Trojaner-Board - nach login nur blauen Hintergrund und Mauszeiger

Hallo zusammen
Ich habe seit gestern folgendes Problem:
PC startet normal. Nach dem ich mich aber einlogge, erscheint ein leerer desktop. nur die Maus funktioniert, kein Contrl-Alt Del nichts !!
Wenn ich mich aber als Admin einlogge geht alles.
Auch wenn ich im Abgesicherten Modus Starte (X- Professional übrigens :rolleyes: ) geht es.
Virenscan mit McAffe enterprise 8.5 -> nichts
Spybot-> nichts
Letzten freitag lief noch alles. Habe dann den Wiederherstellungpunkt zurückgesetzt -> nichts
Habe ein komplettes Acronis Backup (ca. 2 Wochen alt) zurück geladen-> nichts. Muss mir wohl schon länger war geholt haben, dass aber erst nach dem Freitag den 13. aktiv wurde :koch:
Dann habe ich per zufall rausgefunden dass wenn ich das Netzwerkkabel beim einlogen rausgezugen habe alles läuft. Kann es dann auch wieder reinstecken und alles bestens !!!!
Bin zur zeit etwas ratlos.

Folgend noch das hijackthis.log

Besten Dank schon mal für eure Bemühungen

Logfile of HijackThis v1.99.1
Scan saved at 00:58:25, on 18.04.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe
C:\Programme\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
C:\Programme\Symantec\pcAnywhere\awhost32.exe
C:\WINDOWS\System32\GEARSec.exe
C:\Programme\LogMeIn\RaMaint.exe
C:\Programme\LogMeIn\LogMeIn.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Network Associates\Common Framework\FrameworkService.exe
C:\Programme\LogMeIn\LogMeInSystray.exe
C:\Programme\Network Associates\VirusScan\Mcshield.exe
C:\Programme\Network Associates\VirusScan\VsTskMgr.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programme\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\Programme\Symantec\Norton Ghost\Agent\PQV2iSvc.exe
C:\Programme\Gemeinsame Dateien\XCPCSync\Translators\SyACT34\ActAgent.exe
C:\Programme\Gemeinsame Dateien\XCPCMenu.exe
C:\Programme\Winamp\Winampa.exe
C:\Programme\Java\jre1.5.0_10\bin\jusched.exe
C:\Programme\Analog Devices\SoundMAX\SMTray.exe
C:\Programme\DU Meter\DUMeter.exe
C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Programme\Network Associates\VirusScan\SHSTAT.EXE
C:\Programme\Network Associates\Common Framework\UpdaterUI.exe
C:\Programme\Gemeinsame Dateien\Network Associates\TalkBack\TBMon.exe
C:\Programme\Acronis\TrueImageWorkstation\TrueImageMonitor.exe
C:\Programme\Acronis\TrueImageWorkstation\TimounterMonitor.exe
C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
C:\Programme\QuickTime\qttask.exe
C:\Programme\iTunes\iTunesHelper.exe
C:\Programme\EPSON\Creativity Suite\Event Manager\EEventManager.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\XtenNetworksInc\eyeBeam\eyeBeam.exe
C:\Programme\Skype\Phone\Skype.exe
C:\Programme\Microsoft ActiveSync\Wcescomm.exe
C:\Programme\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\WINDOWS\system32\PGPsdkServ.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Programme\C-Channel\MyPen\MyPen.exe
C:\Programme\PGP Corporation\PGP for Windows XP\PGPtray.exe
C:\Programme\ACT\SideACT.exe
C:\Programme\WinZip\WZQKPICK.EXE
C:\Programme\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\usbdlm\USBDLM.exe
C:\Programme\Skype\Plugin Manager\SkypePM.exe
C:\Programme\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Programme\Java\jre1.5.0_10\bin\jucheck.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Dokumente und Einstellungen\rih\Lokale Einstellungen\Temp\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ch/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.compaq.com/1Q00CDT/0407/bl8.asp
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.compaq.com/1Q00CDT/0407/bl7.asp
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Suchspur - {5D945E9A-DC10-4670-83EB-99DAA616628A} - C:\WINDOWS\system32\Suchspur.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.5.0_10\bin\ssv.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [XTNDConnect PC - SyACT34] C:\Programme\Gemeinsame Dateien\XCPCSync\Translators\SyACT34\ActAgent.exe
O4 - HKLM\..\Run: [XTNDConnect PC] C:\Programme\Gemeinsame Dateien\XCPCMenu.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Programme\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [Smapp] C:\Programme\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [SetRefresh] C:\Programme\Compaq\SetRefresh\SetRefresh.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [DU Meter] C:\Programme\DU Meter\DUMeter.exe
O4 - HKLM\..\Run: [CloneCDElbyCDFL] "C:\Programme\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL
O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Programme\LogMeIn\LogMeInSystray.exe"
O4 - HKLM\..\Run: [ShStatEXE] "C:\Programme\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Programme\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Programme\Gemeinsame Dateien\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Programme\Acronis\TrueImageWorkstation\TrueImageMonitor.exe
O4 - HKLM\..\Run: [AcronisTimounterMonitor] C:\Programme\Acronis\TrueImageWorkstation\TimounterMonitor.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programme\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [EEventManager] C:\Programme\EPSON\Creativity Suite\Event Manager\EEventManager.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [eyeBeam SIP Client] "C:\Programme\XtenNetworksInc\eyeBeam\eyeBeam.exe"
O4 - HKCU\..\Run: [Skype] "C:\Programme\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Programme\Microsoft ActiveSync\Wcescomm.exe"
O4 - Startup: ACT!.lnk = C:\Programme\ACT\act.exe
O4 - Startup: Microsoft Office Outlook starten.lnk = C:\Programme\Microsoft Office\OFFICE11\OUTLOOK.EXE
O4 - Startup: Mozilla Thunderbird.lnk = C:\Programme\Mozilla Thunderbird\thunderbird.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Programme\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: MyPen.lnk = ?
O4 - Global Startup: PGPtray.lnk = ?
O4 - Global Startup: SideACT!.lnk = C:\Programme\ACT\SideACT.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programme\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Suchen - res://C:\WINDOWS\system32\Suchspur.dll/Suchspur.HTM
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Mobilen Favoriten erstellen... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {156BF4B7-AE3A-4365-BD88-95A75AF8F09D} (HPSDDX Class) - http://www.hp.com/cpso-support-new/SDD/hpsddObjSigned.cab
O16 - DPF: {210D0CBC-8B17-48D1-B294-1A338DD2EB3A} (VatCtrl Class) - http://192.168.XXX.129/VatDec.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://192.168.XXX.49:8765/activex/AxisCamControl.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - file://E:\AUTORUN\Flash\swflash.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O17 - HKLM\System\CCS\Services\Tcpip\..\{B1E7C564-BD5E-450F-947D-D3CA0A8D86EE}: NameServer = 62.2.24.162,62.2.17.60
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: LMIinit - C:\WINDOWS\SYSTEM32\LMIinit.dll
O20 - Winlogon Notify: PCANotify - C:\WINDOWS\SYSTEM32\PCANotify.dll
O20 - Winlogon Notify: style32 - C:\WINDOWS\q3151125_disk.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Acronis Remote Agent (AcronisAgent) - Acronis - C:\Programme\Gemeinsame Dateien\Acronis\Agent\agent.exe
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe
O23 - Service: Adobe Active File Monitor (AdobeActiveFileMonitor) - Unknown owner - C:\Programme\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: pcAnywhere Host-Modul (awhost32) - Symantec Corporation - C:\Programme\Symantec\pcAnywhere\awhost32.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Programme\LogMeIn\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Programme\LogMeIn\LogMeIn.exe
O23 - Service: McAfee Framework-Dienst (McAfeeFramework) - Network Associates, Inc. - C:\Programme\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Programme\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Programme\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: Norton Ghost - Symantec Corporation - C:\Programme\Symantec\Norton Ghost\Agent\PQV2iSvc.exe
O23 - Service: PGPsdkService (PGPsdkServ) - PGP Corporation - C:\WINDOWS\system32\PGPsdkServ.exe
O23 - Service: Photoshop Elements Device Connect (PhotoshopElementsDeviceConnect) - Unknown owner - C:\Programme\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programme\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: USBDLM - Uwe Sieber - www.uwe-sieber.de - C:\Programme\usbdlm\USBDLM.exe

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Header
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
find.bat Version 2007.04.18.05
Installationssprache Englisch
find.bat im normalen Modus ausgefuehrt

Microsoft Windows XP [Version 5.1.2600]
Thu Apr 19 20:27:04 2007 => Version 9.1.9 (C:\DOKUME~1\***\LOKALE~1\Temp\mexe.com)
Thu Apr 19 20:25:15 2007 => Virus Database Date: 4/18/2007
Thu Apr 19 20:26:10 2007 => Virus Database Date: 4/19/2007
Thu Apr 19 23:12:39 2007 => Virus Database Date: 4/19/2007
Fri Apr 20 08:01:52 2007 => Virus Database Date: 4/19/2007
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Infektionsmeldungen
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Thu Apr 19 20:28:01 2007 => System found infected with ezula Spyware/Adware (internet.url)! Action taken: No Action Taken.
Thu Apr 19 20:28:13 2007 => System found infected with savenow Adware (C:\WINDOWS\system32\unrar.dll)! Action taken: No Action Taken.
Thu Apr 19 20:27:38 2007 => Object "helpexpress Spyware/Adware" found in File System! Action Taken: No Action Taken.
Thu Apr 19 20:27:41 2007 => Object "helpexpress Spyware/Adware" found in File System! Action Taken: No Action Taken.
Thu Apr 19 20:28:18 2007 => Object "Possible Fujacks-type Worm" found in File System! Action Taken: No Action Taken.
~~~~~~~~~~~
Dateien
~~~~~~~~~~~
~~~~ Infected files
~~~~~~~~~~~
Thu Apr 19 20:28:58 2007 => File C:\WINDOWS\system32\checkIn.dll.old//UPX infected by "Trojan.Win32.Dialer.ks" Virus! Action Taken: No Action Taken.
Thu Apr 19 20:30:00 2007 => File C:\WINDOWS\system32\hhk.dll_tobedeleted infected by "Trojan.Win32.Puper.ax" Virus! Action Taken: No Action Taken.
Thu Apr 19 20:32:24 2007 => File C:\WINDOWS\system32\msmsgs.exe.old//FSG infected by "Trojan-Downloader.Win32.Small.bkg" Virus! Action Taken: No Action Taken.
Thu Apr 19 20:33:08 2007 => File C:\WINDOWS\system32\ole32vbs.exe.old//FSG infected by "Trojan.Win32.Favadd.aj" Virus! Action Taken: No Action Taken.
Thu Apr 19 22:14:47 2007 => File C:\System Volume Information\_restore{57A6823A-1951-404C-9B13-3C57FE463739}\RP198\A0034232.exe//UPX infected by "Backdoor.Win32.Agent.abv" Virus! Action Taken: No Action Taken.
Thu Apr 19 22:29:16 2007 => File C:\WINDOWS\system32\checkIn.dll.old//UPX infected by "Trojan.Win32.Dialer.ks" Virus! Action Taken: No Action Taken.
Thu Apr 19 22:29:54 2007 => File C:\WINDOWS\system32\hhk.dll_tobedeleted infected by "Trojan.Win32.Puper.ax" Virus! Action Taken: No Action Taken.
Thu Apr 19 22:30:04 2007 => File C:\WINDOWS\system32\LogFiles\A7271900.so infected by "Trojan.Win32.Small.ev" Virus! Action Taken: No Action Taken.
Thu Apr 19 22:30:11 2007 => File C:\WINDOWS\system32\msmsgs.exe.old//FSG infected by "Trojan-Downloader.Win32.Small.bkg" Virus! Action Taken: No Action Taken.
Thu Apr 19 22:30:18 2007 => File C:\WINDOWS\system32\ole32vbs.exe.old//FSG infected by "Trojan.Win32.Favadd.aj" Virus! Action Taken: No Action Taken.
~~~~~~~~~~~
~~~~ Tagged files
~~~~~~~~~~~
Thu Apr 19 20:27:07 2007 => File C:\WINDOWS\system32\LMIinit.dll tagged as "not-a-virus:RemoteAdmin.Win32.RemotelyAnywhere.a". No Action Taken.
Thu Apr 19 20:27:15 2007 => File C:\WINDOWS\system32\Suchspur.dll//UPX tagged as "not-a-virus:AdWare.Win32.Stud.c". Action Taken: No Action Taken.
Thu Apr 19 20:27:19 2007 => File C:\WINDOWS\system32\LMIinit.dll tagged as "not-a-virus:RemoteAdmin.Win32.RemotelyAnywhere.a". No Action Taken.
Thu Apr 19 20:27:30 2007 => File C:\Programme\LogMeIn\RaMaint.exe tagged as "not-a-virus:RemoteAdmin.Win32.RemotelyAnywhere.a". No Action Taken.
Thu Apr 19 20:31:14 2007 => File C:\WINDOWS\system32\LMIinit.dll tagged as "not-a-virus:RemoteAdmin.Win32.RemotelyAnywhere.a". No Action Taken.
Thu Apr 19 20:31:14 2007 => File C:\WINDOWS\system32\LMIinit.dll.000.bak tagged as "not-a-virus:RemoteAdmin.Win32.RemotelyAnywhere.a". No Action Taken.
Thu Apr 19 20:33:37 2007 => File C:\WINDOWS\system32\Suchspur.dll//UPX tagged as "not-a-virus:AdWare.Win32.Stud.c". Action Taken: No Action Taken.
Thu Apr 19 21:28:09 2007 => File C:\Programme\LogMeIn\LMIinit.dll tagged as "not-a-virus:RemoteAdmin.Win32.RemotelyAnywhere.a". No Action Taken.
Thu Apr 19 21:28:10 2007 => File C:\Programme\LogMeIn\ramaint.exe tagged as "not-a-virus:RemoteAdmin.Win32.RemotelyAnywhere.a". No Action Taken.
Thu Apr 19 21:28:16 2007 => File C:\Programme\LogMeIn\update\2-30-537.bak\ramaint.exe tagged as "not-a-virus:RemoteAdmin.Win32.RemotelyAnywhere.a". No Action Taken.
Thu Apr 19 21:28:17 2007 => File C:\Programme\LogMeIn\update\2-30-547.bak\LMIinit.dll tagged as "not-a-virus:RemoteAdmin.Win32.RemotelyAnywhere.a". No Action Taken.
Thu Apr 19 21:28:17 2007 => File C:\Programme\LogMeIn\update\2-30-547.bak\LogMeIn.exe tagged as "not-a-virus:RemoteAdmin.Win32.RemotelyAnywhere.a". No Action Taken.
Thu Apr 19 21:28:18 2007 => File C:\Programme\LogMeIn\update\2-30-547.bak\ramaint.exe tagged as "not-a-virus:RemoteAdmin.Win32.RemotelyAnywhere.a". No Action Taken.
Thu Apr 19 22:30:03 2007 => File C:\WINDOWS\system32\LMIinit.dll tagged as "not-a-virus:RemoteAdmin.Win32.RemotelyAnywhere.a". No Action Taken.
Thu Apr 19 22:30:03 2007 => File C:\WINDOWS\system32\LMIinit.dll.000.bak tagged as "not-a-virus:RemoteAdmin.Win32.RemotelyAnywhere.a". No Action Taken.
Thu Apr 19 22:31:27 2007 => File C:\WINDOWS\system32\Suchspur.dll//UPX tagged as "not-a-virus:AdWare.Win32.Stud.c". Action Taken: No Action Taken.
~~~~~~~~~~~
~~~~ Offending files
~~~~~~~~~~~
Thu Apr 19 20:28:01 2007 => Offending file found: C:\Dokumente und Einstellungen\***\Favoriten\importierte lesezeichen\ordner _persönliche symbolleiste_\internet.url
Thu Apr 19 20:28:13 2007 => Offending file found: C:\WINDOWS\system32\unrar.dll
~~~~~~~~~~~
Ordner
~~~~~~~~~~~
Thu Apr 19 20:27:41 2007 => Offending Folder found: C:\Programme\aveo
~~~~~~~~~~~
Registry
~~~~~~~~~~~
Thu Apr 19 20:27:38 2007 => Offending Key found: HKLM\Software\aveo !!!
Thu Apr 19 20:28:18 2007 => Offending Key found: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{54c49f11-503d-11da-88db-000ffe07c3bd} !!!

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Diverses
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~
Prozesse und Module
~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~
Scanfehler
~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~
Hosts-Datei
~~~~~~~~~~~~~~~~~~~~~~
DataBasePath REG_EXPAND_SZ %SystemRoot%\System32\drivers\etc
C:\WINDOWS\system32\drivers\etc\hosts:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Statistiken:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Thu Apr 19 23:12:39 2007 => Total Critical Objects: 31
Thu Apr 19 23:12:39 2007 => Total Disinfected Objects: 0
Thu Apr 19 23:12:39 2007 => Total Objects Renamed: 0
Thu Apr 19 23:12:39 2007 => Total Deleted Objects: 0
Thu Apr 19 23:12:39 2007 => Total Errors: 381
Thu Apr 19 23:12:39 2007 => Time Elapsed: 02:45:31
Thu Apr 19 23:12:39 2007 => Total Objects Scanned: 172480
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan-Optionen
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Thu Apr 19 20:27:04 2007 => Memory Check: Enabled
Thu Apr 19 20:27:04 2007 => Registry Check: Enabled
Thu Apr 19 20:27:04 2007 => System Folder Check: Enabled
Thu Apr 19 20:27:04 2007 => System Area Check: Disabled
Thu Apr 19 20:27:04 2007 => Services Check: Enabled
Thu Apr 19 20:27:04 2007 => Drive Check: Disabled
Thu Apr 19 20:27:04 2007 => All Drive Check :Enabled
Thu Apr 19 20:27:04 2007 => All Drive Check :Enabled