Hallo,

habe seit heute Mittag zwei "probleme". Und zwar hat es angefangen, das Antivir einen Fund gemeldet hat:

In der Datei 'C:\WINDOWS\system32\dllcache\figaro.sys'
wurde ein Virus oder unerwünschtes Programm 'TR/Rootkit.Gen' [trojan] gefunden.
Ausgeführte Aktion: Zugriff verweigern

dann ging alles ziemlich schnell, hab mit meinem Laienwissen versucht diesen Virus wieder weg zu bekommen mit dem Ergebnis, dass Antivir zwei Stunden später folgendes meldete:

Die Datei 'C:\WINDOWS\system32\2C.tmp'
enthielt einen Virus oder unerwünschtes Programm 'TR/Fakeavalert.B' [trojan].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4923eba2.qua' verschoben!

Wenn Windows jetzt startet, öffnen sich eine irrsinig große Anzahl an Fenstern, die Spybot aber unterbindet:

Komme jetzt auch nicht weiter, da weder Spybot, noch Antivir, noch das Windows tool zum entfernen bösartiger Software etwas 'böses' findet! Wie bekomme ich den oder die Viren wieder runter, am besten natürlich ohne Fomat C: da ich den Rechner Beruflich tagtäglich benötige!!!

Danke für eure Hilfe.....

Das Logfile kommt gleich....

Hier das Logfile
#
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:29:09, on 15.10.2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programme\Bonjour\mDNSResponder.exe
C:\Programme\Nero\Nero 7\InCD\InCDsrv.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programme\Microsoft SQL Server\MSSQL$HWOF\Binn\sqlservr.exe
C:\Programme\Microsoft SQL Server\MSSQL$INVENTORCONTENT\Binn\sqlservr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Programme\Spyware Doctor\pctsAuxs.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Spyware Doctor\pctsSvc.exe
C:\Programme\Spyware Doctor\pctsTray.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Programme\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
C:\Programme\Nero\Nero 7\InCD\NBHGui.exe
C:\Programme\Nero\Nero 7\InCD\InCD.exe
C:\Programme\DAEMON Tools\daemon.exe
C:\Programme\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe
C:\Programme\Messenger\msmsgs.exe
C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
C:\Programme\Duden\Duden Korrektor\dk3tray.exe
C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe
C:\Programme\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Programme\FinePixViewer\QuickDCF.exe
C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexStoreSvr.exe
C:\Programme\Office-Bibliothek\officebib.exe
C:\Programme\iPod\bin\iPodService.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HP1005MC.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Programme\Adobe\Reader 8.0\Reader\AcroRd32.exe
C:\Programme\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h**p://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Programme\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Programme\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Programme\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SecurDisc] C:\Programme\Nero\Nero 7\InCD\NBHGui.exe
O4 - HKLM\..\Run: [InCD] C:\Programme\Nero\Nero 7\InCD\InCD.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Programme\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [REGSHAVE] C:\Programme\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programme\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ISTray] "C:\Programme\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingA3574] command /c del "C:\WINDOWS\system32\smp\msrc.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingC7250] cmd /c del "C:\WINDOWS\system32\smp\msrc.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingA6752] command /c del "C:\WINDOWS\system32\h@tkeysh@@k.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC7374] cmd /c del "C:\WINDOWS\system32\h@tkeysh@@k.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA2200] command /c del "C:\WINDOWS\iTunesMusic.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingC3433] cmd /c del "C:\WINDOWS\iTunesMusic.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingA1158] command /c del "C:\WINDOWS\winsystem.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingC7197] cmd /c del "C:\WINDOWS\winsystem.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingA9639] command /c del "C:\WINDOWS\system32\akttzn.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingC3770] cmd /c del "C:\WINDOWS\system32\akttzn.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingA629] command /c del "C:\WINDOWS\system32\anticipator.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC9835] cmd /c del "C:\WINDOWS\system32\anticipator.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA5274] command /c del "C:\WINDOWS\system32\awtoolb.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC7628] cmd /c del "C:\WINDOWS\system32\awtoolb.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA3417] command /c del "C:\WINDOWS\system32\bdn.com"
O4 - HKLM\..\RunOnce: [SpybotDeletingC5194] cmd /c del "C:\WINDOWS\system32\bdn.com"
O4 - HKLM\..\RunOnce: [SpybotDeletingA2802] command /c del "C:\WINDOWS\system32\bsva-egihsg52.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingC9149] cmd /c del "C:\WINDOWS\system32\bsva-egihsg52.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingA2031] command /c del "C:\WINDOWS\system32\dpcproxy.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingC8087] cmd /c del "C:\WINDOWS\system32\dpcproxy.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingA5638] command /c del "C:\WINDOWS\system32\emesx.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC1308] cmd /c del "C:\WINDOWS\system32\emesx.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA1777] command /c del "C:\WINDOWS\system32\hoproxy.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC5843] cmd /c del "C:\WINDOWS\system32\hoproxy.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA7876] command /c del "C:\WINDOWS\system32\hxiwlgpm.dat"
O4 - HKLM\..\RunOnce: [SpybotDeletingC7165] cmd /c del "C:\WINDOWS\system32\hxiwlgpm.dat"
O4 - HKLM\..\RunOnce: [SpybotDeletingA6231] command /c del "C:\WINDOWS\system32\hxiwlgpm.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingC389] cmd /c del "C:\WINDOWS\system32\hxiwlgpm.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingA3328] command /c del "C:\WINDOWS\system32\medup012.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC4089] cmd /c del "C:\WINDOWS\system32\medup012.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA851] command /c del "C:\WINDOWS\system32\msgp.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingC1070] cmd /c del "C:\WINDOWS\system32\msgp.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingA4512] command /c del "C:\WINDOWS\system32\msnbho.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC6920] cmd /c del "C:\WINDOWS\system32\msnbho.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA7718] command /c del "C:\WINDOWS\system32\mssecu.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingC9605] cmd /c del "C:\WINDOWS\system32\mssecu.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingA5811] command /c del "C:\WINDOWS\system32\msvchost.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingC1956] cmd /c del "C:\WINDOWS\system32\msvchost.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingA5659] command /c del "C:\WINDOWS\system32\mtr2.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingC887] cmd /c del "C:\WINDOWS\system32\mtr2.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingA4399] command /c del "C:\WINDOWS\system32\mwin32.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingC7541] cmd /c del "C:\WINDOWS\system32\mwin32.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingA7555] command /c del "C:\WINDOWS\system32\netode.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingC7964] cmd /c del "C:\WINDOWS\system32\netode.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingA2185] command /c del "C:\WINDOWS\system32\newsd32.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingC5433] cmd /c del "C:\WINDOWS\system32\newsd32.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingA9576] command /c del "C:\WINDOWS\system32\ps1.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingC4223] cmd /c del "C:\WINDOWS\system32\ps1.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingA9026] command /c del "C:\WINDOWS\system32\psof1.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingC7094] cmd /c del "C:\WINDOWS\system32\psof1.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingA4992] command /c del "C:\WINDOWS\system32\psoft1.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingC8749] cmd /c del "C:\WINDOWS\system32\psoft1.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingA9633] command /c del "C:\WINDOWS\system32\regc64.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC7921] cmd /c del "C:\WINDOWS\system32\regc64.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA3510] command /c del "C:\WINDOWS\system32\regm64.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC1593] cmd /c del "C:\WINDOWS\system32\regm64.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA8229] command /c del "C:\WINDOWS\system32\Rundl1.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingC866] cmd /c del "C:\WINDOWS\system32\Rundl1.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingA7517] command /c del "C:\WINDOWS\system32\sncntr.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingC5214] cmd /c del "C:\WINDOWS\system32\sncntr.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingA5402] command /c del "C:\WINDOWS\system32\ssurf022.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC9353] cmd /c del "C:\WINDOWS\system32\ssurf022.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA1188] command /c del "C:\WINDOWS\system32\ssvchost.com"
O4 - HKLM\..\RunOnce: [SpybotDeletingC5306] cmd /c del "C:\WINDOWS\system32\ssvchost.com"
O4 - HKLM\..\RunOnce: [SpybotDeletingA6648] command /c del "C:\WINDOWS\system32\ssvchost.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingC3696] cmd /c del "C:\WINDOWS\system32\ssvchost.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingA8280] command /c del "C:\WINDOWS\system32\sysreq.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingC6729] cmd /c del "C:\WINDOWS\system32\sysreq.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingA479] command /c del "C:\WINDOWS\system32\taack.dat"
O4 - HKLM\..\RunOnce: [SpybotDeletingC5667] cmd /c del "C:\WINDOWS\system32\taack.dat"
O4 - HKLM\..\RunOnce: [SpybotDeletingA4955] command /c del "C:\WINDOWS\system32\taack.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingC6574] cmd /c del "C:\WINDOWS\system32\taack.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingA5952] command /c del "C:\WINDOWS\system32\temp#01.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingC9265] cmd /c del "C:\WINDOWS\system32\temp#01.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingA5673] command /c del "C:\WINDOWS\system32\thun.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC1602] cmd /c del "C:\WINDOWS\system32\thun.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA4038] command /c del "C:\WINDOWS\system32\thun32.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC5786] cmd /c del "C:\WINDOWS\system32\thun32.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA1536] command /c del "C:\WINDOWS\system32\VBIEWER.OCX"
O4 - HKLM\..\RunOnce: [SpybotDeletingC5894] cmd /c del "C:\WINDOWS\system32\VBIEWER.OCX"
O4 - HKLM\..\RunOnce: [SpybotDeletingA7444] command /c del "C:\WINDOWS\system32\vbsys2.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC3782] cmd /c del "C:\WINDOWS\system32\vbsys2.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA1999] command /c del "C:\WINDOWS\system32\vcatchpi.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC4466] cmd /c del "C:\WINDOWS\system32\vcatchpi.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA1090] command /c del "C:\WINDOWS\system32\winlogonpc.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingC6417] cmd /c del "C:\WINDOWS\system32\winlogonpc.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingA9431] command /c del "C:\WINDOWS\system32\winsystem.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingC8030] cmd /c del "C:\WINDOWS\system32\winsystem.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingA594] command /c del "C:\WINDOWS\system32\WINWGPX.EXE"
O4 - HKLM\..\RunOnce: [SpybotDeletingC1403] cmd /c del "C:\WINDOWS\system32\WINWGPX.EXE"
O4 - HKLM\..\RunOnce: [SpybotDeletingA8067] command /c del "C:\WINDOWS\a.bat"
O4 - HKLM\..\RunOnce: [SpybotDeletingC2310] cmd /c del "C:\WINDOWS\a.bat"
O4 - HKLM\..\RunOnce: [SpybotDeletingA5902] command /c del "C:\WINDOWS\base64.tmp"
O4 - HKLM\..\RunOnce: [SpybotDeletingC8290] cmd /c del "C:\WINDOWS\base64.tmp"
O4 - HKLM\..\RunOnce: [SpybotDeletingA2639] command /c del "C:\WINDOWS\bdn.com"
O4 - HKLM\..\RunOnce: [SpybotDeletingC2805] cmd /c del "C:\WINDOWS\bdn.com"
O4 - HKLM\..\RunOnce: [SpybotDeletingA5315] command /c del "C:\WINDOWS\FVProtect.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingC8345] cmd /c del "C:\WINDOWS\FVProtect.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingA7634] command /c del "C:\WINDOWS\mssecu.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingC527] cmd /c del "C:\WINDOWS\mssecu.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingA5941] command /c del "C:\WINDOWS\userconfig9x.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC7140] cmd /c del "C:\WINDOWS\userconfig9x.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA4658] command /c del "C:\WINDOWS\zip1.tmp"
O4 - HKLM\..\RunOnce: [SpybotDeletingC4602] cmd /c del "C:\WINDOWS\zip1.tmp"
O4 - HKLM\..\RunOnce: [SpybotDeletingA1433] command /c del "C:\WINDOWS\zip2.tmp"
O4 - HKLM\..\RunOnce: [SpybotDeletingC9818] cmd /c del "C:\WINDOWS\zip2.tmp"
O4 - HKLM\..\RunOnce: [SpybotDeletingA6306] command /c del "C:\WINDOWS\zip3.tmp"
O4 - HKLM\..\RunOnce: [SpybotDeletingC8621] cmd /c del "C:\WINDOWS\zip3.tmp"
O4 - HKLM\..\RunOnce: [SpybotDeletingA1295] command /c del "C:\WINDOWS\zipped.tmp"
O4 - HKLM\..\RunOnce: [SpybotDeletingC3223] cmd /c del "C:\WINDOWS\zipped.tmp"
O4 - HKLM\..\RunOnce: [SpybotDeletingA8173] command /c del "C:\WINDOWS\system32\medup020.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC5090] cmd /c del "C:\WINDOWS\system32\medup020.dll"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Duden Korrektor 3.5] C:\Programme\Duden\Duden Korrektor\dk3tray.exe
O4 - HKCU\..\RunOnce: [SpybotDeletingB5554] command /c del "C:\WINDOWS\system32\smp\msrc.exe"
O4 - HKCU\..\RunOnce: [SpybotDeletingD5332] cmd /c del "C:\WINDOWS\system32\smp\msrc.exe"
O4 - HKCU\..\RunOnce: [SpybotDeletingB6766] command /c del "C:\WINDOWS\system32\h@tkeysh@@k.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD3588] cmd /c del "C:\WINDOWS\system32\h@tkeysh@@k.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB4498] command /c del "C:\WINDOWS\winsystem.exe"
O4 - HKCU\..\RunOnce: [SpybotDeletingD1788] cmd /c del "C:\WINDOWS\winsystem.exe"
O4 - HKCU\..\RunOnce: [SpybotDeletingB1118] command /c del "C:\WINDOWS\system32\akttzn.exe"
O4 - HKCU\..\RunOnce: [SpybotDeletingD4036] cmd /c del "C:\WINDOWS\system32\akttzn.exe"
O4 - HKCU\..\RunOnce: [SpybotDeletingB3558] command /c del "C:\WINDOWS\system32\anticipator.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD5714] cmd /c del "C:\WINDOWS\system32\anticipator.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB5127] command /c del "C:\WINDOWS\system32\awtoolb.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD5526] cmd /c del "C:\WINDOWS\system32\awtoolb.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB4857] command /c del "C:\WINDOWS\system32\bdn.com"
O4 - HKCU\..\RunOnce: [SpybotDeletingD7192] cmd /c del "C:\WINDOWS\system32\bdn.com"
O4 - HKCU\..\RunOnce: [SpybotDeletingB5228] command /c del "C:\WINDOWS\system32\bsva-egihsg52.exe"
O4 - HKCU\..\RunOnce: [SpybotDeletingD1760] cmd /c del "C:\WINDOWS\system32\bsva-egihsg52.exe"
O4 - HKCU\..\RunOnce: [SpybotDeletingB3777] command /c del "C:\WINDOWS\system32\dpcproxy.exe"
O4 - HKCU\..\RunOnce: [SpybotDeletingD8316] cmd /c del "C:\WINDOWS\system32\dpcproxy.exe"
O4 - HKCU\..\RunOnce: [SpybotDeletingB9117] command /c del "C:\WINDOWS\system32\emesx.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD7041] cmd /c del "C:\WINDOWS\system32\emesx.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB1263] command /c del "C:\WINDOWS\system32\hoproxy.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD1450] cmd /c del "C:\WINDOWS\system32\hoproxy.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB2242] command /c del "C:\WINDOWS\system32\hxiwlgpm.dat"
O4 - HKCU\..\RunOnce: [SpybotDeletingD210] cmd /c del "C:\WINDOWS\system32\hxiwlgpm.dat"
O4 - HKCU\..\RunOnce: [SpybotDeletingB89] command /c del "C:\WINDOWS\system32\hxiwlgpm.exe"
O4 - HKCU\..\RunOnce: [SpybotDeletingD4445] cmd /c del "C:\WINDOWS\system32\hxiwlgpm.exe"
O4 - HKCU\..\RunOnce: [SpybotDeletingB3679] command /c del "C:\WINDOWS\system32\medup012.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD7872] cmd /c del "C:\WINDOWS\system32\medup012.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB2841] command /c del "C:\WINDOWS\system32\msgp.exe"
O4 - HKCU\..\RunOnce: [SpybotDeletingD5812] cmd /c del "C:\WINDOWS\system32\msgp.exe"
O4 - HKCU\..\RunOnce: [SpybotDeletingB7398] command /c del "C:\WINDOWS\system32\msnbho.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD9382] cmd /c del "C:\WINDOWS\system32\msnbho.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB6146] command /c del "C:\WINDOWS\system32\mssecu.exe"
O4 - HKCU\..\RunOnce: [SpybotDeletingD4297] cmd /c del "C:\WINDOWS\system32\mssecu.exe"
O4 - HKCU\..\RunOnce: [SpybotDeletingB3990] command /c del "C:\WINDOWS\system32\msvchost.exe"
O4 - HKCU\..\RunOnce: [SpybotDeletingD2851] cmd /c del "C:\WINDOWS\system32\msvchost.exe"
O4 - HKCU\..\RunOnce: [SpybotDeletingB1572] command /c del "C:\WINDOWS\system32\mtr2.exe"
O4 - HKCU\..\RunOnce: [SpybotDeletingD9193] cmd /c del "C:\WINDOWS\system32\mtr2.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: AutoCAD-Startbeschleuniger.lnk = C:\Programme\Gemeinsame Dateien\Autodesk Shared\acstart16.exe
O4 - Global Startup: Dienst-Manager.lnk = C:\Programme\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O4 - Global Startup: Exif Launcher.lnk = C:\Programme\FinePixViewer\QuickDCF.exe
O4 - Global Startup: Office-Bibliothek-Direktsuche.lnk = C:\Programme\Office-Bibliothek\PCLib.exe
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Programme\Gemeinsame Dateien\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Programme\Bonjour\mDNSResponder.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Programme\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Programme\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Programme\Spyware Doctor\pctsSvc.exe

--
End of file - 22325 bytes
#