Hallo,

seit einigen Tagen leide ich unter massivem Trojanerbefall.
Immer wenn ich meinen PC einschalte gibt mir McAffee im 10-Sekunden-Takt
Virus-Scan-Warnungen aus.
Er findet immer Trojaner im Ordner C:\Users\***\AppData\Local\313845ff\U\
Die Trojaner identifiziert er als:
ZeroAccess.dm, Downloader.a!bc3, Generic.dx!bcqs und W32/Sirefef.f
McAffee meldet zwar immer den Trojaner gelöscht zu haben, aber nach wenigen Sekunden taucht die Meldung erneut auf.

Defogger hat keine Fehler gemeldet.

Die DDS-Logs:

.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_31
Run by Friederike at 17:29:10 on 2012-03-15
Microsoft Windows 7 Starter 6.1.7601.1.1252.49.1031.18.1013.376 [GMT 1:00]
.
AV: McAfee VirusScan Enterprise *Enabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: McAfee VirusScan Enterprise Antispyware Module *Enabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Launch Manager\dsiwmis.exe
C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
C:\Program Files\Acer\Registration\GREGsvc.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
C:\Windows\system32\mfevtps.exe
C:\Program Files\McAfee\VirusScan Enterprise\mfeann.exe
C:\Windows\system32\conhost.exe
C:\Program Files\Symantec\Norton Online Backup\NOBuAgent.exe
C:\Program Files\McAfee\Common Framework\naPrdMgr.exe
C:\Program Files\Acer\Acer VCM\RS_Service.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Acer\Acer Updater\UpdaterService.exe
C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\explorer.exe
C:\Program Files\Launch Manager\LManager.exe
C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\EgisTec IPS\PmmUpdate.exe
C:\Program Files\EgisTec MyWinLocker\x86\mwlDaemon.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Acer\Android Manager\iSync.exe
C:\Program Files\Acer\Updater\iUpdate.exe
C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\McAfee\Common Framework\UdaterUI.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Launch Manager\LMworker.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Acer\Acer VCM\AcerVCM.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\igfxext.exe
C:\Program Files\EgisTec IPS\EgisUpdate.exe
C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE
C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
C:\Users\Friederike\Desktop\Defogger.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\conhost.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aohappy&r=27b50711g635l0424wwh5w5722v415
uDefault_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aohappy&r=27b50711g635l0424wwh5w5722v415
mDefault_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aohappy&r=27b50711g635l0424wwh5w5722v415
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aohappy&r=27b50711g635l0424wwh5w5722v415
uWinlogon: Shell=c:\users\friederike\appdata\local\313845ff\X
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\common files\mcafee\systemcore\ScriptSn.20120222182418.dll
BHO: Windows Live Anmelde-Hilfsprogramm: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
mRun: [LManager] c:\program files\launch manager\LManager.exe
mRun: [IAStorIcon] c:\program files\intel\intel(r) rapid storage technology\IAStorIcon.exe
mRun: [RtHDVCpl] c:\program files\realtek\audio\hda\RtHDVCpl.exe -s
mRun: [SuiteTray] "c:\program files\egistec mywinlockersuite\x86\SuiteTray.exe"
mRun: [EgisUpdate] "c:\program files\egistec ips\EgisUpdate.exe" -d
mRun: [EgisTecPMMUpdate] "c:\program files\egistec ips\PmmUpdate.exe"
mRun: [mwlDaemon] c:\program files\egistec mywinlocker\x86\mwlDaemon.exe
mRun: [Norton Online Backup] c:\program files\symantec\norton online backup\NOBuClient.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
mRun: [iSyncData] c:\program files\acer\android manager\iSync.exe
mRun: [AndroidManager] c:\program files\acer\android manager\AML.exe
mRun: [iPatchData] c:\program files\acer\updater\iUpdate.exe
mRun: [Acer ePower Management] c:\program files\acer\acer epower management\ePowerTray.exe
mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [McAfeeUpdaterUI] "c:\program files\mcafee\common framework\udaterui.exe" /StartedFromRunKey
mRun: [ShStatEXE] "c:\program files\mcafee\virusscan enterprise\SHSTAT.EXE" /STANDALONE
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
StartupFolder: c:\users\friede~1\appdata\roaming\micros~1\windows\startm~1\programs\startup\openof~1.lnk - c:\program files\openoffice.org 3\program\quickstart.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\acervc~1.lnk - c:\program files\acer\acer vcm\AcerVCM.exe
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
TCP: Interfaces\{8B4A0231-77B5-443B-8418-AC195C4893E8} : NameServer = 81.173.194.69 81.173.194.77
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\acer\acer vcm\Skype4COM.dll
Notify: igfxcui - igfxdev.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\friederike\appdata\roaming\mozilla\firefox\profiles\p6ftbbfj.default\
FF - plugin: c:\program files\google\update\1.3.21.99\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre6\bin\plugin2\npdeployJava1.dll
FF - plugin: c:\program files\java\jre6\bin\plugin2\npjp2.dll
FF - plugin: c:\program files\microsoft silverlight\4.1.10111.0\npctrlui.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
.
---- FIREFOX POLICIES ----
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
============= SERVICES / DRIVERS ===============
.
R0 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2012-2-22 461864]
R0 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [2012-2-22 164840]
R1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\drivers\mwlPSDFilter.sys [2009-6-3 18992]
R1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\drivers\mwlPSDNserv.sys [2009-6-3 16432]
R1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\drivers\mwlPSDVDisk.sys [2009-6-3 60976]
R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\drivers\vwififlt.sys [2009-7-14 48128]
R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\drivers\L1C62x86.sys [2010-9-13 68208]
R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2012-2-22 180072]
R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2012-2-22 59288]
R3 NETw5s32;Intel(R) Wireless WiFi Link der Serie 5000 Adaptertreiber für Windows 7 32-Bit;c:\windows\system32\drivers\NETw5s32.sys [2010-8-31 6766080]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]
S3 EUCR;EUCR;c:\windows\system32\drivers\EUCR6SK.sys [2010-8-31 82768]
S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [2012-2-22 87808]
S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2012-2-26 52224]
.
=============== Created Last 30 ================
.
2012-03-15 08:15:15 3968368 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-03-15 08:15:14 3913584 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-03-14 11:56:02 2343424 ----a-w- c:\windows\system32\win32k.sys
2012-03-14 11:55:54 1077248 ----a-w- c:\windows\system32\DWrite.dll
2012-03-14 11:52:53 8192 ----a-w- c:\windows\system32\rdrmemptylst.exe
2012-03-14 11:52:52 129536 ----a-w- c:\windows\system32\rdpcorekmts.dll
2012-03-14 11:52:50 58880 ----a-w- c:\windows\system32\rdpwsx.dll
2012-03-14 11:52:36 826880 ----a-w- c:\windows\system32\rdpcore.dll
2012-03-14 11:52:31 24576 ----a-w- c:\windows\system32\drivers\tdtcp.sys
2012-03-14 11:52:29 183808 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-03-07 15:59:39 -------- d-----w- c:\windows\system32\SPReview
2012-03-07 15:42:47 -------- d-----w- c:\windows\system32\EventProviders
2012-03-07 10:19:35 -------- d-----w- c:\users\friederike\appdata\roaming\Uxice
2012-03-07 10:19:35 -------- d-----w- c:\users\friederike\appdata\roaming\Genim
2012-03-07 10:19:35 -------- d-----w- c:\users\friederike\appdata\roaming\Ekixu
2012-03-05 13:54:51 0 --sha-w- c:\windows\system32\dds_log_trash.cmd
2012-03-03 12:10:54 -------- d-----w- C:\QUARANTINE
2012-03-03 12:07:42 -------- d-sh--w- c:\users\friederike\appdata\local\313845ff
2012-02-29 18:51:51 -------- d-----w- c:\programdata\Trymedia
2012-02-29 18:49:21 -------- d-----w- c:\program files\RealArcade
2012-02-27 19:47:58 -------- d-----w- c:\programdata\AirportMania
2012-02-27 18:48:05 -------- d-----w- c:\users\friederike\appdata\local\Oberon Games
2012-02-27 17:43:02 -------- d-----w- c:\programdata\Sandlot Games
2012-02-26 20:09:01 -------- d-----w- c:\programdata\FarmFrenzy2
2012-02-26 14:03:58 71168 ----a-w- c:\windows\system32\spool\prtprocs\w32x86\CNBPP4.DLL
2012-02-26 13:47:24 1130824 ----a-w- c:\windows\system32\dfshim.dll
2012-02-26 13:47:15 52224 ----a-w- c:\windows\system32\drivers\TsUsbFlt.sys
2012-02-26 13:47:15 11776 ----a-w- c:\windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
2012-02-26 13:47:14 3215872 ----a-w- c:\windows\system32\mstscax.dll
2012-02-26 13:47:06 1171456 ----a-w- c:\windows\system32\d3d10warp.dll
2012-02-26 13:47:05 954752 ----a-w- c:\windows\system32\mfc40.dll
2012-02-26 13:47:04 954288 ----a-w- c:\windows\system32\mfc40u.dll
2012-02-26 13:47:01 1159168 ----a-w- c:\windows\system32\sysmain.dll
2012-02-26 13:45:59 91136 ----a-w- c:\windows\system32\dot3api.dll
2012-02-26 13:44:59 168960 ----a-w- c:\windows\system32\srvsvc.dll
2012-02-26 13:43:59 42496 ----a-w- c:\windows\system32\mimefilt.dll
2012-02-26 13:42:59 268800 ----a-w- c:\windows\system32\mprddm.dll
2012-02-26 13:41:59 247808 ----a-w- c:\windows\system32\ReAgent.dll
2012-02-26 13:40:59 158720 ----a-w- c:\windows\system32\mprapi.dll
2012-02-26 13:39:59 82944 ----a-w- c:\windows\system32\iccvid.dll
2012-02-26 13:38:58 25856 ----a-w- c:\windows\system32\drivers\USBCAMD2.sys
2012-02-26 13:36:55 189952 ----a-w- c:\windows\system32\wdscore.dll
2012-02-26 13:34:54 189952 ----a-w- c:\program files\windows portable devices\sqmapi.dll
2012-02-26 13:34:53 363008 ----a-w- c:\windows\system32\wbemcomn.dll
2012-02-26 13:34:52 606208 ----a-w- c:\windows\system32\wbem\fastprox.dll
2012-02-26 13:33:20 189952 ----a-w- c:\windows\system32\sqmapi.dll
2012-02-26 13:28:24 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-02-23 08:34:06 -------- d-----w- c:\windows\system32\wbem\en-US
2012-02-23 08:28:59 63488 ----a-w- c:\windows\system32\tdc.ocx
2012-02-22 17:40:33 805376 ----a-w- c:\windows\system32\FntCache.dll
2012-02-22 17:40:32 739840 ----a-w- c:\windows\system32\d2d1.dll
2012-02-22 17:26:18 -------- d-----w- c:\users\friederike\appdata\roaming\McAfee
2012-02-22 17:24:19 74848 ----a-w- c:\windows\system32\MfeOtlkAddin.dll
2012-02-22 17:24:19 28504 ----a-w- c:\program files\mozilla firefox\ScriptFF.dll
2012-02-22 17:24:19 22816 ----a-w- c:\windows\system32\MFEOtlk.dll
2012-02-22 17:24:18 9344 ----a-w- c:\windows\system32\drivers\mfeclnk.sys
2012-02-22 17:24:16 87808 ----a-w- c:\windows\system32\drivers\mferkdet.sys
2012-02-22 17:24:15 59288 ----a-w- c:\windows\system32\drivers\mfebopk.sys
2012-02-22 17:24:15 119968 ----a-w- c:\windows\system32\drivers\mfeapfk.sys
2012-02-22 17:24:14 180072 ----a-w- c:\windows\system32\drivers\mfeavfk.sys
2012-02-22 17:24:11 461864 ----a-w- c:\windows\system32\drivers\mfehidk.sys
2012-02-22 17:23:55 164840 ----a-w- c:\windows\system32\drivers\mfewfpk.sys
2012-02-22 17:23:55 148520 ----a-w- c:\windows\system32\mfevtps.exe
2012-02-22 17:22:14 -------- d-----w- c:\program files\McAfee
2012-02-22 17:22:14 -------- d-----w- c:\program files\common files\McAfee
2012-02-22 16:51:23 43008 ----a-w- c:\windows\system32\drivers\usbehci.sys
2012-02-22 16:51:23 284672 ----a-w- c:\windows\system32\drivers\usbport.sys
2012-02-22 16:51:23 258560 ----a-w- c:\windows\system32\drivers\usbhub.sys
2012-02-22 16:51:22 75776 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2012-02-22 16:51:22 24064 ----a-w- c:\windows\system32\drivers\usbuhci.sys
2012-02-22 16:51:21 5888 ----a-w- c:\windows\system32\drivers\usbd.sys
2012-02-22 16:51:21 20480 ----a-w- c:\windows\system32\drivers\usbohci.sys
2012-02-22 16:50:13 1699328 ----a-w- c:\windows\system32\esent.dll
2012-02-22 16:50:13 143744 ----a-w- c:\windows\system32\drivers\nvstor.sys
2012-02-22 16:50:12 1211264 ----a-w- c:\windows\system32\drivers\ntfs.sys
2012-02-22 16:50:11 80256 ----a-w- c:\windows\system32\drivers\amdsata.sys
2012-02-22 16:50:11 117120 ----a-w- c:\windows\system32\drivers\nvraid.sys
2012-02-22 16:50:10 332160 ----a-w- c:\windows\system32\drivers\iaStorV.sys
2012-02-22 16:50:10 22400 ----a-w- c:\windows\system32\drivers\amdxata.sys
2012-02-22 16:50:10 148864 ----a-w- c:\windows\system32\drivers\storport.sys
2012-02-22 16:50:09 74240 ----a-w- c:\windows\system32\fsutil.exe
2012-02-22 08:17:53 293376 ----a-w- c:\windows\system32\browserchoice.exe
2012-02-21 21:24:41 311808 ----a-w- c:\windows\system32\drivers\srv.sys
2012-02-21 21:24:41 310272 ----a-w- c:\windows\system32\drivers\srv2.sys
2012-02-21 21:24:40 114688 ----a-w- c:\windows\system32\drivers\srvnet.sys
2012-02-21 21:24:38 338944 ----a-w- c:\windows\system32\drivers\afd.sys
2012-02-21 21:24:34 187776 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS
2012-02-21 21:24:34 1290608 ----a-w- c:\windows\system32\drivers\tcpip.sys
2012-02-21 21:24:14 1288472 ----a-w- c:\windows\system32\ntdll.dll
2012-02-21 21:24:07 31232 ----a-w- c:\windows\system32\prevhost.exe
2012-02-21 21:22:57 2048 ----a-w- c:\windows\system32\tzres.dll
2012-02-21 21:22:24 542208 ----a-w- c:\windows\system32\kerberos.dll
2012-02-21 21:22:21 96768 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2012-02-21 21:22:21 223744 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2012-02-21 21:22:21 123904 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2012-02-21 21:22:14 571904 ----a-w- c:\windows\system32\oleaut32.dll
2012-02-21 21:22:14 233472 ----a-w- c:\windows\system32\oleacc.dll
2012-02-21 21:22:03 741376 ----a-w- c:\windows\system32\inetcomm.dll
2012-02-21 21:20:59 199680 ----a-w- c:\windows\system32\mpg2splt.ax
2012-02-21 21:19:44 442880 ----a-w- c:\windows\system32\ntshrui.dll
2012-02-21 21:19:15 1164288 ----a-w- c:\windows\system32\mfc42u.dll
2012-02-21 21:19:15 1137664 ----a-w- c:\windows\system32\mfc42.dll
2012-02-21 21:19:11 69632 ----a-w- c:\windows\system32\drivers\bowser.sys
2012-02-21 21:19:06 123904 ----a-w- c:\windows\system32\poqexec.exe
2012-02-21 21:19:05 27008 ----a-w- c:\windows\system32\drivers\Diskdump.sys
2012-02-21 21:04:25 728448 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2012-02-21 21:04:24 219008 ----a-w- c:\windows\system32\drivers\dxgmms1.sys
2012-02-21 21:04:24 107520 ----a-w- c:\windows\system32\cdd.dll
2012-02-21 15:59:14 2106216 ----a-w- c:\program files\mozilla firefox\D3DCompiler_43.dll
2012-02-21 15:59:14 19416 ----a-w- c:\program files\mozilla firefox\AccessibleMarshal.dll
2012-02-21 15:59:13 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
2012-02-21 15:59:13 125912 ----a-w- c:\program files\mozilla firefox\crashreporter.exe
2012-02-21 15:59:11 45016 ----a-w- c:\program files\mozilla firefox\mozutils.dll
2012-02-21 15:59:10 626688 ----a-w- c:\program files\mozilla firefox\msvcr80.dll
2012-02-21 15:59:10 548864 ----a-w- c:\program files\mozilla firefox\msvcp80.dll
2012-02-21 15:59:10 479232 ----a-w- c:\program files\mozilla firefox\msvcm80.dll
2012-02-21 15:38:22 -------- d-----w- c:\users\friederike\appdata\roaming\OpenOffice.org
2012-02-21 15:14:01 -------- d-----w- c:\users\friederike\appdata\local\Apple Computer
2012-02-21 15:13:29 26600 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2012-02-21 15:13:29 107368 ----a-w- c:\windows\system32\GEARAspi.dll
2012-02-21 15:12:32 -------- d-----w- c:\program files\iPod
2012-02-21 15:12:31 -------- d-----w- c:\programdata\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2012-02-21 15:12:31 -------- d-----w- c:\program files\iTunes
2012-02-21 15:10:41 -------- d-----w- c:\users\friederike\appdata\local\Apple
2012-02-21 15:09:29 -------- d-----w- c:\program files\Bonjour
2012-02-21 14:42:06 -------- d-----w- c:\program files\OpenOffice.org 3
2012-02-21 14:40:52 472808 ----a-w- c:\windows\system32\deployJava1.dll
2012-02-21 14:39:13 -------- d-----w- c:\users\friederike\appdata\local\Adobe
2012-02-21 14:38:44 -------- d-----w- c:\users\friederike\appdata\local\Diagnostics
.
==================== Find3M ====================
.
2012-03-07 16:30:55 152576 ----a-w- c:\windows\system32\msclmd.dll
2012-02-23 08:29:03 74752 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2012-02-23 08:29:03 161792 ----a-w- c:\windows\system32\msls31.dll
2012-02-23 08:29:03 1127424 ----a-w- c:\windows\system32\wininet.dll
2012-02-23 08:29:02 86528 ----a-w- c:\windows\system32\iesysprep.dll
2012-02-23 08:29:02 76800 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2012-02-23 08:29:02 48640 ----a-w- c:\windows\system32\mshtmler.dll
2012-02-23 08:29:02 110592 ----a-w- c:\windows\system32\IEAdvpack.dll
2011-12-30 05:27:56 478720 ----a-w- c:\windows\system32\timedate.cpl
.
============= FINISH: 17:37:56,81 ===============

und

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows 7 Starter
Boot Device: \Device\HarddiskVolume3
Install Date: 15.07.2011 21:08:49
System Uptime: 15.03.2012 16:38:08 (1 hours ago)
.
Motherboard: Acer | | AOHAPPY
Processor: Intel(R) Atom(TM) CPU N450 @ 1.66GHz | CPU | 999/667mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 216 GiB total, 169,809 GiB free.
D: is FIXED (FAT32) - 4 GiB total, 2,651 GiB free.
.
==== Disabled Device Manager Items =============
.
==== Installed Programs ======================
.
Acer Crystal Eye webcam
Acer ePower Management
Acer eRecovery Management
Acer GameZone Console
Acer Registration
Acer ScreenSaver
Acer Updater
Acer VCM
Acrobat.com
Adobe AIR
Adobe Flash Player 11 ActiveX
Adobe Flash Player 11 Plugin
Adobe Reader 9.1 MUI
Amazonia
AndroidInstaller
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver
Bonjour
Dream Day First Home
eBay Worldwide
ENE USB Card Reader Driver
eSobi v2
Farm Frenzy 2
Google Toolbar for Internet Explorer
Google Update Helper
Heroes of Hellas
Identity Card
Intel(R) Graphics Media Accelerator Driver
Intel(R) Rapid Storage Technology
iTunes
Java Auto Updater
Java(TM) 6 Update 31
Junk Mail filter update
Launch Manager
McAfee Agent
McAfee VirusScan Enterprise
Microsoft .NET Framework 4 Client Profile
Microsoft .NET Framework 4 Client Profile DEU Language Pack
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Office 2010
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Mozilla Firefox 10.0.2 (x86 de)
MSVCRT
MyWinLocker
MyWinLocker Suite
Norton Online Backup
OpenOffice.org 3.3
Poker Pop
Realtek High Definition Audio Driver
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile DEU Language Pack (KB2518870)
Shredder
Spin & Win
Synaptics Pointing Device Driver
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
Welcome Center
Windows Live-Uploadtool
Windows Live Anmelde-Assistent
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Fotogalerie
Windows Live Mail
Windows Live Messenger
Windows Live Movie Maker
Windows Live Sync
Windows Live Writer
.
==== End Of File ===========================

Viele Grüße und
vielen Dank im voraus

Löhr

hi
nutzt du den pc für onlinebanking, einkäufe, sonstige zahlungsabwicklungen, oder ähnlich wichtiges, wie berufliches?

nein, eigentlich nicht.
Ich habe zwar mal etwa online bestellt, aber auf Rechnung, also ohne Angabe meiner Bankverbindung.

Löhr

ok, du hast trotzdem ein gefährliches rootkit und das system sollte neu aufgesetzt werden.
1. Datenrettung:

• deaktiviere Autorun: http://www.trojaner-board.de/83238-a...sschalten.html
• dann sichere Daten auf einen externen Datenträger (USB-Platte): http://www.trojaner-board.de/82533-d...ted-magic.html
  Bider, Dokumente, Musik, Videos (persönliches) http://www.trojaner-board.de/71715-k...iendungen.html

2. Formatieren, Windows neuinstallieren:

• nutzt du eine Windows CD: http://www.trojaner-board.de/51262-a...sicherung.html
• Recovery CD oder Recovery Partition?
• falls dies ein Fertig-PC ist, nenne Hersteller + Typ.
• Keine Windows 7 DVD? http://www.trojaner-board.de/100776-...-download.html

3. PC absichern: http://www.trojaner-board.de/96344-a...-rechners.html
4. alle Passwörter ändern!
5. nach PC Absicherung, die gesicherten Daten prüfen und falls sauber: zurückspielen.
6. werde ich dann noch was zum absichern von Onlinebanking mit Chip Card Reader + Star Money sagen.

Zuerst einmal vielen Dank für die schnelle Antwort!

Werde jetzt mal ein paar Sacehn sichern, reicht es dafür das Häkchen bei
"Automatische Wiedergabe für alle Medien und Geräte verwenden"
in Standardprgramme->Einstellungen für Automatische Wiedergabe ändern
wegzunehmen um Autorun zu deaktivieren?

Zum formatieren:
Ich hab ein Acer Netbook Aspire One.
Eine Recovery Partition ist da nicht drauf. Eine CD hab ich bis jetzt noch nicht gefunden, suche heut nachmittag aber noch mal ausführlich.
Aber im zweifelsfall werde ich schon irgendwie an eine Windows 7 CD kommen.

Ich habe einmal einen PC über eine Windows CD formatiert, war zwar noch XP wird aber bei 7 wohl sehr ähnlich sein nehme ich an...


Und nur zum Verständnis:
Ich hab da irgendein Rootkit drauf, dass über Autorun wieder Trojaner installiert?

Vielen Dank!
Löhr

hi,
das deaktivieren der autorun funktion ist ne vorsichtsmaßname, besser man hatt, als man hätte.
acer müsste ne recovery haben, testen wir dann.
den haken raus nehmen reicht.