hallo
können sie mir Bitte helfen?
Ich vermute das ich etwas auf meinem PC habe.
Ich hatte mein System mit SDFix und HijackThis gescannt
Vielen dank im voraus
Gruß,MaxPeter


SDFix: Version 1.182
Run by Frank on 06.08.2008 at 15:08

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\DOKUME~1\Frank\EIGENE~1\TROJAN~1.08\SDFix

Checking Services :


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting


Checking Files :

Trojan Files Found:


Note - Files associated with the MBR Rootkit have been found on this system, to check the PC use Gmer or Dr.Web CureIt

Could Not Remove C:\WINDOWS\Temp\bca4e2da.$$$
Could Not Remove C:\WINDOWS\Temp\fa56d7ec.$$$



Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1359.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-06 15:16:11
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000000
"ujdew"=hex:7e,96,56,85,7b,2e,67,08,c4,31,de,27,39,62,7c,ea,bb,39,e0,d6,70,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000000
"ujdew"=hex:7e,96,56,85,7b,2e,67,08,c4,31,de,27,39,62,7c,ea,bb,39,e0,d6,70,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000000
"ujdew"=hex:7e,96,56,85,7b,2e,67,08,c4,31,de,27,39,62,7c,ea,bb,39,e0,d6,70,..

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\System]
"OODEFRAG08.00.00.01WORKSTATION"="B80E080586B3F9CD70BEC7CD2FDAA6DC87A0D8F31ABD620B292EC582A9A293769016840F38BBEEA1CB494EB78C3DB1466522BFBAA6832FA45185 D313D64BFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C8EDD5E5BE2F6E6678EDD5E5BE2F6E667A6A0AC4980AC79 33A2D97226D213B555A8714885B713C9A839AD1A7E7E48D260402B8A869BF15D056EFB8012C830ADDF438CE260EA6BC1481FFE8A290B7275E09C16035D192DE2553C2A1CF500641DB7E63A C7CE8A0CB963AF844C181A2CA7F6FBAE475628D05A55688275EB1B8C414286395E3DED8B0C83EC533D5A9F36C81C8F84C5BF7BE2CC8FEC2E30A5AD1AE5BA0E6B1FDCA3646A35CD27CA40C5 3411CF7ACB84ABFA5212943D7A889577E1A9615B5699A4E9F45B8ABEDFF7606A2C8793D55C9BF33F6CDA773E57C975729D03FB3FA370CA387FB4191DFDDC969E8B0C6F2DB237319768A950 C65A5541496BB653812259CF342AA6F9BDABA47EA79F4EEC016E184407DC55BAA6BBA0B7DBCB62335BC39DF13C00AE4DE4B08EFC009DD61BC3D2904FC3C708D51E59B4DD3C2475EBFA1D9D B7DFEEA332CFFDECB5541C7D8DDEC70B3AB78840C56032B0FBB3BE335401E9C9E963C9AC4E2D2629940696EF592F5A82AF81E253B119ED439E3EC8B4438506A996414749CC205E3C47AB6B B1198239889EF480E3C463D3B21589D2631512F4D60D248047D9BE8437BE0D5F17ED1E39C03A986D7031D151D874F9D2012B235BFE64EDF5CC2915153CB22A1A4AF63B52627AA41A46A8E7 F62393A6A2A0E9AC846674B007D2ED2234821D3226485E039EBB9A89DA87E19FF81110DB7EAA3B93DD615BB7FC2663D6A8D63B0CF2E34B9760AB9869E72C9AE5B139C918895A8933F8DAF8 FD80E6471E5C9690D055C26F0CF9A6381ADDFD129A1D46E390C7BEC6588A51F3B4210ADACF5FB5E24D82DEFBE974B480A7BD1D8A945C7347AA233C68C46F56B4C05058623CE43CB9059685 27AB7A73BC4F6A7B4D9C34112004E78BE5AF2312683965EE2A26424467AB11D72E41DC11FB052DDEA4EE8E875E6A49B73B41C93C7FEB19BEFDC3F27EFB2CD6CDCB8F0FD4916C33E2613C76 CDB5635CA0EA99A62531598B8CB04297ACCD22ACAE456EA81414638BF6562A9DF29FA419F8784AA42EF3B43FEF16BEEF277660C099E0A966BB5FF6ABDD5BD15A96561A5ECA6C59D1CD08E7 1A56094CE5D8D36D9FFE6982A84D92E86AAD4C40246D5CE2ECEFD43FDF0EEB0FE581687302C18A80BE272D2A71DB903186D089F5974374546B98BF6BA60E657A5185142E75F27E8875A9FD CAEA1180F89E08F4697673A6F3E048C4409C7EFD2F6E4BF16B9017D9277E75B3815EA74DA0B7637701A5F0BFFEBB58F91362278365B40FEB8ECC660CB1F7CBA8DA3E"
"OOCC06.00.00.01WSSV"="083DDD9C19EEE4D614308D9DF49D0E737394ED0C594C2670E9979BAAB11AC2D328E9B092FD374FEB8D050C61B8AA39CE37F1E37E132F6F6263A9FEBC9E127BE CC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C8EDD5E5BE2F6E6678EDD5E5BE2F6E6675D575E7D6A3B9808FEBC9E127BECC74C9 23F41C9D3A2A9D09D2EA093FA58C5F43D02BD680CCD06985966619A0417F62DE8B357BFADB8EC1D8032A90799AEE12AB8EEA91CED072BDF649D451F030D718E920832AD4B840C5DE395E3F 616F21A63AFD7D7E09879F0DEF6B32A42C9C165E72B0E012692F657C841124227C34E0D5A958020CB6A286F6F2216EC096631FED3817AC6C1DA232DDD43458D5FE611740C140E307635B8D 1302B12400058F97E3196E4599CF244035BCA30626EBB2A1937068B097F427857038C5DA8B313E037A522C8E5549AB4E3C46838AD246E30D8647E687F084B54D20E720E80B77E4E13948E0 9680E88F7EC64662736D4A15F265ABEF43CB47FDEAB3B3F1E7723F6CC0DAC7A6835F064B1CDC3402B92D9EB9208A742683C3002D05EB909EF8C90CC0EB55B388FF229CAAA4CB524D3AD8F5 6CD199CB35ECEA8E904787B18C5951EC364B053CD0B9C65CECFC24BF5174856DF36864D745399CEC1779D356A46BEEE14C8B80DF64B7F5A73311E604DCF7612F815121619AB16D709CD86E 1317D83A8E8D61743A024C0BE32855E0EF5399FAC8A599391692B117FB24E7C41535A3877634DAD746F4E554FF7A599356E767F136B947421627FA980A5E3E052E8B07F8818917063B7E68 8CB270DFAFAEC8C2534EB7CB3EA35B3579F3E9DA45EC0B8548F0DAB689905EC79F5135DBB47556375074D6BE2D6C43DDFA048ADD06D5A0C0643BFC6305F1646999786DA314546CAA702C55 E2814ABF062CC0BEA7F4EECAA35DD20B2F9C6DC3B32FA3C6FBEE50DF24823FEF7BD11B489CEF2B95261936279D61E126388A001765B70E628DCDC2FF036E917FDF38461A4E8E402003813D 53D35C56CF0B404DB0B854B2CB41A23E2BE25DC9F5AA9E7E5C5CBF601395CE69B24EE1D7C18EACDFB6A7363A26B187414B91E839F9AD778ABD2E184CAE2396DB83B74ED0337AA9CA46F3A1 559430BD061A27BE990720835CD966DE8E6094D4864F78D0732D20A524CD5473E51DA3D7B209FED2260B457661DBE03084FD9AB5E8E30D13B34932F189C3C5743FDF28A7E56BA78BFF15D7 9131EDE0B4673A9FCD8D7203060A244D7D675A9FD0DC9EEE525C05FF2DB1A8AB4890AEBC10EB5EDFAA696E56A510FD5D3BF6785220611D953FE4DDF8912A37DE2594DC039CC6E42F57A530 796ED7C5A87C4BB1C7E1E265F6CE0A0F23D054C9A7258879C5673E865D0C8CB699D18E40C6A9DE99DA049CCD0DDE313AF5F5846EE64A18EA050F7613A"
"OODEFRAG10.00.00.01WORKSTATION"="EF840E1DA9EA0436922C0149EB73942ADAB3F8490F11D414B8D9FEA87C605E5BF0F32B5C37C4457D496442D60FC5065648DAEDF5EBB97DA8026A FAB59EC2F508F86FAEBFCE1BC0FE0DC228BC6A32DF18F3BC51822E9A3F2ACE0FE488BD4103F848E0FEB3CA80DFA53C4CBEEBC7F90472FC9C7906323F154EA0647E7DFEBC9E127BECC74CFE BC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933A2D97226D213B5559DB7CE019D40AA5CC038D530D6EB3452973A05BA FE4F66AC9A19DD49ABD85129D128CDE44D826FAC2A8DA753D2B2F1E7B97B5F8407CC69018BE20A9BDEC1064CEDE8E1D559FA6DD2E33B64B96C0697AD10A3FE91849FC8AA43FDC1C693868E 470F6EB1762E1F527A6FED22EC3AE9004BFC2B9A5DAEC23437B7B0D57760FD816F5AE9C8C6E345415D42E542E375CFF500E7FB10F07F65408BDE33BB7023B4DEEB7681D45FD8F44008D5D5 CB2B1FDDA95B39785E6E38E8E45CB5330C057BE8853812CFA6E7ADEA3ADA28E4E960766D2EC4E173A90A5B6500B5BB50839FCC0F3D255C623520C7977D8AB92E6C38040DFB75D3B5388BAE 24CFF573A0833E3FCEAE550BBA9859D09F3B9F91C04479907BEBFA84FAF84F3FA3F94FE5AC11F04103E641D54F117BB4DA8B77391E097FA9303F38EF72F945DB16874A9D7254DD7FBB5734 F90B80FEA4576843BDBEF538A2D51A6195C070F19563E2BF2B619BBCF0BB55CEB7CA6AF21853AF07300EEAA812470281F57E326EC6255D5F21DFD55C4C7B9A83D4E17AF9C446A39BA76AE8 E8D097E3751937BBE588A92D2C18C6991E0E26441B19147E4AAAD56BAD3DA618A0FD0D8D700A6BAD99BA74E8FBAB629E76769B5332D01DE72D8960113F0E0A42137A1F34F5D40DCC5C7F3B 0CFAFAF3C2EE0AEE2E37CD2CCD0366F504A2BCCF5891ED7C6E621007FE973F68F8A6A9B107A48F679DEC63DFE7BB0B5A9403EEA66B03410736614FB4D147249A7352E0438EC815014F6DEA D016DE0508F9DCCC3232E324D36DF5AEE3737C9E25A3A4494524A2696B5523C089D886A4294FFE058789C287ACD674CB5BB95ADF8D161916CA34872189234E4685D7607F9F131049356E43 228E9809CA529A1961103BFC77564F6814F21482DFB85B306D80A688CFB6059C6DAB3F2F5073B3075D19677528E3AAC45F746428758951CA0E135135D08113192868B93B09604481D14CD2 76625D9E32618C367A73CFCC9A40D33DB58B7B8419545FDBCF22AC307E04FE1ACCE526A8D941ED0F884DDB031F2AF4F70140806710B75E5DE8CE607F85F8BD3D16F5126979E382563773ED 4E68B5D875DD355D70845D6658D2C677DD34FCC5A145D96A2762F6635CBE62BDAB9F8E190BE9B4D7F39212AC4CB1C2E11B391F8A8FA25F6C4878EAE0D0A89473BD7C"

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services :




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Programme\\IncrediMail\\bin\\IMApp.exe"="C:\\Programme\\IncrediMail\\bin\\IMApp.exe:*:Enabled:IncrediMail"
"C:\\Programme\\IncrediMail\\bin\\IncMail.exe"="C:\\Programme\\IncrediMail\\bin\\IncMail.exe:*:Enabled:IncrediMail"
"C:\\Programme\\IncrediMail\\bin\\ImpCnt.exe"="C:\\Programme\\IncrediMail\\bin\\ImpCnt.exe:*:Enabled:IncrediMail"
"C:\\Programme\\IncrediMail\\bin\\ImLc.exe"="C:\\Programme\\IncrediMail\\bin\\ImLc.exe:*:Enabled:IncrediMail"
"C:\\Programme\\IncrediMail\\bin\\ImPackr.exe"="C:\\Programme\\IncrediMail\\bin\\ImPackr.exe:*:Enabled:IncrediMail"
"C:\\WINDOWS\\system32\\ZoneLabs\\vsmon.exe"="C:\\WINDOWS\\system32\\ZoneLabs\\vsmon.exe:*:Enabled:TrueVector Service"
"C:\\Programme\\Gemeinsame Dateien\\Acronis\\Agent\\agent.exe"="C:\\Programme\\Gemeinsame Dateien\\Acronis\\Agent\\agent.exe:*:Enabled:Acronis Remote Agent"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Programme\\iTunes\\iTunes.exe"="C:\\Programme\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"C:\\Programme\\ICQ6\\ICQ.exe"="C:\\Programme\\ICQ6\\ICQ.exe:*:Enabled:ICQ6"
"C:\\Programme\\Yahoo!\\Messenger\\YahooMessenger.exe"="C:\\Programme\\Yahoo!\\Messenger\\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\\Programme\\Yahoo!\\Messenger\\YServer.exe"="C:\\Programme\\Yahoo!\\Messenger\\YServer.exe:*:Enabled:Yahoo! FT Server"
"C:\\Programme\\FlashFXP\\FlashFXP.exe"="C:\\Programme\\FlashFXP\\FlashFXP.exe:*:Enabled:FlashFXP v3"
"C:\\Programme\\uTorrent\\uTorrent.exe"="C:\\Programme\\uTorrent\\uTorrent.exe:*:Enabled:æTorrent"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Programme\\MSN Messenger\\msnmsgr.exe"="C:\\Programme\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.0"
"C:\\Programme\\MSN Messenger\\msncall.exe"="C:\\Programme\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Programme\\FlashFXP\\FlashFXP.exe"="C:\\Programme\\FlashFXP\\FlashFXP.exe:*:Enabled:FlashFXP v3"

Remaining Files :

C:\WINDOWS\Temp\bca4e2da.$$$ Found
C:\WINDOWS\Temp\fa56d7ec.$$$ Found

File Backups: - C:\DOKUME~1\Frank\EIGENE~1\TROJAN~1.08\SDFix\backups\backups.zip

Files with Hidden Attributes :

Sat 3 Nov 2007 48 ..SH. --- "C:\WINDOWS\SE258FE47.tmp"
Mon 28 Jan 2008 1,404,240 A.SHR --- "C:\Programme\Spybot - Search & Destroy\SDUpdate.exe"
Mon 28 Jan 2008 5,146,448 A.SHR --- "C:\Programme\Spybot - Search & Destroy\SpybotSD.exe"
Mon 28 Jan 2008 2,097,488 A.SHR --- "C:\Programme\Spybot - Search & Destroy\TeaTimer.exe"
Sat 30 Dec 2006 4,348 A.SH. --- "C:\Dokumente und Einstellungen\All Users\DRM\DRMv1.bak"
Mon 31 Mar 2008 32,256 ...H. --- "C:\Dokumente und Einstellungen\Frank\Desktop\Links f�rs FSB Forum\~WRL1421.tmp"
Sat 29 Mar 2008 31,232 ...H. --- "C:\Dokumente und Einstellungen\Frank\Desktop\Links f�rs FSB Forum\~WRL3117.tmp"
Fri 11 Apr 2008 20,480 ...H. --- "C:\Dokumente und Einstellungen\Frank\Desktop\Links f�rs FSB Forum\~WRL4081.tmp"
Thu 8 May 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\ccba472a05828aa2a3ee32c96c6466ca\BIT109.tmp"
Fri 8 Feb 2008 576,512 ...H. --- "C:\Dokumente und Einstellungen\Frank\Anwendungsdaten\Microsoft\Vorlagen\~WRL0031.tmp"
Sat 15 Dec 2007 536,064 A..H. --- "C:\Dokumente und Einstellungen\Frank\Anwendungsdaten\Microsoft\Vorlagen\~WRL1550.tmp"
Sat 7 Jul 2007 369,664 A..H. --- "C:\Dokumente und Einstellungen\Frank\Anwendungsdaten\Microsoft\Vorlagen\~WRL3306.tmp"
Fri 27 Jun 2008 667,136 ...H. --- "C:\Dokumente und Einstellungen\Frank\Anwendungsdaten\Microsoft\Vorlagen\~WRL3348.tmp"
Sun 8 Apr 2007 308,736 A..H. --- "C:\Dokumente und Einstellungen\Frank\Anwendungsdaten\Microsoft\Word\~WRL0005.tmp"
Fri 20 Apr 2007 315,392 A..H. --- "C:\Dokumente und Einstellungen\Frank\Anwendungsdaten\Microsoft\Word\~WRL0159.tmp"
Mon 28 Jan 2008 575,488 ...H. --- "C:\Dokumente und Einstellungen\Frank\Anwendungsdaten\Microsoft\Word\~WRL0318.tmp"
Sun 20 Jan 2008 573,952 ...H. --- "C:\Dokumente und Einstellungen\Frank\Anwendungsdaten\Microsoft\Word\~WRL0489.tmp"
Sun 13 Apr 2008 602,624 ...H. --- "C:\Dokumente und Einstellungen\Frank\Anwendungsdaten\Microsoft\Word\~WRL0818.tmp"
Wed 28 May 2008 641,536 ...H. --- "C:\Dokumente und Einstellungen\Frank\Anwendungsdaten\Microsoft\Word\~WRL1096.tmp"
Thu 17 Apr 2008 603,648 ...H. --- "C:\Dokumente und Einstellungen\Frank\Anwendungsdaten\Microsoft\Word\~WRL1452.tmp"
Mon 14 Apr 2008 603,136 ...H. --- "C:\Dokumente und Einstellungen\Frank\Anwendungsdaten\Microsoft\Word\~WRL1514.tmp"
Sun 27 Apr 2008 605,696 ...H. --- "C:\Dokumente und Einstellungen\Frank\Anwendungsdaten\Microsoft\Word\~WRL1956.tmp"
Wed 23 Jan 2008 576,000 ...H. --- "C:\Dokumente und Einstellungen\Frank\Anwendungsdaten\Microsoft\Word\~WRL2081.tmp"
Sat 10 May 2008 610,816 ...H. --- "C:\Dokumente und Einstellungen\Frank\Anwendungsdaten\Microsoft\Word\~WRL2209.tmp"
Tue 22 Jan 2008 575,488 ...H. --- "C:\Dokumente und Einstellungen\Frank\Anwendungsdaten\Microsoft\Word\~WRL3620.tmp"
Sat 31 May 2008 644,608 ...H. --- "C:\Dokumente und Einstellungen\Frank\Anwendungsdaten\Microsoft\Word\~WRL3762.tmp"
Mon 21 Jan 2008 574,464 ...H. --- "C:\Dokumente und Einstellungen\Frank\Anwendungsdaten\Microsoft\Word\~WRL3779.tmp"
Sat 7 Jun 2008 647,168 ...H. --- "C:\Dokumente und Einstellungen\Frank\Anwendungsdaten\Microsoft\Word\~WRL3865.tmp"

Finished!

--------------------------------------------------------------------------

[edit]
bitte editiere zukünftig deine links, wie es dir u.a. hier angezeigt wird:
http://www.trojaner-board.de/22771-a...tml#post171958

danke
GUA

[/edit]