Hallo,
ich habe seit kurzem ein Problem par Probleme mit meinen Computer. Einige konnte ich schon weitesgehenst selbst lösen, wie z. B. Probleme mit dem Eintrag "command.exe" oder "ibm00001". Doch ich bekomme immernoch beim hochfahren Fehlermeldungen con "VCClient" und "VCMain" und meine Internetstartseite ist immer "c:\secure32.html" und ich kann dies auch nicht ändern. Ich hoffe und wäre dankbar wenn mir jemand helfen könnte.

Logfile of HijackThis v1.99.1
Scan saved at 12:13:11, on 04.01.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\PROGRA~1\EzButton\CPLBTS88.EXE
C:\Programme\TOSHIBA\Power Management\CePMTray.exe
C:\Programme\TOSHIBA\E-KEY\CeEKey.exe
C:\WINDOWS\system32\bcmwltry.exe
C:\Programme\Nokia\Nokia PC Suite 5\DataLayer.exe
C:\Programme\Apoint2K\Apoint.exe
C:\Programme\TOSHIBA\TouchPad\TPTray.exe
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
C:\Programme\D-Tools\daemon.exe
C:\Programme\Apoint2K\Apntex.exe
C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\paytime.exe
C:\Programme\Gemeinsame Dateien\Nokia\Services\ServiceLayer.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Dokumente und Einstellungen\Daniel's Schlepptop\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
O4 - HKLM\..\Run: [wkqitgyw] C:\WINDOWS\System32\hvenhht.exe
O4 - HKLM\..\Run: [RemoveCpl] RemoveCpl.exe
O4 - HKLM\..\Run: [Rbcontrol] C:\WINDOWS\rbcontr.exe
O4 - HKLM\..\Run: [RbContr] C:\WINDOWS\rbcontr.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [CPLBTS88] C:\PROGRA~1\EzButton\CPLBTS88.EXE
O4 - HKLM\..\Run: [CeEPOWER] C:\Programme\TOSHIBA\Power Management\CePMTray.exe
O4 - HKLM\..\Run: [CeEKEY] C:\Programme\TOSHIBA\E-KEY\CeEKey.exe
O4 - HKLM\..\Run: [bcmwltry] bcmwltry.exe
O4 - HKLM\..\Run: [DataLayer] C:\Programme\Nokia\Nokia PC Suite 5\DataLayer.exe
O4 - HKLM\..\Run: [Apoint] C:\Programme\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [TPNF] C:\Programme\TOSHIBA\TouchPad\TPTray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programme\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [timessquare] C:\windows\timessquare.exe
O4 - HKLM\..\Run: [winsync] C:\WINDOWS\system32\cyriwo.exe reg_run
O4 - HKLM\..\Run: [adtech2006] C:\windows\adtech2006a.exe
O4 - HKLM\..\Run: [drsmartloadb] c:\\drsmartloadb.exe
O4 - HKLM\..\Run: [AVGCtrl] C:\Programme\AVPersonal\AVGNT.EXE /min
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NBJ] "C:\Programme\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [PayTime] C:\WINDOWS\system32\paytime.exe
O4 - HKCU\..\Run: [CU1] C:\Programme\Common Files\VCClient\VCClient.exe
O4 - HKCU\..\Run: [CU2] C:\Programme\Common Files\VCClient\VCMain.exe
O4 - HKCU\..\Run: [ziqw] C:\PROGRA~1\GEMEIN~1\ziqw\ziqwm.exe
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://appldnld.m7z.net/qtinstall.info. ... taller.exe
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = D_RIESE
O17 - HKLM\Software\..\Telephony: DomainName = D_RIESE
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = D_RIESE
O20 - Winlogon Notify: BITS - C:\WINDOWS\system32\m4nq0e55eh.dll (file missing)
O23 - Service: InterBase Guardian (InterBaseGuardian) - Inprise Corporation - C:\PROGRA~1\BORLAND\INTERB~1\Bin\ibguard.exe
O23 - Service: InterBase Server (InterBaseServer) - Inprise Corporation - C:\PROGRA~1\BORLAND\INTERB~1\Bin\ibserver.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

DatFindLog
Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: 2B40-10FD

Verzeichnis von C:\WINDOWS\system32

03.01.2006 22:03 0 lo2.txtt
03.01.2006 21:47 2.550 Uninstall.ico
03.01.2006 21:47 1.406 Help.ico
03.01.2006 21:47 1.718 Open.ico
03.01.2006 21:47 1.406 AddQuit.ico
03.01.2006 21:47 5.350 IE.ico
03.01.2006 21:47 9.470 Desktop.ico
03.01.2006 21:47 1.718 Quick.ico
03.01.2006 16:59 1.158 wpa.dbl
03.01.2006 16:40 43.520 CmdLineExt03.dll
03.01.2006 00:15 64 svcp.csv
03.01.2006 00:14 7.187 paytime.exe
21.12.2005 10:55 15.360 BASSMOD.dll
20.12.2005 06:28 7.006 jupdate-1.5.0_06-b05.log
19.12.2005 17:35 310.784 FNTCACHE.DAT
18.12.2005 20:33 23.392 nscompat.tlb
18.12.2005 20:33 16.832 amcompat.tlb
08.12.2005 16:25 2.723.680 MRT.exe
01.12.2005 12:14 86.091 S32EVNT1.DLL
01.12.2005 04:31 1.492.480 shdocvw.dll
24.11.2005 00:58 3.013.632 mshtml.dll
24.11.2005 00:58 1.022.464 browseui.dll
21.11.2005 21:10 5.618 jupdate-1.5.0_05-b05.log
10.11.2005 13:03 127.078 javaws.exe
10.11.2005 13:03 49.265 jpicpl32.cpl
10.11.2005 11:27 49.250 javaw.exe
10.11.2005 11:27 49.248 java.exe
05.11.2005 11:19 45 initdebug.nfo
05.11.2005 04:16 606.208 urlmon.dll
05.11.2005 04:16 1.056.256 danim.dll
04.11.2005 16:27 534.280 LegitCheckControl.DLL

Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: 2B40-10FD

Verzeichnis von C:\DOKUME~1\DANIEL~1\LOKALE~1\Temp

04.01.2006 12:02 618 jusched.log
03.01.2006 22:13 0 CacheInfo.dnl
2 Datei(en) 618 Bytes
0 Verzeichnis(se), 3.679.600.640 Bytes frei

Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: 2B40-10FD

Verzeichnis von C:\WINDOWS

04.01.2006 11:51 2.048 bootstat.dat
03.01.2006 23:57 51.947 WindowsUpdate.log
03.01.2006 23:57 347 wiadebug.log
03.01.2006 23:57 32.616 SchedLgU.Txt
03.01.2006 23:57 50 wiaservc.log
03.01.2006 21:51 1.167 win.ini
03.01.2006 21:48 21.787 setupapi.log
03.01.2006 14:04 561 daasunin.LOG
03.01.2006 14:04 2.981 fsmaunin.log
03.01.2006 14:04 1.255 fsdgunst.log
03.01.2006 14:04 458 FSGUIINS.LOG
03.01.2006 14:04 494 fstnbins.LOG
03.01.2006 14:04 40.275 fsavunin.log
03.01.2006 14:04 1.965 FSASWUNI.LOG
03.01.2006 14:04 46.635 FSASWSIN.log
03.01.2006 14:04 40.451 fwesinst.log
03.01.2006 14:03 17.215 FSSCINST.log
03.01.2006 14:03 1.027.026 FSSSINST.log
03.01.2006 14:03 4.162 FSPCUNIN.LOG
03.01.2006 14:03 689 HELPINST.LOG
03.01.2006 14:03 25.158 fwinst.log
03.01.2006 14:02 10.011 fsbwinst.log
03.01.2006 13:54 5.561 FSPRODRM.LOG
03.01.2006 13:54 478.012 fssgpex.LOG
03.01.2006 13:54 3.524.176 FSSFM.log
03.01.2006 13:54 1.333.901 FSSETUP.log
03.01.2006 13:54 325.040 FSPROD.log
03.01.2006 13:54 7.970.107 FSISU.log
03.01.2006 13:54 621.121 RunSetup.log
03.01.2006 13:54 12.107 FSSYSUPD.LOG
03.01.2006 13:54 4.202 NEWSINST.LOG
03.01.2006 13:54 13.716 FSASWINS.LOG
03.01.2006 13:54 2.185 DAASINST.LOG
03.01.2006 13:54 7.980 FSAVCSIN.LOG
03.01.2006 13:54 36.277 fsmainst.log
03.01.2006 13:54 13.312 FSSGSUP.LOG
03.01.2006 13:54 4.098 fsdginst.log
03.01.2006 13:54 21.768 FSPCINST.LOG
03.01.2006 13:54 276.747 FSDEPH.log
03.01.2006 13:54 12.107 fsrif.log
03.01.2006 13:54 69.173 FSAVINST.LOG
03.01.2006 13:48 8.739 Q-Klez.log
03.01.2006 12:33 1.225 wmsetup.log
03.01.2006 00:20 38 drsmartload.dat
03.01.2006 00:16 0 timessquare1.dat
03.01.2006 00:16 0 drsmartloadb1.dat
03.01.2006 00:16 140 ieynr.dll
03.01.2006 00:16 40 teller2.chk
03.01.2006 00:16 1.999 desktop.html
03.01.2006 00:16 53 qblovw.dat
03.01.2006 00:13 0 uniq
01.01.2006 03:01 116 NeroDigital.ini
27.12.2005 18:39 2.802 Sobo.sam
27.12.2005 18:31 307 UF.ini
18.12.2005 20:33 316.640 WMSysPr9.prx
17.12.2005 15:24 1.398 ODBC.INI
03.11.2005 15:49 79.804 _CB99346.TTF
03.11.2005 15:49 83.260 _0460D4C.TTF
03.11.2005 15:37 338 Sobo.ntz
03.11.2005 15:26 139 asym.ini

Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: 2B40-10FD

Verzeichnis von C:\

04.01.2006 12:15 0 sys.txt
04.01.2006 12:15 17.381 system.txt
04.01.2006 12:14 346 systemtemp.txt
04.01.2006 12:13 113.918 system32.txt
04.01.2006 11:51 535.875.584 hiberfil.sys
04.01.2006 11:51 803.708.928 pagefile.sys
27.12.2005 13:08 310.855 hpfr5550.log
27.12.2005 13:08 550 hpfr5550.xml
27.10.2005 20:06 194 boot.ini
29.08.2005 23:06 13.030 PDOXUSRS.NET
30.07.2005 17:22 389 log.txt
04.03.2005 00:00 0 infect.htm
04.03.2005 00:00 229 error.htm
08.02.2005 12:53 251.184 ntldr
08.02.2005 12:53 47.564 NTDETECT.COM
09.01.2005 15:54 274 m00.exe

Hoffe es kann mir jemand helfen

Kann mir denn wirklich keiner hier helfen?

Und noch des Silentrunners Log:
http://virus-protect.net/silentrunner.html

"Silent Runners.vbs", revision 41, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"ctfmon.exe" = "C:\WINDOWS\system32\ctfmon.exe" [MS]
"NBJ" = ""C:\Programme\Ahead\Nero BackItUp\NBJ.exe"" ["Ahead Software AG"]
"PayTime" = "C:\WINDOWS\system32\paytime.exe" [MS]
"CU1" = "C:\Programme\Common Files\VCClient\VCClient.exe" [null data]
"CU2" = "C:\Programme\Common Files\VCClient\VCMain.exe" [null data]
"ziqw" = "C:\PROGRA~1\GEMEIN~1\ziqw\ziqwm.exe" [file not found]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"wkqitgyw" = "C:\WINDOWS\System32\hvenhht.exe" [file not found]
"RemoveCpl" = "RemoveCpl.exe" [null data]
"Rbcontrol" = "C:\WINDOWS\rbcontr.exe" [null data]
"RbContr" = "C:\WINDOWS\rbcontr.exe" [null data]
"nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]
"NvCplDaemon" = "RUNDLL32.EXE NvQTwk,NvCplDaemon initialize" [MS]
"CPLBTS88" = "C:\PROGRA~1\EzButton\CPLBTS88.EXE" ["Dritek System Inc."]
"CeEPOWER" = "C:\Programme\TOSHIBA\Power Management\CePMTray.exe" ["COMPAL ELECTRONIC INC."]
"CeEKEY" = "C:\Programme\TOSHIBA\E-KEY\CeEKey.exe" ["COMPAL ELECTRONIC INC."]
"bcmwltry" = "bcmwltry.exe" ["Belkin Corporation"]
"DataLayer" = "C:\Programme\Nokia\Nokia PC Suite 5\DataLayer.exe" ["Nokia Mobile Phone Ltd."]
"Apoint" = "C:\Programme\Apoint2K\Apoint.exe" ["Alps Electric Co., Ltd."]
"TPNF" = "C:\Programme\TOSHIBA\TouchPad\TPTray.exe" ["COMPAL ELECTRONIC INC."]
"TkBellExe" = ""C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot" ["RealNetworks, Inc."]
"DAEMON Tools-1033" = ""C:\Programme\D-Tools\daemon.exe" -lang 1033" ["DAEMON'S HOME"]
"NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"]
"KernelFaultCheck" = "C:\WINDOWS\system32\dumprep 0 -k" [MS]
"SunJavaUpdateSched" = "C:\Programme\Java\jre1.5.0_06\bin\jusched.exe" ["Sun Microsystems, Inc."]
"timessquare" = "C:\windows\timessquare.exe" [file not found]
"winsync" = "C:\WINDOWS\system32\cyriwo.exe reg_run" [file not found]
"adtech2006" = "C:\windows\adtech2006a.exe" [file not found]
"drsmartloadb" = "c:\\drsmartloadb.exe" [file not found]
"AVGCtrl" = "C:\Programme\AVPersonal\AVGNT.EXE /min" [file not found]
"PayTime" = "C:\WINDOWS\system32\paytime.exe" [MS]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\ {++}
"Flag" = (empty string)

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "CPL-Erweiterung für Anzeigeverschiebung"
-> {CLSID}\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Erweiterung für HyperTerminal-Icons"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]
"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop-Explorer"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{8FF43EAA-2BB1-4A53-8E18-D9221E56E593}" = "CePMTab Property Sheet"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\CePMTab.dll" ["Compal"]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data]
"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\Real\RealPlayer\rpshell.dll" ["RealNetworks, Inc."]
"{E0D79304-84BE-11CE-9641-444553540000}" = "WinZip"
-> {CLSID}\InProcServer32\(Default) = "D:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
"{E0D79305-84BE-11CE-9641-444553540000}" = "WinZip"
-> {CLSID}\InProcServer32\(Default) = "D:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
"{E0D79306-84BE-11CE-9641-444553540000}" = "WinZip"
-> {CLSID}\InProcServer32\(Default) = "D:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
"{E0D79307-84BE-11CE-9641-444553540000}" = "WinZip"
-> {CLSID}\InProcServer32\(Default) = "D:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
"{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
"{e57ce731-33e8-4c51-8354-bb4de9d215d1}" = "Universelle Plug & Play-Geräte"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\upnpui.dll" [MS]
"{40950107-FEA6-4d53-A65F-B2DCBA57DD58}" = "Nokia Phone Browser"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\Nokia\Nokia PC Suite 5\NokiaPhoneBrowser.dll" ["Nokia"]
"{9ED66769-A198-41FE-8615-601691C68846}" = "TouchPad Property Sheet"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\TPprop.dll" ["COMPAL ELECTRONIC INC."]
"{73B24247-042E-4EF5-ADC2-42F62E6FD654}" = "ICQ Lite Shell Extension"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\ICQLite\ICQLiteShell.dll" [empty string]
"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\Microsoft Office\Office10\OLKFSTUB.DLL" [MS]
"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\Microsoft Office\Office10\msohev.dll" [MS]
"{21569614-B795-46b1-85F4-E737A8DC09AD}" = "Shell Search Band"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\browseui.dll" [MS]
"{32020A01-506E-484D-A2A8-BE3CF17601C3}" = "AlcoholShellEx"
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\ALCOHO~1\ALCOHO~1\AXShlEx.dll" ["Alcohol Soft Development Team"]

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
INFECTION WARNING! BITS\DLLName = "C:\WINDOWS\system32\m4nq0e55eh.dll" [file not found]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
ICQLiteMenu\(Default) = "{73B24247-042E-4EF5-ADC2-42F62E6FD654}"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\ICQLite\ICQLiteShell.dll" [empty string]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data]
WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}"
-> {CLSID}\InProcServer32\(Default) = "D:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
xgtnfksq\(Default) = "{55b82cb3-0ce9-46da-aa51-a3a29006aaaf}"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\wgref.dll" [file not found]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
ICQLiteMenu\(Default) = "{73B24247-042E-4EF5-ADC2-42F62E6FD654}"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\ICQLite\ICQLiteShell.dll" [empty string]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data]
WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}"
-> {CLSID}\InProcServer32\(Default) = "D:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data]
WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}"
-> {CLSID}\InProcServer32\(Default) = "D:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]


Active Desktop and Wallpaper:
-----------------------------

Active Desktop is disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Dokumente und Einstellungen\Daniel's Schlepptop\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp"


Startup items in "Daniel's Schlepptop" & "All Users" startup folders:
---------------------------------------------------------------------

C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart
"Adobe Reader - Schnellstart" -> shortcut to: "C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe" ["Adobe Systems Incorporated"]
"Microsoft Office" -> shortcut to: "C:\Programme\Microsoft Office\Office10\OSA.EXE -b -l" [MS]


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 04, 07 - 26
%SystemRoot%\system32\rsvpsp.dll [MS], 05 - 06


Toolbars, Explorer Bars, Extensions:
------------------------------------

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Konsole"
"CLSIDExtension" = "{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\Java\jre1.5.0_06\bin\npjpi150_06.dll" ["Sun Microsystems, Inc."]

{B863453A-26C3-4E1F-A54D-A2CD196348E9}\
"ButtonText" = "ICQ Lite"
"MenuText" = "ICQ Lite"
"Exec" = "C:\Programme\ICQLite\ICQLite.exe" ["ICQ Ltd."]

{CD67F990-D8E9-11D2-98FE-00C0F0318AFE}\

{FB5F1910-F110-11D2-BB9E-00C04F795683}\
"ButtonText" = "Messenger"
"MenuText" = "Windows Messenger"
"Exec" = "C:\Programme\Messenger\msmsgs.exe" [MS]


Miscellaneous IE Hijack Points
------------------------------

C:\WINDOWS\INF\IERESET.INF (used to "Reset Web Settings")

Added lines (compared with English-language version):
(unwritable string)

Missing lines (compared with English-language version):
[Version]: 2 lines
[RestoreHomePage]: 1 line
[RestoreHomePage.reg]: 1 line
[RestoreBrowserSettings.reg]: 12 lines
[DeleteTemplates.reg]: 5 lines
[DeleteAutosearch.reg]: 1 line
[Strings]: 1 line
[RestoreBrowserSettings]: 2 lines
[Strings]: 3 lines


Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

Machine Debug Manager, MDM, ""C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe"" [MS]
NVIDIA Driver Helper Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"]
StarWind iSCSI Service, StarWindService, "C:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe" ["Rocket Division Software"]
Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS]


Print Monitors:
---------------

HKLM\System\CurrentControlSet\Control\Print\Monitors\
EPSON V5 2KMonitor\Driver = "EBPMON2.DLL" ["SEIKO EPSON CORPORATION"]
HP Standard TCP/IP Port\Driver = "hptcpmon.dll" ["Hewlett Packard"]
hpzlnt07\Driver = "hpzlnt07.dll" ["HP"]
hpzsnt07\Driver = "hpzsnt07.dll" ["HP"]


----------
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ To search all directories of local fixed drives for DESKTOP.INI
DLL launch points and all Registry CLSIDs for dormant Explorer Bars,
use the -supp parameter or answer "No" at the first message box.
---------- (total run time: 35 seconds, including 14 seconds for message boxes)

und wie geht's jetzt weiter?

Hier gehts weiter: http://www.informationsarchiv.net/foren/beitrag-33489.html mfg, Yoruhighness