Windows XP: spyware

Sieht für mich wie Zlob oder Smitfraud aus.

Lade dir dass Programm Smitraudfix runter und führe es aus wie es in der Anleitung steht:

http://siri.geekstogo.com/SmitfraudFix_De.php

Poste dass Logfile dann hier.

Also zuerst BIG THX!!! Hat geklappt, der eintrag:

SSODL: wdpoefan - {36149735-549A-4FC2-961D-CCCEFF02A3D6} - C:\\\\\\\\WINDOWS\\\\\\\\wdpoefan.dll

wurde entfernt,

der andere ist halt noch da, und welchen bericht möchtest haben? vor oder nach dem ausführen?


 

Mach jetzt einfach ein Hijackthis logfile und poste es hier.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:31:38, on 21.04.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Programme\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\TBPanel.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Windows Live\Messenger\MsnMsgr.Exe
C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
C:\Programme\Logitech\SetPoint\SetPoint.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Programme\Gemeinsame Dateien\Logitech\KHAL\KHALMNPR.EXE
C:\Programme\Internet Explorer\iexplore.exe
C:\Programme\Adobe\Reader 8.0\Reader\AcroRd32.exe
C:\Programme\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Gainward] C:\WINDOWS\TBPanel.exe /A
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [EPSON Stylus Photo RX420 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE /P31 "EPSON Stylus Photo RX420 Series" /O6 "USB001" /M "Stylus Photo RX420"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Programme\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Programme\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [EPSON Stylus Photo RX420 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE /P31 "EPSON Stylus Photo RX420 Series" /M "Stylus Photo RX420" /EF "HKCU"
O4 - HKCU\..\Run: [Skype] "C:\Programme\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Logitech SetPoint.lnk = C:\Programme\Logitech\SetPoint\SetPoint.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: In Windows Live Writer in &Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20070711/qtinstall.info.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/DE-AT/a-UNO1/GAME_UNO1.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
O21 - SSODL: vadokmxt - {71707293-98B3-48EF-8008-1573D8109CAC} - C:\WINDOWS\vadokmxt.dll
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe

--
End of file - 7250 bytes
 

Hake folgenden Eintrag an und klicke fix checked, danach neustart und neues logfile posten.

O21 - SSODL: vadokmxt - {71707293-98B3-48EF-8008-1573D8109CAC} - C:\WINDOWS\vadokmxt.dll

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:45:12, on 21.04.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
C:\Programme\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Programme\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\TBPanel.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE
C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Windows Live\Messenger\MsnMsgr.Exe
C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
C:\Programme\Logitech\SetPoint\SetPoint.exe
C:\Programme\Gemeinsame Dateien\Logitech\KHAL\KHALMNPR.EXE
C:\Programme\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Gainward] C:\WINDOWS\TBPanel.exe /A
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [EPSON Stylus Photo RX420 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE /P31 "EPSON Stylus Photo RX420 Series" /O6 "USB001" /M "Stylus Photo RX420"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Programme\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Programme\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [EPSON Stylus Photo RX420 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE /P31 "EPSON Stylus Photo RX420 Series" /M "Stylus Photo RX420" /EF "HKCU"
O4 - HKCU\..\Run: [Skype] "C:\Programme\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Logitech SetPoint.lnk = C:\Programme\Logitech\SetPoint\SetPoint.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: In Windows Live Writer in &Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20070711/qtinstall.info.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/DE-AT/a-UNO1/GAME_UNO1.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
O21 - SSODL: vadokmxt - {2EB19B53-7403-4217-94FD-CEF90FF27CBD} - C:\WINDOWS\vadokmxt.dll
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe

--
End of file - 7239 bytes



ist wieder gekommen, hijackThis fragt mich zuerst ob ich den wert löschen will, das bestätige ich, darauf kommt sofort auch wieder die frage ob ich es erlauben will einzutragen, dies verweigere ich und hacke auch entscheidung merken an,hedoch würde es stunden so weiter gehen da sich die zahlen vorne immer ändern

VideoAccessCodec Infektion

mit Fix per hijackThis ist das leider nicht getan

bereinige so:


Malwarebytes
http://www.virus-protect.org/artikel/tools/malwarebytes.html
alle Funde löschen lassen + poste den Report

wende ccleaner an
http://virus-protect.org/ccleaner.html

wende bitte Combofix an (Warnmeldung wegklicken) + poste den Report
http://virus-protect.org/artikel/tools/combofix.html
 

Malwarebytes' Anti-Malware 1.11
Datenbank Version: 669

Scan Art: Komplett Scan (C:\|)
Objekte gescannt: 118776
Scan Dauer: 1 hour(s), 4 minute(s), 15 second(s)

Infizierte Speicher Prozesse: 0
Infizierte Speicher Module: 1
Infizierte Registrierungsschlüssel: 45
Infizierte Registrierungswerte: 1
Infizierte Datei Objekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 4

Infizierte Speicher Prozesse:
(Keine Malware Objekte gefunden)

Infizierte Speicher Module:
C:\WINDOWS\vadokmxt.dll (Trojan.FakeAlert) -> Unloaded module successfully.

Infizierte Registrierungsschlüssel:
HKEY_CLASSES_ROOT\Interface\{7c054d23-ff37-467e-8f0f-a82d43c203d2} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{a00281d9-67be-4881-bb34-2fb7196d4db5} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{15fabe1b-ee9a-4652-aaa3-fdcf6635ff79} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{6d422996-4f55-407c-828e-059d2c312f5e} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{6d1e583a-d2aa-4aca-ace8-451f73c609f1} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\dpevflbg.bvst (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{87f195a2-e583-4fe1-9649-3333e6fe1a61} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\dpevflbg.toolbar.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{00d52859-f2c8-4367-8f52-99408ad9a3ee} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{09a91c70-b8bf-45d6-80e7-7dfda7bc7d6a} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{0d7afe99-9fb5-4830-8cfc-4181571350a6} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{1120ab0a-e782-4167-ac97-7f59577d13ff} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{18c9497e-8ade-45a6-9f54-9658653b8934} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{21c7ba31-ee41-46e5-9606-32f961af14a2} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{24ee1e7e-b7f8-4b0b-9435-47bd647e25dc} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{29b56c61-17a8-4240-b13c-f50fe96a3580} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{2a3a3927-f5de-4a63-ab34-a189733076a1} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{2d7f6eb1-bafd-4530-b4e1-685c6c840a8a} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{3184ddcf-2449-42d9-80d0-5926ccf19414} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{36fe03b6-64d5-42ac-9c99-77a6dd2f68ef} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{37cf4d82-f434-4d1d-bdd8-7b304384c653} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{381dfdb8-25a0-433b-952d-da0225454a7c} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{383012dc-92c0-4ffa-86e9-def1e6d64b17} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{3f5eada9-0e01-4f84-89e6-09ad4408491d} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{407fa7d3-6d27-4060-b33b-caf630446cfe} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{4088ecd4-7043-40fc-8a52-7199ac0c1c5d} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{464188e2-40b3-451e-a60b-7e36562d2d33} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{50bacd80-100b-44cb-8e95-262ede90571c} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{5247a2c0-d2e4-487c-87e6-c0f31f3c13eb} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{59a6782c-93ff-4b41-a0ce-2acc80db5a6e} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{5f0555ac-e26e-44a4-8764-b66d0df16f67} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{63dec87b-8450-4fc9-afc1-06e76464e9d6} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{7397f12c-202f-4bd1-a987-da4828c3dc80} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{8003cda9-e2f6-47a5-9437-a5270cd47510} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a16f0c92-32b2-4790-afa2-abcc5745d7fd} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a20c5118-2498-4441-be19-d8ce0623ada6} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{ab71fcaf-1870-49f1-9c2a-2b18fb38c1ff} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{b2002684-1924-4a77-a3b4-2e8fc06a5bf9} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{b97dacef-12ce-43da-b369-522c004cd184} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{def5b164-2bf4-4e82-8a8c-0bbf73bd7b8f} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{df9b35bd-fb4c-4e04-a3b3-4a0b6e6b774a} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{e8f5f45c-3f66-46dc-87ee-d52dadebc5b4} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{ea631291-eee6-43f1-a18f-1c3eb06b4c4e} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{f15954c2-ba64-4209-99aa-7c44b81d08d9} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VideoPlugin (Trojan.Fakealert) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\vadokmxt (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Infizierte Datei Objekte der Registrierung:
(Keine Malware Objekte gefunden)

Infizierte Verzeichnisse:
(Keine Malware Objekte gefunden)

Infizierte Dateien:
C:\WINDOWS\dpevflbg.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\wxvgsdbq.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\vadokmxt.dll (Trojan.FakeAlert) -> Delete on reboot.
C:\WINDOWS\olgdqarf.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.




also bis jetzt mal vielen vielen dank, hab ne menge dazugelernt und probleme gelöscht, soll ich nun den cc cleaner doch noch ausführen und combofix?

der eintrag O21 - SSODL: vadokmxt - {2EB19B53-7403-4217-94FD-CEF90FF27CBD} - C:\WINDOWS\vadokmxt.dll

wurde entfernt aber vielleicht ist ja doch noch was drauf?

mfg 

Ja alles durchführen, eine halbe Reinigung bringt dir nichts! 

ComboFix 08-04-20.5 - Manu 2008-04-22 15:48:31.1 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1252.1.1031.18.616 [GMT 2:00]
ausgeführt von:: C:\Dokumente und Einstellungen\Manu\Eigene Dateien\ComboFix.exe
 * Neuer Wiederherstellungspunkt wurde erstellt

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\autorun.inf

.
(((((((((((((((((((((((   Dateien erstellt von 2008-03-22 bis 2008-04-22  ))))))))))))))))))))))))))))))
.

2008-04-22 15:39 . 2008-04-22 15:39   <DIR>   d--------   C:\Programme\CCleaner
2008-04-22 13:51 . 2008-04-22 13:51   <DIR>   d--------   C:\Programme\Malwarebytes' Anti-Malware
2008-04-22 13:51 . 2008-04-22 13:51   <DIR>   d--------   C:\Dokumente und Einstellungen\Manu\Anwendungsdaten\Malwarebytes
2008-04-22 13:51 . 2008-04-22 13:51   <DIR>   d--------   C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
2008-04-21 21:13 . 2008-04-21 21:17   3,176   --a------   C:\WINDOWS\system32\tmp.reg
2008-04-21 19:54 . 2008-04-21 19:54   <DIR>   d--------   C:\Programme\Trend Micro
2008-04-20 18:06 . 2008-04-20 18:06   102   --a------   C:\WINDOWS\wininit.ini
2008-04-20 17:18 . 2008-04-20 22:10   <DIR>   d--------   C:\Programme\Spybot - Search & Destroy
2008-04-20 17:18 . 2008-04-21 12:18   <DIR>   d--------   C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
2008-04-20 14:41 . 2008-04-20 17:48   <DIR>   d-a------   C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP
2008-04-20 11:59 . 2008-04-20 11:59   <DIR>   d--------   C:\Dokumente und Einstellungen\Manu\Anwendungsdaten\TmpRecentIcons
2008-03-26 10:56 . 2008-03-26 10:56   <DIR>   d--------   C:\Logs

.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-22 13:07   ---------   d-----w   C:\Dokumente und Einstellungen\Manu\Anwendungsdaten\Skype
2008-04-22 11:46   ---------   d-----w   C:\Dokumente und Einstellungen\Manu\Anwendungsdaten\skypePM
2008-04-19 18:01   ---------   d-----w   C:\Dokumente und Einstellungen\Manu\Anwendungsdaten\LimeWire
2008-04-19 14:26   ---------   d-----w   C:\Programme\Steam
2008-04-09 11:43   ---------   d-----w   C:\Dokumente und Einstellungen\Manu\Anwendungsdaten\teamspeak2
2008-04-02 09:17   ---------   d-----w   C:\Programme\World of Warcraft
2008-04-01 21:40   ---------   d-----w   C:\Programme\Messenger Plus! Live
2008-03-26 15:43   ---------   d-----w   C:\Programme\MobMapUpdater
2008-03-23 09:41   ---------   d-----w   C:\Programme\Java
2008-03-21 19:19   ---------   d-----w   C:\Dokumente und Einstellungen\Manu\Anwendungsdaten\Xfire
2008-03-20 08:03   1,845,376   ----a-w   C:\WINDOWS\system32\win32k.sys
2008-03-15 22:30   ---------   d-----w   C:\Dokumente und Einstellungen\Manu\Anwendungsdaten\Azureus
2008-03-13 01:01   ---------   d-----w   C:\Programme\Azureus
2008-03-11 11:57   ---------   d-----w   C:\Programme\Windows Live
2008-03-11 11:53   ---------   dcsh--w   C:\Programme\Gemeinsame Dateien\WindowsLiveInstaller
2008-03-11 11:49   ---------   d-----w   C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\WLInstaller
2008-03-04 19:34   ---------   d-----w   C:\Dokumente und Einstellungen\Manu\Anwendungsdaten\DivX
2008-03-04 19:24   ---------   d-----w   C:\Programme\Security Task Manager
2008-03-04 19:10   ---------   d-----w   C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SecTaskMan
2008-03-04 19:09   ---------   d-----w   C:\Programme\JthAbcKeylogger
2008-03-01 18:12   ---------   d-----w   C:\Dokumente und Einstellungen\Manu\Anwendungsdaten\Ahead
2008-03-01 18:10   ---------   d-----w   C:\Programme\Ahead
2008-03-01 18:03   ---------   d-----w   C:\Programme\Nero
2008-03-01 18:03   ---------   d-----w   C:\Programme\Gemeinsame Dateien\Ahead
2008-03-01 16:11   ---------   d-----w   C:\Programme\DivX
2008-03-01 12:54   826,368   ----a-w   C:\WINDOWS\system32\wininet.dll
2008-02-24 13:21   ---------   d-----w   C:\Programme\LimeWire
2008-02-21 20:35   32   ----a-w   C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ezsid.dat
2008-02-21 02:05   524,288   ----a-w   C:\WINDOWS\system32\DivXsm.exe
2008-02-21 02:05   3,596,288   ----a-w   C:\WINDOWS\system32\qt-dx331.dll
2008-02-21 02:05   200,704   ----a-w   C:\WINDOWS\system32\ssldivx.dll
2008-02-21 02:05   1,044,480   ----a-w   C:\WINDOWS\system32\libdivx.dll
2008-02-21 02:04   823,296   ----a-w   C:\WINDOWS\system32\divx_xx0c.dll
2008-02-21 02:04   823,296   ----a-w   C:\WINDOWS\system32\divx_xx07.dll
2008-02-21 02:04   81,920   ----a-w   C:\WINDOWS\system32\dpl100.dll
2008-02-21 02:04   802,816   ----a-w   C:\WINDOWS\system32\divx_xx11.dll
2008-02-21 02:04   682,496   ----a-w   C:\WINDOWS\system32\DivX.dll
2008-02-21 02:04   593,920   ----a-w   C:\WINDOWS\system32\dpuGUI11.dll
2008-02-21 02:04   57,344   ----a-w   C:\WINDOWS\system32\dpv11.dll
2008-02-21 02:04   53,248   ----a-w   C:\WINDOWS\system32\dpuGUI10.dll
2008-02-21 02:04   344,064   ----a-w   C:\WINDOWS\system32\dpus11.dll
2008-02-21 02:04   294,912   ----a-w   C:\WINDOWS\system32\dpu11.dll
2008-02-21 02:04   294,912   ----a-w   C:\WINDOWS\system32\dpu10.dll
2008-02-21 02:04   196,608   ----a-w   C:\WINDOWS\system32\dtu100.dll
2008-02-21 02:03   156,992   ----a-w   C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-02-21 02:03   12,288   ----a-w   C:\WINDOWS\system32\DivXWMPExtType.dll
2008-02-20 06:50   282,624   ----a-w   C:\WINDOWS\system32\gdi32.dll
2008-02-20 05:33   45,568   ----a-w   C:\WINDOWS\system32\dnsrslvr.dll
2007-10-07 16:10   16,384   --sha-w   C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
2007-10-07 16:10   32,768   --sha-w   C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\index.dat
2007-10-07 16:10   16,384   --sha-w   C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Verlauf\History.IE5\index.dat
.

((((((((((((((((((((((((((((   Autostart Punkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Hinweis* leere Eintrage & legitime Standardeintrage werden nicht angezeigt.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 14:00 15360]
"msnmsgr"="C:\Programme\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 12:34 5724184]
"EPSON Stylus Photo RX420 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.exe" [2004-04-09 05:00 98304]
"Skype"="C:\Programme\Skype\Phone\Skype.exe" [2008-02-01 18:22 21898024]
"SpybotSD TeaTimer"="C:\Programme\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]
"MSMSGS"="C:\Programme\Messenger\msmsgs.exe" [2004-10-13 18:24 1694208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2004-08-10 04:04 59392]
"SoundMan"="SOUNDMAN.EXE" [2004-11-15 12:20 77824 C:\WINDOWS\SOUNDMAN.EXE]
"SunJavaUpdateSched"="C:\Programme\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"Gainward"="C:\WINDOWS\TBPanel.exe" [2005-07-25 10:39 2043904]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-08-17 16:23 8478720]
"nwiz"="nwiz.exe" [2007-08-17 16:23 1626112 C:\WINDOWS\system32\nwiz.exe]
"avgnt"="C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" [2008-04-17 10:57 262401]
"EPSON Stylus Photo RX420 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.exe" [2004-04-09 05:00 98304]
"Adobe Photo Downloader"="C:\Programme\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [ ]
"Adobe Reader Speed Launcher"="C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 20:51 39792]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2005-07-22 23:25 28160 C:\WINDOWS\KHALMNPR.Exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-08-17 16:23 81920]
"QuickTime Task"="C:\Programme\QuickTime\qttask.exe" [2007-09-26 20:40 286720]
"NeroCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-10 14:00 15360]

C:\Dokumente und Einstellungen\All Users\Startmen\Programme\Autostart\
Logitech SetPoint.lnk - C:\Programme\Logitech\SetPoint\SetPoint.exe [2007-08-13 15:04:05 528384]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.XFR1"= xfcodec.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Programme\\World of Warcraft\\WoW-2.1.0-deDE-downloader.exe"=
"C:\\Programme\\Windows Media Player\\wmplayer.exe"=
"C:\\Programme\\Steam\\SteamApps\\2high2die\\counter-strike source\\hl2.exe"=
"C:\\Programme\\Internet Explorer\\iexplore.exe"=
"C:\\Programme\\World of Warcraft\\Launcher.exe"=
"C:\\Programme\\World of Warcraft\\BackgroundDownloader.exe"=
"C:\\Programme\\Xfire\\xfire.exe"=
"C:\\Programme\\MobMapUpdater\\MobMapUpdater.exe"=
"C:\\Programme\\Azureus\\Azureus.exe"=
"C:\\Programme\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Programme\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Programme\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

R2 PStrip;PStrip;C:\WINDOWS\system32\drivers\pstrip.sys [2007-07-15 04:37]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{03df0f3c-6e94-11dc-bc0d-0013d4f7e6c5}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe

*Newly Created Service* - CATCHME
.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-22 15:51:16
Windows 5.1.2600 Service Pack 2 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostart Einträge...

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
  EPSON Stylus Photo RX420 Series = C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE /P31 "EPSON Stylus Photo RX420 Series" /M "Stylus Photo RX420" /EF "HKCU"??????????????????????l???????T???I???????????????l???????????J?6~????????l????????????????c:~????????l?????????????????????????????????6~p?V???????????6~???????????????????????????????|????????p?V?????????????????`c:~??6~-?7~????????????????????????9???????7???????????4????Y7~????????????????P???????????????T????Y7~????P???????{S??????????????X?8~????P???????j?8~P???????8???????????`??

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 9

**************************************************************************
.
Zeit der Fertigstellung: 2008-04-22 15:51:58
ComboFix-quarantined-files.txt  2008-04-22 13:51:55

               8 Verzeichnis(se), 65,544,675,328 Bytes frei
              11 Verzeichnis(se), 66,176,151,552 Bytes frei

154   --- E O F ---   2008-04-11 23:07:18
 

Bin in nun endlich frei von den bescheurten Viren oder nicht ?

Start - Ausführen - Kopiere rein: Combofix /U - klicke "OK"

Mach nun abschließend einen Onlinescan mit Bitdefender
http://www.bitdefender.com/scan8/ie.html
mit dem Internetexplorer (auf I agree klicken / active x zulassen) Report posten

BitDefender Online Scanner
 
 
 
Scan report generated at: Wed, Apr 23, 2008 - 18:02:45
 
 
Scan path: A:\;C:\:\;
 
 
Statistics
 
Time
 01:12:58
 
Files
 348560
 
Folders
 7230
 
Boot Sectors
 2
 
Archives
 1934
 
Packed Files
 25645
 
 
 
Results
 
Identified Viruses
 2
 
Infected Files
 3
 
Suspect Files
 0
 
Warnings
 0
 
Disinfected
 0
 
Deleted Files
 3
 
 
 
 
Engines Info
 
Virus Definitions
 1175964
 
Engine build
 AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)
 
Scan plugins
 16
 
Archive plugins
 42
 
Unpack plugins
 7
 
E-mail plugins
 6
 
System plugins
 5
 
 
 
 
Scan Settings
 
First Action
 Disinfect
 
Second Action
 Delete
 
Heuristics
 Yes
 
Enable Warnings
 Yes
 
Scanned Extensions
 *;
 
Exclude Extensions
 
 
Scan Emails
 Yes
 
Scan Archives
 Yes
 
Scan Packed
 Yes
 
Scan Files
 Yes
 
Scan Boot
 Yes
 
 
 
 
  Scanned File
  Status
 
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SecTaskMan\KeyLogger.exe.q_DFB2009_q
 Detected with: Spyware.Abckeylog.A
 
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SecTaskMan\KeyLogger.exe.q_DFB2009_q
 Deleted
 
C:\Programme\Gamers.IRC\bin\dll\moo.dll
 Detected with: Application.Motherboardmonitor.B
 
C:\Programme\Gamers.IRC\bin\dll\moo.dll
 Disinfection failed
 
C:\Programme\Gamers.IRC\bin\dll\moo.dll
 Deleted
 
C:\System Volume Information\_restore{A00ECA04-E354-4569-9783-AA3C80797A86}\RP215\A0043776.dll
 Detected with: Application.Motherboardmonitor.B
 
C:\System Volume Information\_restore{A00ECA04-E354-4569-9783-AA3C80797A86}\RP215\A0043776.dll
 Disinfection failed
 
C:\System Volume Information\_restore{A00ECA04-E354-4569-9783-AA3C80797A86}\RP215\A0043776.dll
 Deleted
 
 
 

Ändere alle wichtigen Passwörter!

Noch Probleme?