schönen guten abend!!

mir ist aufgefallen das mein rechner irgendwie langsam ist. er braucht recht lange zum hochfahren. habe mal nen scan mit hijack und combo fix


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:18:34, on 21.10.2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18241)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programme\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\system32\nvsvc32.exe
E:\Spiele\Need for Speed ProStreet\PB\PnkBstrA.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\Rising\Rav\RavTask.exe
C:\Programme\Rising\Rav\Rav.exe
C:\PROGRAMME\RISING\RAV\ravmond.exe
C:\Programme\Rising\Rav\RavMon.exe
C:\PROGRAMME\RISING\RAV\RavStub.exe
C:\Programme\Trust\GM-4200 Gamer Mouse Optical\Panel.exe
C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Programme\IncrediMail\bin\ImApp.exe
C:\Programme\SpeedFan\speedfan.exe
C:\Programme\Vista Start Menu\VistaStartMenu.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Mozilla Firefox\firefox.exe
G:\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_07\bin\ssv.dll
O4 - HKLM\..\Run: [Trust Gaming mouse] "C:\Programme\Trust\GM-4200 Gamer Mouse Optical\Panel.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [TrojanScanner] C:\Programme\Trojan Remover\Trjscan.exe /boot
O4 - HKLM\..\Run: [RavTask] "C:\Programme\Rising\Rav\RavTask.exe" -system
O4 - HKCU\..\Run: [SteganosAntiSpam] "C:\Programme\Steganos AntiSpam 7\antispam.exe"
O4 - HKCU\..\Run: [IncrediMail] C:\Programme\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [speedfan] C:\Programme\SpeedFan\speedfan.exe
O4 - HKCU\..\Run: [VistaStartMenu] "C:\Programme\Vista Start Menu\VistaStartMenu.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O15 - Trusted Zone: *.windowsupdate.com
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://static.pe.studivz.net/photouploader/ImageUploader5.cab?nocache=1223411166
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1219348875218
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1221467848306
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Programme\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PunkBuster (PnkBstrA) - Unknown owner - E:\Spiele\Need for Speed ProStreet\PB\PnkBstrA.exe
O23 - Service: DiRT Drivers Auto Removal (pr2ah4nb) (pr2ah4nb) - CODEMASTERS - C:\WINDOWS\system32\pr2ah4nb.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Programme\Rising\Rav\CCenter.exe
O23 - Service: Rising RealTime Monitor (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\PROGRAMME\RISING\RAV\Ravmond.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 7130 bytes


so über combo fix kommt gleich

teil 1 combo fix

ComboFix 08-10-19.04 - Shadow 2008-10-21 21:51:31.1 - NTFSx86
ausgeführt von:: G:\ComboFix.exe
.
ADS - WINDOWS: deleted 96 bytes in 1 streams.
/wow section nicht fertiggestellt

((((((((((((((((((((((( Dateien erstellt von 2008-09-21 bis 2008-10-21 ))))))))))))))))))))))))))))))
.

2008-10-21 19:22 . 2008-10-21 19:22 <DIR> d-------- C:\Programme\Rising
2008-10-21 19:22 . 2008-10-21 19:21 1,060,864 --a------ C:\WINDOWS\system32\mfc71.dll
2008-10-21 19:21 . 2008-10-21 19:21 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Rising
2008-10-21 19:21 . 2008-10-21 19:24 42 --a------ C:\WINDOWS\Rav.ini
2008-10-21 19:21 . 2008-10-21 19:21 27 --a------ C:\WINDOWS\Language.ini
2008-10-21 14:39 . 2008-10-21 14:39 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Simply Super Software
2008-10-20 13:13 . 2008-10-20 13:13 <DIR> d-------- C:\Programme\Google
2008-10-19 09:33 . 2008-10-19 09:33 <DIR> d-------- C:\WINDOWS\system32\xlive
2008-10-18 21:57 . 2008-10-21 19:24 <DIR> d-------- C:\Programme\7-Zip
2008-10-18 18:51 . 2008-10-18 18:51 <DIR> d-------- C:\Programme\Driver-Soft
2008-10-18 18:47 . 2008-03-09 07:25 236 --ah----- C:\Programme\Gemeinsame Dateien\dx.reg
2008-10-18 18:34 . 2008-10-18 18:34 34,308 --a------ C:\WINDOWS\system32\Chip.dll
2008-10-18 13:35 . 2008-10-18 13:36 <DIR> d-------- C:\Programme\flatster
2008-10-18 13:35 . 2002-02-18 03:58 98,304 --a------ C:\WINDOWS\system32\unzip32.dll
2008-10-15 22:36 . 2008-10-15 22:36 <DIR> d-------- C:\Programme\Lavalys
2008-10-15 08:56 . 2008-10-15 08:56 <DIR> d-------- C:\Programme\EASEUS
2008-10-14 20:43 . 2008-09-15 17:24 1,846,528 -----c--- C:\WINDOWS\system32\dllcache\win32k.sys
2008-10-14 20:43 . 2008-09-08 12:41 333,824 -----c--- C:\WINDOWS\system32\dllcache\srv.sys
2008-10-13 22:24 . 2008-10-21 14:39 <DIR> d-------- C:\Dokumente und Einstellungen\Shadow\Anwendungsdaten\Simply Super Software
2008-10-13 21:13 . 2008-10-21 14:42 <DIR> d-------- C:\Programme\Trojan Remover
2008-10-13 21:13 . 2006-05-25 15:52 162,304 --a------ C:\WINDOWS\system32\ztvunrar36.dll
2008-10-13 21:13 . 2003-02-02 20:06 153,088 --a------ C:\WINDOWS\system32\UNRAR3.dll
2008-10-13 21:13 . 2005-08-26 01:50 77,312 --a------ C:\WINDOWS\system32\ztvunace26.dll
2008-10-13 21:13 . 2002-03-06 01:00 75,264 --a------ C:\WINDOWS\system32\unacev2.dll
2008-10-13 21:13 . 2006-06-19 13:01 69,632 --a------ C:\WINDOWS\system32\ztvcabinet.dll
2008-10-13 18:06 . 2008-10-13 18:06 <DIR> d-------- C:\Programme\Gemeinsame Dateien\DirectX
2008-10-13 04:32 . 2008-10-21 13:45 <DIR> d-------- C:\Programme\ICQLite
2008-10-13 04:32 . 2008-10-13 04:32 <DIR> d-------- C:\Program Files
2008-10-13 04:32 . 2008-10-13 04:33 <DIR> d-------- C:\Dokumente und Einstellungen\Shadow\Anwendungsdaten\ICQLite
2008-10-11 10:20 . 2008-10-11 10:20 <DIR> d-------- C:\Programme\Freecorder
2008-10-11 10:20 . 2008-10-11 10:20 737,280 --a------ C:\WINDOWS\iun6002.exe
2008-10-11 09:53 . 2008-10-11 09:55 <DIR> d-------- C:\Programme\Chameleon Clock
2008-10-09 21:36 . 2008-10-21 19:24 <DIR> d-------- C:\Programme\Microsoft Silverlight
2008-10-09 10:33 . 2008-10-09 10:33 25 --a------ C:\WINDOWS\WebEasy6.INI
2008-10-09 02:47 . 2008-10-09 02:47 42,320 --a------ C:\WINDOWS\system32\xfcodec.dll
2008-10-08 19:59 . 2008-04-14 07:52 1,888,992 --------- C:\WINDOWS\system32\ati3duag.dll
2008-10-08 19:57 . 2008-10-08 20:00 <DIR> d-------- C:\WINDOWS\ServicePackFiles
2008-10-08 19:56 . 2008-04-14 07:52 294,912 -----c--- C:\WINDOWS\system32\dllcache\dlimport.exe
2008-10-08 19:54 . 2008-04-13 23:53 1,309,184 --------- C:\WINDOWS\system32\drivers\mtlstrm.sys
2008-10-08 19:53 . 2006-12-29 00:31 19,569 --a------ C:\WINDOWS\002617_.tmp
2008-10-08 19:41 . 2008-10-08 19:42 <DIR> d-------- C:\Programme\iTunes
2008-10-08 19:41 . 2008-10-08 19:41 <DIR> d-------- C:\Programme\iPod
2008-10-08 19:41 . 2008-10-08 19:42 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-10-07 15:53 . 2008-06-24 18:42 74,240 -----c--- C:\WINDOWS\system32\dllcache\mscms.dll
2008-10-07 09:40 . 2008-10-07 09:41 <DIR> d--h-c--- C:\WINDOWS\ie8
2008-10-06 21:57 . 2008-10-09 21:36 16,832 --a------ C:\WINDOWS\system32\amcompat.tlb
2008-10-06 21:56 . 2008-10-09 21:36 23,392 --a------ C:\WINDOWS\system32\nscompat.tlb
2008-10-06 21:25 . 2008-10-14 20:45 1,393 --a------ C:\WINDOWS\imsins.BAK
2008-10-06 21:24 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-10-06 11:23 . 2008-10-06 11:23 <DIR> d-------- C:\WINDOWS\95FC26FB19FD4A96BBB1B1062E8648F5.TMP
2008-10-06 10:04 . 2008-10-06 21:38 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AOL
2008-10-06 10:03 . 2008-10-06 21:56 <DIR> d-------- C:\Programme\Gemeinsame Dateien\AOL
2008-10-04 16:55 . 2008-10-04 17:02 12 --a------ C:\WINDOWS\dirsaver.ini
2008-10-04 13:52 . 2008-10-04 13:52 <DIR> d-------- C:\Programme\IVT Corporation
2008-10-02 21:03 . 2008-10-02 21:10 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\POPWWPROFILES
2008-10-02 10:44 . 2008-10-04 13:51 32 --a------ C:\WINDOWS\0
2008-10-02 10:44 . 2008-10-02 10:44 0 --a------ C:\WINDOWS\system32\0
2008-10-02 10:38 . 2008-10-02 10:38 <DIR> d-------- C:\WINDOWS\system32\AGEIA
2008-10-02 10:38 . 2008-10-06 21:44 <DIR> d-------- C:\Programme\Gemeinsame Dateien\Wise Installation Wizard
2008-10-02 10:38 . 2008-10-02 10:38 <DIR> d-------- C:\Programme\AGEIA Technologies
2008-10-02 10:38 . 2008-10-02 10:38 <DIR> d-------- C:\Dokumente und Einstellungen\Shadow\Anwendungsdaten\InstallShield
2008-10-02 10:38 . 2008-09-17 09:55 201,050 --a------ C:\WINDOWS\system32\nvapps.nvb
2008-10-02 10:29 . 2008-08-05 20:10 1,684,736 --a------ C:\WINDOWS\system32\drivers\Ambfilt.sys
2008-10-02 10:29 . 2006-01-04 15:41 1,389,056 --a------ C:\WINDOWS\system32\drivers\Monfilt.sys
2008-10-02 09:40 . 2008-10-18 18:49 <DIR> d-------- C:\Programme\Driver Magician
2008-10-01 11:31 . 2008-10-01 11:31 <DIR> d-------- C:\Dokumente und Einstellungen\Shadow\Anwendungsdaten\Ulead Systems
2008-10-01 10:50 . 2008-10-01 10:50 <DIR> d-------- C:\Programme\BinaryMark
2008-10-01 10:50 . 2008-10-01 10:50 <DIR> d-------- C:\Dokumente und Einstellungen\Shadow\Anwendungsdaten\BinaryMark
2008-09-30 09:31 . 2008-09-30 09:31 <DIR> d-------- C:\Programme\ASCII
2008-09-30 09:12 . 2008-09-30 09:16 <DIR> d-------- C:\Programme\Microsoft Diagnostics and Recovery Toolset
2008-09-30 09:10 . 2008-10-09 21:36 <DIR> d-------- C:\WINDOWS\system32\XPSViewer
2008-09-30 09:10 . 2008-09-30 09:10 <DIR> d-------- C:\Programme\Reference Assemblies
2008-09-30 09:10 . 2008-09-30 09:10 <DIR> d-------- C:\Programme\MSBuild
2008-09-30 09:09 . 2006-06-29 13:07 14,048 --------- C:\WINDOWS\system32\spmsg2.dll
2008-09-29 23:05 . 2008-09-29 23:05 <DIR> d-------- C:\Programme\Western Digital Technologies
2008-09-29 12:38 . 2008-09-29 12:41 21,840 --a----t- C:\WINDOWS\system32\SIntfNT.dll
2008-09-29 12:38 . 2008-09-29 12:41 17,212 --a----t- C:\WINDOWS\system32\SIntf32.dll
2008-09-29 12:38 . 2008-09-29 12:41 12,067 --a----t- C:\WINDOWS\system32\SIntf16.dll
2008-09-26 20:05 . 2008-09-26 20:05 <DIR> d-------- C:\Programme\Canon
2008-09-26 20:05 . 2008-10-15 15:37 <DIR> d-------- C:\Dokumente und Einstellungen\Shadow\Anwendungsdaten\Canon
2008-09-24 21:34 . 2008-10-16 11:57 <DIR> d-------- C:\Programme\DAEMON Tools Lite
2008-09-24 12:50 . 2008-10-21 14:42 <DIR> d-a------ C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP
2008-09-24 11:13 . 2008-09-24 11:51 <DIR> d-------- C:\Programme\RegCleaner
2008-09-23 10:52 . 2003-09-17 17:35 339,968 --a------ C:\WINDOWS\system32\N067UFW.DLL
2008-09-23 10:52 . 2002-09-12 01:07 36,864 --a------ C:\WINDOWS\system32\CNQU70.DLL
2008-09-23 10:21 . 2004-06-14 14:56 427,864 --a------ C:\WINDOWS\system32\XceedZip.dll
2008-09-22 21:18 . 2008-09-29 23:11 <DIR> d-------- C:\Programme\Recover Keys
2008-09-21 09:03 . 2001-06-26 07:15 38,912 --------- C:\WINDOWS\system32\picn20.dll
2008-09-21 08:51 . 2006-01-12 15:40 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe
2008-09-21 08:51 . 2000-06-26 10:45 106,496 --------- C:\WINDOWS\system32\TwnLib20.dll

teil 2 combo fix



.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-21 19:52 34,973,728 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-10-21 17:53 --------- d-----w C:\Programme\SpeedFan
2008-10-21 17:23 426,260 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-10-21 17:21 62,448 ----a-w C:\WINDOWS\system32\drivers\HookNtos.sys
2008-10-21 17:21 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
2008-10-21 17:21 38,128 ----a-w C:\WINDOWS\system32\drivers\HOOKREG.sys
2008-10-21 17:21 30,320 ----a-w C:\WINDOWS\system32\drivers\HookHelp.sys
2008-10-21 17:21 237,168 ----a-w C:\WINDOWS\system32\bsmain.exe
2008-10-21 17:21 163,824 ----a-w C:\WINDOWS\system32\drivers\HookSys.sys
2008-10-21 17:21 13,680 ----a-w C:\WINDOWS\system32\drivers\HookCont.sys
2008-10-21 17:21 113,264 ----a-w C:\WINDOWS\system32\RavExt.dll
2008-10-21 17:21 10,640 ----a-w C:\WINDOWS\system32\drivers\RsNTGdi.sys
2008-10-21 17:17 --------- d-----w C:\Dokumente und Einstellungen\Shadow\Anwendungsdaten\Vista Start Menu
2008-10-21 13:04 --------- d-----w C:\Programme\Spybot - Search & Destroy
2008-10-21 13:03 --------- d-----w C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
2008-10-20 21:42 --------- d-----w C:\Dokumente und Einstellungen\Shadow\Anwendungsdaten\Xfire
2008-10-20 21:38 --------- d-----w C:\Dokumente und Einstellungen\Shadow\Anwendungsdaten\Hamachi
2008-10-19 07:20 2,383,469 ----a-w C:\WINDOWS\Internet Logs\tvDebug.zip
2008-10-17 06:55 --------- d--h--w C:\Programme\InstallShield Installation Information
2008-10-17 06:55 --------- d-----w C:\Programme\VID_0E8F&PID_0012
2008-10-16 09:41 --------- d-----w C:\Programme\Xfire
2008-10-15 14:16 8,882 ----a-w C:\Dokumente und Einstellungen\Shadow\Anwendungsdaten\wklnhst.dat
2008-10-15 09:10 319,488 ----a-w C:\WINDOWS\HideWin.exe
2008-10-15 08:19 73,216 ----a-w C:\WINDOWS\Internet Logs\xDBF.tmp
2008-10-15 08:19 3,098,112 ----a-w C:\WINDOWS\Internet Logs\xDB10.tmp
2008-10-13 21:15 66,560 ----a-w C:\WINDOWS\Internet Logs\xDBD.tmp
2008-10-13 21:15 3,096,064 ----a-w C:\WINDOWS\Internet Logs\xDBE.tmp
2008-10-13 02:37 --------- d-----w C:\Programme\Wondershare
2008-10-12 21:05 26,624 ----a-w C:\WINDOWS\Internet Logs\xDBC.tmp
2008-10-12 18:15 3,046,912 ----a-w C:\WINDOWS\Internet Logs\xDB8.tmp
2008-10-12 18:15 29,696 ----a-w C:\WINDOWS\Internet Logs\xDB7.tmp
2008-10-12 12:39 91,648 ----a-w C:\WINDOWS\Internet Logs\xDB5.tmp
2008-10-12 12:39 3,046,912 ----a-w C:\WINDOWS\Internet Logs\xDB6.tmp
2008-10-12 09:58 --------- d-----w C:\Dokumente und Einstellungen\Shadow\Anwendungsdaten\ICQ
2008-10-09 19:35 --------- d-----w C:\Programme\Windows Media Connect 2
2008-10-09 12:16 84,992 ----a-w C:\WINDOWS\Internet Logs\xDB3.tmp
2008-10-09 12:16 3,006,976 ----a-w C:\WINDOWS\Internet Logs\xDB4.tmp
2008-10-08 17:40 --------- d-----w C:\Programme\Gemeinsame Dateien\Apple
2008-10-07 14:02 3,030,528 ----a-w C:\WINDOWS\Internet Logs\xDB2.tmp
2008-10-07 14:02 220,160 ----a-w C:\WINDOWS\Internet Logs\xDB1.tmp
2008-10-06 19:24 --------- d-----w C:\Programme\Java
2008-10-06 10:11 --------- d-----w C:\Programme\PrintMaster
2008-10-06 10:11 --------- d-----w C:\Programme\Microsoft Works
2008-10-06 10:11 --------- d-----w C:\Dokumente und Einstellungen\Shadow\Anwendungsdaten\Skype
2008-10-06 10:11 --------- d-----w C:\Dokumente und Einstellungen\Shadow\Anwendungsdaten\Player
2008-10-06 10:10 --------- d-----w C:\Programme\TuneUp Utilities 2007
2008-10-06 09:33 2,847,232 ----a-w C:\WINDOWS\Internet Logs\xDBB.tmp
2008-10-06 09:28 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-10-04 11:55 --------- d-----w C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Bluetooth
2008-10-02 17:01 4,878,336 ----a-w C:\WINDOWS\system32\drivers\RtkHDAud.sys
2008-10-02 13:19 82,432 ----a-w C:\WINDOWS\Internet Logs\xDB9.tmp
2008-10-02 13:19 2,783,744 ----a-w C:\WINDOWS\Internet Logs\xDBA.tmp
2008-10-01 18:58 --------- d-----w C:\Programme\Zattoo
2008-09-30 16:01 16,864,768 ----a-w C:\WINDOWS\RTHDCPL.EXE
2008-09-30 14:38 2,168,320 ----a-w C:\WINDOWS\MicCal.exe
2008-09-26 07:00 --------- d-----w C:\Programme\ICQ6
2008-09-24 18:50 --------- d-----w C:\Programme\Ahead
2008-09-24 07:50 --------- d-----w C:\Programme\IncrediMail
2008-09-23 11:52 --------- d-----w C:\Programme\OO Software
2008-09-23 11:51 --------- d-----w C:\Programme\Elaborate Bytes
2008-09-23 11:50 --------- d-----w C:\Programme\SlySoft
2008-09-23 11:06 --------- d-----w C:\Dokumente und Einstellungen\Shadow\Anwendungsdaten\Ahead
2008-09-23 09:02 --------- d-----w C:\Programme\Intel
2008-09-22 20:59 --------- d-----w C:\Programme\ArtMoney
2008-09-21 16:25 --------- d-----w C:\Programme\Windows Desktop Search
2008-09-21 08:31 --------- d-----w C:\Programme\Nero
2008-09-21 06:51 --------- d-----w C:\Programme\Gemeinsame Dateien\Ahead
2008-09-21 06:24 --------- d-----w C:\Programme\xp-Iso-Builder
2008-09-20 07:16 170,496 ----a-w C:\WINDOWS\system32\BootMan.exe
2008-09-19 19:27 --------- d-----w C:\Programme\DivX
2008-09-19 19:25 --------- d-----w C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SlySoft
2008-09-19 18:42 86,408 ----a-w C:\WINDOWS\system32\setupempdrv03.exe
2008-09-19 18:42 8,704 ----a-w C:\WINDOWS\system32\epmntdrv.sys
2008-09-19 18:42 3,072 ----a-w C:\WINDOWS\system32\EuGdiDrv.sys
2008-09-19 18:42 14,848 ----a-w C:\WINDOWS\system32\EuEpmGdi.dll
2008-09-19 18:07 --------- d-----w C:\Dokumente und Einstellungen\Shadow\Anwendungsdaten\SuperEasy
2008-09-19 16:10 86,016 ----a-w C:\WINDOWS\system32\ResizeNTFS.dll
2008-09-19 16:10 61,952 ----a-w C:\WINDOWS\system32\FatResizeMove.dll
2008-09-19 16:10 472,576 ----a-w C:\WINDOWS\system32\NTFSFormat.dll
2008-09-19 16:10 22,016 ----a-w C:\WINDOWS\system32\FatFormat.dll
2008-09-19 16:09 92,672 ----a-w C:\WINDOWS\system32\Partition.dll
2008-09-19 16:09 31,744 ----a-w C:\WINDOWS\system32\FatLib.dll
2008-09-19 16:09 179,200 ----a-w C:\WINDOWS\system32\DeviceManager.dll
2008-09-19 16:09 124,416 ----a-w C:\WINDOWS\system32\NTFSCopy.dll
2008-09-19 16:08 86,528 ----a-w C:\WINDOWS\system32\NTFSLib.dll
2008-09-19 16:08 68,096 ----a-w C:\WINDOWS\system32\Device.dll
2008-09-19 16:08 6,144 ----a-w C:\WINDOWS\system32\CallbackOperator.dll
2008-09-19 16:08 44,032 ----a-w C:\WINDOWS\system32\FileSystemCheck.dll
2008-09-19 16:08 25,088 ----a-w C:\WINDOWS\system32\FATFileSystemAnalyser.dll
2008-09-19 16:08 24,576 ----a-w C:\WINDOWS\system32\NTFSFileSystemAnalyser.dll
2008-09-19 16:08 21,504 ----a-w C:\WINDOWS\system32\Fixup.dll
2008-09-19 16:08 14,848 ----a-w C:\WINDOWS\system32\FileSystemAnalyser.dll
2008-09-19 16:08 10,752 ----a-w C:\WINDOWS\system32\DeviceAdapter.dll
2008-09-19 15:48 1,200,128 ----a-w C:\WINDOWS\RtlUpd.exe
2008-09-19 14:06 65,517 ----a-w C:\WINDOWS\BricoPackUninst.cmd
2008-09-19 14:06 6,116 ----a-w C:\WINDOWS\BricoPackFoldersDelete.cmd
2008-09-18 19:35 0 ---ha-w C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-09-18 19:35 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_ggsemc_01005.Wdf
2008-09-18 19:04 --------- d-----w C:\Programme\Mobile Master
2008-09-18 18:09 --------- d-----w C:\Programme\Vista Start Menu
.

------- Sigcheck -------

2008-04-14 07:53 111616 65e60c18ddb0215c201ff75e32d564c8 C:\WINDOWS\ServicePackFiles\i386\wuauclt.exe
2008-07-18 22:10 68808 136896c2cdc3f689876e0d44485153ea C:\WINDOWS\system32\wuauclt.exe
2008-07-18 22:10 53448 d316e28958873859b88d72cf47ad1ea5 C:\WINDOWS\system32\dllcache\wuauclt.exe
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SteganosAntiSpam"="C:\Programme\Steganos AntiSpam 7\antispam.exe" [2004-12-01 1760085]
"IncrediMail"="C:\Programme\IncrediMail\bin\IncMail.exe" [2008-09-22 243072]
"speedfan"="C:\Programme\SpeedFan\speedfan.exe" [2008-04-22 3287552]
"VistaStartMenu"="C:\Programme\Vista Start Menu\VistaStartMenu.exe" [2008-07-09 2136064]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"KernelFaultCheck"="C:\WINDOWS\system32\dumprep 0 -k" [X]
"Trust Gaming mouse"="C:\Programme\Trust\GM-4200 Gamer Mouse Optical\Panel.exe" [2006-12-28 1232896]
"ZoneAlarm Client"="C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 919016]
"QuickTime Task"="C:\Programme\QuickTime\qttask.exe" [2008-09-06 413696]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-09-17 13574144]
"TrojanScanner"="C:\Programme\Trojan Remover\Trjscan.exe" [2008-10-09 967048]
"RavTask"="C:\Programme\Rising\Rav\RavTask.exe" [2008-10-21 211568]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 C:\WINDOWS\system32\bthprops.cpl]
"RTHDCPL"="RTHDCPL.EXE" [2008-09-30 C:\WINDOWS\RTHDCPL.EXE]
"Alcmtr"="ALCMTR.EXE" [2008-06-19 C:\WINDOWS\ALCMTR.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{32CD708B-60A7-4C00-9377-D73EAA495F0F}"= "C:\WINDOWS\system32\RavExt.dll" [2008-10-21 113264]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.XFR1"= xfcodec.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli scecli scecli scecli scecli scecli

[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Windows Search.lnk]
backup=C:\WINDOWS\pss\Windows Search.lnkCommon Startup

[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^Shadow^Startmenü^Programme^Autostart^Ereigniserinnerung.lnk]
backup=C:\WINDOWS\pss\Ereigniserinnerung.lnkStartup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BtTray
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpywareTerminator

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2008-04-14 07:52 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2006-01-12 15:40 155648 C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a------ 2008-09-17 09:55 13574144 C:\WINDOWS\system32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3 (0x3)
"sp_rssrv"=2 (0x2)
"iPod Service"=3 (0x3)
"NMIndexingService"=3 (0x3)
"Nero BackItUp Scheduler 3"=2 (0x2)
"IDriverT"=3 (0x3)
"Bonjour Service"=2 (0x2)
"BlueSoleil Hid Service"=2 (0x2)
"WinDefend"=2 (0x2)
"BlueSoleilCS"=2 (0x2)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe
"Google Update"="C:\Dokumente und Einstellungen\Shadow\Lokale Einstellungen\Anwendungsdaten\Google\Update\GoogleUpdate.exe" /c
"Sony Ericsson PC Suite"="C:\Programme\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon
"RegistryMechanic"=C:\Programme\Registry Mechanic\RegMech.exe /H

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"QuickTime Task"="C:\Programme\QuickTime\QTTask.exe" -atboottime
"Adobe Reader Speed Launcher"="C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe"
"EPSON Stylus D68 Series"=C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE /P23 "EPSON Stylus D68 Series" /O6 "USB001" /M "Stylus D68"
"iTunesHelper"="C:\Programme\iTunes\iTunesHelper.exe"
"vspdfprsrv.exe"=C:\Programme\Visagesoft\eXPert PDF\vspdfprsrv.exe --background
"C-Media Mixer"=Mixer.exe /startup
"NvCplDaemon"=RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
"nwiz"=nwiz.exe /install
"NvMediaCenter"=RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
"BluetoothAuthenticationAgent"=rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
"Alcmtr"=ALCMTR.EXE
"SunJavaUpdateSched"="C:\Programme\Java\jre1.6.0_07\bin\jusched.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Programme\\IncrediMail\\bin\\IncMail.exe"=
"C:\\Programme\\IncrediMail\\bin\\ImApp.exe"=
"C:\\Programme\\IncrediMail\\bin\\ImpCnt.exe"=
"C:\\Programme\\ICQ6\\ICQ.exe"=
"C:\\Programme\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
"C:\\Programme\\Bonjour\\mDNSResponder.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Programme\\iTunes\\iTunes.exe"=
"C:\\Programme\\ICQLite\\ICQLite.exe"=
"E:\\Spiele\\FlatOut Ultimate Carnage\\Fouc.exe"=

R2 BT848;Conexant's BtPCI WDM Video Capture;C:\WINDOWS\system32\DRIVERS\BT848.sys [2008-09-14 00:04]
R2 pr2ah4nb;DiRT Drivers Auto Removal (pr2ah4nb);C:\WINDOWS\system32\pr2ah4nb.exe svc []
R2 RsRavMon;Rising RealTime Monitor;C:\PROGRAMME\RISING\RAV\Ravmond.exe [2008-10-21 19:21]
R3 epmntdrv;epmntdrv;C:\WINDOWS\system32\epmntdrv.sys [2008-09-19 20:42]
R3 EuGdiDrv;EuGdiDrv;C:\WINDOWS\system32\EuGdiDrv.sys [2008-09-19 20:42]
R3 ggflt;SEMC USB Flash Driver Filter;C:\WINDOWS\system32\DRIVERS\ggflt.sys [2008-09-15 11:24]
R3 IvtBtBUs;IVT Bluetooth Bus Service;C:\WINDOWS\system32\Drivers\IvtBtBus.sys [2008-07-02 14:58]
R3 Usbfilt;Usbfilt;C:\WINDOWS\SYSTEM32\DRIVERS\usbfilt.sys [2004-02-01 05:53]
S0 BtHidBus;Bluetooth HID Bus Service;C:\WINDOWS\System32\Drivers\BtHidBus.sys [2008-07-31 20:45]
S0 pe3ah4nb;DiRT Environment Driver (pe3ah4nb);C:\WINDOWS\system32\drivers\pe3ah4nb.sys [2007-07-19 16:45]
S0 ps6ah4nb;DiRT Synchronization Driver (ps6ah4nb);C:\WINDOWS\system32\drivers\ps6ah4nb.sys [2007-07-19 16:43]
S0 RsNTGDI;RsNTGDI;C:\WINDOWS\system32\Drivers\RsNTGdi.sys [2008-10-21 19:21]
S1 HookCont;HookCont;C:\WINDOWS\system32\drivers\HookCont.sys [2008-10-21 19:21]
S1 HookNtos;HookNtos;C:\WINDOWS\system32\drivers\HookNtos.sys [2008-10-21 19:21]
S1 HookReg;HookReg;C:\WINDOWS\system32\drivers\HookReg.sys [2008-10-21 19:21]
S1 HookSys;HookSys;C:\WINDOWS\system32\drivers\HookSys.sys [2008-10-21 19:21]
S2 RsCCenter;Rising Process Communication Center;C:\Programme\Rising\Rav\CCenter.exe [2008-10-21 19:21]
S2 UxTuneUp;TuneUp Designerweiterung;C:\WINDOWS\System32\svchost.exe [2008-04-14 07:53]
S3 GMFilter Filter;GMFilter Filter;C:\WINDOWS\system32\Drivers\GMFilter.sys [2006-12-29 16:49]
S3 PAC207;SoC PC-Camera;C:\WINDOWS\system32\DRIVERS\pfc027.sys [2005-04-08 10:46]


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

*Newly Created Service* - HOOKCONT
*Newly Created Service* - HOOKNTOS
*Newly Created Service* - HOOKREG
*Newly Created Service* - HOOKSYS
*Newly Created Service* - PROCEXP90
*Newly Created Service* - RSNTGDI
*Newly Created Service* - RSRAVMON
.
Inhalt des "geplante Tasks" Ordners

2008-10-17 C:\WINDOWS\Tasks\1-Klick-Wartung.job
- C:\Programme\TuneUp Utilities 2007\SystemOptimizer.exe [2007-04-27 05:08]

2008-10-20 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Programme\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]

2008-10-21 C:\WINDOWS\Tasks\GoogleUpdateTaskUser.job
- C:\Dokumente und Einstellungen\Shadow\Lokale Einstellungen\Anwendungsdaten\Google\Update\GoogleUpdate.exe [2008-09-03 12:33]
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -

WebBrowser-{32099AAC-C132-4136-9E9A-4E364A424E17} - (no file)


.
------- Zusätzlicher Suchlauf -------
.
FireFox -: Profile - C:\Dokumente und Einstellungen\Shadow\Anwendungsdaten\Mozilla\Firefox\Profiles\nl5um30a.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - www.google.de
FF -: plugin - C:\Dokumente und Einstellungen\Shadow\Lokale Einstellungen\Anwendungsdaten\Google\Update\1.2.131.11\npGoogleOneClick5.dll
FF -: plugin - C:\Programme\iTunes\Mozilla Plugins\npitunes.dll
FF -: plugin - C:\Programme\Microsoft Silverlight\2.0.31005.0\npctrl.1.0.30716.0.dll
FF -: plugin - C:\Programme\Microsoft Silverlight\2.0.31005.0\npctrl.dll
FF -: plugin - C:\Programme\Mozilla Firefox\plugins\npijjiFFPlugin1.dll
FF -: plugin - C:\Programme\Mozilla Firefox\plugins\npsnapfish.dll
FF -: plugin - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-21 21:52:02
Windows 5.1.2600 Service Pack 3 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

Scanne versteckte Dateien...


**************************************************************************
.
Zeit der Fertigstellung: 2008-10-21 21:53:18
ComboFix-quarantined-files.txt 2008-10-21 19:53:16

Vor Suchlauf: 18 Verzeichnis(se), 44.324.126.720 Bytes frei
Nach Suchlauf: 18 Verzeichnis(se), 44,300,677,120 Bytes frei

WindowsXP-KB310994-SP2-Home-BootDisk-DEU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

369 --- E O F --- 2008-10-21 15:31:57