Trojaner-Board - Brauche dringend Hilfe!!! Hab mir da was eingefangen...

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - Brauche dringend Hilfe!!! Hab mir da was eingefangen... (https://www.trojaner-board.de/53801-brauche-dringend-hilfe-hab-mir-eingefangen.html)

Brauche dringend Hilfe!!! Hab mir da was eingefangen...

Hallo :heulen:

Ich habe seit gestern ein Problem; Bin mir nicht so ganz sicher was es ist, vermute mal, dass es sich um einen msn Wurm handelt...

Hier das Logfile; falls das jemandem weiterhilft:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:05:36, on 11.6.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Gemeinsame Dateien\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Gemeinsame Dateien\Ahead\lib\NMBgMonitor.exe
C:\Programme\MSN Messenger\msnmsgr.exe
C:\PROGRA~1\ICQ6\ICQ.exe
C:\Dokumente und Einstellungen\1. Vicky Koller\Lokale Einstellungen\Anwendungsdaten\YouTube\Uploader\youtubeuploader.exe
C:\Programme\MSN Messenger\usnsvc.exe
C:\Programme\Internet Explorer\IEXPLORE.EXE
C:\Dokumente und Einstellungen\1. Vicky Koller\Lokale Einstellungen\Temporary Internet Files\Content.IE5\X7W5YWWS\HiJackThis[1].exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ch/
O2 - BHO: (no name) - {03657894-7C44-4EF3-A162-E70D19564373} - C:\WINDOWS\system32\cbXqOFXn.dll
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Programme\Gemeinsame Dateien\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: (no name) - {2CCEF7C2-E16F-44A2-95CF-803F43FA79DA} - C:\WINDOWS\system32\nnnnMFvT.dll
O2 - BHO: {1eb1b4cf-eda9-6ddb-d494-ac646dbed055} - {550debd6-46ca-494d-bdd6-9adefc4b1be1} - C:\WINDOWS\system32\yttgaygj.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Programme\FlashGet\getflash.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Programme\Gemeinsame Dateien\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
O4 - HKLM\..\Run: [ccApp] C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Windows Controls Center] winudmr.exe
O4 - HKLM\..\Run: [40a41428] rundll32.exe "C:\WINDOWS\system32\aiqkedku.dll",b
O4 - HKLM\..\Run: [BM439727b4] Rundll32.exe "C:\WINDOWS\system32\ichxoiyc.dll",s
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programme\Gemeinsame Dateien\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Programme\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ICQ] "C:\PROGRA~1\ICQ6\ICQ.exe" silent
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: YouTube Uploader.lnk = C:\Dokumente und Einstellungen\1. Vicky Koller\Lokale Einstellungen\Anwendungsdaten\YouTube\Uploader\youtubeuploader.exe
O8 - Extra context menu item: &Alles mit FlashGet laden - C:\Programme\FlashGet\jc_all.htm
O8 - Extra context menu item: &Mit FlashGet laden - C:\Programme\FlashGet\jc_link.htm
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Programme\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Programme\FlashGet\FlashGet.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe
O9 - Extra button: @C:\Programme\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Programme\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/DE-CH/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1193946358328
O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/PhtPkMSN.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab57213.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0B29BB01-E7D6-4C80-BE2A-6CBE3FF4B34E}: NameServer = 195.186.1.111,195.186.1.110
O17 - HKLM\System\CCS\Services\Tcpip\..\{3F77CBF3-D90B-43DA-8F34-1A0FBBF15757}: NameServer = 195.186.1.111,195.186.1.110
O17 - HKLM\System\CCS\Services\Tcpip\..\{F2D68FAC-32BB-43C2-9804-E32EB168E711}: NameServer = 195.186.1.111,195.186.1.110
O17 - HKLM\System\CCS\Services\Tcpip\..\{FCA63F54-85D9-472F-AA4A-DAB76615E0EE}: NameServer = 195.186.1.111,195.186.1.110
O17 - HKLM\System\CS1\Services\Tcpip\..\{0B29BB01-E7D6-4C80-BE2A-6CBE3FF4B34E}: NameServer = 195.186.1.111,195.186.1.110
O17 - HKLM\System\CS2\Services\Tcpip\..\{0B29BB01-E7D6-4C80-BE2A-6CBE3FF4B34E}: NameServer = 195.186.1.111,195.186.1.110
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: cbXqOFXn - C:\WINDOWS\SYSTEM32\cbXqOFXn.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Programme\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Programme\Norton Internet Security\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Programme\TuneUp Utilities 2004\WinStylerThemeSvc.exe
O23 - Service: XYJZNPYN - Unknown owner - C:\DOKUME~1\RUTHKO~1\LOKALE~1\Temp\XYJZNPYN.exe (file missing)

--
End of file - 10065 bytes

Danke für eure Hilfe:confused::confused::confused:

Was verleitet dich zu der Annahme, dass es der MSN-Wurm ist?

Erstell bitte ein Log mit Malwarebytes und anschließend ein Log mit DSS:

DSS

Lade dir DSS
Schließe alle Anwendungen und führe DSS.exe dann mit einem Doppelklick aus
Führe während DSS arbeitet bitte keine anderen Aktionen durch
Am Ende öffnen sich 2 Datein main.txt und extra.txt
Poste den Inhalt beider Dateien hier

lg myrtille

EDIT: Hi Chris! :)

Hi,

- oh, myrtille war schneller -
- it's your turn -
- äh, und folge dann noch den Anweisungen von myrtille (DSS ausführen und posten)

chris and out

Bitte folgende Files prüfen:

Zitat:

C:\WINDOWS\system32\winudmr.exe oder in
C:\WINDOWS\winudmr.exe
C:\WINDOWS\system32\cbXqOFXn.dll
C:\DOKUME~1\RUTHKO~1\LOKALE~1\Temp\XYJZNPYN.exe

VirusTotal - Free Online Virus and Malware Scan
Oben auf der Seite --> auf Durchsuchen klicken --> Datei aussuchen (oder gleich die Datei mit korrektem Pfad einkopieren) --> Doppelklick auf die zu prüfende Datei --> klick auf "Send"... jetzt abwarten - dann mit der rechten Maustaste den Text markieren -> kopieren - einfügen
Poste jedes Ergebnis mit Filename

Also:
Anleitung Avenger (by swandog46)

1.) Lade dir das Tool Avenger und speichere es auf dem Desktop:

http://swandog46.geekstogo.com/res/images/avenger.jpg

2.) Das Programm so einstellen wie es auf dem Bild zu sehen ist.

Kopiere nun folgenden Text in das weiße Feld:
(bei -> "input script here")

Code:



registry keys to delete:

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cbXqOFXn
 

Registry values to delete:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run|Windows Controls Center

HKLM\Software\Microsoft\Windows\CurrentVersion\Run|40a41428

HKLM\Software\Microsoft\Windows\CurrentVersion\Run|BM439727b4

 

Files to delete:

C:\WINDOWS\system32\cbXqOFXn.dll

C:\WINDOWS\system32\nnnnMFvT.dll

C:\WINDOWS\system32\yttgaygj.dll

C:\WINDOWS\system32\aiqkedku.dll

C:\WINDOWS\system32\ichxoiyc.dll

C:\DOKUME~1\RUTHKO~1\LOKALE~1\Temp\XYJZNPYN.exe

3.) Schliesse nun alle Programme (vorher notfalls abspeichern!) und Browser-Fenster, nach dem Ausführen des Avengers wird das System neu gestartet.

4.) Um den Avenger zu starten klicke auf -> Execute
Dann bestätigen mit "Yes" das der Rechner neu startet!

5.) Nachdem das System neu gestartet ist, findest du hier einen Report vom Avenger -> C:\avenger.txt
Öffne die Datei mit dem Editor und kopiere den gesamten Text in deinen Beitrag hier am Trojaner-Board.

Hijackthis, fixen:
öffne das HijackThis -- Button "scan" -- vor den nachfolgenden Einträge Häkchen setzen -- Button "Fix checked" -- PC neustarten
Beim fixen müssen alle Programme geschlossen sein!

Code:

O2 - BHO: (no name) - {03657894-7C44-4EF3-A162-E70D19564373} - C:\WINDOWS\system32\cbXqOFXn.dll

O2 - BHO: (no name) - {2CCEF7C2-E16F-44A2-95CF-803F43FA79DA} - C:\WINDOWS\system32\nnnnMFvT.dll

O2 - BHO: {1eb1b4cf-eda9-6ddb-d494-ac646dbed055} - {550debd6-46ca-494d-bdd6-9adefc4b1be1} - C:\WINDOWS\system32\yttgaygj.dll

O4 - HKLM\..\Run: [Windows Controls Center] winudmr.exe

O4 - HKLM\..\Run: [40a41428] rundll32.exe "C:\WINDOWS\system32\aiqkedku.dll",b

O4 - HKLM\..\Run: [BM439727b4] Rundll32.exe "C:\WINDOWS\system32\ichxoiyc.dll",s

O20 - Winlogon Notify: cbXqOFXn - C:\WINDOWS\SYSTEM32\cbXqOFXn.dll

O23 - Service: XYJZNPYN - Unknown owner - C:\DOKUME~1\RUTHKO~1\LOKALE~1\Temp\XYJZNPYN.exe (file missing)

Scanne danach mit Antimalewarebyte, Funde entfernen lassen und Log posten:
http://www.trojaner-board.de/51187-m...i-malware.html

Chris

ok gut, dann werd ich das mal machen...

ich denke es ist der msn wurm, weil meine "probleme" erst auftraten, als mir meine freundin (mit der ich gechattet hatte) eine datei sendete, die ich dummerweise angenommen und ausgeführt habe...

@myrtille; hab ich gemacht...

Malwarebytes' Anti-Malware 1.17
Datenbank Version: 846

16:39:29 11.6.2008
mbam-log-6-11-2008 (16-39-09).txt

Scan Art: Komplett Scan (C:\|)
Objekte gescannt: 158637
Scan Dauer: 1 hour(s), 8 minute(s), 22 second(s)

Infizierte Speicher Prozesse: 0
Infizierte Speicher Module: 3
Infizierte Registrierungsschlüssel: 12
Infizierte Registrierungswerte: 3
Infizierte Datei Objekte der Registrierung: 2
Infizierte Verzeichnisse: 6
Infizierte Dateien: 22

Infizierte Speicher Prozesse:
(Keine Malware Objekte gefunden)

Infizierte Speicher Module:
C:\WINDOWS\system32\aiqkedku.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\nnnnMFvT.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\cbXqOFXn.dll (Trojan.Vundo) -> No action taken.

Infizierte Registrierungsschlüssel:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2ccef7c2-e16f-44a2-95cf-803f43fa79da} (Trojan.Vundo) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{2ccef7c2-e16f-44a2-95cf-803f43fa79da} (Trojan.Vundo) -> No action taken.
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{1962c5bc-e475-465b-823b-133e711bceb9} (Adware.Starware) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Malware.Trace) -> No action taken.
HKEY_CURRENT_USER\Software\Microsoft\rdfa (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affltid (Malware.Trace) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{03657894-7c44-4ef3-a162-e70d19564373} (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{03657894-7c44-4ef3-a162-e70d19564373} (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cbxqofxn (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> No action taken.

Infizierte Registrierungswerte:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\40a41428 (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BM439727b4 (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{03657894-7c44-4ef3-a162-e70d19564373} (Trojan.Vundo) -> No action taken.

Infizierte Datei Objekte der Registrierung:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\nnnnmfvt -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\nnnnmfvt -> No action taken.

Infizierte Verzeichnisse:
C:\Programme\2 find mp3 (Adware.180Solutions) -> No action taken.
C:\Programme\2 find mp3\Data (Adware.180Solutions) -> No action taken.
C:\Programme\2 find mp3\Downloads (Adware.180Solutions) -> No action taken.
C:\Programme\2 find mp3\Incomplete (Adware.180Solutions) -> No action taken.
C:\WINDOWS\privacy_danger (Trojan.FakeAlert) -> No action taken.
C:\WINDOWS\privacy_danger\images (Trojan.FakeAlert) -> No action taken.

Infizierte Dateien:
C:\WINDOWS\system32\aiqkedku.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\ukdekqia.ini (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\nnnnMFvT.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\TvFMnnnn.ini (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\TvFMnnnn.ini2 (Trojan.Vundo) -> No action taken.
C:\Programme\2 find mp3\2 Find MP3 Quick Start.url (Adware.180Solutions) -> No action taken.
C:\Programme\2 find mp3\2FindMP3.exe (Adware.180Solutions) -> No action taken.
C:\Programme\2 find mp3\unins000.dat (Adware.180Solutions) -> No action taken.
C:\Programme\2 find mp3\unins000.exe (Adware.180Solutions) -> No action taken.
C:\Programme\2 find mp3\Data\2FindMP3.dat (Adware.180Solutions) -> No action taken.
C:\Programme\2 find mp3\Data\Engines.dat (Adware.180Solutions) -> No action taken.
C:\Programme\2 find mp3\Data\SearchKeys.txt (Adware.180Solutions) -> No action taken.
C:\Programme\2 find mp3\Incomplete\genie in a bottle.mp3 (Adware.180Solutions) -> No action taken.
C:\Programme\2 find mp3\Incomplete\mmm mmm mmm.mp3 (Adware.180Solutions) -> No action taken.
C:\WINDOWS\privacy_danger\images\capt.gif (Trojan.FakeAlert) -> No action taken.
C:\WINDOWS\privacy_danger\images\danger.jpg (Trojan.FakeAlert) -> No action taken.
C:\WINDOWS\privacy_danger\images\down.gif (Trojan.FakeAlert) -> No action taken.
C:\WINDOWS\privacy_danger\images\spacer.gif (Trojan.FakeAlert) -> No action taken.
C:\WINDOWS\cookies.ini (Malware.Trace) -> No action taken.
C:\WINDOWS\system32\ichxoiyc.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\cbXqOFXn.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\clkcnt.txt (Trojan.Vundo) -> No action taken.

von DSS gab es nur main.txt...

Deckard's System Scanner v20071014.68
Run by 1. Vicky Koller on 2008-06-11 16:46:00
Computer is in Normal Mode.
--------------------------------------------------------------------------------

Percentage of Memory in Use: 88% (more than 75%).
Total Physical Memory: 503 MiB (512 MiB recommended).

-- HijackThis (run as 1. Vicky Koller.exe) -------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:46:04, on 11.6.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSvcHst.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Gemeinsame Dateien\Ahead\lib\NMBgMonitor.exe
C:\Programme\MSN Messenger\msnmsgr.exe
C:\PROGRA~1\ICQ6\ICQ.exe
C:\Dokumente und Einstellungen\1. Vicky Koller\Lokale Einstellungen\Anwendungsdaten\YouTube\Uploader\youtubeuploader.exe
C:\Programme\MSN Messenger\usnsvc.exe
C:\Programme\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\explorer.exe
C:\Programme\Internet Explorer\IEXPLORE.EXE
C:\Dokumente und Einstellungen\1. Vicky Koller\Lokale Einstellungen\Temporary Internet Files\Content.IE5\X7W5YWWS\dss[1].exe
C:\DOKUME~1\1DF6E~1.VIC\LOKALE~1\TEMPOR~1\Content.IE5\X7W5YWWS\1VICKY~1.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Google
O2 - BHO: (no name) - {03657894-7C44-4EF3-A162-E70D19564373} - C:\WINDOWS\system32\cbXqOFXn.dll
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Programme\Gemeinsame Dateien\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: (no name) - {2CCEF7C2-E16F-44A2-95CF-803F43FA79DA} - C:\WINDOWS\system32\nnnnMFvT.dll
O2 - BHO: {1eb1b4cf-eda9-6ddb-d494-ac646dbed055} - {550debd6-46ca-494d-bdd6-9adefc4b1be1} - C:\WINDOWS\system32\yttgaygj.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Programme\FlashGet\getflash.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Programme\Gemeinsame Dateien\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
O4 - HKLM\..\Run: [ccApp] C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Windows Controls Center] winudmr.exe
O4 - HKLM\..\Run: [40a41428] rundll32.exe "C:\WINDOWS\system32\aiqkedku.dll",b
O4 - HKLM\..\Run: [BM439727b4] Rundll32.exe "C:\WINDOWS\system32\ichxoiyc.dll",s
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programme\Gemeinsame Dateien\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Programme\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ICQ] "C:\PROGRA~1\ICQ6\ICQ.exe" silent
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: YouTube Uploader.lnk = C:\Dokumente und Einstellungen\1. Vicky Koller\Lokale Einstellungen\Anwendungsdaten\YouTube\Uploader\youtubeuploader.exe
O8 - Extra context menu item: &Alles mit FlashGet laden - C:\Programme\FlashGet\jc_all.htm
O8 - Extra context menu item: &Mit FlashGet laden - C:\Programme\FlashGet\jc_link.htm
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Programme\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Programme\FlashGet\FlashGet.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe
O9 - Extra button: @C:\Programme\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Programme\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/DE-CH/.../GAME_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1193946358328
O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.co...p/PhtPkMSN.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary...o.cab56649.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary...t.cab57213.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary...r.cab56986.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0B29BB01-E7D6-4C80-BE2A-6CBE3FF4B34E}: NameServer = 195.186.1.111,195.186.1.110
O17 - HKLM\System\CCS\Services\Tcpip\..\{3F77CBF3-D90B-43DA-8F34-1A0FBBF15757}: NameServer = 195.186.1.111,195.186.1.110
O17 - HKLM\System\CCS\Services\Tcpip\..\{F2D68FAC-32BB-43C2-9804-E32EB168E711}: NameServer = 195.186.1.111,195.186.1.110
O17 - HKLM\System\CCS\Services\Tcpip\..\{FCA63F54-85D9-472F-AA4A-DAB76615E0EE}: NameServer = 195.186.1.111,195.186.1.110
O17 - HKLM\System\CS1\Services\Tcpip\..\{0B29BB01-E7D6-4C80-BE2A-6CBE3FF4B34E}: NameServer = 195.186.1.111,195.186.1.110
O17 - HKLM\System\CS2\Services\Tcpip\..\{0B29BB01-E7D6-4C80-BE2A-6CBE3FF4B34E}: NameServer = 195.186.1.111,195.186.1.110
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: cbXqOFXn - C:\WINDOWS\SYSTEM32\cbXqOFXn.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Programme\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Programme\Norton Internet Security\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Programme\TuneUp Utilities 2004\WinStylerThemeSvc.exe
O23 - Service: XYJZNPYN - Unknown owner - C:\DOKUME~1\RUTHKO~1\LOKALE~1\Temp\XYJZNPYN.exe (file missing)

--
End of file - 10146 bytes

-- Files created between 2008-05-11 and 2008-06-11 -----------------------------

2008-06-11 15:26:00 0 d-------- C:\Programme\Malwarebytes' Anti-Malware
2008-06-10 18:20:52 109056 --a------ C:\WINDOWS\system32\yttgaygj.dll
2008-06-10 18:19:16 92160 --a------ C:\WINDOWS\system32\aiqkedku.dll
2008-06-10 18:19:04 100352 --a------ C:\WINDOWS\system32\ichxoiyc.dll
2008-06-10 18:17:50 2453 --ahs---- C:\WINDOWS\system32\TvFMnnnn.ini2
2008-06-10 18:17:46 349696 --a------ C:\WINDOWS\system32\nnnnMFvT.dll
2008-06-10 18:12:40 32768 --a------ C:\WINDOWS\system32\cbXqOFXn.dll
2008-06-10 18:11:58 29334 -r-hs---- C:\WINDOWS\winudmr.exe
2008-05-23 11:37:48 0 d-------- C:\Programme\Picasa2
2008-05-23 11:25:24 0 d-------- C:\Programme\FotoWorks
2008-05-23 11:25:18 0 d-------- C:\Programme\mresreg
2008-05-21 16:34:53 0 d-------- C:\Programme\ICQ6

-- Find3M Report ---------------------------------------------------------------

2008-06-11 15:26:15 0 d-------- C:\Dokumente und Einstellungen\1. Vicky Koller\Anwendungsdaten\Malwarebytes
2008-06-11 14:43:52 1982 --a------ C:\WINDOWS\system32\tmp.reg
2008-06-11 07:48:39 0 d-------- C:\Programme\Gemeinsame Dateien\Symantec Shared
2008-06-11 00:25:55 0 d-------- C:\Dokumente und Einstellungen\1. Vicky Koller\Anwendungsdaten\Microsoft Games
2008-06-10 20:49:40 0 d-------- C:\Dokumente und Einstellungen\1. Vicky Koller\Anwendungsdaten\Skype
2008-06-10 18:35:35 0 d-------- C:\Programme\TuneUp Utilities 2004
2008-06-10 16:09:06 0 d-------- C:\Dokumente und Einstellungen\1. Vicky Koller\Anwendungsdaten\skypePM
2008-05-25 18:48:18 0 d-------- C:\Programme\FlashGet
2008-05-21 18:27:03 0 d-------- C:\Programme\Gemeinsame Dateien\Wise Installation Wizard
2008-05-21 16:45:46 0 d-------- C:\Dokumente und Einstellungen\1. Vicky Koller\Anwendungsdaten\ICQ
2008-05-21 16:41:20 0 d--h----- C:\Programme\InstallShield Installation Information
2008-05-05 18:41:21 0 d-------- C:\Programme\EA GAMES
2008-05-05 18:36:05 0 d-------- C:\Programme\YouTube Downloader
2008-05-01 00:47:47 0 d-------- C:\Programme\Messenger
2008-04-24 16:33:02 0 d-------- C:\Programme\Java
2008-04-19 19:42:49 0 d-------- C:\Programme\lang
2008-04-19 19:42:46 0 d-------- C:\Programme\Plugins
2008-04-19 19:42:40 0 d-------- C:\Programme\Gemeinsame Dateien
2008-04-19 19:42:40 0 d-------- C:\Programme\Gemeinsame Dateien\xing shared
2008-04-19 19:42:33 0 d-------- C:\Programme\Gemeinsame Dateien\Real
2008-04-19 19:42:24 0 d-------- C:\Programme\Setup
2008-03-30 17:39:39 425118 --a------ C:\WINDOWS\system32\perfh007.dat
2008-03-30 17:39:39 77924 --a------ C:\WINDOWS\system32\perfc007.dat
2008-03-20 18:43:26 7680 --ahs---- C:\Programme\Thumbs.db

-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{03657894-7C44-4EF3-A162-E70D19564373}]
10.06.2008 18:12 32768 --a------ C:\WINDOWS\system32\cbXqOFXn.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2CCEF7C2-E16F-44A2-95CF-803F43FA79DA}]
10.06.2008 18:17 349696 --a------ C:\WINDOWS\system32\nnnnMFvT.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{550debd6-46ca-494d-bdd6-9adefc4b1be1}]
10.06.2008 18:20 109056 --a------ C:\WINDOWS\system32\yttgaygj.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccApp"="C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe" [03.09.2006 09:04]
"QuickTime Task"="C:\Programme\QuickTime\qttask.exe" [29.06.2007 06:24]
"TkBellExe"="C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" [19.04.2008 19:41]
"Windows Controls Center"="winudmr.exe" [10.06.2008 18:11 C:\WINDOWS\winudmr.exe]
"40a41428"="C:\WINDOWS\system32\aiqkedku.dll" [10.06.2008 18:19]
"BM439727b4"="C:\WINDOWS\system32\ichxoiyc.dll" [10.06.2008 18:19]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"="C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit" []
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [04.08.2004 12:00]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Programme\Gemeinsame Dateien\Ahead\lib\NMBgMonitor.exe" [03.09.2005 15:18]
"msnmsgr"="C:\Programme\MSN Messenger\msnmsgr.exe" [19.01.2007 12:55]
"ICQ"="C:\PROGRA~1\ICQ6\ICQ.exe" [01.04.2008 12:40]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"NvMediaCenter"=RUNDLL32.EXE C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit

C:\Dokumente und Einstellungen\1. Vicky Koller\Startmen\Programme\Autostart\
YouTube Uploader.lnk - C:\Dokumente und Einstellungen\1. Vicky Koller\Lokale Einstellungen\Anwendungsdaten\YouTube\Uploader\youtubeuploader.exe [9.11.2007 14:33:08]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{03657894-7C44-4EF3-A162-E70D19564373}"= C:\WINDOWS\system32\cbXqOFXn.dll [10.06.2008 18:12 32768]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cbXqOFXn]
cbXqOFXn.dll 10.06.2008 18:12 32768 C:\WINDOWS\system32\cbXqOFXn.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\nnnnMFvT

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Adobe Reader - Schnellstart.lnk]
path=C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Reader - Schnellstart.lnk
backup=C:\WINDOWS\pss\Adobe Reader - Schnellstart.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C-Media Mixer]
Mixer.exe /startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
C:\Programme\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Symantec NetDriver Monitor]
C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer

*Newly Created Service* - COMHOST

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{621FCD24-4498-4324-A81E-07D331376EDF}]
C:\Programme\PixiePack Codec Pack\InstallerHelper.exe

-- End of Deckard's System Scanner: finished at 2008-06-11 16:47:13 ------------

@ Chris

die 3 dateien...

C:\WINDOWS\winudmr.exe:

Datei winudmr.exe empfangen 2008.06.10 20:45:10 (CET)
Status: Beendet

Ergebnis: 2/33 (6.06%)
Filter Drucken der Ergebnisse
Antivirus Version letzte aktualisierung Ergebnis
AhnLab-V3 - - -
AntiVir - - -
Authentium - - -
Avast - - -
AVG - - -
BitDefender - - -
CAT-QuickHeal - - -
ClamAV - - -
DrWeb - - Trojan.Inject.3473
eSafe - - -
eTrust-Vet - - -
Ewido - - -
F-Prot - - -
F-Secure - - -
FileAdvisor - - -
Fortinet - - -
GData - - -
Ikarus - - -
Kaspersky - - -
McAfee - - -
Microsoft - - VirTool:Win32/Injector.gen!B
NOD32v2 - - -
Norman - - -
Panda - - -
Prevx1 - - -
Rising - - -
Sophos - - -
Sunbelt - - -
Symantec - - -
TheHacker - - -
VBA32 - - -
VirusBuster - - -
Webwasher-Gateway - - -
weitere Informationen
MD5: 372d26f9a0578d9779bca756e912ad0c
SHA1: 425b97ec4d283ea864b22a861331a2d4e097d7bf
SHA256: 68698aab320d9a21119b77424989656447ea4100d752b38a7c3e5e2f533cf8f4
SHA512: 76c0f9f81019d41d75207950b556bd14dde2c3ca01114ce10c80e0ea98168bdc0bc19c0eafeda23297524679f0652134b25e793d84ff2eaede7d6cd79a3d4649

C:\WINDOWS\system32\cbXqOFXn.dll:

Datei byXPGVPG.dll empfangen 2008.06.10 16:49:36 (CET)
Status: Beendet

Ergebnis: 10/33 (30.30%)
Filter Drucken der Ergebnisse
Antivirus Version letzte aktualisierung Ergebnis
AhnLab-V3 - - -
AntiVir - - -
Authentium - - W32/Sinowal-based!Maximus
Avast - - Win32:VunDrop
AVG - - -
BitDefender - - -
CAT-QuickHeal - - -
ClamAV - - -
DrWeb - - -
eSafe - - Suspicious File
eTrust-Vet - - -
Ewido - - -
F-Prot - - W32/Sinowal-based!Maximus
F-Secure - - Vundo.gen179
FileAdvisor - - -
Fortinet - - -
GData - - Trojan.Win32.Monder.gen
Ikarus - - -
Kaspersky - - Trojan.Win32.Monder.gen
McAfee - - -
Microsoft - - Trojan:Win32/Vundo.gen!H
NOD32v2 - - -
Norman - - -
Panda - - Suspicious file
Prevx1 - - -
Rising - - -
Sophos - - -
Sunbelt - - -
Symantec - - -
TheHacker - - -
VBA32 - - -
VirusBuster - - -
Webwasher-Gateway - - Win32.Malware.gen!80 (suspicious)
weitere Informationen
MD5: 54a85efbfd084db9233f0f71ae363116
SHA1: d067cab713e46f63bf1f9970ba2df7fa8c832268
SHA256: a5a89842df6ebe5aadacb61d65b99b25ae6aeb0718b0dba676288399df3a31c4
SHA512: 10bfe9ccd878451f7adddc7823524aa474cfbbc25bd77bddfb2019746bd38b4d5287f1a58dc7de3d7b0ba8d60951d53885a1a4907500ec36d5acd917d10d2e89

C:\DOKUME~1\RUTHKO~1\LOKALE~1\Temp\XYJZNPYN.exe:

diese datei funktionierte nicht zum überprüfen...

Hi,
lass bitte Malwarebytes alle Funde löschen und poste danach ein neues DSS log :)

lg myrtille

.... noch das logfile von avenger...

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\godwmwne

*******************

Script file located at: \??\C:\kcsjlhis.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

File C:\WINDOWS\privacy_danger\index.htm deleted successfully.
File C:\WINDOWS\system32\cyvdfteu.ini deleted successfully.
File C:\WINDOWS\system32\kpjovhod.ini deleted successfully.
File C:\WINDOWS\system32\cyoxveks.ini deleted successfully.
File C:\WINDOWS\system32\aweixaqk.ini deleted successfully.
File C:\WINDOWS\system32\clobhahb.ini deleted successfully.
File C:\WINDOWS\system32\dldrftlv.ini deleted successfully.
File C:\WINDOWS\system32\iatnsbyg.ini deleted successfully.
File C:\WINDOWS\system32\scltknel.ini deleted successfully.
File C:\WINDOWS\system32\uoskrlai.ini deleted successfully.
File C:\WINDOWS\system32\fwecywmq.ini deleted successfully.
File C:\WINDOWS\system32\wvbjuojx.ini deleted successfully.
File C:\WINDOWS\system32\moymjffd.ini deleted successfully.
File C:\WINDOWS\system32\muonwlnp.ini deleted successfully.
File C:\WINDOWS\system32\lrvppcee.ini deleted successfully.
File C:\WINDOWS\system32\ljefxxxx.ini deleted successfully.
File C:\WINDOWS\system32\eaouotgn.ini deleted successfully.
File C:\WINDOWS\system32\cmjpkvws.ini deleted successfully.
File C:\WINDOWS\system32\rsxddkuf.ini deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

Logfile of The Avenger Version 2.0, (c) by Swandog46
Swandog46's Public Anti-Malware Tools

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File "C:\WINDOWS\system32\cbXqOFXn.dll" deleted successfully.
File "C:\WINDOWS\system32\nnnnMFvT.dll" deleted successfully.
File "C:\WINDOWS\system32\yttgaygj.dll" deleted successfully.
File "C:\WINDOWS\system32\aiqkedku.dll" deleted successfully.
File "C:\WINDOWS\system32\ichxoiyc.dll" deleted successfully.

Error: file "C:\DOKUME~1\RUTHKO~1\LOKALE~1\Temp\XYJZNPYN.exe" not found!
Deletion of file "C:\DOKUME~1\RUTHKO~1\LOKALE~1\Temp\XYJZNPYN.exe" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist

Registry key "HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cbXqOFXn" deleted successfully.
Registry value "HKLM\Software\Microsoft\Windows\CurrentVersion\Run|Windows Controls Center" deleted successfully.
Registry value "HKLM\Software\Microsoft\Windows\CurrentVersion\Run|40a41428" deleted successfully.
Registry value "HKLM\Software\Microsoft\Windows\CurrentVersion\Run|BM439727b4" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

@myrtille; ok mach ich...

Deckard's System Scanner v20071014.68
Run by 1. Vicky Koller on 2008-06-11 18:50:22
Computer is in Normal Mode.
--------------------------------------------------------------------------------

Total Physical Memory: 503 MiB (512 MiB recommended).

-- HijackThis (run as 1. Vicky Koller.exe) -------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:50:25, on 11.6.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSvcHst.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe
C:\Programme\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Gemeinsame Dateien\Ahead\lib\NMBgMonitor.exe
C:\Programme\MSN Messenger\msnmsgr.exe
C:\PROGRA~1\ICQ6\ICQ.exe
C:\Dokumente und Einstellungen\1. Vicky Koller\Lokale Einstellungen\Anwendungsdaten\YouTube\Uploader\youtubeuploader.exe
C:\Programme\MSN Messenger\usnsvc.exe
C:\Dokumente und Einstellungen\1. Vicky Koller\Lokale Einstellungen\Temporary Internet Files\Content.IE5\X7W5YWWS\dss[1].exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\1VICKY~1.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Google
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Programme\Gemeinsame Dateien\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Programme\FlashGet\getflash.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Programme\Gemeinsame Dateien\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
O4 - HKLM\..\Run: [ccApp] C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programme\Gemeinsame Dateien\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Programme\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ICQ] "C:\PROGRA~1\ICQ6\ICQ.exe" silent
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: YouTube Uploader.lnk = C:\Dokumente und Einstellungen\1. Vicky Koller\Lokale Einstellungen\Anwendungsdaten\YouTube\Uploader\youtubeuploader.exe
O8 - Extra context menu item: &Alles mit FlashGet laden - C:\Programme\FlashGet\jc_all.htm
O8 - Extra context menu item: &Mit FlashGet laden - C:\Programme\FlashGet\jc_link.htm
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Programme\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Programme\FlashGet\FlashGet.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe
O9 - Extra button: @C:\Programme\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Programme\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/DE-CH/.../GAME_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1193946358328
O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.co...p/PhtPkMSN.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary...o.cab56649.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary...t.cab57213.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary...r.cab56986.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0B29BB01-E7D6-4C80-BE2A-6CBE3FF4B34E}: NameServer = 195.186.1.111,195.186.1.110
O17 - HKLM\System\CCS\Services\Tcpip\..\{3F77CBF3-D90B-43DA-8F34-1A0FBBF15757}: NameServer = 195.186.1.111,195.186.1.110
O17 - HKLM\System\CCS\Services\Tcpip\..\{F2D68FAC-32BB-43C2-9804-E32EB168E711}: NameServer = 195.186.1.111,195.186.1.110
O17 - HKLM\System\CCS\Services\Tcpip\..\{FCA63F54-85D9-472F-AA4A-DAB76615E0EE}: NameServer = 195.186.1.111,195.186.1.110
O17 - HKLM\System\CS1\Services\Tcpip\..\{0B29BB01-E7D6-4C80-BE2A-6CBE3FF4B34E}: NameServer = 195.186.1.111,195.186.1.110
O17 - HKLM\System\CS2\Services\Tcpip\..\{0B29BB01-E7D6-4C80-BE2A-6CBE3FF4B34E}: NameServer = 195.186.1.111,195.186.1.110
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Programme\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Programme\Norton Internet Security\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Programme\TuneUp Utilities 2004\WinStylerThemeSvc.exe

--
End of file - 9243 bytes

-- Files created between 2008-05-11 and 2008-06-11 -----------------------------

2008-06-11 15:26:00 0 d-------- C:\Programme\Malwarebytes' Anti-Malware
2008-06-10 18:17:50 2492 --ahs---- C:\WINDOWS\system32\TvFMnnnn.ini2
2008-06-10 18:11:58 29334 -r-hs---- C:\WINDOWS\winudmr.exe
2008-05-23 11:37:48 0 d-------- C:\Programme\Picasa2
2008-05-23 11:25:24 0 d-------- C:\Programme\FotoWorks
2008-05-23 11:25:18 0 d-------- C:\Programme\mresreg
2008-05-21 16:34:53 0 d-------- C:\Programme\ICQ6

-- Find3M Report ---------------------------------------------------------------

2008-06-11 15:26:15 0 d-------- C:\Dokumente und Einstellungen\1. Vicky Koller\Anwendungsdaten\Malwarebytes
2008-06-11 14:43:52 1982 --a------ C:\WINDOWS\system32\tmp.reg
2008-06-11 07:48:39 0 d-------- C:\Programme\Gemeinsame Dateien\Symantec Shared
2008-06-11 00:25:55 0 d-------- C:\Dokumente und Einstellungen\1. Vicky Koller\Anwendungsdaten\Microsoft Games
2008-06-10 20:49:40 0 d-------- C:\Dokumente und Einstellungen\1. Vicky Koller\Anwendungsdaten\Skype
2008-06-10 18:35:35 0 d-------- C:\Programme\TuneUp Utilities 2004
2008-06-10 16:09:06 0 d-------- C:\Dokumente und Einstellungen\1. Vicky Koller\Anwendungsdaten\skypePM
2008-05-25 18:48:18 0 d-------- C:\Programme\FlashGet
2008-05-21 18:27:03 0 d-------- C:\Programme\Gemeinsame Dateien\Wise Installation Wizard
2008-05-21 16:45:46 0 d-------- C:\Dokumente und Einstellungen\1. Vicky Koller\Anwendungsdaten\ICQ
2008-05-21 16:41:20 0 d--h----- C:\Programme\InstallShield Installation Information
2008-05-05 18:41:21 0 d-------- C:\Programme\EA GAMES
2008-05-05 18:36:05 0 d-------- C:\Programme\YouTube Downloader
2008-05-01 00:47:47 0 d-------- C:\Programme\Messenger
2008-04-24 16:33:02 0 d-------- C:\Programme\Java
2008-04-19 19:42:49 0 d-------- C:\Programme\lang
2008-04-19 19:42:46 0 d-------- C:\Programme\Plugins
2008-04-19 19:42:40 0 d-------- C:\Programme\Gemeinsame Dateien
2008-04-19 19:42:40 0 d-------- C:\Programme\Gemeinsame Dateien\xing shared
2008-04-19 19:42:33 0 d-------- C:\Programme\Gemeinsame Dateien\Real
2008-04-19 19:42:24 0 d-------- C:\Programme\Setup
2008-03-30 17:39:39 425118 --a------ C:\WINDOWS\system32\perfh007.dat
2008-03-30 17:39:39 77924 --a------ C:\WINDOWS\system32\perfc007.dat
2008-03-20 18:43:26 7680 --ahs---- C:\Programme\Thumbs.db

-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccApp"="C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe" [03.09.2006 09:04]
"QuickTime Task"="C:\Programme\QuickTime\qttask.exe" [29.06.2007 06:24]
"TkBellExe"="C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" [19.04.2008 19:41]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"="C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit" []
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [04.08.2004 12:00]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Programme\Gemeinsame Dateien\Ahead\lib\NMBgMonitor.exe" [03.09.2005 15:18]
"msnmsgr"="C:\Programme\MSN Messenger\msnmsgr.exe" [19.01.2007 12:55]
"ICQ"="C:\PROGRA~1\ICQ6\ICQ.exe" [01.04.2008 12:40]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"NvMediaCenter"=RUNDLL32.EXE C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit

C:\Dokumente und Einstellungen\1. Vicky Koller\Startmen\Programme\Autostart\
YouTube Uploader.lnk - C:\Dokumente und Einstellungen\1. Vicky Koller\Lokale Einstellungen\Anwendungsdaten\YouTube\Uploader\youtubeuploader.exe [9.11.2007 14:33:08]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\nnnnMFvT

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Adobe Reader - Schnellstart.lnk]
path=C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Reader - Schnellstart.lnk
backup=C:\WINDOWS\pss\Adobe Reader - Schnellstart.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C-Media Mixer]
Mixer.exe /startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
C:\Programme\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Symantec NetDriver Monitor]
C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer

*Newly Created Service* - COMHOST

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{621FCD24-4498-4324-A81E-07D331376EDF}]
C:\Programme\PixiePack Codec Pack\InstallerHelper.exe

-- End of Deckard's System Scanner: finished at 2008-06-11 18:50:51 ------------

sooo das wärs... logfile von DSS nachdem ich mit malwarebytes gescannt und gelöscht hab...

Hi,

auf die schnelle überprüft, ist leider das immer noch da:
C:\WINDOWS\system32\TvFMnnnn.ini2
C:\WINDOWS\winudmr.exe

Bitte noch mal Avenger einsetzten!

Code:

Registry values to delete:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run|Windows Controls Center
 

Files to delete:

C:\WINDOWS\winudmr.exe

C:\WINDOWS\system32\TvFMnnnn.ini2

Poste das Log von Avenger und danach noch mal ein neues DSS-Log...

chris

Ok dann mach ich das nochmal...

Hast du das Script von Chris noch ausgeführt?

Poste bitte das neue Log von Avenger und ein neues Log von DSS.

lg myrtille

das hab ich gerade eben gemacht; hier das logfile...

Logfile of The Avenger Version 2.0, (c) by Swandog46
Swandog46's Public Anti-Malware Tools

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File "C:\WINDOWS\winudmr.exe" deleted successfully.
File "C:\WINDOWS\system32\TvFMnnnn.ini2" deleted successfully.

Error: could not delete registry value "HKLM\Software\Microsoft\Windows\CurrentVersion\Run|Windows Controls Center"
Deletion of registry value "HKLM\Software\Microsoft\Windows\CurrentVersion\Run|Windows Controls Center" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist

Completed script processing.

*******************

Finished! Terminate.

hier noch DSS

Deckard's System Scanner v20071014.68
Run by 1. Vicky Koller on 2008-06-12 23:54:59
Computer is in Normal Mode.
--------------------------------------------------------------------------------

Percentage of Memory in Use: 91% (more than 75%).
Total Physical Memory: 503 MiB (512 MiB recommended).

-- HijackThis (run as 1. Vicky Koller.exe) -------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:55:22, on 12.6.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSvcHst.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Gemeinsame Dateien\Ahead\lib\NMBgMonitor.exe
C:\Programme\MSN Messenger\msnmsgr.exe
C:\PROGRA~1\ICQ6\ICQ.exe
C:\Programme\Skype\Phone\Skype.exe
C:\Dokumente und Einstellungen\1. Vicky Koller\Lokale Einstellungen\Anwendungsdaten\YouTube\Uploader\youtubeuploader.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Skype\Plugin Manager\skypePM.exe
C:\Programme\Internet Explorer\IEXPLORE.EXE
C:\Programme\MSN Messenger\usnsvc.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Programme\Symantec\LiveUpdate\AUPDATE.EXE
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
C:\Programme\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Programme\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Programme\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Programme\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Dokumente und Einstellungen\1. Vicky Koller\Lokale Einstellungen\Temporary Internet Files\Content.IE5\X7W5YWWS\dss[1].exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\1VICKY~1.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Google
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Programme\Gemeinsame Dateien\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Programme\FlashGet\getflash.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Programme\Gemeinsame Dateien\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
O4 - HKLM\..\Run: [ccApp] C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programme\Gemeinsame Dateien\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Programme\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ICQ] "C:\PROGRA~1\ICQ6\ICQ.exe" silent
O4 - HKCU\..\Run: [Skype] "C:\Programme\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: YouTube Uploader.lnk = C:\Dokumente und Einstellungen\1. Vicky Koller\Lokale Einstellungen\Anwendungsdaten\YouTube\Uploader\youtubeuploader.exe
O8 - Extra context menu item: &Alles mit FlashGet laden - C:\Programme\FlashGet\jc_all.htm
O8 - Extra context menu item: &Mit FlashGet laden - C:\Programme\FlashGet\jc_link.htm
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Programme\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Programme\FlashGet\FlashGet.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe
O9 - Extra button: @C:\Programme\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Programme\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/DE-CH/.../GAME_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1193946358328
O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.co...p/PhtPkMSN.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary...o.cab56649.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary...t.cab57213.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary...r.cab56986.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0B29BB01-E7D6-4C80-BE2A-6CBE3FF4B34E}: NameServer = 195.186.1.111,195.186.1.110
O17 - HKLM\System\CCS\Services\Tcpip\..\{3F77CBF3-D90B-43DA-8F34-1A0FBBF15757}: NameServer = 195.186.1.111,195.186.1.110
O17 - HKLM\System\CCS\Services\Tcpip\..\{F2D68FAC-32BB-43C2-9804-E32EB168E711}: NameServer = 195.186.1.111,195.186.1.110
O17 - HKLM\System\CCS\Services\Tcpip\..\{FCA63F54-85D9-472F-AA4A-DAB76615E0EE}: NameServer = 195.186.1.111,195.186.1.110
O17 - HKLM\System\CS1\Services\Tcpip\..\{0B29BB01-E7D6-4C80-BE2A-6CBE3FF4B34E}: NameServer = 195.186.1.111,195.186.1.110
O17 - HKLM\System\CS2\Services\Tcpip\..\{0B29BB01-E7D6-4C80-BE2A-6CBE3FF4B34E}: NameServer = 195.186.1.111,195.186.1.110
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Programme\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Programme\Norton Internet Security\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Programme\TuneUp Utilities 2004\WinStylerThemeSvc.exe

--
End of file - 9865 bytes

-- Files created between 2008-05-12 and 2008-06-12 -----------------------------

2008-06-11 15:26:00 0 d-------- C:\Programme\Malwarebytes' Anti-Malware
2008-05-23 11:37:48 0 d-------- C:\Programme\Picasa2
2008-05-23 11:25:24 0 d-------- C:\Programme\FotoWorks
2008-05-23 11:25:18 0 d-------- C:\Programme\mresreg
2008-05-21 16:34:53 0 d-------- C:\Programme\ICQ6

-- Find3M Report ---------------------------------------------------------------

2008-06-12 23:51:05 0 d-------- C:\Dokumente und Einstellungen\1. Vicky Koller\Anwendungsdaten\Skype
2008-06-12 23:49:55 0 d-------- C:\Dokumente und Einstellungen\1. Vicky Koller\Anwendungsdaten\skypePM
2008-06-12 16:21:15 0 d-------- C:\Programme\Gemeinsame Dateien\Symantec Shared
2008-06-11 15:26:15 0 d-------- C:\Dokumente und Einstellungen\1. Vicky Koller\Anwendungsdaten\Malwarebytes
2008-06-11 14:43:52 1982 --a------ C:\WINDOWS\system32\tmp.reg
2008-06-11 00:25:55 0 d-------- C:\Dokumente und Einstellungen\1. Vicky Koller\Anwendungsdaten\Microsoft Games
2008-06-10 18:35:35 0 d-------- C:\Programme\TuneUp Utilities 2004
2008-05-25 18:48:18 0 d-------- C:\Programme\FlashGet
2008-05-21 18:27:03 0 d-------- C:\Programme\Gemeinsame Dateien\Wise Installation Wizard
2008-05-21 16:45:46 0 d-------- C:\Dokumente und Einstellungen\1. Vicky Koller\Anwendungsdaten\ICQ
2008-05-21 16:41:20 0 d--h----- C:\Programme\InstallShield Installation Information
2008-05-05 18:41:21 0 d-------- C:\Programme\EA GAMES
2008-05-05 18:36:05 0 d-------- C:\Programme\YouTube Downloader
2008-05-01 00:47:47 0 d-------- C:\Programme\Messenger
2008-04-24 16:33:02 0 d-------- C:\Programme\Java
2008-04-19 19:42:49 0 d-------- C:\Programme\lang
2008-04-19 19:42:46 0 d-------- C:\Programme\Plugins
2008-04-19 19:42:40 0 d-------- C:\Programme\Gemeinsame Dateien
2008-04-19 19:42:40 0 d-------- C:\Programme\Gemeinsame Dateien\xing shared
2008-04-19 19:42:33 0 d-------- C:\Programme\Gemeinsame Dateien\Real
2008-04-19 19:42:24 0 d-------- C:\Programme\Setup
2008-03-30 17:39:39 425118 --a------ C:\WINDOWS\system32\perfh007.dat
2008-03-30 17:39:39 77924 --a------ C:\WINDOWS\system32\perfc007.dat
2008-03-20 18:43:26 7680 --ahs---- C:\Programme\Thumbs.db

-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccApp"="C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe" [03.09.2006 09:04]
"QuickTime Task"="C:\Programme\QuickTime\qttask.exe" [29.06.2007 06:24]
"TkBellExe"="C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" [19.04.2008 19:41]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"="C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit" []
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [04.08.2004 12:00]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Programme\Gemeinsame Dateien\Ahead\lib\NMBgMonitor.exe" [03.09.2005 15:18]
"msnmsgr"="C:\Programme\MSN Messenger\msnmsgr.exe" [19.01.2007 12:55]
"ICQ"="C:\PROGRA~1\ICQ6\ICQ.exe" [01.04.2008 12:40]
"Skype"="C:\Programme\Skype\Phone\Skype.exe" [06.02.2008 19:37]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"NvMediaCenter"=RUNDLL32.EXE C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit

C:\Dokumente und Einstellungen\1. Vicky Koller\Startmen\Programme\Autostart\
YouTube Uploader.lnk - C:\Dokumente und Einstellungen\1. Vicky Koller\Lokale Einstellungen\Anwendungsdaten\YouTube\Uploader\youtubeuploader.exe [9.11.2007 14:33:08]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\nnnnMFvT

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Adobe Reader - Schnellstart.lnk]
path=C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Reader - Schnellstart.lnk
backup=C:\WINDOWS\pss\Adobe Reader - Schnellstart.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C-Media Mixer]
Mixer.exe /startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
C:\Programme\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Symantec NetDriver Monitor]
C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer

*Newly Created Service* - COMHOST

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{621FCD24-4498-4324-A81E-07D331376EDF}]
C:\Programme\PixiePack Codec Pack\InstallerHelper.exe

-- End of Deckard's System Scanner: finished at 2008-06-12 23:56:36 ------------

LG

Hi,
hast du Malwarebytes wirklich alles löschen lassen? Erstell bitte ein neues Log mit Malwarebytes und lasse alles löschen was es findet.
Poste das Log dann hier.
(Es tauchen weiterhin Zeilen im Log auf, die eigentlich von Malwarebytes erkannt wurden. :o )