Hallo

Avenger will nicht dann versuchen wir es mal mit OTMoveit
Lade dir das Programm von hier --> http://download.bleepingcomputer.com...r/OTMoveIt.exe

* Starte OTMoveIt.exe mit einem doppelklick.
* Kopiere alle Dateien aus dieser Box (markiere alle Dateien dann drücke STRG C):

C:\WINDOWS\system32\hlfxcshi.ini
C:\WINDOWS\system32\aspdwdvx.ini
C:\WINDOWS\system32\yulhbxcv.ini
C:\WINDOWS\system32\cqovxpne.ini
C:\WINDOWS\system32\nmojfnie.ini
C:\WINDOWS\system32\bcydxsxj.ini
C:\WINDOWS\system32\wvrqiurw.ini
C:\WINDOWS\system32\askgsupn.ini
C:\WINDOWS\system32\grmvprcs.ini
C:\WINDOWS\system32\dvfhvbis.ini
C:\WINDOWS\system32\hpvkhxnn.ini
C:\WINDOWS\system32\bbeoncct.ini
C:\WINDOWS\system32\jhdldgkp.ini
C:\WINDOWS\system32\kryaxjhi.ini
C:\WINDOWS\system32\vdywvjqm.ini
C:\WINDOWS\system32\qjmbsufd.ini
C:\WINDOWS\system32\fnybghtf.ini
C:\WINDOWS\system32\skkododw.ini
C:\WINDOWS\system32\bharnlfj.ini
C:\WINDOWS\system32\ntieahhs.ini
C:\WINDOWS\system32\cqcrdcad.ini
C:\WINDOWS\system32\lftcbafh.ini
C:\WINDOWS\system32\gjdkblba.ini
C:\WINDOWS\system32\nycxltiu.ini
C:\WINDOWS\system32\hxkellfi.ini
C:\WINDOWS\system32\pfttvcwv.ini
C:\WINDOWS\system32\rxhohgew.ini
C:\WINDOWS\system32\lwjgtrol.ini
C:\WINDOWS\system32\ouupwskb.ini
C:\WINDOWS\system32\muynmroh.ini
C:\WINDOWS\system32\jotuqwpo.ini
C:\WINDOWS\system32\wowdtinw.ini
C:\WINDOWS\system32\aartikqn.ini
C:\WINDOWS\system32\htfpugvx.ini
C:\WINDOWS\system32\bmolccpy.ini
C:\WINDOWS\system32\qpcwqidp.ini
C:\WINDOWS\system32\nrreorgi.ini
C:\WINDOWS\system32\tjahcyln.ini
C:\WINDOWS\system32\uaudvkul.ini
C:\WINDOWS\system32\climkqkj.ini
C:\WINDOWS\system32\yiyuyboc.ini
C:\WINDOWS\system32\qupjcfgt.ini
C:\WINDOWS\system32\hgotsfwn.ini
C:\WINDOWS\system32\bocwdgud.ini
C:\WINDOWS\system32\vaesseva.ini
C:\WINDOWS\system32\phhnkmhs.ini
C:\WINDOWS\system32\achusdoj.ini
C:\WINDOWS\system32\iplgouhp.ini
C:\WINDOWS\system32\cqtujyus.ini
C:\WINDOWS\system32\csgaisbi.ini
C:\WINDOWS\system32\dgqmtjfe.ini
C:\WINDOWS\system32\icgayrjc.ini
C:\WINDOWS\system32\ceprejij.ini
C:\WINDOWS\system32\eomehmfd.ini
C:\WINDOWS\system32\xdmgcyqw.ini
C:\WINDOWS\system32\bhynngdx.ini
C:\WINDOWS\system32\jdbdxado.ini
C:\WINDOWS\system32\kmtgceqg.ini
C:\WINDOWS\system32\achgaibj.ini
C:\WINDOWS\system32\autopdnk.ini
C:\WINDOWS\system32\vinvckqr.ini
C:\WINDOWS\system32\dsehneup.ini
C:\WINDOWS\system32\odajwuxy.ini
C:\WINDOWS\system32\dksqilbe.ini
C:\WINDOWS\system32\ifhddgob.tmp
C:\WINDOWS\system32\fiflmqna.ini
C:\WINDOWS\system32\svmnhnmk.ini
C:\WINDOWS\system32\ctdaufhb.tmp
C:\WINDOWS\system32\ctdaufhb.ini
C:\WINDOWS\system32\xrjuinuk.ini
C:\WINDOWS\system32\gworenqe.ini
C:\WINDOWS\system32\qaypwqiv.ini
C:\WINDOWS\system32\kkbsdbkc.ini
C:\WINDOWS\system32\gufqekwk.ini
C:\WINDOWS\system32\xuvsvkot.ini
C:\WINDOWS\system32\qnkniqse.ini
C:\WINDOWS\system32\kabjscud.ini
C:\WINDOWS\system32\sefqrhho.ini
C:\WINDOWS\system32\dldvqkxb.ini
C:\WINDOWS\system32\owqmswtj.ini
C:\WINDOWS\system32\xgonghws.ini
C:\WINDOWS\system32\vpsxapom.ini
C:\WINDOWS\system32\vlmxghrk.ini
C:\WINDOWS\system32\axypfatv.ini
C:\WINDOWS\system32\ymsqmxui.ini
C:\WINDOWS\system32\cagmokdk.ini
C:\WINDOWS\system32\gbkdcavw.ini
C:\WINDOWS\system32\hedwofoa.ini
C:\WINDOWS\system32\nlpylxwk.ini
C:\WINDOWS\system32\gwtrkuel.ini
C:\WINDOWS\system32\afjrwoei.ini
C:\WINDOWS\system32\rlyltohl.ini
C:\WINDOWS\system32\yvnvplcb.ini
C:\WINDOWS\system32\hdaasmfi.ini
C:\WINDOWS\system32\byxyxxv.dll.vir
         

* Im Programm OTMoveIt, mach einen rechtsklick in das Fenster unter "Paste List of Files/Folders to be moved" und wähle 'Einfügen'.
* Klick auf den roten Moveit! button.
* Kopiere nun alles aus dem Results Fenster ab und füge den Inhalt in deinen Beitrag ein (STRG V).
* Beende OTMoveIt und berichte, dann sehen wir weiter

Soll ich den Rest trotzdem abarbeiten?

erst wenn wir die vermaledeiten Dateien gelöscht haben.

MFG

C:\WINDOWS\system32\hlfxcshi.ini moved successfully.
C:\WINDOWS\system32\aspdwdvx.ini moved successfully.
C:\WINDOWS\system32\yulhbxcv.ini moved successfully.
C:\WINDOWS\system32\cqovxpne.ini moved successfully.
C:\WINDOWS\system32\nmojfnie.ini moved successfully.
C:\WINDOWS\system32\bcydxsxj.ini moved successfully.
C:\WINDOWS\system32\wvrqiurw.ini moved successfully.
C:\WINDOWS\system32\askgsupn.ini moved successfully.
C:\WINDOWS\system32\grmvprcs.ini moved successfully.
C:\WINDOWS\system32\dvfhvbis.ini moved successfully.
C:\WINDOWS\system32\hpvkhxnn.ini moved successfully.
C:\WINDOWS\system32\bbeoncct.ini moved successfully.
C:\WINDOWS\system32\jhdldgkp.ini moved successfully.
C:\WINDOWS\system32\kryaxjhi.ini moved successfully.
C:\WINDOWS\system32\vdywvjqm.ini moved successfully.
C:\WINDOWS\system32\qjmbsufd.ini moved successfully.
C:\WINDOWS\system32\fnybghtf.ini moved successfully.
C:\WINDOWS\system32\skkododw.ini moved successfully.
C:\WINDOWS\system32\bharnlfj.ini moved successfully.
C:\WINDOWS\system32\ntieahhs.ini moved successfully.
C:\WINDOWS\system32\cqcrdcad.ini moved successfully.
C:\WINDOWS\system32\lftcbafh.ini moved successfully.
C:\WINDOWS\system32\gjdkblba.ini moved successfully.
C:\WINDOWS\system32\nycxltiu.ini moved successfully.
C:\WINDOWS\system32\hxkellfi.ini moved successfully.
C:\WINDOWS\system32\pfttvcwv.ini moved successfully.
C:\WINDOWS\system32\rxhohgew.ini moved successfully.
C:\WINDOWS\system32\lwjgtrol.ini moved successfully.
C:\WINDOWS\system32\ouupwskb.ini moved successfully.
C:\WINDOWS\system32\muynmroh.ini moved successfully.
C:\WINDOWS\system32\jotuqwpo.ini moved successfully.
C:\WINDOWS\system32\wowdtinw.ini moved successfully.
C:\WINDOWS\system32\aartikqn.ini moved successfully.
C:\WINDOWS\system32\htfpugvx.ini moved successfully.
C:\WINDOWS\system32\bmolccpy.ini moved successfully.
C:\WINDOWS\system32\qpcwqidp.ini moved successfully.
C:\WINDOWS\system32\nrreorgi.ini moved successfully.
C:\WINDOWS\system32\tjahcyln.ini moved successfully.
C:\WINDOWS\system32\uaudvkul.ini moved successfully.
C:\WINDOWS\system32\climkqkj.ini moved successfully.
C:\WINDOWS\system32\yiyuyboc.ini moved successfully.
C:\WINDOWS\system32\qupjcfgt.ini moved successfully.
C:\WINDOWS\system32\hgotsfwn.ini moved successfully.
C:\WINDOWS\system32\bocwdgud.ini moved successfully.
C:\WINDOWS\system32\vaesseva.ini moved successfully.
C:\WINDOWS\system32\phhnkmhs.ini moved successfully.
C:\WINDOWS\system32\achusdoj.ini moved successfully.
C:\WINDOWS\system32\iplgouhp.ini moved successfully.
C:\WINDOWS\system32\cqtujyus.ini moved successfully.
C:\WINDOWS\system32\csgaisbi.ini moved successfully.
C:\WINDOWS\system32\dgqmtjfe.ini moved successfully.
C:\WINDOWS\system32\icgayrjc.ini moved successfully.
C:\WINDOWS\system32\ceprejij.ini moved successfully.
C:\WINDOWS\system32\eomehmfd.ini moved successfully.
C:\WINDOWS\system32\xdmgcyqw.ini moved successfully.
C:\WINDOWS\system32\bhynngdx.ini moved successfully.
C:\WINDOWS\system32\jdbdxado.ini moved successfully.
C:\WINDOWS\system32\kmtgceqg.ini moved successfully.
C:\WINDOWS\system32\achgaibj.ini moved successfully.
C:\WINDOWS\system32\autopdnk.ini moved successfully.
C:\WINDOWS\system32\vinvckqr.ini moved successfully.
C:\WINDOWS\system32\dsehneup.ini moved successfully.
C:\WINDOWS\system32\odajwuxy.ini moved successfully.
C:\WINDOWS\system32\dksqilbe.ini moved successfully.
C:\WINDOWS\system32\ifhddgob.tmp moved successfully.
C:\WINDOWS\system32\fiflmqna.ini moved successfully.
C:\WINDOWS\system32\svmnhnmk.ini moved successfully.
C:\WINDOWS\system32\ctdaufhb.tmp moved successfully.
C:\WINDOWS\system32\ctdaufhb.ini moved successfully.
C:\WINDOWS\system32\xrjuinuk.ini moved successfully.
C:\WINDOWS\system32\gworenqe.ini moved successfully.
C:\WINDOWS\system32\qaypwqiv.ini moved successfully.
C:\WINDOWS\system32\kkbsdbkc.ini moved successfully.
C:\WINDOWS\system32\gufqekwk.ini moved successfully.
C:\WINDOWS\system32\xuvsvkot.ini moved successfully.
C:\WINDOWS\system32\qnkniqse.ini moved successfully.
C:\WINDOWS\system32\kabjscud.ini moved successfully.
C:\WINDOWS\system32\sefqrhho.ini moved successfully.
C:\WINDOWS\system32\dldvqkxb.ini moved successfully.
C:\WINDOWS\system32\owqmswtj.ini moved successfully.
C:\WINDOWS\system32\xgonghws.ini moved successfully.
C:\WINDOWS\system32\vpsxapom.ini moved successfully.
C:\WINDOWS\system32\vlmxghrk.ini moved successfully.
C:\WINDOWS\system32\axypfatv.ini moved successfully.
C:\WINDOWS\system32\ymsqmxui.ini moved successfully.
C:\WINDOWS\system32\cagmokdk.ini moved successfully.
C:\WINDOWS\system32\gbkdcavw.ini moved successfully.
C:\WINDOWS\system32\hedwofoa.ini moved successfully.
C:\WINDOWS\system32\nlpylxwk.ini moved successfully.
C:\WINDOWS\system32\gwtrkuel.ini moved successfully.
C:\WINDOWS\system32\afjrwoei.ini moved successfully.
C:\WINDOWS\system32\rlyltohl.ini moved successfully.
C:\WINDOWS\system32\yvnvplcb.ini moved successfully.
C:\WINDOWS\system32\hdaasmfi.ini moved successfully.
C:\WINDOWS\system32\byxyxxv.dll.vir moved successfully.

Created on 12.11.2007 06:25:54

Hallo

Ok OTMoveit hats wohl gewuppt, aber da gucken wir nochmal nach.

Erstelle bitte ein neues HijackThis Log und lass Combofix nochmal laufen.
Ebenso zeig uns nochmal den neuen Inhalt des System32 Ordners der letzten 2 Monate.

MFG

Logfile of HijackThis v1.99.1
Scan saved at 21:47:05, on 11.12.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
J:\Tobit ClipInc\Server\ClipInc-Server.exe
J:\Tobit ClipInc\Server\ClipInc-Server.exe
J:\Tobit ClipInc\Server\ClipInc-Server.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Java\jre1.6.0_03\bin\jusched.exe
C:\Programme\QuickTime\qttask.exe
C:\Programme\iTunes\iTunesHelper.exe
C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe
C:\Programme\iPod\bin\iPodService.exe
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\LiveUpdate\LiveUpdate.exe
C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programme\internet explorer\iexplore.exe
C:\Programme\ICQLite\ICQLite.exe
C:\DOKUME~1\User\LOKALE~1\Temp\Temporäres Verzeichnis 2 für This.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll (file missing)
R3 - URLSearchHook: Multi Media Germany Toolbar - {dac6ed64-8dd1-4ab8-aedf-b97892d28ffe} - C:\Programme\Multi_Media_Germany\tbMul1.dll
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Programme\Yahoo!\Messenger\ycomp.dll
O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {1B7F7A9D-0B21-455B-B6F6-5537A01B76D6} - C:\WINDOWS\system32\msi32.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Multi Media Germany Toolbar - {dac6ed64-8dd1-4ab8-aedf-b97892d28ffe} - C:\Programme\Multi_Media_Germany\tbMul1.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Messenger\ycomp.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar3.dll
O3 - Toolbar: Multi Media Germany Toolbar - {dac6ed64-8dd1-4ab8-aedf-b97892d28ffe} - C:\Programme\Multi_Media_Germany\tbMul1.dll
O4 - HKLM\..\Run: [PSDrvCheck] C:\WINDOWS\system32\PSDrvCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programme\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [ICQ Lite] "C:\Programme\ICQLite\ICQLite.exe" -minimize
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ClipIncSrvTray] "J:\Tobit ClipInc\Player\ClipIncTray.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BTCLiveUpdate] "C:\Programme\LiveUpdate\LiveUpdate.exe" /autostart
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Programme\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programme\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Performance Center] C:\Programme\Ascentive\Performance Center\APCMain.exe -m
O4 - HKCU\..\Run: [PC SpeedScan Pro] C:\Dokumente und Einstellungen\User\Desktop\einfach ma n ordner\PCSpeedScan.exe -m
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -trayboot
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Programme\ICQToolbar\toolbaru.dll/SEARCH.HTML
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZNxdm799YYDE
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: View Exif/GPS/IPTC with IExif - C:\Programme\Opanda\IExif 1.8\IExifCom.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Programme\Titan Poker\casino.exe (file missing)
O9 - Extra 'Tools' menuitem: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Programme\Titan Poker\casino.exe (file missing)
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programme\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programme\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: PartyBingo.com - {B987E7E7-5997-4330-A5F9-9FFEFC1CCFD0} - C:\Programme\PartyGaming\PartyBingo\RunBingo.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyBingo.com - {B987E7E7-5997-4330-A5F9-9FFEFC1CCFD0} - C:\Programme\PartyGaming\PartyBingo\RunBingo.exe (file missing)
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe (file missing)
O12 - Plugin for .spop: C:\Programme\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: *.amaena.com
O15 - Trusted Zone: *.avsystemcare.com
O15 - Trusted Zone: *.gomyhit.com
O15 - Trusted Zone: *.imageservr.com
O15 - Trusted Zone: *.imagesrvr.com
O15 - Trusted Zone: *.onerateld.com
O15 - Trusted Zone: *.trustedantivirus.com
O15 - Trusted Zone: *.virusschlacht.com
O15 - Trusted Zone: *.amaena.com (HKLM)
O15 - Trusted Zone: *.avsystemcare.com (HKLM)
O15 - Trusted Zone: *.gomyhit.com (HKLM)
O15 - Trusted Zone: *.imageservr.com (HKLM)
O15 - Trusted Zone: *.imagesrvr.com (HKLM)
O15 - Trusted Zone: *.onerateld.com (HKLM)
O15 - Trusted Zone: *.trustedantivirus.com (HKLM)
O15 - Trusted Zone: *.virusschlacht.com (HKLM)
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/SmileyCentralFWBInitialSetup1.0.0.15.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://god.t-online.de/download/ExentCtl.ocx
O16 - DPF: {ABB660B6-6694-407B-950A-EDBA5A159722} (DVCDownloadControl) - http://webgames.d.tmsrv.com/c=85cbc5bd0eab51aa1bb7155203abd389/aff=t_06po_wg/p/release/sonypictures/wg_davincicode/davincicode/DVCDownloadControl.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game06.zylom.com/activex/zylomgamesplayer.cab
O16 - DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} (SproutLauncherCtrl Class) - http://media.grab.com/media/fbd793/games/files/209/SproutLauncher.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://arcade.icq.com/online2/bejeweled2/popcaploader_v6.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{03116015-647F-4989-AC22-B16B5FED26D1}: NameServer = 195.50.140.114 195.50.140.252
O17 - HKLM\System\CS2\Services\Tcpip\..\{03116015-647F-4989-AC22-B16B5FED26D1}: NameServer = 195.50.140.114 195.50.140.252
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: C-DillaCdaC11BA - C-Dilla Ltd - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
O23 - Service: ClipInc 001 (ClipInc001) - Unknown owner - J:\Tobit ClipInc\Server\ClipInc-Server.exe
O23 - Service: ClipInc 002 (ClipInc002) - Unknown owner - J:\Tobit ClipInc\Server\ClipInc-Server.exe
O23 - Service: ClipInc 003 (ClipInc003) - Unknown owner - J:\Tobit ClipInc\Server\ClipInc-Server.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Programme\TuneUp Utilities 2004\WinStylerThemeSvc.exe

ComboFix 07-12-09.1 - User 2007-12-11 21:49:37.2 - NTFSx86
ausgeführt von:: C:\Dokumente und Einstellungen\User\Desktop\ComboFix.exe
.

((((((((((((((((((((((( Dateien erstellt von 2007-11-11 bis 2007-12-11 ))))))))))))))))))))))))))))))
.

2007-12-09 10:50 . 2007-12-09 10:54 <DIR> d-------- C:\HiJackThis
2007-12-07 22:36 . 2007-12-07 22:36 12 --a------ C:\WINDOWS\system32\a871a5c6
2007-12-07 02:42 . 2007-06-20 14:47 143,360 --a------ C:\WINDOWS\system32\ConTest.dll
2007-12-07 02:42 . 2003-04-22 15:41 36,864 --a------ C:\WINDOWS\system32\ascbalon.dll
2007-12-07 02:42 . 2007-02-13 11:05 20,480 --a------ C:\WINDOWS\system32\SysRestore.dll
2007-11-24 20:48 . 2007-11-24 20:48 <DIR> d-------- C:\Programme\directx
2007-11-16 15:12 . 2007-12-07 22:24 <DIR> d-------- C:\Programme\Gemeinsame Dateien\Symantec Shared

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-09 15:52 --------- d-----w C:\Programme\StarOffice7
2007-12-09 10:23 --------- d--h--w C:\Programme\InstallShield Installation Information
2007-12-07 22:31 --------- d-----w C:\Programme\Java
2007-12-07 14:00 --------- d-----w C:\Programme\Norton Security Scan
2007-11-16 16:17 --------- d-----w C:\Programme\PokerStars.NET
2007-11-11 01:41 --------- d-----w C:\Programme\PokerOffice
2007-11-06 01:52 --------- d-----w C:\Programme\PartyGaming
2007-11-05 02:15 11,270 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2007-10-22 07:43 --------- d-----w C:\Programme\DATA BECKER
2007-10-22 04:22 --------- d-----w C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AntiVir PersonalEdition Classic
2007-10-22 04:05 --------- d-----w C:\Programme\Antivir
2007-10-22 03:23 --------- d-----w C:\Programme\UNNÜTZE
2007-10-20 03:48 --------- d-----w C:\Dokumente und Einstellungen\User\Anwendungsdaten\Tobit
2007-10-20 03:47 --------- d-----w C:\Programme\Gemeinsame Dateien\Tobit
2007-01-04 18:52 92,064 ----a-w C:\Dokumente und Einstellungen\User\mqdmmdm.sys
2007-01-04 18:52 9,232 ----a-w C:\Dokumente und Einstellungen\User\mqdmmdfl.sys
2007-01-04 18:52 79,328 ----a-w C:\Dokumente und Einstellungen\User\mqdmserd.sys
2007-01-04 18:52 66,656 ----a-w C:\Dokumente und Einstellungen\User\mqdmbus.sys
2007-01-04 18:52 6,208 ----a-w C:\Dokumente und Einstellungen\User\mqdmcmnt.sys
2007-01-04 18:52 5,936 ----a-w C:\Dokumente und Einstellungen\User\mqdmwhnt.sys
2007-01-04 18:52 4,048 ----a-w C:\Dokumente und Einstellungen\User\mqdmcr.sys
2007-01-04 18:52 25,600 ----a-w C:\Dokumente und Einstellungen\User\usbsermptxp.sys
2007-01-04 18:52 22,768 ----a-w C:\Dokumente und Einstellungen\User\usbsermpt.sys
2005-05-11 14:30 774,144 ----a-w C:\Programme\RngInterstitial.dll
2005-03-23 11:28 284 ----a-w C:\Dokumente und Einstellungen\User\Anwendungsdaten\ViewerApp.dat
2001-11-23 04:08 712,704 ----a-w C:\WINDOWS\inf\OTHER\AUDIO3D.DLL
.

(((((((((((((((((((((((((((( Autostart Punkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Hinweis* leere Eintrage & legitime Standardeintrage werden nicht angezeigt.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1B7F7A9D-0B21-455B-B6F6-5537A01B76D6}]
2006-01-28 02:53 25704 --a------ C:\WINDOWS\system32\msi32.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 13:00]
"BTCLiveUpdate"="C:\Programme\LiveUpdate\LiveUpdate.exe" [2004-03-08 12:50]
"Yahoo! Pager"="C:\Programme\Yahoo!\Messenger\ypager.exe" [2004-08-06 15:33]
"MsnMsgr"="C:\Programme\MSN Messenger\MsnMsgr.exe" [2006-06-16 13:38]
"swg"="C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-01 15:37]
"Performance Center"="C:\Programme\Ascentive\Performance Center\APCMain.exe" []
"PC SpeedScan Pro"="C:\Dokumente und Einstellungen\User\Desktop\einfach ma n ordner\PCSpeedScan.exe" []

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"ICQ Lite"="C:\Programme\ICQLite\ICQLite.exe" [2006-07-11 11:15]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PSDrvCheck"="C:\WINDOWS\system32\PSDrvCheck.exe" [2003-08-28 09:47]
"SunJavaUpdateSched"="C:\Programme\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]
"QuickTime Task"="C:\Programme\QuickTime\qttask.exe" [2006-10-25 18:58]
"iTunesHelper"="C:\Programme\iTunes\iTunesHelper.exe" [2006-10-30 09:36]
"avgnt"="C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" [2007-10-24 12:27]
"POEngine"="" []
"ICQ Lite"="C:\Programme\ICQLite\ICQLite.exe" [2006-07-11 11:15]
"TkBellExe"="C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" [2007-08-18 18:43]
"ClipIncSrvTray"="J:\Tobit ClipInc\Player\ClipIncTray.exe" [2007-10-24 15:05]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 13:00]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoFavoritesMenu"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Dokumente und Einstellungen^User^Startmenü^Programme^Autostart^StarOffice 7.lnk]
backup=C:\WINDOWS\pss\StarOffice 7.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
2004-08-03 21:10 339968 --a------ C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cmaudio]
RunDll32 cmicnfg.cpl,CMICtrlWnd

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2004-08-04 13:00 15360 --a------ C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
2001-07-09 10:50 155648 --a------ C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SiSUSBRG]
2002-07-12 11:15 106496 --a------ C:\WINDOWS\SiSUSBrg.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Yahoo! Pager"=C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe -quiet

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"LVCOMS"=C:\Programme\Gemeinsame Dateien\Logitech\QCDriver3\LVCOMS.EXE
"NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe

R1 cdrbsvsd;cdrbsvsd;C:\WINDOWS\system32\drivers\cdrbsvsd.sys
R2 ClipInc001;ClipInc 001;J:\Tobit ClipInc\Server\ClipInc-Server.exe 001
R2 ClipInc002;ClipInc 002;J:\Tobit ClipInc\Server\ClipInc-Server.exe 002
R2 ClipInc003;ClipInc 003;J:\Tobit ClipInc\Server\ClipInc-Server.exe 003
S3 C-Dilla;C-Dilla;\??\C:\WINDOWS\system32\drivers\CDANT.SYS
S3 CxUSB;Logitech QuickCam VC USB;C:\WINDOWS\system32\DRIVERS\CxUSB.sys

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\AutoRun\command - E:\autoplay.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\M]
\Shell\AutoRun\command - M:\RunGame.exe

.
Inhalt des "geplante Tasks" Ordners
"2007-12-07 16:15:02 C:\WINDOWS\Tasks\1-Klick-Wartung.job"
- C:\Programme\TuneUp Utilities 2004\SystemOptimizer.exe
"2007-12-06 06:59:12 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Programme\Apple Software Update\SoftwareUpdate.exe
"2007-12-07 20:22:59 C:\WINDOWS\Tasks\Norton Security Scan.job"
- C:\Programme\Norton Security Scan\Nss.exe
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\explorer.exe [6.00.2900.2180]
-> C:\DOKUME~1\User\LOKALE~1\Temp\krfgehsnEC18160.dll
.
**************************************************************************

catchme 0.3.1331 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-11 21:56:47
Windows 5.1.2600 Service Pack 2 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostart Einträge...

Scanne versteckte Dateien...

**************************************************************************
.
Zeit der Fertigstellung: 2007-12-11 21:58:48
C:\ComboFix2.txt ... 2007-12-09 12:46
.
--- E O F ---

____________________________________________________________

Verzeichnis von C:\WINDOWS\system32

09.12.2007 16:05 6.144 Thumbs.db
07.12.2007 23:31 5.686 jupdate-1.6.0_03-b05.log
07.12.2007 22:36 12 a871a5c6
06.12.2007 19:45 13.682 wpa.dbl
04.12.2007 01:00 136.704 swsc.exe
05.11.2007 03:15 11.270 KGyGaAvL.sys
28.10.2007 12:19 52.764 perfc009.dat
28.10.2007 12:19 380.350 perfh009.dat
28.10.2007 12:19 391.000 perfh007.dat
28.10.2007 12:19 63.580 perfc007.dat
28.10.2007 12:19 897.954 PerfStringBackup.INI
24.09.2007 23:31 139.264 javaws.exe
24.09.2007 23:31 69.632 javacpl.cpl
24.09.2007 22:30 135.168 javaw.exe
24.09.2007 22:30 135.168 java.exe
11.09.2007 03:26 5.214 jupdate-1.6.0_02-b06.log

Hallo

lösche mit OTMoveit bitte diese Datei

C:\WINDOWS\system32\msi32.dll
         

gehe dazu vor wie gehabt.

Dann überprüfe dein System mit Blacklight
ftp://ftp.f-secure.com/anti-virus/tools/fsbl.exe
* Speichere das Programm unter C:\
* Scanne dein System mit Blacklight
* Poste im Anschluss das Ergebnis des Reportes in dem du alles abkopierst und hier in einen Beitrag einfügst. (die Datei sollte auf C: angelegt werden und sieht etwa so aus --> fsbl-20071208024718.)

Anschließend führe bitte einen eScan durch nach dieser Anleitung
http://www.trojaner-board.de/42731-escan-anleitung.html
poste das Ergebnis mittels der Find.bat (rechtsklick --> ziel speichern unter)


MFG

C:\WINDOWS\system32\msi32.dll NOT unregistered.
C:\WINDOWS\system32\msi32.dll moved successfully.

Created on 12.13.2007 10:26:43
____________________________________________________________________________
Zwischendurch möcht ich mich auch erstmal für die schnelle und ausfürliche Hilfe bedanke.
Danke, Danke, Danke!
____________________________________________________________________________
12/13/07 10:31:14 [Info]: BlackLight Engine 1.0.67 initialized
12/13/07 10:31:14 [Info]: OS: 5.1 build 2600 (Service Pack 2)
12/13/07 10:31:14 [Note]: 7019 4
12/13/07 10:31:14 [Note]: 7005 0
12/13/07 10:31:28 [Note]: 7006 0
12/13/07 10:31:28 [Note]: 7011 2096
12/13/07 10:31:29 [Note]: 7026 0
12/13/07 10:31:29 [Note]: 7026 0
12/13/07 10:31:38 [Note]: FSRAW library version 1.7.1024
12/13/07 11:05:37 [Note]: 7007 0