Rootkit BOO/TDss.D Bekomme ich nicht mehr weg HELP

cosinus · 15.08.2011, 15:13

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop.

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Hauke1234 · 16.08.2011, 13:12

Hallo Arne!

Habe Combofix Ausgeführt. Den Log habe ich auch. Allerdings Kann ich keine Programme mehr öffnen. Es Kommt ein Schild: z.B. "C:\Users\HaukeS\Desktop\log1234.txt Es wurde versucht, einen Registrierungsschlüssel einem unzulässigen Vorgang zu unterziehen, der zum Löschen markiert wurde". Bin gerade an einem anderen Pc, weil ich auch Firefox usw nicht mehr öffnen kann. ich könnte den Log mit einem stick auf diesen rüberhohlen oder ist das keine gute idee wegen dem virus?

Was soll ich tun Meister

Grüße Hauke

cosinus · 16.08.2011, 13:34

Windows neu starten!!

Hauke1234 · 17.08.2011, 17:38

Ok stimmt

Hier der Combifix Log

Grüße!

cosinus · 17.08.2011, 21:31

Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte

aswMBR.exe und speichere die Datei auf deinem Desktop.

Starte die aswMBR.exe - (aswMBR.exe Anleitung)
Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
Klicke auf Scan.
Warte bitte bis Scan finished successfully im DOS-Fenster steht.
Drücke auf Save Log und speichere diese auf dem Desktop.

Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).

Hauke1234 · 18.08.2011, 10:37

HI Arne!

gmer log:

GMER Logfile:

Code:

ATTFilter

GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2011-08-18 10:47:14
Windows 6.1.7600  
Running: m2pto3ov.exe; Driver: C:\Users\HaukeS\AppData\Local\Temp\kwrorpob.sys


---- Registry - GMER 1.0.15 ----

Reg   HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\001f3ad3f68b                                                    
Reg   HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0c607688b5f7                                                    
Reg   HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\001f3ad3f68b (not active ControlSet)                                
Reg   HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0c607688b5f7 (not active ControlSet)                                

---- Files - GMER 1.0.15 ----

File  C:\Users\HaukeS\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7NAULF0F\video_gallery[1].htm             0 bytes
File  C:\Users\HaukeS\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GJSHXLAK\heias.ret.pu[1].htm              0 bytes
File  C:\Users\HaukeS\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HHHKUYF5\postview-tag-cunda[1].gif        43 bytes
File  C:\Users\HaukeS\AppData\Roaming\Microsoft\Windows\Cookies\haukes@fastclick[2].txt                                              0 bytes
File  C:\Users\HaukeS\AppData\Roaming\Microsoft\Windows\Cookies\haukes@c-and-a[2].txt                                                0 bytes
File  C:\Users\HaukeS\AppData\Roaming\Microsoft\Windows\Cookies\haukes@turn[1].txt                                                   0 bytes
File  C:\Users\HaukeS\AppData\Roaming\Microsoft\Windows\Cookies\haukes@wtp101[1].txt                                                 0 bytes
File  C:\Users\HaukeS\AppData\Roaming\Microsoft\Windows\Cookies\haukes@invitemedia[1].txt                                            0 bytes
File  C:\Users\HaukeS\AppData\Roaming\Microsoft\Windows\Cookies\haukes@metalyzer[2].txt                                              0 bytes
File  C:\Windows\assembly\GAC\Policy.11.0.Microsoft.Vbe.Interop\12.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Vbe.Interop.config  880 bytes
File  C:\Windows\assembly\GAC\Policy.11.0.Microsoft.Vbe.Interop\12.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Vbe.Interop.dll     11112 bytes executable
File  C:\Windows\assembly\GAC\Policy.11.0.Microsoft.Vbe.Interop\12.0.0.0__71e9bce111e9429c\__AssemblyInfo__.ini                      222 bytes

---- EOF - GMER 1.0.15 ----

--- --- ---

Osam logfile:

OSAM Logfile:

Code:

ATTFilter

Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 10:53:15 on 18.08.2011

OS: Windows 7  (Build 7600), 32-bit
Default Browser: Mozilla Corporation Firefox 3.6.20

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"ISUSPM.cpl" - "Macrovision Corporation" - C:\Windows\system32\ISUSPM.cpl
"PWMCP32V.cpl" - "Lenovo Group Limited" - C:\Windows\system32\PWMCP32V.cpl
"TpShCPL.cpl" - "Lenovo." - C:\Windows\system32\TpShCPL.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"mlcfg32.cpl" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~4\Office12\MLCFG32.CPL
"PROSet Tools" - "Intel(R) Corporation" - C:\Program Files\Intel\WiFi\bin\iproset.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"APS Digitizer Activity Monitor" (TPDIGIMN) - "Lenovo." - C:\Windows\System32\DRIVERS\ApsHM86.sys
"catchme" (catchme) - ? - C:\Users\HaukeS\AppData\Local\Temp\catchme.sys  (File not found)
"GarenaPEngine" (GarenaPEngine) - ? - C:\Users\HaukeS\AppData\Local\Temp\MWHA35B.tmp  (File not found)
"GGSAFER Driver" (GGSAFERDriver) - ? - C:\Program Files\Garena\safedrv.sys  (File not found)
"Huawei DataCard USB Fake" (hwusbfake) - ? - C:\Windows\System32\DRIVERS\ewusbfake.sys  (File not found)
"Huawei DataCard USB Modem and USB Serial" (hwdatacard) - ? - C:\Windows\System32\DRIVERS\ewusbmdm.sys  (File not found)
"Huawei DataCard USB Serial Port" (ewsercd) - ? - C:\Windows\System32\DRIVERS\ewsercd.sys  (File not found)
"Huawei MobileBroadband USB PNP Device" (ew_hwusbdev) - ? - C:\Windows\System32\DRIVERS\ew_hwusbdev.sys  (File not found)
"HUAWEI USB-NDIS miniport" (ewusbnet) - ? - C:\Windows\System32\DRIVERS\ewusbnet.sys  (File not found)
"huawei_CompositeFilter" (ew_usbenumfilter) - ? - C:\Windows\System32\DRIVERS\ew_usbenumfilter.sys  (File not found)
"huawei_enumerator" (huawei_enumerator) - ? - C:\Windows\System32\DRIVERS\ew_jubusenum.sys  (File not found)
"kwrorpob" (kwrorpob) - "GMER" - C:\Users\HaukeS\AppData\Local\Temp\kwrorpob.sys  (Hidden registry entry, rootkit activity)
"MBAMSwissArmy" (MBAMSwissArmy) - "Malwarebytes Corporation" - C:\Windows\system32\drivers\mbamswissarmy.sys
"PCDSRVC{3037D694-FD904ACA-06000000}_0 - PCDR Kernel Mode Service Helper Driver" (PCDSRVC{3037D694-FD904ACA-06000000}_0) - "PC-Doctor, Inc." - c:\program files\pc-doctor\pcdsrvc.pkms
"PCDSRVC{C4B36920-79E24793-06000000}_0 - PCDR Kernel Mode Service Helper Driver" (PCDSRVC{C4B36920-79E24793-06000000}_0) - "PC-Doctor, Inc." - c:\progra~1\pc-doc~1\pcdsrvc.pkms
"regi" (regi) - "InterVideo" - C:\Windows\System32\drivers\regi.sys
"SASDIFSV" (SASDIFSV) - "SUPERAdBlocker.com and SUPERAntiSpyware.com" - C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
"SASKUTIL" (SASKUTIL) - "SUPERAdBlocker.com and SUPERAntiSpyware.com" - C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS
"Shockprf" (Shockprf) - "Lenovo." - C:\Windows\System32\DRIVERS\Apsx86.sys

[Explorer]
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{32505114-5902-49B2-880A-1F7738E5A384} "Data Page Plugable Protocal mso-offdap11 Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL
{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
{828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL
{88FED34C-F0CA-4636-A375-3CB6248B04CD} "Local Groove Web Services Protocol" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~4\Office12\GRA32A~1.DLL
{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL
{03C514A3-1EFB-4856-9F99-10D7BE1653C0} "Windows Live Mail HTML Asynchronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\Program Files\Windows Live\Mail\mailcomm.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----
{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~4\Office12\GR469A~1.DLL
{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "SABShellExecuteHook Class" - "SuperAdBlocker.com" - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Program Files\7-Zip\7-zip.dll
{0563DB41-F538-4B37-A92D-4659049B7766} "CLSID_WLMCMimeFilter" - "Microsoft Corporation" - C:\Program Files\Windows Live\Mail\mailcomm.dll
{99FD978C-D287-4F50-827F-B2C658EDA8E7} "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~4\Office12\GR469A~1.DLL
{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} "Groove Explorer Icon Overlay 2 (GFS Stub)" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~4\Office12\GR469A~1.DLL
{920E6DB1-9907-4370-B3A0-BAFC03D81399} "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~4\Office12\GR469A~1.DLL
{16F3DD56-1AF5-4347-846D-7C10C4192619} "Groove Explorer Icon Overlay 3 (GFS Folder)" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~4\Office12\GR469A~1.DLL
{2916C86E-86A6-43FE-8112-43ABE6BF8DCC} "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~4\Office12\GR469A~1.DLL
{2A541AE1-5BF6-4665-A8A3-CFA9672E4291} "Groove Folder Synchronization" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~4\Office12\GR469A~1.DLL
{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~4\Office12\GR469A~1.DLL
{6C467336-8281-4E60-8204-430CED96822D} "Groove GFS Context Menu Handler" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~4\Office12\GR469A~1.DLL
{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~4\Office12\GR469A~1.DLL
{A449600E-1DC6-4232-B948-9BD794D62056} "Groove GFS Stub Icon Handler" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~4\Office12\GR469A~1.DLL
{387E725D-DC16-4D76-B310-2C93ED4752A0} "Groove XML Icon Handler" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~4\Office12\GR469A~1.DLL
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\msohevi.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~4\Office12\ONFILTER.DLL
{00020D75-0000-0000-C000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~4\Office12\MLSHEXT.DLL
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{7842554E-6BED-11D2-8CDB-B05550C10000} "Monitor Class" - "Broadcom Corporation." - C:\Program Files\ThinkPad\Bluetooth Software\btncopy.dll
{0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~4\Office12\OLKFSTUB.DLL
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - ? -   (File not found | COM-object registry key not found)
{2BE99FD4-A181-4996-BFA9-58C5FFD11F6C} "Windows Live Photo Gallery Autoplay Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F30F64-AC33-42F5-8FD1-5DC2D3FDE06C} "Windows Live Photo Gallery Editor Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F3712A-CA79-45B4-9E4D-D7891E7F8B9D} "Windows Live Photo Gallery Editor Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F30F90-3E96-453B-AFCD-D71989ECC2C7} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F33137-EE26-412F-8D71-F84E4C2C6625} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F374B7-B390-4884-B372-2FC349F2172B} "Windows Live Photo Gallery Viewer Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F346CB-35A4-465B-8B8F-65A29DBAB1F6} "Windows Live Photo Gallery Viewer Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll
{06A2568A-CED6-4187-BB20-400B8C02BE5A} "{06A2568A-CED6-4187-BB20-400B8C02BE5A}" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoAcquireWizard.exe

[Internet Explorer]
-----( HKCU\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars )-----
{555D4D79-4BD2-4094-A395-CFC534424A05} "HP Smart Web Printing" - "Hewlett-Packard Co." - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_bho.dll
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "&Windows Live Toolbar" - "Microsoft Corporation" - C:\Program Files\Windows Live\Toolbar\wltcore.dll
ITBar7Height "ITBar7Height" - ? -   (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_16" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_16.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
"@C:\Program Files\ThinkPad\Bluetooth Software\btrez.dll,-4015" - ? - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm
{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
{F4F55DC8-0B69-4DFE-BA94-CB677B88B2A3} "ClsidExtension" - "Lenovo Group Limited" - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll
{DDE87865-83C5-48c4-8357-2F5B1AA84522} "HP Smart Web Printing ein- oder ausblenden" - "Hewlett-Packard Co." - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
{5F7B1267-94A9-47F5-98DB-E99415F33AEC} "In Blog veröffentlichen" - "Microsoft Corporation" - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
<binary data> "&Windows Live Toolbar" - "Microsoft Corporation" - C:\Program Files\Windows Live\Toolbar\wltcore.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~4\Office12\GR469A~1.DLL
{0347C33E-8762-4905-BF09-768834316C61} "HP Print Enhancer" - "Hewlett-Packard Co." - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
{FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} "HP Smart BHO Class" - "Hewlett-Packard Co." - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
{BF468356-BB7E-42D7-9F15-4F3B9BCFCED2} "IePasswordManagerHelper Class" - "Lenovo Group Limited" - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll
{6EBF7485-159F-4bff-A14F-B9E3AAC4465B} "Search Helper" - "Microsoft Corp." - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} "Windows Live Toolbar Helper" - "Microsoft Corporation" - C:\Program Files\Windows Live\Toolbar\wltcore.dll
{5C255C8A-E604-49b4-9D64-90988571CECB} "{5C255C8A-E604-49b4-9D64-90988571CECB}" - ? -   (File not found | COM-object registry key not found)

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE  (Shortcut exists | File exists)
"desktop.ini" - ? - C:\Users\HaukeS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
"My_AutoWarkey_Script.lnk" - ? - C:\Program Files\Warkeys\AutoWarkey\AutoHotkey\AutoHotkey.exe  (Shortcut exists | File exists)
"Warkeys Update.lnk" - ? - C:\Program Files\Warkeys\AutoWarkey\AutoHotkey\AutoHotkey.exe  (Shortcut exists | File exists)
-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
"Digital Line Detect.lnk" - "Avanquest Software " - C:\Program Files\Digital Line Detect\DLG.exe  (Shortcut exists | File exists)
"HP Digital Imaging Monitor.lnk" - "Hewlett-Packard Co." - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe  (Shortcut exists | File exists)
"Bluetooth.lnk" - "Broadcom Corporation." - C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe  (Shortcut exists | File exists)
"Update Agent.lnk" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Update Agent.lnk  (Shortcut exists | File not found)
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"ISUSPM Startup" - "Macrovision Corporation" - "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup
"ISUSScheduler" - "Macrovision Corporation" - "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
"msnmsgr" - "Microsoft Corporation" - "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
"SUPERAntiSpyware" - "SUPERAntiSpyware.com" - C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"AcWin7Hlpr" - ? - C:\Program Files\Lenovo\Access Connections\AcTBenabler.exe  (File found, but it contains no detailed information)
"Adobe ARM" - "Adobe Systems Incorporated" - "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"cssauth" - "Lenovo Group Limited" - "C:\Program Files\Lenovo\Client Security Solution\cssauth.exe" silent
"FingerPrintSoftware" - "AuthenTec" - "C:\Program Files\Lenovo Fingerprint Software\fpapp.exe" \s
"GrooveMonitor" - "Microsoft Corporation" - "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
"HP Software Update" - "Hewlett-Packard" - C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
"hpqSRMon" - "Hewlett-Packard" - C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
"Launch Backup Service Once" - ? - C:\Program Files\Lenovo\Rescue and Recovery\rrstrigger.exe -start  (File found, but it contains no detailed information)
"LENOVO.TPFNF6R" - "Lenovo Group Limited" - C:\Program Files\Lenovo\HOTKEY\TPFNF6R.exe
"LenVolFx" - "Lenovo" - LenVolEx.exe
"Message Center Plus" - ? - C:\Program Files\LENOVO\Message Center Plus\MCPLaunch.exe /start
"PWMTRV" - "Lenovo Group Limited" - rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWMTR32V.DLL,PwrMgrBkGndMonitor
"TPHOTKEY" - "Lenovo Group Limited" - C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe
"TpShocks" - "Lenovo." - TpShocks.exe

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"Send To Microsoft OneNote Monitor" - "Microsoft Corporation" - C:\Windows\system32\msonpmon.dll

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##" (Bonjour Service) - "Apple Computer, Inc." - C:\Program Files\Bonjour\mDNSResponder.exe
"AcPrfMgrSvc" (AcPrfMgrSvc) - "Lenovo" - C:\Program Files\Lenovo\Access Connections\AcPrfMgrSvc.exe
"AcSvc" (AcSvc) - "Lenovo" - C:\Program Files\Lenovo\Access Connections\AcSvc.exe
"AD Monitor" (ADMonitor) - ? - C:\Windows\system32\ADMonitor.exe
"Anzeige am Bildschirm" (TPHKSVC) - "Lenovo Group Limited" - C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe
"AuthenTec Fingerprint Service" (ATService) - "AuthenTec, Inc." - C:\Windows\system32\AtService.exe
"Bluetooth Service" (btwdins) - "Broadcom Corporation." - C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe
"Data Transfer Service" (dtsvc) - ? - C:\Windows\system32\DTS.exe
"FLEXnet Licensing Service" (FLEXnet Licensing Service) - "Macrovision Europe Ltd." - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
"HP CUE DeviceDiscovery Service" (hpqddsvc) - "Hewlett-Packard Co." - C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll
"hpqcxs08" (hpqcxs08) - "Hewlett-Packard Co." - C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll
"Intel(R) PROSet/Wireless Event Log" (EvtEng) - "Intel(R) Corporation" - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
"Intel(R) PROSet/Wireless Registry Service" (RegSrvc) - "Intel(R) Corporation" - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
"IviRegMgr" (IviRegMgr) - "InterVideo" - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
"Lenovo Microphone Mute" (LENOVO.MICMUTE) - "Lenovo Group Limited" - C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe
"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
"Microsoft Office Groove Audit Service" (Microsoft Office Groove Audit Service) - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe
"Net Driver HPZ12" (Net Driver HPZ12) - "Hewlett-Packard" - C:\Windows\system32\HPZinw12.dll
"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"Pml Driver HPZ12" (Pml Driver HPZ12) - "Hewlett-Packard" - C:\Windows\system32\HPZipm12.dll
"Power Manager DBC Service" (Power Manager DBC Service) - "Lenovo" - C:\Program Files\ThinkPad\Utilities\PWMDBSVC.EXE
"RoxMediaDB10" (RoxMediaDB10) - "Sonic Solutions" - C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe
"SAS Core Service" (!SASCORE) - "SUPERAntiSpyware.com" - C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
"SeaPort" (SeaPort) - "Microsoft Corp." - C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
"SQL Server (MSSMLBIZ)" (MSSQL$MSSMLBIZ) - "Microsoft Corporation" - c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
"SQL Server VSS Writer" (SQLWriter) - "Microsoft Corporation" - c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
"SQL Server-Startdienst für Business Contact Manager" (BcmSqlStartupSvc) - "Microsoft Corporation" - C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
"stllssvr" (stllssvr) - "MicroVision Development, Inc." - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
"System Update" (SUService) - "Lenovo Group Limited" - c:\Program Files\Lenovo\System Update\SUService.exe
"ThinkPad HDD APS Logging Service" (TPHDEXLGSVC) - "Lenovo." - C:\Windows\System32\TPHDEXLG.exe
"ThinkVantage Registry Monitor Service" (ThinkVantage Registry Monitor Service) - "Lenovo Group Limited" - C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
"TVT Backup Service" (TVT Backup Service) - "Lenovo Group Limited" - C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe

[Winlogon]
-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )-----
"!SASWinLogon" - "SUPERAntiSpyware.com" - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL

[Winsock Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----
"mdnsNSP" - "Apple Computer, Inc." - C:\Program Files\Bonjour\mdnsNSP.dll

===[ Logfile end ]=========================================[ Logfile end ]===

--- --- ---

If You have questions or want to get some help, You can visit
hxxp://forum.online-solutions.ru

aswMBR logfile:

aswMBR version 0.9.8.978 Copyright(c) 2011 AVAST Software
Run date: 2011-08-18 11:17:41
-----------------------------
11:17:41.721 OS Version: Windows 6.1.7600
11:17:41.721 Number of processors: 2 586 0x170A
11:17:41.722 ComputerName: HAUKES-THINK UserName: HaukeS
11:17:43.001 Initialize success
11:18:03.859 AVAST engine defs: 11081701
11:18:24.336 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
11:18:24.340 Disk 0 Vendor: WDC_WD25 14.0 Size: 238475MB BusType: 3
11:18:24.370 Disk 0 MBR read successfully
11:18:24.375 Disk 0 MBR scan
11:18:24.401 Disk 0 MBR:Alureon-I [Rtk]
11:18:24.406 Disk 0 TDL4@MBR code has been found
11:18:24.412 Disk 0 MBR hidden
11:18:24.418 Disk 0 MBR [TDL4] **ROOTKIT**
11:18:24.425 Disk 0 trace - called modules:
11:18:24.434 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll >>UNKNOWN [0x86935ed1]<<
11:18:24.442 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86917aa0]
11:18:24.451 3 CLASSPNP.SYS[891c259e] -> nt!IofCallDriver -> [0x85f25700]
11:18:24.458 5 ACPI.sys[836b13b2] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0x85af6028]
11:18:24.470 \Driver\iaStor[0x85eebc08] -> IRP_MJ_INTERNAL_DEVICE_CONTROL -> 0x86935ed1
11:18:25.963 AVAST engine scan C:\Windows
11:18:28.748 AVAST engine scan C:\Windows\system32
11:20:14.947 AVAST engine scan C:\Windows\system32\drivers
11:20:25.565 AVAST engine scan C:\Users\HaukeS
11:22:59.850 AVAST engine scan C:\ProgramData
11:23:51.896 Scan finished successfully
11:28:13.621 Disk 0 MBR has been saved successfully to "C:\Users\HaukeS\Desktop\MBR.dat"
11:28:13.630 The log file has been saved successfully to "C:\Users\HaukeS\Desktop\aswMBR log.txt"

Grüße und danke für die gute betreuung!

cosinus · 18.08.2011, 11:50

Zitat:

11:18:24.370 Disk 0 MBR read successfully
11:18:24.375 Disk 0 MBR scan
11:18:24.401 Disk 0 MBR:Alureon-I [Rtk]
11:18:24.406 Disk 0 TDL4@MBR code has been found
11:18:24.412 Disk 0 MBR hidden
11:18:24.418 Disk 0 MBR [TDL4] **ROOTKIT**
11:18:24.425 Disk 0 trace - called modules:

Deswegen öffnet sich der TDSS-Killer nicht!

Wir sollten den MBR fixen, sichere für den Fall der Fälle ALLE wichtigen Daten, auch wenn meistens alles glatt geht.
Starte nach der Datensicherung aswmbr erneut und klick auf den Button FIXMBR.

Hauke1234 · 18.08.2011, 18:48

So hab ich gemacht, der pc ist dann abrupt runtergefahren und hat neugestarted. War das jetzt der Mbrfix?

Grüße

cosinus · 19.08.2011, 15:15

Mach dann ein neues Log mit aswmbr

Hauke1234 · 20.08.2011, 10:04

Hier der Log

aswMBR version 0.9.8.978 Copyright(c) 2011 AVAST Software
Run date: 2011-08-20 10:24:30
-----------------------------
10:24:30.527 OS Version: Windows 6.1.7600
10:24:30.527 Number of processors: 2 586 0x170A
10:24:30.529 ComputerName: HAUKES-THINK UserName: HaukeS
10:24:31.877 Initialize success
10:25:06.736 AVAST engine defs: 11081901
10:26:57.596 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
10:26:57.598 Disk 0 Vendor: WDC_WD25 14.0 Size: 238475MB BusType: 3
10:26:57.614 Disk 0 MBR read successfully
10:26:57.616 Disk 0 MBR scan
10:26:57.633 Disk 0 MBR:Alureon-I [Rtk]
10:26:57.636 Disk 0 TDL4@MBR code has been found
10:26:57.639 Disk 0 MBR hidden
10:26:57.643 Disk 0 MBR [TDL4] **ROOTKIT**
10:26:57.646 Disk 0 trace - called modules:
10:26:57.651 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll >>UNKNOWN [0x86935ed1]<<
10:26:57.656 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86917030]
10:26:57.661 3 CLASSPNP.SYS[892ae59e] -> nt!IofCallDriver -> [0x85ef3660]
10:26:57.667 5 ACPI.sys[836923b2] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0x85af2028]
10:26:57.676 \Driver\iaStor[0x85ee9a78] -> IRP_MJ_INTERNAL_DEVICE_CONTROL -> 0x86935ed1
10:26:58.673 AVAST engine scan C:\Windows
10:27:01.252 AVAST engine scan C:\Windows\system32
10:28:40.167 AVAST engine scan C:\Windows\system32\drivers
10:28:50.114 AVAST engine scan C:\Users\HaukeS
10:31:08.113 AVAST engine scan C:\ProgramData
10:32:03.250 Scan finished successfully
11:00:35.379 Disk 0 MBR has been saved successfully to "C:\Users\HaukeS\Desktop\MBR.dat"
11:00:35.388 The log file has been saved successfully to "C:\Users\HaukeS\Desktop\aswMBR.txt"

immer noch der Rootkit drin... soll ich nochmal fixen?

cosinus · 21.08.2011, 13:00

Wir müssen den MBR anders fixen, Daten hast du ja gesichert.

Hast Du noch andere Betriebssysteme außer Win7 (32-Bit) installiert?
Wenn nicht: Schau mal hier => RescueDisc-Win7-32-Bit

Lad das iso runter, brenn es zB mit ImgBurn per Imagebrennfunktion auf eine CD und starte damit den Rechner (von dieser CD booten)

Falls Du eine normale Win7-Installations-DVD (32-Bit) hast, brauchst Du das o.g. Image nicht sondern kannst einfach von der dieser DVD booten.

Klick auf Computerreparaturoptionen, weiter, Eingabeaufforderung - die Konsole öffnet sich. Da bitte bootrec.exe /fixboot eintippen (mit enter bestätigen), dann bootrec.exe /fixmbr eintippen (mit enter bestätigen) - Rechner neustarten, CD vorher rausnehmen. Führe im normalen Windowsmodus MBRcheck bzw. aswmbr (je nachdem welches Tool ich dir vorhin aufgab) und wenn es geht GMER nochmals aus und poste die neuen Logs.

Hauke1234 · 26.08.2011, 11:45

Hi arne!

Hier die logs nach dem genannten vorgang:

aswmbr:

aswMBR version 0.9.8.978 Copyright(c) 2011 AVAST Software
Run date: 2011-08-26 12:17:28
-----------------------------
12:17:28.690 OS Version: Windows 6.1.7600
12:17:28.690 Number of processors: 2 586 0x170A
12:17:28.690 ComputerName: HAUKES-THINK UserName: HaukeS
12:17:29.719 Initialize success
12:17:32.668 AVAST engine defs: 11082600
12:17:38.689 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
12:17:38.689 Disk 0 Vendor: WDC_WD25 14.0 Size: 238475MB BusType: 3
12:17:38.736 Disk 0 MBR read successfully
12:17:38.752 Disk 0 MBR scan
12:17:38.752 Disk 0 Windows 7 default MBR code
12:17:38.767 Disk 0 scanning sectors +488394752
12:17:38.861 Disk 0 scanning C:\Windows\system32\drivers
12:17:48.268 Service scanning
12:17:50.046 Modules scanning
12:17:58.361 Disk 0 trace - called modules:
12:17:58.376 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll iaStor.sys
12:17:58.376 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8651b030]
12:17:58.392 3 CLASSPNP.SYS[891d359e] -> nt!IofCallDriver -> [0x85af1958]
12:17:58.891 5 ACPI.sys[88a3e3b2] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0x856ec028]
12:18:00.264 AVAST engine scan C:\Windows
12:18:03.306 AVAST engine scan C:\Windows\system32
12:19:52.899 AVAST engine scan C:\Windows\system32\drivers
12:20:03.260 AVAST engine scan C:\Users\HaukeS
12:22:48.126 File: C:\Users\HaukeS\AppData\Local\Temp\jar_cache7161096472331229318.tmp **INFECTED** Win32:Banker-IID [Trj]
12:23:01.075 File: C:\Users\HaukeS\AppData\Roaming\appconf32.exe **INFECTED** Win32:Banker-IJD [Drp]
12:24:22.139 AVAST engine scan C:\ProgramData
12:25:18.730 Scan finished successfully
12:25:43.889 Disk 0 MBR has been saved successfully to "C:\Users\HaukeS\Desktop\MBR.dat"
12:25:43.896 The log file has been saved successfully to "C:\Users\HaukeS\Desktop\logaswmbr.txt"

und gmer:
GMER Logfile:

Code:

ATTFilter

GMER 1.0.15.15641 - GMER - Rootkit Detector and Remover
Rootkit scan 2011-08-26 12:42:14
Windows 6.1.7600  Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD25 rev.14.0
Running: m2pto3ov.exe; Driver: C:\Users\HaukeS\AppData\Local\Temp\kwrorpob.sys


---- Kernel code sections - GMER 1.0.15 ----

.text           ntkrnlpa.exe!ZwSaveKeyEx + 13AD                                                                                                   82E5A579 1 Byte  [06]
.text           ntkrnlpa.exe!KiDispatchInterrupt + 5A2                                                                                            82E7EF52 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
?               C:\Users\HaukeS\AppData\Local\Temp\aswMBR.sys                                                                                     Das System kann die angegebene Datei nicht finden. !

---- User code sections - GMER 1.0.15 ----

.text           C:\Program Files\Mozilla Firefox\firefox.exe[1856] ntdll.dll!LdrLoadDll                                                           773AF585 5 Bytes  JMP 00DD1410 C:\Program Files\Mozilla Firefox\firefox.exe (Firefox/Mozilla Corporation)
.text           C:\Program Files\Mozilla Firefox\plugin-container.exe[5184] USER32.dll!SetWindowLongA                                             766DB1E3 5 Bytes  JMP 61D4A2FB C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text           C:\Program Files\Mozilla Firefox\plugin-container.exe[5184] USER32.dll!SetWindowLongW                                             766E6614 5 Bytes  JMP 61D4A28D C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text           C:\Program Files\Mozilla Firefox\plugin-container.exe[5184] USER32.dll!GetWindowInfo                                              766E6A82 5 Bytes  JMP 61B51BD2 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text           C:\Program Files\Mozilla Firefox\plugin-container.exe[5184] USER32.dll!TrackPopupMenu                                             76704B3B 5 Bytes  JMP 61B5219D C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)

---- User IAT/EAT - GMER 1.0.15 ----

IAT             C:\Program Files\Windows Live\Messenger\msnmsgr.exe[2076] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress]        [753F5D3D] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT             C:\Program Files\Windows Live\Messenger\msnmsgr.exe[2076] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!GetProcAddress]           [753F5D3D] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT             C:\Program Files\Windows Live\Messenger\msnmsgr.exe[2076] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!GetProcAddress]          [753F5D3D] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT             C:\Program Files\Windows Live\Messenger\msnmsgr.exe[2076] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress]         [753F5D3D] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT             C:\Program Files\Windows Live\Messenger\msnmsgr.exe[2076] @ C:\Windows\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress]         [753F5D3D] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT             C:\Program Files\Windows Live\Messenger\msnmsgr.exe[2076] @ C:\Windows\system32\WININET.dll [KERNEL32.dll!GetProcAddress]         [753F5D3D] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT             C:\Program Files\Windows Live\Messenger\msnmsgr.exe[2076] @ C:\Windows\system32\Secur32.dll [KERNEL32.dll!GetProcAddress]         [753F5D3D] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[3528] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree]                                                    [7352250F] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[3528] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc]                                                   [73522494] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[3528] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup]                                              [73505624] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[3528] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown]                                             [735056E2] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[3528] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics]                                          [73518573] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[3528] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage]                                            [73514D27] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[3528] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth]                                           [735150CE] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[3528] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight]                                          [735151A3] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[3528] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromHBITMAP]                                 [735166D0] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[3528] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC]                                           [735182CA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[3528] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode]                                      [73518819] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[3528] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode]                                    [7351907A] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[3528] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI]                                          [7351E21D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[3528] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage]                                              [73514C59] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\System32\rundll32.exe[3932] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!GetProcAddress]                             [753F5D3D] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT             C:\Windows\System32\rundll32.exe[3932] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!GetProcAddress]                              [753F5D3D] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT             C:\Windows\System32\rundll32.exe[3932] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress]                            [753F5D3D] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT             C:\Windows\System32\rundll32.exe[3932] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress]                           [753F5D3D] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT             C:\Program Files\Lenovo\Message Center Plus\MCPLaunch.exe[3996] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!GetProcAddress]    [753F5D3D] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT             C:\Program Files\Lenovo\Message Center Plus\MCPLaunch.exe[3996] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!GetProcAddress]     [753F5D3D] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT             C:\Program Files\Lenovo\Message Center Plus\MCPLaunch.exe[3996] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress]  [753F5D3D] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT             C:\Program Files\Lenovo\Message Center Plus\MCPLaunch.exe[3996] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress]   [753F5D3D] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT             c:\Program Files\Lenovo\System Update\SUService.exe[4912] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress]         [753F5D3D] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT             c:\Program Files\Lenovo\System Update\SUService.exe[4912] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!GetProcAddress]           [753F5D3D] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT             c:\Program Files\Lenovo\System Update\SUService.exe[4912] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!GetProcAddress]          [753F5D3D] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT             c:\Program Files\Lenovo\System Update\SUService.exe[4912] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress]        [753F5D3D] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT             c:\Program Files\Lenovo\System Update\SUService.exe[4912] @ C:\Windows\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress]         [753F5D3D] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)

---- Devices - GMER 1.0.15 ----

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                                                                                           Wdf01000.sys (Kernelmodustreiber-Frameworklaufzeit/Microsoft Corporation)
AttachedDevice  \Driver\kbdclass \Device\KeyboardClass1                                                                                           Wdf01000.sys (Kernelmodustreiber-Frameworklaufzeit/Microsoft Corporation)

Device          \Driver\ACPI_HAL \Device\00000052                                                                                                 halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume1                                                                                            fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume2                                                                                            fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume3                                                                                            fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

---- Registry - GMER 1.0.15 ----

Reg             HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\001f3ad3f68b                                                       
Reg             HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0c607688b5f7                                                       
Reg             HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\001f3ad3f68b (not active ControlSet)                                   
Reg             HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0c607688b5f7 (not active ControlSet)                                   

---- Files - GMER 1.0.15 ----

File            C:\Users\HaukeS\AppData\Local\Temp\flaEED6.tmp                                                                                    22754707 bytes

---- EOF - GMER 1.0.15 ----

--- --- ---

Ich bekomme zur Zeit oft einen bluescreen mit der Meldung: Page_fault_on_nonpage_area

Grüße Hauke

cosinus · 26.08.2011, 12:42

Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SUPERAntiSpyware und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Hauke1234 · 02.09.2011, 06:55

Hi arne!

Hier die logs

Mbam:

Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org

Datenbank Version: 7631

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

01.09.2011 21:01:38
mbam-log-2011-09-01 (21-01-33).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|Q:\|)
Durchsuchte Objekte: 299941
Laufzeit: 38 Minute(n), 40 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 2

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\Users\HaukeS\AppData\Local\Temp\jar_cache7161096472331229318.tmp (Malware.Gen) -> No action taken.
c:\Users\HaukeS\AppData\Roaming\appconf32.exe (Malware.Gen) -> No action taken.

eset:

ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=0473d60f8ff74b42a9ea304314a0ab92
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-08-12 02:26:10
# local_time=2011-08-12 04:26:10 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7600 NT
# compatibility_mode=1797 16774142 0 1 246162 246162 0 0
# compatibility_mode=5893 16776574 100 94 50262124 64786156 0 0
# compatibility_mode=8192 67108863 100 0 301 301 0 0
# scanned=133042
# found=1
# cleaned=0
# scan_time=4206
C:\Users\HaukeS\AppData\Local\Temp\P1kAlMiG2Kb7Fz.exe a variant of Win32/Kryptik.RJL trojan (unable to clean) 00000000000000000000000000000000 I
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=0473d60f8ff74b42a9ea304314a0ab92
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-09-01 08:33:41
# local_time=2011-09-01 10:33:41 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7600 NT
# compatibility_mode=1797 16774142 0 1 1995850 1995850 0 0
# compatibility_mode=5893 16776574 100 94 52011812 66535844 0 0
# compatibility_mode=8192 67108863 100 0 1749989 1749989 0 0
# scanned=132489
# found=2
# cleaned=0
# scan_time=4569
C:\Users\HaukeS\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TRDSR2WS\c3[1].htm HTML/Iframe.B.Gen virus (unable to clean) 00000000000000000000000000000000 I
C:\Users\HaukeS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\46\151adf2e-332d23c1 a variant of Java/Agent.DH trojan (unable to clean) 00000000000000000000000000000000 I

Der superanti log ist im anhang.

Grüße Hauke

cosinus · 02.09.2011, 09:54

Zitat:

-> No action taken.

Die Funde müssen mit Malwarebytes entfernt waren! Bitte nachholen falls noch nicht getan!

16.08.2011, 13:34	#18
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Rootkit BOO/TDss.D Bekomme ich nicht mehr weg HELP Windows neu starten!! __________________ __________________

19.08.2011, 15:15	#24
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Rootkit BOO/TDss.D Bekomme ich nicht mehr weg HELP Mach dann ein neues Log mit aswmbr __________________ Logfiles bitte immer in CODE-Tags posten

Rootkit BOO/TDss.D Bekomme ich nicht mehr weg HELP

Log-Analyse und Auswertung: Rootkit BOO/TDss.D Bekomme ich nicht mehr weg HELP