Trojaner-Board - HDD Diagnostic entfernt,Desktop ist fast leer u. kein Zugriff auf Programme u. Dateien

Hallo Arne,

hier das OSAM log:

OSAM Logfile:

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

hxxp://www.online-solutions.ru/en/

Saved at 21:27:45 on 03.04.2011
 

OS: Windows XP Professional Service Pack 3 (Build 2600)

Default Browser: Mozilla Corporation Firefox 3.6.16
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[AppInit DLLs]

-----( HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows )-----

"AppInit_DLLs" - "Symantec Corporation" - C:\WINDOWS\system32\apitrap.dll
 

[Control Panel Objects]

-----( %SystemRoot%\system32 )-----

"BACSCPL.cpl" - ? - C:\WINDOWS\system32\BACSCPL.cpl

"ddbaccpl.cpl" - "DataDesign AG" - C:\WINDOWS\system32\ddbaccpl.cpl

"ddbacctm.cpl" - "DataDesign AG" - C:\WINDOWS\system32\ddbacctm.cpl

"infocardcpl.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\infocardcpl.cpl

"ISUSPM.cpl" - "InstallShield Software Corporation" - C:\WINDOWS\system32\ISUSPM.cpl

"javacpl.cpl" - "Sun Microsystems, Inc." - C:\WINDOWS\system32\javacpl.cpl

"NicConfigSvc.cpl" - "Dell Inc." - C:\WINDOWS\system32\NicConfigSvc.cpl

"stacgui.cpl" - "SigmaTel, Inc." - C:\WINDOWS\system32\stacgui.cpl

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----

"SYMLIVE" - "Symantec Corporation" - C:\Programme\Symantec\LiveUpdate\S32LUCP2.CPL
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"AEGIS Protocol (IEEE 802.1x) v3.4.9.0" (AegisP) - "Meetinghouse Data Communications" - C:\WINDOWS\System32\DRIVERS\AegisP.sys

"APPDRV" (APPDRV) - "Dell Inc" - C:\WINDOWS\SYSTEM32\DRIVERS\APPDRV.SYS

"Bluetooth Audio Service" (BlueletAudio) - "IVT Corporation" - C:\WINDOWS\System32\DRIVERS\blueletaudio.sys

"Bluetooth HID Enumerator" (BTHidEnum) - ? - C:\WINDOWS\System32\DRIVERS\vbtenum.sys  (File found, but it contains no detailed information)

"Bluetooth HID Manager Service" (BTHidMgr) - "IVT Corporation" - C:\WINDOWS\System32\Drivers\BTHidMgr.sys

"Bluetooth PAN Network Adapter" (BT) - "IVT Corporation" - C:\WINDOWS\System32\DRIVERS\btnetdrv.sys

"Bluetooth USB For Bluetooth Service" (Btcsrusb) - "IVT Corporation" - C:\WINDOWS\System32\Drivers\btcusb.sys

"Bluetooth VComm Manager Service" (VcommMgr) - "IVT Corporation" - C:\WINDOWS\System32\Drivers\VcommMgr.sys

"catchme" (catchme) - ? - C:\DOKUME~1\THOMAS~1\LOKALE~1\Temp\catchme.sys  (File not found)

"Changer" (Changer) - ? - C:\WINDOWS\system32\drivers\Changer.sys  (File not found)

"drvmcdb" (drvmcdb) - "Sonic Solutions" - C:\WINDOWS\System32\drivers\drvmcdb.sys

"drvnddm" (drvnddm) - "Sonic Solutions" - C:\WINDOWS\System32\drivers\drvnddm.sys

"lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys  (File not found)

"NetGroup Packet Filter Driver" (npf) - "CACE Technologies, Inc." - C:\WINDOWS\System32\drivers\npf.sys

"OMCI WDM Device Driver" (omci) - "Dell Inc" - C:\WINDOWS\System32\DRIVERS\omci.sys

"PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys  (File not found)

"PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys  (File not found)

"PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys  (File not found)

"PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys  (File not found)

"PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys  (File not found)

"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\WINDOWS\System32\Drivers\PxHelp20.sys

"QDFSDRV" (QDFSDRV) - "Symantec Corporation" - C:\WINDOWS\system32\drivers\qdfsdrv.sys

"sscdbhk5" (sscdbhk5) - "Sonic Solutions" - C:\WINDOWS\System32\drivers\sscdbhk5.sys

"ssrtln" (ssrtln) - "Sonic Solutions" - C:\WINDOWS\System32\drivers\ssrtln.sys

"tfsnboio" (tfsnboio) - "Sonic Solutions" - C:\WINDOWS\System32\dla\tfsnboio.sys

"tfsncofs" (tfsncofs) - "Sonic Solutions" - C:\WINDOWS\System32\dla\tfsncofs.sys

"tfsndrct" (tfsndrct) - "Sonic Solutions" - C:\WINDOWS\System32\dla\tfsndrct.sys

"tfsndres" (tfsndres) - "Sonic Solutions" - C:\WINDOWS\System32\dla\tfsndres.sys

"tfsnifs" (tfsnifs) - "Sonic Solutions" - C:\WINDOWS\System32\dla\tfsnifs.sys

"tfsnopio" (tfsnopio) - "Sonic Solutions" - C:\WINDOWS\System32\dla\tfsnopio.sys

"tfsnpool" (tfsnpool) - "Sonic Solutions" - C:\WINDOWS\System32\dla\tfsnpool.sys

"tfsnudf" (tfsnudf) - "Sonic Solutions" - C:\WINDOWS\System32\dla\tfsnudf.sys

"tfsnudfa" (tfsnudfa) - "Sonic Solutions" - C:\WINDOWS\System32\dla\tfsnudfa.sys

"ui11rdr" (ui11rdr) - "1&1 Internet AG" - C:\WINDOWS\System32\DRIVERS\ui11rdr.sys

"Virtual Serial port driver" (VComm) - "IVT Corporation" - C:\WINDOWS\System32\DRIVERS\VComm.sys

"WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys  (File not found)

"WLAN-Transport" (s24trans) - "Intel Corporation" - C:\WINDOWS\System32\DRIVERS\s24trans.sys
 

[Explorer]

-----( HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{BDEADF00-C265-11d0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL

-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----

{89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - ? - C:\Programme\OpenOffice.org 2.4\program\shlxthdl.dll

-----( HKLM\Software\Classes\Protocols\Filter )-----

{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

-----( HKLM\Software\Classes\Protocols\Handler )-----

{CF184AD3-CDCB-4168-A3F7-8E447D129300} "CZipHandler Object" - "Hewlett-Packard Company" - C:\Programme\HP\hpcoretech\comp\hpuiprot.dll

{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL

{5513F07E-936B-4E52-9B00-067394E91CC5} "McAfee SACore Protocol Handler" - "McAfee, Inc." - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll

{5513F07E-936B-4E52-9B00-067394E91CC5} "McAfee SACore Protocol Handler" - "McAfee, Inc." - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll

{91774881-D725-4E58-B298-07617B9B86A8} "Skype IE add-on Pluggable Protocol" - "Skype Technologies S.A." - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? - deskpan.dll  (File not found)

{5CA3D70E-1895-11CF-8E15-001234567890} "DriveLetterAccess" - ? -   (File not found)

{692F0339-CBAA-47e6-B5B5-3B84DB604E87} "Extensions Manager Folder" - "Microsoft Corporation" - C:\WINDOWS\system32\extmgr.dll

{1D2680C9-0E2A-469d-B787-065558BC7D43} "Fusion Cache" - "Microsoft Corporation" - c:\WINDOWS\system32\mscoree.dll

{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? -   (File not found | COM-object registry key not found)

{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll

{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll

{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - ? - C:\Programme\OpenOffice.org 2.4\program\shlxthdl.dll

{087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - ? - C:\Programme\OpenOffice.org 2.4\program\shlxthdl.dll

{63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - ? - C:\Programme\OpenOffice.org 2.4\program\shlxthdl.dll

{3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - ? - C:\Programme\OpenOffice.org 2.4\program\shlxthdl.dll

{0006F045-0000-0000-C000-000000000046} "Outlook-Dateisymbolerweiterung" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office\OLKFSTUB.DLL

{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" - "Microsoft Corporation" - c:\WINDOWS\system32\dfshim.dll

{62DF97A2-3635-4412-AE30-80B164BC88AD} "ShellContextMenuHandler Class" - "1&1 Internet AG" - C:\Programme\1&1\1&1 Upload-Manager\SHNDLERS.DLL

{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? -   (File not found | COM-object registry key not found)

{e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" - "Microsoft Corporation" - c:\WINDOWS\system32\dfshim.dll

{B8323370-FF27-11D2-97B6-204C4F4F5020} "SmartFTP Copy Hook" - "SmartSoft Ltd." - C:\Programme\SmartFTP Client 2.0\smarthook.dll
 

[Internet Explorer]

-----( HKCU\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

"eBay DE" - ? - C:\Programme\Supreme Auction\ebay_de.url

"eBay UK" - ? - C:\Programme\Supreme Auction\ebay_uk.url

"eBay US" - ? - C:\Programme\Supreme Auction\ebay_us.url

"Supreme Auction" - "Supreme NewMedia GmbH" - C:\Programme\Supreme Auction\SupremeAuctionOnline.exe

-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----

<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)

<binary data> "ITBarLayout" - ? -   (File not found | COM-object registry key not found)

-----( HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks )-----

{0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} "McAfee SiteAdvisor Toolbar" - "McAfee, Inc." - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{02BCC737-B171-4746-94C9-0D8A0B2C0089} "Microsoft Office Template and Media Control" - "Microsoft Corporation" - C:\WINDOWS\Downloaded Program Files\IEAWSDC.DLL / hxxp://office.microsoft.com/templates/ieawsdc.cab

{05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} "Office Genuine Advantage Validation Tool" - ? - C:\WINDOWS\system32\OGACheckControl.DLL / hxxp://download.microsoft.com/download/e/7/3/e7345c16-80aa-4488-ae10-9ac6be844f99/OGAControl.cab

{02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} "{02BF25D5-8C17-4B23-BC80-D3488ABDDC6B}" - ? -   (File not found | COM-object registry key not found) / hxxp://a1540.g.akamai.net/7/1540/52/20070501/qtinstall.info.apple.com/qtactivex/qtplugin.cab

{8FFBE65D-2C9C-4669-84BD-5829DC0B603C} "{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}" - ? -   (File not found | COM-object registry key not found) / hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

{898EA8C8-E7FF-479B-8935-AEC46303B9E5} "Skype Plug-In" - "Skype Technologies S.A." - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----

{327C2873-E90D-4c37-AA9D-10AC9BABA46C} "Easy-WebPrint" - ? - C:\Programme\Canon\Easy-WebPrint\Toolband.dll

{0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} "McAfee SiteAdvisor Toolbar" - "McAfee, Inc." - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{D48FF4B4-E68F-47D1-8E25-81A0F0EEB341} "1&&1 Internet AG Browser Configuration by mquadr.at" - "mquadr.at software engineering und consulting GmbH" - C:\WINDOWS\system32\ieconfig_1und1.dll

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "AcroIEHlprObj Class" - ? -   (File not found)

{5CA3D70E-1895-11CF-8E15-001234567890} "DriveLetterAccess" - ? -   (File not found)

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jp2ssv.dll

{E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

{B164E929-A1B6-4A06-B104-2CD0E90A88FF} "McAfee SiteAdvisor BHO" - "McAfee, Inc." - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll

{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} "Skype Plug-In" - "Skype Technologies S.A." - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
 

[Logon]

-----( %AllUsersProfile%\Startmenü\Programme\Autostart )-----

"BlueSoleil.lnk" - "IVT Corporation" - C:\Programme\IVT Corporation\BlueSoleil\BlueSoleil.exe  (Shortcut exists | File exists)

"CleanSweep Smart Sweep-Internet Sweep.LNK" - "Symantec Corporation" - C:\Programme\Norton CleanSweep\csinsmnt.exe  (Shortcut exists | File exists)

"dlbcserv.lnk" - ? - C:\Programme\Dell Photo Printer 720\dlbcserv.exe  (Shortcut exists | File exists)

"desktop.ini" - ? - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini

"Digital Line Detect.lnk" - "BVRP Software" - C:\Programme\Digital Line Detect\DLG.exe  (Shortcut exists | File exists)

"Microsoft Office.lnk" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office\OSA9.EXE  (Shortcut exists | File exists)

-----( %UserProfile%\Startmenü\Programme\Autostart )-----

"desktop.ini" - ? - C:\Dokumente und Einstellungen\*****\Startmenü\Programme\Autostart\desktop.ini

-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----

"ModemOnHold" - ? - C:\Programme\NetWaiting\netwaiting.exe  (File found, but it contains no detailed information)

"Skype" - "Skype Technologies S.A." - "C:\Programme\Skype\Phone\Skype.exe" /nosplash /minimized

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"Adobe Photo Downloader" - "Adobe Systems Incorporated" - "C:\Programme\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"

"Corel Photo Downloader" - "Corel, Inc." - C:\Programme\Corel\Corel Photo Album 6\MediaDetect.exe

"Dell QuickSet" - "Dell Inc" - C:\Programme\Dell\QuickSet\quickset.exe

"dla" - "Sonic Solutions" - C:\WINDOWS\system32\dla\tfswctrl.exe

"DMXLauncher" - ? - C:\Programme\Dell\Media Experience\DMXLauncher.exe  (File found, but it contains no detailed information)

"DVDLauncher" - "CyberLink Corp." - "C:\Programme\CyberLink\PowerDVD\DVDLauncher.exe"

"Easy-PrintToolBox" - "CANON INC." - C:\Programme\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon

"FreePDF Assistant" - "shbox.de" - C:\Programme\FreePDF_XP\fpassist.exe

"IntelWireless" - "Intel Corporation" - "C:\Programme\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless

"IntelZeroConfig" - "Intel Corporation" - "C:\Programme\Intel\Wireless\bin\ZCfgSvc.exe"

"ISUSPM Startup" - "InstallShield Software Corporation" - "C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\isuspm.exe" -startup

"ISUSScheduler" - "InstallShield Software Corporation" - "C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe" -start

"QD FastAndSafe" - "Symantec Corporation" - C:\Programme\Norton CleanSweep\QDCSFS.exe /startup

"ShowLOMControl" - ? -   (File not found)

"SigmatelSysTrayApp" - "SigmaTel, Inc." - stsystra.exe

"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe"

"UpdatePDRShortCut" - "CyberLink Corp." - "C:\Programme\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" "C:\Programme\CyberLink\PowerDirector" UpdateWithCreateOnce "Software\CyberLink\PowerDirector\7.0"
 

[Network Providers]

-----( HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order )-----

"1&1 SmartDrive" - "1&1 Internet AG" - C:\WINDOWS\System32\ui11np.dll
 

[Print Monitors]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----

"Microsoft Office Live Meeting 2007 Document Writer Monitor" - "Microsoft Corporation." - C:\WINDOWS\system32\lmdimon8.dll

"Redirected Port" - ? - C:\WINDOWS\system32\redmonnt.dll  (File found, but it contains no detailed information)
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

".NET Runtime Optimization Service v2.0.50727_X86" (clr_optimization_v2.0.50727_32) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

"ASP.NET State Service" (aspnet_state) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe

"BlueSoleil Hid Service" (BlueSoleil Hid Service) - ? - C:\Programme\IVT Corporation\BlueSoleil\BTNtService.exe  (File found, but it contains no detailed information)

"Cyberlink RichVideo Service(CRVS)" (RichVideo) - ? - C:\Programme\CyberLink\Shared Files\RichVideo.exe

"Intel(R) PROSet/Wireless Event Log" (EvtEng) - "Intel Corporation" - C:\Programme\Intel\Wireless\Bin\EvtEng.exe

"Intel(R) PROSet/Wireless Registry Service" (RegSrvc) - "Intel Corporation" - C:\Programme\Intel\Wireless\Bin\RegSrvc.exe

"Intel(R) PROSet/Wireless Service" (S24EventMonitor) - "Intel Corporation " - C:\Programme\Intel\Wireless\Bin\S24EvMon.exe

"Intel(R) PROSet/Wireless SSO Service" (WLANKEEPER) - "Intel(R) Corporation" - C:\Programme\Intel\Wireless\Bin\WLKeeper.exe

"Java Quick Starter" (JavaQuickStarterService) - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jqs.exe

"LiveUpdate" (LiveUpdate) - "Symantec Corporation" - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

"McAfee SiteAdvisor Service" (McAfee SiteAdvisor Service) - "McAfee, Inc." - c:\PROGRA~1\mcafee\SITEAD~1\McSACore.exe

"NICCONFIGSVC" (NICCONFIGSVC) - "Dell Inc." - C:\Programme\Dell\NICCONFIGSVC\NICCONFIGSVC.exe

"Symantec Lic NetConnect service" (CLTNetCnService) - ? - "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSvcHst.exe" /h ccCommon  (File not found)

"Windows CardSpace" (idsvc) - "Microsoft Corporation" - c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe

"Windows Presentation Foundation Font Cache 3.0.0.0" (FontCache3.0.0.0) - "Microsoft Corporation" - c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
 

[Winlogon]

-----( HKCU\Control Panel\IOProcs )-----

"MVB" - ? - mvfs32.dll  (File not found)

-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )-----

"WgaLogon" - "Microsoft Corporation" - C:\WINDOWS\system32\WgaLogon.dll
 

===[ Logfile end ]=========================================[ Logfile end ]===

--- --- ---

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

Hallo Arne,

hier das mbam-log:

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6266

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.2180

04.04.2011 16:17:22
mbam-log-2011-04-04 (16-17-22).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Durchsuchte Objekte: 307283
Laufzeit: 1 Stunde(n), 17 Minute(n), 47 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

-------------------------------------------------------------------------

und das SuperAntiSpyware Log:

SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 04/04/2011 at 06:42 PM

Application Version : 4.50.1002

Core Rules Database Version : 6745
Trace Rules Database Version: 4557

Scan type : Complete Scan
Total Scan Time : 02:13:31

Memory items scanned : 594
Memory threats detected : 0
Registry items scanned : 6980
Registry threats detected : 2
File items scanned : 134390
File threats detected : 65

Unclassified.Unknown Origin
HKU\S-1-5-21-3195249837-88931578-2232832582-1005\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{134F7664-943D-3BB9-65F5-70B91DF46C86}
HKCR\CLSID\{134F7664-943D-3BB9-65F5-70B91DF46C86}

Browser Hijacker.Favorites
C:\Dokumente und Einstellungen\All Users\Favoriten\Download Free Spyware Remover.url
C:\Dokumente und Einstellungen\All Users\Favoriten\NEW VIAGRA at Half Price!.url
C:\Dokumente und Einstellungen\All Users\Favoriten\Online Chat With Nude Girls.url
C:\Dokumente und Einstellungen\All Users\Favoriten\Order CIALIS online without leaving home..url
C:\Dokumente und Einstellungen\All Users\Favoriten\PC protection in under 2 minutes!.url
C:\Dokumente und Einstellungen\All Users\Favoriten\SEX Dating - Real Girls For Real SEX.url
C:\Dokumente und Einstellungen\All Users\Favoriten\Stop PopUps On Your Computer.url
C:\Dokumente und Einstellungen\All Users\Favoriten\VIAGRA at incredible low price. Bonus Pills!.url
C:\Dokumente und Einstellungen\All Users\Favoriten\View ADULT photos of REAL GIRLS!.url
C:\Dokumente und Einstellungen\All Users\Favoriten\Online Pharmacy\CHEAPEST VIAGRA ONLINE.url
C:\Dokumente und Einstellungen\All Users\Favoriten\Online Pharmacy\Cialis at HALF PRICE!.url
C:\Dokumente und Einstellungen\All Users\Favoriten\Online Pharmacy\Fast Way To Loose Your Weight!.url
C:\Dokumente und Einstellungen\All Users\Favoriten\Online Pharmacy\Guaranteed low price at Pills..url
C:\Dokumente und Einstellungen\All Users\Favoriten\Online Pharmacy\SOMA at Special LOW PRICE.url
C:\Dokumente und Einstellungen\All Users\Favoriten\Online Pharmacy\Tramadol Special Offer!.url
C:\Dokumente und Einstellungen\All Users\Favoriten\Online Pharmacy\Try New VIAGRA! Works Faster and Longer!.url
C:\Dokumente und Einstellungen\All Users\Favoriten\Online Pharmacy
C:\Dokumente und Einstellungen\All Users\Favoriten\Sex and Dating\Meet Girls Who Want To Get Laid!.url
C:\Dokumente und Einstellungen\All Users\Favoriten\Sex and Dating\Meet Horny Girls In Your Area!.url
C:\Dokumente und Einstellungen\All Users\Favoriten\Sex and Dating\Read profiles and Chat With Nude Girls!.url
C:\Dokumente und Einstellungen\All Users\Favoriten\Sex and Dating\SEX Dating - people looking for SEX.url
C:\Dokumente und Einstellungen\All Users\Favoriten\Sex and Dating\View XXX photos of Real Sexy Girls..url
C:\Dokumente und Einstellungen\All Users\Favoriten\Sex and Dating
C:\Dokumente und Einstellungen\All Users\Favoriten\Spyware Uninstall\Easy Detect and Uninstall Spyware..url
C:\Dokumente und Einstellungen\All Users\Favoriten\Spyware Uninstall\Free Spyware Scanner..url
C:\Dokumente und Einstellungen\All Users\Favoriten\Spyware Uninstall\Search & Destroy Annoying Adware..url
C:\Dokumente und Einstellungen\All Users\Favoriten\Spyware Uninstall\Stop PopUps on your PC..url
C:\Dokumente und Einstellungen\All Users\Favoriten\Spyware Uninstall

Adware.Tracking Cookie
C:\Dokumente und Einstellungen\Gast\Cookies\gast@2o7[1].txt
C:\Dokumente und Einstellungen\Gast\Cookies\gast@ad.zanox[1].txt
C:\Dokumente und Einstellungen\Gast\Cookies\gast@ads.aooa[1].txt
C:\Dokumente und Einstellungen\Gast\Cookies\gast@ads.maotec-00[1].txt
C:\Dokumente und Einstellungen\Gast\Cookies\gast@adserver.dialogmediencenter[2].txt
C:\Dokumente und Einstellungen\Gast\Cookies\gast@adtech[2].txt
C:\Dokumente und Einstellungen\Gast\Cookies\gast@as-eu.falkag[2].txt
C:\Dokumente und Einstellungen\Gast\Cookies\gast@as1.falkag[2].txt
C:\Dokumente und Einstellungen\Gast\Cookies\gast@atdmt[2].txt
C:\Dokumente und Einstellungen\Gast\Cookies\gast@doubleclick[1].txt
C:\Dokumente und Einstellungen\Gast\Cookies\gast@ehg-neckermann.hitbox[2].txt
C:\Dokumente und Einstellungen\Gast\Cookies\gast@falkag[2].txt
C:\Dokumente und Einstellungen\Gast\Cookies\gast@hitbox[2].txt
C:\Dokumente und Einstellungen\Gast\Cookies\gast@hmt.connexpromotions[2].txt
C:\Dokumente und Einstellungen\Gast\Cookies\gast@id153.qualitraffic[1].txt
C:\Dokumente und Einstellungen\Gast\Cookies\gast@komtrack[2].txt
C:\Dokumente und Einstellungen\Gast\Cookies\gast@m1.webstats4u[1].txt
C:\Dokumente und Einstellungen\Gast\Cookies\gast@mediaplex[1].txt
C:\Dokumente und Einstellungen\Gast\Cookies\gast@mediavantage[2].txt
C:\Dokumente und Einstellungen\Gast\Cookies\gast@msnportal.112.2o7[1].txt
C:\Dokumente und Einstellungen\Gast\Cookies\gast@opodo.122.2o7[1].txt
C:\Dokumente und Einstellungen\Gast\Cookies\gast@partners.webmasterplan[2].txt
C:\Dokumente und Einstellungen\Gast\Cookies\gast@publicidad1.webfg[1].txt
C:\Dokumente und Einstellungen\Gast\Cookies\gast@revenue[1].txt
C:\Dokumente und Einstellungen\Gast\Cookies\gast@serving-sys[2].txt
C:\Dokumente und Einstellungen\Gast\Cookies\gast@statse.webtrendslive[1].txt
C:\Dokumente und Einstellungen\Gast\Cookies\gast@stats[2].txt
C:\Dokumente und Einstellungen\Gast\Cookies\gast@tacoda[1].txt
C:\Dokumente und Einstellungen\Gast\Cookies\gast@tracking.11880[1].txt
C:\Dokumente und Einstellungen\Gast\Cookies\gast@tracking.quisma[1].txt
C:\Dokumente und Einstellungen\Gast\Cookies\gast@webstats4u[1].txt
C:\Dokumente und Einstellungen\Gast\Cookies\gast@www.etracker[1].txt
C:\Dokumente und Einstellungen\Gast\Cookies\gast@www.zanox-affiliate[2].txt
ad.yieldmanager.com [ C:\Programme\MediaCoder\xulapp\Anwendungsdaten\Mozilla\Firefox\Profiles\mh5aqar7.default\cookies.sqlite ]
ad.yieldmanager.com [ C:\Programme\MediaCoder\xulapp\Anwendungsdaten\Mozilla\Firefox\Profiles\mh5aqar7.default\cookies.sqlite ]

Trojan.Agent/Gen-Nullo[Short]
C:\SYSTEM VOLUME INFORMATION\_RESTORE{DF867C4F-0E0D-4E20-9F25-BC2B2DFBD84A}\RP667\A0124005.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{DF867C4F-0E0D-4E20-9F25-BC2B2DFBD84A}\RP667\A0124006.EXE