM-Audiokompatibilität: system32\drivers\wdmaud.sys (manual start)
Webclient: %SystemRoot%\System32\svchost.exe -k LocalService (autostart)
Windows-Verwaltungsinstrumentation: %systemroot%\system32\svchost.exe -k netsvcs (autostart)
Dienst für Seriennummern der tragbaren Medien: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Treibererweiterungen für Windows-Verwaltungsinstrumentation: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
WMI-Leistungsadapter: C:\WINDOWS\System32\wbem\wmiapsrv.exe (manual start)
Windows Socket 2.0 Non-IFS-Dienstanbieter-Unterstützungsumgebung: \SystemRoot\System32\drivers\ws2ifsl.sys (system)
Sicherheitscenter: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Automatische Updates: %systemroot%\system32\svchost.exe -k netsvcs (autostart)
Konfigurationsfreie drahtlose Verbindung: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Netzwerkversorgungsdienst: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)


--------------------------------------------------

Enumerating Windows NT logon/logoff scripts:
*No scripts set to run*

Windows NT checkdisk command:
BootExecute = autocheck autochk *

Windows NT 'Wininit.ini':
PendingFileRenameOperations: *Registry value not found*

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\System32\webcheck.dll
SysTray: C:\WINDOWS\System32\stobject.dll

--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

*Registry key not found*

--------------------------------------------------

End of report, 30.989 bytes
Report generated in 0,235 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

so ich sehr mir kann auch geholfen werden .. denn ich bin mit meinem wissen am ende =)
naja schonmal danke bye

Hallo@Marqooh

Deaktivieren Wiederherstellung
«XP
http://service1.symantec.com/SUPPORT/IN ... 7105707924

Gehe in die Registry
Start<Ausfeuhren
schreib rein: regedit
die Registry oeffnet sich

klicke dich durch zum Schluessel:

<HKEY_CURRENT_USER>Software>Microsoft>Windows>
CurrentVersion>Run
loesche:-->mit rechtsklick-->loeschen
[Win32 SSL Driver] = "WINSSV.EXE"

<HKEY_CURRENT_USER>Software>Microsoft>Windows>
CurrentVersion>Runonce
loesche:
[Win32 SSL Driver] = "WINSSV.EXE"

<HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>
CurrentVersion>Run
loesche:
[Win32 SSL Driver] = "WINSSV.EXE"

<HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>
CurrentVersion>RunOnce
loesche:
[Win32 SSL Driver] = "WINSSV.EXE"

<HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>
CurrentVersion>RunServices
loesche:
[Win32 SSL Driver] = "WINSSV.EXE"

<HKEY_LOCAL_MACHINE>SYSTEM>CurrentControlSet>
Services\
loesche:-->Cronation

13. Close Registry Editor.



#öffne das HijackThis-->> Button "scan" -->> Häkchen setzen -->> Button "Fix checked" -->> PC neustarten

R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {34DEDCB8-1C23-1B84-5137-4B3654EDAFC0} - C:\WINDOWS\System32\rmfq.dll
O4 - HKLM\..\Run: [Win32 SSL Driver] winssv.exe -->WORM_WOOTBOT.CA
O4 - HKLM\..\Run: [USBHWDRV] C:\sst4.exe
O4 - HKLM\..\Run: [DeskAd Service] C:\Program Files\DeskAd Service\DeskAdServ.exe
O4 - HKLM\..\RunServices: [Win32 SSL Driver] winssv.exe
O4 - HKLM\..\RunOnce: [Win32 SSL Driver] winssv.exe
O4 - HKCU\..\Run: [Win32 SSL Driver] winssv.exe
O4 - HKCU\..\Run: [Fvfmqgc] C:\WINDOWS\System32\??oolsv.exe
O4 - HKCU\..\RunOnce: [Win32 SSL Driver] winssv.exe

PC neustarten

KillBox
http://www.bleepingcomputer.com/files/killbox.php

<Delete File on Reboot
und klick auf das rote Kreuz,
wenn gefragt wird, ob "Do you want to reboot? "----> klicke auf "no",und kopiere das naechste rein, erst beim letzten auf "yes"

C:\WINDOWS\System32\winssv.exe
C:\WINDOWS\System32\wuampd.exe
C:\WINDOWS\System32\??oolsv.exe
C:\Program Files\DeskAd Service\DeskAdServ.exe
C:\Program Files\DeskAd Service\DeskAdKeep.exe
C:\WINDOWS\System32\rmfq.dll
C:\sst4.exe

PC neustarten

<Lade clrav-->klicke an und es beginnt ein automatischer Scann unter DOS
http://www.kaspersky.com/de/removaltool ... 10248#open

Loeschen temporaere Dateien --> loesche die Dateien in den Ordnern, nicht die ordner selbst
C:\WINDOWS\Temp\
C:\Temp\
C:\Dokumente und Einstellungen\username\Lokale Einstellungen\Temp\
C:\Dokumente und Einstellungen\user\Lokale Einstellungen\Temporary Internet Files\Content.IE5 [loesche nicht die index.dat)

#eScan-Erkennungstool
eSan ist hier unter dem Namen Free eScan Antivirus Toolkit Utility kostenlos erhältlich:
http://www.mwti.net/antivirus/free_utilities.asp

erstelle den Ordner c:\bases
mwav.exe runterladen, die Datei in den Ordner c:\bases (wichtig!) entpacken und danach kavupd.exe (Update- in DOS) ausführen

gehe in den abgesicherten Modus
http://www.tu-berlin.de/www/software/vi ... mode.shtml

und den Scanner mit der "mwav.exe"[oder:MWAVSCAN.COM] starten. Alle Häkchen setzen :
Auswählen: "all files", Memory, Startup-Folders, Registry, System Folders,
Services, Drive/All Local drives, Folder [C:\WINDOWS], Include SubDirectory
-->und "Scan " klicken.

mache bitte folgendes:
nun öffnest du mit dem editor, die mwav.txt und gehst unter bearbeiten -> suchen, hier gibst du infected ein

jene zeile in der infected steht, markieren, und hier einfügen, weitersuchen usw.
und ganz unten steht die zusammenfassung, diese auch hier posten
--------------------------------------------------------------------------------------

#Search&Destroy
http://www.safer-networking.org/de/download/index.html
Spybot - Search && Destroy process list report,-->bitte abkopieren und posten


#BitDefender Scan
www.bitdefender.com/scan/Msie/index.php

#McAfee FreeScan (Online)
www.mcafee.com/myapps/mfs/default.asp

#Online-Scann <f-secure<
http://support.f-secure.com/enu/home/ols.shtml

Thu Jan 20 15:08:02 2005 => File C:\WINDOWS\system32\netut80ex.vxd infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:08:51 2005 => File C:\DOKUME~1\TEH-XZ~1\LOKALE~1\Temp\Rar$EX00.782\backups\backup-20050120-142922-931.dll infected by "not-a-virus:AdWare.PurityScan.ak" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:08:53 2005 => File C:\DOKUME~1\TEH-XZ~1\LOKALE~1\TEMPOR~1\Content.IE5\9NRDYTTH\AdmilliServ[1].exe infected by "not-a-virus:AdWare.WinAD.k" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:08:58 2005 => File C:\DOKUME~1\TEH-XZ~1\LOKALE~1\TEMPOR~1\Content.IE5\9NRDYTTH\DeskAdComm[1].dll infected by "not-a-virus:AdWare.WinAD.m" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:09:08 2005 => File C:\DOKUME~1\TEH-XZ~1\LOKALE~1\TEMPOR~1\Content.IE5\ESDR78WY\DeskAdKeep[1].exe infected by "not-a-virus:AdWare.WinAD.k" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:09:08 2005 => File C:\DOKUME~1\TEH-XZ~1\LOKALE~1\TEMPOR~1\Content.IE5\ESDR78WY\DeskAdServ[1].exe infected by "not-a-virus:AdWare.WinAD.m" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:09:13 2005 => File C:\DOKUME~1\TEH-XZ~1\LOKALE~1\TEMPOR~1\Content.IE5\Z4YHLZ7Z\AdmilliComm[1].dll infected by "not-a-virus:AdWare.WinAD.k" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:09:13 2005 => File C:\DOKUME~1\TEH-XZ~1\LOKALE~1\TEMPOR~1\Content.IE5\Z4YHLZ7Z\AdmilliKeep[1].exe infected by "not-a-virus:AdWare.WinAD.k" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:09:16 2005 => File C:\DOKUME~1\TEH-XZ~1\LOKALE~1\TEMPOR~1\Content.IE5\Z4YHLZ7Z\bb[1].exe infected by "not-a-virus:AdWare.BargainBuddy.l" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:09:29 2005 => File C:\DOKUME~1\TEH-XZ~1\LOKALE~1\TEMPOR~1\Content.IE5\ZKK3BE5M\webrebates_europe[1].exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:09:40 2005 => File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy\Recovery\DyFuCAInternetOptimizer11.zip infected by "Password-protected-EXE" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:09:41 2005 => File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy\Recovery\DyFuCAInternetOptimizer14.zip infected by "Password-protected-EXE" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:09:41 2005 => File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy\Recovery\DyFuCAInternetOptimizer17.zip infected by "Password-protected-EXE" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:09:41 2005 => File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy\Recovery\DyFuCAInternetOptimizer8.zip infected by "Password-protected-EXE" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:10:22 2005 => File C:\Dokumente und Einstellungen\teh-xzyther\Desktop\hijackthis.zip infected by "not-a-virus:AdWare.PurityScan.ak" Virus. Action Taken: No Action Taken
Thu Jan 20 15:10:36 2005 => File C:\Dokumente und Einstellungen\teh-xzyther\Lokale Einstellungen\Temp\Rar$EX00.782\backups\backup-20050120-142922-931.dll infected by "not-a-virus:AdWare.PurityScan.ak" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:10:22 2005 => File C:\Dokumente und Einstellungen\teh-xzyther\Desktop\hijackthis.zip infected by "not-a-virus:AdWare.PurityScan.ak" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:09:41 2005 => File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy\Recovery\DyFuCAInternetOptimizer8.zip infected by "Password-protected-EXE" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:09:41 2005 => File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy\Recovery\DyFuCAInternetOptimizer17.zip infected by "Password-protected-EXE" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:09:41 2005 => File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy\Recovery\DyFuCAInternetOptimizer8.zip infected by "Password-protected-EXE" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:10:22 2005 => File C:\Dokumente und Einstellungen\teh-xzyther\Desktop\hijackthis.zip infected by "not-a-virus:AdWare.PurityScan.ak" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:10:36 2005 => File C:\Dokumente und Einstellungen\teh-xzyther\Lokale Einstellungen\Temp\Rar$EX00.782\backups\backup-20050120-142922-931.dll infected by "not-a-virus:AdWare.PurityScan.ak" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:10:37 2005 => File C:\Dokumente und Einstellungen\teh-xzyther\Lokale Einstellungen\Temporary Internet Files\Content.IE5\9NRDYTTH\AdmilliServ[1].exe infected by "not-a-virus:AdWare.WinAD.k" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:10:39 2005 => File C:\Dokumente und Einstellungen\teh-xzyther\Lokale Einstellungen\Temporary Internet Files\Content.IE5\9NRDYTTH\DeskAdComm[1].dll infected by "not-a-virus:AdWare.WinAD.m" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:10:43 2005 => File C:\Dokumente und Einstellungen\teh-xzyther\Lokale Einstellungen\Temporary Internet Files\Content.IE5\ESDR78WY\DeskAdKeep[1].exe infected by "not-a-virus:AdWare.WinAD.k" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:10:44 2005 => File C:\Dokumente und Einstellungen\teh-xzyther\Lokale Einstellungen\Temporary Internet Files\Content.IE5\ESDR78WY\DeskAdServ[1].exe infected by "not-a-virus:AdWare.WinAD.m" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:10:46 2005 => File C:\Dokumente und Einstellungen\teh-xzyther\Lokale Einstellungen\Temporary Internet Files\Content.IE5\Z4YHLZ7Z\AdmilliComm[1].dll infected by "not-a-virus:AdWare.WinAD.k" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:10:46 2005 => File C:\Dokumente und Einstellungen\teh-xzyther\Lokale Einstellungen\Temporary Internet Files\Content.IE5\Z4YHLZ7Z\AdmilliKeep[1].exe infected by "not-a-virus:AdWare.WinAD.k" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:10:47 2005 => File C:\Dokumente und Einstellungen\teh-xzyther\Lokale Einstellungen\Temporary Internet Files\Content.IE5\Z4YHLZ7Z\bb[1].exe infected by "not-a-virus:AdWare.BargainBuddy.l" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:10:53 2005 => File C:\Dokumente und Einstellungen\teh-xzyther\Lokale Einstellungen\Temporary Internet Files\Content.IE5\ZKK3BE5M\webrebates_europe[1].exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:17:32 2005 => File C:\RECYCLER\S-1-5-21-1960408961-1708537768-1417001333-1003\Dc6846.fr5D15 infected by "not-a-virus:AdWare.WinAD.k" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:17:32 2005 => File C:\RECYCLER\S-1-5-21-1960408961-1708537768-1417001333-1003\Dc6848.fr2786 infected by "not-a-virus:AdWare.WinAD.m" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:17:55 2005 => File C:\RECYCLER\S-1-5-21-1960408961-1708537768-1417001333-1003\Dc9.360\backups\backup-20050120-142922-931.dll infected by "not-a-virus:AdWare.PurityScan.ak" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:20:59 2005 => File C:\WINDOWS\Downloaded Program Files\AdmilliServX.dll infected by "not-a-virus:AdWare.WinAD.j" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:20:59 2005 => File C:\WINDOWS\Downloaded Program Files\CONFLICT.1\WinServAdX.dll infected by "not-a-virus:AdWare.WinAD.f" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:20:59 2005 => File C:\WINDOWS\Downloaded Program Files\CONFLICT.2\WinServAdX.dll infected by "not-a-virus:AdWare.WinAD.f" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:20:59 2005 => File C:\WINDOWS\Downloaded Program Files\CONFLICT.3\WinServAdX.dll infected by "not-a-virus:AdWare.WinAD.f" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:20:59 2005 => File C:\WINDOWS\Downloaded Program Files\DeskAdX.dll infected by "not-a-virus:AdWare.WinAD.n" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:20:59 2005 => File C:\WINDOWS\Downloaded Program Files\WinServAdX.dll infected by "not-a-virus:AdWare.WinAD.f" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:26:50 2005 => File C:\WINDOWS\system32\netut80ex.vxd infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:27:55 2005 => File C:\DOKUME~1\TEH-XZ~1\LOKALE~1\Temp\Rar$EX00.782\backups\backup-20050120-142922-931.dll infected by "not-a-virus:AdWare.PurityScan.ak" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:27:58 2005 => File C:\DOKUME~1\TEH-XZ~1\LOKALE~1\TEMPOR~1\Content.IE5\9NRDYTTH\AdmilliServ[1].exe infected by "not-a-virus:AdWare.WinAD.k" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:28:05 2005 => File C:\DOKUME~1\TEH-XZ~1\LOKALE~1\TEMPOR~1\Content.IE5\9NRDYTTH\DeskAdComm[1].dll infected by "not-a-virus:AdWare.WinAD.m" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:28:18 2005 => File C:\DOKUME~1\TEH-XZ~1\LOKALE~1\TEMPOR~1\Content.IE5\ESDR78WY\DeskAdKeep[1].exe infected by "not-a-virus:AdWare.WinAD.k" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:28:19 2005 => File C:\DOKUME~1\TEH-XZ~1\LOKALE~1\TEMPOR~1\Content.IE5\ESDR78WY\DeskAdServ[1].exe infected by "not-a-virus:AdWare.WinAD.m" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:28:23 2005 => File C:\DOKUME~1\TEH-XZ~1\LOKALE~1\TEMPOR~1\Content.IE5\Z4YHLZ7Z\AdmilliComm[1].dll infected by "not-a-virus:AdWare.WinAD.k" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:28:23 2005 => File C:\DOKUME~1\TEH-XZ~1\LOKALE~1\TEMPOR~1\Content.IE5\Z4YHLZ7Z\AdmilliKeep[1].exe infected by "not-a-virus:AdWare.WinAD.k" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:28:25 2005 => File C:\DOKUME~1\TEH-XZ~1\LOKALE~1\TEMPOR~1\Content.IE5\Z4YHLZ7Z\bb[1].exe infected by "not-a-virus:AdWare.BargainBuddy.l" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:28:38 2005 => File C:\DOKUME~1\TEH-XZ~1\LOKALE~1\TEMPOR~1\Content.IE5\ZKK3BE5M\webrebates_europe[1].exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:28:48 2005 => File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy\Recovery\DyFuCAInternetOptimizer11.zip infected by "Password-protected-EXE" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:28:48 2005 => File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy\Recovery\DyFuCAInternetOptimizer14.zip infected by "Password-protected-EXE" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:28:48 2005 => File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy\Recovery\DyFuCAInternetOptimizer17.zip infected by "Password-protected-EXE" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:28:49 2005 => File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy\Recovery\DyFuCAInternetOptimizer8.zip infected by "Password-protected-EXE" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:29:25 2005 => File C:\Dokumente und Einstellungen\teh-xzyther\Desktop\hijackthis.zip infected by "not-a-virus:AdWare.PurityScan.ak" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:29:38 2005 => File C:\Dokumente und Einstellungen\teh-xzyther\Lokale Einstellungen\Temp\Rar$EX00.782\backups\backup-20050120-142922-931.dll infected by "not-a-virus:AdWare.PurityScan.ak" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:29:39 2005 => File C:\Dokumente und Einstellungen\teh-xzyther\Lokale Einstellungen\Temporary Internet Files\Content.IE5\9NRDYTTH\AdmilliServ[1].exe infected by "not-a-virus:AdWare.WinAD.k" Virus.
Thu Jan 20 15:29:41 2005 => File C:\Dokumente und Einstellungen\teh-xzyther\Lokale Einstellungen\Temporary Internet Files\Content.IE5\9NRDYTTH\DeskAdComm[1].dll infected by "not-a-virus:AdWare.WinAD.m" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:29:46 2005 => File C:\Dokumente und Einstellungen\teh-xzyther\Lokale Einstellungen\Temporary Internet Files\Content.IE5\ESDR78WY\DeskAdKeep[1].exe infected by "not-a-virus:AdWare.WinAD.k" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:29:46 2005 => File C:\Dokumente und Einstellungen\teh-xzyther\Lokale Einstellungen\Temporary Internet Files\Content.IE5\ESDR78WY\DeskAdServ[1].exe infected by "not-a-virus:AdWare.WinAD.m" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:29:48 2005 => File C:\Dokumente und Einstellungen\teh-xzyther\Lokale Einstellungen\Temporary Internet Files\Content.IE5\Z4YHLZ7Z\AdmilliComm[1].dll infected by "not-a-virus:AdWare.WinAD.k" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:29:48 2005 => File C:\Dokumente und Einstellungen\teh-xzyther\Lokale Einstellungen\Temporary Internet Files\Content.IE5\Z4YHLZ7Z\AdmilliKeep[1].exe infected by "not-a-virus:AdWare.WinAD.k" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:29:50 2005 => File C:\Dokumente und Einstellungen\teh-xzyther\Lokale Einstellungen\Temporary Internet Files\Content.IE5\Z4YHLZ7Z\bb[1].exe infected by "not-a-virus:AdWare.BargainBuddy.l" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:29:56 2005 => File C:\Dokumente und Einstellungen\teh-xzyther\Lokale Einstellungen\Temporary Internet Files\Content.IE5\ZKK3BE5M\webrebates_europe[1].exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken
Thu Jan 20 15:35:59 2005 => File C:\WINDOWS\Downloaded Program Files\AdmilliServX.dll infected by "not-a-virus:AdWare.WinAD.j" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:35:59 2005 => File C:\WINDOWS\Downloaded Program Files\CONFLICT.1\WinServAdX.dll infected by "not-a-virus:AdWare.WinAD.f" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:36:00 2005 => File C:\WINDOWS\Downloaded Program Files\CONFLICT.2\WinServAdX.dll infected by "not-a-virus:AdWare.WinAD.f" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:36:00 2005 => File C:\WINDOWS\Downloaded Program Files\CONFLICT.3\WinServAdX.dll infected by "not-a-virus:AdWare.WinAD.f" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:36:00 2005 => File C:\WINDOWS\Downloaded Program Files\DeskAdX.dll infected by "not-a-virus:AdWare.WinAD.n" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:36:00 2005 => File C:\WINDOWS\Downloaded Program Files\WinServAdX.dll infected by "not-a-virus:AdWare.WinAD.f" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:45:28 2005 => File C:\WINDOWS\system32\netut80ex.vxd infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:49:34 2005 => File C:\WINDOWS\Downloaded Program Files\AdmilliServX.dll infected by "not-a-virus:AdWare.WinAD.j" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:49:34 2005 => File C:\WINDOWS\Downloaded Program Files\CONFLICT.1\WinServAdX.dll infected by "not-a-virus:AdWare.WinAD.f" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:49:34 2005 => File C:\WINDOWS\Downloaded Program Files\CONFLICT.2\WinServAdX.dll infected by "not-a-virus:AdWare.WinAD.f" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:49:35 2005 => File C:\WINDOWS\Downloaded Program Files\CONFLICT.3\WinServAdX.dll infected by "not-a-virus:AdWare.WinAD.f" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:49:35 2005 => File C:\WINDOWS\Downloaded Program Files\DeskAdX.dll infected by "not-a-virus:AdWare.WinAD.n" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:49:35 2005 => File C:\WINDOWS\Downloaded Program Files\WinServAdX.dll infected by "not-a-virus:AdWare.WinAD.f" Virus. Action Taken: No Action Taken.
Thu Jan 20 15:58:38 2005 => File C:\WINDOWS\system32\netut80ex.vxd infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken.


sooooo ich hoffe ich hab alles gefunden =))))

ich vergaß ....
Thu Jan 20 15:59:48 2005 => ***** Scanning complete. *****

Thu Jan 20 15:59:48 2005 => Total Files Scanned: 46394
Thu Jan 20 15:59:48 2005 => Total Virus(es) Found: 39
Thu Jan 20 15:59:48 2005 => Total Disinfected Files: 0
Thu Jan 20 15:59:48 2005 => Total Files Renamed: 0
Thu Jan 20 15:59:48 2005 => Total Deleted Files: 0
Thu Jan 20 15:59:48 2005 => Total Errors: 168
Thu Jan 20 15:59:48 2005 => Time Elapsed: 00:34:32
Thu Jan 20 15:59:48 2005 => Virus Database Date: 2005/01/20
Thu Jan 20 15:59:48 2005 => Virus Database Count: 116109

Thu Jan 20 15:59:48 2005 => Scan Completed.

Thu Jan 20 16:08:52 2005 => Virus Database Date: 2005/01/20
Thu Jan 20 16:08:52 2005 => Virus Database Count: 116109
Thu Jan 20 16:47:56 2005 => AV Library Unloaded (3)...

Start<Ausfuehren --> schreib rein: cmd
dann k