Trojaner-Board - pc lahmt; woran liegt's?

hallo.

auf meinem laptop läuft vshield (mcaffee) und eine virusscankonsole (?). der scan sagt, dass nix gefunden wurde. wenn ich die ordner durchforste und rumgugel, bin ich mir aber nicht sicher, ob ich mir nicht doch etwas eingefangen habe, denn das lappi läuft langsamer, aber frisiert ist es nicht und auch nicht zu heiss.
(das soll zb verdächtig sein: O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} )

vielleicht kann jemand etwas aus diesen kryptischen file-logs herauslesen?
ich stoße einfach rasch an grenzen: zu manchen exe.dats gibt's widersprüchliches, zu anderen gar nichts and so on.

daher hoffe ich auf rat, trost, beistand und ein schnelleres laptop.
na, wenigstens eins von dem wäre schon mal super. :)

dank, gruß und los geht's:

Code:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 15:48:06, on 25.10.2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal
 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Programme\Gemeinsame Dateien\AccSys\AccVSSvc.exe

C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Programme\Network Associates\VirusScan\Avsynmgr.exe

C:\Programme\Bonjour\mDNSResponder.exe

C:\Programme\Executive Software\DiskeeperWorkstation\DKService.exe

C:\Programme\Mouse Driver\KMWDSrv.exe

C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\Programme\Network Associates\VirusScan\VsStat.exe

C:\Programme\Network Associates\VirusScan\Vshwin32.exe

C:\Programme\PestPatrol\PPControl.exe

C:\Programme\PestPatrol\PPMemCheck.exe

C:\Programme\PestPatrol\CookiePatrol.exe

C:\Programme\Sony\HotKey Utility\HKserv.exe

C:\Programme\Network Associates\VirusScan\Avconsol.exe

C:\Programme\Sony\VAIO Update 3\VAIOUpdt.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Programme\SpeedswitchXP\SpeedswitchXP.exe

C:\Programme\Network Associates\VirusScan\Webscanx.exe

C:\Programme\Gemeinsame Dateien\Network Associates\McShield\Mcshield.exe

C:\Programme\Sony\HotKey Utility\HKWnd.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Programme\Mozilla Firefox\firefox.exe

C:\Programme\Messenger\msmsgs.exe

C:\Programme\DSL Connection Manager\DSLCoMan.exe

C:\Programme\Trend Micro\HijackThis\HijackThis.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\WINDOWS\system32\notepad.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\system32\msiexec.exe
 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = htwo2onlinede/goto/isphome

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = eumex.ip;*.local

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O4 - HKLM\..\Run: [PestPatrol Control Center] C:\Programme\PestPatrol\PPControl.exe

O4 - HKLM\..\Run: [PPMemCheck] C:\Programme\PestPatrol\PPMemCheck.exe

O4 - HKLM\..\Run: [CookiePatrol] C:\Programme\PestPatrol\CookiePatrol.exe

O4 - HKLM\..\Run: [HKSERV.EXE] C:\Programme\Sony\HotKey Utility\HKserv.exe

O4 - HKLM\..\Run: [Hcontrol] C:\WINDOWS\Hcontrol.exe

O4 - HKLM\..\Run: [VAIO Update 3] "C:\Programme\Sony\VAIO Update 3\VAIOUpdt.exe"  /Stationary

O4 - HKLM\..\Run: [DSLCoMan] "C:\Programme\DSL Connection Manager\DSLCoMan.exe" -autostart

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [SpeedswitchXP] C:\Programme\SpeedswitchXP\SpeedswitchXP.exe

O4 - HKCU\..\Run: [MsnMsgr] "C:\Programme\Windows Live\Messenger\MsnMsgr.Exe" /background

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')

O4 - HKUS\S-1-5-19\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'LOKALER DIENST')

O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'LOKALER DIENST')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')

O4 - HKUS\S-1-5-20\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'NETZWERKDIENST')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - HKUS\.DEFAULT\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'Default user')

O9 - Extra button: Mobilen Favoriten erstellen - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Programme\Microsoft ActiveSync\INetRepl.dll

O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Programme\Microsoft ActiveSync\INetRepl.dll

O9 - Extra 'Tools' menuitem: Mobilen Favoriten erstellen... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Programme\Microsoft ActiveSync\INetRepl.dll

O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL

O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\WINDOWS\system32\shdocvw.dll

O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\WINDOWS\system32\shdocvw.dll

O23 - Service: AccSys WLAN Control Service (accvssvc) - AccSys GmbH - C:\Programme\Gemeinsame Dateien\AccSys\AccVSSvc.exe

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Ati HotKey Poller - Lisa - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: AVSync Manager (AvSynMgr) - Lisa - C:\Programme\Network Associates\VirusScan\Avsynmgr.exe

O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Programme\Bonjour\mDNSResponder.exe

O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Programme\Executive Software\DiskeeperWorkstation\DKService.exe

O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Programme\iPod\bin\iPodService.exe

O23 - Service: Keyboard And Mouse Communication Service (KMWDSERVICE) - UASSOFT.COM - C:\Programme\Mouse Driver\KMWDSrv.exe

O23 - Service: McShield - Lisa - C:\Programme\Gemeinsame Dateien\Network Associates\McShield\Mcshield.exe

O24 - Desktop Component 1: PC-Aquarium Deluxe - 7db39a0d-580f-4be9-9195-8bfcd226f6c2
 

--

End of file - 6386 bytes

Code:

StartupList report, 25.10.2008, 15:51:42

StartupList version: 1.52.2

Started from : C:\Programme\Trend Micro\HijackThis\HijackThis.EXE

Detected: Windows XP SP2 (WinNT 5.01.2600)

Detected: Internet Explorer v6.00 SP2 (6.00.2900.2180)

* Using default options

==================================================
 

Running processes:
 

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Programme\Gemeinsame Dateien\AccSys\AccVSSvc.exe

C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Programme\Network Associates\VirusScan\Avsynmgr.exe

C:\Programme\Bonjour\mDNSResponder.exe

C:\Programme\Executive Software\DiskeeperWorkstation\DKService.exe

C:\Programme\Mouse Driver\KMWDSrv.exe

C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\Programme\Network Associates\VirusScan\VsStat.exe

C:\Programme\Network Associates\VirusScan\Vshwin32.exe

C:\Programme\PestPatrol\PPControl.exe

C:\Programme\PestPatrol\PPMemCheck.exe

C:\Programme\PestPatrol\CookiePatrol.exe

C:\Programme\Sony\HotKey Utility\HKserv.exe

C:\Programme\Network Associates\VirusScan\Avconsol.exe

C:\Programme\Sony\VAIO Update 3\VAIOUpdt.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Programme\SpeedswitchXP\SpeedswitchXP.exe

C:\Programme\Network Associates\VirusScan\Webscanx.exe

C:\Programme\Gemeinsame Dateien\Network Associates\McShield\Mcshield.exe

C:\Programme\Sony\HotKey Utility\HKWnd.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Programme\Mozilla Firefox\firefox.exe

C:\Programme\Messenger\msmsgs.exe

C:\Programme\DSL Connection Manager\DSLCoMan.exe

C:\Programme\Trend Micro\HijackThis\HijackThis.exe

C:\WINDOWS\system32\notepad.exe

C:\WINDOWS\system32\msiexec.exe

C:\WINDOWS\system32\NOTEPAD.EXE
 

--------------------------------------------------
 

Checking Windows NT UserInit:
 

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]

UserInit = C:\WINDOWS\system32\userinit.exe,
 

--------------------------------------------------
 

Autorun entries from Registry:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
 

PestPatrol Control Center = C:\Programme\PestPatrol\PPControl.exe

PestPatrolCL = 

PPMemCheck = C:\Programme\PestPatrol\PPMemCheck.exe

CookiePatrol = C:\Programme\PestPatrol\CookiePatrol.exe

HKSERV.EXE = C:\Programme\Sony\HotKey Utility\HKserv.exe

Hcontrol = C:\WINDOWS\Hcontrol.exe

VAIO Update 3 = "C:\Programme\Sony\VAIO Update 3\VAIOUpdt.exe"  /Stationary

DSLCoMan = "C:\Programme\DSL Connection Manager\DSLCoMan.exe" -autostart
 

--------------------------------------------------
 

Autorun entries from Registry:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
 

CTFMON.EXE = C:\WINDOWS\system32\ctfmon.exe

SpeedswitchXP = C:\Programme\SpeedswitchXP\SpeedswitchXP.exe

MsnMsgr = "C:\Programme\Windows Live\Messenger\MsnMsgr.Exe" /background
 

--------------------------------------------------
 

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:
 

Shell=*INI section not found*

SCRNSAVE.EXE=*INI section not found*

drivers=*INI section not found*
 

Shell & screensaver key from Registry:
 

Shell=Explorer.exe

SCRNSAVE.EXE=C:\WINDOWS\AquaReal.scr

drivers=*Registry value not found*
 

Policies Shell key:
 

HKCU\..\Policies: Shell=*Registry key not found*

HKLM\..\Policies: Shell=*Registry value not found*
 

--------------------------------------------------
 
 

Enumerating Browser Helper Objects:
 

(no name) - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}

(no name) - (no file) - {7E853D72-626A-48EC-A868-BA8D5E23E045}

(no name) - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll - {9030D464-4C02-4ABF-8ECC-5164760863C6}
 

--------------------------------------------------
 

Enumerating Task Scheduler jobs:
 

AppleSoftwareUpdate.job
 

--------------------------------------------------
 

Enumerating Download Program Files:
 

[Shockwave Flash Object]

InProcServer32 = C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx

CODEBASE = http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
 

--------------------------------------------------
 

Enumerating Winsock LSP files:
 

NameSpace #4: C:\Programme\Bonjour\mdnsNSP.dll
 

--------------------------------------------------
 

Enumerating ShellServiceObjectDelayLoad items:
 

PostBootReminder: C:\WINDOWS\system32\SHELL32.dll

CDBurn: C:\WINDOWS\system32\SHELL32.dll

WebCheck: C:\WINDOWS\system32\webcheck.dll

SysTray: C:\WINDOWS\system32\stobject.dll
 

--------------------------------------------------

End of report, 5.545 bytes

Report generated in 0,020 seconds
 

Command line options:

   /verbose  - to add additional info on each section

   /complete - to include empty sections and unsuspicious data

   /full     - to include several rarely-important sections

   /force9x  - to include Win9x-only startups even if running on WinNT

   /forcent  - to include WinNT-only startups even if running on Win9x

   /forceall - to include all Win9x and WinNT startups, regardless of platform

   /history  - to list version history only