Sicherheit – Seite 3

das ergebniss sieht komisch aus... mach mit combofix weiter.

das ist der logbericht von combifix.

ComboFix 09-03-19.02 - Mama 2009-03-20 17:42:55.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium   6.0.6001.1.1252.1.1031.18.1022.438 [GMT 1:00]
ausgeführt von:: c:\users\Mama\Downloads\ComboFix.exe
 * Neuer Wiederherstellungspunkt wurde erstellt
.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\Mama\AppData\Local\koqikmq.dat
c:\users\Mama\AppData\Local\koqikmq_nav.dat
c:\users\Mama\AppData\Local\koqikmq_navps.dat

.
(((((((((((((((((((((((   Dateien erstellt von 2009-02-20 bis 2009-03-20  ))))))))))))))))))))))))))))))
.

2009-03-20 16:27 . 2009-03-20 17:28   <DIR>   d--------   c:\program files\Navilog1
2009-03-19 12:26 . 2009-03-20 16:30   <DIR>   d--------   c:\users\All Users\PrevxCSI
2009-03-19 12:26 . 2009-03-20 16:30   <DIR>   d--------   c:\programdata\PrevxCSI
2009-03-19 12:26 . 2009-03-19 12:26   <DIR>   d--------   c:\program files\Prevx
2009-03-19 12:26 . 2009-03-19 12:26   22,536   --a------   c:\windows\System32\drivers\pxscan.sys
2009-03-17 16:20 . 2009-03-20 16:15   <DIR>   d--h-----   C:\$AVG8.VAULT$
2009-03-17 10:55 . 2009-03-17 10:55   10,520   --a------   c:\windows\System32\avgrsstx.dll
2009-03-17 10:54 . 2009-03-20 10:27   <DIR>   d--------   c:\windows\System32\drivers\Avg
2009-03-17 10:54 . 2009-03-17 10:54   325,640   --a------   c:\windows\System32\drivers\avgldx86.sys
2009-03-17 10:54 . 2009-03-17 10:54   107,912   --a------   c:\windows\System32\drivers\avgtdix.sys
2009-03-17 10:54 . 2009-03-17 10:54   12,552   --a------   c:\windows\System32\drivers\avgrkx86.sys
2009-03-17 10:52 . 2009-03-18 09:44   <DIR>   d--------   c:\users\All Users\avg8
2009-03-17 10:52 . 2009-03-18 09:44   <DIR>   d--------   c:\programdata\avg8
2009-03-17 10:52 . 2009-03-17 10:52   23,832   --a------   c:\windows\System32\drivers\avgfwd6x.sys
2009-03-15 14:09 . 2009-03-15 14:12   <DIR>   d--------   c:\program files\ICQ6.5
2009-03-12 13:14 . 2009-03-12 12:19   15,688   --a------   c:\windows\System32\lsdelete.exe
2009-03-12 12:19 . 2009-03-12 12:19   <DIR>   d----c---   c:\windows\System32\DRVSTORE
2009-03-12 12:19 . 2009-03-12 12:19   64,160   --a------   c:\windows\System32\drivers\Lbd.sys
2009-03-12 12:18 . 2009-03-12 12:18   <DIR>   d--h-c---   c:\users\All Users\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-03-12 12:18 . 2009-03-12 12:18   <DIR>   d--h-c---   c:\programdata\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-03-12 12:18 . 2009-03-12 12:18   <DIR>   d--------   c:\program files\Lavasoft
2009-03-11 07:29 . 2009-02-09 04:10   2,033,152   --a------   c:\windows\System32\win32k.sys
2009-03-11 07:29 . 2008-11-27 05:43   268,288   --a------   c:\windows\System32\schannel.dll
2009-03-07 20:34 . 2009-03-07 20:34   0   --ah-----   c:\users\Default.LOG2
2009-03-07 20:34 . 2009-03-07 20:34   0   --ah-----   c:\users\Default.LOG1
2009-03-07 20:34 . 2009-03-07 20:34   0   --ah-----   C:\ProgramData.LOG2
2009-03-07 20:34 . 2009-03-07 20:34   0   --ah-----   C:\ProgramData.LOG1
2009-03-07 20:03 . 2009-03-07 20:03   <DIR>   d--------   c:\program files\Webroot
2009-03-07 20:03 . 2009-03-07 20:03   <DIR>   d--------   c:\program files\MSSOAP
2009-03-07 20:02 . 2009-03-07 20:05   164   --a------   c:\windows\install.dat
2009-03-01 15:05 . 2009-03-01 15:05   <DIR>   d--------   c:\program files\Common Files\PX Storage Engine
2009-02-26 12:04 . 2008-12-16 04:29   8,147,456   --a------   c:\windows\System32\wmploc.DLL
2009-02-26 12:04 . 2008-12-16 06:31   7,680   --a------   c:\windows\System32\spwmp.dll
2009-02-26 12:04 . 2008-12-16 06:31   4,096   --a------   c:\windows\System32\msdxm.ocx
2009-02-26 12:04 . 2008-12-16 06:31   4,096   --a------   c:\windows\System32\dxmasf.dll
2009-02-22 16:24 . 2009-02-22 17:32   <DIR>   d-a------   c:\users\All Users\TEMP
2009-02-22 16:24 . 2009-02-22 17:32   <DIR>   d-a------   c:\programdata\TEMP
2009-02-21 13:52 . 2009-02-21 13:52   10,520   --a------   c:\windows\System32\avgrsstx.dll.install_backup

.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

ComboFix 09-03-19.02 - Mama 2009-03-20 17:42:55.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium   6.0.6001.1.1252.1.1031.18.1022.438 [GMT 1:00]
ausgeführt von:: c:\users\Mama\Downloads\ComboFix.exe
 * Neuer Wiederherstellungspunkt wurde erstellt
.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\Mama\AppData\Local\koqikmq.dat
c:\users\Mama\AppData\Local\koqikmq_nav.dat
c:\users\Mama\AppData\Local\koqikmq_navps.dat

.
(((((((((((((((((((((((   Dateien erstellt von 2009-02-20 bis 2009-03-20  ))))))))))))))))))))))))))))))
.

2009-03-20 16:27 . 2009-03-20 17:28   <DIR>   d--------   c:\program files\Navilog1
2009-03-19 12:26 . 2009-03-20 16:30   <DIR>   d--------   c:\users\All Users\PrevxCSI
2009-03-19 12:26 . 2009-03-20 16:30   <DIR>   d--------   c:\programdata\PrevxCSI
2009-03-19 12:26 . 2009-03-19 12:26   <DIR>   d--------   c:\program files\Prevx
2009-03-19 12:26 . 2009-03-19 12:26   22,536   --a------   c:\windows\System32\drivers\pxscan.sys
2009-03-17 16:20 . 2009-03-20 16:15   <DIR>   d--h-----   C:\$AVG8.VAULT$
2009-03-17 10:55 . 2009-03-17 10:55   10,520   --a------   c:\windows\System32\avgrsstx.dll
2009-03-17 10:54 . 2009-03-20 10:27   <DIR>   d--------   c:\windows\System32\drivers\Avg
2009-03-17 10:54 . 2009-03-17 10:54   325,640   --a------   c:\windows\System32\drivers\avgldx86.sys
2009-03-17 10:54 . 2009-03-17 10:54   107,912   --a------   c:\windows\System32\drivers\avgtdix.sys
2009-03-17 10:54 . 2009-03-17 10:54   12,552   --a------   c:\windows\System32\drivers\avgrkx86.sys
2009-03-17 10:52 . 2009-03-18 09:44   <DIR>   d--------   c:\users\All Users\avg8
2009-03-17 10:52 . 2009-03-18 09:44   <DIR>   d--------   c:\programdata\avg8
2009-03-17 10:52 . 2009-03-17 10:52   23,832   --a------   c:\windows\System32\drivers\avgfwd6x.sys
2009-03-15 14:09 . 2009-03-15 14:12   <DIR>   d--------   c:\program files\ICQ6.5
2009-03-12 13:14 . 2009-03-12 12:19   15,688   --a------   c:\windows\System32\lsdelete.exe
2009-03-12 12:19 . 2009-03-12 12:19   <DIR>   d----c---   c:\windows\System32\DRVSTORE
2009-03-12 12:19 . 2009-03-12 12:19   64,160   --a------   c:\windows\System32\drivers\Lbd.sys
2009-03-12 12:18 . 2009-03-12 12:18   <DIR>   d--h-c---   c:\users\All Users\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-03-12 12:18 . 2009-03-12 12:18   <DIR>   d--h-c---   c:\programdata\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-03-12 12:18 . 2009-03-12 12:18   <DIR>   d--------   c:\program files\Lavasoft
2009-03-11 07:29 . 2009-02-09 04:10   2,033,152   --a------   c:\windows\System32\win32k.sys
2009-03-11 07:29 . 2008-11-27 05:43   268,288   --a------   c:\windows\System32\schannel.dll
2009-03-07 20:34 . 2009-03-07 20:34   0   --ah-----   c:\users\Default.LOG2
2009-03-07 20:34 . 2009-03-07 20:34   0   --ah-----   c:\users\Default.LOG1
2009-03-07 20:34 . 2009-03-07 20:34   0   --ah-----   C:\ProgramData.LOG2
2009-03-07 20:34 . 2009-03-07 20:34   0   --ah-----   C:\ProgramData.LOG1
2009-03-07 20:03 . 2009-03-07 20:03   <DIR>   d--------   c:\program files\Webroot
2009-03-07 20:03 . 2009-03-07 20:03   <DIR>   d--------   c:\program files\MSSOAP
2009-03-07 20:02 . 2009-03-07 20:05   164   --a------   c:\windows\install.dat
2009-03-01 15:05 . 2009-03-01 15:05   <DIR>   d--------   c:\program files\Common Files\PX Storage Engine
2009-02-26 12:04 . 2008-12-16 04:29   8,147,456   --a------   c:\windows\System32\wmploc.DLL
2009-02-26 12:04 . 2008-12-16 06:31   7,680   --a------   c:\windows\System32\spwmp.dll
2009-02-26 12:04 . 2008-12-16 06:31   4,096   --a------   c:\windows\System32\msdxm.ocx
2009-02-26 12:04 . 2008-12-16 06:31   4,096   --a------   c:\windows\System32\dxmasf.dll
2009-02-22 16:24 . 2009-02-22 17:32   <DIR>   d-a------   c:\users\All Users\TEMP
2009-02-22 16:24 . 2009-02-22 17:32   <DIR>   d-a------   c:\programdata\TEMP
2009-02-21 13:52 . 2009-02-21 13:52   10,520   --a------   c:\windows\System32\avgrsstx.dll.install_backup

.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-16 11:46   ---------   d--h--w   c:\program files\InstallShield Installation Information
2009-03-16 09:53   ---------   d-----w   c:\program files\ICQ6Toolbar
2009-03-15 13:10   ---------   d-----w   c:\programdata\ICQ
2009-03-15 13:10   ---------   d-----w   c:\program files\ICQ6
2009-03-12 13:00   ---------   d-----w   c:\program files\Malwarebytes' Anti-Malware
2009-03-12 10:23   ---------   d-----w   c:\program files\Windows Mail
2009-03-07 18:34   410,984   ----a-w   c:\windows\System32\deploytk.dll
2009-03-07 18:34   ---------   d-----w   c:\program files\Java
2009-03-07 12:54   ---------   d-----w   c:\program files\Windows Live Safety Center
2009-02-26 11:09   ---------   d-----w   c:\program files\Microsoft Silverlight
2009-02-11 09:19   38,496   ----a-w   c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-11 09:19   15,504   ----a-w   c:\windows\system32\drivers\mbam.sys
2009-02-02 20:04   ---------   d-----w   c:\users\Mama\AppData\Roaming\Malwarebytes
2009-02-02 20:04   ---------   d-----w   c:\programdata\Malwarebytes
2009-02-02 17:43   ---------   d-----w   c:\program files\Trend Micro
2009-01-28 17:04   ---------   d-----w   c:\users\Mama\AppData\Roaming\aAvgApi
2009-01-24 15:59   ---------   d-----w   c:\programdata\BVRP Software
2009-01-24 15:59   ---------   d-----w   c:\program files\Avanquest update
2009-01-24 15:42   ---------   d-----w   c:\program files\Sony Ericsson
2009-01-24 14:25   ---------   d-----w   c:\users\Mama\AppData\Roaming\Sony
2009-01-24 14:25   ---------   d-----w   c:\programdata\Sony
2009-01-24 14:14   ---------   d-----w   c:\program files\Common Files\Sony Shared
2009-01-24 14:08   ---------   d-----w   c:\programdata\Apple
2009-01-24 14:08   ---------   d-----w   c:\program files\Apple Software Update
2009-01-24 14:06   ---------   d-----w   c:\users\Mama\AppData\Roaming\Sony Setup
2009-01-24 14:06   ---------   d-----w   c:\program files\Sony Setup
2009-01-24 13:54   ---------   d-----w   c:\program files\Common Files\InstallShield
2009-01-24 13:36   ---------   d-----w   c:\program files\Google
2009-01-24 13:20   ---------   d-----w   c:\programdata\Sony Ericsson
2009-01-19 16:19   1,076   ----a-w   c:\users\Mama\AppData\Roaming\wklnhst.dat
2009-01-15 06:11   827,392   ----a-w   c:\windows\System32\wininet.dll
2008-09-06 21:27   174   --sha-w   c:\program files\desktop.ini
.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-09-04 39408]
"Yahoo! Pager"="c:\progra~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" [2007-08-30 4670704]
"MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 49152]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-09-17 13580832]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-09-17 92704]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-07 148888]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-03-12 515416]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-03-17 1932568]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-01-02 210520]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute   REG_MULTI_SZ      SsiEfr.exe\0lsdelete

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{287472EA-8D7C-4336-94E3-544DDFCAD8C8}"= UDP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{638B02B7-8CFD-4423-BCCB-B6A0D6C6148D}"= TCP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"TCP Query User{2BA5FA37-F3E4-4FF5-9421-855CE835A026}c:\\program files\\icq6\\icq.exe"= UDP:c:\program files\icq6\icq.exe:ICQ Library
"UDP Query User{AB9E4EF3-0C37-434F-9286-C15659285001}c:\\program files\\icq6\\icq.exe"= TCP:c:\program files\icq6\icq.exe:ICQ Library
"{5069929A-71B6-47A6-8570-D8AE71A19885}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"{96EECBC0-85E9-4921-823F-D09EBB451E5F}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{5A37227F-52BD-438F-B754-9CAA6FA62A69}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{D4F1889A-49A8-4292-AFDC-8304E97CE812}"= UDP:c:\program files\Common Files\MicroWorld\Agent\MWAGENT.EXE:MicroWorld Management Agent
"{C141FD1E-2EB9-4E03-A8C0-BF89460386B8}"= TCP:c:\program files\Common Files\MicroWorld\Agent\MWAGENT.EXE:MicroWorld Management Agent
"{87F2C29B-343F-46D0-9821-BA1EEC5EC66D}"= UDP:c:\program files\Common Files\MicroWorld\eScanRAD\ESCANRAD.EXE:eScan Remote Administration Tool
"{2ABFF9BC-7BB4-4444-95F1-376D8B994DEF}"= TCP:c:\program files\Common Files\MicroWorld\eScanRAD\ESCANRAD.EXE:eScan Remote Administration Tool
"{5573C872-B572-4892-9DE8-51AC7B0095B9}"= c:\program files\AVG\AVG8\avgam.exe:avgam.exe
"{A0F1610E-9F6D-4A4F-B7A0-4CDDB82CF22B}"= c:\program files\AVG\AVG8\avgdiag.exe:avgdiag.exe
"{9A149DC7-50AC-4281-91C8-7AC52A30B9C7}"= c:\program files\AVG\AVG8\avgdiagex.exe:avgdiagex.exe
"{30A28B50-04BC-4937-8F22-2173605EBED5}"= c:\program files\AVG\AVG8\avgemc.exe:avgemc.exe
"{2487AB22-49AB-449C-9CD8-5CEE27C7E4AE}"= c:\program files\AVG\AVG8\avgupd.exe:avgupd.exe
"{ECA283A0-34CB-42A8-8619-7D4C6E86E85A}"= c:\program files\AVG\AVG8\avgnsx.exe:avgnsx.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

R0 AvgRkx86;avgrkx86.sys;c:\windows\System32\drivers\avgrkx86.sys [2009-03-17 12552]
R0 Lbd;Lbd;c:\windows\System32\drivers\Lbd.sys [2009-03-12 64160]
R0 pxscan;pxscan;c:\windows\System32\drivers\pxscan.sys [2009-03-19 22536]
R1 Avgfwfd;AVG network filter service;c:\windows\System32\drivers\avgfwd6x.sys [2009-03-17 23832]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\System32\drivers\avgldx86.sys [2009-03-17 325640]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\System32\drivers\avgtdix.sys [2009-03-17 107912]
R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2009-03-17 908056]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-03-17 298264]
R2 avgfws8;AVG8 Firewall;c:\progra~1\AVG\AVG8\avgfws8.exe [2009-03-17 1362784]
R2 CSIScanner;CSIScanner;c:\program files\Prevx\prevx.exe [2009-03-19 4150840]
R2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [2008-09-04 222456]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-01-18 951632]
R3 camfilt2;camfilt2;c:\windows\System32\drivers\camfilt2.sys [2008-09-07 96384]
R3 ovt530;Hercules Classic Webcam;c:\windows\System32\drivers\ov530vid.sys [2008-09-07 167464]
S3 s0016bus;Sony Ericsson Device 0016 driver (WDM);c:\windows\System32\drivers\s0016bus.sys [2009-01-24 89256]
S3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter;c:\windows\System32\drivers\s0016mdfl.sys [2009-01-24 15016]
S3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver;c:\windows\System32\drivers\s0016mdm.sys [2009-01-24 120744]
S3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM);c:\windows\System32\drivers\s0016mgmt.sys [2009-01-24 114216]
S3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS);c:\windows\System32\drivers\s0016nd5.sys [2009-01-24 25512]
S3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface;c:\windows\System32\drivers\s0016obex.sys [2009-01-24 110632]
S3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM);c:\windows\System32\drivers\s0016unic.sys [2009-01-24 115752]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12   REG_MULTI_SZ      Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt   REG_MULTI_SZ      hpqcxs08 hpqddsvc
.
Inhalt des "geplante Tasks" Ordners

2009-03-19 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-12 12:19]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-20 17:55:19
Windows 6.0.6001 Service Pack 1 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.Wäre des jetzt alles, oder fehlt immernoch was?

Zeit der Fertigstellung: 2009-03-20 17:57:08
ComboFix-quarantined-files.txt  2009-03-20 16:57:05

Vor Suchlauf: 16 Verzeichnis(se), 216.953.319.424 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 216,642,052,096 Bytes frei

189   --- E O F ---   2009-03-12 10:34:28
 

neues hijackthis log, füre als administrator aus, wie läuft der pc?

 denke mal wie vorher auch? werd ja morgen, wenn ich antimalware scannen lasse, sehen ob wieder was drinne is.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:26:23, on 20.03.2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Prevx\prevx.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\notepad.exe
C:\Windows\Explorer.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\Google Toolbar\GoogleToolbarUser.exe
C:\Program Files\AVG\AVG8\aAvgApi.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10b.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = 192.168.2.1.
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [Sidebar] "C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [WMPNSCFG] "C:\Program Files\Windows Media Player\WMPNSCFG.exe"
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O13 - Gopher Prefix:
O16 - DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} (Windows Live OneCare safety scanner control) - http://cdn.scan.onecare.live.com/resource/download/scanner/de-ch/wlscctrl2.cab
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - https://wimpro3.cce.hp.com/ChatEntry/downloads/sysinfo.cab
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - https://wimpro3.cce.hp.com/ChatEntry/downloads/msxml4.cab
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://icq.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: AVG8 Firewall (avgfws8) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgfws8.exe
O23 - Service: CSIScanner - Prevx - C:\Program Files\Prevx\prevx.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: ICQ Service - Unknown owner - C:\Program Files\ICQ6Toolbar\ICQ Service.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: MWAgent - MicroWorld Technologies Inc. - C:\Program Files\Common Files\MicroWorld\Agent\MWASER.EXE
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe

--
End of file - 7306 bytes
 

öffne hijackthis klicke scan hake an:
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = 192.168.2.1.
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
den o13-eintrag und alle o16-einträge
deinen autostart solltest du aufräumen dafür hake folgendes an:
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [HP
Software
Update] "C:\Program Files\HP\HP
Software
Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
adwatch behindert malwareBytes außerdem solltest du mleber auf MalwareBytes umsteigen da adaware in letzter zeit viele fehlalarme hat

O4 - HKCU\..\Run: [Sidebar] "C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [WMPNSCFG] "C:\Program Files\Windows Media Player\WMPNSCFG.exe"
schau dir auf jeden fall an was du brauchst und den rest fixen, also drücke fix cheked.
öffne den scleaner extras liste der instalierten programme, erstelle die texxtdatei und poste deren inhalt.
start ausfüren
combofix /u
enter
mache folgende 2 onlinescans:
http://support.f-secure.com/ger/home/ols.shtml
funde löschen, log posten.
Kaspersky, untersuchungsobjekt arbeitsplatz, log posten.
www.kaspersky.com/de/virusscanner - 23k -
für beide scans den internet explorer verwenden.

Ad-Aware
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 9 - Deutsch
Adobe Shockwave Player 11
Apple Software Update
AVG 8.5
CCleaner (remove only)
Der Schreibtrainer 3.6
Favorit
Google Toolbar for Internet Explorer
Hercules Classic Webcam Drivers
HijackThis 2.0.2
HP Customer Participation Program 8.0
HP Imaging Device Functions 8.0
HP OCR Software 8.0
HP Photosmart Essential
HP Photosmart.All-In-One Driver Software 8.0 .A
HP Solution Center 8.0
HP Update
HPSSupply
ICQ Toolbar
ICQ6.5
Java(TM) 6 Update 12
Java(TM) 6 Update 7
king.com (remove only)
Malwarebytes' Anti-Malware
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
Microsoft .NET Framework 3.5 SP1
Microsoft Silverlight
Microsoft Visual C++ 2005 Redistributable
Microsoft Works
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB941833)
MSXML 4.0 SP2 (KB954430)
NVIDIA Drivers
Prevx CSI
Sony Ericsson PC Suite 4.006.00
Spelling Dictionaries Support For Adobe Reader 9
SweetIM Toolbar for Internet Explorer 3.3
VideoLAN VLC media player 0.8.6i
Windows Live Messenger
Windows Live OneCare safety scanner
Windows Live Sign-in Assistant
Yahoo! Messenger
 

das u bei combofix konnte ich leider net finden, hat immer nur gescannt.

ComboFix 09-03-19.02 - Mama 2009-03-20 20:47:37.5 - NTFSx86
Microsoft® Windows Vista™ Home Premium   6.0.6001.1.1252.1.1031.18.1022.286 [GMT 1:00]
ausgeführt von:: c:\users\Mama\Downloads\ComboFix.exe
.

(((((((((((((((((((((((   Dateien erstellt von 2009-02-20 bis 2009-03-20  ))))))))))))))))))))))))))))))
.

2009-03-20 16:27 . 2009-03-20 18:04   <DIR>   d--------   c:\program files\Navilog1
2009-03-19 12:26 . 2009-03-20 16:30   <DIR>   d--------   c:\users\All Users\PrevxCSI
2009-03-19 12:26 . 2009-03-20 16:30   <DIR>   d--------   c:\programdata\PrevxCSI
2009-03-19 12:26 . 2009-03-19 12:26   <DIR>   d--------   c:\program files\Prevx
2009-03-19 12:26 . 2009-03-19 12:26   22,536   --a------   c:\windows\System32\drivers\pxscan.sys
2009-03-17 16:20 . 2009-03-20 16:15   <DIR>   d--h-----   C:\$AVG8.VAULT$
2009-03-17 10:55 . 2009-03-17 10:55   10,520   --a------   c:\windows\System32\avgrsstx.dll
2009-03-17 10:54 . 2009-03-20 10:27   <DIR>   d--------   c:\windows\System32\drivers\Avg
2009-03-17 10:54 . 2009-03-17 10:54   325,640   --a------   c:\windows\System32\drivers\avgldx86.sys
2009-03-17 10:54 . 2009-03-17 10:54   107,912   --a------   c:\windows\System32\drivers\avgtdix.sys
2009-03-17 10:54 . 2009-03-17 10:54   12,552   --a------   c:\windows\System32\drivers\avgrkx86.sys
2009-03-17 10:52 . 2009-03-18 09:44   <DIR>   d--------   c:\users\All Users\avg8
2009-03-17 10:52 . 2009-03-18 09:44   <DIR>   d--------   c:\programdata\avg8
2009-03-17 10:52 . 2009-03-17 10:52   23,832   --a------   c:\windows\System32\drivers\avgfwd6x.sys
2009-03-15 14:09 . 2009-03-15 14:12   <DIR>   d--------   c:\program files\ICQ6.5
2009-03-12 13:14 . 2009-03-12 12:19   15,688   --a------   c:\windows\System32\lsdelete.exe
2009-03-12 12:19 . 2009-03-12 12:19   <DIR>   d----c---   c:\windows\System32\DRVSTORE
2009-03-12 12:19 . 2009-03-12 12:19   64,160   --a------   c:\windows\System32\drivers\Lbd.sys
2009-03-12 12:18 . 2009-03-12 12:18   <DIR>   d--h-c---   c:\users\All Users\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-03-12 12:18 . 2009-03-12 12:18   <DIR>   d--h-c---   c:\programdata\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-03-12 12:18 . 2009-03-12 12:18   <DIR>   d--------   c:\program files\Lavasoft
2009-03-11 07:29 . 2009-02-09 04:10   2,033,152   --a------   c:\windows\System32\win32k.sys
2009-03-11 07:29 . 2008-11-27 05:43   268,288   --a------   c:\windows\System32\schannel.dll
2009-03-07 20:34 . 2009-03-07 20:34   0   --ah-----   c:\users\Default.LOG2
2009-03-07 20:34 . 2009-03-07 20:34   0   --ah-----   c:\users\Default.LOG1
2009-03-07 20:34 . 2009-03-07 20:34   0   --ah-----   C:\ProgramData.LOG2
2009-03-07 20:34 . 2009-03-07 20:34   0   --ah-----   C:\ProgramData.LOG1
2009-03-07 20:03 . 2009-03-07 20:03   <DIR>   d--------   c:\program files\Webroot
2009-03-07 20:03 . 2009-03-07 20:03   <DIR>   d--------   c:\program files\MSSOAP
2009-03-07 20:02 . 2009-03-07 20:05   164   --a------   c:\windows\install.dat
2009-03-01 15:05 . 2009-03-01 15:05   <DIR>   d--------   c:\program files\Common Files\PX Storage Engine
2009-02-26 12:04 . 2008-12-16 04:29   8,147,456   --a------   c:\windows\System32\wmploc.DLL
2009-02-26 12:04 . 2008-12-16 06:31   7,680   --a------   c:\windows\System32\spwmp.dll
2009-02-26 12:04 . 2008-12-16 06:31   4,096   --a------   c:\windows\System32\msdxm.ocx
2009-02-26 12:04 . 2008-12-16 06:31   4,096   --a------   c:\windows\System32\dxmasf.dll
2009-02-22 16:24 . 2009-02-22 17:32   <DIR>   d-a------   c:\users\All Users\TEMP
2009-02-22 16:24 . 2009-02-22 17:32   <DIR>   d-a------   c:\programdata\TEMP
2009-02-21 13:52 . 2009-02-21 13:52   10,520   --a------   c:\windows\System32\avgrsstx.dll.install_backup

.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-16 11:46   ---------   d--h--w   c:\program files\InstallShield Installation Information
2009-03-16 09:53   ---------   d-----w   c:\program files\ICQ6Toolbar
2009-03-15 13:10   ---------   d-----w   c:\programdata\ICQ
2009-03-15 13:10   ---------   d-----w   c:\program files\ICQ6
2009-03-12 13:00   ---------   d-----w   c:\program files\Malwarebytes' Anti-Malware
2009-03-12 10:23   ---------   d-----w   c:\program files\Windows Mail
2009-03-07 18:34   410,984   ----a-w   c:\windows\System32\deploytk.dll
2009-03-07 18:34   ---------   d-----w   c:\program files\Java
2009-03-07 12:54   ---------   d-----w   c:\program files\Windows Live Safety Center
2009-02-26 11:09   ---------   d-----w   c:\program files\Microsoft Silverlight
2009-02-11 09:19   38,496   ----a-w   c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-11 09:19   15,504   ----a-w   c:\windows\system32\drivers\mbam.sys
2009-02-02 20:04   ---------   d-----w   c:\users\Mama\AppData\Roaming\Malwarebytes
2009-02-02 20:04   ---------   d-----w   c:\programdata\Malwarebytes
2009-02-02 17:43   ---------   d-----w   c:\program files\Trend Micro
2009-01-28 17:04   ---------   d-----w   c:\users\Mama\AppData\Roaming\aAvgApi
2009-01-24 15:59   ---------   d-----w   c:\programdata\BVRP Software
2009-01-24 15:59   ---------   d-----w   c:\program files\Avanquest update
2009-01-24 15:42   ---------   d-----w   c:\program files\Sony Ericsson
2009-01-24 14:25   ---------   d-----w   c:\users\Mama\AppData\Roaming\Sony
2009-01-24 14:25   ---------   d-----w   c:\programdata\Sony
2009-01-24 14:14   ---------   d-----w   c:\program files\Common Files\Sony Shared
2009-01-24 14:08   ---------   d-----w   c:\programdata\Apple
2009-01-24 14:08   ---------   d-----w   c:\program files\Apple Software Update
2009-01-24 14:06   ---------   d-----w   c:\users\Mama\AppData\Roaming\Sony Setup
2009-01-24 14:06   ---------   d-----w   c:\program files\Sony Setup
2009-01-24 13:54   ---------   d-----w   c:\program files\Common Files\InstallShield
2009-01-24 13:36   ---------   d-----w   c:\program files\Google
2009-01-24 13:20   ---------   d-----w   c:\programdata\Sony Ericsson
2009-01-19 16:19   1,076   ----a-w   c:\users\Mama\AppData\Roaming\wklnhst.dat
2009-01-15 06:11   827,392   ----a-w   c:\windows\System32\wininet.dll
2008-09-06 21:27   174   --sha-w   c:\program files\desktop.ini
.

(((((((((((((((((((((((((((((   SnapShot@2009-03-20_17.55.47,99   )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-02-27 14:59:28   290,816   ----a-w   c:\windows\Downloaded Program Files\auc_lib.dll
+ 2008-02-27 14:59:28   495,616   ----a-w   c:\windows\Downloaded Program Files\daas_s.dll
+ 2008-02-27 15:00:12   262,144   ----a-w   c:\windows\Downloaded Program Files\fscax.dll
+ 2008-02-27 14:59:16   588,392   ----a-w   c:\windows\Downloaded Program Files\gatelauncher.exe
- 2009-03-20 14:56:11   262,144   --sha-w   c:\windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2009-03-20 16:55:41   262,144   --sha-w   c:\windows\ServiceProfiles\LocalService\NTUSER.DAT
- 2009-03-20 14:57:03   262,144   --sha-w   c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2009-03-20 16:55:33   262,144   --sha-w   c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2009-03-20 16:55:33   262,144   ---ha-w   c:\windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1
- 2009-03-20 16:41:02   16,384   --sha-w   c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-03-20 19:30:13   16,384   --sha-w   c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-03-20 16:41:02   32,768   --sha-w   c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-03-20 19:30:13   32,768   --sha-w   c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-03-20 16:41:02   16,384   --sha-w   c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-03-20 19:30:13   16,384   --sha-w   c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-09-04 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-03-17 1932568]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-01-02 210520]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute   REG_MULTI_SZ      SsiEfr.exe\0lsdelete

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{287472EA-8D7C-4336-94E3-544DDFCAD8C8}"= UDP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{638B02B7-8CFD-4423-BCCB-B6A0D6C6148D}"= TCP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"TCP Query User{2BA5FA37-F3E4-4FF5-9421-855CE835A026}c:\\program files\\icq6\\icq.exe"= UDP:c:\program files\icq6\icq.exe:ICQ Library
"UDP Query User{AB9E4EF3-0C37-434F-9286-C15659285001}c:\\program files\\icq6\\icq.exe"= TCP:c:\program files\icq6\icq.exe:ICQ Library
"{5069929A-71B6-47A6-8570-D8AE71A19885}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"{96EECBC0-85E9-4921-823F-D09EBB451E5F}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{5A37227F-52BD-438F-B754-9CAA6FA62A69}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{D4F1889A-49A8-4292-AFDC-8304E97CE812}"= UDP:c:\program files\Common Files\MicroWorld\Agent\MWAGENT.EXE:MicroWorld Management Agent
"{C141FD1E-2EB9-4E03-A8C0-BF89460386B8}"= TCP:c:\program files\Common Files\MicroWorld\Agent\MWAGENT.EXE:MicroWorld Management Agent
"{87F2C29B-343F-46D0-9821-BA1EEC5EC66D}"= UDP:c:\program files\Common Files\MicroWorld\eScanRAD\ESCANRAD.EXE:eScan Remote Administration Tool
"{2ABFF9BC-7BB4-4444-95F1-376D8B994DEF}"= TCP:c:\program files\Common Files\MicroWorld\eScanRAD\ESCANRAD.EXE:eScan Remote Administration Tool
"{5573C872-B572-4892-9DE8-51AC7B0095B9}"= c:\program files\AVG\AVG8\avgam.exe:avgam.exe
"{A0F1610E-9F6D-4A4F-B7A0-4CDDB82CF22B}"= c:\program files\AVG\AVG8\avgdiag.exe:avgdiag.exe
"{9A149DC7-50AC-4281-91C8-7AC52A30B9C7}"= c:\program files\AVG\AVG8\avgdiagex.exe:avgdiagex.exe
"{30A28B50-04BC-4937-8F22-2173605EBED5}"= c:\program files\AVG\AVG8\avgemc.exe:avgemc.exe
"{2487AB22-49AB-449C-9CD8-5CEE27C7E4AE}"= c:\program files\AVG\AVG8\avgupd.exe:avgupd.exe
"{ECA283A0-34CB-42A8-8619-7D4C6E86E85A}"= c:\program files\AVG\AVG8\avgnsx.exe:avgnsx.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

R0 AvgRkx86;avgrkx86.sys;c:\windows\System32\drivers\avgrkx86.sys [2009-03-17 12552]
R0 Lbd;Lbd;c:\windows\System32\drivers\Lbd.sys [2009-03-12 64160]
R0 pxscan;pxscan;c:\windows\System32\drivers\pxscan.sys [2009-03-19 22536]
R1 Avgfwfd;AVG network filter service;c:\windows\System32\drivers\avgfwd6x.sys [2009-03-17 23832]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\System32\drivers\avgldx86.sys [2009-03-17 325640]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\System32\drivers\avgtdix.sys [2009-03-17 107912]
R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2009-03-17 908056]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-03-17 298264]
R2 avgfws8;AVG8 Firewall;c:\progra~1\AVG\AVG8\avgfws8.exe [2009-03-17 1362784]
R2 CSIScanner;CSIScanner;c:\program files\Prevx\prevx.exe [2009-03-19 4150840]
R2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [2008-09-04 222456]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-01-18 951632]
R3 camfilt2;camfilt2;c:\windows\System32\drivers\camfilt2.sys [2008-09-07 96384]
R3 ovt530;Hercules Classic Webcam;c:\windows\System32\drivers\ov530vid.sys [2008-09-07 167464]
S3 s0016bus;Sony Ericsson Device 0016 driver (WDM);c:\windows\System32\drivers\s0016bus.sys [2009-01-24 89256]
S3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter;c:\windows\System32\drivers\s0016mdfl.sys [2009-01-24 15016]
S3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver;c:\windows\System32\drivers\s0016mdm.sys [2009-01-24 120744]
S3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM);c:\windows\System32\drivers\s0016mgmt.sys [2009-01-24 114216]
S3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS);c:\windows\System32\drivers\s0016nd5.sys [2009-01-24 25512]
S3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface;c:\windows\System32\drivers\s0016obex.sys [2009-01-24 110632]
S3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM);c:\windows\System32\drivers\s0016unic.sys [2009-01-24 115752]

--- Andere Dienste/Treiber im Speicher ---

*NewlyCreated* - F-SECURE_STANDALONE_MINIFILTER
*Deregistered* - F-Secure Standalone Minifilter

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12   REG_MULTI_SZ      Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt   REG_MULTI_SZ      hpqcxs08 hpqddsvc
.
Inhalt des "geplante Tasks" Ordners

2009-03-19 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-12 12:19]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-20 20:59:13
Windows 6.0.6001 Service Pack 1 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

Scanne versteckte Dateien...


c:\users\Mama\AppData\Local\Temp\catchme.dll 53248 bytes executable

Scan erfolgreich abgeschlossen
versteckte Dateien: 1

**************************************************************************
.
Zeit der Fertigstellung: 2009-03-20 21:00:58
ComboFix-quarantined-files.txt  2009-03-20 20:00:56
ComboFix2.txt  2009-03-20 19:22:05
ComboFix3.txt  2009-03-20 18:53:38
ComboFix4.txt  2009-03-20 16:57:09

Vor Suchlauf: 16 Verzeichnis(se), 216,086,474,752 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 216,191,127,552 Bytes frei

197   --- E O F ---   2009-03-12 10:34:28
 

warum noch ein combofix log?
start ausfüren
combofix /u
enter
dann die online scans bitte

Markus er hatte den Befehl nicht verstanden

Vl so verständlicher für den User

Start--->Ausführen--->combofix /u (reinkopieren)-->OK 

nachdem ich jetzt die vorgeschlagenen Punkte gelöscht hatte war sogar meine Lanverbindung deaktiviert, vielen Dank für eure Hilfe aber jetzt werde ich doch neu installieren.

installiere nicht mehr/noch nicht! den AVG 8.5
nimm einen andereren oder AVG 8.0
Denke aber du währest, mit einen anderen besser aufgehoben.