Hallo!
Hab folgendes Problem seit 2 Tagen öffnen sich bei mir ständig neue Browserfenster mit Werbung und einem Fake Spywareschutz Programm das mich 3 mal rumklicken lässt mich das fenster geschlossen ist. Ich hab echt alles probiert was ich im Internet finden konnt ich bin am Ende des will einfach net weggehen ! Hoffe ihr könnt helfen .

Dies ist meiner erste hijack post also wenn was flasch ist bitte sagen

Hier is hijack:

Logfile of HijackThis v1.99.1
Scan saved at 21:53:16, on 15.03.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Bonjour\mDNSResponder.exe
C:\Programme\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
C:\Programme\F-Secure Internet Security\Anti-Virus\FSGK32.EXE
C:\Programme\F-Secure Internet Security\Common\FSMA32.EXE
C:\Programme\CyberLink\Shared Files\RichVideo.exe
C:\Programme\F-Secure Internet Security\Common\FSMB32.EXE
C:\Programme\F-Secure Internet Security\Common\FCH32.EXE
C:\Programme\Virtual CD v9\System\VC9SecS.exe
C:\Programme\F-Secure Internet Security\Common\FAMEH32.EXE
C:\Programme\F-Secure Internet Security\Anti-Virus\fsqh.exe
C:\Programme\F-Secure Internet Security\FSAUA\program\fsaua.exe
C:\Programme\F-Secure Internet Security\Anti-Virus\fssm32.exe
C:\Programme\F-Secure Internet Security\FWES\Program\fsdfwd.exe
C:\Programme\F-Secure Internet Security\FSAUA\program\fsus.exe
C:\Programme\F-Secure Internet Security\Anti-Virus\fsav32.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Programme\F-Secure Internet Security\Common\FSM32.EXE
C:\Programme\F-Secure Internet Security\FSGUI\fsguidll.exe
C:\Programme\Virtual CD v9\System\VC9Play.exe
C:\Programme\Musicmatch\Musicmatch Jukebox\mmtask.exe
F:\Programme\ICQ6\ICQ.exe
C:\Programme\Winamp\winampa.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Messenger\msmsgs.exe
C:\Programme\SlySoft\AnyDVD\AnyDVD.exe
C:\Programme\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Programme\Windows Live\Messenger\usnsvc.exe
C:\Programme\Winamp\winamp.exe
C:\PROGRA~1\Mozilla Firefox\firefox.exe
C:\Dokumente und Einstellungen\******\Desktop\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yodl.de
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar mit Pop-Up-Blocker - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O1 - Hosts: 121.128.133.26 gwgt1.joymax.com
O1 - Hosts: 121.128.133.27 gwgt1.joymax.com
O1 - Hosts: 121.128.133.28 gwgt1.joymax.com
O1 - Hosts: 121.128.133.26 gwgt2.joymax.com
O1 - Hosts: 121.128.133.26 gwgt2.joymax.com
O2 - BHO: (no name) - {0140DF95-9128-4053-AE72-F43F0CFCA062} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Programme\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [RemoteControl] C:\Programme\CyberLink\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [LanguageShortcut] C:\Programme\CyberLink\PowerDVD\Language\Language.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [CloneDVDElbyDelay] "C:\Programme\Elaborate Bytes\CloneDVD\ElbyCheck.exe" /L ElbyDelay
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Programme\F-Secure Internet Security\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Programme\F-Secure Internet Security\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [VC9Player] C:\Programme\Virtual CD v9\System\VC9Play.exe
O4 - HKLM\..\Run: [mmtask] "C:\Programme\Musicmatch\Musicmatch Jukebox\mmtask.exe"
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [amd_dc_opt] C:\Programme\AMD\Dual-Core Optimizer\amd_dc_opt.exe
O4 - HKLM\..\Run: [Mirabilis ICQ] F:\Programme\ICQ6\ICQ.exe -minimize
O4 - HKLM\..\Run: [WinampAgent] C:\Programme\Winamp\winampa.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AnyDVD] C:\Programme\SlySoft\AnyDVD\AnyDVD.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Programme\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ICQ] "F:\Programme\ICQ6\ICQ.exe" silent
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Programme\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O8 - Extra context menu item: In 1&&1 SoftPhone wählen - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\1&1\1&1 SoftPhone\ContextMenuHandler.html
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O10 - Unknown file in Winsock LSP: c:\programme\bonjour\mdnsnsp.dll
O10 - Unknown file in Winsock LSP: c:\programme\f-secure internet security\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\programme\f-secure internet security\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\programme\f-secure internet security\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\programme\f-secure internet security\fsps\program\fslsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - h**p://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - h**p://www.kaspersky.com/kos/german/partner/de/kavwebscan_unicode.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - h**p://www.johannrain-softwareentwicklung.de/DE/scan8/oscan8.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - h**p://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - h**p://www.acclaim.com/cabs/acclaim_v5.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} -
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} -
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - h**p://ax.emsisoft.com/asquared.cab
O16 - DPF: {BD08A9D5-0E5C-4F42-99A3-C0CB5E860557} (CSolidBrowserObj Object) - h**p://www.playwhat.com/solidPlugin/solidstateion.cab
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} -
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} -
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - h**p://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1} (Steuerung des DownloadManager ) - h**p://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.1.6.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Programme\Bonjour\mDNSResponder.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Programme\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Programme\F-Secure Internet Security\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Programme\F-Secure Internet Security\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Programme\F-Secure Internet Security\Common\FSMA32.EXE
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Programme\CyberLink\Shared Files\RichVideo.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Programme\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Programme\Spyware Doctor\pctsSvc.exe
O23 - Service: Virtual CD v9 Management Service (VC9SecS) - H+H Software GmbH - C:\Programme\Virtual CD v9\System\VC9SecS.exe

DANKE

Hallo.

1.
deaktiviere bitte kurzzeitig den Search & Destroy\TeaTimer.exe

2.
wende CCleaner an
http://www.trojaner-board.de/51464-a...-ccleaner.html

3.
wende Combofix an + poste hier das Log
http://www.virus-protect.org/artikel.../combofix.html

Erstmal Danke das du mir hilfst !!

So ich hoff mal ich habs richtig gemacht hier ist Log:

ComboFix 08-03-14.4 - ***** 2008-03-16 11:47:43.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1031.18.1477 [GMT 1:00]
ausgeführt von:: C:\Dokumente und Einstellungen\*****\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((( Dateien erstellt von 2008-02-16 bis 2008-03-16 ))))))))))))))))))))))))))))))
.

2008-03-15 23:42 . 2008-02-22 02:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-03-15 23:41 . 2008-03-15 23:42 <DIR> d-------- C:\Programme\Java
2008-03-15 23:41 . 2008-03-15 23:41 <DIR> d-------- C:\Programme\Gemeinsame Dateien\Java
2008-03-15 08:42 . 2008-03-15 08:42 <DIR> d-------- C:\Programme\Lavasoft
2008-03-15 08:42 . 2008-03-15 08:42 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Lavasoft
2008-03-15 08:28 . 2008-03-15 08:28 <DIR> dr------- C:\Dokumente und Einstellungen\LocalService\Favoriten
2008-03-15 08:22 . 2008-03-15 17:34 <DIR> d-------- C:\Programme\Spyware Doctor
2008-03-15 08:22 . 2008-03-15 08:22 <DIR> d-------- C:\Dokumente und Einstellungen\Michael\Anwendungsdaten\PC Tools
2008-03-15 08:22 . 2008-03-15 22:10 <DIR> d-a------ C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP
2008-03-15 08:22 . 2007-12-10 14:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2008-03-15 08:22 . 2007-12-10 14:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2008-03-15 08:22 . 2008-02-01 12:55 42,376 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2008-03-15 08:22 . 2007-12-10 14:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2008-03-14 23:19 . 2008-03-14 23:19 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Kaspersky Lab
2008-03-14 23:18 . 2008-03-14 23:18 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-03-14 22:55 . 2008-03-14 22:55 <DIR> d-------- C:\Dokumente und Einstellungen\*****\Anwendungsdaten\SoftInform
2008-03-14 22:53 . 2008-03-14 22:53 <DIR> d-------- C:\Programme\SoftInform
2008-03-14 22:53 . 2008-03-14 23:00 <DIR> d-------- C:\Dokumente und Einstellungen\Michael\Anwendungsdaten\AdsCleaner
2008-03-14 21:51 . 2008-03-14 21:51 <DIR> dr------- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien
2008-03-13 00:02 . 2008-03-13 00:02 <DIR> d-------- C:\Programme\Spybot - Search & Destroy
2008-03-13 00:02 . 2008-03-13 07:04 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
2008-03-12 20:46 . 2008-03-12 20:46 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico
2008-03-12 20:46 . 2008-03-12 20:46 1,406 --a------ C:\WINDOWS\system32\Help.ico
2008-03-12 18:07 . 2008-03-12 20:49 <DIR> d-------- C:\WINDOWS\BDOSCAN8
2008-03-10 21:01 . 2008-03-10 21:01 124,688 --a------ C:\WINDOWS\system32\MSWINSCK.OCX
2008-03-10 21:01 . 2008-03-10 21:01 18,944 --a------ C:\WINDOWS\system32\wk32.dll
2008-03-10 21:01 . 2008-03-10 21:01 3,584 --a------ C:\WINDOWS\system32\ic32.dll
2008-03-09 22:50 . 2008-03-09 22:50 <DIR> d-------- C:\Programme\ICQ6
2008-03-01 18:15 . 2008-03-01 18:15 <DIR> d-------- C:\Programme\Veoh Networks
2008-03-01 09:22 . 2008-03-01 09:22 <DIR> d-------- C:\Programme\AVPersonal
2008-02-26 23:28 . 2008-02-26 23:29 <DIR> d-------- C:\E2PLUS
2008-02-26 23:28 . 1996-03-08 23:15 39,768 --a------ C:\WINDOWS\E2SETUP.EXE
2008-02-26 23:28 . 2008-02-26 23:30 326 --a------ C:\WINDOWS\E2PLUS.INI
2008-02-26 21:32 . 2008-02-26 21:32 <DIR> d-------- C:\Dokumente und Einstellungen\******\WINDOWS
2008-02-26 21:32 . 1996-03-08 23:15 398,416 --a------ C:\WINDOWS\system\VBRUN300.DLL
2008-02-26 21:32 . 1996-03-08 23:15 14,639 --a------ C:\WINDOWS\E2DEINST.EXE
2008-02-26 21:32 . 1996-03-08 23:15 7,008 --a------ C:\WINDOWS\system\SETUPKIT.DLL
2008-02-26 21:32 . 2008-02-26 23:29 49 --a------ C:\WINDOWS\TEACH_ME.INI
2008-02-25 19:32 . 2008-02-11 02:05 5,004,062 --a------ C:\WINDOWS\Alica Keys - No one.mp3
2008-02-25 19:32 . 2008-02-09 16:36 1,087,470 --a------ C:\WINDOWS\server.0xe
2008-02-23 17:10 . 2008-02-23 17:11 <DIR> d-------- C:\Programme\Windows Live
2008-02-23 17:10 . 2008-02-23 17:11 <DIR> d--hsc--- C:\Programme\Gemeinsame Dateien\WindowsLiveInstaller
2008-02-23 17:10 . 2008-02-23 17:10 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\WLInstaller
2008-02-21 22:49 . 2008-02-21 22:50 <DIR> d-------- C:\Dokumente und Einstellungen\****\Anwendungsdaten\foobar2000
2008-02-21 13:52 . 2007-03-08 00:51 129,784 --------- C:\WINDOWS\system32\pxafs.dll
2008-02-21 13:52 . 2007-03-08 00:51 9,464 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys
2008-02-21 13:52 . 2007-03-08 00:51 9,336 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys
2008-02-21 13:51 . 2008-02-21 13:52 <DIR> d-------- C:\Programme\Winamp
2008-02-21 13:51 . 2008-02-21 13:53 <DIR> d-------- C:\Dokumente und Einstellungen\****\Anwendungsdaten\Winamp

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-16 09:52 --------- d-----w C:\Dokumente und Einstellungen\*****\Anwendungsdaten\teamspeak2
2008-03-15 20:32 --------- d-----w C:\Dokumente und Einstellungen\*****\Anwendungsdaten\ICQ
2008-03-15 09:43 --------- d-----w C:\Programme\Gemeinsame Dateien\Wise Installation Wizard
2008-03-10 05:06 --------- d-----w C:\Dokumente und Einstellungen\*****\Anwendungsdaten\Hamachi
2008-03-01 17:16 --------- d--h--w C:\Programme\InstallShield Installation Information
2008-02-14 12:00 --------- d-----w C:\Programme\F-Secure Internet Security
2008-01-23 21:28 --------- d-----w C:\Programme\DivX
2008-01-22 19:48 --------- d-----w C:\Programme\Activision
2007-11-22 13:23 22,328 ----a-w C:\Dokumente und Einstellungen\******\Anwendungsdaten\PnkBstrK.sys
.

------- Sigcheck -------

2006-04-20 13:18 360576 b2220c618b42a2212a59d91ebd6fc4b4 C:\WINDOWS\$hf_mig$\KB917953\SP2QFE\tcpip.sys
2003-04-02 13:00 332928 244a2f9816bc9b593957281ef577d976 C:\WINDOWS\$NtServicePackUninstall$\tcpip.sys
2004-08-03 22:14 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\$NtUninstallKB917953$\tcpip.sys
2004-08-03 22:14 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\ServicePackFiles\i386\TCPIP.SYS
2007-11-08 22:01 359808 8d8949936913b041c6a0e184fbf1030b C:\WINDOWS\system32\dllcache\TCPIP.SYS
2007-11-08 22:01 359808 8d8949936913b041c6a0e184fbf1030b C:\WINDOWS\system32\drivers\TCPIP.SYS
.
(((((((((((((((((((((((((((( Autostart Punkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Hinweis* leere Eintrage & legitime Standardeintrage werden nicht angezeigt.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0140DF95-9128-4053-AE72-F43F0CFCA062}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:57 15360]
"MSMSGS"="C:\Programme\Messenger\msmsgs.exe" [2004-10-13 17:24 1694208]
"AnyDVD"="C:\Programme\SlySoft\AnyDVD\AnyDVD.exe" [2007-12-21 04:34 1649600]
"msnmsgr"="C:\Programme\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184]
"ICQ"="F:\Programme\ICQ6\ICQ.exe" [2007-12-19 15:48 172280]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SkyTel"="SkyTel.EXE" [2006-05-16 11:04 2879488 C:\WINDOWS\SkyTel.exe]
"RemoteControl"="C:\Programme\CyberLink\PowerDVD\PDVDServ.exe" [2006-11-23 14:10 56928]
"LanguageShortcut"="C:\Programme\CyberLink\PowerDVD\Language\Language.exe" [2006-12-05 21:55 54832]
"RTHDCPL"="RTHDCPL.EXE" [2006-11-14 10:21 16270848 C:\WINDOWS\RTHDCPL.exe]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
"CloneDVDElbyDelay"="C:\Programme\Elaborate Bytes\CloneDVD\ElbyCheck.exe" [2002-11-02 07:33 45056]
"F-Secure Manager"="C:\Programme\F-Secure Internet Security\Common\FSM32.exe" [2007-05-28 10:19 183208]
"F-Secure TNB"="C:\Programme\F-Secure Internet Security\FSGUI\TNBUtil.exe" [2007-05-28 10:18 740208]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-03 21:32 208952]
"IMEKRMIG6.1"="C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE" [2003-04-02 13:00 44032]
"MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-03 21:31 59392]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-03 21:32 455168]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-03 21:32 455168]
"VC9Player"="C:\Programme\Virtual CD v9\System\VC9Play.exe" [2007-05-15 13:30 202312]
"mmtask"="C:\Programme\Musicmatch\Musicmatch Jukebox\mmtask.exe" [2006-01-17 12:26 53248]
"AtiPTA"="atiptaxx.exe" [2006-02-22 01:05 344064 C:\WINDOWS\system32\atiptaxx.exe]
"QuickTime Task"="C:\Programme\QuickTime\qttask.exe" [2007-10-07 22:10 286720]
"amd_dc_opt"="C:\Programme\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2007-07-23 11:06 77824]
"Mirabilis ICQ"="F:\Programme\ICQ6\ICQ.exe" [2007-12-19 15:48 172280]
"WinampAgent"="C:\Programme\Winamp\winampa.exe" [2008-01-15 23:54 37376]
"SunJavaUpdateSched"="C:\Programme\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-03 23:57 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="LogonUI.EXE"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"F:\\Programme\\ICQ6\\ICQ.exe"=
"C:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"=
"F:\\Spiele\\Binaries\\UT3.exe"=
"C:\\Programme\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
"C:\\Programme\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\SolidStateNetworks\\SolidStateION\\solidnm.exe"=
"C:\\Programme\\Bonjour\\mDNSResponder.exe"=
"C:\\Programme\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"C:\\Programme\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Programme\\Windows Live\\Messenger\\livecall.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9842:TCP"= 9842:TCP:*isabled:SolidNetworkManager
"9842:UDP"= 9842:UDP:*isabled:SolidNetworkManager
"21369:TCP"= 21369:TCP:SolidNetworkManager
"21369:UDP"= 21369:UDP:SolidNetworkManager
"50693:TCP"= 50693:TCP:SolidNetworkManager
"50693:UDP"= 50693:UDP:SolidNetworkManager

R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2007-08-30 13:06]
R1 atitray;atitray;C:\Programme\Radeon Omega Drivers\v3.8.360\ATI Tray Tools\atitray.sys [2007-05-22 10:04]
R1 F-Secure HIPS;F-Secure HIPS;C:\Programme\F-Secure Internet Security\HIPS\fshs.sys [2008-02-13 14:27]
R1 SSHDRV62;SSHDRV62;C:\WINDOWS\system32\drivers\SSHDRV62.sys [2007-09-02 20:25]
R1 vdrv9000;vdrv9000;C:\WINDOWS\system32\DRIVERS\vdrv9000.sys [2007-01-23 10:48]
R2 VC9SecS;Virtual CD v9 Management Service;C:\Programme\Virtual CD v9\System\VC9SecS.exe [2007-05-15 13:30]
R3 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Programme\F-Secure Internet Security\Anti-Virus\minifilter\fsgk.sys [2007-05-28 10:15]
R3 SCREAMINGBDRIVER;Screaming Bee Audio;C:\WINDOWS\system32\drivers\ScreamingBAudio.sys [2006-09-26 23:21]
S3 dump_wmimmc;dump_wmimmc;F:\Spiele\bin\GameGuard\dump_wmimmc.sys []
S3 HH9Help.sys;HH9Help.sys;C:\WINDOWS\system32\drivers\HH9Help.sys [2006-09-20 11:42]
S3 msloop;Microsoft Loopbackadaptertreiber;C:\WINDOWS\system32\DRIVERS\loop.sys [2001-08-17 12:53]
S3 scramby_out;Scramby Output;C:\WINDOWS\system32\drivers\scramby_out.sys [2007-08-08 09:31]
S3 XDva059;XDva059;C:\WINDOWS\system32\XDva059.sys []
S4 F-Secure Filter;F-Secure File System Filter;C:\Programme\F-Secure Internet Security\Anti-Virus\Win2K\FSfilter.sys [2007-05-28 10:15]
S4 F-Secure Recognizer;F-Secure File System Recognizer;C:\Programme\F-Secure Internet Security\Anti-Virus\Win2K\FSrec.sys [2007-05-28 10:15]
S4 fsbl;F-Secure BlackLight Engine Driver;C:\Programme\F-Secure Internet Security\Anti-Virus\fsbldrv.sys []

*Newly Created Service* - FSBL
.
Inhalt des "geplante Tasks" Ordners
"2008-03-07 16:15:00 C:\WINDOWS\Tasks\1-Klick-Wartung.job"
- C:\Programme\TuneUp Utilities 2007\SystemOptimizer.exe
"2008-03-16 00:00:22 C:\WINDOWS\Tasks\Scheduled scanning task.job"
- C:\PROGRA~1\F-SECU~1\ANTI-V~1\fsav.exeQ /HARD /POLICY /SCHED /NOBREAK /REPORT=C:\PROGRA~1\F-SECU~1\ANTI-V~1\report.txt
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-16 11:49:36
Windows 5.1.2600 Service Pack 2 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostart Einträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
Zeit der Fertigstellung: 2008-03-16 11:49:53
ComboFix-quarantined-files.txt 2008-03-16 10:49:52
ComboFix2.txt 2008-03-16 10:44:37
.
2007-11-14 13:13:14 --- E O F ---

Hallo

VirusTotal - Kostenloser online Viren- und Malwarescanner

C:\WINDOWS\server.0xe

Auf Durchsuchen klicken --> Datei aussuchen (oder gleich die Datei mit korrektem Pfad einkopieren mit Strg V) --> Klick auf die zu prüfende Datei und öffnen--> klick auf "Senden der Datei"... jetzt abwarten - dann mit der rechten Maustaste den Text markieren -> kopieren

2.
wende rvaxo an +poste den report
RVAXO

3.
wende smitfraudfix an (option 1 ) + poste den report
SmitfraudFix

Soo geschafft.

Also hier mal der Virustotal scann <-- der net gut aussieht des erkenn sogar ich.

Antivirus Version letzte aktualisierung Ergebnis
AhnLab-V3 2008.3.15.0 2008.03.14 Win-Trojan/Inject.1087470
AntiVir 7.6.0.73 2008.03.14 BDS/Bifrose.Gen
Authentium 4.93.8 2008.03.14 -
Avast 4.7.1098.0 2008.03.16 -
AVG 7.5.0.516 2008.03.16 BackDoor.Bifrose.BN
BitDefender 7.2 2008.03.16 MemScan:Backdoor.Bifrose.NQ
CAT-QuickHeal 9.50 2008.03.14 -
ClamAV None 2008.03.16 -
DrWeb 4.44.0.09170 2008.03.16 -
eSafe 7.0.15.0 2008.03.09 suspicious Trojan/Worm
eTrust-Vet 31.3.5616 2008.03.14 -
Ewido 4.0 2008.03.16 -
F-Prot 4.4.2.54 2008.03.15 W32/Bifrost.B.gen!Eldorado
F-Secure 6.70.13260.0 2008.03.14 Trojan.Win32.Inject.xc
FileAdvisor 1 2008.03.16 -
Fortinet 3.14.0.0 2008.03.16 -
Ikarus T3.1.1.20 2008.03.16 -
Kaspersky 7.0.0.125 2008.03.16 Trojan.Win32.Inject.xc
McAfee 5252 2008.03.14 BackDoor-CEP.svr
Microsoft 1.3301 2008.03.16 -
NOD32v2 2949 2008.03.15 probably a variant of Win32/Packed.Themida
Norman 5.80.02 2008.03.14 -
Panda 9.0.0.4 2008.03.16 -
Prevx1 V2 2008.03.16 -
Rising 20.35.61.00 2008.03.16 -
Sophos 4.27.0 2008.03.16 Mal/Generic-A
Sunbelt 3.0.963.0 2008.03.14 -
Symantec 10 2008.03.16 Infostealer
TheHacker 6.2.92.247 2008.03.15 W32/Behav-Heuristic-066
VBA32 3.12.6.2 2008.03.13 -
VirusBuster 4.3.26:9 2008.03.15 -
Webwasher-Gateway 6.6.2 2008.03.14 Trojan.Backdoor.Bifrose.Gen
weitere Informationen
File size: 1087470 bytes
MD5: 6d58274391dc6d4daf766736d05a62d8
SHA1: 8f97a5b311bc1ba79a2078613d1f6f18611d427f
PEiD: tElock 0.98 -> tE!

Rvoaxoresult:

---RVAXO.exe Updated: 2008-03-15---first run---
Uninstallers:

Files found:

Folders Found:

Hosts-file was reset, If you use a custom hosts file please replace it...

--------------RVAXO.exe last run---------------
Not deleted items:

--------------RVAXO.exe finished----------------