Hallo,
den Teil ignorierst du, du hast eine ander Variante.


Grüße Wildone

soll ich denn ATF Cleanerund cleanup anwenden???

Nein.

Falls es ein Logfile gibt immer her damit, falls nicht poste danach wieder ein Log von Silentrunners.

Grüße Wildone

Logfile of HijackThis v1.99.1
Scan saved at 00:07:28, on 18.08.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
C:\Programme\Winamp\winampa.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programme\Lexmark X1100 Series\lxbkbmgr.exe
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe
C:\Programme\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Programme\ICQLite\ICQLite.exe
C:\Programme\Lexmark X1100 Series\lxbkbmon.exe
C:\Programme\Sunbelt Software\CounterSpy\Consumer\sunserver.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Programme\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\Programme\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
C:\Programme\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Programme\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Dokumente und Einstellungen\Angie\Desktop\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yooliety.de/
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {91A8ED78-F850-4AF2-90E0-5F1200853E0D} - C:\WINDOWS\system32\ddabb.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar2.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Toolbar mit Pop-Up-Blocker - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Programme\Winamp\winampa.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Programme\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Programme\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [ICQ Lite] "C:\Programme\ICQLite\ICQLite.exe" -minimize
O4 - HKLM\..\Run: [WinAntiVirusPro2006] "C:\Programme\WinAntiVirus Pro 2006\WinAV.exe" /min
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunServer] C:\Programme\Sunbelt Software\CounterSpy\Consumer\sunserver.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpyBrowser] C:\Programme\SpyBro\SpyBro.exe /autostart
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -trayboot
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BlueSoleil.lnk = ?
O4 - Global Startup: LimeWire 4.2.6 Pro.lnk = C:\Programme\LimeWire\LimeWire 4.2.6 Pro\LimeWire.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google-Suche - res://c:\programme\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Programme\ICQToolbar\toolbaru.dll/SEARCH.HTML
O8 - Extra context menu item: &Ins Deutsche übersetzen - res://c:\programme\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Im Cache gespeicherte Seite - res://c:\programme\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Verweisseiten - res://c:\programme\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Ähnliche Seiten - res://c:\programme\google\GoogleToolbar2.dll/cmsimilar.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O15 - Trusted Zone: http://www.amaena.com
O15 - Trusted Zone: http://locator.cdn.imageservr.com
O15 - Trusted Zone: http://locator1.cdn.imagesrvr.com
O15 - Trusted Zone: http://scanner.sysprotect.com
O15 - Trusted Zone: http://*.systemdoctor.com
O15 - Trusted Zone: http://www.winantivirus.com
O15 - Trusted Zone: http://www.winantiviruspro.com
O15 - Trusted Zone: http://download.cdn.winsoftware.com
O15 - Trusted IP range: http://202.67.220.225
O15 - Trusted IP range: http://59.148.220.121
O15 - Trusted IP range: http://62.4.84.53
O15 - Trusted IP range: http://82.98.235.58
O15 - Trusted IP range: http://85.12.25.90
O16 - DPF: {F919FBD3-A96B-4679-AF26-F551439BB5FD} - http://locator1.cdn.imagesrvr.com/sites/sysprotect.com/scanner/pages/scanner/SysProtectScannerInstall2.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://www.pop-radio.de/video_popup/ampx_en_dl.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: winjgf32 - winjgf32.dll (file missing)
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Programme\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Programme\ewido anti-spyware 4.0\guard.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE






"Silent Runners.vbs", revision 46, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS]
"SpyBrowser" = "C:\Programme\SpyBro\SpyBro.exe /autostart" [file not found]

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ {++}
"ICQ Lite" = "C:\Programme\ICQLite\ICQLite.exe -trayboot" ["ICQ Ltd."]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"SunJavaUpdateSched" = "C:\Programme\Java\jre1.5.0_06\bin\jusched.exe" ["Sun Microsystems, Inc."]
"WinampAgent" = "C:\Programme\Winamp\winampa.exe" [null data]
"BluetoothAuthenticationAgent" = "rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent" [MS]
"Lexmark X1100 Series" = ""C:\Programme\Lexmark X1100 Series\lxbkbmgr.exe"" ["Lexmark International, Inc."]
"TkBellExe" = ""C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot" ["RealNetworks, Inc."]
"avgnt" = ""C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min" ["Avira GmbH"]
"AdaptecDirectCD" = ""C:\Programme\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"" ["Roxio"]
"ICQ Lite" = ""C:\Programme\ICQLite\ICQLite.exe" -minimize" ["ICQ Ltd."]
"WinAntiVirusPro2006" = ""C:\Programme\WinAntiVirus Pro 2006\WinAV.exe" /min" [file not found]
"NeroCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"]
"SunServer" = "C:\Programme\Sunbelt Software\CounterSpy\Consumer\sunserver.exe" ["Sunbelt Software"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)
-> {HKLM...CLSID} = "AcroIEHlprObj Class"
\InProcServer32\(Default) = "C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)
-> {HKLM...CLSID} = "SSVHelper Class"
\InProcServer32\(Default) = "C:\Programme\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."]
{9030D464-4C02-4ABF-8ECC-5164760863C6}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Windows Live Sign-in Helper"
\InProcServer32\(Default) = "C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll" [MS]
{91A8ED78-F850-4AF2-90E0-5F1200853E0D}\(Default) = (no title provided)
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\ddabb.dll" [file not found]
{AA58ED58-01DD-4d91-8333-CF10577473F7}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Google Toolbar Helper"
\InProcServer32\(Default) = "c:\programme\google\googletoolbar2.dll" ["Google Inc."]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "CPL-Erweiterung für Anzeigeverschiebung"
-> {HKLM...CLSID} = "CPL-Erweiterung für Anzeigeverschiebung"
\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Erweiterung für HyperTerminal-Icons"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]
"{45AC2688-0253-4ED8-97DE-B5370FA7D48A}" = "Shell Extension for Malware scanning"
-> {HKLM...CLSID} = "Shell Extension for Malware scanning"
\InProcServer32\(Default) = "C:\Programme\AntiVir PersonalEdition Classic\shlext.dll" ["H+BEDV Datentechnik GmbH"]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data]
"{73B24247-042E-4EF5-ADC2-42F62E6FD654}" = "ICQ Lite Shell Extension"
-> {HKLM...CLSID} = "MCLiteShellExt Class"
\InProcServer32\(Default) = "C:\Programme\ICQLite\ICQLiteShell.dll" [empty string]
"{8D1636FD-CA49-4B4E-90E4-0A20E03A15E8}" = "jetAudio"
-> {HKLM...CLSID} = "JetFlExt"
\InProcServer32\(Default) = "C:\Programme\JetAudio\JetFlExt.dll" ["JetAudio, Inc."]
"{21569614-B795-46b1-85F4-E737A8DC09AD}" = "Shell Search Band"
-> {HKLM...CLSID} = "Shell Search Band"
\InProcServer32\(Default) = "C:\WINDOWS\system32\browseui.dll" [MS]
"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player"
-> {HKLM...CLSID} = "RealOne Player Context Menu Class"
\InProcServer32\(Default) = "C:\Programme\Real\RealPlayer\rpshell.dll" ["RealNetworks, Inc."]
"{E8D43C7E-EFA1-41A2-9AD9-0CFECD1678B7}" = "SafeErase"
-> {HKLM...CLSID} = "SafeEraseObj Class"
\InProcServer32\(Default) = "C:\Programme\OO Software\SafeErase\oosesh.dll" ["O&O Software GmbH"]
"{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D}" = "Messenger Sharing Folders"
-> {HKLM...CLSID} = "Meine freigegebenen Ordner"
\InProcServer32\(Default) = "C:\Programme\MSN Messenger\fsshext.8.0.0792.00.dll" [MS]
"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Programme\Microsoft Office\Office10\msohev.dll" [MS]
"{5E44E225-A408-11CF-B581-008029601108}" = "Adaptec DirectCD Shell Extension"
-> {HKLM...CLSID} = "Adaptec DirectCD Shell Extension"
\InProcServer32\(Default) = "C:\PROGRA~1\Roxio\EASYCD~1\DirectCD\Shellex.dll" ["Roxio"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
INFECTION WARNING! "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}" = "ewido anti-spyware 4.0"
-> {HKLM...CLSID} = "CShellExecuteHookImpl Object"
\InProcServer32\(Default) = "C:\Programme\ewido anti-spyware 4.0\shellexecutehook.dll" ["Anti-Malware Development a.s."]

HKLM\System\CurrentControlSet\Control\Session Manager\
"BootExecute" = ** WARNING -- empty or invalid data! **

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
INFECTION WARNING! winjgf32\DLLName = "winjgf32.dll" [file not found]

HKLM\Software\Classes\Folder\shellex\ColumnHandlers\
{F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info"
-> {HKLM...CLSID} = "PDF Shell Extension"
\InProcServer32\(Default) = "C:\Programme\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
ewido anti-spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"
-> {HKLM...CLSID} = "CContextScan Object"
\InProcServer32\(Default) = "C:\Programme\ewido anti-spyware 4.0\context.dll" ["Anti-Malware Development a.s."]
ICQLiteMenu\(Default) = "{73B24247-042E-4EF5-ADC2-42F62E6FD654}"
-> {HKLM...CLSID} = "MCLiteShellExt Class"
\InProcServer32\(Default) = "C:\Programme\ICQLite\ICQLiteShell.dll" [empty string]
SafeErase\(Default) = "{E8D43C7E-EFA1-41A2-9AD9-0CFECD1678B7}"
-> {HKLM...CLSID} = "SafeEraseObj Class"
\InProcServer32\(Default) = "C:\Programme\OO Software\SafeErase\oosesh.dll" ["O&O Software GmbH"]
Shell Extension for Malware scanning\(Default) = "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}"
-> {HKLM...CLSID} = "Shell Extension for Malware scanning"
\InProcServer32\(Default) = "C:\Programme\AntiVir PersonalEdition Classic\shlext.dll" ["H+BEDV Datentechnik GmbH"]
ShellExtension\(Default) = "{1AC5C88A-DEA7-462b-A232-04AF5CA42E7E}"
-> {HKLM...CLSID} = "ShellExtension Class"
\InProcServer32\(Default) = "C:\Programme\WinAntiVirus Pro 2006\WAV6COM.dll" [file not found]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
ewido anti-spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"
-> {HKLM...CLSID} = "CContextScan Object"
\InProcServer32\(Default) = "C:\Programme\ewido anti-spyware 4.0\context.dll" ["Anti-Malware Development a.s."]
ICQLiteMenu\(Default) = "{73B24247-042E-4EF5-ADC2-42F62E6FD654}"
-> {HKLM...CLSID} = "MCLiteShellExt Class"
\InProcServer32\(Default) = "C:\Programme\ICQLite\ICQLiteShell.dll" [empty string]
jetAudio\(Default) = "{8D1636FD-CA49-4B4E-90E4-0A20E03A15E8}"
-> {HKLM...CLSID} = "JetFlExt"
\InProcServer32\(Default) = "C:\Programme\JetAudio\JetFlExt.dll" ["JetAudio, Inc."]
ShellExtension\(Default) = "{1AC5C88A-DEA7-462b-A232-04AF5CA42E7E}"
-> {HKLM...CLSID} = "ShellExtension Class"
\InProcServer32\(Default) = "C:\Programme\WinAntiVirus Pro 2006\WAV6COM.dll" [file not found]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
jetAudio\(Default) = "{8D1636FD-CA49-4B4E-90E4-0A20E03A15E8}"
-> {HKLM...CLSID} = "JetFlExt"
\InProcServer32\(Default) = "C:\Programme\JetAudio\JetFlExt.dll" ["JetAudio, Inc."]
SafeErase\(Default) = "{E8D43C7E-EFA1-41A2-9AD9-0CFECD1678B7}"
-> {HKLM...CLSID} = "SafeEraseObj Class"
\InProcServer32\(Default) = "C:\Programme\OO Software\SafeErase\oosesh.dll" ["O&O Software GmbH"]
Shell Extension for Malware scanning\(Default) = "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}"
-> {HKLM...CLSID} = "Shell Extension for Malware scanning"
\InProcServer32\(Default) = "C:\Programme\AntiVir PersonalEdition Classic\shlext.dll" ["H+BEDV Datentechnik GmbH"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data]


Active Desktop and Wallpaper:
-----------------------------

Active Desktop is disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Dokumente und Einstellungen\Angie\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp"


Startup items in "Angie" & "All Users" startup folders:
-------------------------------------------------------

C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart
"Adobe Reader - Schnellstart" -> shortcut to: "C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe" ["Adobe Systems Incorporated"]
"BlueSoleil" -> shortcut to: "C:\Programme\IVT Corporation\BlueSoleil\BlueSoleil.exe" ["IVT Corporation"]
"LimeWire 4.2.6 Pro" -> shortcut to: "C:\Programme\LimeWire\LimeWire 4.2.6 Pro\LimeWire.exe -startup" ["LimeWire, LLC"]
"Microsoft Office" -> shortcut to: "C:\Programme\Microsoft Office\Office10\OSA.EXE -b -l" [MS]


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000004\LibraryPath = "%SystemRoot%\system32\wshbth.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 30
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05


Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
"{855F3B16-6D32-4FE6-8A56-BBB695989046}"
-> {HKLM...CLSID} = "ICQ Toolbar"
\InProcServer32\(Default) = "C:\Programme\ICQToolbar\toolbaru.dll" ["ICQ Inc."]
"{2318C2B1-4965-11D4-9B18-009027A5CD4F}"
-> {HKLM...CLSID} = "&Google"
\InProcServer32\(Default) = "c:\programme\google\googletoolbar2.dll" ["Google Inc."]
"{EF99BD32-C1FB-11D2-892F-0090271D4F88}"
-> {HKLM...CLSID} = "Yahoo! Toolbar mit Pop-Up-Blocker"
\InProcServer32\(Default) = "C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll" ["Yahoo! Inc."]

HKLM\Software\Microsoft\Internet Explorer\Toolbar\
"{855F3B16-6D32-4FE6-8A56-BBB695989046}" = (no title provided)
-> {HKLM...CLSID} = "ICQ Toolbar"
\InProcServer32\(Default) = "C:\Programme\ICQToolbar\toolbaru.dll" ["ICQ Inc."]
"{2318C2B1-4965-11D4-9B18-009027A5CD4F}" = (no title provided)
-> {HKLM...CLSID} = "&Google"
\InProcServer32\(Default) = "c:\programme\google\googletoolbar2.dll" ["Google Inc."]
"{EF99BD32-C1FB-11D2-892F-0090271D4F88}" = (no title provided)
-> {HKLM...CLSID} = "Yahoo! Toolbar mit Pop-Up-Blocker"
\InProcServer32\(Default) = "C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll" ["Yahoo! Inc."]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Konsole"
"CLSIDExtension" = "{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}"
-> {HKCU...CLSID} = "Java Plug-in"
\InProcServer32\(Default) = "C:\Programme\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."]
-> {HKLM...CLSID} = "Java Plug-in 1.5.0_06"
\InProcServer32\(Default) = "C:\Programme\Java\jre1.5.0_06\bin\npjpi150_06.dll" ["Sun Microsystems, Inc."]

{B863453A-26C3-4E1F-A54D-A2CD196348E9}\
"ButtonText" = "ICQ Lite"
"MenuText" = "ICQ Lite"
"Exec" = "C:\Programme\ICQLite\ICQLite.exe" ["ICQ Ltd."]

{FB5F1910-F110-11D2-BB9E-00C04F795683}\
"ButtonText" = "Messenger"
"MenuText" = "Windows Messenger"
"Exec" = "C:\Programme\Messenger\msmsgs.exe" [MS]


Miscellaneous IE Hijack Points
------------------------------

HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\

Missing lines (compared with English-language version):
"{855F3B16-6D32-4fe6-8A56-BBB695989046}" = (no title provided)
-> {HKLM...CLSID} = "ICQ Toolbar"
\InProcServer32\(Default) = "C:\Programme\ICQToolbar\toolbaru.dll" ["ICQ Inc."]


Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

AntiVir PersonalEdition Classic Guard, AntiVirService, "C:\Programme\AntiVir PersonalEdition Classic\avguard.exe" ["AVIRA GmbH"]
AntiVir PersonalEdition Classic Planer, AntiVirScheduler, "C:\Programme\AntiVir PersonalEdition Classic\sched.exe" ["Avira GmbH"]
BlueSoleil Hid Service, BlueSoleil Hid Service, "C:\Programme\IVT Corporation\BlueSoleil\BTNtService.exe" [null data]
Bluetooth Support Service, BthServ, "C:\WINDOWS\system32\svchost.exe -k bthsvcs" {"C:\WINDOWS\System32\bthserv.dll" [MS]}
ewido anti-spyware 4.0 guard, ewido anti-spyware 4.0 guard, "C:\Programme\ewido anti-spyware 4.0\guard.exe" ["Anti-Malware Development a.s."]

Hallo,
okay, das sieht doch schon ganz gut aus. Jetzt machst du noch vor folgende Einträge einen Haken und klickst auf "fix checked":

O4 - HKLM\..\Run: [WinAntiVirusPro2006] "C:\Programme\WinAntiVirus Pro 2006\WinAV.exe" /min
O15 - Trusted Zone: ht*p://www.amaena.com
O15 - Trusted Zone: ht*p://locator.cdn.imageservr.com
O15 - Trusted Zone: ht*p://locator1.cdn.imagesrvr.com
O15 - Trusted Zone: ht*p://scanner.sysprotect.com
O15 - Trusted Zone: ht*p://*.systemdoctor.com
O15 - Trusted Zone: ht*p://www.winantivirus.com
O15 - Trusted Zone: ht*p://www.winantiviruspro.com
O15 - Trusted Zone: ht*p://download.cdn.winsoftware.com
O15 - Trusted IP range: ht*p://202.67.220.225
O15 - Trusted IP range: ht*p://59.148.220.121
O15 - Trusted IP range: ht*p://62.4.84.53
O15 - Trusted IP range: ht*p://82.98.235.58
O15 - Trusted IP range: ht*p://85.12.25.90
O20 - Winlogon Notify: winjgf32 - winjgf32.dll (file missing)

Counterspy kannst du wieder deinstallieren.

Mach mal noch einen Scan mit Ewido und poste noch mal das Ergebnis. Hast du noch irgendwelche Symptome? Popups?

Edit
Achja, falls noch vorhanden löschst du folgende Ordner:
c:\programme\winantivirus pro 2006\
C:\Programme\Gemeinsame Dateien\WinAntiVirus Pro 2006\


Grüße Wildone

---------------------------------------------------------
ewido anti-spyware - Scan-Bericht
---------------------------------------------------------

+ Erstellt um: 01:52:46 18.08.2006

+ Scan-Ergebnis:



C:\VundoFix Backups\ddabb.dll -> Adware.Virtumonde : Mit Backup gesäubert (unter Quarantäne gestellt).
C:\WINDOWS\Downloaded Program Files\__delete_on_reboot__U_S_Y_P___0_0_0_3___N_9_1_M_0_9_0_8_N_e_t_I_n_s_t_a_l_l_e_r_._e_x_e_ -> Not-A-Virus.Downloader.Win32.WinFixer.o : Ignoriert.
C:\Dokumente und Einstellungen\Angie\Cookies\angie@2o7[1].txt -> TrackingCookie.2o7 : Gesäubert.
:mozilla.69:C:\Dokumente und Einstellungen\Angie\Anwendungsdaten\Mozilla\Firefox\Profiles\ctc9n305.default\cookies.txt -> TrackingCookie.Adition : Gesäubert.
:mozilla.70:C:\Dokumente und Einstellungen\Angie\Anwendungsdaten\Mozilla\Firefox\Profiles\ctc9n305.default\cookies.txt -> TrackingCookie.Adition : Gesäubert.
:mozilla.89:C:\Dokumente und Einstellungen\Angie\Anwendungsdaten\Mozilla\Firefox\Profiles\ctc9n305.default\cookies.txt -> TrackingCookie.Atdmt : Gesäubert.
:mozilla.47:C:\Dokumente und Einstellungen\Angie\Anwendungsdaten\Mozilla\Firefox\Profiles\ctc9n305.default\cookies.txt -> TrackingCookie.Burstnet : Gesäubert.
:mozilla.48:C:\Dokumente und Einstellungen\Angie\Anwendungsdaten\Mozilla\Firefox\Profiles\ctc9n305.default\cookies.txt -> TrackingCookie.Casalemedia : Gesäubert.
:mozilla.49:C:\Dokumente und Einstellungen\Angie\Anwendungsdaten\Mozilla\Firefox\Profiles\ctc9n305.default\cookies.txt -> TrackingCookie.Casalemedia : Gesäubert.
:mozilla.51:C:\Dokumente und Einstellungen\Angie\Anwendungsdaten\Mozilla\Firefox\Profiles\ctc9n305.default\cookies.txt -> TrackingCookie.Casalemedia : Gesäubert.
:mozilla.19:C:\Dokumente und Einstellungen\Angie\Anwendungsdaten\Mozilla\Firefox\Profiles\ctc9n305.default\cookies.txt -> TrackingCookie.Doubleclick : Gesäubert.
:mozilla.74:C:\Dokumente und Einstellungen\Angie\Anwendungsdaten\Mozilla\Firefox\Profiles\ctc9n305.default\cookies.txt -> TrackingCookie.Euroclick : Gesäubert.
:mozilla.75:C:\Dokumente und Einstellungen\Angie\Anwendungsdaten\Mozilla\Firefox\Profiles\ctc9n305.default\cookies.txt -> TrackingCookie.Euroclick : Gesäubert.
:mozilla.76:C:\Dokumente und Einstellungen\Angie\Anwendungsdaten\Mozilla\Firefox\Profiles\ctc9n305.default\cookies.txt -> TrackingCookie.Euroclick : Gesäubert.
:mozilla.77:C:\Dokumente und Einstellungen\Angie\Anwendungsdaten\Mozilla\Firefox\Profiles\ctc9n305.default\cookies.txt -> TrackingCookie.Euroclick : Gesäubert.
:mozilla.78:C:\Dokumente und Einstellungen\Angie\Anwendungsdaten\Mozilla\Firefox\Profiles\ctc9n305.default\cookies.txt -> TrackingCookie.Euroclick : Gesäubert.
:mozilla.83:C:\Dokumente und Einstellungen\Angie\Anwendungsdaten\Mozilla\Firefox\Profiles\ctc9n305.default\cookies.txt -> TrackingCookie.Falkag : Gesäubert.
:mozilla.84:C:\Dokumente und Einstellungen\Angie\Anwendungsdaten\Mozilla\Firefox\Profiles\ctc9n305.default\cookies.txt -> TrackingCookie.Falkag : Gesäubert.
:mozilla.85:C:\Dokumente und Einstellungen\Angie\Anwendungsdaten\Mozilla\Firefox\Profiles\ctc9n305.default\cookies.txt -> TrackingCookie.Falkag : Gesäubert.
:mozilla.86:C:\Dokumente und Einstellungen\Angie\Anwendungsdaten\Mozilla\Firefox\Profiles\ctc9n305.default\cookies.txt -> TrackingCookie.Falkag : Gesäubert.
:mozilla.87:C:\Dokumente und Einstellungen\Angie\Anwendungsdaten\Mozilla\Firefox\Profiles\ctc9n305.default\cookies.txt -> TrackingCookie.Falkag : Gesäubert.
:mozilla.88:C:\Dokumente und Einstellungen\Angie\Anwendungsdaten\Mozilla\Firefox\Profiles\ctc9n305.default\cookies.txt -> TrackingCookie.Falkag : Gesäubert.
:mozilla.32:C:\Dokumente und Einstellungen\Angie\Anwendungsdaten\Mozilla\Firefox\Profiles\ctc9n305.default\cookies.txt -> TrackingCookie.Fastclick : Gesäubert.
:mozilla.33:C:\Dokumente und Einstellungen\Angie\Anwendungsdaten\Mozilla\Firefox\Profiles\ctc9n305.default\cookies.txt -> TrackingCookie.Fastclick : Gesäubert.
:mozilla.34:C:\Dokumente und Einstellungen\Angie\Anwendungsdaten\Mozilla\Firefox\Profiles\ctc9n305.default\cookies.txt -> TrackingCookie.Fastclick : Gesäubert.
:mozilla.35:C:\Dokumente und Einstellungen\Angie\Anwendungsdaten\Mozilla\Firefox\Profiles\ctc9n305.default\cookies.txt -> TrackingCookie.Fastclick : Gesäubert.
:mozilla.36:C:\Dokumente und Einstellungen\Angie\Anwendungsdaten\Mozilla\Firefox\Profiles\ctc9n305.default\cookies.txt -> TrackingCookie.Fastclick : Gesäubert.
:mozilla.37:C:\Dokumente und Einstellungen\Angie\Anwendungsdaten\Mozilla\Firefox\Profiles\ctc9n305.default\cookies.txt -> TrackingCookie.Fastclick : Gesäubert.
:mozilla.22:C:\Dokumente und Einstellungen\Angie\Anwendungsdaten\Mozilla\Firefox\Profiles\ctc9n305.default\cookies.txt -> TrackingCookie.Ivwbox : Gesäubert.
C:\Dokumente und Einstellungen\Angie\Cookies\angie@ivwbox[1].txt -> TrackingCookie.Ivwbox : Gesäubert.
C:\Dokumente und Einstellungen\Angie\Cookies\angie@stats1.reliablestats[1].txt -> TrackingCookie.Reliablestats : Gesäubert.
:mozilla.31:C:\Dokumente und Einstellungen\Angie\Anwendungsdaten\Mozilla\Firefox\Profiles\ctc9n305.default\cookies.txt -> TrackingCookie.Statcounter : Gesäubert.
:mozilla.38:C:\Dokumente und Einstellungen\Angie\Anwendungsdaten\Mozilla\Firefox\Profiles\ctc9n305.default\cookies.txt -> TrackingCookie.Statcounter : Gesäubert.
:mozilla.39:C:\Dokumente und Einstellungen\Angie\Anwendungsdaten\Mozilla\Firefox\Profiles\ctc9n305.default\cookies.txt -> TrackingCookie.Statcounter : Gesäubert.
:mozilla.23:C:\Dokumente und Einstellungen\Angie\Anwendungsdaten\Mozilla\Firefox\Profiles\ctc9n305.default\cookies.txt -> TrackingCookie.Tradedoubler : Gesäubert.
:mozilla.30:C:\Dokumente und Einstellungen\Angie\Anwendungsdaten\Mozilla\Firefox\Profiles\ctc9n305.default\cookies.txt -> TrackingCookie.Tribalfusion : Gesäubert.
:mozilla.91:C:\Dokumente und Einstellungen\Angie\Anwendungsdaten\Mozilla\Firefox\Profiles\ctc9n305.default\cookies.txt -> TrackingCookie.Webtrendslive : Gesäubert.
:mozilla.62:C:\Dokumente und Einstellungen\Angie\Anwendungsdaten\Mozilla\Firefox\Profiles\ctc9n305.default\cookies.txt -> TrackingCookie.Xhit : Gesäubert.
:mozilla.64:C:\Dokumente und Einstellungen\Angie\Anwendungsdaten\Mozilla\Firefox\Profiles\ctc9n305.default\cookies.txt -> TrackingCookie.Xhit : Gesäubert.
:mozilla.67:C:\Dokumente und Einstellungen\Angie\Anwendungsdaten\Mozilla\Firefox\Profiles\ctc9n305.default\cookies.txt -> TrackingCookie.Xhit : Gesäubert.
:mozilla.68:C:\Dokumente und Einstellungen\Angie\Anwendungsdaten\Mozilla\Firefox\Profiles\ctc9n305.default\cookies.txt -> TrackingCookie.Xhit : Gesäubert.
:mozilla.25:C:\Dokumente und Einstellungen\Angie\Anwendungsdaten\Mozilla\Firefox\Profiles\ctc9n305.default\cookies.txt -> TrackingCookie.Yieldmanager : Gesäubert.
:mozilla.26:C:\Dokumente und Einstellungen\Angie\Anwendungsdaten\Mozilla\Firefox\Profiles\ctc9n305.default\cookies.txt -> TrackingCookie.Yieldmanager : Gesäubert.
:mozilla.28:C:\Dokumente und Einstellungen\Angie\Anwendungsdaten\Mozilla\Firefox\Profiles\ctc9n305.default\cookies.txt -> TrackingCookie.Yieldmanager : Gesäubert.


::Berichtende



die ordner habe ich auch gelöscht....

nö, popups hab ich keine mehr...
bis jetzt hat sich noch nichts gemeldet....