Windows update Fehler 80070426

DDS (Ver_2011-08-26.01) - NTFSx86 
Internet Explorer: 8.0.6001.19154
Run by Andreas  at 12:58:16 on 2012-03-21
Microsoft® Windows Vista™ Business   6.0.6002.2.1252.49.1031.18.1023.426 [GMT 1:00]
.
AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Microsoft SQL Server\MSSQL10.BTSQLINSTANZ\MSSQL\Binn\sqlservr.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe
C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Program Files\VMware\VMware Tools\vmtoolsd.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\CodeMeter\Runtime\bin\CodeMeter.exe
C:\Program Files\VMware\VMware Tools\VMUpgradeHelper.exe
C:\Program Files\VMware\VMware Tools\VMwareTray.exe
C:\Program Files\VMware\VMware Tools\VMwareUser.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\CodeMeter\Runtime\bin\CodeMeterCC.exe
c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe
C:\Program Files\VMware\VMware Tools\TPAutoConnSvc.exe
C:\Windows\system32\dllhost.exe
C:\Windows\System32\msdtc.exe
C:\Program Files\VMware\VMware Tools\TPAutoConnect.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.fondsfinanz.de/
mStart Page = hxxp://startsear.ch/
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll
BHO: IE5BarLauncherBHO Class: {78f3a323-798e-4aea-9a57-88f4b05fd5dd} - c:\program files\vshare.tv plugin\ssBarLcher.dll
TB: StartSearchToolBar: {7ac3e13b-3bca-4158-b330-f66dbb03c1b5} - c:\program files\vshare.tv plugin\ssBarLcher.dll
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [VMware Tools] "c:\program files\vmware\vmware tools\VMwareTray.exe"
mRun: [VMware User Process] "c:\program files\vmware\vmware tools\VMwareUser.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 10.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
StartupFolder: c:\users\andrea~1\appdata\roaming\micros~1\windows\startm~1\programs\startup\codeme~1.lnk - c:\program files\codemeter\runtime\bin\CodeMeterCC.exe
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Free YouTube to MP3 Converter - c:\users\andreas \appdata\roaming\dvdvideosoftiehelpers\freeyoutubetomp3converter.htm
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
LSP: c:\program files\vmware\vmware tools\vsock sdk\bin\win32\vsocklib.dll
DPF: {1241F20B-0688-45A5-ADB2-208AFE4A5DDC} - hxxps://goglobal4lic.maklersoftware.com/goglobal/plugins/gg-activex.cab
DPF: {CAFEEFAC-0014-0002-0010-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
TCP: DhcpNameServer = 192.168.109.2
TCP: Interfaces\{16DA9B34-0EE4-4A52-9716-E2E232151574} : DhcpNameServer = 192.168.109.2
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\andreas \appdata\roaming\mozilla\firefox\profiles\pvsw9u8k.default\
FF - prefs.js: browser.startup.homepage - hxxp://vshare.toolbarhome.com/?hp=df
FF - prefs.js: keyword.URL - hxxp://vshare.toolbarhome.com/search.aspx?srch=ku&q=
FF - plugin: c:\program files\java\j2re1.4.2_10\bin\NPJPI142_10.dll
FF - plugin: c:\program files\veetle\player\npvlc.dll
FF - plugin: c:\program files\veetle\plugins\npVeetle.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: vShare: vshare@toolbar - %profile%\extensions\vshare@toolbar
FF - Ext: Free YouTube Download (Free Studio) Menu: {ACAA314B-EEBA-48e4-AD47-84E31C44796C} - %profile%\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
.
============= SERVICES / DRIVERS ===============
.
R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2011-4-18 165648]
R1 MpKsl479cd8cd;MpKsl479cd8cd;c:\programdata\microsoft\microsoft antimalware\definition updates\{8dc5d129-5531-4db4-b39b-1f00de735054}\MpKsl479cd8cd.sys [2012-3-21 29904]
R1 vmhgfs;vmhgfs;c:\windows\system32\drivers\vmhgfs.sys [2011-1-13 129392]
R1 vmrawdsk;Hilfsdienst für physischen VMware Vista-Datenträger;c:\program files\vmware\vmware tools\vmrawdsk.sys [2010-11-30 37744]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2011-2-1 66616]
R2 CodeMeter.exe;CodeMeter Runtime Server;c:\program files\codemeter\runtime\bin\CodeMeter.exe [2010-6-30 2067344]
R2 FontCache;Windows-Dienst für Schriftartencache;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2011-1-16 21504]
R2 MSSQL$BTSQLINSTANZ;SQL Server (BTSQLINSTANZ);c:\program files\microsoft sql server\mssql10.btsqlinstanz\mssql\binn\sqlservr.exe [2009-3-30 43010392]
R2 SentinelKeysServer;Sentinel Keys Server;c:\program files\common files\safenet sentinel\sentinel keys server\sntlkeyssrvr.exe [2008-7-11 328992]
R2 VMMEMCTL;Treiber für Speichersteuerung;c:\program files\vmware\vmware tools\drivers\memctl\vmmemctl.sys [2011-5-21 14448]
R2 VMTools;VMware Tools Service;c:\program files\vmware\vmware tools\vmtoolsd.exe [2011-5-21 50288]
R2 VMUpgradeHelper;VMware-Upgrade-Hilfsprogramm;c:\program files\vmware\vmware tools\VMUpgradeHelper.exe [2011-5-21 174704]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\drivers\MpNWMon.sys [2011-4-18 43392]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\drivers\NisDrvWFP.sys [2011-4-27 65024]
R3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\microsoft security client\antimalware\NisSrv.exe [2011-4-27 208944]
R3 TPAutoConnSvc;TP AutoConnect Service;c:\program files\vmware\vmware tools\TPAutoConnSvc.exe [2010-11-30 255304]
R3 vm3dmp;vm3dmp;c:\windows\system32\drivers\vm3dmp.sys [2011-6-1 77824]
R3 vmci;VMware VMCI Bus Driver;c:\windows\system32\drivers\vmci.sys [2011-1-13 61872]
R3 vmmouse;VMware Pointing Device;c:\windows\system32\drivers\vmmouse.sys [2011-1-13 11440]
S1 vmdebug;VMware Replay Debugging Helper;c:\windows\system32\drivers\vmdebug.sys [2010-11-30 23152]
S2 AntiVirSchedulerService;Avira AntiVir Planer;"c:\program files\avira\antivir desktop\sched.exe" --> c:\program files\avira\antivir desktop\sched.exe [?]
S2 AntiVirService;Avira AntiVir Guard;"c:\program files\avira\antivir desktop\avguard.exe" --> c:\program files\avira\antivir desktop\avguard.exe [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S3 TPVCGateway;TP VC Gateway Service;c:\program files\vmware\vmware tools\TPVCGateway.exe [2010-11-30 390432]
S3 vmvss;VMware Snapshot Provider;c:\windows\system32\dllhost.exe [2006-11-2 7168]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
S4 mfetdi2k;McAfee Inc. mfetdi2k;c:\windows\system32\drivers\mfetdi2k.sys [2011-1-15 84072]
S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\microsoft sql server\100\shared\sqladhlp.exe [2009-3-31 47128]
S4 RsFx0103;RsFx0103 Driver;c:\windows\system32\drivers\RsFx0103.sys [2009-3-30 239336]
S4 SQLAgent$BTSQLINSTANZ;SQL Server Agent (BTSQLINSTANZ);c:\program files\microsoft sql server\mssql10.btsqlinstanz\mssql\binn\SQLAGENT.EXE [2009-3-30 366936]
.
=============== Created Last 30 ================
.
2012-03-21 11:08:56    29904    ----a-w-    c:\programdata\microsoft\microsoft antimalware\definition updates\{8dc5d129-5531-4db4-b39b-1f00de735054}\MpKsl479cd8cd.sys
2012-03-19 11:57:44    6552120    ----a-w-    c:\programdata\microsoft\microsoft antimalware\definition updates\backup\mpengine.dll
2012-03-19 11:57:23    6552120    ----a-w-    c:\programdata\microsoft\microsoft antimalware\definition updates\{8dc5d129-5531-4db4-b39b-1f00de735054}\mpengine.dll
2012-03-07 15:28:50    --------    d-----w-    c:\programdata\Spybot - Search & Destroy
2012-03-07 15:28:50    --------    d-----w-    c:\program files\Spybot - Search & Destroy
2012-03-07 15:09:58    713784    ----a-w-    c:\programdata\microsoft\microsoft antimalware\definition updates\nisbackup\gapaengine.dll
2012-03-07 15:09:57    713784    ----a-w-    c:\programdata\microsoft\microsoft antimalware\definition updates\{770fb0e5-4d49-4a1b-bb27-d14b0ced2018}\gapaengine.dll
2012-03-07 14:49:59    --------    d-----w-    c:\program files\Microsoft Security Client
2012-03-07 14:49:45    221568    ----a-w-    c:\windows\system32\drivers\netio.sys
.
==================== Find3M  ====================
.
2012-03-07 15:08:53    414368    ----a-w-    c:\windows\system32\FlashPlayerCPLApp.cpl
.
============= FINISH: 12:58:54,61 ===============
         

GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-03-21 13:58:30
Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\00000059 VMware,_ rev.1.0_
Running: 6oyd5cu5.exe; Driver: C:\Users\ANDREA~1\AppData\Local\Temp\kftoyaow.sys
 
 
---- System - GMER 1.0.15 ----
 
SSDT   86B58FE6                                                                                                            ZwCreateSection
SSDT   86B58FEB                                                                                                            ZwSetContextThread
SSDT   86B58F87                                                                                                            ZwTerminateProcess
 
---- Kernel code sections - GMER 1.0.15 ----
 
.text  ntkrnlpa.exe!KeSetEvent + 215                                                                                       81CF3998 4 Bytes  [E6, 8F, B5, 86] {OUT 0x8f, AL; MOV CH, 0x86}
.text  ntkrnlpa.exe!KeSetEvent + 56D                                                                                       81CF3CF0 4 Bytes  [EB, 8F, B5, 86] {JMP 0xffffffffffffff91; MOV CH, 0x86}
.text  ntkrnlpa.exe!KeSetEvent + 621                                                                                       81CF3DA4 4 Bytes  [87, 8F, B5, 86]
 
---- Files - GMER 1.0.15 ----
 
File   C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\MpCmdRun-55-53C9D589-6B66-4F30-9BAB-9A0193B0BAFC.lock  0 bytes
 
---- EOF - GMER 1.0.15 ----