Guten Tag.
Ich habe zeit einigen zeit probleme mit IE. Obwohl ich popupblocker aktiviert habe, kommen trotzdem lauter popups.
Nach lange suchen habe ich folgenden datei gefunden "c:\users\xxxxxxxx\appdata\local\cwisomi.exe" cwisomi

Dieser Datei habe ich in autostart gefunden und dieser mit der program "Autostart Manager" deactiviert. Zeit dem ist mein problem nicht mehr aufgetretten. Wie lange noch ??
Dieser Program will bei jeder Bootvorgang starten.
AdAware und Spybot SD habe dieser datei nicht angezeigt.

Ich habe auch gegooglet und nichts gefunden über solche programm.
Ist solche datei jemand bekannt und oder ist solche datei gefährlich ??
Wenn ja wie kann ich solchen entfernen ??

Würde mich freuen wenn jemand mir ein wenig auskunft geben könnte.

Hier ist HijackThis report:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 07:34:54, on 24.12.2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe
C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Adobe\Photoshop Elements 5.0\apdproxy.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
C:\Program Files\Intel\IntelDH\CCU\CCU_Engine.exe
C:\Program Files\Steganos\Internet Security 2009\avgtray.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\PDFCreator\PDFCreator.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
C:\Program Files\Brother\Brmfcmon\BrMfcmon.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\IncrediMail\bin\IMApp.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.familyhill.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\sw g.dll
O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [NMSSupport] "C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe" /startup
O4 - HKLM\..\Run: [CCUTRAYICON] C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [GnabTray] C:\Program Files\Common Files\Gnab\Service\GnabTray.exe -checkstart
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [QuickFinder Scheduler] "C:\Program Files\WordPerfect Office X3\Programs\QFSCHD130.EXE"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Elements 5.0\apdproxy.exe"
O4 - HKLM\..\Run: [Skytel] Skytel.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] "C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe"
O4 - HKLM\..\Run: [IndexSearch] "C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe"
O4 - HKLM\..\Run: [PPort11reminder] "C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe" -r "C:\ProgramData\ScanSoft\PaperPort\11\Config\Ereg\ Ereg.ini
O4 - HKLM\..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\Steganos\INTERN~1\avgtray.exe
O4 - HKCU\..\Run: [Picasa Media Detector] REM C:\Program Files\Picasa2\PicasaMediaDetector
O4 - HKCU\..\Run: [WMPNSCFG] REM C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [cwisomi] REM "c:\users\xxxxxx\appdata\local\cwisomi.exe" cwisomi
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O4 - Global Startup: PDFCreator.lnk = C:\Program Files\PDFCreator\PDFCreator.exe
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Öffnen mit WordPerfect - C:\Program Files\WordPerfect Office X3\Programs\WPLauncher.hta
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O13 - Gopher Prefix:
O16 - DPF: Justin.tv Publisher - hxxp://wxw.justin.tv/plugins/justintv_publisher.CAB
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe Active File Monitor V5 (AdobeActiveFileMonitor5.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
O23 - Service: Intel(R) Alert Service (AlertService) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\CCU\AlertService.exe
O23 - Service: Steganos I.S. WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\Steganos\INTERN~1\avgwdsvc.exe
O23 - Service: Steganos I.S. Firewall (avgfws8) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\Steganos\INTERN~1\avgfws8.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762# # (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\Windows\system32\brsvc01a.exe
O23 - Service: Intel(R) DHTrace Controller (DHTRACE) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\IntelDH\bin\DHTraceController.exe
O23 - Service: DQLWinService - Unknown owner - C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.e xe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GnabService - Empolis GmbH - c:\program files\common files\gnab\service\servicecontroller.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktopManager.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Intel(R) Software Services Manager (ISSM) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe
O23 - Service: Intel(R) Viiv(TM) Media Server (M1 Server) - Unknown owner - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe
O23 - Service: Intel(R) Application Tracker (MCLServiceATL) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe
O23 - Service: Intel(R) NMSCore (NMSCore) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\IntelDH\NMS\NMSCore\NMSCore.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\Windows\system32\PSIService.exe
O23 - Service: Intel(R) Quality Manager (QualityManager) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\qualitymanager.exe
O23 - Service: Intel(R) Remoting Service (Remote UI Service) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

--
End of file - 12052 bytes

Ich Hoffe das es jetzt klappt.
Frohe Weihnachten
JDHill

Lade die Datei bei virustotal.com hoch und lass sie dort scannen.
Das Scanergebnis anschließebd hir posten.

Vielen Danke für die schnelle Antwort.

Anbei Report von Virus Total

a-squared 4.0.0.73 2008.12.24 -
AhnLab-V3 2008.12.25.0 2008.12.24 -
AntiVir 7.9.0.45 2008.12.24 -
Authentium 5.1.0.4 2008.12.24 -
Avast 4.8.1281.0 2008.12.24 -
AVG 8.0.0.199 2008.12.24 -
BitDefender 7.2 2008.12.24 -
CAT-QuickHeal 10.00 2008.12.24 -
ClamAV 0.94.1 2008.12.24 -
Comodo 809 2008.12.24 -
DrWeb 4.44.0.09170 2008.12.24 -
eSafe 7.0.17.0 2008.12.23 -
eTrust-Vet 31.6.6276 2008.12.24 -
Ewido 4.0 2008.12.24 -
F-Prot 4.4.4.56 2008.12.24 -
F-Secure 8.0.14332.0 2008.12.24 -
Fortinet 3.117.0.0 2008.12.24 -
GData 19 2008.12.24 -
Ikarus T3.1.1.45.0 2008.12.24 -
K7AntiVirus 7.10.564 2008.12.24 -
Kaspersky 7.0.0.125 2008.12.24 -
McAfee 5473 2008.12.23 -
McAfee+Artemis 5473 2008.12.23 -
Microsoft 1.4205 2008.12.24 -
NOD32 3716 2008.12.24 -
Norman 5.80.02 2008.12.24 -
Panda 9.0.0.4 2008.12.24 -
PCTools 4.4.2.0 2008.12.24 -
Prevx1 V2 2008.12.24 -
Rising 21.09.22.00 2008.12.24 -
SecureWeb-Gateway 6.7.6 2008.12.24 -
Sophos 4.37.0 2008.12.24 -
Sunbelt 3.2.1809.2 2008.12.22 -
Symantec 10 2008.12.24 -
TheHacker 6.3.1.4.199 2008.12.23 -
TrendMicro 8.700.0.1004 2008.12.24 -
VBA32 3.12.8.10 2008.12.23 -
ViRobot 2008.12.24.1534 2008.12.24 -
VirusBuster 4.5.11.0 2008.12.24 -
weitere Informationen
File size: 1800 bytes
MD5...: 40dfe369ec661ab3cf842aab953b4700
SHA1..: 6dbbae6a5bd13a4846ef625a79b2b0ad3a9f28a0
SHA256: 6c633010241711c37c761f8302401186ea0b16384fc3f58822685a9cad6d0334
SHA512: 3bbcdb8ef10a8264623609c47332d324d36d257de306113ff29d7f875d236af5
577f794df4247659a453f2d060e55809b4752b9084dfa52d5d4da8e6894656f0

ssdeep: 48:4oGP1kWkwYSjM3TU+KDWkanolsTB1+JMdUK+/I:l2dkRSjKo+KD3sF1+JY2Q

PEiD..: -
TrID..: File type identification
Unknown!
PEInfo: -

Wie ich sehe ist datei zur zeit unbekannt.
Ist es möglich es zu löschen oder soll ich warten ??

Danke viel mals für die schnelle antwort auf erste Post.
JDHill

Lass mal lieber mit Malwarebytes scannen, anstatt mit AdAware und Spybot.

LG

Nächste Report von Virus Total.
Es besteht 3 Datei teile.

a-squared 4.0.0.73 2008.12.24 -
AhnLab-V3 2008.12.25.0 2008.12.24 -
AntiVir 7.9.0.45 2008.12.24 -
Authentium 5.1.0.4 2008.12.24 -
Avast 4.8.1281.0 2008.12.24 -
AVG 8.0.0.199 2008.12.24 -
BitDefender 7.2 2008.12.24 -
CAT-QuickHeal 10.00 2008.12.24 -
ClamAV 0.94.1 2008.12.24 -
Comodo 809 2008.12.24 -
DrWeb 4.44.0.09170 2008.12.24 -
eSafe 7.0.17.0 2008.12.23 -
eTrust-Vet 31.6.6276 2008.12.24 -
Ewido 4.0 2008.12.24 -
F-Prot 4.4.4.56 2008.12.24 -
F-Secure 8.0.14332.0 2008.12.24 -
Fortinet 3.117.0.0 2008.12.24 -
GData 19 2008.12.24 -
Ikarus T3.1.1.45.0 2008.12.24 -
K7AntiVirus 7.10.564 2008.12.24 -
Kaspersky 7.0.0.125 2008.12.24 -
McAfee 5473 2008.12.23 -
McAfee+Artemis 5473 2008.12.23 -
Microsoft 1.4205 2008.12.24 -
NOD32 3716 2008.12.24 -
Norman 5.80.02 2008.12.24 -
Panda 9.0.0.4 2008.12.24 -
PCTools 4.4.2.0 2008.12.24 -
Prevx1 V2 2008.12.24 -
Rising 21.09.22.00 2008.12.24 -
SecureWeb-Gateway 6.7.6 2008.12.24 -
Sophos 4.37.0 2008.12.24 -
Sunbelt 3.2.1809.2 2008.12.22 -
Symantec 10 2008.12.24 -
TheHacker 6.3.1.4.199 2008.12.23 -
TrendMicro 8.700.0.1004 2008.12.24 -
VBA32 3.12.8.10 2008.12.23 -
ViRobot 2008.12.24.1534 2008.12.24 -
VirusBuster 4.5.11.0 2008.12.24 -
weitere Informationen
File size: 255488 bytes
MD5...: 00f7bdba39386ebe8db4aa3737892618
SHA1..: dcd4443c0c6cebe0f01ee60141000d30070a4682
SHA256: 1f158ef9fed77d42bd5806644417067a262fd96a135dfb5f3dd6e11cca322711
SHA512: 35bdee9e1bfb7b7a552205f44b1009c38fc042b73b0e267432705fce17e9e8d8
abc6e48dc2fe0548d575c40e2daded49934795b0b177451611af1b2efd200c90

ssdeep: 6144:wuoggJUSYKvOXmVEKXn+4i5Tmz1kenRBZ+798OkRNOkMDEVp:wuQUSYv2VE
on+4uTmzieR69XfR

PEiD..: Armadillo v1.71
TrID..: File type identification
Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x430676
timedatestamp.....: 0x42bd0c1d (Sat Jun 25 07:47:41 2005)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x2f806 0x2fa00 7.45 d46c3b3030c67b5b21cb9c0450c98fc4
.rdata 0x31000 0x1080 0x1200 5.27 597e82ece2b65e6d9a4454612393fadb
.data 0x33000 0xd4ac 0xd600 5.59 6db8708e161010074c9aaea7d4ddb2c0

( 10 imports )
> KERNEL32.dll: lstrcpynA, FileTimeToLocalFileTime, CreateFileW, ClearCommBreak, ExitThread, GetSystemInfo, LocalLock, SetEnvironmentVariableW, WaitNamedPipeA, GetUserDefaultLCID, GetHandleInformation, EnumCalendarInfoW, FormatMessageW, IsBadReadPtr, CreateEventA, WriteConsoleOutputW, IsValidLocale, GetThreadContext, _lclose, lstrcmpiW, GetCPInfo, GetOverlappedResult, GetModuleHandleA, UnmapViewOfFile, GetFullPathNameA, GetPrivateProfileStringA, lstrlenA, GetStartupInfoA, GlobalFree, VirtualAlloc
> USER32.dll: GetMenuItemInfoA, ModifyMenuW, MessageBoxIndirectW, RegisterClipboardFormatW, FindWindowA, TrackMouseEvent, GetMenuItemInfoW, SetSysColors, SendInput, DispatchMessageA, GetWindowTextLengthW, SetMenuItemInfoW, LoadImageW, DestroyCursor, ShowWindow, SetCaretPos, ScrollWindowEx, ChangeDisplaySettingsExA, SetKeyboardState, InflateRect, GetAncestor, CreateWindowExA, GetSystemMenu, SetWindowWord, OpenClipboard, ValidateRgn, CharLowerBuffW, LoadMenuIndirectA, ScrollWindow, UnregisterClassA, SetUserObjectSecurity, CreateDialogParamA, SendMessageTimeoutA, CharToOemBuffA, IsWindowUnicode, TrackPopupMenuEx, GetUpdateRgn, GetUpdateRect, TranslateAcceleratorW
> COMCTL32.dll: ImageList_DragEnter
> WS2_32.dll: -, WSAIoctl, -, -, WSASetServiceA, -, -, -, WSALookupServiceNextW, WSALookupServiceEnd, -, -, -, WSAEnumProtocolsW, -
> OLEAUT32.dll: -, -, -, -, -
> SHELL32.dll: FindExecutableA, SHAddToRecentDocs, SHChangeNotify, ExtractIconA, SHGetSpecialFolderLocation, ShellExecuteA, SHBrowseForFolderA, SHGetSpecialFolderPathA
> ADVAPI32.dll: AccessCheckAndAuditAlarmW, StartServiceA, RegReplaceKeyW, RegSetValueExA, CryptSetKeyParam, GetNamedSecurityInfoW
> GDI32.dll: StretchDIBits, GetGlyphOutlineA, BeginPath, GetWinMetaFileBits, GetPixelFormat, GetTextCharset, SetTextColor, ResizePalette, OffsetRgn, PtInRegion, SelectObject
> ole32.dll: CoFreeAllLibraries, StgOpenStorage
> MSVCRT.dll: difftime, strftime, _mbsinc, _mbslwr, _wtoi64, localeconv, _ecvt, _wtol, wcscpy, _pipe, tolower, _umask, _flushall, fopen, wcstod, srand, _strdup, wctomb, _wctime, iswctype, _except_handler3, __set_app_type, __p__fmode, __p__commode, _adjust_fdiv, __setusermatherr, _initterm, __getmainargs, _acmdln, exit, _XcptFilter, _exit, putc, _mbsicmp, _fcvt, _strnicmp, _fsopen, ceil, _wspawnv, strtok, ftell, _strncoll, strtoul, strcspn, _spawnv, putchar, _wcslwr, _fstat, _controlfp, _strcmpi, _chmod

( 0 exports )

Zitat von Aggro Berlin

Lass mal lieber mit Malwarebytes scannen, anstatt mit AdAware und Spybot.

LG

Danke Sehr

Ich habe Scan durchgeführt und folgendes gefunden.
Ich wünsche dir ein Schönen Weihnachten.

Malwarebytes' Anti-Malware 1.31
Datenbank Version: 1539
Windows 6.0.6001 Service Pack 1

24.12.2008 15:51:09
mbam-log-2008-12-24 (15-50-25).txt

Scan-Methode: Quick-Scan
Durchsuchte Objekte: 54008
Laufzeit: 3 minute(s), 13 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\Windows\System32\avgrsstx.dll (Trojan.Vundo) -> No action taken.

Wie kann ich sowas entfernen bitte ??

Danke
JDHill

Klar entferne den Fund.

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

• Lade dir das Tool hier herunter auf den Desktop -> KLICK

Das Programm jedoch noch nicht starten sondern zuerst folgendes tun:

• Schliesse alle Anwendungen und Programme, vor allem deine Antiviren-Software und andere Hintergrundwächter, sowie deinen Internetbrowser.
  Vermeide es auch explizit während das Combofix läuft die Maus und Tastatur zu benutzen.

• Dann folgende Anleitung durchlesen und abarbeiten -> CCleaner Systembereinigung

• Starte nun die combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen und lass dein System durchsuchen.

• Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte abkopieren und in deinen Beitrag einfügen. Das log findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Hinweis: Combofix verhindert die Autostart Funktion aller CD / DVD und USB - Laufwerken um so eine Verbeitung einzudämmen. Wenn es hierdurch zu Problemen kommt, diese im Thread posten.

Edit: Poste danach nochmal einen HijackThis Log.

LG

Vielen Dank
Ich habe ComboFix laufen lassen und unten ist der Report.

ComboFix 08-12-23.01 - Familie Hill 2008-12-24 19:26:09.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1031.18.2045.950 [GMT 1:00]
ausgeführt von:: c:\users\Familie Hill\Downloads\ComboFix.exe
.

(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\install.exe
c:\users\Familie Hill\AppData\Local\cwisomi.dat
c:\users\Familie Hill\AppData\Local\cwisomi.exe
c:\users\Familie Hill\AppData\Local\cwisomi_nav.dat
c:\users\Familie Hill\AppData\Local\cwisomi_navps.dat
c:\users\Familie Hill\AppData\Roaming\.#

.
((((((((((((((((((((((( Dateien erstellt von 2008-11-24 bis 2008-12-24 ))))))))))))))))))))))))))))))
.

2008-12-24 15:45 . 2008-12-24 15:45 <DIR> d-------- c:\users\Familie Hill\AppData\Roaming\Malwarebytes
2008-12-24 15:45 . 2008-12-24 15:45 <DIR> d-------- c:\users\All Users\Malwarebytes
2008-12-24 15:45 . 2008-12-24 15:45 <DIR> d-------- c:\programdata\Malwarebytes
2008-12-24 15:45 . 2008-12-24 15:45 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-12-24 15:45 . 2008-12-03 19:52 38,496 --a------ c:\windows\System32\drivers\mbamswissarmy.sys
2008-12-24 15:45 . 2008-12-03 19:52 15,504 --a------ c:\windows\System32\drivers\mbam.sys
2008-12-24 07:34 . 2008-12-24 07:34 <DIR> d-------- c:\program files\Trend Micro
2008-12-23 08:11 . 2008-12-23 08:11 <DIR> d-------- c:\program files\Tools&More
2008-12-20 08:49 . 2008-12-20 08:50 <DIR> d-------- c:\users\All Users\Lavasoft
2008-12-20 08:49 . 2008-12-20 08:50 <DIR> d-------- c:\programdata\Lavasoft
2008-12-20 08:49 . 2008-12-20 08:49 <DIR> d-------- c:\program files\Lavasoft
2008-12-20 08:48 . 2008-12-20 08:48 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard
2008-12-20 08:27 . 2008-12-20 09:50 <DIR> d-------- c:\users\All Users\Spybot - Search & Destroy
2008-12-20 08:27 . 2008-12-20 09:50 <DIR> d-------- c:\programdata\Spybot - Search & Destroy
2008-12-20 08:27 . 2008-12-20 08:29 <DIR> d-------- c:\program files\Spybot - Search & Destroy
2008-12-18 15:08 . 2008-12-18 16:16 5,401,120 --ahs---- c:\windows\System32\drivers\fidbox.dat
2008-12-18 15:08 . 2008-12-18 16:16 73,412 --ahs---- c:\windows\System32\drivers\fidbox.idx
2008-12-18 15:07 . 2008-12-18 16:15 <DIR> d-------- c:\users\All Users\ParetoLogic
2008-12-18 15:07 . 2008-12-18 16:15 <DIR> d-------- c:\programdata\ParetoLogic
2008-12-18 15:07 . 2008-12-18 16:15 <DIR> d-------- c:\program files\Common Files\ParetoLogic
2008-12-18 12:40 . 2008-12-21 12:58 <DIR> d--h----- C:\$AVG8.VAULT$
2008-12-18 12:13 . 2008-12-18 12:13 90,632 --a------ c:\windows\System32\drivers\avgtdix.sys
2008-12-18 12:13 . 2008-12-18 12:13 23,832 --a------ c:\windows\System32\drivers\avgfwd6x.sys
2008-12-18 12:00 . 2008-12-24 15:43 <DIR> d-------- c:\windows\System32\drivers\Avg
2008-12-18 12:00 . 2008-12-18 12:00 <DIR> d-------- c:\users\All Users\avg8
2008-12-18 12:00 . 2008-12-18 12:00 <DIR> d-------- c:\programdata\avg8
2008-12-18 12:00 . 2008-12-18 12:00 <DIR> d-------- c:\program files\Steganos
2008-12-18 12:00 . 2008-12-18 12:13 98,440 --a------ c:\windows\System32\drivers\avgldx86.sys
2008-12-18 12:00 . 2008-12-18 12:00 12,936 --a------ c:\windows\System32\drivers\avgrkx86.sys
2008-12-18 12:00 . 2008-12-18 12:00 10,520 --a------ c:\windows\System32\avgrsstx.dll
2008-12-14 08:15 . 2008-12-14 08:15 <DIR> d-------- c:\program files\SuperWebcam
2008-12-14 08:13 . 2006-06-27 08:56 31,872 --a------ c:\windows\System32\drivers\superwebcam.sys
2008-12-14 08:02 . 2004-04-16 07:20 90,700 --a------ c:\windows\System32\drivers\P0620Vid.sys
2008-12-14 08:02 . 2004-04-16 02:00 77,824 --a------ c:\windows\System32\P0620Ext.ax
2008-12-14 08:02 . 2004-01-18 11:03 69,632 --a------ c:\windows\System32\p0620sti.dll
2008-12-14 08:02 . 2003-10-03 02:05 65,536 --a------ c:\windows\System32\CtCamMgr.dll
2008-12-14 08:02 . 2004-04-06 02:00 40,960 --a------ c:\windows\System32\P0620Hwx.dll
2008-12-14 08:02 . 2004-03-23 02:00 32,768 --a------ c:\windows\System32\P0620Pin.dll
2008-12-14 08:02 . 2004-03-23 04:36 32,768 --a------ c:\windows\System32\P0620Ext.crl
2008-12-14 08:02 . 2004-03-23 04:36 24,576 --a------ c:\windows\System32\P0620Pin.crl
2008-12-14 08:02 . 2004-03-08 02:00 20,480 --a------ c:\windows\System32\P0620Srv.exe
2008-12-14 08:02 . 2004-03-03 02:00 20,480 --a------ c:\windows\P0620Cfg.exe
2008-12-14 08:02 . 2004-04-22 05:49 4,749 --a------ c:\windows\PD0620.uns
2008-12-14 08:01 . 2008-12-14 08:02 <DIR> d-------- c:\program files\Creative
2008-12-12 20:24 . 2008-10-22 02:22 2,048 --a------ c:\windows\System32\tzres.dll
2008-12-05 18:46 . 2008-12-05 18:47 <DIR> d-------- c:\users\Familie Hill\AppData\Roaming\SopCast
2008-12-05 18:38 . 2008-12-05 18:38 <DIR> d-------- c:\users\Familie Hill\AppData\Roaming\PPMate
2008-12-05 18:38 . 2008-12-05 18:38 <DIR> d-------- c:\program files\Common Files\Synacast
2008-12-04 19:54 . 2008-12-04 19:54 <DIR> d-------- c:\users\IUSR_NMPR\Roaming
2008-12-04 19:54 . 2008-12-04 19:54 <DIR> d-------- c:\users\Familie Hill\Roaming
2008-12-04 19:54 . 2008-12-04 19:54 <DIR> d-------- c:\users\Familie Hill\AppData\Roaming\MySpace
2008-12-04 19:54 . 2008-12-04 19:54 <DIR> d-------- c:\users\Default\Roaming
2008-12-04 19:54 . 2008-12-04 19:54 <DIR> d-------- c:\program files\MySpace
2008-12-03 08:22 . 2008-12-03 08:22 <DIR> d-------- c:\users\Familie Hill\AppData\Roaming\ScanSoft
2008-12-02 16:35 . 2008-12-02 16:35 50 --a------ c:\windows\System32\bridf07a.dat
2008-12-02 16:32 . 2007-02-01 13:19 1,520,640 --a------ c:\windows\System32\BrWia07a.dll
2008-12-02 16:32 . 2007-01-26 14:06 45,568 --a------ c:\windows\System32\BrUsi07a.dll
2008-12-02 16:31 . 2006-12-28 13:39 176,128 --------- c:\windows\System32\BroSNMP.dll
2008-12-02 16:31 . 2007-01-18 13:51 163,840 --------- c:\windows\System32\NSSearch.dll
2008-12-02 16:31 . 2006-01-17 01:03 126,976 --------- c:\windows\System32\BrfxD05a.dll
2008-12-02 16:31 . 2007-01-25 17:16 94,208 -r------- c:\windows\System32\BrDctF2.dll
2008-12-02 16:31 . 2007-01-15 16:08 16,384 -r------- c:\windows\System32\BrDctF2L.dll
2008-12-02 16:31 . 2007-01-15 21:54 12,288 -r------- c:\windows\System32\BrDctF2S.dll
2008-12-02 16:31 . 2001-11-15 01:00 6,224 --------- c:\windows\CVRPAGE.bmp
2008-12-02 16:31 . 2008-12-04 10:07 0 --a------ c:\windows\brdfxspd.dat
2008-12-02 16:30 . 2008-12-02 16:30 <DIR> d-------- c:\program files\Nuance
2008-12-02 16:29 . 2006-10-24 15:35 31,664 --a------ c:\windows\maxlink.ini
2008-12-02 16:28 . 2008-12-03 08:25 <DIR> d-------- c:\users\All Users\ScanSoft
2008-12-02 16:28 . 2008-12-03 08:25 <DIR> d-------- c:\programdata\ScanSoft
2008-12-02 16:28 . 2008-12-02 16:28 <DIR> d-------- c:\program files\ScanSoft
2008-12-02 16:28 . 2008-12-02 16:28 <DIR> d-------- c:\program files\Common Files\ScanSoft Shared
2008-12-02 04:36 . 2008-12-02 04:35 410,976 --a------ c:\windows\System32\deploytk.dll
2008-11-28 17:41 . 2004-04-21 02:00 126,976 --a------ c:\windows\System32\P0620Vfw.dll
2008-11-27 13:52 . 2008-11-27 13:52 <DIR> d-------- c:\users\Familie Hill\AppData\Roaming\HiYo
2008-11-26 07:12 . 2008-10-21 06:25 1,645,568 --a------ c:\windows\System32\connect.dll
2008-11-26 07:12 . 2008-08-28 04:40 712,704 --a------ c:\windows\System32\WindowsCodecs.dll
2008-11-26 07:12 . 2008-08-28 04:40 425,472 --a------ c:\windows\System32\PhotoMetadataHandler.dll
2008-11-26 07:12 . 2008-08-28 04:40 347,136 --a------ c:\windows\System32\WindowsCodecsExt.dll
2008-11-26 07:12 . 2008-10-22 04:57 241,152 --a------ c:\windows\System32\PortableDeviceApi.dll
2008-11-25 19:12 . 2008-11-27 12:05 <DIR> d-------- c:\users\Familie Hill\AppData\Roaming\noteMaNIA
2008-11-25 19:12 . 2008-11-28 09:16 <DIR> d-------- c:\program files\Note Mania
2008-11-25 12:18 . 2008-11-25 12:18 <DIR> d-------- c:\users\Familie Hill\AppData\Roaming\Reallusion
2008-11-24 10:54 . 2008-12-14 07:59 54,156 --ah----- c:\windows\QTFont.qfn
2008-11-24 10:54 . 2008-12-14 07:59 1,409 --a------ c:\windows\QTFont.for

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-24 13:24 --------- d-----w c:\programdata\Google Updater
2008-12-21 17:08 --------- d-----w c:\users\Familie Hill\AppData\Roaming\Skype
2008-12-21 17:06 --------- d-----w c:\users\Familie Hill\AppData\Roaming\skypePM
2008-12-18 10:54 --------- d-----w c:\programdata\Steganos
2008-12-18 10:51 --------- d-----w c:\program files\Steganos Internet Security 2007
2008-12-14 07:15 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-12 19:49 --------- d-----w c:\program files\Windows Mail
2008-12-11 14:29 --------- d-----w c:\programdata\Roxio
2008-12-05 06:49 --------- d-----w c:\programdata\Xfire
2008-12-04 09:59 --------- d-----w c:\users\Familie Hill\AppData\Roaming\Xfire
2008-12-04 09:53 --------- d-----w c:\program files\Xfire
2008-12-03 07:41 --------- d-----w c:\users\Familie Hill\AppData\Roaming\Corel
2008-12-02 15:33 --------- d-----w c:\program files\Brother
2008-12-02 15:30 --------- d-----w c:\users\Familie Hill\AppData\Roaming\InstallShield
2008-12-02 03:35 --------- d-----w c:\program files\Java
2008-11-28 08:17 --------- d-----w c:\program files\Windows Live
2008-11-27 14:45 --------- d-----w c:\users\Familie Hill\AppData\Roaming\Any Video Converter
2008-11-23 05:29 --------- d-----w c:\users\Familie Hill\AppData\Roaming\Roxio
2008-11-22 16:30 --------- d-----w c:\program files\Wisdom-soft AutoScreenRecorder 3 Free
2008-11-22 13:02 --------- d---a-w c:\programdata\TEMP
2008-11-22 09:49 --------- d-----w c:\program files\EA GAMES
2008-11-22 09:19 --------- d-----w c:\program files\America's Army
2008-11-22 09:16 --------- d-----w c:\programdata\media center programs
2008-11-21 15:13 --------- d-----w c:\program files\WeGame
2008-11-21 14:54 --------- d-----w c:\program files\Growler Guncam
2008-11-21 14:46 --------- d-----w c:\program files\Common Files\GC Install
2008-11-21 08:27 --------- d-----w c:\program files\Any Video Converter
2008-11-21 08:24 --------- d-----w c:\program files\DVDVideoSoft
2008-11-21 08:24 --------- d-----w c:\program files\Common Files\DVDVideoSoft
2008-11-20 20:44 42,320 ----a-w c:\windows\System32\xfcodec.dll
2008-11-14 07:00 --------- d-----w c:\users\Familie Hill\AppData\Roaming\Steganos AntiSpam 2007
2008-11-09 14:43 --------- d-----w c:\users\Familie Hill\AppData\Roaming\Photozig Albums
2008-11-09 14:30 --------- d-----w c:\users\Familie Hill\AppData\Roaming\Picajet.com
2008-11-01 03:44 541,696 ----a-w c:\windows\AppPatch\AcLayers.dll
2008-11-01 03:44 52,736 ----a-w c:\windows\AppPatch\iebrshim.dll
2008-11-01 03:44 460,288 ----a-w c:\windows\AppPatch\AcSpecfc.dll
2008-11-01 03:44 28,672 ----a-w c:\windows\System32\Apphlpdm.dll
2008-11-01 03:44 2,154,496 ----a-w c:\windows\AppPatch\AcGenral.dll
2008-11-01 03:44 173,056 ----a-w c:\windows\AppPatch\AcXtrnal.dll
2008-11-01 01:21 4,240,384 ----a-w c:\windows\System32\GameUXLegacyGDFs.dll
2008-10-30 17:25 --------- d-----w c:\program files\Sopcast_plugin
2008-10-29 06:29 2,927,104 ----a-w c:\windows\explorer.exe
2008-10-28 06:09 --------- d-----w c:\program files\WarRock
2008-10-21 05:25 296,960 ----a-w c:\windows\System32\gdi32.dll
2008-10-16 21:13 1,809,944 ----a-w c:\windows\System32\wuaueng.dll
2008-10-16 21:12 561,688 ----a-w c:\windows\System32\wuapi.dll
2008-10-16 21:09 51,224 ----a-w c:\windows\System32\wuauclt.exe
2008-10-16 21:09 43,544 ----a-w c:\windows\System32\wups2.dll
2008-10-16 21:08 34,328 ----a-w c:\windows\System32\wups.dll
2008-10-16 20:56 1,524,736 ----a-w c:\windows\System32\wucltux.dll
2008-10-16 20:55 83,456 ----a-w c:\windows\System32\wudriver.dll
2008-10-16 13:08 162,064 ----a-w c:\windows\System32\wuwebv.dll
2008-10-16 12:56 31,232 ----a-w c:\windows\System32\wuapp.exe
2008-10-16 04:47 827,392 ----a-w c:\windows\System32\wininet.dll
2008-10-02 23:46 81,920 ----a-w c:\windows\System32\frapsvid.dll
2008-09-30 15:43 1,286,152 ----a-w c:\windows\System32\msxml4.dll
2008-06-12 09:54 174 --sha-w c:\program files\desktop.ini
2008-03-13 07:08 32 ----a-w c:\users\All Users\ezsid.dat
2008-03-13 07:08 32 ----a-w c:\programdata\ezsid.dat
.

(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Picasa Media Detector"="REM" [X]
"WMPNSCFG"="REM" [X]
"cwisomi"="REM" [X]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-09-11 218032]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NMSSupport"="c:\program files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe" [2007-04-06 439768]
"CCUTRAYICON"="c:\program files\Intel\IntelDH\CCU\CCU_TrayIcon.exe" [2007-04-06 215512]
"GnabTray"="c:\program files\Common Files\Gnab\Service\GnabTray.exe" [2007-04-13 327680]
"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2007-03-12 225280]
"QuickFinder Scheduler"="c:\program files\WordPerfect Office X3\Programs\QFSCHD130.EXE" [2007-01-02 83568]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-02 136600]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2007-06-29 286720]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-03-21 174872]
"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Elements 5.0\apdproxy.exe" [2006-09-14 61440]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-16 13535776]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-16 92704]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2007-01-29 30248]
"IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2007-01-29 46632]
"PPort11reminder"="c:\program files\ScanSoft\PaperPort\Ereg\Ereg.exe" [2007-02-01 255528]
"BrMfcWnd"="c:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2007-03-12 663552]
"ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2007-01-26 65536]
"AVG8_TRAY"="c:\progra~1\Steganos\INTERN~1\avgtray.exe" [2008-12-18 1235736]
"RtHDVCpl"="RtHDVCpl.exe" [2007-05-10 c:\windows\RtHDVCpl.exe]
"Skytel"="Skytel.exe" [2007-05-07 c:\windows\SkyTel.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2008-04-18 9117696]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
PDFCreator.lnk - c:\program files\PDFCreator\PDFCreator.exe [2008-02-24 2641920]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_Dlls"=avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.XFR1"= xfcodec.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{6340B7CF-58A3-4FB8-AE15-2A04E9B4A5A5}"= UDP:Profile=Private|Profile=Public:LocalSubnet:LocalSubnet|c:\program files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.exe:SPCM
"{A8673EE6-8383-4E19-A30B-135CB429E84B}"= TCP:Profile=Private|Profile=Public:LocalSubnet:LocalSubnet|c:\program files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.exe:SPCM
"{8121BB96-2B00-4DAA-A676-4548B3847C13}"= UDP:Profile=Private|Profile=Public:LocalSubnet:LocalSubnet|c:\program files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe:Intel(R) Remoting Service
"{5555A60F-B789-4ACA-8275-534896469A54}"= TCP:Profile=Private|Profile=Public:LocalSubnet:LocalSubnet|c:\program files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe:Intel(R) Remoting Service
"{B9794F33-E13B-4009-87A7-FF83230B6915}"= UDP:Profile=Private|Profile=Public:LocalSubnet:LocalSubnet|c:\program files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe:Intel(R) Viiv(TM) Media Server
"{6892DB50-466E-4D60-9E65-F1A419AB1953}"= TCP:Profile=Private|Profile=Public:LocalSubnet:LocalSubnet|c:\program files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe:Intel(R) Viiv(TM) Media Server
"{5D957C54-E9DF-4C50-AF5F-93CEBE1B3B41}"= TCP:Profile=Private|Profile=Public|9442:127.0.0.1:Intel(R) Viiv(TM) Media Server Discovery
"{CBF7C76D-1AB7-409A-9D27-860AB3F888BB}"= TCP:Profile=Private|Profile=Public|1900:LocalSubnet:LocalSubnet:Intel(R) Viiv(TM) Media Server UPnP Discovery
"TCP Query User{2DB2059F-9CEF-4EC5-A025-D6C3B26F8B17}c:\\program files\\skype\\phone\\skype.exe"= UDP:c:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"UDP Query User{E352F219-267E-434F-9CF6-D3F7D8BEDD4A}c:\\program files\\skype\\phone\\skype.exe"= TCP:c:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"{DFB4D1AA-3452-4D8A-A55E-A11ED88422E6}"= Disabled:UDP:c:\program files\Adobe\Photoshop Elements 5.0\AdobePhotoshopElementsMediaServer.exe:Adobe Photoshop Elements Media Server
"{CBD6FCF8-7242-4140-BAC3-94DEA0F0601F}"= Disabled:TCP:c:\program files\Adobe\Photoshop Elements 5.0\AdobePhotoshopElementsMediaServer.exe:Adobe Photoshop Elements Media Server
"{CB73BC53-BFC8-4A9B-A28E-A0E182AF4977}"= Disabled:UDP:c:\program files\Magentic\bin\MgImp.exe:Magentic
"{72DA0491-D4CA-46BE-8D06-397D6C483F8C}"= Disabled:TCP:c:\program files\Magentic\bin\MgImp.exe:Magentic
"{1D0C9287-621F-4B1A-A960-C9209D62B5CC}"= Disabled:UDP:c:\program files\Magentic\bin\Magentic.exe:Magentic
"{EB6D81EA-02C8-4D09-921E-FF18B8627282}"= Disabled:TCP:c:\program files\Magentic\bin\Magentic.exe:Magentic
"{6EF7B45A-7C1F-4E9D-81E1-33FBE3CE41CB}"= Disabled:UDP:c:\program files\Magentic\bin\MgApp.exe:Magentic
"{E25AE988-5E27-4FBB-89CA-560B590E73D5}"= Disabled:TCP:c:\program files\Magentic\bin\MgApp.exe:Magentic
"{F0147D86-E8A2-4E8C-8E67-B349785EAE52}"= Disabled:UDP:F:\fsetup.exe:AVM FSetup Application
"{0093BAB8-C94B-4411-BCB6-A771BBEA0DEC}"= Disabled:TCP:F:\fsetup.exe:AVM FSetup Application
"{B71E7732-0A21-474A-8350-9896AEEE712C}"= Disabled:UDP:c:\program files\IncrediMail\bin\ImApp.exe:IncrediMail
"{E47BBCBB-CFC6-4267-8D11-D5039C8413BA}"= Disabled:TCP:c:\program files\IncrediMail\bin\ImApp.exe:IncrediMail
"{686F260D-99AE-4BA4-B53D-24EE643705B6}"= Disabled:UDP:c:\program files\IncrediMail\bin\IncMail.exe:IncrediMail
"{6107873E-6C38-44FE-8F1E-1608E37CDF21}"= Disabled:TCP:c:\program files\IncrediMail\bin\IncMail.exe:IncrediMail
"{A64354EB-CE02-48BE-B2AA-6D912F41DA8A}"= Disabled:UDP:c:\program files\IncrediMail\bin\ImpCnt.exe:IncrediMail
"{FA4D7CE3-D9A4-46BB-9F41-2A736BDD9984}"= Disabled:TCP:c:\program files\IncrediMail\bin\ImpCnt.exe:IncrediMail
"{C7AFEFF2-2B67-4172-B2A0-4E9813C038A4}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{0BD0D9D8-9B49-487C-A7F0-6C8F4DBD9195}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{8FFC1AEC-8D8D-4040-9EC1-B71BFDE20414}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{81F68B6B-8F8A-4DAE-A64A-0ECC1929ECA9}"= UDP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{25021CDF-598D-4089-9A66-9DAB023FE052}"= TCP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{E46139AA-37BF-4D9B-A8DD-D0BD562B8892}"= c:\program files\MySpace\IM\MySpaceIM.exe:MySpaceIM
"{43EB2B21-8E16-4320-BC4F-77AF895829B8}"= c:\program files\Steganos\Internet Security 2009\avgupd.exe:avgupd.exe
"{06832BA7-7F19-4B61-A543-31F7FD8F8346}"= c:\program files\Steganos\Internet Security 2009\avgnsx.exe:avgnsx.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\PPMate\\ppmate.exe"= c:\program files\PPMate\ppmate.exe:*:Enabled:PPMate
"c:\\Program Files\\PPMate\\ppamnet.exe"= c:\program files\PPMate\ppamnet.exe:*:Enabled:PPMate

R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\Drivers\avgrkx86.sys [2008-12-18 12936]
R1 Avgfwfd;AVG network filter service;c:\windows\system32\DRIVERS\avgfwd6x.sys [2008-12-18 23832]
R1 AvgLdx86;Steganos I.S. AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-12-18 98440]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\Drivers\avgtdix.sys [2008-12-18 90632]
R2 avg8wd;Steganos I.S. WatchDog;c:\progra~1\Steganos\INTERN~1\avgwdsvc.exe [2008-12-18 231704]
R2 avgfws8;Steganos I.S. Firewall;c:\progra~1\Steganos\INTERN~1\avgfws8.exe [2008-12-18 1212184]
R2 GnabService;GnabService;c:\program files\common files\gnab\service\servicecontroller.exe [2007-06-18 36864]
R2 nmsunidr;UniDriver for NMS;c:\windows\system32\DRIVERS\nmsunidr.sys [2007-02-18 5376]
R3 IntelDH;IntelDH Driver;c:\windows\system32\Drivers\IntelDH.sys [2007-06-18 5504]
R3 SUPERWEBCAM;SuperWebcam, WDM Virtual Video Capture Device;c:\windows\system32\DRIVERS\superwebcam.sys [2008-12-14 31872]
S3 athrusb;Atheros Wireless LAN USB device driver;c:\windows\system32\DRIVERS\athrusb.sys [2007-07-20 449536]
S3 DHTRACE;Intel(R) DHTrace Controller;c:\program files\Common Files\Intel\IntelDH\bin\DHTraceController.exe [2007-04-06 39896]
S3 DQLWinService;DQLWinService;"c:\program files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe" [2007-02-12 208896]
S3 NMSCore;Intel(R) NMSCore;"c:\program files\Common Files\Intel\IntelDH\NMS\NMSCore\NMSCore.exe" [2007-04-06 313816]
S3 QualityManager;Intel(R) Quality Manager;"c:\program files\Intel\IntelDH\Intel Media Server\Media Server\bin\qualitymanager.exe" [2007-04-06 272856]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d167d6ab-b10b-11dc-93de-806e6f6e6963}]
\shell\AutoRun\command - e:\ctrun\start.exe

*Newly Created Service* - PROCEXP90
.
Inhalt des "geplante Tasks" Ordners

2008-12-10 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2006-10-10 16:13]

2008-12-24 c:\windows\Tasks\ParetoLogic Registration.job
- c:\windows\system32\rundll32.exe [2006-11-02 10:45]

2008-12-24 c:\windows\Tasks\User_Feed_Synchronization-{754DF9A4-02F3-47EC-9038-622DA8C4A8AE}.job
- c:\windows\system32\msfeedssync.exe [2008-01-19 08:33]
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2008-12-24 19:28:58
Windows 6.0.6001 Service Pack 1 NTFS

Scanne versteckte Prozesse...

[0] 0x00080482

Scanne versteckte Autostarteinträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

- - - - - - - > 'winlogon.exe'(836)
c:\windows\system32\avgrsstx.dll

- - - - - - - > 'lsass.exe'(712)
c:\windows\system32\avgrsstx.dll
.
Zeit der Fertigstellung: 2008-12-24 19:32:55
ComboFix-quarantined-files.txt 2008-12-24 18:32:53

Vor Suchlauf: 20 Verzeichnis(se), 415,061,569,536 Bytes frei
Nach Suchlauf: 20 Verzeichnis(se), 415,036,370,944 Bytes frei

299 --- E O F --- 2008-12-23 06:42:00

Hier ist auch mein HJT Log nach Scan.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:53:46, on 24.12.2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe
C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Intel\IntelDH\CCU\CCU_Engine.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Adobe\Photoshop Elements 5.0\apdproxy.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
C:\Program Files\Steganos\Internet Security 2009\avgtray.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\PDFCreator\PDFCreator.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Brother\Brmfcmon\BrMfcmon.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NMSSupport] "C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe" /startup
O4 - HKLM\..\Run: [CCUTRAYICON] C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [GnabTray] C:\Program Files\Common Files\Gnab\Service\GnabTray.exe -checkstart
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [QuickFinder Scheduler] "C:\Program Files\WordPerfect Office X3\Programs\QFSCHD130.EXE"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Elements 5.0\apdproxy.exe"
O4 - HKLM\..\Run: [Skytel] Skytel.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] "C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe"
O4 - HKLM\..\Run: [IndexSearch] "C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe"
O4 - HKLM\..\Run: [PPort11reminder] "C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe" -r "C:\ProgramData\ScanSoft\PaperPort\11\Config\Ereg\Ereg.ini
O4 - HKLM\..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\Steganos\INTERN~1\avgtray.exe
O4 - HKCU\..\Run: [Picasa Media Detector] REM C:\Program Files\Picasa2\PicasaMediaDetector
O4 - HKCU\..\Run: [WMPNSCFG] REM C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [cwisomi] REM "c:\users\familie hill\appdata\local\cwisomi.exe" cwisomi
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O4 - Global Startup: PDFCreator.lnk = C:\Program Files\PDFCreator\PDFCreator.exe
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Öffnen mit WordPerfect - C:\Program Files\WordPerfect Office X3\Programs\WPLauncher.hta
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O13 - Gopher Prefix:
O16 - DPF: Justin.tv Publisher -
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe Active File Monitor V5 (AdobeActiveFileMonitor5.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
O23 - Service: Intel(R) Alert Service (AlertService) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\CCU\AlertService.exe
O23 - Service: Steganos I.S. WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\Steganos\INTERN~1\avgwdsvc.exe
O23 - Service: Steganos I.S. Firewall (avgfws8) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\Steganos\INTERN~1\avgfws8.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\Windows\system32\brsvc01a.exe
O23 - Service: Intel(R) DHTrace Controller (DHTRACE) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\IntelDH\bin\DHTraceController.exe
O23 - Service: DQLWinService - Unknown owner - C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GnabService - Empolis GmbH - c:\program files\common files\gnab\service\servicecontroller.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktopManager.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Intel(R) Software Services Manager (ISSM) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe
O23 - Service: Intel(R) Viiv(TM) Media Server (M1 Server) - Unknown owner - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe
O23 - Service: Intel(R) Application Tracker (MCLServiceATL) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe
O23 - Service: Intel(R) NMSCore (NMSCore) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\IntelDH\NMS\NMSCore\NMSCore.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\Windows\system32\PSIService.exe
O23 - Service: Intel(R) Quality Manager (QualityManager) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\qualitymanager.exe
O23 - Service: Intel(R) Remoting Service (Remote UI Service) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

--
End of file - 11165 bytes

Frohe Weihnachten
JDHill

Hallo.


Deaktiviere den UAC-User Account Control -(dran denken ihn danach wieder zu aktivieren).

• Start> Systemsteuerung
• Doppelklick auf Benutzerkonten
• Klicke auf Deaktivieren und bestätige.
• Lade dir nun Navilog herunter indem du den Link per Rechtsklick anwähghlst und Speichern unter anwählst. Speicher die Datei auf deinem Desktop
• Rufe navilog1.exe per Rechtsklick auf und wähle "Ausführen als Administrator" aus um das Programm zu installieren.

OPTION 1: #Analyse#

Versichere dich, dass der User Account Control deaktiviert ist.

Rufe die Verknüpfung zu Navilog per Rechtsklick auf und wähle "Ausführen als Admininstrator" aus

• Wähle E für Englisch im Sprachenmenü
• Wähle 1 im nächsten Menü um "Suche" auszuwählen. Bestätige mit Enter.
• Die Dauer des Scans kann variieren, bitte abwarten. Wenn du aufgefordert wirst, eine Taste zu drücken, tue dies bitte.
• Ein neues Dokument sollte erstellt und geöffnet werden: fixnavi.txt.
• Bitte füge den Inhalt dieser Datei in deine nächste Antwort ein.

Der Bericht wird außerdem im Hauptverzeichnis (z.B.: "C:\") erstellt.

Hinweis:
Navilog1.exe wir von einigen Antivirenprogrammen als bösartig erkannt. Dies ist ein Fehlalarm. Die Nachricht bitte ignorieren.

Anbei Log von fixnavi.

Ich bedanke mich in voraus für die hervorragende hilfeleistung.
Sowas kommt selten vor. Weiter so.

XXXXXXXXXXXXXXXXXXXXX fixnavi log XXXXXXXXXXXXXXXXXXXXXXXXX

Search Navipromo version 3.7.0 began on 24.12.2008 at 20:23:00,81

!!! Warning, this report may include legitimate files/programs !!!
!!! Post this report on the forum you are being helped !!!
!!! Don't continue with removal unless instructed by an authorized helper !!!

Fix running from C:\Program Files\navilog1

Updated on 10.12.2008 at 21h00 by IL-MAFIOSO

Microsoft® Windows Vista™ Home Premium ( v6.0.6001 ) Service Pack 1
X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 Quad CPU @ 2.40GHz )
BIOS : Phoenix - AwardBIOS v6.00PG
USER : Familie Hill ( Administrator )
BOOT : Normal boot

Antivirus : Steganos Internet Security 8.0 (Activated)
Firewall : Steganos Firewall 8.0 (Activated)

C:\ (Local Disk) - NTFS - Total:445 Go (Free:386 Go)
D:\ (Local Disk) - FAT32 - Total:20 Go (Free:13 Go)
E:\ (CD or DVD) - CDFS - Total:0 Go (Free:0 Go)
F:\ (CD or DVD)
G:\ (USB)
H:\ (USB)
I:\ (USB)
J:\ (USB)


Search done in normal mode

*** Searching for installed Software ***


*** Search folders in "C:\Windows" ***


*** Search folders in "C:\Program Files" ***


*** Search folders in "c:\progra~2\micros~1\windows\startm~1\programs" ***


*** Search folders in "c:\progra~2\micros~1\windows\startm~1" ***


*** Search folders in "C:\ProgramData" ***


*** Search folders in "c:\users\famili~1\appdata\roaming\micros~1\windows\startm~1\programs" ***


*** Search folders in "C:\Users\Familie Hill\AppData\Local\virtualstore\Program Files" ***


*** Search folders in "C:\Users\Familie Hill\AppData\Roaming" ***


*** Search folders in "C:\Users\ADMINI~1\appdata\roaming" ***


*** Search folders in "C:\Users\IUSR_N~1\appdata\roaming" ***


*** Search with Catchme-rootkit/stealth malware detector by gmer ***
for more info : hxxp://www.gmer.net



*** Search with GenericNaviSearch ***
!!! Possibility of legitimate files in the result !!!
!!! Must always be checked before manually deleting !!!

* Scan in "C:\Windows\system32" *

* Scan in "C:\Users\Familie Hill\AppData\Local\Microsoft" *

* Scan in "C:\Users\Familie Hill\AppData\Local" *

* Scan in "C:\Users\IUSR_N~1\AppData\Local" *



*** Search files ***



*** Search specific Registry keys ***
!! Following keys are not certainly all infected !!


*** Complementary Search ***
(Search specific files)

1)Search new Instant Access files :


2)Heuristic Search :

* In "C:\Windows\system32" :


* In "C:\Users\Familie Hill\AppData\Local\Microsoft" :


* In "C:\Users\Familie Hill\AppData\Local" :


* In "C:\Users\IUSR_N~1\AppData\Local" :


3)Certificates Search :

Egroup certificate not found !
Electronic-Group certificate found !
Montorgueil certificate not found !
OOO-Favorit certificate found !
Sunny-Day-Design-Ltd certificate not found !

4)Search others known folders and files :



*** Search completed on 24.12.2008 at 20:34:24,43 ***

Danke
JDHill

Das sieht gut aus. Combofix scheint alles erwischt zu haben.

Ich würde noch mit SUPERAntiSpyware scannen um "sicher" zu gehen...

Guten Morgen

Ich habe Scan gemacht mit SuperAntiSpy.
Anbei Logfile.

SUPERAntiSpyware Scann-Protokoll
http://www.superantispyware.com

Generiert 12/25/2008 bei 06:50 AM

Version der Applikation : 4.23.1006

Version der Kern-Datenbank : 3685
Version der Spur-Datenbank : 1662

Scan Art : kompletter Scann
Totale Scann-Zeit : 01:15:48

Gescannte Speicherelemente : 645
Erfasste Speicher-Bedrohungen : 0
Gescannte Register-Elemente : 7774
Erfasste Register-Bedrohungen : 0
Gescannte Datei-Elemente : 179307
Erfasste Datei-Elemente : 0

Vielen Dank
JDHill