tja mir wurde von 3 tagen der Account von WOW geklaut und damit wurde schnell klar das die Kiste befallen ist. Nach einer Neuinstallation von C mit Win7 (war vorher auch drauf) hab ich leider immer noch die Seuche - sie will mich nicht verlassen

anbei schon mal der Lauf von Malwarebytes


Malwarebytes' Anti-Malware 1.44
Datenbank Version: 3562
Windows 6.1.7600
Internet Explorer 8.0.7600.16385

14.01.2010 17:54:27
mbam-log-2010-01-14 (17-54-27).txt

Scan-Methode: Vollständiger Scan (C:\|D:\|E:\|G:\|H:\|)
Durchsuchte Objekte: 199583
Laufzeit: 19 minute(s), 48 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 2
Infizierte Registrierungswerte: 2
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 1
Infizierte Dateien: 9

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{215cu8f1-6f10-02dj-a7wq-12q5xbx0d4c4} (Generic.Bot.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\SlysBitch (Bifrose.Trace) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\windows dll (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\windows dll (Backdoor.Bot) -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
C:\Program Files\Windowsdll (Backdoor.Bot) -> Quarantined and deleted successfully.

Infizierte Dateien:
C:\Windows\System32\spool\prtprocs\w32x86\1458.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{430E53AF-D7CA-490A-B217-FA2671484C96}\RP106\A0050773.exe (Malware.Tool) -> Quarantined and deleted successfully.
D:\download-alt\Norton.Ghost.v12.0-EDGE\Norton.Ghost.v12.0-keygen.exe (Malware.Packer.Krunchy) -> Quarantined and deleted successfully.
E:\System Volume Information\_restore{430E53AF-D7CA-490A-B217-FA2671484C96}\RP104\A0050627.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
H:\programme\Daemon\Patch\daemon.tools.pro.patch.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\Windowsdll\dll32.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Users\mustermann\AppData\Roaming\logs.dat (Bifrose.Trace) -> Quarantined and deleted successfully.
C:\Users\mustermann\AppData\Local\Temp\UuU.uUu (Malware.Trace) -> Quarantined and deleted successfully.
C:\Users\mustermann\AppData\Local\Temp\XxX.xXx (Malware.Trace) -> Delete on reboot.


RSIT

leider kommt beim versuch RSIT auszuführen die fehlermeldung:

Line -1:
Error: Variable used without being declared

hmm was mach ich falsch?

Also log dazu hab ich das hier:

Logfile of random's system information tool 1.06 (written by random/random)
Run by mustermann at 2010-01-14 18:16:22
Microsoft Windows 7 Home Premium
System drive C: has 19 GB (63%) free of 30 GB
Total RAM: 2046 MB (72% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:16:23, on 14.01.2010
Platform: Unknown Windows (WinNT 6.01.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskhost.exe
C:\Programme\Windows7FirewallControl\Windows7FirewallControl.exe
C:\Program Files\Avast4\ashDisp.exe
C:\Program Files\NVIDIA Corporation\NvMixer\NvMixerTray.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\NOTEPAD.EXE
D:\Download\RSIT.exe
C:\Program Files\trend micro\mustermann.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = ht*p://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = w*w.google.de
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = ht*p://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = ht*p://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = ht*p://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = ht*p://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O4 - HKLM\..\Run: [Windows7FirewallControl] C:\Programme\Windows7FirewallControl\Windows7FirewallControl.exe
O4 - HKLM\..\Run: [avast!] "C:\Program Files\Avast4\ashDisp.exe"
O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [ Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETZWERKDIENST')
O13 - Gopher Prefix:
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Avast4\ashWebSv.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: Windows7FirewallService - Sphinx Software - C:\Programme\Windows7FirewallControl\Windows7FirewallService.exe

--
End of file - 3385 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows7FirewallControl"=C:\Programme\Windows7FirewallControl\Windows7FirewallControl.exe [2009-06-29 724992]
"avast!"=C:\Program Files\Avast4\ashDisp.exe [2009-11-25 81000]
"NVMixerTray"=C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe [2004-12-20 131072]
" Malwarebytes Anti-Malware (reboot)"=C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe [2010-01-07 1394000]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"=C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [2010-01-13 2001648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [2009-09-03 548352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=credssp.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppInfo]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppMgmt]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Base]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Boot Bus Extender]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Boot file system]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CryptSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\DcomLaunch]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\EFS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\EventLog]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\File system]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Filter]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HelpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\KeyIso]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Netlogon]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NTDS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PCI Configuration]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PlugPlay]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PNP Filter]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Power]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Primary disk]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ProfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\RpcEptMapper]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\RpcSs]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sacsvr]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SCSI Class]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sermouse.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SWPRV]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\System Bus Extender]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TabletInputService]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TBS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TrustedInstaller]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\VDS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vga.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vgasave.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vmms]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgr.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgrx.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinMgmt]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{36FC9E60-C465-11CF-8056-444553540000}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E965-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E969-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96A-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96B-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96F-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E977-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E97B-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E97D-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E980-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AppInfo]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AppMgmt]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Base]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\BFE]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Boot Bus Extender]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Boot file system]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\bowser]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Browser]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\CryptSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\DcomLaunch]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\dfsc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Dhcp]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\DnsCache]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Dot3Svc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Eaphost]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\EFS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\EventLog]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\File system]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Filter]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\HelpSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\IKEEXT]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\ipnat.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\KeyIso]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\LanmanServer]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\LanmanWorkstation]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\LmHosts]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Messenger]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MPSDrv]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MPSSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mrxsmb]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mrxsmb10]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mrxsmb20]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NativeWifiP]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NDIS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NDIS Wrapper]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\ndiscap]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Ndisuio]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NetBIOS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NetBIOSGroup]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NetBT]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NetDDEGroup]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Netlogon]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NetMan]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\netprofm]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Network]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NetworkProvider]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NlaSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Nsi]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nsiproxy.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NTDS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PCI Configuration]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PlugPlay]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PNP Filter]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PNP_TDI]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PolicyAgent]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Power]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Primary disk]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\ProfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\rdbss]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\rdpencdd.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\rdsessmgr]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\RpcEptMapper]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\RpcSs]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\sacsvr]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SCardSvr]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SCSI Class]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\sermouse.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SharedAccess]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Streams Drivers]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SWPRV]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\System Bus Extender]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\TabletInputService]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\TBS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Tcpip]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\TDI]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\TrustedInstaller]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\VaultSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\VDS]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\vga.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\vgasave.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\vmms]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\volmgr.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\volmgrx.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WinDefend]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WinMgmt]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wlansvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{36FC9E60-C465-11CF-8056-444553540000}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E965-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E967-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E969-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E96A-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E96B-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E96F-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E972-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E973-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E974-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E975-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E977-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E97B-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E97D-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E980-E325-11CE-BFC1-08002BE10318}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{50DD5230-BA8A-11D1-BF5D-0000F805F530}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableUIADesktopToggle"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2010-01-14 18:07:48 ----D---- C:\rsit
2010-01-14 18:07:48 ----D---- C:\Program Files\trend micro
2010-01-14 17:28:47 ----D---- C:\Users\mustermann\AppData\Roaming\Malwarebytes
2010-01-14 17:28:43 ----D---- C:\ProgramData\Malwarebytes
2010-01-14 17:28:43 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-01-13 21:12:03 ----A---- C:\Windows\system32\msv1_0.dll
2010-01-13 21:10:27 ----A---- C:\Windows\system32\MRT.exe
2010-01-13 21:09:53 ----A---- C:\Windows\system32\tzres.dll
2010-01-13 21:09:24 ----D---- C:\Program Files\Common Files\NVIDIA Shared
2010-01-13 21:09:23 ----HD---- C:\Program Files\InstallShield Installation Information
2010-01-13 21:09:15 ----A---- C:\Windows\system32\msasn1.dll
2010-01-13 21:09:13 ----A---- C:\Windows\system32\wmp.dll
2010-01-13 21:09:11 ----A---- C:\Windows\system32\CertEnroll.dll
2010-01-13 21:09:10 ----A---- C:\Windows\system32\winresume.exe
2010-01-13 21:09:10 ----A---- C:\Windows\system32\winload.exe
2010-01-13 21:09:10 ----A---- C:\Windows\explorer.exe
2010-01-13 21:09:08 ----A---- C:\Windows\system32\wmploc.DLL
2010-01-13 21:09:00 ----A---- C:\Windows\system32\t2embed.dll
2010-01-13 21:09:00 ----A---- C:\Windows\system32\fontsub.dll
2010-01-13 21:09:00 ----A---- C:\Windows\system32\atmfd.dll
2010-01-13 21:08:59 ----A---- C:\Windows\system32\mshtml.dll
2010-01-13 21:08:58 ----A---- C:\Windows\system32\msfeedsbs.dll
2010-01-13 21:05:38 ----A---- C:\Windows\system32\nvuide.exe
2010-01-13 21:05:21 ----A---- C:\Windows\system32\nvusmb.exe
2010-01-13 21:04:38 ----D---- C:\Program Files\Common Files\InstallShield
2010-01-13 20:56:18 ----A---- C:\Windows\HideWin.exe
2010-01-13 20:51:06 ----A---- C:\Windows\system32\OpenCL.dll
2010-01-13 20:51:05 ----A---- C:\Windows\system32\nvoglv32.dll
2010-01-13 20:51:05 ----A---- C:\Windows\system32\nvencodemft.dll
2010-01-13 20:51:05 ----A---- C:\Windows\system32\nvdecodemft.dll
2010-01-13 20:51:05 ----A---- C:\Windows\system32\nvd3dum.dll
2010-01-13 20:51:05 ----A---- C:\Windows\system32\nvcuvid.dll
2010-01-13 20:51:05 ----A---- C:\Windows\system32\nvcuvenc.dll
2010-01-13 20:51:04 ----A---- C:\Windows\system32\nvcuda.dll
2010-01-13 20:51:03 ----A---- C:\Windows\system32\nvcompiler.dll
2010-01-13 20:51:03 ----A---- C:\Windows\system32\nvcod178.dll
2010-01-13 20:51:03 ----A---- C:\Windows\system32\nvcod.dll
2010-01-13 20:22:04 ----D---- C:\Users\mustermann\AppData\Roaming\Macromedia
2010-01-13 20:22:04 ----D---- C:\Users\mustermann\AppData\Roaming\Adobe
2010-01-13 20:22:00 ----D---- C:\Windows\system32\Macromed
2010-01-13 20:20:03 ----D---- C:\Users\mustermann\AppData\Roaming\teamspeak2
2010-01-13 19:41:04 ----D---- C:\Users\mustermann\AppData\Roaming\vlc
2010-01-13 19:40:44 ----D---- C:\Program Files\VideoLAN
2010-01-13 19:23:37 ----D---- C:\Program Files\CCleaner
2010-01-13 18:51:22 ----N---- C:\Windows\system32\MpSigStub.exe
2010-01-13 18:45:22 ----A---- C:\Users\mustermann\AppData\Roaming\SQLite3.dll
2010-01-13 18:45:14 ----D---- C:\ProgramData\SUPERAntiSpyware.com
2010-01-13 18:45:06 ----D---- C:\Users\mustermann\AppData\Roaming\SUPERAntiSpyware.com
2010-01-13 18:45:06 ----D---- C:\Program Files\SUPERAntiSpyware
2010-01-13 18:37:00 ----D---- C:\Users\mustermann\AppData\Roaming\WinRAR
2010-01-13 18:06:27 ----D---- C:\Program Files\WinRAR
2010-01-13 18:05:09 ----D---- C:\ProgramData\WinZip
2010-01-13 18:05:08 ----D---- C:\Program Files\WinZip
2010-01-13 18:02:45 ----D---- C:\Program Files\Avast4
2010-01-13 18:02:45 ----A---- C:\Windows\system32\MSVCR71.dll
2010-01-13 18:02:45 ----A---- C:\Windows\system32\MSVCP71.dll
2010-01-13 18:02:45 ----A---- C:\Windows\system32\MFC71.dll
2010-01-13 18:02:45 ----A---- C:\Windows\system32\aswBoot.exe
2010-01-13 17:58:17 ----D---- C:\Users\mustermann\AppData\Roaming\Mozilla
2010-01-13 17:58:14 ----D---- C:\Program Files\Mozilla Firefox
2010-01-13 17:53:06 ----D---- C:\Program Files\NVIDIA Corporation
2010-01-13 17:52:58 ----D---- C:\ProgramData\NVIDIA
2010-01-13 17:52:34 ----D---- C:\Windows\system32\AGEIA
2010-01-13 17:52:34 ----D---- C:\Program Files\AGEIA Technologies
2010-01-13 17:52:30 ----SHD---- C:\Windows\Installer
2010-01-13 17:52:28 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2010-01-13 17:52:26 ----A---- C:\Windows\system32\nvuninst.exe
2010-01-13 17:52:00 ----D---- C:\NVIDIA
2010-01-13 17:51:02 ----D---- C:\Program Files\Windows7FirewallControl
2010-01-13 17:49:30 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-01-13 17:46:46 ----D---- C:\Users\mustermann\AppData\Roaming\Identities
2010-01-13 17:46:38 ----SD---- C:\Users\mustermann\AppData\Roaming\Microsoft
2010-01-13 17:46:38 ----D---- C:\Users\mustermann\AppData\Roaming\Media Center Programs
2010-01-13 17:46:27 ----SHD---- C:\Recovery
2010-01-13 17:46:27 ----SHD---- C:\Programme
2010-01-13 17:46:27 ----SHD---- C:\ProgramData\Vorlagen
2010-01-13 17:46:27 ----SHD---- C:\ProgramData\Startmenü
2010-01-13 17:46:27 ----SHD---- C:\ProgramData\Favoriten
2010-01-13 17:46:27 ----SHD---- C:\ProgramData\Dokumente
2010-01-13 17:46:27 ----SHD---- C:\ProgramData\Anwendungsdaten
2010-01-13 17:46:27 ----SHD---- C:\Program Files\Gemeinsame Dateien
2010-01-13 17:46:27 ----SHD---- C:\Dokumente und Einstellungen
2010-01-13 17:40:53 ----D---- C:\Windows\SoftwareDistribution
2010-01-13 17:38:15 ----D---- C:\Windows\Prefetch
2010-01-13 17:38:04 ----SHD---- C:\System Volume Information
2010-01-13 17:37:13 ----D---- C:\Windows\Panther
2010-01-13 17:37:09 ----RASH---- C:\BOOTSECT.BAK
2010-01-13 17:37:08 ----SHD---- C:\Boot

======List of files/folders modified in the last 1 months======

2010-01-14 18:16:23 ----D---- C:\Windows\Temp
2010-01-14 18:09:02 ----D---- C:\Windows\System32
2010-01-14 18:09:02 ----D---- C:\Windows\inf
2010-01-14 18:07:48 ----RD---- C:\Program Files
2010-01-14 18:07:37 ----D---- C:\Windows\system32\config
2010-01-14 18:04:41 ----D---- C:\Windows
2010-01-14 18:04:30 ----D---- C:\Windows\system32\drivers
2010-01-14 18:03:10 ----D---- C:\Windows\Globalization
2010-01-14 17:28:43 ----HD---- C:\ProgramData
2010-01-14 17:25:18 ----D---- C:\Windows\debug
2010-01-14 17:22:13 ----D---- C:\Windows\Microsoft.NET
2010-01-14 17:21:48 ----RSD---- C:\Windows\assembly
2010-01-14 17:10:50 ----SD---- C:\ProgramData\Microsoft
2010-01-13 21:14:13 ----D---- C:\Windows\winsxs
2010-01-13 21:12:30 ----D---- C:\Program Files\Internet Explorer
2010-01-13 21:12:29 ----D---- C:\Windows\system32\Boot
2010-01-13 21:12:29 ----D---- C:\Windows\ehome
2010-01-13 21:12:29 ----D---- C:\Windows\AppPatch
2010-01-13 21:12:29 ----D---- C:\Program Files\Windows Media Player
2010-01-13 21:12:05 ----D---- C:\Windows\system32\catroot2
2010-01-13 21:12:05 ----D---- C:\Windows\system32\catroot
2010-01-13 21:10:08 ----D---- C:\Windows\system32\de-DE
2010-01-13 21:09:24 ----D---- C:\Program Files\Common Files
2010-01-13 21:07:41 ----D---- C:\Windows\Logs
2010-01-13 21:05:41 ----D---- C:\Windows\system32\DriverStore
2010-01-13 18:35:07 ----D---- C:\Windows\system32\wdi
2010-01-13 17:52:53 ----D---- C:\Windows\Help
2010-01-13 17:52:31 ----D---- C:\Windows\system32\CodeIntegrity
2010-01-13 17:49:10 ----D---- C:\Windows\system32\wbem
2010-01-13 17:47:46 ----D---- C:\Windows\system32\restore
2010-01-13 17:46:45 ----SHD---- C:\$Recycle.Bin
2010-01-13 17:46:36 ----RD---- C:\Users
2010-01-13 17:46:27 ----D---- C:\Program Files\Windows NT
2010-01-13 17:44:15 ----D---- C:\Windows\rescache
2010-01-13 17:41:05 ----D---- C:\Windows\system32\sysprep

Das Neuaufsetzen hat nichts gebracht da die anderen nicht Formatierten festplatten befallen sind und nun u.a die C Festplatte angegrifen haben!
Der einfachste weg für dich wäre "komplet" Neuaufsetzen!
Vorher alle Ext. Datenträger mit Formatieren!

Norton.Ghost.v12.0-keygen.exe

Finger weg von keygen!!!
Wer sowas herunterlädt sollte sich nicht über Viren wundern
Lass es dir mit dem Neuaufsetzen durch den Kopf gehen, ich würd es dir aber dringend raten den dein System zu 100% Sauber zu bekommen kann nicht gewährleistet werden. Die Sicherheitslücken die entstanden sind lassen sich ebendfals nicht beheben....

Gruß
Black_Light

danke fuer die antwort.

hmm mit Ghost arbeite ich sicher schon 2 JAhre nicht mehr. Sind halt uralt platten.

Wiegesagt der Rechner wurde erst wieder von 4 Wochen reaktiviert mit Win7.

gibt es keine Möglichkeit ausser alle Platten platt machen? auch die externen?

Wir können deine PC bereinigen! Doch das würde viel mehr zeit ins Anspruch nehmen da bist du mit dem Neuinstalieren besser dran. Außerdem wird nur so eine 100% Sicherheit gewährleistet.

Dateien, die crack.exe, keygen.exe oder patch.exe sind zu 99,9% gefährliche Schädlinge, mit denen man nicht Spaßen sollte.
Ausserdem sind diese illegal und somit beschränkt sich der Support auf
Anleitung zum Neu aufsetzten

okay ihr habt recht. bin schon am platt machen.

leider ist im link nix von win7 also mach ich es wie bei vista.

reicht es wenn ich die anderen partitionen einfach formatiere per windows?