Trojaner-Board - Trojanisches Pferd TR/Dropper.Gen

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Trojanisches Pferd TR/Dropper.Gen (https://www.trojaner-board.de/72185-trojanisches-pferd-tr-dropper-gen.html)

Trojanisches Pferd TR/Dropper.Gen

Hallo Jungs, habe eben noch meinem Problem gegoogelt, und bin hier auf die Seite gestoßen, ich bin leider total unerfahren, im umgang mit dem PC, und bräuchte jmd mit Geduld der bereit ist mir zu helfen...

Ich wäre euch zutiefst dankbar, wenn sich wer findet, der mir helfen kann...

Seit 3 Tagen bekomme ich von AntiVir eine Mitteilung, über ein Trojanisches Pferd "TR/Dropper.Gen" und weis absolut nicht weiter, wäre euch sehr dankbar, wenn mir einer helfen kann und mir das über ICQ(223088792) oder anders erklären kann, wie ich mit dem Problem umgehen muss...

Mit freundlichen Grüßen
Nico

"c:\users\nico\appdata\local\ygcugos.exe" ygcugos ---> Das zeigt er als Quelle an...

Hab mich mal schlau gemacht und dass hier soll da ne wichtige Rolle spielen, leider habe ich keine Ahnung wie, wo und warum...

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:11:47, on 19.04.2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18226)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Steam\Steam.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\ICQ6.5\ICQ.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe
C:\Program Files\Teamspeak2_RC2\TeamSpeak.exe
C:\Program Files\Microsoft Windows OneCare Live\WinSSNotifyE.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = ICQ.com Suche
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Live Search
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Live Search
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll
R3 - URLSearchHook: (no name) - - (no file)
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: Windows Live Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ICQ] "C:\Program Files\ICQ6.5\ICQ.exe" silent
O4 - HKCU\..\Run: [ygcugos] "c:\users\nico\appdata\local\ygcugos.exe" ygcugos
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O8 - Extra context menu item: &Winamp Search - C:\ProgramData\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe (file missing)
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O13 - Gopher Prefix:
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://icq.oberon-media.com/Gameshel...onGameHost.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/ge...sh/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: ClipInc 001 (ClipInc001) - Unknown owner - C:\Program Files\Tobit ClipInc\Server\ClipInc-Server.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: TeamViewer 3 (TeamViewer) - TeamViewer GmbH - C:\Program Files\TeamViewer3\TeamViewer_Service.exe
O23 - Service: TeamViewer 4 (TeamViewer4) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software - C:\Windows\System32\TuneUpDefragService.exe
O23 - Service: @%SystemRoot%\System32\TUProgSt.exe,-1 (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\Windows\System32\TUProgSt.exe

--
End of file - 9219 bytes

sodele hab schon ne lösung gefunden :P
sry für die die ich gestört habe :P

______________________________________
CLOSE

Navilog
Starte navilog1.exe und installiere die Anwendung, eventuelle Fehlermeldungen Deines
Virescanners sind zu ignorieren (Anwendung erlauben!)
Alle anderen Anwendungen bitte beenden!
Danach sollte navilog automatisch starten, sonst per Doppelklick dem Desktop starten.
Im Sprachmenü bitte Englisch auswählen.
Wähle 1 im nächsten Menü um "Suche" auszuwählen. Bestätige mit Enter.
Während der Suche nichts am Rechner machen, nur auf Programmaufforderung!
Nach dem Durchlauf sollte sich der Editor mit dem Log (fixnavi.txt) öffnen,
Inhalt kopieren und in Thread einfügen.
Das Log findest Du auch im Hauptverzeichnis (z.B.: "C:\").
http://pagesperso-orange.fr/il.mafio...x/Navilog1.exe

Zitat:

Zitat von RoteInge (Beitrag 430003)

sodele hab schon ne lösung gefunden :P
sry für die die ich gestört habe :P

______________________________________

Vielleicht wärst du so nett und würdest uns deine Lösung auch verraten?! :)

kann ich dir nich genau sagen, aber mein nachbar war eben hier, und hat sich das ganze angeschaut, kp was er gemacht hat, bin ein pc-nicht-kenner...wenn er vom fußball zurück ist kann ich ihn mal fragen und poste es euch hier...

Hab das mit Navilog gemacht, jetzt hat sich danach folgende Datei im Editor geöffnet:

Search Navipromo version 3.7.6 began on 19.04.2009 at 12:10:26,29

!!! Warning, this report may include legitimate files/programs !!!
!!! Post this report on the forum you are being helped !!!
!!! Don't continue with removal unless instructed by an authorized helper !!!

Fix running from C:\Program Files\navilog1

Updated on 14.03.2009 at 18h00 by IL-MAFIOSO

Microsoft® Windows Vista™ Home Premium ( v6.0.6001 ) Service Pack 1
X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 Duo CPU E8400 @ 3.00GHz )
BIOS : Default System BIOS
USER : Nico ( Administrator )
BOOT : Normal boot

Antivirus : Windows Live OneCare 1.0.0 (Activated)
Firewall : Windows Live OneCare-Firewall 1.0.0 (Activated)

C:\ (Local Disk) - NTFS - Total:457 Go (Free:327 Go)
D:\ (Local Disk) - NTFS - Total:7 Go (Free:2 Go)
E:\ (CD or DVD)
F:\ (USB)
G:\ (USB)
H:\ (USB)
I:\ (USB)

Search done in normal mode

*** Search folders in "C:\Windows" ***

*** Search folders in "C:\Program Files" ***

...\WebMediaPlayer found !

*** Search folders in "c:\progra~2\micros~1\windows\startm~1\programs" ***

...\WebMediaPlayer found !

*** Search folders in "c:\progra~2\micros~1\windows\startm~1" ***

*** Search folders in "C:\ProgramData" ***

*** Search folders in "c:\users\nico\appdata\roaming\micros~1\windows\startm~1\programs" ***

*** Search folders in "C:\Users\Nico\AppData\Local\virtualstore\Program Files" ***

*** Search folders in "C:\Users\Nico\AppData\Local" ***

*** Search folders in "C:\Users\Nico\AppData\Roaming" ***

*** Search with Catchme-rootkit/stealth malware detector by gmer ***
for more info : http://www.gmer.net

*** Search with GenericNaviSearch ***
!!! Possibility of legitimate files in the result !!!
!!! Must always be checked before manually deleting !!!

* Scan in "C:\Windows\system32" *

* Scan in "C:\Users\Nico\AppData\Local\Microsoft" *

* Scan in "C:\Users\Nico\AppData\Local\virtualstore\windows\system32" *

* Scan in "C:\Users\Nico\AppData\Local" *

*** Search files ***

*** Search specific Registry keys ***
!! Following keys are not certainly all infected !!

*** Complementary Search ***
(Search specific files)

1)Search new Instant Access files :

2)Heuristic Search :

* In "C:\Windows\system32" :

* In "C:\Users\Nico\AppData\Local\Microsoft" :

* In "C:\Users\Nico\AppData\Local\virtualstore\windows\system32" :

* In "C:\Users\Nico\AppData\Local" :

3)Certificates Search :

Egroup certificate not found !
Electronic-Group certificate not found !
Montorgueil certificate not found !
OOO-Favorit certificate not found !
Sunny-Day-Design-Ltd certificate not found !

4)Search others known folders and files :

*** Search completed on 19.04.2009 at 12:11:19,55 ***

Navilog nochmal mit Option 2 durchführen, Log posten.

So hab "Schritt 2" ausgeführt, PC hat neu gestartet und nun Folgendes :)

Navipromo Removal version 3.7.6 started on 19.04.2009 at 12:17:53,55

Fix running from C:\Program Files\navilog1

Updated on 14.03.2009 at 18h00 by IL-MAFIOSO

Microsoft® Windows Vista™ Home Premium ( v6.0.6001 ) Service Pack 1
X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 Duo CPU E8400 @ 3.00GHz )
BIOS : Default System BIOS
USER : Nico ( Administrator )
BOOT : Normal boot

Antivirus : Windows Live OneCare 1.0.0 (Activated)
Firewall : Windows Live OneCare-Firewall 1.0.0 (Activated)

C:\ (Local Disk) - NTFS - Total:457 Go (Free:327 Go)
D:\ (Local Disk) - NTFS - Total:7 Go (Free:2 Go)
E:\ (CD or DVD)
F:\ (USB)
G:\ (USB)
H:\ (USB)
I:\ (USB)

Automatic removal
with Catchme and GNS results

Cleanning stage done on Reboot

*** fsbl1.txt not found ***
(Check that Catchme found nothing in Search Mode)

*** Deleting with Backups GenericNaviSearch results ***

* Deletion in "C:\Windows\System32" *

* Deletion in "C:\Users\Nico\AppData\Local\Microsoft" *

* Deletion in "C:\Users\Nico\AppData\Local\virtualstore\windows\system32" *

* Deletion in "C:\Users\Nico\AppData\Local" *

*** Deleting folders in "C:\Windows" ***

*** Deleting folders in "C:\Program Files" ***

...\WebMediaPlayer ...deleting...
...\WebMediaPlayer deleted !

*** Deleting folders in "c:\progra~2\micros~1\windows\startm~1\programs" ***

...\WebMediaPlayer ...deleting...
...\WebMediaPlayer deleted !

*** Deleting folders in "c:\progra~2\micros~1\windows\startm~1" ***

*** Deleting folders in "C:\ProgramData" ***

*** Deleting folders in c:\users\nico\appdata\roaming\micros~1\windows\startm~1\programs ***

*** Deleting folders in "C:\Users\Nico\AppData\Local\virtualstore\Program Files" ***

*** Deleting folders in "C:\Users\Nico\AppData\Local" ***

*** Deleting folders in "C:\Users\Nico\AppData\Roaming" ***

*** Deleting files ***

*** Deleting temporary files ***

Cleaning of C:\Windows\Temp done !
Cleaning of C:\Users\Nico\AppData\Local\Temp done !

*** Complementary Search ***
(Search specific files)

1)Deletion with backups new Instant Access files:

2)Heuristic search and deletion with backups :

* In "C:\Windows\system32" *

* In "C:\Users\Nico\AppData\Local\Microsoft" *

* In "C:\Users\Nico\AppData\Local\virtualstore\windows\system32" *

* In "C:\Users\Nico\AppData\Local" *

*** Copy Registry to Safebackup folder ***

Backing up Registry done !

*** Cleaning Registry ***

Registry cleaned

*** Certificates ***

Egroup Certificate not found !
Electronic-Group Certificate not found !
Montorgueil Certificate not found !
OOO-Favorit Certificate not found !
Sunny-Day-Design-Ltd Certificate not found !

*** Search others known folders and files ***

*** Cleaning stage complete on 19.04.2009 at 12:21:09,47 ***

Sieht doch schonmal netter aus. Nun poste nochmal alles durch (Malwarebytes, Uninstall List und Superantispyware).

Hier die Anleitung: http://www.trojaner-board.de/69886-a...-beachten.html

Meine Aktuelle HJT-Logfile:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:30:42, on 19.04.2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18226)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Teamspeak2_RC2\TeamSpeak.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = h**p://google.icq.com/search/search_frame.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = ICQ.com Suche
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.c*m
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Live Search
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Live Search
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll
R3 - URLSearchHook: (no name) - - (no file)
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: Windows Live Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O8 - Extra context menu item: &Winamp Search - C:\ProgramData\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O13 - Gopher Prefix:
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - h**p://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - h**p://icq.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - h**ps://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: ClipInc 001 (ClipInc001) - Unknown owner - C:\Program Files\Tobit ClipInc\Server\ClipInc-Server.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: TeamViewer 3 (TeamViewer) - TeamViewer GmbH - C:\Program Files\TeamViewer3\TeamViewer_Service.exe
O23 - Service: TeamViewer 4 (TeamViewer4) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version4\TeamViewer_Service.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software - C:\Windows\System32\TuneUpDefragService.exe
O23 - Service: @%SystemRoot%\System32\TUProgSt.exe,-1 (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\Windows\System32\TUProgSt.exe

--
End of file - 9156 bytes

was müsste ich vion denen denn jezt über hjt "fixen"`?

Fixen tun wir noch gar nichts, wir richten uns erstmal an Malwarebytes und SASW.
Du hattest/hast nicht nur Navipromo drauf. Befolge bitte die Anleitungen und poste alle Logs hier rein.

hab ich, nur das prob war bei malwarebytes das ich die textdatei nich kopieren konnte, da der rechner automatisch neu gestartet habe, habe die schritte ja durchgeführt wie angegeben und bin jetzt beim ende von schritt 3.

Dann machte er wohlmöglich ein "Delete on reboot". Gehe oben bei den reitern auf Scan-Berichte und poste das log vom heutigen Datum hier rein.

Malwarebytes' Anti-Malware 1.36
Datenbank Version: 2009
Windows 6.0.6001 Service Pack 1

19.04.2009 15:25:08
mbam-log-2009-04-19 (15-25-08).txt

Scan-Methode: Vollständiger Scan (C:\|D:\|)
Durchsuchte Objekte: 216612
Laufzeit: 1 hour(s), 10 minute(s), 31 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\Windows\NV_Teilnehmer.exe (Backdoor.Bot) -> Quarantined and deleted successfully.

Bitte poste noch ein Superantispyware Scan bericht, falls du noch keinen hast, dann downloade dir SASW.

Edit: wie sieht es mit CCleaner aus? Hast du diesen schon erledigt? Wenn nein, dann tu dies bitte jetzt bis keine fehler mehr auftreten.

sry hab den edit grad erst gesehen, ja habe ich...bis schritt 3 bei hijackthis wo ich irg was fixen musste, wusste ich ncihmehr weiter :)
superantispyware läuft gerade durch

SUPERAntiSpyware Scan Log
SUPERAntiSpyware.com - AntiAdware, AntiSpyware, AntiMalware!

Generated 04/19/2009 at 05:06 PM

Application Version : 4.26.1000

Core Rules Database Version : 3852
Trace Rules Database Version: 1805

Scan type : Complete Scan
Total Scan Time : 00:56:14

Memory items scanned : 672
Memory threats detected : 0
Registry items scanned : 7296
Registry threats detected : 0
File items scanned : 135379
File threats detected : 3

Adware.Tracking Cookie
C:\Users\Nico\AppData\Roaming\Microsoft\Windows\Cookies\nico@ad.71i[1].txt
C:\Users\Nico\AppData\Roaming\Microsoft\Windows\Cookies\nico@atwola[2].txt

Adware.Vundo/Variant-MSFake
C:\PROGRAM FILES\NAVILOG1\REG.EXE

Lass folgendes laufen: http://www.trojaner-board.de/72020-a...g-zhpdiag.html

Bitte das Log davon hier rein. Wenn es zu groß ist lade es bei Materialordner hoch.

wie kann ich bei anti vir diesen echtzeitschutz aktivieren?weil jedesmal wenn ich sonst das programm starte kommt "keine rückmeldung"

rechtsklick auf das Avira Symbol und dann Antivir Guard aktivieren Häckchen rein.

Wenn das nicht geht dann Deinstallation, dann neu downloaden von avira.com, neu installieren.

Code:

Rapport de ZHPDiag v1.18 par Nicolas Coolman

Enregistré le 19.04.2009 17:42:13

Platform : Windows Vista (TM) Home Premium (6.0.6001) Service Pack 1

MSIE: Internet Explorer v7.0.6001.18000

MFIE: Mozilla Firefox (3.0.8)
 

---\\ Processus lancés

%ProgramFiles%\Windows Defender\MSASCui.exe

RtHDVCpl.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
 

---\\ Plugin du navigateur Opera (P1)

P1 - OPN:Opera Plugin Navigator - C:\Program Files\Opera\Program\Plugins\libdivx.dll

P1 - OPN:Opera Plugin Navigator - C:\Program Files\Opera\Program\Plugins\npdivx32.dll

P1 - OPN:Opera Plugin Navigator - C:\Program Files\Opera\Program\Plugins\ssldivx.dll
 

---\\ Modification d'une valeur Ini (Changed inifile value, mapped to Registry) (F2)

F2 - REG:system.ini: UserInit=C:\Windows\system32\userinit.exe,

F2 - REG:system.ini: Shell=explorer.exe
 

---\\ Pages de démarrage d'Internet Explorer (R0)

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
 

---\\ Pages de recherche d'Internet Explorer (R1)

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://google.icq.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
 

---\\ Redirection du fichier Hosts (O1)

O1 - Hosts: ::1             localhost
 

---\\ Browser Helper Objects de navigateur(O2)

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll

O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll

O2 - BHO: Windows Live Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
 

---\\ Internet Explorer Toolbars (O3)

O3 - Toolbar: 1 - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll

O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll

O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

O3 - Toolbar: (no name) - {D0943516-5076-4020-A3B5-AEFAF26AB263} - 
 

---\\ Applications démarrées automatiquement par le registre (O4)

O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe

O4 - HKLM\..\Run: [] 

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
 

---\\ Invisibilité de l'icône d'options IE dans le panneau de Configuration (O5)

O5 - control.ini: inetcpl.cpl=no
 

---\\ Lignes supplémentaires dans le menu contextuel d'Internet Explorer (O8)

O8 - Extra context menu item: &Winamp Search - C:\ProgramData\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html

O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
 

---\\ Boutons situés sur la barre d'outils principale d'Internet Explorer (O9)

O9 - Extra button: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll

O9 - Extra button: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll,103

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFBARH.ICO

O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe,1040

O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe,1040
 

---\\ Objets ActiveX (Downloaded Program Files)(O16)

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab

O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://icq.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab
 

---\\ Protocole additionnel et piratage de protocole (O18)

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
 

---\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)

O20 - Winlogon Notify: SABWINLOStartup - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
 

---\\ Clé de Registre autorun SharedTaskScheduler (STS) (O22)

O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030}
 

---\\ Composants installés (ActiveSetup Installed Components) (O40)

O40 - ASIC: Microsoft Windows Media Player - {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP

O40 - ASIC: Internet Explorer - {26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig

O40 - ASIC: Browser Customizations - {60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

O40 - ASIC: Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - (not file)

O40 - ASIC: (no name) - {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - (not file)

O40 - ASIC: Microsoft Windows Media Player 11.0 - {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\System32\wmpdxm.dll

O40 - ASIC: .NET Framework - {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - (not file)

O40 - ASIC: Themes Setup - {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - C:\Windows\system32\regsvr32.exe /s /n /i:/UserInstall C:\Windows\system32\themeui.dll

O40 - ASIC: Offline Browsing Pack - {3af36230-a269-11d1-b5bf-0000f8051515} - (not file)

O40 - ASIC: Microsoft Windows Mail 7 - {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

O40 - ASIC: (no name) - {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - (not file)

O40 - ASIC: DirectDrawEx - {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - (not file)

O40 - ASIC: Internet Explorer Help - {45ea75a0-a269-11d1-b5bf-0000f8051515} - (not file)

O40 - ASIC: Microsoft Windows Script 5.6 - {4f645220-306d-11d2-995d-00c04f98bbc9} - (not file)

O40 - ASIC: Internet Explorer Setup Tools - {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - (not file)

O40 - ASIC: Browsing Enhancements - {630b1da0-b465-11d1-9948-00c04f98bbc9} - (not file)

O40 - ASIC: Microsoft Windows Media Player - {6BF52A52-394A-11d3-B153-00C04F79FAA6} - C:\Windows\system32\unregmp2.exe /FirstLogon /Shortcuts /RegBrowsers /ResetMUI

O40 - ASIC: MSN Site Access - {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - (not file)

O40 - ASIC: Address Book 7 - {7790769C-0471-11d2-AF11-00C04FA35D02} - (not file)

O40 - ASIC: .NET Framework - {7C028AF8-F614-47B3-82DA-BA94E41B1089} - (not file)

O40 - ASIC: Windows Desktop Update - {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

O40 - ASIC: Internet Explorer - {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings

O40 - ASIC: (no name) - {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

O40 - ASIC: Dynamic HTML Data Binding - {9381D8F2-0288-11D0-9501-00AA00B911A5} - (not file)

O40 - ASIC: Internet Explorer Core Fonts - {C9E9A340-D1F1-11D0-821E-444553540600} - (not file)

O40 - ASIC: (no name) - {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - (not file)

O40 - ASIC: Adobe Flash Player 9 ActiveX - {D27CDB6E-AE6D-11CF-96B8-444553540000} - C:\Windows\system32\Macromed\Flash\Flash10a.ocx

O40 - ASIC: HTML Help - {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - (not file)

O40 - ASIC: Active Directory Service Interface - {E92B03AB-B707-11d2-9CBD-0000F87A369E} - (not file)
 

---\\ Logiciels installés (O42)

O42 - Logiciel: Activation Assistant for the 2007 Microsoft Office suites

O42 - Logiciel: Adobe Flash Player 10 ActiveX

O42 - Logiciel: Adobe Flash Player 10 Plugin

O42 - Logiciel: Adobe Shockwave Player 11.5

O42 - Logiciel: Alcatech BPM Studio Professional v4.9.1

O42 - Logiciel: Ask Toolbar

O42 - Logiciel: AV Voice Changer Software 6.0

O42 - Logiciel: Avira AntiVir Personal - Free Antivirus

O42 - Logiciel: DivX Plus DirectShow Filters

O42 - Logiciel: Favorit

O42 - Logiciel: Free YouTube to Mp3 Converter version 3.1

O42 - Logiciel: FreeStar Free iPod Video Converter 3.0.6

O42 - Logiciel: FUSSBALL MANAGER 09

O42 - Logiciel: HijackThis 2.0.2

O42 - Logiciel: HLSW v1.2.1.2

O42 - Logiciel: Microsoft Office Home and Student 2007

O42 - Logiciel: Sonic MyDVD-VR

O42 - Logiciel: Malwarebytes' Anti-Malware

O42 - Logiciel: Messenger Plus! Live & Sponsor (CiD)

O42 - Logiciel: Microsoft .NET Framework 3.5 Language Pack SP1 - DEU

O42 - Logiciel: Microsoft .NET Framework 3.5 SP1

O42 - Logiciel: Mozilla Firefox (3.0.8)

O42 - Logiciel: Mumble and Murmur

O42 - Logiciel: Navilog1 3.7.6

O42 - Logiciel: Norton Security Scan (Symantec Corporation)

O42 - Logiciel: NVIDIA Drivers

O42 - Logiciel: Winamp Remote

O42 - Logiciel: Project Torque

O42 - Logiciel: PSP Video 9 2.25

O42 - Logiciel: Registry Easy v4.9

O42 - Logiciel: Adobe Flash Player 9 ActiveX

O42 - Logiciel: SHOUTcast Source DSP 1.9.0 (remove only)

O42 - Logiciel: Counter-Strike: Source

O42 - Logiciel: TeamSpeak 2 RC2

O42 - Logiciel: TeamViewer 3

O42 - Logiciel: TeamViewer 4

O42 - Logiciel: TmNationsForever

O42 - Logiciel: Tobit.Software clipinc.fx

O42 - Logiciel: Uninstall 1.0.0.1

O42 - Logiciel: VLC media player 0.9.9

O42 - Logiciel: Winamp

O42 - Logiciel: Winamp Toolbar for Internet Explorer

O42 - Logiciel: Windows Live Essentials

O42 - Logiciel: WinRAR

O42 - Logiciel: Windows Live OneCare

O42 - Logiciel: Steam

O42 - Logiciel: OpenOffice.org 3.0

O42 - Logiciel: Microsoft .NET Framework 3.5 Language Pack SP1 - deu

O42 - Logiciel: Bonjour

O42 - Logiciel: Windows Live Fotogalerie

O42 - Logiciel: LevelR

O42 - Logiciel: Windows Live-Uploadtool

O42 - Logiciel: QuickTime

O42 - Logiciel: MSVCRT

O42 - Logiciel: FIFA 09

O42 - Logiciel: Java(TM) 6 Update 7

O42 - Logiciel: Microsoft Windows OneCare Live v2.5.2900.20 Idcrl Install

O42 - Logiciel: Microsoft Works

O42 - Logiciel: Windows Live Communications Platform

O42 - Logiciel: Junk Mail filter update

O42 - Logiciel: Windows Live Anmelde-Assistent

O42 - Logiciel: Windows Live Family Safety

O42 - Logiciel: TuneUp Utilities 2009

O42 - Logiciel: Microsoft Windows Live OneCare Resources v2.5.2900.20

O42 - Logiciel: Microsoft Office Live Add-in 1.3

O42 - Logiciel: Windows Live Mail

O42 - Logiciel: Skype™ 3.8

O42 - Logiciel: iTunes

O42 - Logiciel: Windows Live Call

O42 - Logiciel: ICQ6.5

O42 - Logiciel: PX Engine

O42 - Logiciel: Apple Software Update

O42 - Logiciel: NVIDIA PhysX v8.08.01

O42 - Logiciel: Windows Media Player Firefox Plugin

O42 - Logiciel: Windows Live Toolbar

O42 - Logiciel: Microsoft Visual C++ 2005 Redistributable

O42 - Logiciel: VC80CRTRedist - 8.0.50727.762

O42 - Logiciel: DivX Codec

O42 - Logiciel: Windows Live Writer

O42 - Logiciel: Windows Live Messenger

O42 - Logiciel: MSXML 4.0 SP2 (KB954430)

O42 - Logiciel: Microsoft Silverlight

O42 - Logiciel: Microsoft Sync Framework Runtime Native v1.0 (x86)

O42 - Logiciel: DivX Player

O42 - Logiciel: GTOneCare

O42 - Logiciel: Choice Guard

O42 - Logiciel: Microsoft Office Excel MUI (German) 2007

O42 - Logiciel: Update for Microsoft Office Excel 2007 Help (KB957242)

O42 - Logiciel: 2007 Microsoft Office Suite Service Pack 1 (SP1)

O42 - Logiciel: Microsoft Office PowerPoint MUI (German) 2007

O42 - Logiciel: Microsoft Office Word MUI (German) 2007

O42 - Logiciel: Microsoft Office Proof (German) 2007

O42 - Logiciel: Microsoft Office Proof (English) 2007

O42 - Logiciel: Microsoft Office Proof (French) 2007

O42 - Logiciel: Microsoft Office Proof (Italian) 2007

O42 - Logiciel: Compatibility Pack für 2007 Office System

O42 - Logiciel: Microsoft Office Proofing (German) 2007

O42 - Logiciel: Microsoft Office Shared MUI (German) 2007

O42 - Logiciel: Microsoft Office OneNote MUI (German) 2007

O42 - Logiciel: Security Update for Microsoft Office Word 2007 (KB956358)

O42 - Logiciel: Security Update for Microsoft Office PowerPoint 2007 (KB951338)

O42 - Logiciel: Security Update for Microsoft Office system 2007 (KB954326)

O42 - Logiciel: Security Update for 2007 Microsoft Office System (KB951944)

O42 - Logiciel: Security Update for Microsoft Office system 2007 (KB956828)

O42 - Logiciel: Security Update for Microsoft Office Excel 2007 (KB959997)

O42 - Logiciel: Update for Office 2007 (KB946691)

O42 - Logiciel: Security Update for 2007 Microsoft Office System (KB951550)

O42 - Logiciel: Security Update for 2007 Microsoft Office System (KB960003)

O42 - Logiciel: Security Update for Microsoft Office OneNote 2007 (KB950130)

O42 - Logiciel: Microsoft Protection Service

O42 - Logiciel: Microsoft Office PowerPoint Viewer 2007 (German)

O42 - Logiciel: Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

O42 - Logiciel: Microsoft Search Enhancement Pack

O42 - Logiciel: Pro Evolution Soccer 2009

O42 - Logiciel: Adobe Reader 9 - Deutsch

O42 - Logiciel: Apple Mobile Device Support

O42 - Logiciel: DivX Converter

O42 - Logiciel: Spybot - Search & Destroy

O42 - Logiciel: DivX Web Player

O42 - Logiciel: Microsoft Sync Framework Services Native v1.0 (x86)

O42 - Logiciel: MSXML 4.0 SP2 (KB936181)

O42 - Logiciel: MSXML 4.0 SP2 (KB941833)

O42 - Logiciel: SUPERAntiSpyware Free Edition

O42 - Logiciel: Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)

O42 - Logiciel: Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)

O42 - Logiciel: Microsoft Windows OneCare Live v2.5.2900.20

O42 - Logiciel: Norton Security Scan

O42 - Logiciel: Roxio WinOnCD 9 Basic

O42 - Logiciel: Microsoft Windows OneCare Live AntiSpyware and AntiVirus

O42 - Logiciel: Windows Live Sync

O42 - Logiciel: Microsoft SQL Server 2005 Compact Edition [ENU]

O42 - Logiciel: Realtek High Definition Audio Driver
 

---\\ Contenu des dossiers Fichiers Communs (O43)

O43 - CFD:Common File Directory - C:\Program Files\Common Files\Adobe

O43 - CFD:Common File Directory - C:\Program Files\Common Files\Apple

O43 - CFD:Common File Directory - C:\Program Files\Common Files\DESIGNER

O43 - CFD:Common File Directory - C:\Program Files\Common Files\DivX Shared

O43 - CFD:Common File Directory - C:\Program Files\Common Files\DVDVideoSoft

O43 - CFD:Common File Directory - C:\Program Files\Common Files\InstallShield

O43 - CFD:Common File Directory - C:\Program Files\Common Files\Java

O43 - CFD:Common File Directory - C:\Program Files\Common Files\Logitech

O43 - CFD:Common File Directory - C:\Program Files\Common Files\microsoft shared

O43 - CFD:Common File Directory - C:\Program Files\Common Files\PX Storage Engine

O43 - CFD:Common File Directory - C:\Program Files\Common Files\Roxio Shared

O43 - CFD:Common File Directory - C:\Program Files\Common Files\Services

O43 - CFD:Common File Directory - C:\Program Files\Common Files\Skype

O43 - CFD:Common File Directory - C:\Program Files\Common Files\Sonic Shared

O43 - CFD:Common File Directory - C:\Program Files\Common Files\Sony Shared

O43 - CFD:Common File Directory - C:\Program Files\Common Files\SpeechEngines

O43 - CFD:Common File Directory - C:\Program Files\Common Files\Steam

O43 - CFD:Common File Directory - C:\Program Files\Common Files\SureThing Shared

O43 - CFD:Common File Directory - C:\Program Files\Common Files\Symantec Shared

O43 - CFD:Common File Directory - C:\Program Files\Common Files\System

O43 - CFD:Common File Directory - C:\Program Files\Common Files\Tobit

O43 - CFD:Common File Directory - C:\Program Files\Common Files\Windows Live

O43 - CFD:Common File Directory - C:\Program Files\Common Files\WindowsLiveInstaller

O43 - CFD:Common File Directory - C:\Program Files\Common Files\Wise Installation Wizard
 

---\\ Derniers fichiers modifiés ou crées sous System32 (O44)

O44 - LFC:Last File Created - C:\Windows\System32\amxread.dll -->17.03.2009

O44 - LFC:Last File Created - C:\Windows\System32\apilogen.dll -->17.03.2009

O44 - LFC:Last File Created - C:\Windows\System32\authuitu.dll -->20.03.2009

O44 - LFC:Last File Created - C:\Windows\System32\Bar.OCX -->17.02.2009

O44 - LFC:Last File Created - C:\Windows\System32\DataRnvx.dat -->26.02.2009

O44 - LFC:Last File Created - C:\Windows\System32\device.OCX -->25.02.2009

O44 - LFC:Last File Created - C:\Windows\System32\DivX.dll -->27.01.2009

O44 - LFC:Last File Created - C:\Windows\System32\divx_xx07.dll -->27.01.2009

O44 - LFC:Last File Created - C:\Windows\System32\divx_xx0a.dll -->27.01.2009

O44 - LFC:Last File Created - C:\Windows\System32\divx_xx0c.dll -->27.01.2009

O44 - LFC:Last File Created - C:\Windows\System32\divx_xx11.dll -->27.01.2009

O44 - LFC:Last File Created - C:\Windows\System32\dpl100.dll -->27.01.2009

O44 - LFC:Last File Created - C:\Windows\System32\FNTCACHE.DAT -->12.03.2009

O44 - LFC:Last File Created - C:\Windows\System32\HPOINS08.TXT -->24.02.2009

O44 - LFC:Last File Created - C:\Windows\System32\html.iec -->03.03.2009

O44 - LFC:Last File Created - C:\Windows\System32\iasads.dll -->03.03.2009

O44 - LFC:Last File Created - C:\Windows\System32\iasdatastore.dll -->03.03.2009

O44 - LFC:Last File Created - C:\Windows\System32\iashost.exe -->03.03.2009

O44 - LFC:Last File Created - C:\Windows\System32\iasrecst.dll -->03.03.2009

O44 - LFC:Last File Created - C:\Windows\System32\ieaksie.dll -->03.03.2009

O44 - LFC:Last File Created - C:\Windows\System32\iedkcs32.dll -->03.03.2009

O44 - LFC:Last File Created - C:\Windows\System32\ieencode.dll -->03.03.2009

O44 - LFC:Last File Created - C:\Windows\System32\ieframe.dll -->03.03.2009

O44 - LFC:Last File Created - C:\Windows\System32\iertutil.dll -->03.03.2009

O44 - LFC:Last File Created - C:\Windows\System32\ieUnatt.exe -->03.03.2009

O44 - LFC:Last File Created - C:\Windows\System32\jsproxy.dll -->03.03.2009

O44 - LFC:Last File Created - C:\Windows\System32\kernel32.dll -->13.02.2009

O44 - LFC:Last File Created - C:\Windows\System32\lsasrv.dll -->13.02.2009

O44 - LFC:Last File Created - C:\Windows\System32\mrt.exe -->06.04.2009

O44 - LFC:Last File Created - C:\Windows\System32\MSCOMCTL.OCX -->01.03.2009

O44 - LFC:Last File Created - C:\Windows\System32\msfeeds.dll -->03.03.2009

O44 - LFC:Last File Created - C:\Windows\System32\mshtml.dll -->03.03.2009

O44 - LFC:Last File Created - C:\Windows\System32\mshtml.tlb -->03.03.2009

O44 - LFC:Last File Created - C:\Windows\System32\mstime.dll -->03.03.2009

O44 - LFC:Last File Created - C:\Windows\System32\ntkrnlpa.exe -->03.03.2009

O44 - LFC:Last File Created - C:\Windows\System32\ntoskrnl.exe -->03.03.2009

O44 - LFC:Last File Created - C:\Windows\System32\occache.dll -->03.03.2009

O44 - LFC:Last File Created - C:\Windows\System32\perfc007.dat -->19.04.2009

O44 - LFC:Last File Created - C:\Windows\System32\perfc009.dat -->19.04.2009

O44 - LFC:Last File Created - C:\Windows\System32\perfh007.dat -->19.04.2009

O44 - LFC:Last File Created - C:\Windows\System32\perfh009.dat -->19.04.2009

O44 - LFC:Last File Created - C:\Windows\System32\PerfStringBackup.INI -->19.04.2009

O44 - LFC:Last File Created - C:\Windows\System32\printfilterpipelineprxy.dll -->03.03.2009

O44 - LFC:Last File Created - C:\Windows\System32\printfilterpipelinesvc.exe -->03.03.2009

O44 - LFC:Last File Created - C:\Windows\System32\rpcss.dll -->03.03.2009

O44 - LFC:Last File Created - C:\Windows\System32\sdohlp.dll -->03.03.2009

O44 - LFC:Last File Created - C:\Windows\System32\secur32.dll -->13.02.2009

O44 - LFC:Last File Created - C:\Windows\System32\SENXPCTL.OCX -->15.02.2009

O44 - LFC:Last File Created - C:\Windows\System32\sirenacm.dll -->06.02.2009

O44 - LFC:Last File Created - C:\Windows\System32\TuneUpDefragService.exe -->02.04.2009

O44 - LFC:Last File Created - C:\Windows\System32\TUProgSt.exe -->02.04.2009

O44 - LFC:Last File Created - C:\Windows\System32\urlmon.dll -->03.03.2009

O44 - LFC:Last File Created - C:\Windows\System32\usbaaplrc.dll -->26.03.2009

O44 - LFC:Last File Created - C:\Windows\System32\uxtuneup.dll -->20.03.2009

O44 - LFC:Last File Created - C:\Windows\System32\win32k.sys -->09.02.2009

O44 - LFC:Last File Created - C:\Windows\System32\wininet.dll -->03.03.2009

O44 - LFC:Last File Created - C:\Windows\System32\drivers\avgntflt.sys -->13.02.2009

O44 - LFC:Last File Created - C:\Windows\System32\drivers\avipbb.sys -->13.02.2009

O44 - LFC:Last File Created - C:\Windows\System32\drivers\fssfltr.sys -->06.02.2009

O44 - LFC:Last File Created - C:\Windows\System32\drivers\GEARAspiWDM.sys -->19.03.2009

O44 - LFC:Last File Created - C:\Windows\System32\drivers\mbam.sys -->06.04.2009

O44 - LFC:Last File Created - C:\Windows\System32\drivers\mbamswissarmy.sys -->06.04.2009

O44 - LFC:Last File Created - C:\Windows\System32\drivers\ssmdrv.sys -->13.02.2009

O44 - LFC:Last File Created - C:\Windows\System32\drivers\usbaapl.sys -->26.03.2009
 

---\\ Opérations et fonctions au démarrage de Windows Explorer (O46)

O46 - SEH:ShellExecuteHooks - SABShellExecuteHook Class - {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL
 

---\\ Déni du service LSA (Local Security Authority) (O48)

O48 - LSA:Local Security Authority Authentication Packages - 

O48 - LSA:Local Security Authority Notification Packages - 
 

---\\ Trojan Driver Search Data (TDSD) (O52)

O52 - TDSD:HKLM\...\Drivers\"timer"="timer.drv"

O52 - TDSD:HKLM\...\Drivers32\"vidc.mrle"="msrle32.dll"

O52 - TDSD:HKLM\...\Drivers32\"vidc.msvc"="msvidc32.dll"

O52 - TDSD:HKLM\...\Drivers32\"msacm.imaadpcm"="imaadp32.acm"

O52 - TDSD:HKLM\...\Drivers32\"msacm.msg711"="msg711.acm"

O52 - TDSD:HKLM\...\Drivers32\"msacm.msgsm610"="msgsm32.acm"

O52 - TDSD:HKLM\...\Drivers32\"msacm.msadpcm"="msadp32.acm"

O52 - TDSD:HKLM\...\Drivers32\"midimapper"="midimap.dll"

O52 - TDSD:HKLM\...\Drivers32\"wavemapper"="msacm32.drv"

O52 - TDSD:HKLM\...\Drivers32\"vidc.uyvy"="msyuv.dll"

O52 - TDSD:HKLM\...\Drivers32\"vidc.yuy2"="msyuv.dll"

O52 - TDSD:HKLM\...\Drivers32\"vidc.yvyu"="msyuv.dll"

O52 - TDSD:HKLM\...\Drivers32\"vidc.iyuv"="iyuv_32.dll"

O52 - TDSD:HKLM\...\Drivers32\"vidc.i420"="i420vfw.dll"

O52 - TDSD:HKLM\...\Drivers32\"vidc.yvu9"="tsbyuv.dll"

O52 - TDSD:HKLM\...\Drivers32\"msacm.l3acm"="C:\Windows\system32\l3codecp.acm"

O52 - TDSD:HKLM\...\Drivers32\"vidc.cvid"="iccvid.dll"

O52 - TDSD:HKLM\...\Drivers32\"wave"="wdmaud.drv"

O52 - TDSD:HKLM\...\Drivers32\"midi"="wdmaud.drv"

O52 - TDSD:HKLM\...\Drivers32\"mixer"="wdmaud.drv"

O52 - TDSD:HKLM\...\Drivers32\"aux"="wdmaud.drv"

O52 - TDSD:HKLM\...\Drivers32\"msacm.lhacm"="lhacm.acm"

O52 - TDSD:HKLM\...\Drivers32\"vidc.yv12"="DivX.dll"

O52 - TDSD:HKLM\...\Drivers32\"msacm.siren"="sirenacm.dll"

O52 - TDSD:HKLM\...\Drivers32\"msacm.l3codec"="C:\Windows\system32\l3codecp.acm"

O52 - TDSD:HKLM\...\Drivers32\"vidc.DIVX"="DivX.dll"
 
 

End of the scan:

Deinstallie die Askbar. Du hast dir Navipromo vom Messenger Plus geholt, bei seiner Installation.

ok, ist unten...
was muss ich noch machen?

Was ist unten? Hast du Askbar deinstalliert?

jap askbar ist deinstalliert

Perfekt.

Mache bitte einen Kaspersky Online Scan.

Hier der Link zum Online Scan von Kaspersky: Kaspersky Online Scanner