Hallo,

meine Frau hat gestern einmal "kurz gesurft" (Sie sagte haupsächlich auf dieser Seite:w w w.x17online.com
Ergebnis:

Mein Antivir ist gelöscht und auch merkwürdigerweise meine ganzen anderen Spyware Programme wie ants und spybot.Wenn ich nun versuche Antivire neu zu installieren kommt die Meldung:
Datein konnten nicht alle entpackt werde und es geht nix...ich bin ratlos.
Kann mir hier bitte einmal jemand helfen?

Danke im vorraus und lg

Logfiles:
"Silent Runners.vbs", revision 52, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"ctfmon.exe" = "I:\WINDOWS\system32\ctfmon.exe" [MS]
"Spamihilator" = ""I:\Programme\Spamihilator\spamihilator.exe"" ["Michel Krämer"]
"Simple Star PhotoShow Media Manager" = "I:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe" ["Simple Star, Inc."]
"IBP" = "(empty string)" [file not found]
"SpybotSD TeaTimer" = "I:\Programme\Sicherheit\Spybot - Search & Destroy\TeaTimer.exe" [file not found]

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"NVMixerTray" = ""I:\Programme\NVIDIA Corporation\NvMixer\NVMixerTray.exe"" ["NVIDIA Corporation"]
"ATIPTA" = "I:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe" ["ATI Technologies, Inc."]
"EPSON Stylus C66 Series" = "I:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0S2.EXE /P23 "EPSON Stylus C66 Series" /O6 "USB002" /M "Stylus C66"" ["SEIKO EPSON CORPORATION"]
"Tweak UI" = "RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp" [MS]
"P2P Networking" = "I:\WINDOWS\system32\P2P Networking\P2P Networking.exe /AUTOSTART" [file not found]
"KernelFaultCheck" = "I:\WINDOWS\system32\dumprep 0 -k"
"Siemens SmartSync - ScheduleSync" = "C:\PROGRA~1\HANDYF~1\SMARTS~1\SCHEDU~1.EXE" [empty string]
"SunJavaUpdateSched" = ""I:\Programme\Java\jre1.6.0_01\bin\jusched.exe"" ["Sun Microsystems, Inc."]
"LVCOMS" = "I:\Programme\Gemeinsame Dateien\Logitech\QCDriver3\LVCOMS.EXE" ["Logitech Inc."]
"SNPSTD2" = "I:\WINDOWS\vsnpstd2.exe" [empty string]
"avgnt" = ""I:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min" [file not found]
"QuickTime Task" = ""I:\Programme\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."]
"TkBellExe" = ""I:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot" ["RealNetworks, Inc."]
"BluetoothAuthenticationAgent" = "rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent" [MS]
"RemoteControl" = "I:\Programme\CyberLink\PowerDVD\PDVDServ.exe" ["Cyberlink Corp."]
"CloneCDTray" = ""I:\Programme\SlySoft\CloneCD\CloneCDTray.exe" /s" ["SlySoft, Inc."]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{02478D38-C3F9-4EFB-9B51-7695ECA05670}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Yahoo! Toolbar Helper"
\InProcServer32\(Default) = "I:\Programme\Yahoo!\Companion\Installs\cpn1\yt.dll" ["Yahoo! Inc."]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)
-> {HKLM...CLSID} = "AcroIEHlprObj Class"
\InProcServer32\(Default) = "i:\programme\acrobat\Acrobat\ActiveX\AcroIEHelper.ocx" [empty string]
{53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Spybot-S&D IE Protection"
\InProcServer32\(Default) = "I:\PROGRA~1\SICHER~2\SPYBOT~1\SDHelper.dll" ["Safer Networking Limited"]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)
-> {HKLM...CLSID} = "SSVHelper Class"
\InProcServer32\(Default) = "I:\Programme\Java\jre1.6.0_01\bin\ssv.dll" ["Sun Microsystems, Inc."]
{AA58ED58-01DD-4d91-8333-CF10577473F7}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Google Toolbar Helper"
\InProcServer32\(Default) = "i:\programme\google\googletoolbar2.dll" ["Google Inc."]
{CC59E0F9-7E43-44FA-9FAA-8377850BF205}\(Default) = (no title provided)
-> {HKLM...CLSID} = "FDMIECookiesBHO Class"
\InProcServer32\(Default) = "I:\Programme\Free Download Manager\iefdmcks.dll" [null data]
{E99421FB-68DD-40F0-B4AC-B7027CAE2F1A}\(Default) = (no title provided)
-> {HKLM...CLSID} = "EpsonToolBandKicker Class"
\InProcServer32\(Default) = "I:\Programme\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll" ["SEIKO EPSON CORPORATION"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Erweiterung für HyperTerminal-Icons"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "I:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "I:\office\winrar\rarext.dll" [null data]
"{63542C48-9552-494A-84F7-73AA6A7C99C1}" = "OpenOffice Property Sheet Handler"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "I:\office\open_office\program\shlxthdl.dll" ["Sun Microsystems, Inc."]
"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player"
-> {HKLM...CLSID} = "RealOne Player Context Menu Class"
\InProcServer32\(Default) = "I:\Programme\Real\RealPlayer\rpshell.dll" ["RealNetworks, Inc."]
"{5E2121EE-0300-11D4-8D3B-444553540000}" = "Shredder extension"
-> {HKLM...CLSID} = "Shredder"
\InProcServer32\(Default) = "I:\WINDOWS\system32\ShredExt.dll" [empty string]
"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "I:\Programme\Microsoft Office\Office10\msohev.dll" [MS]
"{DEE12703-6333-4D4E-8F34-738C4DCC2E04}" = "RecordNow! SendToExt"
-> {HKLM...CLSID} = "RecordNow! SendToExt"
\InProcServer32\(Default) = "I:\Programme\Sonic\RecordNow!\shlext.dll" ["Sonic Solutions"]
"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler"
-> {HKLM...CLSID} = "Outlook File Icon Extension"
\InProcServer32\(Default) = "I:\Programme\Microsoft Office\Office10\OLKFSTUB.DLL" [MS]
"{5464D816-CF16-4784-B9F3-75C0DB52B499}" = "Yahoo! Mail"
-> {HKLM...CLSID} = "YMailShellExt Class"
\InProcServer32\(Default) = "I:\PROGRA~1\Yahoo!\Common\ymmapi.dll" ["Yahoo! Inc."]
"{ED65AC21-B24F-11d3-BA80-00C0CA16AA37}" = "Siemens Device"
-> {HKLM...CLSID} = "Siemens Device"
\InProcServer32\(Default) = "C:\Program Files\handyfotos_übertragen\DES\DESShellExt.dll" ["Siemens AG"]
"{ED65AC22-B24F-11d3-BA80-00C0CA16AA37}" = "Siemens Device ContextMenuHandler"
-> {HKLM...CLSID} = "Siemens Device ContextMenuHandler"
\InProcServer32\(Default) = "C:\Program Files\handyfotos_übertragen\DES\DESShellExt.dll" ["Siemens AG"]
"{ED65AC23-B24F-11d3-BA80-00C0CA16AA37}" = "Siemens SX1 PropertySheetHandler"
-> {HKLM...CLSID} = "Siemens Device PropertySheetHandler"
\InProcServer32\(Default) = "C:\Program Files\handyfotos_übertragen\DES\DESShellExt.dll" ["Siemens AG"]
"{acb4a560-3606-11d3-aef4-00104bd0f92d}" = "KodakShellExtension"
-> {HKLM...CLSID} = "KodakShellExtension"
\InProcServer32\(Default) = "I:\Programme\Gemeinsame Dateien\Kodak\ifscore\KodakShX.dll" ["Eastman Kodak Company"]
"{45AC2688-0253-4ED8-97DE-B5370FA7D48A}" = "Shell Extension for Malware scanning"
-> {HKLM...CLSID} = "Shell Extension for Malware scanning"
\InProcServer32\(Default) = "I:\Programme\AntiVir PersonalEdition Classic\shlext.dll" ["Avira GmbH"]
"{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}" = "iTunes"
-> {HKLM...CLSID} = "iTunes"
\InProcServer32\(Default) = "I:\Programme\iTunes\iTunesMiniPlayer.dll" ["Apple Computer, Inc."]
"{73B24247-042E-4EF5-ADC2-42F62E6FD654}" = "ICQ Lite Shell Extension"
-> {HKLM...CLSID} = "MCLiteShellExt Class"
\InProcServer32\(Default) = "I:\Programme\ICQLite\ICQLiteShell.dll" [empty string]
"{969223C0-26AA-11D0-90EE-444553540000}" = "Shell Extension"
-> {HKLM...CLSID} = "PGP Shell Extension"
\InProcServer32\(Default) = "pgpmn.dll" ["PGP Corporation"]
"{F8B14440-3785-11D1-B363-5C6F08C10000}" = "PGPdisk Shell Extension"
-> {HKLM...CLSID} = "PGPdisk Shell Extension"
\InProcServer32\(Default) = "PGPdiskSE.dll" [file not found]

HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\
<<!>> "load" = "I:\Programme\TBRIDGE\tbridge\Flatbed.exe" [null data]

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
<<!>> AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
East-TecEraser\(Default) = "{E0BD38EB-C8EC-11D2-B274-B493B003B125}"
-> {HKLM...CLSID} = "East-Tec Eraser Context Menu Shell Extension"
\InProcServer32\(Default) = "I:\PROGRA~1\EAST-T~1\eteshell.dll" [file not found]
ICQLiteMenu\(Default) = "{73B24247-042E-4EF5-ADC2-42F62E6FD654}"
-> {HKLM...CLSID} = "MCLiteShellExt Class"
\InProcServer32\(Default) = "I:\Programme\ICQLite\ICQLiteShell.dll" [empty string]
Shell Extension for Malware scanning\(Default) = "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}"
-> {HKLM...CLSID} = "Shell Extension for Malware scanning"
\InProcServer32\(Default) = "I:\Programme\AntiVir PersonalEdition Classic\shlext.dll" ["Avira GmbH"]
Shredder\(Default) = "{5E2121EE-0300-11D4-8D3B-444553540000}"
-> {HKLM...CLSID} = "Shredder"
\InProcServer32\(Default) = "I:\WINDOWS\system32\ShredExt.dll" [empty string]
VIDEOTRANS\(Default) = "{C8CA0A66-AF32-4D5E-879E-F0809ACEDC55}"
-> {HKLM...CLSID} = "AmvTransform Class"
\InProcServer32\(Default) = "I:\Programme\MyMPxPlayer.org\MP3 Player Utilities 3.68\AMVTools\AmvTransform.dll" [empty string]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "I:\office\winrar\rarext.dll" [null data]
Yahoo! Mail\(Default) = "{5464D816-CF16-4784-B9F3-75C0DB52B499}"
-> {HKLM...CLSID} = "YMailShellExt Class"
\InProcServer32\(Default) = "I:\PROGRA~1\Yahoo!\Common\ymmapi.dll" ["Yahoo! Inc."]
ZONERMenu\(Default) = "{7B793D33-DB64-11D0-8720-0020AF158EA5}"
-> {HKLM...CLSID} = "Zoner Explorer Extension"
\InProcServer32\(Default) = "I:\office\zoner_draw3\Program\FShEx30.dll" ["ZONER software, Ltd."]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
ICQLiteMenu\(Default) = "{73B24247-042E-4EF5-ADC2-42F62E6FD654}"
-> {HKLM...CLSID} = "MCLiteShellExt Class"
\InProcServer32\(Default) = "I:\Programme\ICQLite\ICQLiteShell.dll" [empty string]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "I:\office\winrar\rarext.dll" [null data]
ZONERMenu\(Default) = "{7B793D33-DB64-11D0-8720-0020AF158EA5}"
-> {HKLM...CLSID} = "Zoner Explorer Extension"
\InProcServer32\(Default) = "I:\office\zoner_draw3\Program\FShEx30.dll" ["ZONER software, Ltd."]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
East-TecEraser\(Default) = "{E0BD38EB-C8EC-11D2-B274-B493B003B125}"
-> {HKLM...CLSID} = "East-Tec Eraser Context Menu Shell Extension"
\InProcServer32\(Default) = "I:\PROGRA~1\EAST-T~1\eteshell.dll" [file not found]
Shell Extension for Malware scanning\(Default) = "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}"
-> {HKLM...CLSID} = "Shell Extension for Malware scanning"
\InProcServer32\(Default) = "I:\Programme\AntiVir PersonalEdition Classic\shlext.dll" ["Avira GmbH"]
Shredder\(Default) = "{5E2121EE-0300-11D4-8D3B-444553540000}"
-> {HKLM...CLSID} = "Shredder"
\InProcServer32\(Default) = "I:\WINDOWS\system32\ShredExt.dll" [empty string]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "I:\office\winrar\rarext.dll" [null data]
ZONERMenu\(Default) = "{7B793D33-DB64-11D0-8720-0020AF158EA5}"
-> {HKLM...CLSID} = "Zoner Explorer Extension"
\InProcServer32\(Default) = "I:\office\zoner_draw3\Program\FShEx30.dll" ["ZONER software, Ltd."]


Group Policies {GPedit.msc branch and setting}:
-----------------------------------------------

Note: detected settings may not have any effect.

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\

"NoWindowsUpdate" = (REG_DWORD) hex:0x00000000
{User Configuration|Administrative Templates|Start Menu and Taskbar|
Remove links and access to Windows Update}

"NoInstrumentation" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoFavoritesMenu" = (REG_DWORD) hex:0x00000000
{User Configuration|Administrative Templates|Start Menu and Taskbar|
Remove Favorites menu from Start Menu}

"ClearRecentDocsOnExit" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoLowDiskSpaceChecks" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoTrayItemsDisplay" = (REG_DWORD) hex:0x00000000
{User Configuration|Administrative Templates|Start Menu and Taskbar|
Hide the notification area}

"NoTrayContextMenu" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoSetTaskbar" = (REG_DWORD) hex:0x00000000
{User Configuration|Administrative Templates|Start Menu and Taskbar|
Prevent changes to Taskbar and Start Menu Settings}

"NoDrives" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoSharedDocuments" = (REG_DWORD) hex:0x00000000
{User Configuration|Administrative Templates|Windows Components|Windows Explorer|
Remove Shared Documents from My Computer}

"SpecifyDefaultButtons" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoNetworkConnections" = (REG_DWORD) hex:0x00000000
{User Configuration|Administrative Templates|Start Menu and Taskbar|
Remove Network Connections from Start Menu}

HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel\

"GeneralTab" = (REG_DWORD) hex:0x00000000
{User Configuration|Administrative Templates|Windows Components|Internet Explorer|Internet Control Panel|
Disable the General page}

"Settings" = (REG_DWORD) hex:0x00000000
{User Configuration|Administrative Templates|Windows Components|Internet Explorer|
Prevent the deletion of temporary Internet files and cookies}

"Cache" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"History" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"HomePage" = (REG_DWORD) hex:0x00000000
{User Configuration|Administrative Templates|Windows Components|Internet Explorer|
Disable changing home page settings}

"Colors" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"Fonts" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"Languages" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"SecurityTab" = (REG_DWORD) hex:0x00000000
{User Configuration|Administrative Templates|Windows Components|Internet Explorer|Internet Control Panel|
Disable the Security page}

"SecChangeSettings" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"ContentTab" = (REG_DWORD) hex:0x00000000
{User Configuration|Administrative Templates|Windows Components|Internet Explorer|Internet Control Panel|
Disable the Content page}

"Ratings" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"Certificates" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"Profiles" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"CertifPers" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"ConnectionsTab" = (REG_DWORD) hex:0x00000000
{User Configuration|Administrative Templates|Windows Components|Internet Explorer|Internet Control Panel|
Disable the Connections page}

"Proxy" = (REG_DWORD) hex:0x00000000
{User Configuration|Administrative Templates|Windows Components|Internet Explorer|
Disable changing proxy settings}

"ProgramsTab" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"CalendarContact" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"Check_If_Default" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"Messaging" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"AdvancedTab" = (REG_DWORD) hex:0x00000000
{User Configuration|Administrative Templates|Windows Components|Internet Explorer|Internet Control Panel|
Disable the Advanced page}

"Connwiz Admin Lock" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions\

"NoBrowserClose" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoBrowserContextMenu" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoBrowserOptions" = (REG_DWORD) hex:0x00000000
{User Configuration|Administrative Templates|Windows Components|Internet Explorer|Browser Menus|
Tools menu: Disable Internet Options... menu option}

"NoBrowserSaveAs" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoFavorites" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoFileNew" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoFileOpen" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoFindFiles" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoSelectDownloadDir" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoTheaterMode" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoNavButtons" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

"NoPrinting" = (REG_DWORD) hex:0x00000000
{unrecognized setting}

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\

"shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Shutdown: Allow system to be shut down without having to log on}

"undockwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Devices: Allow undock without having to log on}


Active Desktop and Wallpaper:
-----------------------------

Active Desktop may be disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState


Enabled Screen Saver:
---------------------

HKCU\Control Panel\Desktop\
"SCRNSAVE.EXE" = "I:\WINDOWS\System32\ssmypics.scr" [MS]


Startup items in "familie_muppet" & "All Users" startup folders:
--------------------------------------------------------------

I:\Dokumente und Einstellungen\familie_hees\Startmenü\Programme\Autostart
"FRITZ!DSL Internet" -> shortcut to: "I:\Programme\FRITZ!DSL\FritzDsl.exe" ["AVM Berlin"]
"FRITZ!DSL Protect" -> shortcut to: "I:\Programme\FRITZ!DSL\FwebProt.exe" ["AVM Berlin"]
"FRITZ!DSL Startcenter" -> shortcut to: "I:\Programme\FRITZ!DSL\StCenter.exe" ["AVM Berlin"]

I:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart
"Microsoft Office" -> shortcut to: "I:\Programme\Microsoft Office\Office10\OSA.EXE -b -l" [MS]
"NETGEAR ProSafe VPN Client" -> shortcut to: "I:\Programme\NETGEAR\NETGEAR ProSafe VPN Client\SafeCfg.exe" ["SafeNet"]
"Software Kodak EasyShare" -> shortcut to: "I:\Programme\Kodak\Kodak EasyShare software\bin\EasyShare.exe -hx" [null data]


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000004\LibraryPath = "I:\Programme\FRITZ!DSL\sarah.dll" ["AVM Berlin"]
000000000005\LibraryPath = "%SystemRoot%\system32\wshbth.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
I:\Programme\FRITZ!DSL\sarah.dll ["AVM Berlin"], 01 - 03, 09
%SystemRoot%\system32\mswsock.dll [MS], 04 - 06, 10 - 38
%SystemRoot%\system32\rsvpsp.dll [MS], 07 - 08


Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\
"{2318C2B1-4965-11D4-9B18-009027A5CD4F}"
-> {HKLM...CLSID} = "&Google"
\InProcServer32\(Default) = "i:\programme\google\googletoolbar2.dll" ["Google Inc."]

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
"{2318C2B1-4965-11D4-9B18-009027A5CD4F}"
-> {HKLM...CLSID} = "&Google"
\InProcServer32\(Default) = "i:\programme\google\googletoolbar2.dll" ["Google Inc."]
"{EE5D279F-081B-4404-994D-C6B60AAEBA6D}"
-> {HKLM...CLSID} = "EPSON Web-To-Page"
\InProcServer32\(Default) = "I:\Programme\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll" ["SEIKO EPSON CORPORATION"]
"{EF99BD32-C1FB-11D2-892F-0090271D4F88}"
-> {HKLM...CLSID} = "Yahoo! Toolbar"
\InProcServer32\(Default) = "I:\Programme\Yahoo!\Companion\Installs\cpn1\yt.dll" ["Yahoo! Inc."]

HKLM\Software\Microsoft\Internet Explorer\Toolbar\
"{EE5D279F-081B-4404-994D-C6B60AAEBA6D}" = (no title provided)
-> {HKLM...CLSID} = "EPSON Web-To-Page"
\InProcServer32\(Default) = "I:\Programme\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll" ["SEIKO EPSON CORPORATION"]
"{2318C2B1-4965-11D4-9B18-009027A5CD4F}" = (no title provided)
-> {HKLM...CLSID} = "&Google"
\InProcServer32\(Default) = "i:\programme\google\googletoolbar2.dll" ["Google Inc."]
"{EF99BD32-C1FB-11D2-892F-0090271D4F88}" = (no title provided)
-> {HKLM...CLSID} = "Yahoo! Toolbar"
\InProcServer32\(Default) = "I:\Programme\Yahoo!\Companion\Installs\cpn1\yt.dll" ["Yahoo! Inc."]
"{855F3B16-6D32-4FE6-8A56-BBB695989046}" = (no title provided)
-> {HKLM...CLSID} = "ICQ Toolbar"
\InProcServer32\(Default) = "I:\Programme\ICQToolbar\toolbaru.dll" ["ICQ Inc."]

Explorer Bars

HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\
{4528BBE0-4E08-11D5-AD55-00010333D0AD}\(Default) = (no title provided)
-> {HKLM...CLSID} = "&Yahoo! Messenger"
\InProcServer32\(Default) = "I:\PROGRA~1\Yahoo!\Common\yhexbmeses.dll" ["Yahoo! Inc."]

Extensions (Tools menu items, main toolbar menu buttons)

HKCU\Software\Microsoft\Internet Explorer\Extensions\
{0E921E80-267A-42AA-AEE4-60B9A1222A44}\
"ButtonText" = "Klicke hier um das Projekt xp-AntiSpy zu unterstützen"
"MenuText" = "Unterstützung für xp-AntiSpy"
"Exec" = "I:\Programme\xp-AntiSpy\sponsoring\sponsor.html" [null data]

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Konsole"
"CLSIDExtension" = "{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBC}"
-> {HKLM...CLSID} = "Java Plug-in 1.6.0_01"
\InProcServer32\(Default) = "I:\Programme\Java\jre1.6.0_01\bin\npjpi160_01.dll" ["Sun Microsystems, Inc."]

{4528BBE0-4E08-11D5-AD55-00010333D0AD}\
"ButtonText" = "Messenger"
"MenuText" = "Yahoo! Messenger"
"CLSIDExtension" = "{4C171D40-8277-11D5-AD55-00010333D0AD}"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "I:\PROGRA~1\Yahoo!\Common\yhexbmeses.dll" ["Yahoo! Inc."]

{B863453A-26C3-4E1F-A54D-A2CD196348E9}\
"ButtonText" = "ICQ Lite"
"MenuText" = "ICQ Lite"
"Exec" = "I:\Programme\ICQLite\ICQLite.exe" ["ICQ Ltd."]

{DFB852A3-47F8-48C4-A200-58CAB36FD2A2}\
"MenuText" = "Spybot - Search & Destroy Configuration"
"CLSIDExtension" = "{53707962-6F74-2D53-2644-206D7942484F}"
-> {HKLM...CLSID} = "Spybot-S&D IE Protection"
\InProcServer32\(Default) = "I:\PROGRA~1\SICHER~2\SPYBOT~1\SDHelper.dll" ["Safer Networking Limited"]

{FB5F1910-F110-11D2-BB9E-00C04F795683}\
"ButtonText" = "Messenger"
"MenuText" = "Windows Messenger"
"Exec" = "I:\Programme\Messenger\msmsgs.exe" [MS]

{FD9DE2B4-C926-4460-81C4-FC58C6F1062E}\
"ButtonText" = "SmartWhois"
"Exec" = "I:\PROGRA~1\SMARTW~1\SWMSIE~1.EXE" ["TamoSoft, Inc."]

{FF983118-58C7-4AD4-B5A7-691C39CB7B42}\
"MenuText" = "SmartWhois"
"Exec" = "I:\PROGRA~1\SMARTW~1\SWMSIE~1.EXE" ["TamoSoft, Inc."]


Miscellaneous IE Hijack Points
------------------------------

HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\
<<H>> "{EF99BD32-C1FB-11D2-892F-0090271D4F88}" = "*_" (unwritable string)
-> {HKLM...CLSID} = "Yahoo! Toolbar"
\InProcServer32\(Default) = "I:\Programme\Yahoo!\Companion\Installs\cpn1\yt.dll" ["Yahoo! Inc."]


Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

AntiVir Scheduler, AntiVirScheduler, "I:\Programme\AntiVir PersonalEdition Classic\sched.exe" [null data]
AVM IGD CTRL Service, AVM IGD CTRL Service, "I:\Programme\FRITZ!DSL\IGDCTRL.EXE" ["AVM Berlin"]
Bluetooth Support Service, BthServ, "I:\WINDOWS\system32\svchost.exe -k bthsvcs" {"I:\WINDOWS\System32\bthserv.dll" [MS]}
Machine Debug Manager, MDM, ""I:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe"" [MS]
MSSQL$FHU, MSSQL$FHU, "I:\Programme\Microsoft SQL Server\MSSQL$FHU\Binn\sqlservr.exe -sFHU" [null data]
MSSQLSERVER, MSSQLSERVER, "I:\Programme\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe -sMSSQLSERVER" [null data]
MySQL, MySQL, ""I:\Programme\MySQL\MySQL Server 4.1\bin\mysqld-nt" --defaults-file="I:\Programme\MySQL\MySQL Server 4.1\my.ini" MySQL" [null data]
PGPserv, PGPserv, "I:\WINDOWS\system32\PGPserv.exe" ["PGP Corporation"]
SafeNet IKE Service, IREIKE, ""I:\Programme\NETGEAR\NETGEAR ProSafe VPN Client\IreIKE.exe"" ["SafeNet"]
SafeNet Monitor Service, IPSECMON, ""I:\Programme\NETGEAR\NETGEAR ProSafe VPN Client\IPSecMon.exe"" ["SafeNet"]
Windows User Mode Driver Framework, UMWdf, "I:\WINDOWS\system32\wdfmgr.exe" [MS]


Keyboard Driver Filters:
------------------------

HKLM\System\CurrentControlSet\Control\Class\{4D36E96B-E325-11CE-BFC1-08002BE10318}\
"UpperFilters" = <<!>> "PGPsdkDriver" [file not found]


Print Monitors:
---------------

HKLM\System\CurrentControlSet\Control\Print\Monitors\
avm:\Driver = "avmprmon.dll" ["AVM Berlin GmbH"]
EPSON V6 2KMonitor\Driver = "EBPMON24.DLL" ["SEIKO EPSON CORPORATION"]
FRITZ!fax Color Port Monitor\Driver = "FritzColorPort.dll" ["AVM Berlin GmbH"]
FRITZ!fax Port Monitor\Driver = "FritzPort.dll" ["AVM Berlin GmbH"]
Kodak PD6000 Language Monitor\Driver = "PD6000LM.dll" ["Eastman Kodak Company"]
PDF Port\Driver = "I:\WINDOWS\System32\pdfports.dll" ["Adobe Systems Incorporated."]


---------- (launch time: 2007-11-06 19:35:12)
<<!>>: Suspicious data at a malware launch point.
<<H>>: Suspicious data at a browser hijack point.

+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ To search all directories of local fixed drives for DESKTOP.INI
DLL launch points, use the -supp parameter or answer "No" at the
first message box and "Yes" at the second message box.
---------- (total run time: 93 seconds, including 14 seconds for message boxes)


ComboFix 07-11-06.4 - familie_muppet 2007-11-06 19:40:33.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2634.2.1252.49.1031.18.185 [GMT 1:00]
ausgeführt von:: I:\Dokumente und Einstellungen\familie_muppet\Lokale Einstellungen\Temporary Internet Files\Content.IE5\IKZULHQS\ComboFix[1].exe
* Neuer Wiederherstellungspunkt wurde erstellt
.

(((((((((((((((((((((((((((((((((((( Weitere L”schungen ))))))))))))))))))))))))))))))))))))))))))))))))
.

I:\Dokumente und Einstellungen\familie_muppet\Anwendungsdaten\winantiviruspro2006freeinstall_es[1].exe
I:\Programme\winupdates
I:\WINDOWS\exefld
I:\WINDOWS\exefld\415807921.exe
I:\WINDOWS\regedit.com
I:\WINDOWS\system32\bszip.dll
I:\WINDOWS\system32\Cache
I:\WINDOWS\system32\cmd.com
I:\WINDOWS\system32\drivers\hidr.exe
I:\WINDOWS\system32\drivers\srosa.sys
I:\WINDOWS\system32\f3PSSavr.scr
I:\WINDOWS\system32\ping.com
I:\WINDOWS\system32\regedit.com
I:\WINDOWS\system32\tasklist.com
I:\WINDOWS\system32\taskmgr.com
I:\WINDOWS\system32\tracert.com
I:\WINDOWS\system32\wintems.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_SROSA
-------\srosa


((((((((((((((((((((((( Dateien erstellt von 2007-10-06 bis 2007-11-06 ))))))))))))))))))))))))))))))
.

2007-11-06 19:37 51,200 --a------ I:\WINDOWS\NirCmd.exe
2007-11-06 18:52 2,183,296 --a------ I:\WINDOWS\system32\ntoskrnl.exe
2007-11-06 18:52 2,183,296 --a--c--- I:\WINDOWS\system32\dllcache\ntoskrnl.exe
2007-11-06 18:13 <DIR> d-a------ I:\WINDOWS\zts2.exe
2007-11-06 18:13 <DIR> d-a------ I:\WINDOWS\system32\vcmgcd32.dll
2007-11-06 18:13 <DIR> d-a------ I:\WINDOWS\system32\systems.txt
2007-11-06 18:13 <DIR> d-a------ I:\WINDOWS\system32\iifgfgf.dll
2007-11-06 18:13 <DIR> d-a------ I:\WINDOWS\rundll16.exe
2007-11-06 18:13 <DIR> d-a------ I:\WINDOWS\rundl132.dll
2007-11-06 18:13 <DIR> d-a------ I:\WINDOWS\logo1_.exe
2007-11-06 18:13 22 --a------ I:\WINDOWS\REGBK00.ZIP
2007-11-06 18:00 153,600 --a------ I:\WINDOWS\R.COM
2007-11-06 18:00 140,800 --a------ I:\WINDOWS\system32\T.COM
2007-11-04 11:57 <DIR> d-------- I:\Dokumente und Einstellungen\familie_muppet\Anwendungsdaten\DVD Flick
2007-11-01 19:04 <DIR> d-------- I:\Dokumente und Einstellungen\familie_muppet\Anwendungsdaten\ImgBurn
2007-11-01 13:31 <DIR> d-------- I:\Programme\AVStoDVD
2007-10-29 20:58 <DIR> d-------- I:\Programme\TagTooga.com
2007-10-21 13:37 <DIR> d-------- I:\Programme\DaemonTools_WhenUSave_Installer
2007-10-20 17:09 <DIR> d-------- I:\spoolerlogs
2007-10-20 12:24 <DIR> d-------- I:\DVDTemp
2007-10-20 12:23 <DIR> d-------- I:\Programme\WinX DVD Author 5.5
2007-10-20 11:34 <DIR> d-------- I:\Programme\DVDlab
2007-10-18 21:33 <DIR> d-------- I:\Programme\PowerWare
2007-10-11 18:36 <DIR> d-------- I:\Programme\sofTRANS GmbH
2007-10-10 10:39 584,192 -----c--- I:\WINDOWS\system32\dllcache\rpcrt4.dll
2007-10-07 13:16 1,601,536 --a------ I:\WINDOWS\system32\MediaInfo.dll

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.
2007-11-06 18:59 --------- d-----w I:\Dokumente und Einstellungen\familie_muppet\Anwendungsdaten\FRITZ!
2007-11-06 18:52 --------- d-----w I:\Programme\xp_clean
2007-11-06 18:37 --------- d-----w I:\Dokumente und Einstellungen\familie_muppet\Anwendungsdaten\Free Download Manager
2007-11-06 17:50 --------- d-----w I:\Programme\FRITZ!DSL
2007-11-06 17:39 --------- d-----w I:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AntiVir PersonalEdition Classic
2007-11-06 17:23 --------- d-----w I:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
2007-11-06 17:04 --------- d-----w I:\Programme\tmx5
2007-11-06 16:02 --------- d-----w I:\Programme\Spamihilator
2007-11-01 19:49 --------- d-----w I:\Dokumente und Einstellungen\familie_muppet\Anwendungsdaten\IBP
2007-11-01 12:32 --------- d-----w I:\Programme\AviSynth 2.5
2007-10-23 10:44 --------- d-----w I:\Dokumente und Einstellungen\familie_muppet\Anwendungsdaten\Simple Star
2007-10-21 10:36 --------- d-----w I:\Programme\WinExpert
2007-10-12 19:40 --------- d-----w I:\Programme\billig_telefonieren
2007-10-11 17:52 --------- d--h--w I:\Programme\InstallShield Installation Information
2007-10-04 11:00 --------- d-----w I:\Dokumente und Einstellungen\muppetshow\Anwendungsdaten\PGP Corporation
2007-09-10 12:49 --------- d-----w I:\Programme\Winamp
2007-08-06 17:17 43,160 ----a-w I:\Dokumente und Einstellungen\familie_muppet\Anwendungsdaten\GDIPFONTCACHEV1.DAT
2006-05-03 09:06:54 163,328 --sh--r I:\WINDOWS\system32\flvDX.dll
2007-02-21 10:47:16 31,232 --sh--r I:\WINDOWS\system32\msfDX.dll
.

(((((((((((((((((((((((((((( Autostart Punkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Eintrage & legitime Standardeintrage werden nicht angezeigt.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NVMixerTray"="I:\Programme\NVIDIA Corporation\NvMixer\NVMixerTray.exe" [2004-06-03 19:51]
"ATIPTA"="I:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-08-25 11:52]
"EPSON Stylus C66 Series"="I:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0S2.exe" [2003-11-26 08:00]
"Tweak UI"="TWEAKUI.CPL" [2003-03-25 06:49 I:\WINDOWS\system32\tweakui.cpl]
"P2P Networking"="I:\WINDOWS\system32\P2P Networking\P2P Networking.exe" []
"Siemens SmartSync - ScheduleSync"="C:\PROGRA~1\HANDYF~1\SMARTS~1\SCHEDU~1.EXE" [2005-03-16 10:15]
"SunJavaUpdateSched"="I:\Programme\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 02:43]
"LVCOMS"="I:\Programme\Gemeinsame Dateien\Logitech\QCDriver3\LVCOMS.EXE" [2002-12-10 17:54]
"SNPSTD2"="I:\WINDOWS\vsnpstd2.exe" [2004-08-30 16:37]
"avgnt"="I:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" []
"QuickTime Task"="I:\Programme\QuickTime\qttask.exe" [2006-05-15 09:40]
"TkBellExe"="I:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" [2006-05-05 21:26]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 08:58 I:\WINDOWS\system32\bthprops.cpl]
"RemoteControl"="I:\Programme\CyberLink\PowerDVD\PDVDServ.exe" [2005-01-12 02:01]
"CloneCDTray"="I:\Programme\SlySoft\CloneCD\CloneCDTray.exe" [2006-09-28 20:21]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="I:\WINDOWS\system32\ctfmon.exe" [2004-08-04 08:57]
"Spamihilator"="I:\Programme\Spamihilator\spamihilator.exe" [2007-01-24 14:49]
"Simple Star PhotoShow Media Manager"="I:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe" [2006-01-13 22:22]
"IBP"="" []
"SpybotSD TeaTimer"="I:\Programme\Sicherheit\Spybot - Search & Destroy\TeaTimer.exe" []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoInstrumentation"=0 (0x0)
"NoFavoritesMenu"=0 (0x0)
"NoTrayItemsDisplay"=0 (0x0)
"NoTrayContextMenu"=0 (0x0)
"SpecifyDefaultButtons"=0 (0x0)

SafeBoot Registrierungsschl�ssel muss repariert werden. Dieser PC kann nicht im abgesicherten Modus starten.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\File system]
@="Driver Group"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vgasave.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}]
@="DiskDrive"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96A-E325-11CE-BFC1-08002BE10318}]
@="Hdc"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96B-E325-11CE-BFC1-08002BE10318}]
@="Keyboard"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96F-E325-11CE-BFC1-08002BE10318}]
@="Mouse"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E97D-E325-11CE-BFC1-08002BE10318}]
@="System"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]
@="Volume"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\I:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Acrobat Assistant.lnk]
path=I:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Acrobat Assistant.lnk
backup=I:\WINDOWS\pss\Acrobat Assistant.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\I:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Dienst-Manager.lnk]
path=I:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Dienst-Manager.lnk
backup=I:\WINDOWS\pss\Dienst-Manager.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\I:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Kodak software updater.lnk]
path=I:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Kodak software updater.lnk
backup=I:\WINDOWS\pss\Kodak software updater.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\I:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^MyWebSearch Email Plugin.lnk]
path=I:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\MyWebSearch Email Plugin.lnk
backup=I:\WINDOWS\pss\MyWebSearch Email Plugin.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\I:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Software Kodak EasyShare.lnk]
path=I:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Software Kodak EasyShare.lnk
backup=I:\WINDOWS\pss\Software Kodak EasyShare.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\I:^Dokumente und Einstellungen^familie_hees^Startmenü^Programme^Autostart^MyWebSearch Email Plugin.lnk]
path=I:\Dokumente und Einstellungen\familie_hees\Startmenü\Programme\Autostart\MyWebSearch Email Plugin.lnk
backup=I:\WINDOWS\pss\MyWebSearch Email Plugin.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\I:^Dokumente und Einstellungen^familie_hees^Startmenü^Programme^Autostart^OpenOffice.org 1.1.2.lnk]
path=I:\Dokumente und Einstellungen\familie_hees\Startmenü\Programme\Autostart\OpenOffice.org 1.1.2.lnk
backup=I:\WINDOWS\pss\OpenOffice.org 1.1.2.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\I:^Dokumente und Einstellungen^familie_hees^Startmenü^Programme^Autostart^Sonic CinePlayer Quick Launch.lnk]
path=I:\Dokumente und Einstellungen\familie_hees\Startmenü\Programme\Autostart\Sonic CinePlayer Quick Launch.lnk
backup=I:\WINDOWS\pss\Sonic CinePlayer Quick Launch.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\1&1 EasyLogin]
"I:\Programme\internet\1&1 EasyLogin\EasyLogin.exe" HIDE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ALDI_SUED_FotoSuite_Download]
"I:\Programme\ALDI Sued Foto Service\ALDI_Foto_Service\FotoSuite.exe" /autorun

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DB_AFD]
I:\Programme\DATA BECKER\XP optimal einstellen 3.0\DBAFD.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ImInstaller_IncrediMail]
I:\DOKUME~1\FAMILI~1\LOKALE~1\Temp\ImInstaller\IncrediMail\incredimail_install.exe -startup -product IncrediMail

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"I:\Programme\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
I:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sonic RecordNow!]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
I:\Programme\Java\j2re1.4.2_05\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"I:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Tweak UI]
RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateManager]
"I:\Programme\Gemeinsame Dateien\Sonic\Update Manager\sgtray.exe" /r

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WebCamRT.exe]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinMX]
C:\musika_peliculas\filesharing\WinMX\WinMX.exe -m

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winupdates]
I:\Programme\winupdates\winupdates.exe /auto

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\XPoe-Runtime]
I:\Programme\DATA BECKER\XP optimal einstellen 3.0\xpoerunt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"TapiSrv"=3 (0x3)
"wuauserv"=2 (0x2)
"Alerter"=2 (0x2)

R0 avgntmgr;avgntmgr;I:\WINDOWS\system32\drivers\avgntmgr.sys
R1 avgntdd;avgntdd;I:\WINDOWS\system32\DRIVERS\avgntdd.sys
R1 Cinemsup;Cinemsup;I:\WINDOWS\system32\drivers\Cinemsup.sys
R1 NETDSL;AVM PPP over Ethernet;I:\WINDOWS\system32\DRIVERS\netdsl.sys
R2 Crypto;Crypto;I:\WINDOWS\system32\drivers\Crypto.sys
R2 IPSECDRV;SafeNet IPSec Plugin;\??\I:\WINDOWS\system32\Drivers\IPSECDRV.sys
R2 MSSQL$FHU;MSSQL$FHU;I:\Programme\Microsoft SQL Server\MSSQL$FHU\Binn\sqlservr.exe -sFHU
R2 PGPdisk;PGPdisk;I:\WINDOWS\system32\drivers\PGPdisk.sys
R2 PGPsdkDriver;PGPsdkDriver;I:\WINDOWS\system32\Drivers\PGPsdk.sys
R2 ppsio;PrmxPPDev;I:\WINDOWS\system32\drivers\ppsio.sys
R2 SMTPSVC;Simple Mail Transfer Protocol (SMTP);I:\WINDOWS\system32\inetsrv\inetinfo.exe
R3 DniVap;SafeNet WAN Miniport (VA);I:\WINDOWS\system32\DRIVERS\vap.sys
R3 NETFWDSL;AVM FRITZ!web DSL PPP;I:\WINDOWS\system32\DRIVERS\NETFWDSL.SYS
S3 AVMCOWAN;AVM CoNDIS WAN CAPI Treiber;I:\WINDOWS\system32\DRIVERS\avmcowan.sys
S3 AVMDSLPPPOE;AVM DSL PPPoE CAPI-Treiber;I:\WINDOWS\system32\DRIVERS\avmdsloe.sys
S3 AVMNDSL;AVM DSL NDIS WAN CAPI Treiber;I:\WINDOWS\system32\DRIVERS\avmndsl.sys
S3 FDSLBASE;AVM FRITZ!Card DSL (WinXP/2000);I:\WINDOWS\system32\DRIVERS\fdslbase.sys
S3 snpstd2;Trek 310;I:\WINDOWS\system32\DRIVERS\snpstd2.sys
S3 SQLAgent$FHU;SQLAgent$FHU;I:\Programme\Microsoft SQL Server\MSSQL$FHU\Binn\sqlagent.EXE -i FHU

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
\Shell\AutoRun\command - G:\setup.exe

.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-06 19:59:39
Windows 5.1.2600 Service Pack 2 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostart Eintr„ge...

Scanne versteckte Dateien...

**************************************************************************
.
Zeit der Fertigstellung: 2007-11-06 20:02:25 - machine was rebooted
.
--- E O F ---

Hallo,

Zitat von Unwissender123

I:\WINDOWS\system32\drivers\hidr.exe

unter anderem dürftest du einen Bagle laufen haben, der für die deaktivierten AV-/Anti-Spyware-Programme verantwortlich sein könnte, in der Regel aber per Mail ankommt.

Ein HijackThis-Logfile und ein eScan wären von Interesse; Anleitungen dazu findest du im entsprechenden Unterforum.

Ferner unternimm bitte einen Scan mit Blacklight und poste auch dieses Log.

Hallo,
wie löscht man einen "Bagle"??
Hijackthis log ist hier anbei.

lg

So, jetzt hab ich mir auch mal sowas hübsches eingefangen.

Mit meinem 2. System hab ich alle erkannten Dateien vernichtet.

Tja.

Dateien sind futsch - Wirkung sprich daß keine Sicherheitssoft mehr läuft sowie bestimmte Sites nicht angesurft werden können, bleibt.

Wie zum Kuckuck macht das dieser Virus ?
Wo kann ich was löschen ?

In der Registry ist auch weit und breit nix mehr von srosa oder hldrrr oder wintmrs zu sehen.

Gibts wo eine Übersicht, was die Viren da verbogen haben bzw. wo ich den Hebel ansetzen könnte ?

Danke für die Tips im voraus.


Fancy Destroyer