Hilfeee Trojaner!

Ladt dir Hijackthis runter und erstelle damit ein Logfile. Anleitung siehe hier:
Anleitung Hijackthis

Außerdem mache einen Scan mit Malwarebytes, lasse alle Funde löschen und Poste den Report hier:

Anleitung:
Anleitung Malwarebytes

Und zum guten schluss auch Combofix benutzen und Logfile posten!!
Combofix

Generell ...
sollte man seine Daten nach Befall sichern ,und den PC neu aufsetzen (Formatieren & Installieren) .....

------------------------------------------------------------------------------------------------------------

zuerst : Browsercache & Cookies löschen

Plattenbereinigung machen zum löschen aller temporären Dateien
Zubehör .....oder :
Arbplatz , Rechtsklick auf die Platte , Eigenschaften ,Bereinigen

-------------------------------------------------------------------------------------------------------------

Virenscan mit deinem Scanner (unbedingt immer im abgesicherten Modus machen)  !
Denn im Normalmodus sind etliche Dateien gesperrt .

Ausserdem verstecken sich welche ggf in der Systemwiederherst.

Vor dem Scan dort unter SYSTEM die Systemwiederherstellumg AUS ,
(vorsicht, alle Punkte sind dann weg)

---------------
Systemwiederherst. wenn OK = wieder AN
Normalstart und Systemwiederherstellungspunkt setzen .

DANN die Anleitung von Ersguterjunge abarbeiten ... !!!

Moin hatte ersmal lange keine zeit aber jezz hab ich die logfile erstellt:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:35:25, on 01.05.2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://de.msn.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: D - {7B8FFA6B-0AD2-3279-A22E-D56A8FB99857} - C:\Windows\system32\xwr57619.dll
O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [Skytel] Skytel.exe
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [Framework Windows] frmwrk32.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [] C:\Windows\TEMP\b2hjh.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [] C:\Windows\TEMP\b2hjh.exe (User 'Default user')
O9 - Extra button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O13 - Gopher Prefix:
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Unknown owner - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\Windows\system32\PnkBstrB.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe

--
End of file - 6109 bytes

O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

O4 - HKUS\S-1-5-18\..\Run: [] C:\Windows\TEMP\b2hjh.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [] C:\Windows\TEMP\b2hjh.exe (User 'Default user')
 

soo zum malewarebytes file:

Malwarebytes' Anti-Malware 1.36
Datenbank Version: 2065
Windows 6.0.6001 Service Pack 1

01.05.2009 21:07:39
mbam-log-2009-05-01 (21-07-39).txt

Scan-Methode: Vollständiger Scan (C:\|)
Durchsuchte Objekte: 157692
Laufzeit: 17 minute(s), 20 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 8
Infizierte Registrierungswerte: 1
Infizierte Dateiobjekte der Registrierung: 3
Infizierte Verzeichnisse: 0
Infizierte Dateien: 10

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7b8ffa6b-0ad2-3279-a22e-d56a8fb99857} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{7b8ffa6b-0ad2-3279-a22e-d56a8fb99857} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{6b6757c6-43a4-32d9-b141-307db618408c} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{544b0ee3-be73-32d2-9adf-cf16e2723ab3} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{7b8ffa6b-0ad2-3279-a22e-d56a8fb99857} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{d48e4caa-ebff-37c5-8440-536a72dc6113} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{7a9e425f-2832-3d43-9a2e-0eba24f85e91} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{448ffae5-1028-309a-a796-8fc52f0c9d6c} (Trojan.BHO) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Framework Windows (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\activedesktop\NoChangingWallpaper (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\Windows\System32\xwr57619.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\Windows\System32\wr57619.dll (Trojan.BHO) -> Quarantined and deleted successfully.
C:\Windows\System32\wr83955.dll (Trojan.BHO) -> Quarantined and deleted successfully.
C:\Windows\System32\xwr83955.dll (Trojan.BHO) -> Quarantined and deleted successfully.
C:\Windows\System32\MSVolume.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\Windows\System32\ftp_non_crp.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\System32\p2hhr.bat (Malware.Trace) -> Quarantined and deleted successfully.
C:\Windows\System32\warning.gif (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Windows\System32\ahtn.htm (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Windows\System32\lmppcsetup.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

und jetzt werde ich mich an combofix ranmachen

schonmal danke

Okay ich werde mir das Combofix Logfile dann ansehen.

ComboFix 09-05-01.1 - HOME 01.05.2009 21:45.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium   6.0.6001.1.1252.49.1031.18.3070.2057 [GMT 2:00]
ausgeführt von:: c:\users\HOME\Pictures\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\install.exe
c:\windows\patchw32.dll
c:\windows\system32\drivers\ovfsthxbdqoiuup.sys
c:\windows\system32\ovfsthxcokhxtei.dat
c:\windows\system32\ovfsthxcwtqipls.dll
c:\windows\system32\ovfsthxthwbtyxp.dll
c:\windows\system32\ovfsthxulnhgdqp.dat
c:\windows\system32\ovfsthxxrxejmop.dll
c:\windows\system32\uniq.tll

.
(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_ovfsthxwwfycrqb


(((((((((((((((((((((((   Dateien erstellt von 2009-04-01 bis 2009-05-01  ))))))))))))))))))))))))))))))
.

2009-05-01 18:47 . 2009-05-01 18:47   --------   d-----w   c:\users\HOME\AppData\Roaming\Malwarebytes
2009-05-01 18:47 . 2009-04-06 13:32   15504   ----a-w   c:\windows\system32\drivers\mbam.sys
2009-05-01 18:47 . 2009-04-06 13:32   38496   ----a-w   c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-01 18:47 . 2009-05-01 18:47   --------   d-----w   c:\programdata\Malwarebytes
2009-05-01 18:47 . 2009-05-01 18:47   --------   d-----w   c:\users\All Users\Malwarebytes
2009-05-01 18:47 . 2009-05-01 18:47   --------   d-----w   c:\program files\Malwarebytes' Anti-Malware
2009-05-01 18:34 . 2009-05-01 18:34   --------   d-----w   c:\program files\Trend Micro
2009-04-28 17:21 . 2009-05-01 15:11   --------   d-----w   c:\programdata\Spybot - Search & Destroy
2009-04-28 17:21 . 2009-05-01 15:11   --------   d-----w   c:\users\All Users\Spybot - Search & Destroy
2009-04-28 17:21 . 2009-04-28 17:22   --------   d-----w   c:\program files\Spybot - Search & Destroy
2009-04-27 17:55 . 2009-04-27 17:32   15688   ----a-w   c:\windows\system32\lsdelete.exe
2009-04-27 17:33 . 2009-04-27 17:32   64160   ----a-w   c:\windows\system32\drivers\Lbd.sys
2009-04-27 17:30 . 2009-04-27 17:30   --------   dc-h--w   c:\programdata\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-04-27 17:30 . 2009-04-27 17:30   --------   dc-h--w   c:\users\All Users\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-04-27 17:00 . 2009-04-27 17:30   --------   d-----w   c:\program files\Lavasoft
2009-04-26 14:00 . 2009-04-26 14:01   --------   d-----w   c:\program files\HDCleaner
2009-04-26 12:15 . 2009-04-26 12:15   --------   d-----w   c:\users\HOME\AppData\Roaming\vlc
2009-04-19 18:24 . 2009-04-26 13:46   --------   d-----w   c:\program files\BurnAware Free
2009-04-14 16:14 . 2009-04-14 16:14   --------   d-----w   c:\users\HOME\AppData\Local\My Games
2009-04-14 11:02 . 2009-04-14 11:02   107888   ----a-w   c:\windows\system32\CmdLineExt.dll
2009-04-14 10:54 . 2009-04-14 10:54   --------   d-----w   c:\program files\Ubisoft
2009-04-12 13:13 . 2009-04-12 13:14   --------   d-----w   c:\program files\Windows Live Safety Center
2009-04-11 13:36 . 2009-04-13 10:18   --------   d-----w   c:\programdata\Tages
2009-04-11 13:36 . 2009-04-13 10:18   --------   d-----w   c:\users\All Users\Tages
2009-04-11 13:21 . 2009-04-11 13:21   279712   ----a-w   c:\windows\system32\drivers\atksgt.sys
2009-04-11 13:21 . 2009-04-11 13:21   25888   ----a-w   c:\windows\system32\drivers\lirsgt.sys
2009-04-05 17:50 . 2009-04-05 17:50   --------   d-----w   c:\windows\system32\config\systemprofile\AppData\Local\Google
2009-04-05 17:50 . 2009-04-05 17:50   --------   d-----w   c:\program files\Common Files\DivX Shared

.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-01 19:16 . 2008-01-21 07:15   628672   ----a-w   c:\windows\system32\perfh007.dat
2009-05-01 19:16 . 2008-01-21 07:15   127400   ----a-w   c:\windows\system32\perfc007.dat
2009-04-27 16:42 . 2009-03-18 00:51   55640   ----a-w   c:\windows\system32\drivers\avgntflt.sys
2009-04-16 12:19 . 2008-12-04 11:59   --------   d--h--w   c:\program files\InstallShield Installation Information
2009-04-16 10:49 . 2006-11-02 11:18   --------   d-----w   c:\program files\Windows Mail
2009-04-14 11:00 . 2008-12-05 12:53   22328   ----a-w   c:\windows\system32\drivers\PnkBstrK.sys
2009-04-14 11:00 . 2008-12-05 12:53   22328   ----a-w   c:\users\HOME\AppData\Roaming\PnkBstrK.sys
2009-04-14 11:00 . 2008-12-05 12:53   107832   ----a-w   c:\windows\system32\PnkBstrB.exe
2009-04-14 11:00 . 2008-12-05 12:53   66872   ----a-w   c:\windows\system32\PnkBstrA.exe
2009-04-14 11:00 . 2008-12-05 12:53   2250024   ----a-w   c:\windows\system32\pbsvc.exe
2009-04-13 09:58 . 2009-03-02 15:24   --------   d-----w   c:\program files\Steam
2009-04-12 17:40 . 2008-12-23 23:34   --------   d-----w   c:\program files\Common Files\Adobe
2009-04-05 19:17 . 2008-12-28 15:29   --------   d-----w   c:\program files\Google
2009-04-05 17:51 . 2008-12-07 00:34   --------   d-----w   c:\program files\DivX
2009-04-02 21:23 . 2009-01-13 22:34   --------   d-----w   c:\program files\Messenger Plus! Live
2009-03-30 20:49 . 2009-03-30 20:49   --------   d-----w   c:\program files\Common Files\Adobe AIR
2009-03-30 20:47 . 2008-12-05 17:45   --------   d-----w   c:\program files\Common Files\Wise Installation Wizard
2009-03-30 16:41 . 2008-12-28 23:57   --------   d-----w   c:\program files\Java
2009-03-24 18:23 . 2009-03-24 18:23   --------   d-----w   c:\program files\Xvid
2009-03-22 20:51 . 2009-03-02 15:33   --------   d-----w   c:\program files\Common Files\Steam
2009-03-18 00:51 . 2009-03-18 00:51   --------   d-----w   c:\program files\Avira
2009-03-18 00:33 . 2008-12-05 17:45   --------   d-----w   c:\program files\AGEIA Technologies
2009-03-18 00:33 . 2006-11-02 10:25   86016   ----a-w   c:\windows\inf\infstrng.dat
2009-03-18 00:33 . 2006-11-02 10:25   51200   ----a-w   c:\windows\inf\infpub.dat
2009-03-18 00:33 . 2006-11-02 10:25   86016   ----a-w   c:\windows\inf\infstor.dat
2009-03-18 00:26 . 2008-12-04 11:20   680   ----a-w   c:\users\HOME\AppData\Local\d3d9caps.dat
2009-03-17 20:26 . 2009-03-17 20:26   --------   d-----w   c:\program files\Eidos
2009-03-17 03:38 . 2009-04-16 10:38   40960   ----a-w   c:\windows\AppPatch\apihex86.dll
2009-03-17 03:38 . 2009-04-16 10:38   13824   ----a-w   c:\windows\system32\apilogen.dll
2009-03-17 03:38 . 2009-04-16 10:38   24064   ----a-w   c:\windows\system32\amxread.dll
2009-03-16 23:42 . 2009-03-16 23:42   --------   d-----w   c:\program files\CCleaner
2009-03-12 02:07 . 2008-12-04 11:20   64896   ----a-w   c:\users\HOME\AppData\Local\GDIPFONTCACHEV1.DAT
2009-03-11 22:37 . 2009-03-11 22:37   92   ----a-w   c:\users\HOME\AppData\Local\fusioncache.dat
2009-03-09 20:11 . 2009-03-09 20:11   8733696   ----a-w   c:\windows\system32\xa13731629.exe
2009-03-09 20:11 . 2009-03-09 20:11   8733696   ----a-w   c:\windows\system32\xa13731332.exe
2009-03-09 20:11 . 2009-03-09 20:11   8733696   ----a-w   c:\windows\system32\xa13690288.exe
2009-03-09 20:11 . 2009-03-09 20:11   8733696   ----a-w   c:\windows\system32\xa13689337.exe
2009-03-09 15:32 . 2008-12-04 21:46   --------   d-----w   c:\program files\Windows Live
2009-03-09 15:31 . 2009-03-09 15:31   --------   d-----w   c:\program files\Microsoft Sync Framework
2009-03-09 15:30 . 2009-03-09 15:30   --------   d-----w   c:\program files\Microsoft SQL Server Compact Edition
2009-03-09 15:28 . 2009-03-09 15:28   --------   d-----w   c:\program files\Microsoft
2009-03-09 15:28 . 2009-03-09 15:28   --------   d-----w   c:\program files\Windows Live SkyDrive
2009-03-09 15:22 . 2009-03-09 15:22   --------   d-----w   c:\program files\Common Files\Windows Live
2009-03-09 03:19 . 2008-12-28 23:58   410984   ----a-w   c:\windows\system32\deploytk.dll
2009-03-08 11:34 . 2009-03-25 14:12   914944   ----a-w   c:\windows\system32\wininet.dll
2009-03-08 11:34 . 2009-03-25 14:12   43008   ----a-w   c:\windows\system32\licmgr10.dll
2009-03-08 11:33 . 2009-03-25 14:12   18944   ----a-w   c:\windows\system32\corpol.dll
2009-03-08 11:33 . 2009-03-25 14:12   109056   ----a-w   c:\windows\system32\iesysprep.dll
2009-03-08 11:33 . 2009-03-25 14:12   109568   ----a-w   c:\windows\system32\PDMSetup.exe
2009-03-08 11:33 . 2009-03-25 14:12   132608   ----a-w   c:\windows\system32\ieUnatt.exe
2009-03-08 11:33 . 2009-03-25 14:12   107520   ----a-w   c:\windows\system32\RegisterIEPKEYs.exe
2009-03-08 11:33 . 2009-03-25 14:12   107008   ----a-w   c:\windows\system32\SetIEInstalledDate.exe
2009-03-08 11:33 . 2009-03-25 14:12   103936   ----a-w   c:\windows\system32\SetDepNx.exe
2009-03-08 11:33 . 2009-03-25 14:12   420352   ----a-w   c:\windows\system32\vbscript.dll
2009-03-08 11:32 . 2009-03-25 14:12   72704   ----a-w   c:\windows\system32\admparse.dll
2009-03-08 11:32 . 2009-03-25 14:12   71680   ----a-w   c:\windows\system32\iesetup.dll
2009-03-08 11:32 . 2009-03-25 14:12   66560   ----a-w   c:\windows\system32\wextract.exe
2009-03-08 11:32 . 2009-03-25 14:12   169472   ----a-w   c:\windows\system32\iexpress.exe
2009-03-08 11:31 . 2009-03-25 14:12   34816   ----a-w   c:\windows\system32\imgutil.dll
2009-03-08 11:31 . 2009-03-25 14:12   48128   ----a-w   c:\windows\system32\mshtmler.dll
2009-03-08 11:31 . 2009-03-25 14:12   45568   ----a-w   c:\windows\system32\mshta.exe
2009-03-08 11:22 . 2009-03-25 14:12   156160   ----a-w   c:\windows\system32\msls31.dll
2009-03-03 04:46 . 2009-04-16 10:38   3599328   ----a-w   c:\windows\system32\ntkrnlpa.exe
2009-03-03 04:46 . 2009-04-16 10:38   3547632   ----a-w   c:\windows\system32\ntoskrnl.exe
2009-03-03 04:39 . 2009-04-16 10:38   183296   ----a-w   c:\windows\system32\sdohlp.dll
2009-03-03 04:39 . 2009-04-16 10:38   551424   ----a-w   c:\windows\system32\rpcss.dll
2009-03-03 04:39 . 2009-04-16 10:38   26112   ----a-w   c:\windows\system32\printfilterpipelineprxy.dll
2009-03-03 04:37 . 2009-04-16 10:38   98304   ----a-w   c:\windows\system32\iasrecst.dll
2009-03-03 04:37 . 2009-04-16 10:38   54784   ----a-w   c:\windows\system32\iasads.dll
2009-03-03 04:37 . 2009-04-16 10:38   44032   ----a-w   c:\windows\system32\iasdatastore.dll
2009-03-03 03:04 . 2009-04-16 10:38   666624   ----a-w   c:\windows\system32\printfilterpipelinesvc.exe
2009-03-03 02:38 . 2009-04-16 10:38   17408   ----a-w   c:\windows\system32\iashost.exe
2009-03-02 20:23 . 2009-03-02 20:23   0   ----a-w   c:\users\HOME\AppData\Roaming\wklnhst.dat
2009-02-24 19:34 . 2009-02-24 19:34   90112   ----a-w   c:\windows\system32\dpl100.dll
2009-02-24 19:34 . 2009-02-24 19:34   823296   ----a-w   c:\windows\system32\divx_xx0c.dll
2009-02-24 19:34 . 2009-02-24 19:34   823296   ----a-w   c:\windows\system32\divx_xx07.dll
2009-02-24 19:34 . 2009-02-24 19:34   815104   ----a-w   c:\windows\system32\divx_xx0a.dll
2009-02-24 19:34 . 2009-02-24 19:34   802816   ----a-w   c:\windows\system32\divx_xx11.dll
2009-02-24 19:34 . 2009-02-24 19:34   684032   ----a-w   c:\windows\system32\DivX.dll
2009-02-16 22:17 . 2009-03-18 00:32   453152   ----a-w   c:\windows\system32\NVUNINST.EXE
2009-02-13 08:49 . 2009-04-16 10:38   72704   ----a-w   c:\windows\system32\secur32.dll
2009-02-13 08:49 . 2009-04-16 10:38   1255936   ----a-w   c:\windows\system32\lsasrv.dll
2009-02-09 03:10 . 2009-03-11 14:05   2033152   ----a-w   c:\windows\system32\win32k.sys
2009-02-06 18:46 . 2009-02-06 18:46   308600   ----a-w   c:\windows\WLXPGSS.SCR
2009-02-06 17:52 . 2009-02-06 17:52   49504   ----a-w   c:\windows\system32\sirenacm.dll
2009-02-06 17:08 . 2009-03-09 15:32   55280   ----a-w   c:\windows\system32\drivers\fssfltr.sys
2009-02-05 15:37 . 2009-02-05 15:37   1196   ----a-w   c:\windows\system32\ealregsnapshot1.reg
2008-01-21 02:43 . 2006-11-02 12:50   174   --sha-w   c:\program files\desktop.ini
2009-02-24 19:34 . 2009-02-24 19:34   1044480   ----a-w   c:\program files\mozilla firefox\plugins\libdivx.dll
2009-02-24 19:34 . 2009-02-24 19:34   200704   ----a-w   c:\program files\mozilla firefox\plugins\ssldivx.dll
.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

geht weiter......



und ich sollte mir noch 6 dateinamen notieren

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-02-18 13683232]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-02-18 92704]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-04-27 516440]
"Skytel"="Skytel.exe" - c:\windows\SkyTel.exe [2007-11-20 1826816]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2007-09-21 55824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSetActiveDesktop"= 1 (0x1)
"NoActiveDesktopChanges"= 1 (0x1)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"WMPNSCFG"=c:\program files\Windows Media Player\WMPNSCFG.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"NvMediaCenter"=RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{0264DFC0-B380-4E64-B359-78EC824BB99B}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{2078A124-FFD2-4448-915A-A0A21807680B}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{C5674A93-E468-424C-855F-7EF7CD957E57}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{9DA5DB86-FCAE-4224-BC16-0FD3AE0725EA}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{5BFEE4B4-90FE-4949-B466-EC1F69F86F58}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{219D2448-F0C4-4916-97E0-F09D1411DF34}"= UDP:c:\windows\System32\PnkBstrA.exe:PnkBstrA
"{CF2F9679-F1D2-4E77-8536-D32407C9BDD6}"= TCP:c:\windows\System32\PnkBstrA.exe:PnkBstrA
"{72602C22-FC1C-43F4-8DFB-6686C62A039B}"= UDP:c:\windows\System32\PnkBstrB.exe:PnkBstrB
"{9F200EE2-CCFD-4DCC-A049-3DD99D72200F}"= TCP:c:\windows\System32\PnkBstrB.exe:PnkBstrB
"{33901831-7ECA-4CD9-9884-F7E83284F5D8}"= UDP:c:\program files\DNA\btdna.exe:DNA (TCP-In)
"{B1F2D5AA-97D6-4AE8-86C5-C7D7F1A8DD07}"= TCP:c:\program files\DNA\btdna.exe:DNA (UDP-In)
"TCP Query User{6ED27FF6-29A8-4E23-B78B-2D040B687D6B}c:\\program files\\steam\\steamapps\\common\\left 4 dead\\left4dead.exe"= UDP:c:\program files\steam\steamapps\common\left 4 dead\left4dead.exe:left4dead
"UDP Query User{CF5E5E9B-744A-4418-973E-BD4F0650A4AE}c:\\program files\\steam\\steamapps\\common\\left 4 dead\\left4dead.exe"= TCP:c:\program files\steam\steamapps\common\left 4 dead\left4dead.exe:left4dead
"{369A528E-4313-4429-B517-A90F536D835A}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In)
"{99DD3FFF-BB65-40EC-832A-C5E8A8C4E326}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In)
"TCP Query User{3BBD4588-F791-4A98-A40D-B5318AFD7798}c:\\program files\\steam\\steamapps\\kingnumberone\\counter-strike source\\hl2.exe"= UDP:c:\program files\steam\steamapps\kingnumberone\counter-strike source\hl2.exe:hl2
"UDP Query User{04A27961-4651-499F-88CA-3ADE4A52E89F}c:\\program files\\steam\\steamapps\\kingnumberone\\counter-strike source\\hl2.exe"= TCP:c:\program files\steam\steamapps\kingnumberone\counter-strike source\hl2.exe:hl2
"TCP Query User{713E012B-EC85-4BC3-BA57-3C4236E3EF81}c:\\program files\\steam\\steamapps\\kingnumberone\\half-life 2 deathmatch\\hl2.exe"= UDP:c:\program files\steam\steamapps\kingnumberone\half-life 2 deathmatch\hl2.exe:hl2
"UDP Query User{394B69EA-77D7-4748-BC5E-C5D41EDCB025}c:\\program files\\steam\\steamapps\\kingnumberone\\half-life 2 deathmatch\\hl2.exe"= TCP:c:\program files\steam\steamapps\kingnumberone\half-life 2 deathmatch\hl2.exe:hl2
"TCP Query User{2BCA9FB4-2E53-437A-A989-7F6FDB8DED63}c:\\program files\\steam\\steamapps\\kingnumberone\\counter-strike source\\hl2.exe"= UDP:c:\program files\steam\steamapps\kingnumberone\counter-strike source\hl2.exe:hl2
"UDP Query User{80AAEB87-21BE-4148-A18E-FDDD8ECF10B3}c:\\program files\\steam\\steamapps\\kingnumberone\\counter-strike source\\hl2.exe"= TCP:c:\program files\steam\steamapps\kingnumberone\counter-strike source\hl2.exe:hl2
"TCP Query User{15CB97D5-B92C-47F2-B829-380B03050C39}c:\\program files\\utorrent\\utorrent.exe"= UDP:c:\program files\utorrent\utorrent.exe:µTorrent
"UDP Query User{FA354C61-FEF0-40FB-8D89-550E8CE97EF1}c:\\program files\\utorrent\\utorrent.exe"= TCP:c:\program files\utorrent\utorrent.exe:µTorrent
"{2EEB9A30-24AF-4E42-9BA6-F2DB2422D033}"= c:\program files\Windows Live\Sync\WindowsLiveSync.exe:Windows Live Sync
"{0D1F1029-84B6-458E-8DDB-26F60D8AD098}"= UDP:c:\program files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe:Rockstar Games Social Club
"{6CE01B64-CA4D-4FFC-8393-E42C50708A7A}"= TCP:c:\program files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe:Rockstar Games Social Club
"{4F1AF02B-EB53-418F-A645-7F2E6A2EE542}"= UDP:c:\program files\Rockstar Games\Grand Theft Auto IV\LaunchGTAIV.exe:Grand Theft Auto IV
"{6534BC06-98E1-4E66-83D0-E904B7BFAC67}"= TCP:c:\program files\Rockstar Games\Grand Theft Auto IV\LaunchGTAIV.exe:Grand Theft Auto IV
"TCP Query User{8C7FFEFE-DDFE-4F48-A519-092D232F7436}c:\\program files\\aspyr\\dark sector\\ds.exe"= UDP:c:\program files\aspyr\dark sector\ds.exe:Dark Sector
"UDP Query User{D23BBCB3-EC23-435B-AD76-777BF2C94DF8}c:\\program files\\aspyr\\dark sector\\ds.exe"= TCP:c:\program files\aspyr\dark sector\ds.exe:Dark Sector
"{75A0AAB1-F066-4995-A3A0-5E4660B938DA}"= UDP:c:\program files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
"{82AC037A-4941-4354-8582-1BD670FFAEC8}"= TCP:c:\program files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
"{4B00CF0B-8A95-4D2A-95F3-9C1FCF47CE8B}"= UDP:c:\program files\Ubisoft\Far Cry 2\bin\FarCry2.exe:Far Cry 2
"{FB4D16A6-046C-4F80-BE50-BD46F0818792}"= TCP:c:\program files\Ubisoft\Far Cry 2\bin\FarCry2.exe:Far Cry 2
"{C41D8C63-26AA-4E64-8B85-B8088A416E95}"= UDP:c:\program files\Ubisoft\Far Cry 2\bin\FC2Launcher.exe:Far Cry 2 Updater
"{8931CBB7-440F-4565-8AF6-CEC7C822C34C}"= TCP:c:\program files\Ubisoft\Far Cry 2\bin\FC2Launcher.exe:Far Cry 2 Updater
"{8BDCBCFF-EA30-46FB-A865-60BF8685E7B2}"= UDP:c:\program files\Ubisoft\Far Cry 2\bin\FC2Editor.exe:Editor
"{27F32F72-0BA2-4A5D-88F5-0CBBB399E3CC}"= TCP:c:\program files\Ubisoft\Far Cry 2\bin\FC2Editor.exe:Editor

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-04-27 953168]
R3 fssfltr;fssfltr;c:\windows\system32\DRIVERS\fssfltr.sys [2009-02-06 55280]
R3 fsssvc;Windows Live Family Safety;c:\program files\Windows Live\Family Safety\fsssvc.exe [2009-02-06 533360]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2009-04-27 64160]
S2 acedrv11;acedrv11;c:\windows\system32\drivers\acedrv11.sys [2008-07-30 277736]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-04-27 108289]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S2 SeaPort;SeaPort;c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2009-01-14 226656]


--- Andere Dienste/Treiber im Speicher ---

*Deregistered* - sptd

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12   REG_MULTI_SZ      Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt   REG_MULTI_SZ      hpqcxs08 hpqddsvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ad1ce12e-cf7c-11dd-adf0-001fd00b01b1}]
\shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL e:\resycled\boot.com e:
\shell\Open\command - e:\resycled\boot.com e:
.
Inhalt des "geplante Tasks" Ordners

2009-04-27 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 17:32]
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -

WebBrowser-{32099AAC-C132-4136-9E9A-4E364A424E17} - (no file)
HKU-Default-Run-Windows Resurections - c:\windows\TEMP\b2hjh.exe
HKU-Default-Run-Diagnostic Manager - c:\windows\TEMP\954558371.exe
HKU-Default-Run-A00FDF23A.exe - c:\windows\TEMP\_A00FDF23A.exe


.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
FF - ProfilePath - c:\users\HOME\AppData\Roaming\Mozilla\Firefox\Profiles\vfn2i66o.default\
FF - prefs.js: browser.search.selectedEngine - Ask
FF - prefs.js: browser.startup.homepage - www.google.de
FF - prefs.js: keyword.URL - hxxp://toolbar.ask.com/toolbarv/askRedirect?o=101720&gct=&gc=1&q=
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll

---- Firefox Richtlinien ----
 .

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-01 21:49
Windows 6.0.6001 Service Pack 1 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

Scanne versteckte Dateien...


c:\windows\system32\drivers\ovfsthxbdqoiuup.sys 81920 bytes executable
c:\windows\system32\ovfsthxenwetoyv.dll 18944 bytes executable
c:\windows\system32\ovfsthxiiqruoiu.dll 60928 bytes executable
c:\windows\system32\ovfsthxqfcewvtc.dat 1355 bytes
c:\windows\system32\ovfsthxtgfbcjbm.dll 18432 bytes executable

Scan erfolgreich abgeschlossen
versteckte Dateien: 5

**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_USERS\S-1-5-21-2991144284-227402195-2311450652-1000\Software\SecuROM\License information*]
"datasecu"=hex:5a,2c,d2,76,33,0a,e4,fa,15,a6,0b,ad,58,a1,f9,e4,3a,2e,1f,2b,28,
   d3,96,db,c2,34,3f,3f,60,39,39,ff,4a,c9,49,1e,72,92,87,a3,94,85,84,20,06,93,\
"rkeysecu"=hex:db,51,2d,0c,88,7d,51,ee,40,7e,16,85,00,ea,0c,3b

[HKEY_USERS\SYSTEM\ControlSet001\Services\ovfsthxwwfycrqb]
@DACL=(02 0000)
"start"=dword:00000001
"type"=dword:00000001
"group"="file system"
"imagepath"=expand:"\\systemroot\\system32\\drivers\\ovfsthxbdqoiuup.sys"
"inst"=dword:00000000

[HKEY_USERS\SYSTEM\ControlSet002\Services\ovfsthxwwfycrqb]
@DACL=(02 0000)
"start"=dword:00000001
"type"=dword:00000001
"group"="file system"
"imagepath"=expand:"\\systemroot\\system32\\drivers\\ovfsthxbdqoiuup.sys"
"inst"=dword:00000000
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\System32\nvvsvc.exe
c:\windows\System32\audiodg.exe
c:\windows\System32\rundll32.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\windows\System32\PnkBstrA.exe
c:\windows\System32\PnkBstrB.exe
c:\windows\System32\conime.exe
c:\windows\System32\rundll32.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\System32\dllhost.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2009-05-01 21:50 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2009-05-01 19:50

Vor Suchlauf: 16 Verzeichnis(se), 436.607.975.424 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 436.554.420.224 Bytes frei

306   --- E O F ---   2009-04-27 16:45

Okay,

Start -> Ausführen -> Combofix /U

Bitte Sdfix runteladen und anwenden, Logfile posten.
http://virus-protect.org/artikel/tools/sdfix.html

combofix deinstallieren?  ???

sind ja nur noch 5 rootkits am start 

 

sind ja nur noch 5 rootkits am start 

LOL 

C. 

wiesoo is das gut oder schlecht? und irgendwie startet mein pc nich im abgesicherten modus passiert nixxxxx

Ich gebe dir einen gutgemeinten Rat

 

c:\windows\system32\drivers\ovfsthxbdqoiuup.sys 81920 bytes executable
c:\windows\system32\ovfsthxenwetoyv.dll 18944 bytes executable
c:\windows\system32\ovfsthxiiqruoiu.dll 60928 bytes executable
c:\windows\system32\ovfsthxqfcewvtc.dat 1355 bytes
c:\windows\system32\ovfsthxtgfbcjbm.dll 18432 bytes executable

 

[HKEY_USERS\SYSTEM\ControlSet001\Services\ovfsthxwwfycrqb]
@DACL=(02 0000)
"start"=dword:00000001
"type"=dword:00000001
"group"="file system"
"imagepath"=expand:"\\systemroot\\system32\\drivers\\ovfsthxbdqoiuup.sys"
"inst"=dword:00000000
 

 

[HKEY_USERS\SYSTEM\ControlSet002\Services\ovfsthxwwfycrqb]
@DACL=(02 0000)
"start"=dword:00000001
"type"=dword:00000001
"group"="file system"
"imagepath"=expand:"\\systemroot\\system32\\drivers\\ovfsthxbdqoiuup.sys"
"inst"=dword:00000000

Setzte dein System neu auf

Hier siehst du das,was dafür verantwortlich sein kann
 

c:\\program files\\utorrent\\utorrent.exe"= TCP:c:\program files\utorrent\utorrent.exe:µTorrent

P2P-Filesharing
Dies sind ansich sichere Programme,jedoch weist du niemals von wo du dir die Sachen herunter lädst.Diese sind meist aus unsicheren Quellen und ich rate dir auch in Zukunft davon ab.
Ausserdem kann es dich zu eventuell illegalen Handlungen verleiten

EDIT

SDFix funktioniert nur bei Windows 2000 und Windows XP im abgesicherten Modus



 

 

Setzte dein System neu auf

Hier siehst du das,was dafür verantwortlich sein kann
 
Zitat
c:\\program files\\utorrent\\utorrent.exe"= TCP:c:\program files\utorrent\utorrent.exe:µTorrent

P2P-Filesharing
Dies sind ansich sichere Programme,jedoch weist du niemals von wo du dir die Sachen herunter lädst.Diese sind meist aus unsicheren Quellen und ich rate dir auch in Zukunft davon ab.
Ausserdem kann es dich zu eventuell illegalen Handlungen verleiten
 

Excellent, Larusso! Ein hartes Wort darf und sollte durchaus gesprochen werden!! Denn die eigentliche Schuld liegt bei gierigen/unbelehrbaren Usern!

C.