leo015

seit heute nachmittag plagt mich ständig eine nachricht wo drin steht das der pc infiziert ist und das ich ein schutzprogramm (file secure) runterladen soll!!! wie löse ich das problem????


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:25:48, on 10.02.2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16575)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\G oogleToolbarNotifier.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\ICQ6\ICQ.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\system32\Macromed\Flash\FlashUtil9e.exe
C:\Users\user\Desktop\HiJackThis202.exe
c:\program files\google\googletoolbar1user.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.kicker.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {445A3D12-EBA3-4054-AB54-587BF3FF40EA} - C:\Windows\AcroIEHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [CmCardRun] C:\Windows\system32\CmWatch.exe
O4 - HKLM\..\Run: [QuickTime Task] "D:\Quick Time\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\G oogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O13 - Gopher Prefix:
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/DE-DE/.../GAME_UNO1.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary...o.cab56649.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary...t.cab57213.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab57176.cab
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

--
End of file - 5687 bytes

Humdinger

Hallo

Du solltest dein System überprüfen.

Bitte arbeite diese
>>>Anleitung<<<
ab und poste wie angegeben die Reporte

(den unteren Teil für Vista User bitte)

leo015

das ist glaub ich der bericht vom counter spy

Scan History Details
Start Date: 10.02.2008 19:43:35
End Date: 10.02.2008 19:59:56
Total Time: 16 Min 21 Sec
Detected security risks

PartyPoker Potentially Unwanted Program more information...
Details: PartyPoker is an online gambling application that requires the user to download its software in order to play.
Status: Deleted

Files detected
D:\Programs\PartyGaming\PartyCasino\Language\de_DE \Images\PartyCasino.ico
D:\Programs\PartyGaming\PartyPoker\Images\pp_brows er.ico
D:\Programs\PartyGaming\PartyPoker\Images\ppicon.i co

Registry entries detected
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURR ENTVERSION\UNINSTALL\PARTYPOKER
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURR ENTVERSION\UNINSTALL\PARTYPOKER
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURR ENTVERSION\UNINSTALL\PARTYPOKER
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURR ENTVERSION\UNINSTALL\PARTYPOKER
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURR ENTVERSION\UNINSTALL\PARTYPOKER
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURR ENTVERSION\UNINSTALL\PARTYPOKER
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURR ENTVERSION\UNINSTALL\PARTYPOKER
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURR ENTVERSION\UNINSTALL\PARTYPOKER
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURR ENTVERSION\UNINSTALL\PARTYPOKER
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURR ENTVERSION\UNINSTALL\PARTYPOKER
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURR ENTVERSION\UNINSTALL\PARTYPOKER
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURR ENTVERSION\UNINSTALL\PARTYPOKER
HKEY_USERS\S-1-5-21-2480117256-3742256608-282447528-1000\SOFTWARE\PARTYGAMING\PARTYPOKER
HKEY_USERS\S-1-5-21-2480117256-3742256608-282447528-1000\SOFTWARE\PARTYGAMING\PARTYPOKER
HKEY_USERS\S-1-5-21-2480117256-3742256608-282447528-1000\SOFTWARE\PARTYGAMING\PARTYPOKER
HKEY_USERS\S-1-5-21-2480117256-3742256608-282447528-1000\SOFTWARE\PARTYGAMING\PARTYPOKER
HKEY_USERS\S-1-5-21-2480117256-3742256608-282447528-1000\SOFTWARE\PARTYGAMING\PARTYPOKER
HKEY_USERS\S-1-5-21-2480117256-3742256608-282447528-1000\SOFTWARE\PARTYGAMING\PARTYPOKER
HKEY_USERS\S-1-5-21-2480117256-3742256608-282447528-1000\SOFTWARE\PARTYGAMING\PARTYPOKER
HKEY_USERS\S-1-5-21-2480117256-3742256608-282447528-1000\SOFTWARE\PARTYGAMING\PARTYPOKER
HKEY_USERS\S-1-5-21-2480117256-3742256608-282447528-1000\SOFTWARE\PARTYGAMING\PARTYPOKER
HKEY_USERS\S-1-5-21-2480117256-3742256608-282447528-1000\SOFTWARE\PARTYGAMING\PARTYPOKER
HKEY_USERS\S-1-5-21-2480117256-3742256608-282447528-1000\SOFTWARE\PARTYGAMING\PARTYPOKER
HKEY_USERS\S-1-5-21-2480117256-3742256608-282447528-1000\SOFTWARE\PARTYGAMING\PARTYPOKER
HKEY_USERS\S-1-5-21-2480117256-3742256608-282447528-1000\SOFTWARE\PARTYGAMING\PARTYPOKER
HKEY_USERS\S-1-5-21-2480117256-3742256608-282447528-1000\SOFTWARE\PARTYGAMING\PARTYPOKER
HKEY_USERS\S-1-5-21-2480117256-3742256608-282447528-1000\SOFTWARE\PARTYGAMING\PARTYPOKER
HKEY_USERS\S-1-5-21-2480117256-3742256608-282447528-1000\SOFTWARE\PARTYGAMING\PARTYPOKER
HKEY_USERS\S-1-5-21-2480117256-3742256608-282447528-1000\SOFTWARE\PARTYGAMING\PARTYPOKER
HKEY_USERS\S-1-5-21-2480117256-3742256608-282447528-1000\SOFTWARE\PARTYGAMING\PARTYPOKER
HKEY_USERS\S-1-5-21-2480117256-3742256608-282447528-1000\SOFTWARE\PARTYGAMING\PARTYPOKER
HKEY_USERS\S-1-5-21-2480117256-3742256608-282447528-1000\SOFTWARE\PARTYGAMING\PARTYPOKER
HKEY_USERS\S-1-5-21-2480117256-3742256608-282447528-1000\SOFTWARE\PARTYGAMING\PARTYPOKER
HKEY_USERS\S-1-5-21-2480117256-3742256608-282447528-1000\SOFTWARE\PARTYGAMING\PARTYPOKER
HKEY_USERS\S-1-5-21-2480117256-3742256608-282447528-1000\SOFTWARE\PARTYGAMING\PARTYPOKER
HKEY_USERS\S-1-5-21-2480117256-3742256608-282447528-1000\SOFTWARE\PARTYGAMING\PARTYPOKER
HKEY_USERS\S-1-5-21-2480117256-3742256608-282447528-1000\SOFTWARE\PARTYGAMING\PARTYPOKER
HKEY_USERS\S-1-5-21-2480117256-3742256608-282447528-1000\SOFTWARE\PARTYGAMING\PARTYPOKER
HKEY_USERS\S-1-5-21-2480117256-3742256608-282447528-1000\SOFTWARE\PARTYGAMING\PARTYPOKER
HKEY_USERS\S-1-5-21-2480117256-3742256608-282447528-1000\SOFTWARE\PARTYGAMING\PARTYPOKER
HKEY_USERS\S-1-5-21-2480117256-3742256608-282447528-1000\SOFTWARE\PARTYGAMING\PARTYPOKER
HKEY_USERS\S-1-5-21-2480117256-3742256608-282447528-1000\SOFTWARE\PARTYGAMING\PARTYPOKER
HKEY_USERS\S-1-5-21-2480117256-3742256608-282447528-1000\SOFTWARE\PARTYGAMING\PARTYPOKER
HKEY_USERS\S-1-5-21-2480117256-3742256608-282447528-1000\SOFTWARE\PARTYGAMING\PARTYPOKER
HKEY_USERS\S-1-5-21-2480117256-3742256608-282447528-1000\SOFTWARE\PARTYGAMING\PARTYPOKER
HKEY_USERS\S-1-5-21-2480117256-3742256608-282447528-1000\SOFTWARE\PARTYGAMING\PARTYPOKER
HKEY_USERS\S-1-5-21-2480117256-3742256608-282447528-1000\SOFTWARE\PARTYGAMING\PARTYPOKER
HKEY_USERS\S-1-5-21-2480117256-3742256608-282447528-1000\SOFTWARE\PARTYGAMING\PARTYPOKER
HKEY_USERS\S-1-5-21-2480117256-3742256608-282447528-1000\SOFTWARE\PARTYGAMING\PARTYPOKER
HKEY_USERS\S-1-5-21-2480117256-3742256608-282447528-1000\SOFTWARE\PARTYGAMING\PARTYPOKER
HKEY_USERS\S-1-5-21-2480117256-3742256608-282447528-1000\SOFTWARE\PARTYGAMING\PARTYPOKER
HKEY_USERS\S-1-5-21-2480117256-3742256608-282447528-1000\SOFTWARE\PARTYGAMING\PARTYPOKER


Cookie: Tracking Cookies Cookie (General) more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count unique visitors to web pages; and to allow web surfers to use virtual "shopping carts." Online advertising networks use cookies to track users across web sites and to measure ad impressions and click-throughs.
Status: Deleted

Cookies detected
c:\users\gast\appdata\roaming\microsoft\windows\co okies\low\gast@doubleclick[1].txt
c:\users\gast\appdata\roaming\microsoft\windows\co okies\low\gast@mediaplex[2].txt
c:\users\user\appdata\roaming\microsoft\windows\co okies\low\user@mediaplex[2].txt


Files-Secure Rogue Security Program more information...
Status: Deleted

Files detected
C:\PROGRAM FILES\FILES-SECURE\secure.db1
C:\PROGRAM FILES\FILES-SECURE\secure.db2
C:\PROGRAM FILES\FILES-SECURE\secure.db3
C:\PROGRAM FILES\FILES-SECURE\secure.db4
C:\PROGRAM FILES\FILES-SECURE\secure.db5
C:\PROGRAM FILES\FILES-SECURE\secure.exe
C:\PROGRAM FILES\FILES-SECURE\Uninstall.exe
C:\PROGRAM FILES\FILES-SECURE
C:\PROGRAM FILES\FILES-SECURE\UPDATES

Registry entries detected
HKEY_USERS\S-1-5-21-2480117256-3742256608-282447528-1000\SOFTWARE\FILESSECURE
HKEY_USERS\S-1-5-21-2480117256-3742256608-282447528-1000\SOFTWARE\FILESSECURE

leo015

hijack report:

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 20:16:41, on 10.02.2008
Platform: Windows Vista (WinNT 6.00.1904)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\rundll32.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Windows\System32\CmWatch.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Sunbelt Software\CounterSpy\SBCSTray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\G oogleToolbarNotifier.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Users\user\AppData\Local\Microsoft\Windows\Temp orary Internet Files\Content.IE5\FLRVNYQL\HiJackThis_v2[1].exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.kicker.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar mit Pop-Up-Blocker - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {445A3D12-EBA3-4054-AB54-587BF3FF40EA} - C:\Windows\AcroIEHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar mit Pop-Up-Blocker - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [CmCardRun] C:\Windows\system32\CmWatch.exe
O4 - HKLM\..\Run: [QuickTime Task] "D:\Quick Time\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SBCSTray] C:\Program Files\Sunbelt Software\CounterSpy\SBCSTray.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\G oogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O13 - Gopher Prefix:
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/DE-DE/.../GAME_UNO1.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary...o.cab56649.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary...t.cab57213.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab57176.cab
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Sunbelt CounterSpy Antispyware (SBCSSvc) - Sunbelt Software - C:\Program Files\Sunbelt Software\CounterSpy\SBCSSvc.exe

--
End of file - 6542 bytes

leo015

vista scan :


***** ***** ***** ***** *****
***** Scanning C:\Windows *****
***** ***** ***** ***** *****

10.02.2008 WindowsUpdate.log 20 12:1.434.626
10.02.2008 bootstat.dat 20 09:67.584
10.02.2008 ntbtlog.txt 19 43:126.392
10.02.2008 AcroIEHelper.dll 14 23:235.008
29.12.2007 QTFont.qfn 15 21:54.156
28.12.2007 QTFont.for 23 27:1.409
06.12.2007 ODBC.INI 21 35:403
06.12.2007 win.ini 21 35:240
15.11.2007 explorer.exe 00 37:2.923.520
30.08.2007 WindowsShell.Manifest 19 47:749
02.11.2006 WMSysPr9.prx 13 35:316.640
02.11.2006 twunk_16.exe 13 34:49.680
02.11.2006 twain_32.dll 13 34:50.688
02.11.2006 twunk_32.exe 13 34:31.232
02.11.2006 twain.dll 13 34:94.784
02.11.2006 notepad.exe 13 34:151.040
02.11.2006 winhlp32.exe 10 45:9.216
02.11.2006 regedit.exe 10 45:134.656
02.11.2006 HelpPane.exe 10 45:497.152
02.11.2006 hh.exe 10 45:14.848
02.11.2006 fveupdate.exe 10 45:13.312
02.11.2006 bfsvc.exe 10 44:50.176
02.11.2006 mib.bin 08 46:43.131
19.09.2006 HomePremium.xml 12 41:8.328
18.09.2006 system.ini 22 46:219
18.09.2006 _default.pif 22 43:707
18.09.2006 winhelp.exe 22 43:256.192


Die 50 neuesten Dateien im Ordner Windows\system32:

***** ***** ***** ***** *****
***** Scanning C:\Windows\system32 *****
***** ***** ***** ***** *****

10.02.2008 perfh009.dat 20 13:609.944
10.02.2008 perfc009.dat 20 13:103.726
10.02.2008 perfh007.dat 20 13:641.106
10.02.2008 perfc007.dat 20 13:116.500
10.02.2008 PerfStringBackup.INI 20 13:1.461.736
10.02.2008 7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 20 09:3.952
10.02.2008 7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 20 09:3.952
10.02.2008 SBFC.dat 19 43:0
10.02.2008 SBRC.dat 19 43:0
09.01.2008 netcfg.exe 23 28:24.064
09.01.2008 tcpipcfg.dll 23 28:167.424
09.01.2008 netiougc.exe 23 28:22.016
09.01.2008 GameUXLegacyGDFs.dll 23 28:4.247.552
09.01.2008 gameux.dll 23 28:1.686.016
09.01.2008 sbunattend.exe 23 27:11.776
08.01.2008 divxdec.ax 02 16:630.784
04.01.2008 dsm_de.qm 22 59:10.152
04.01.2008 divxsm.tlb 22 59:4.816
04.01.2008 DivXsm.exe 22 59:524.288
04.01.2008 qt-dx331.dll 22 58:3.596.288
04.01.2008 ssldivx.dll 22 58:200.704
04.01.2008 libdivx.dll 22 58:1.044.480
04.01.2008 dpl100.dll 22 57:81.920
04.01.2008 dpl100.dll.manifest 22 57:416
04.01.2008 dtu100.dll 22 57:196.608
04.01.2008 dtu100.dll.manifest 22 57:416
04.01.2008 dpuGUI10.dll 22 57:53.248
04.01.2008 dpv11.dll 22 57:57.344
04.01.2008 dpu11.dll 22 57:294.912
04.01.2008 dpu10.dll 22 57:294.912
04.01.2008 dpuGUI11.dll 22 57:593.920
04.01.2008 dpus11.dll 22 57:344.064
04.01.2008 divx_xx07.dll 22 57:823.296
04.01.2008 divx_xx0c.dll 22 57:823.296
04.01.2008 divx_xx11.dll 22 57:802.816
04.01.2008 DivX.dll 22 57:682.496
04.01.2008 DivXCodecVersionChecker.exe 22 56:156.992
04.01.2008 DivXWMPExtType.dll 22 56:12.288
04.01.2008 dtu_de.qm 22 56:3.136
04.01.2008 dpude.qm 22 56:8.523
02.01.2008 mrt.exe 19 21:17.642.616
28.12.2007 CmdLineExt.dll 23 32:107.888
13.12.2007 quartz.dll 00 09:1.327.104
13.12.2007 LAPRXY.DLL 00 08:9.728
13.12.2007 asferror.dll 00 08:2.048
13.12.2007 WMASF.DLL 00 08:223.232
13.12.2007 ieui.dll 00 08:180.736


***** ***** ***** ***** *****
***** Scanning C:\Windows\system32\drivers\etc\hosts *****
***** ***** ***** ***** *****

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost
::1 localhost



***** ***** ***** ***** *****
***** Scanning Processe *****
***** ***** ***** ***** *****


Abbildname PID Sitzungsname Sitz.-Nr. Speichernutzung
========================= ======== ================ =========== ===============
System Idle Process 0 Services 0 28 K
System 4 Services 0 2.004 K
smss.exe 412 Services 0 544 K
csrss.exe 484 Services 0 3.776 K
wininit.exe 532 Services 0 3.156 K
csrss.exe 544 Console 1 8.508 K
services.exe 576 Services 0 4.180 K
lsass.exe 592 Services 0 2.472 K
lsm.exe 600 Services 0 3.092 K
winlogon.exe 740 Console 1 4.040 K
svchost.exe 768 Services 0 5.276 K
svchost.exe 828 Services 0 5.472 K
svchost.exe 968 Services 0 9.144 K
svchost.exe 1000 Services 0 52.572 K
svchost.exe 1020 Services 0 21.460 K
audiodg.exe 1140 Services 0 9.588 K
SLsvc.exe 1192 Services 0 3.344 K
svchost.exe 1228 Services 0 7.772 K
svchost.exe 1396 Services 0 10.348 K
spoolsv.exe 1560 Services 0 6.740 K
avguard.exe 1584 Services 0 6.624 K
svchost.exe 1604 Services 0 7.604 K
sched.exe 1884 Services 0 2.812 K
AppleMobileDeviceService. 1916 Services 0 2.612 K
svchost.exe 1956 Services 0 3.640 K
SBCSSvc.exe 288 Services 0 7.748 K
svchost.exe 404 Services 0 4.920 K
svchost.exe 812 Services 0 1.956 K
SearchIndexer.exe 1256 Services 0 20.328 K
taskeng.exe 2160 Services 0 4.308 K
taskeng.exe 2364 Console 1 8.532 K
dwm.exe 2388 Console 1 38.524 K
explorer.exe 2452 Console 1 40.032 K
rundll32.exe 2764 Console 1 3.356 K
avgnt.exe 2772 Console 1 1.352 K
CmWatch.exe 2784 Console 1 4.796 K
rundll32.exe 2792 Console 1 4.624 K
iTunesHelper.exe 2812 Console 1 6.472 K
SBCSTray.exe 2848 Console 1 3.968 K
sidebar.exe 2876 Console 1 19.756 K
msnmsgr.exe 2900 Console 1 3.064 K
GoogleToolbarNotifier.exe 2908 Console 1 312 K
ehtray.exe 2916 Console 1 1.368 K
ehmsas.exe 2988 Console 1 3.240 K
iPodService.exe 3476 Services 0 4.148 K
ieuser.exe 3076 Console 1 19.120 K
iexplore.exe 2356 Console 1 74.732 K
WLLoginProxy.exe 4036 Console 1 7.876 K
conime.exe 4696 Console 1 3.312 K
SearchProtocolHost.exe 5612 Services 0 8.484 K
SearchFilterHost.exe 5632 Services 0 4.788 K
cmd.exe 5708 Console 1 2.880 K
tasklist.exe 2540 Console 1 4.420 K
WmiPrvSE.exe 3040 Services 0 5.540 K



Microsoft Windows [Version 6.0.6000]


http://www.paules-pc-forum.de
***** Malware Team *****


***** Ende des Scans 10.02.2008 um 20:20:39,83 ***

leo015

übrigens: das ist die nachricht die immer erscheint


Your computer was infected by unknown trojan
It's dangerous for your system (critical files can be lost)

Click OK to .....

AL-Massiva

Ya Viren-System drüberlaufen lassen. Trojaner entfernen oder was auch immer.

Humdinger

Hallo

**Link entfernt** Bitte keine Downloads direkt verlinken! – auf dem Desktop speichern.
Beende nun dein Antiviren- & evtl. Antispywareprogramm
Doppelklicken auf: combofix.exe
Gib eine 1 ein, um den Scan zu starten, wenn du danach gefragt wirst.
Die Datenträgerbereinigung abwarten (bis ca. 20 Min/ Neustart kann erfolgen)
mit der rechten Maustaste den Text markieren -> kopieren -> vollständig posten

leo015

was soll ich nun machen???

Humdinger

Gute Frage. Da fragen wir mal warum oben der Link von ComboFix entfernt wurde?