hiho
habe mir gestern mal wieder diesen spayware quake2 eingefangen,habe dann nochmal nachgeschaut wie mann ihn wegbekommt. habe alles so gemacht wie beschrieben , hatte dann auch alles weg ,doch wenn ich ins inet. gegangen bin kam n#ach ca.2 sec. ein geräusch aus den boxen als wenn mann ein telefon abhebt dann rauschen!! Jetzt habe ich den *lol* wieder drauf und musste wieder von neu anfangen.

thx schonmal



Logfile of HijackThis v1.99.1
Scan saved at 17:12, on 06-10-09
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\Programme\Home Cinema\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe
C:\Programme\CA\eTrust Antivirus\InoRpc.exe
C:\Programme\CA\eTrust Antivirus\InoRT.exe
C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Programme\CyberLink\Shared Files\RichVideo.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\Programme\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Programme\Home Cinema\PowerCinema\PCMService.exe
C:\WINDOWS\system32\CmUCReye.exe
C:\Programme\Medion Info Display\MdionLCM.exe
C:\WINDOWS\mHotkey.exe
C:\WINDOWS\CNYHKey.exe
C:\PROGRA~1\CA\ETRUST~1\realmon.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Programme\Gemeinsame Dateien\{F8459504-0BB0-1031-0113-060922050001}\Update.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\HAMAS1~1\S1_2k.exe
C:\Programme\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
C:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\WINDOWS\system\CmSNXeye.exe
C:\Programme\WinRAR\WinRAR.exe
C:\WINDOWS\explorer.exe
C:\Programme\WinRAR\WinRAR.exe
C:\Programme\WinRAR\WinRAR.exe
C:\DOKUME~1\danielb\LOKALE~1\Temp\Rar$EX00.078\HijackThis.exe

R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll
O3 - Toolbar: ToolBar888 - {C004DEC2-2623-438e-9CA2-C9043AB28508} - C:\Programme\Gemeinsame Dateien\{38459504-0BB0-1031-0113-060922050001}\MyToolBar.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [PCMService] "C:\Programme\Home Cinema\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [CmUCRRun] C:\WINDOWS\system32\CmUCReye.exe
O4 - HKLM\..\Run: [MedionVFD] "C:\Programme\Medion Info Display\MdionLCM.exe"
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [ledpointer] CNYHKey.exe
O4 - HKLM\..\Run: [Showwnd] showwnd.exe
O4 - HKLM\..\Run: [AntivirusRegistration] C:\Programme\CA\Etrust Antivirus\Register.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Realtime Monitor] C:\PROGRA~1\CA\ETRUST~1\realmon.exe -s
O4 - HKLM\..\Run: [InstantOn] "C:\Programme\CyberLink\PowerCinema Linux\ion_install.exe /c "
O4 - HKLM\..\Run: [CmUsbSound] RunDll32 cmcnfgu.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [dmdan.exe] C:\WINDOWS\system32\dmdan.exe
O4 - HKCU\..\Run: [AOLMIcon] C:\Programme\Gemeinsame Dateien\AOLSHARE\AOLMIcon.exe
O4 - HKCU\..\Run: [Steam] "c:\programme\valve\steam\steam.exe" -silent
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [La_View Mouse] C:\PROGRA~1\HAMAS1~1\S1_2k.exe
O4 - HKCU\..\Run: [swg] C:\Programme\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe
O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Programme\ICQToolbar\toolbaru.dll/SEARCH.HTML
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra button: MedionShop - {A461BF3E-96B0-488F-9ACA-202335DDCC4B} - http://www.medionshop.de/ (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.aldi.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 8778405937
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 1142460296
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMe ... loader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{66BA32C4-D5E5-4143-9232-A6F13D7BBB79}: NameServer = 85.255.116.35,85.255.112.65
O17 - HKLM\System\CCS\Services\Tcpip\..\{749B9CC5-2650-4E8C-9ED9-9DBDF42700E9}: NameServer = 85.255.116.35,85.255.112.65
O17 - HKLM\System\CCS\Services\Tcpip\..\{C1594B35-CE5E-4855-BC82-EE215E6ADED9}: NameServer = 85.255.116.35,85.255.112.65
O17 - HKLM\System\CCS\Services\Tcpip\..\{E72B7FE2-905B-4F5E-A4F9-F7BD2D805E41}: NameServer = 85.255.116.35,85.255.112.65
O17 - HKLM\System\CCS\Services\Tcpip\..\{E95E35F4-9C2C-4D71-B3F7-B37DBCCA9AC7}: NameServer = 85.255.116.35,85.255.112.65
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.35 85.255.112.65
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.35 85.255.112.65
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Programme\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Programme\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Programme\Home Cinema\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: AVM FRITZ!web Routing Service (de_serv) - Unknown owner - C:\Programme\Gemeinsame Dateien\AVM\de_serv.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: eTrust Antivirus RPC Server (InoRPC) - Computer Associates International, Inc. - C:\Programme\CA\eTrust Antivirus\InoRpc.exe
O23 - Service: eTrust Antivirus Realtime Server (InoRT) - Computer Associates International, Inc. - C:\Programme\CA\eTrust Antivirus\InoRT.exe
O23 - Service: eTrust Antivirus Job Server (InoTask) - Computer Associates International, Inc. - C:\Programme\CA\eTrust Antivirus\InoTask.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Programme\CyberLink\Shared Files\RichVideo.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

stelle den CleanUp genauso ein, wie hier angegeben:
http://virus-protect.org/cleanup.html

Kopiere diese 6 Textdateien ab . (rechtsklick mit der Maus -> den Text markieren -> kopieren -> einfügen) Sie sind nach Datum geordnet. (kopiere nur die letzten 3 Monate ab)
http://virus-protect.org/datfindbat.html

poste das log
http://virus-protect.org/artikel/tools/combofix.html

poste das log
http://virus-protect.org/artikel/tools/fixwareout.html

Datentr„ger in Laufwerk C: ist BOOT
Volumeseriennummer: F845-9504

Verzeichnis von C:\WINDOWS\system32

06-10-10 17:00 380,845 oqtwa.ini2
06-10-10 16:54 39,291 nvapps.xml
06-10-10 16:54 2,206 wpa.dbl
06-10-10 16:45 296,704 oqtwa.bak2
06-10-09 21:00 380,317 oqtwa.tmp
06-10-09 20:59 380,317 oqtwa.ini
06-10-09 16:35 684,084 awtqo.dll
06-10-08 18:25 18,432 winmfu32.dll
06-09-11 19:37 8,960,936 MRT.exe
06-08-29 19:43 135,168 swreg.exe
06-08-21 14:26 16,896 fltlib.dll
06-08-21 11:14 23,040 fltmc.exe
06-07-28 20:35 36,697 OggDSuninst.exe
06-07-28 13:28 3,075,072 mshtml.dll
06-07-27 15:25 679,424 inetcomm.dll
06-07-25 22:33 615,936 urlmon.dll
06-07-21 10:29 72,704 hlink.dll
06-07-14 17:38 332,288 netapi32.dll
06-07-14 17:25 546,304 hhctrl.ocx
06-07-13 15:34 8,494,592 shell32.dll
06-07-12 19:31 396,876 perfh009.dat
06-07-12 19:31 61,540 perfc009.dat
06-07-12 19:31 411,148 perfh007.dat
06-07-12 19:31 74,202 perfc007.dat
06-07-12 19:31 955,264 PerfStringBackup.INI


Datentr„ger in Laufwerk C: ist BOOT
Volumeseriennummer: F845-9504

Verzeichnis von C:\DOKUME~1\danielb\LOKALE~1\Temp




Datentr„ger in Laufwerk C: ist BOOT
Volumeseriennummer: F845-9504

Verzeichnis von C:\WINDOWS

06-10-10 16:52 0 0.log
06-10-10 16:52 3,836 ModemLog_Creatix V.92 Data Fax Modem.txt
06-10-10 16:52 1,232,630 WindowsUpdate.log
06-10-10 16:51 2,048 bootstat.dat
06-10-10 16:43 32,638 SchedLgU.Txt
06-10-09 21:00 2,742 setupact.log
06-10-09 16:58 278,420 ntbtlog.txt
06-10-09 16:30 264,830 setupapi.log
06-10-08 21:15 50 wiaservc.log
06-10-08 21:15 216 wiadebug.log
06-10-04 20:03 202 NeroDigital.ini
06-09-27 16:26 29,271 iis6.log
06-09-27 16:26 1,374 imsins.log
06-09-27 16:26 69,490 tsoc.log
06-09-27 16:26 36,073 ntdtcsetup.log
06-09-27 16:26 59,363 comsetup.log
06-09-27 16:26 9,918 ocmsn.log
06-09-27 16:26 10,517 KB925486.log
06-09-27 16:26 84,564 ocgen.log
06-09-27 16:26 8,961 msgsocm.log
06-09-27 16:26 178,588 FaxSetup.log
06-09-26 19:36 9,606 wmsetup.log
06-09-14 18:42 1,374 imsins.BAK
06-09-14 18:42 13,074 KB920685.log
06-09-14 18:42 14,912 KB920872.log
06-09-14 18:41 13,223 KB919007.log
06-09-14 18:41 9,107 KB922582.log
06-09-14 18:41 14,578 updspapi.log
06-08-11 17:25 18,618 KB920214.log
06-08-11 17:25 18,923 KB922616.log
06-08-11 17:25 18,499 KB921398.log
06-08-11 17:25 21,333 KB918899.log
06-08-11 17:25 11,899 KB920670.log
06-08-11 17:25 12,055 KB917422.log
06-08-11 17:25 12,262 KB920683.log
06-08-09 20:19 11,081 KB921883.log
06-07-12 19:26 11,831 KB917159.log
06-07-12 19:26 12,342 KB914388.log
06-07-12 19:26 10,417 KB916595.log
06-07-07 22:29 73,728 ALCFDRTM.EXE




Datentr„ger in Laufwerk C: ist BOOT
Volumeseriennummer: F845-9504

Verzeichnis von C:\WINDOWS\Temp

06-10-10 16:59 0 win12.tmp
06-10-10 16:57 0 win11.tmp
06-10-10 16:55 0 win10.tmp
06-10-10 16:54 409 WGANotify.settings
06-10-10 16:54 255 WGAErrLog.txt
06-10-10 16:53 0 winC.tmp
06-10-10 16:51 2,048 sqlite_WyIrkwDc9fSgAUS
06-10-10 16:51 0 CLML_AGENT_LOG1.txt
8 Datei(en) 2,712 Bytes
0 Verzeichnis(se), 88,788,176,896 Bytes frei



Datentr„ger in Laufwerk C: ist BOOT
Volumeseriennummer: F845-9504

Verzeichnis von C:\WINDOWS\Downloaded Program Files

06-06-22 11:41 5,032 swflash.inf
05-10-08 22:56 65 desktop.ini
05-08-26 15:57 495 LegitCheckControl.inf
05-08-14 01:26 113,664 MsnMessengerSetupDownloader.ocx
05-06-30 16:19 227 MsnMessengerSetupDownloader.inf
05-06-29 18:17 227 opuc.inf
05-05-26 05:19 293 muweb.inf
05-05-26 04:19 291 wuweb.inf
05-02-09 16:54 1,271 erma.inf
04-01-09 13:39 3,237 awswax.inf
10 Datei(en) 124,802 Bytes
0 Verzeichnis(se), 88,788,176,896 Bytes frei


Datentr„ger in Laufwerk C: ist BOOT
Volumeseriennummer: F845-9504

Verzeichnis von C:\

06-10-10 17:03 0 sys.txt
06-10-10 17:03 747 down.txt
06-10-10 17:03 613 tmp.txt
06-10-10 17:02 8,112 system.txt
06-10-10 17:01 126 systemtemp.txt
06-10-10 17:00 101,050 system32.txt
06-10-10 16:51 1,072,156,672 hiberfil.sys
06-10-10 16:51 1,610,612,736 pagefile.sys
06-10-09 21:00 881 rapport.txt
06-10-09 20:58 7,086 ComboFix.txt
06-10-09 16:58 1,745 VundoFix.txt
06-10-08 21:15 979 ComboFix2.txt
06-10-08 19:24 7,579 ComboFix3.txt
06-06-01 17:52 211 boot.ini
06-02-28 16:58 2,429 IPH.PH
05-10-09 14:46 50 AUTOEXEC.BAT
05-10-08 22:57 0 CONFIG.SYS
05-10-08 22:57 0 IO.SYS
05-10-08 22:57 0 MSDOS.SYS
04-08-04 14:00 4,952 bootfont.bin
04-08-04 14:00 47,564 NTDETECT.COM
04-08-04 14:00 251,184 ntldr
22 Datei(en) 2,683,204,716 Bytes
0 Verzeichnis(se), 88,788,168,704 Bytes frei

danielb - 06-10-10 17:10:04.09 Service Pack 2
ComboFix 06.09.28 - Running from: "C:\Dokumente und Einstellungen\danielb\Desktop\virus"

((((((((((((((((((((((((((((((( Files Created from 2006-09-10 to 2006-10-10 ))))))))))))))))))))))))))))))))))


2006-10-10 16:37 296,704 ---hs---- C:\WINDOWS\system32\oqtwa.bak2
2006-10-09 21:00 380,845 ---hs---- C:\WINDOWS\system32\oqtwa.ini2
2006-10-09 16:35 684,084 --------- C:\WINDOWS\system32\awtqo.dll
2006-10-08 19:48 53,248 --a------ C:\WINDOWS\system32\Process.exe
2006-10-08 19:48 40,960 --a------ C:\WINDOWS\system32\swsc.exe
2006-10-08 19:48 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2006-10-08 19:48 135,168 --a------ C:\WINDOWS\system32\swreg.exe
2006-10-08 18:25 18,432 --a------ C:\WINDOWS\system32\winmfu32.dll


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-10-10 16:52 -------- d-------- C:\Programme\CleanUp!
2006-10-09 20:58 -------- d-------- C:\Programme\Gemeinsame Dateien
2006-10-09 17:06 -------- d-------- C:\Programme\Roguescanfix
2006-10-08 19:15 -------- d-------- C:\Programme\VSToolbar
2006-10-03 18:16 -------- d-------- C:\Dokumente und Einstellungen\danielb\Anwendungsdaten\LimeWire
2006-09-19 19:57 -------- d-------- C:\Programme\Google
2006-09-17 19:12 -------- d-------- C:\Programme\Windows Media Player
2006-09-17 14:51 -------- d-------- C:\Dokumente und Einstellungen\danielb\Anwendungsdaten\Google
2006-09-17 14:40 -------- d-------- C:\Programme\ICQToolbar
2006-09-12 20:22 -------- d-------- C:\Dokumente und Einstellungen\danielb\Anwendungsdaten\Azureus
2006-09-11 21:20 -------- d-------- C:\Programme\QuickTime
2006-09-11 21:20 -------- d-------- C:\Programme\Gemeinsame Dateien\InterVideo
2006-09-11 21:20 -------- d-------- C:\Programme\Gemeinsame Dateien\aol
2006-09-11 21:20 -------- d-------- C:\Programme\FRITZ!DSL
2006-09-11 21:20 -------- d-------- C:\Programme\DivX
2006-09-11 21:20 -------- d-------- C:\Programme\CyberLink
2006-09-11 21:20 -------- d-------- C:\Programme\ALDI Sued Foto Service
2006-09-11 21:20 -------- d-------- C:\Programme\Ahead
2006-08-29 19:07 -------- d-------- C:\Programme\Azureus
2006-08-21 14:26 16896 --a------ C:\WINDOWS\system32\fltlib.dll
2006-08-21 11:14 23040 --a------ C:\WINDOWS\system32\fltmc.exe
2006-08-21 11:14 128896 --a------ C:\WINDOWS\system32\drivers\fltmgr.sys
2006-08-18 16:41 -------- d-------- C:\Programme\Hama S1
2006-08-18 16:21 -------- d-------- C:\Programme\danielb
2006-08-11 17:25 -------- d-------- C:\Programme\Internet Explorer
2006-07-28 20:35 36697 --a------ C:\WINDOWS\system32\OggDSuninst.exe
2006-07-27 15:25 679424 --a------ C:\WINDOWS\system32\inetcomm.dll
2006-07-21 10:29 72704 --a------ C:\WINDOWS\system32\hlink.dll
2006-07-05 17:01 164 --a------ C:\Dokumente und Einstellungen\danielb\Anwendungsdaten\wklnhst.dat


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AOLMIcon"="C:\\Programme\\Gemeinsame Dateien\\AOLSHARE\\AOLMIcon.exe"
"Steam"="\"c:\\programme\\valve\\steam\\steam.exe\" -silent"
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"La_View Mouse"="C:\\PROGRA~1\\HAMAS1~1\\S1_2k.exe"
"swg"="C:\\Programme\\Google\\GoogleToolbarNotifier\\1.0.720.3640\\GoogleToolbarNotifier.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="\"C:\\WINDOWS\\IME\\imjp8_1\\IMJPMIG.EXE\" /Spoil /RemAdvDef /Migration32"
"MSPY2002"="C:\\WINDOWS\\system32\\IME\\PINTLGNT\\ImScInst.exe /SYNC"
"PHIME2002ASync"="C:\\WINDOWS\\system32\\IME\\TINTLGNT\\TINTSETP.EXE /SYNC"
"PHIME2002A"="C:\\WINDOWS\\system32\\IME\\TINTLGNT\\TINTSETP.EXE /IMEName"
"RTHDCPL"="RTHDCPL.EXE"
"Alcmtr"="ALCMTR.EXE"
"PCMService"="\"C:\\Programme\\Home Cinema\\PowerCinema\\PCMService.exe\""
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"nwiz"="nwiz.exe /install"
"CmUCRRun"="C:\\WINDOWS\\system32\\CmUCReye.exe"
"MedionVFD"="\"C:\\Programme\\Medion Info Display\\MdionLCM.exe\""
"CHotkey"="mHotkey.exe"
"ledpointer"="CNYHKey.exe"
"Showwnd"="showwnd.exe"
"AntivirusRegistration"="C:\\Programme\\CA\\Etrust Antivirus\\Register.exe"
"NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"Realtime Monitor"="C:\\PROGRA~1\\CA\\ETRUST~1\\realmon.exe -s"
"InstantOn"="\"C:\\Programme\\CyberLink\\PowerCinema Linux\\ion_install.exe /c \""
"CmUsbSound"="RunDll32 cmcnfgu.cpl,CMICtrlWnd"
"QuickTime Task"="\"C:\\Programme\\QuickTime\\qttask.exe\" -atboottime"
"dmdan.exe"="C:\\WINDOWS\\system32\\dmdan.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000000
"GeneralFlags"=dword:00000000

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE"

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\awtqo
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winmfu32

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders
securityproviders REG_SZ msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll


Completion time: 06-10-10 17:10:30.32
ComboFix.txt
ComboFix2.txt
ComboFix3.txt

noob20

1.
http://www.f-secure.com/blacklight/
starte die Datei, nimm die Lizenzbestimmung an und waehle scan, wenn es mit dem Scan fertig ist, druecke next und danach close. Nun befindet sich im selben Ordner von Blacklight eine FSB*.TXT Datei - poste das log

________________________________________________

2.
Den folgenden Text in den Editor (Start - Zubehör - Editor) kopieren und als listen.bat mit 'Speichern unter' auf dem Desktop. Gebe bei Dateityp 'Alle Dateien' an. Du solltest jetzt auf dem Desktop diese Datei finden. --> die listen.bat doppelt klicken--> kopiere den Text, der erscheint

cd\
dir "C:\Windows\System32\Com" >>files.txt
dir "C:\Programme\Gemeinsame Dateien\{F8459504-0BB0-1031-0113-060922050001}" >>files.txt
dir "C:\Programme" >>files.txt
dir "C:\Dokumente und Einstellungen\%UserName%\Lokale Einstellungen\Anwendungsdaten" >>files.txt
dir "C:\Dokumente und Einstellungen\%UserName%\Anwendungsdaten" >>files.txt
dir "C:\Dokumente und Einstellungen\All Users\Anwendungsdaten" >>files.txt
dir "C:\Programme\Gemeinsame Dateien" >>files.txt
dir "C:Windows\tasks" >>files.txt
notepad files.txt

3.
scanne mit vundofix
http://virus-protect.org/artikel/tools/vundofixx.html

4.
Avenger
http://virus-protect.org/artikel/tools/avenger.html
kopiere rein

registry keys to delete:
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\awtqo
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winmfu32
HKEY_LOCAL_MACHINE\SOFTWARE\SearchToolbar

Files to delete:
C:\Programme\Gemeinsame Dateien\{38459504-0BB0-1031-0113-060922050001}\MyToolBar.dll
C:\WINDOWS\Temp\win12.tmp
C:\WINDOWS\Temp\win11.tmp
C:\WINDOWS\Temp\win10.tmp
C:\WINDOWS\Temp\winC.tmp
C:\WINDOWS\system32\oqtwa.ini2
C:\WINDOWS\system32\oqtwa.bak2
C:\WINDOWS\system32\oqtwa.tmp
C:\WINDOWS\system32\oqtwa.ini
C:\WINDOWS\system32\awtqo.dll
C:\WINDOWS\system32\winmfu32.dll
C:\WINDOWS\system32\dmdan.exe
C:\WINDOWS\balloon.wav
C:\WINDOWS\rdt.ini

Folders to delete:
C:\Programme\VSToolbar
C:\Programme\Gemeinsame Dateien\{38459504-0BB0-1031-0113-060922050001}

Klicke die gruene Ampel
das Script wird nun ausgeführt, dann wird der PC automatisch neustarten


**
öffne das HijackThis -- Button "scan" -- vor die Malware-Einträge Häkchen setzen -- Button "Fix checked" -- PC neustarten

O3 - Toolbar: ToolBar888 - {C004DEC2-2623-438e-9CA2-C9043AB28508} - C:\Programme\Gemeinsame Dateien\{38459504-0BB0-1031-0113-060922050001}\MyToolBar.dll

O4 - HKLM\..\Run: [dmdan.exe] C:\WINDOWS\system32\dmdan.exe

O17 - HKLM\System\CCS\Services\Tcpip\..\{66BA32C4-D5E5-4143-9232-A6F13D7BBB79}: NameServer = 85.255.116.35,85.255.112.65
O17 - HKLM\System\CCS\Services\Tcpip\..\{749B9CC5-2650-4E8C-9ED9-9DBDF42700E9}: NameServer = 85.255.116.35,85.255.112.65
O17 - HKLM\System\CCS\Services\Tcpip\..\{C1594B35-CE5E-4855-BC82-EE215E6ADED9}: NameServer = 85.255.116.35,85.255.112.65
O17 - HKLM\System\CCS\Services\Tcpip\..\{E72B7FE2-905B-4F5E-A4F9-F7BD2D805E41}: NameServer = 85.255.116.35,85.255.112.65
O17 - HKLM\System\CCS\Services\Tcpip\..\{E95E35F4-9C2C-4D71-B3F7-B37DBCCA9AC7}: NameServer = 85.255.116.35,85.255.112.65
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.35 85.255.112.65
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.35 85.255.112.65

nach dem neustart, bevor du wieder ins Internet gehst:
Bei Netzwerk/Eigenschaften des Internetprotokolls steht denn auch IP und DNS automatisch beziehen - anhaken

85.255.116.35 85.255.112.65 - muss raus, wird auf einen Server in die ukraine umgeleitet !

1. Click Start > Control Panel
2. Double-click Network Connections.


**
scanne und poste den scanreport
http://virus-protect.org/artikel/tools/fixwareout.html

**
scanne mit smitfraud.fix (option 1 und 2)
http://virus-protect.org/artikel/tools/ ... utfix.html
es wird den Desktop-Hintergrund wieder geraderuecken - in MS-blau

**
F-Secure Online Scanner Next Generation Beta
http://support.f-secure.com/enu/home/ols3.shtml

1. Klicke den Link: "F-Secure Online Scanner Next Generation Beta".
2. Du wirst aufgefordert werden, ein ActiveX-Control zu installieren
3. Installiere diese ActiveX-Komponente
4. Lies die Anleitung und klicke: "Accept"
5. Klicke "Full System Scan"
6. klicke "Show report" - kopiere den Scanreport

________________
poste das neue Log vom HijacktHis

0/11/06 17:18:42 [Info]: BlackLight Engine 1.0.47 initialized
10/11/06 17:18:42 [Info]: OS: 5.1 build 2600 (Service Pack 2)
10/11/06 17:18:42 [Note]: 7019 4
10/11/06 17:18:42 [Note]: 7005 0
10/11/06 17:18:42 [Note]: 7006 0
10/11/06 17:18:42 [Note]: 7011 1384
10/11/06 17:18:43 [Note]: 7026 0
10/11/06 17:18:43 [Note]: 7026 0
10/11/06 17:18:51 [Note]: FSRAW library version 1.7.1020
10/11/06 17:23:39 [Note]: 7007 0





Fixwareout ver 1.003
Last edited 8/11/2006
Post this report in the forums please

Reg Entries that were deleted
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}B311B0E93BFD-504A-48A4-71C2-83960317{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}B505CD12C36F-25DB-6364-5BC7-1EF2F88D{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\nadmd
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\0mdm
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\1mdm
...

Random Runs removed from HKLM
...

PLEASE NOTE, There WILL be LEGITIMATE FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.

»»»»» Searching by size/names...

»»»»»
Search five digit cs, dm and jb files.
This WILL/CAN also list Legit Files, Submit them at Virustotal

Other suspects.
Directory of C:\WINDOWS\system32

»»»»» Misc files.

»»»»» Checking for older varients covered by the Rem3 tool.



Logfile of HijackThis v1.99.1
Scan saved at 18:45, on 06-10-11
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Logfile of HijackThis v1.99.1
Scan saved at 18:45, on 06-10-11
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\Programme\Home Cinema\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe
C:\Programme\CA\eTrust Antivirus\InoRpc.exe
C:\Programme\CA\eTrust Antivirus\InoRT.exe
C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Programme\CyberLink\Shared Files\RichVideo.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\Programme\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Programme\Home Cinema\PowerCinema\PCMService.exe
C:\WINDOWS\system32\CmUCReye.exe
C:\Programme\Medion Info Display\MdionLCM.exe
C:\WINDOWS\mHotkey.exe
C:\WINDOWS\CNYHKey.exe
C:\PROGRA~1\CA\ETRUST~1\realmon.exe
C:\WINDOWS\system32\RunDll32.exe
C:\programme\valve\steam\steam.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\HAMAS1~1\S1_2k.exe
C:\Programme\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
C:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\WINDOWS\system\CmSNXeye.exe
C:\WINDOWS\explorer.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Programme\ICQLite\ICQLite.exe
C:\Programme\Home Cinema\PowerCinema\PowerCinema.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\WinRAR\WinRAR.exe
C:\DOKUME~1\danielb\LOKALE~1\Temp\Rar$EX00.984\HijackThis.exe

R3 - URLSearchHook: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
O2 - BHO: My Search BHO - {014DA6C1-189F-421a-88CD-07CFE51CFF10} - C:\Programme\MySearch\bar\1.bin\S4BAR.DLL
O2 - BHO: (no name) - {9973D06F-B83F-4D2F-B153-4CF19640E67A} - C:\WINDOWS\system32\awtqo.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar3.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [PCMService] "C:\Programme\Home Cinema\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [CmUCRRun] C:\WINDOWS\system32\CmUCReye.exe
O4 - HKLM\..\Run: [MedionVFD] "C:\Programme\Medion Info Display\MdionLCM.exe"
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [ledpointer] CNYHKey.exe
O4 - HKLM\..\Run: [Showwnd] showwnd.exe
O4 - HKLM\..\Run: [AntivirusRegistration] C:\Programme\CA\Etrust Antivirus\Register.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Realtime Monitor] C:\PROGRA~1\CA\ETRUST~1\realmon.exe -s
O4 - HKLM\..\Run: [InstantOn] "C:\Programme\CyberLink\PowerCinema Linux\ion_install.exe /c "
O4 - HKLM\..\Run: [CmUsbSound] RunDll32 cmcnfgu.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [AOLMIcon] C:\Programme\Gemeinsame Dateien\AOLSHARE\AOLMIcon.exe
O4 - HKCU\..\Run: [Steam] "c:\programme\valve\steam\steam.exe" -silent
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [La_View Mouse] C:\PROGRA~1\HAMAS1~1\S1_2k.exe
O4 - HKCU\..\Run: [swg] C:\Programme\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -trayboot
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe
O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Programme\ICQToolbar\toolbaru.dll/SEARCH.HTML
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra button: MedionShop - {A461BF3E-96B0-488F-9ACA-202335DDCC4B} - http://www.medionshop.de/ (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.aldi.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 8778405937
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 1142460296
O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://support.f-secure.com/ols3/fscax.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMe ... loader.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Programme\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Programme\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Programme\Home Cinema\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: AVM FRITZ!web Routing Service (de_serv) - Unknown owner - C:\Programme\Gemeinsame Dateien\AVM\de_serv.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: eTrust Antivirus RPC Server (InoRPC) - Computer Associates International, Inc. - C:\Programme\CA\eTrust Antivirus\InoRpc.exe
O23 - Service: eTrust Antivirus Realtime Server (InoRT) - Computer Associates International, Inc. - C:\Programme\CA\eTrust Antivirus\InoRT.exe
O23 - Service: eTrust Antivirus Job Server (InoTask) - Computer Associates International, Inc. - C:\Programme\CA\eTrust Antivirus\InoTask.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Programme\CyberLink\Shared Files\RichVideo.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

-
1.
fixe mit dem HijackThis:

R3 - URLSearchHook: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
O2 - BHO: My Search BHO - {014DA6C1-189F-421a-88CD-07CFE51CFF10} - C:\Programme\MySearch\bar\1.bin\S4BAR.DLL
O2 - BHO: (no name) - {9973D06F-B83F-4D2F-B153-4CF19640E67A} - C:\WINDOWS\system32\awtqo.dll (file missing)

2.
Secure Online Scanner Next Generation Beta
http://support.f-secure.com/enu/home/ols3.shtml

1. Klicke den Link: "F-Secure Online Scanner Next Generation Beta".
2. Du wirst aufgefordert werden, ein ActiveX-Control zu installieren
3. Installiere diese ActiveX-Komponente
4. Lies die Anleitung und klicke: "Accept"
5. Klicke "Full System Scan"
6. klicke "Show report" - kopiere den Scanreport

Scanning Report
Thursday, October 12, 2006 16:31:30 - 18:52:26
Computer name: DANIEL
Scanning type: Scan system for viruses, rootkits, spyware
Target: C:\ D:\ E:\ K:\


--------------------------------------------------------------------------------

Result: 5 malware found
Tracking Cookie (spyware)
System (Disinfected)
System
System
System
System

--------------------------------------------------------------------------------

Statistics
Scanned:
Files: 22209
System: 4850
Not scanned: 7
Actions:
Disinfected: 1
Renamed: 0
Deleted: 0
None: 4
Submitted: 0
Files not scanned:
C:\HIBERFIL.SYS
C:\PAGEFILE.SYS
C:\WINDOWS\TEMP\SQLITE_SZY0UZ5XPNJVXJK
C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT
C:\WINDOWS\SYSTEM32\CATROOT2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\CATDB
C:\WINDOWS\SOFTWAREDISTRIBUTION\EVENTCACHE\{18419E89-D0EE-4727-A85C-7F0943BE0CF3}.BIN
C:\DOKUMENTE UND EINSTELLUNGEN\ALL USERS\ANWENDUNGSDATEN\MUVEE TECHNOLOGIES\030625\0237\0192\VALUES

--------------------------------------------------------------------------------

Options
Scanning engines:
F-Secure AVP: 6.0.171, 2006-10-12
F-Secure Libra: 2.4.1, 2006-10-12
F-Secure Orion: 1.2.37, 2006-10-11
F-Secure Blacklight: 1.0.31, 0000-00-00
F-Secure Pegasus: 1.19.0, 2006-08-29
F-Secure Draco: 1.0.35, 2006-10-06
Scanning options:
Scan defined files: COM EXE SYS OV? BIN SCR DLL SHS HTM HTML HTT VBS JS INF VXD DO? XL? RTF CPL WIZ HTA PP? PWZ P?T MSO PIF . ACM ASP AX CNV CSC DRV INI MDB MPD MPP MPT OBD OBT OCX PCI TLB TSP WBK WBT WPC WSH VWP WML BOO HLP TD0 TT6 MSG ASD JSE VBE WSC CHM EML PRC SHB LNK WSF {* PDF ZL? XML ZIP XXX
Use Advanced heuristics