Über 600 gepackte Trojaner in Windows/Fonts !!

Kery

Hier das combofix log :

ComboFix 08-03-04.5 - Kery 2008-03-11 20:59:17.2 - NTFSx86
ausgeführt von:: E:\Downloads\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((( Dateien erstellt von 2008-02-11 bis 2008-03-11 ))))))))))))))))))))))))))))))
.

2008-03-10 01:23 . 2008-03-10 01:23 <DIR> d-------- C:\Programme\ReflexiveArcade
2008-03-09 22:50 . 2008-03-09 22:50 <DIR> d-------- C:\Programme\Tsunami-Filter-Pack
2008-03-09 22:50 . 2008-03-09 22:50 <DIR> d-------- C:\Programme\Avisynth
2008-03-09 22:45 . 2008-03-09 22:45 <DIR> d-------- C:\WINDOWS\system32\quicktime
2008-03-09 22:45 . 2008-03-09 22:45 <DIR> d-------- C:\Programme\NimoCodec Pack
2008-03-09 22:45 . 2008-03-09 22:45 <DIR> d-------- C:\Programme\DivX
2008-03-06 22:37 . 2008-03-06 22:37 <DIR> d-------- C:\Dokumente und Einstellungen\***\Anwendungsdaten\GameHouse
2008-03-06 18:18 . 2008-03-06 18:18 1,142 --a------ C:\WINDOWS\mozver.dat
2008-03-06 18:17 . 2008-03-06 18:17 0 --a------ C:\WINDOWS\nsreg.dat
2008-03-06 15:28 . 2008-03-06 21:11 <DIR> d-------- C:\Programme\XoftSpySE
2008-03-06 11:30 . 2004-08-03 23:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys
2008-03-06 04:57 . 2008-03-11 02:11 69 --a------ C:\WINDOWS\NeroDigital.ini
2008-03-06 01:12 . 2008-03-09 02:05 31 --a------ C:\WINDOWS\popcinfo.dat
2008-03-05 23:04 . 2008-03-05 23:04 <DIR> d-------- C:\Programme\Nero
2008-03-05 23:04 . 2008-03-05 23:04 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Nero
2008-03-05 22:52 . 2008-03-05 22:52 0 --a------ C:\WINDOWS\Irremote.ini
2008-03-05 01:32 . 2008-03-11 12:59 <DIR> d-------- C:\Programme\HijackThisxx
2008-03-01 14:29 . 2008-03-01 14:29 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\n7-89-o9-3r-4t-r9
2008-03-01 14:09 . 2008-03-02 23:41 <DIR> d-a------ C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP
2008-02-29 00:33 . 2008-02-29 02:08 <DIR> d-------- C:\Dokumente und Einstellungen\***\.smplayer
2008-02-29 00:32 . 2008-02-29 00:33 <DIR> d-------- C:\Programme\SMPlayer
2008-02-29 00:13 . 2008-02-29 00:13 <DIR> d-------- C:\Dokumente und Einstellungen\***\Anwendungsdaten\CyberLink
2008-02-29 00:00 . 2008-02-29 00:00 <DIR> d-------- C:\Dokumente und Einstellungen\***\Anwendungsdaten\vlc
2008-02-28 13:16 . 2008-02-28 23:51 <DIR> d-------- C:\temp
2008-02-27 16:15 . 2008-02-27 16:15 <DIR> d-------- C:\Programme\Real
2008-02-27 16:15 . 2008-02-27 16:15 <DIR> d-------- C:\Programme\Gemeinsame Dateien\xing shared
2008-02-27 16:15 . 2008-02-27 16:15 <DIR> d-------- C:\Programme\Gemeinsame Dateien\Real
2008-02-26 23:11 . 2008-02-26 23:11 <DIR> d-------- C:\Dokumente und Einstellungen\***\Incomplete
2008-02-26 15:29 . 2008-02-26 21:45 <DIR> d-------- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Zylom
2008-02-26 15:28 . 2008-03-03 22:29 <DIR> d-------- C:\Programme\Zylom Games
2008-02-26 14:25 . 2008-02-26 14:25 <DIR> d-------- C:\Programme\Java
2008-02-26 14:25 . 2005-03-04 03:36 49,265 --a------ C:\WINDOWS\system32\jpicpl32.cpl
2008-02-26 14:24 . 2008-02-26 14:24 <DIR> d-------- C:\Programme\Gemeinsame Dateien\Java
2008-02-26 14:23 . 2008-02-26 14:23 <DIR> d-------- C:\Programme\appleJuice
2008-02-26 14:06 . 2008-02-26 14:23 <DIR> d-------- C:\WINDOWS\appleJuice
2008-02-26 13:49 . 2004-08-03 23:57 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2008-02-26 11:19 . 2008-02-26 11:19 <DIR> d-------- C:\Programme\Gemeinsame Dateien\Adobe
2008-02-26 10:50 . 2008-02-26 11:17 <DIR> d-------- C:\Dokumente und Einstellungen\***\Anwendungsdaten\AdobeUM
2008-02-26 01:20 . 2008-02-26 01:20 <DIR> d-------- C:\WINDOWS\Sun
2008-02-26 01:02 . 2008-02-26 01:02 <DIR> d---s---- C:\Dokumente und Einstellungen\***\UserData
2008-02-26 00:45 . 2008-03-11 00:50 <DIR> d-------- C:\Spiele
2008-02-26 00:44 . 1998-10-21 18:43 328,704 --a------ C:\WINDOWS\IsUn0407.exe
2008-02-26 00:07 . 2008-03-06 17:52 <DIR> d-------- C:\Programme\Security Task Manager
2008-02-26 00:07 . 2008-03-06 17:54 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SecTaskMan
2008-02-26 00:01 . 2008-02-26 00:01 400 --a------ C:\WINDOWS\ODBC.INI
2008-02-25 23:59 . 2008-02-26 00:00 <DIR> d-------- C:\WINDOWS\ShellNew
2008-02-25 23:48 . 2008-02-25 23:48 <DIR> d-------- C:\Programme\Spybot - Search & Destroy
2008-02-25 23:48 . 2008-02-26 00:11 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
2008-02-25 23:38 . 2008-02-25 23:38 <DIR> d-------- C:\Programme\audiograbber
2008-02-25 23:38 . 2008-02-25 23:38 34 --a------ C:\WINDOWS\cdplayer.ini
2008-02-25 23:31 . 2008-03-06 05:03 <DIR> d-------- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Ahead
2008-02-25 23:29 . 2008-03-05 23:05 <DIR> d-------- C:\Programme\Gemeinsame Dateien\Ahead
2008-02-25 23:16 . 2008-02-25 23:16 <DIR> d-------- C:\Programme\Deamon
2008-02-25 23:16 . 2004-08-22 16:31 155,136 --a------ C:\WINDOWS\system32\drivers\d347bus.sys
2008-02-25 23:16 . 2004-08-22 16:31 5,248 --a------ C:\WINDOWS\system32\drivers\d347prt.sys
2008-02-25 23:15 . 2008-02-25 23:15 <DIR> d-------- C:\WINDOWS\Downloaded Installations
2008-02-25 23:07 . 2008-02-25 23:07 <DIR> d-------- C:\WINDOWS\OPTIONS
2008-02-25 23:07 . 2006-08-15 06:09 83,200 -ra------ C:\WINDOWS\system32\drivers\Rtenicxp.sys
2008-02-25 23:06 . 2008-02-25 23:06 <DIR> d-------- C:\WINDOWS\system32\Lang
2008-02-25 23:06 . 2008-02-25 23:06 940,794 --a------ C:\WINDOWS\system32\LoopyMusic.wav
2008-02-25 23:06 . 2008-02-25 23:06 146,650 --a------ C:\WINDOWS\system32\BuzzingBee.wav
2008-02-25 23:04 . 2008-02-25 23:05 <DIR> d-------- C:\WINDOWS\system32\RTCOM
2008-02-25 23:04 . 2008-02-25 23:07 <DIR> d-------- C:\Programme\Realtek
2008-02-25 23:03 . 2008-02-25 23:03 <DIR> d-------- C:\Dokumente und Einstellungen\***\Anwendungsdaten\ATI
2008-02-25 23:03 . 2007-01-12 09:54 520,192 -r------- C:\WINDOWS\RtlExUpd.dll
2008-02-25 23:03 . 2008-02-25 23:03 315,392 --a------ C:\WINDOWS\HideWin.exe
2008-02-25 23:00 . 2008-02-25 23:00 <DIR> d-------- C:\WINDOWS\ASUSInstAll
2008-02-25 22:51 . 2008-02-25 22:57 <DIR> d-------- C:\Programme\ATI Technologies
2008-02-25 22:50 . 2008-02-25 22:50 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
2008-02-25 22:50 . 2008-02-25 22:50 <DIR> d-------- C:\Programme\DIFX
2008-02-25 22:50 . 2006-06-18 23:38 43,520 --a------ C:\WINDOWS\system32\drivers\AmdK8.sys
2008-02-25 22:49 . 2008-02-25 23:08 21,910 --a------ C:\WINDOWS\Ascd_log.ini
2008-02-25 22:49 . 2008-02-25 22:49 21,582 --a------ C:\WINDOWS\Ascd_tmp.ini
2008-02-25 22:49 . 2004-08-13 19:56 5,810 -ra------ C:\WINDOWS\system32\drivers\ASACPI.sys
2008-02-25 22:48 . 2006-10-11 04:33 10,288 --a------ C:\WINDOWS\system32\drivers\ASUSHWIO.SYS
2008-02-25 22:44 . 2003-02-14 15:31 73,728 -ra------ C:\WINDOWS\system32\cnm1E7.tmp
2008-02-25 22:41 . 2003-02-28 05:30 100,352 --a------ C:\WINDOWS\system32\CNMLM50.DLL
2008-02-25 22:41 . 2003-02-14 15:31 73,728 -ra------ C:\WINDOWS\system32\CNMCP50.exe
2008-02-25 22:41 . 2003-02-28 05:30 5,632 --a------ C:\WINDOWS\system32\CNMVS50.DLL
2008-02-25 22:14 . 2008-03-11 20:02 <DIR> d-------- C:\Dokumente und Einstellungen\***\appleJuice
2008-02-25 21:59 . 2008-02-25 23:03 <DIR> d-------- C:\Programme\TVgenial
2008-02-25 21:58 . 2008-02-25 21:58 <DIR> d-------- C:\Programme\VideoLAN
2008-02-25 21:56 . 2008-02-25 21:56 <DIR> d-------- C:\Programme\Kalenderchen
2008-02-25 21:54 . 2008-03-10 12:54 <DIR> d-------- C:\Programme\Google
2008-02-25 21:52 . 2008-03-11 20:56 <DIR> d-------- C:\Programme\DasÖrtliche Such-Leiste
2008-02-25 21:52 . 2008-02-25 21:52 682,232 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-02-25 21:37 . 2008-02-25 21:38 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CyberLink
2008-02-25 21:36 . 2008-03-09 22:50 <DIR> d--h----- C:\Programme\InstallShield Installation Information
2008-02-25 21:36 . 2008-02-25 21:36 <DIR> d-------- C:\Programme\CyberLink
2008-02-25 21:36 . 2008-02-27 16:15 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll
2008-02-25 21:36 . 2003-02-21 04:42 348,160 --------- C:\WINDOWS\system32\msvcr71.dll
2008-02-25 21:36 . 2001-03-08 18:30 24,064 --------- C:\WINDOWS\system32\msxml3a.dll
2008-02-25 21:35 . 2008-02-25 22:52 <DIR> d-------- C:\Programme\Gemeinsame Dateien\InstallShield
2008-02-25 21:34 . 2008-03-03 22:28 <DIR> d-------- C:\Entpacktes
2008-02-25 21:34 . 2008-03-04 17:39 <DIR> d-------- C:\Dowloads
2008-02-25 21:24 . 2004-11-24 02:00 14,976 -ra------ C:\WINDOWS\system32\drivers\avmunet.sys
2008-02-24 20:28 . 2004-08-04 00:40 57,600 --a------ C:\WINDOWS\system32\drivers\redbook.sys
2008-02-24 20:28 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-02-24 20:28 . 2001-08-17 13:59 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys
2008-02-24 20:27 . 2004-08-04 00:57 77,312 --a------ C:\WINDOWS\system32\usbui.dll

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-04 23:19 316,928 ----a-w C:\WINDOWS\Fonts\rar.exe
2008-03-01 12:56 0 ----a-w C:\Programme\temp01
2008-02-29 18:01 --------- d-----w C:\Programme\TuneUp Utilities 2007
2008-02-27 09:18 --------- d-----w C:\Programme\IncrediMail
2008-02-25 19:58 --------- d-----w C:\Programme\Gemeinsame Dateien\Wise Installation Wizard
2008-02-25 19:58 --------- d-----w C:\Dokumente und Einstellungen\Kery\Anwendungsdaten\TuneUp Software
2008-02-25 19:58 --------- d-----w C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TuneUp Software
2008-02-25 19:56 --------- d-----w C:\Programme\Common files
2008-02-25 19:55 --------- d-----w C:\Programme\Avira
2008-02-25 19:55 --------- d-----w C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Avira
2008-02-25 19:51 --------- d-----w C:\Programme\xp-AntiSpy
2008-02-25 19:36 --------- d-----w C:\Programme\microsoft frontpage
2008-02-25 19:34 --------- d-----w C:\Programme\Online-Dienste
2008-02-25 19:34 --------- d-----w C:\Programme\Gemeinsame Dateien\Dienste
.

------- Sigcheck -------

27a5959c94ee173a063ca06bd14f021a C:\WINDOWS\system32\drivers\tcpip.sys
----a-w 359,040 2004-08-10 16:11:23 C:\WINDOWS\system32\drivers\tcpip.sys
.
((((((((((((((((((((((((((((( snapshot@2008-03-05_10.15.26,14 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-03-10 11:54:52 26,694 ----a-r C:\WINDOWS\Installer\{1E04F83B-2AB9-4301-9EF7-E86307F79C72}\ARPPRODUCTICON.exe
+ 2008-03-10 11:54:52 26,694 ----a-r C:\WINDOWS\Installer\{1E04F83B-2AB9-4301-9EF7-E86307F79C72}\googleearth.exe_407B9B5CDAC54F44A756B57CAB4E6A8B.exe
+ 2008-03-10 11:54:52 26,694 ----a-r C:\WINDOWS\Installer\{1E04F83B-2AB9-4301-9EF7-E86307F79C72}\googleearth.exe1_407B9B5CDAC54F44A756B57CAB4E6A8B.exe
+ 2008-03-10 11:54:52 65,536 ----a-r C:\WINDOWS\Installer\{1E04F83B-2AB9-4301-9EF7-E86307F79C72}\NewShortcut1_407B9B5CDAC54F44A756B57CAB4E6A8B.exe
+ 2008-03-10 11:54:52 65,536 ----a-r C:\WINDOWS\Installer\{1E04F83B-2AB9-4301-9EF7-E86307F79C72}\NewShortcut2_407B9B5CDAC54F44A756B57CAB4E6A8B.exe
+ 2008-03-10 11:54:52 26,694 ----a-r C:\WINDOWS\Installer\{1E04F83B-2AB9-4301-9EF7-E86307F79C72}\UNINST_Uninstall_G_3DE5E7D47B88403CA3FD2017A8240C5B.exe
+ 2008-03-05 22:05:46 25,214 ----a-r C:\WINDOWS\Installer\{2D7D9D86-923A-41A8-919F-437332AB1031}\ARPPRODUCTICON.exe
+ 2002-11-22 15:21:26 123,904 ----a-w C:\WINDOWS\system32\avisynth.dll
+ 2002-05-04 14:19:00 49,152 ----a-w C:\WINDOWS\system32\avisynthEx.dll
+ 2002-05-17 19:44:18 1,306,624 ----a-w C:\WINDOWS\system32\divx.dll
+ 2002-08-01 10:03:40 121,344 ----a-w C:\WINDOWS\system32\DivXc32.dll
+ 2001-02-21 14:08:24 122,944 ----a-w C:\WINDOWS\system32\divxc32f.dll
- 2007-11-21 16:31:48 11,304 ----a-w C:\WINDOWS\system32\drivers\imagedrv.sys
+ 2005-08-15 10:08:26 5,888 ----a-w C:\WINDOWS\system32\drivers\imagedrv.sys
- 2007-11-21 16:31:48 132,904 ----a-w C:\WINDOWS\system32\drivers\imagesrv.sys
+ 2005-08-15 10:08:26 127,488 ----a-w C:\WINDOWS\system32\drivers\imagesrv.sys
+ 2004-08-03 22:08:48 26,496 ----a-w C:\WINDOWS\system32\drivers\USBSTOR.SYS
+ 2001-12-08 19:20:20 17,920 ----a-w C:\WINDOWS\system32\huffyuv.dll
- 2006-03-17 10:45:52 1,757,184 ----a-w C:\WINDOWS\system32\imagX7.dll
+ 2004-07-26 15:16:10 1,568,768 ----a-w C:\WINDOWS\system32\imagX7.dll
- 2006-03-17 10:45:54 497,296 ----a-w C:\WINDOWS\system32\imagXpr7.dll
+ 2004-07-26 15:16:10 476,320 ----a-w C:\WINDOWS\system32\imagXpr7.dll
- 2006-03-17 10:45:54 258,048 ----a-w C:\WINDOWS\system32\imagXR7.dll
+ 2004-07-26 15:16:10 262,144 ----a-w C:\WINDOWS\system32\imagXR7.dll
- 2006-03-17 10:45:54 802,816 ----a-w C:\WINDOWS\system32\imagXRA7.dll
+ 2004-07-26 15:16:10 471,040 ----a-w C:\WINDOWS\system32\imagXRA7.dll
+ 2002-09-23 12:31:50 195,697 ----a-w C:\WINDOWS\system32\libavcodec.dll
+ 2002-09-23 12:32:46 113,331 ----a-w C:\WINDOWS\system32\libmpeg2_ff.dll
+ 2002-09-23 12:33:38 107,455 ----a-w C:\WINDOWS\system32\libpostproc.dll
+ 2007-11-20 15:52:00 2,884,992 ----a-w C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
+ 2007-11-20 15:52:00 218,496 ----a-w C:\WINDOWS\system32\Macromed\Flash\NPSWF32_FlashUtil.exe
+ 2002-05-17 21:18:30 39,936 ----a-w C:\WINDOWS\system32\mp4fil32.dll
+ 2001-06-22 12:06:02 167,936 ----a-w C:\WINDOWS\system32\MPEG2DEC.dll
+ 2002-08-20 00:41:12 120,832 ----a-w C:\WINDOWS\system32\mpg4c32.dll
+ 2002-01-05 04:37:28 344,064 ----a-w C:\WINDOWS\system32\msvcr70.dll
- 2007-12-03 17:04:12 95,600 ----a-w C:\WINDOWS\system32\NeroCo.dll
+ 2005-02-16 13:18:04 90,184 ----a-w C:\WINDOWS\system32\NeroCo.dll
+ 2002-10-05 00:04:18 21,504 ----a-w C:\WINDOWS\system32\ogg.dll
+ 2002-10-06 19:42:58 105,472 ----a-w C:\WINDOWS\system32\OggDS.dll
+ 2001-06-23 13:04:50 198,656 ----a-w C:\WINDOWS\system32\pvmjpg21.dll
+ 1999-06-24 00:47:36 19,968 ----a-w C:\WINDOWS\system32\RaMp3Cfg.exe
+ 2002-07-29 17:15:04 61,440 ----a-w C:\WINDOWS\system32\SimpleResize.dll
- 2006-03-17 13:49:46 368,640 ----a-w C:\WINDOWS\system32\TwnLib4.dll
+ 2004-07-09 07:43:56 364,544 ----a-w C:\WINDOWS\system32\TwnLib4.dll
+ 2002-10-15 22:54:04 153,088 ----a-w C:\WINDOWS\system32\unrar.dll
+ 2000-07-22 15:49:46 180,736 ----a-w C:\WINDOWS\system32\vfcodec.dll
+ 2002-12-11 08:18:44 348,160 ----a-w C:\WINDOWS\system32\vobsub.dll
+ 2002-10-05 00:04:26 92,672 ----a-w C:\WINDOWS\system32\vorbis.dll
+ 2002-10-05 00:04:26 90,624 ----a-w C:\WINDOWS\system32\vorbisenc.dll
+ 2002-10-04 07:01:42 135,168 ----a-w C:\WINDOWS\system32\xvid.dll
- 2007-03-20 19:22:04 972,336 ----a-w C:\WINDOWS\UNNeroBackItUp.exe
+ 2006-07-14 15:29:44 966,656 ----a-w C:\WINDOWS\UNNeroBackItUp.exe
- 2007-12-13 18:09:06 972,072 ----a-w C:\WINDOWS\UNNeroMediaHome.exe
+ 2006-07-14 15:29:44 966,656 ----a-w C:\WINDOWS\UNNeroMediaHome.exe
- 2007-02-28 14:41:02 972,336 ----a-w C:\WINDOWS\UNNeroShowTime.exe
+ 2006-07-14 15:29:44 966,656 ----a-w C:\WINDOWS\UNNeroShowTime.exe
- 2007-03-21 19:02:12 972,336 ----a-w C:\WINDOWS\UNNeroVision.exe
+ 2006-07-14 15:29:44 966,656 ----a-w C:\WINDOWS\UNNeroVision.exe
- 2007-12-04 08:59:22 972,072 ----a-w C:\WINDOWS\UNRecode.exe
+ 2006-07-14 15:29:44 966,656 ----a-w C:\WINDOWS\UNRecode.exe
.
-- Snapshot reset to current date --
.
(((((((((((((((((((((((((((( Autostart Punkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Hinweis* leere Eintrage & legitime Standardeintrage werden nicht angezeigt.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IncrediMail"="C:\PROGRA~1\INCRED~1\bin\IncMail.exe" [2004-02-23 20:21 176171]
"TVgenial"="C:\Programme\TVgenial\TVgenial.exe" [2008-02-25 22:02 875520]
"swg"="C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-02-25 23:03 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-25 23:04 249896]
"DMS-Kalenderchen"="C:\Programme\Kalenderchen\Kalenderchen.exe" [2005-07-20 22:35 1445376]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 23:57 15360]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"MaxRecentDocs"= 2 (0x2)
"GreyMSIAds"= 1 (0x1)
"NoRecentDocsNetHood"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\policies\microsoft\windows\windowsupdate\au]
"NoAutoUpdate"= 1 (0x1)

[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Adobe Reader - Schnellstart.lnk]
path=C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Reader - Schnellstart.lnk
backup=C:\WINDOWS\pss\Adobe Reader - Schnellstart.lnkCommon Startup

[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Microsoft Office.lnk]
path=C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^***^Startmenü^Programme^Autostart^PrevxCSI.lnk]
path=C:\Dokumente und Einstellungen\***\Startmenü\Programme\Autostart\PrevxCSI.lnk
backup=C:\WINDOWS\pss\PrevxCSI.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2006-11-16 19:04 139264 C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033]
--a------ 2004-08-22 17:05 81920 C:\Programme\Deamon\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Host Process]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
C:\Programme\Nero\Nero8\Nero BackItUp\NBKeyScan.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2006-01-12 15:40 155648 C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
--a------ 2008-02-25 23:03 68856 C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2008-02-27 16:15 185896 C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"RichVideo"=2 (0x2)
"gusvc"=3 (0x3)
"Ati HotKey Poller"=2 (0x2)
"NMIndexingService"=3 (0x3)
"Nero BackItUp Scheduler 3"=2 (0x2)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe
"StartCCC"=C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
"swg"=C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"LanguageShortcut"=C:\Programme\CyberLink\PowerDVD\Language\Language.exe
"RemoteControl"=C:\Programme\CyberLink\PowerDVD\PDVDServ.exe
"RTHDCPL"=RTHDCPL.EXE
"Alcmtr"=ALCMTR.EXE

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=

R2 {95808DC4-FA4A-4c74-92FE-5B863F82066B};{95808DC4-FA4A-4c74-92FE-5B863F82066B};C:\Programme\CyberLink\PowerDVD\000.fcl [2006-11-02 16:51]
R2 UxTuneUp;TuneUp Designerweiterung;C:\WINDOWS\System32\svchost.exe [2004-08-03 23:58]
R3 AVMUNET;AVM FRITZ!Box;C:\WINDOWS\system32\DRIVERS\avmunet.sys [2004-11-24 02:00]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d7dea448-ebbc-11dc-b761-b74f0c2a8664}]
\Shell\AutoRun\command - F:\preinst.exe


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\ccc-core-static]
msiexec /fums {A75BF1D0-C7C3-CB55-EE17-3225387FD154} /qb
.
Inhalt des "geplante Tasks" Ordners
"2008-02-25 22:02:42 C:\WINDOWS\Tasks\1-Klick-Wartung.job"
- C:\Programme\TuneUp Utilities 2007\SystemOptimizer.exe
"2008-03-04 16:32:52 C:\WINDOWS\Tasks\XoftSpy.job"
- C:\Programme\XoftSpy\XoftSpy.exe
"2008-03-06 14:28:34 C:\WINDOWS\Tasks\XoftSpySE 2.job"
- C:\Programme\XoftSpySE\XoftSpy.exe
"2008-03-06 14:28:34 C:\WINDOWS\Tasks\XoftSpySE.job"
- C:\Programme\XoftSpySE\XoftSpy.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-11 21:00:29
Windows 5.1.2600 Service Pack 2 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostart Einträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{95808DC4-FA4A-4c74-92FE-5B863F82066B}]
"ImagePath"="\??\C:\Programme\CyberLink\PowerDVD\000.fcl"
.
Zeit der Fertigstellung: 2008-03-11 21:00:48
ComboFix2.txt 2008-03-05 09:15:35