Ständiges WINDOWS SECURITY ALERT: Wie entferne ich diesen Trojaner? Logfile vorhanden

jeremy007

Hier noch der 2.Teil:
Jeremy

main.txt: Teil 2

--------


-- Registry Dump --------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIModeChange"="Ati2mdxx.exe" [25.02.2004 20:08 C:\WINDOWS\system32\Ati2mdxx.exe]
"ATIPTA"="C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe" [03.02.2004 21:10]
"AGRSMMSG"="AGRSMMSG.exe" [11.06.2003 05:37 C:\WINDOWS\AGRSMMSG.exe]
"Hcontrol"="C:\WINDOWS\ATK0100\Hcontrol.exe" [09.09.2003 01:02]
"SynTPLpr"="C:\Programme\Synaptics\SynTP\SynTPLpr.exe" [17.06.2003 19:40]
"SynTPEnh"="C:\Programme\Synaptics\SynTP\SynTPEnh.exe" [17.06.2003 19:40]
"SAMSUNG Keydefin"="C:\Programme\SAMSUNG\Keydefin\KeyDefin.exe" [15.01.2004 21:48]
"Realtime Monitor"="C:\PROGRA~1\CA\ETRUST~1\realmon.exe" [06.04.2004 17:14]
"IntelliPoint"="C:\Programme\Microsoft IntelliPoint\point32.exe" [10.06.2005 11:21]
"Google Desktop Search"="C:\Programme\Google\Google Desktop Search\GoogleDesktop.exe" [09.12.2007 10:07]
"QuickTime Task"="C:\Programme\QuickTime\qttask.exe" [11.12.2007 11:56]
"avgnt"="C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [12.02.2008 10:06]
"TrojanScanner"="D:\Programme\Trojan Remover\Trjscan.exe" [26.07.2008 21:02]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [04.08.2004 14:00]
"DayDisplay"="C:\Programme\DayDisplay\DayDisplay.exe" [23.02.2003 16:26]
"HotkeySearchTool"="C:\Programme\Hotkey Search Tool\SearchTool.exe" [22.04.2006 14:30]
"RocketDock"="C:\Programme\RocketDock\RocketDock.exe" [14.05.2006 22:47]
"swg"="C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [20.06.2007 09:18]
"googletalk"="C:\Programme\Google\Google Talk\googletalk.exe" [19.04.2007 07:37]
"winsetmsg"="C:\WINDOWS\system32\lwrgrslq.exe" [26.07.2008 13:40]
"SpybotSD TeaTimer"="D:\Programme\Spybot - Search & Destroy\TeaTimer.exe" [07.07.2008 09:42]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce]
"WIAWizardMenu"=RUNDLL32.EXE C:\WINDOWS\system32\sti_ci.dll,WiaCreateWizardMenu

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"TSClientMSIUninstaller"=cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs"

C:\Dokumente und Einstellungen\XXXX\Startmen�\Programme\Autostart\
Desktop Calendar Reminder.lnk - C:\Programme\Desktop Calendar Reminder\Desktop Calendar Reminder.exe [11.05.2006 11:41:10]
Last.fm Helper.lnk - D:\Programme\Last.fm\LastFMHelper.exe [27.01.2008 14:47:32]

C:\Dokumente und Einstellungen\All Users\Startmen�\Programme\Autostart\
Acrobat Assistant.lnk - C:\Programme\Adobe\Acrobat 6.0\Distillr\acrotray.exe [15.05.2003 02:19:50]
Adobe Gamma Loader.lnk - C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe [18.07.2006 15:04:15]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"disableregistrytools"=0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\Run]
"1i9qjB6dFX"=C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\jupizizm\twvqrwbu.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ClearRecentDocsOnExit"=1 (0x1)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"hlpdscsh"= {35CCA6C1-0D38-A1C4-15EC-00B65925B612} - C:\Programme\eivydsb\hlpdscsh.dll [26.07.2008 13:41 118784]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice"


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ddbf72a2-247b-11dc-bc23-000e359b8563}]
verb1\command- desktop.exe




-- Hosts ----------------------------------------------

127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com

8908 more entries in hosts file.


-- End of Deckard's System Scanner: finished at 2008-07-30 13:22:31 ------------