Moskau - Plötzlich langsame Internetverbindung trotz gutem Netzwerk

cosinus · 14.06.2012, 13:39

Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C

nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

mkid76 · 14.06.2012, 21:28

Hi Arne,

alles wie beschrieben durchgeführt und hier nun das tdss log file:

lg mario

Code:

ATTFilter

22:19:59.0119 4468	TDSS rootkit removing tool 2.7.39.0 Jun 14 2012 08:11:46
22:20:00.0133 4468	============================================================
22:20:00.0133 4468	Current date / time: 2012/06/14 22:20:00.0133
22:20:00.0133 4468	SystemInfo:
22:20:00.0133 4468	
22:20:00.0133 4468	OS Version: 6.1.7601 ServicePack: 1.0
22:20:00.0133 4468	Product type: Workstation
22:20:00.0133 4468	ComputerName: M-MKINDERMANN
22:20:00.0133 4468	UserName: mkindermann
22:20:00.0133 4468	Windows directory: C:\Windows
22:20:00.0133 4468	System windows directory: C:\Windows
22:20:00.0133 4468	Running under WOW64
22:20:00.0133 4468	Processor architecture: Intel x64
22:20:00.0133 4468	Number of processors: 4
22:20:00.0133 4468	Page size: 0x1000
22:20:00.0133 4468	Boot type: Normal boot
22:20:00.0133 4468	============================================================
22:20:00.0382 4468	Drive \Device\Harddisk0\DR0 - Size: 0x1DCFE00000 (119.25 Gb), SectorSize: 0x200, Cylinders: 0x3CCE, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
22:20:00.0398 4468	============================================================
22:20:00.0398 4468	\Device\Harddisk0\DR0:
22:20:00.0398 4468	MBR partitions:
22:20:00.0398 4468	\Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0xFF5000, BlocksNum 0x32000
22:20:00.0398 4468	\Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x1027000, BlocksNum 0xDE57800
22:20:00.0398 4468	============================================================
22:20:00.0398 4468	Initialize success
22:20:00.0398 4468	============================================================
22:20:15.0031 5672	============================================================
22:20:15.0031 5672	Scan started
22:20:15.0031 5672	Mode: Manual; SigCheck; TDLFS; 
22:20:15.0031 5672	============================================================
22:20:15.0062 5672	1394ohci - ok
22:20:15.0062 5672	ACDaemon - ok
22:20:15.0062 5672	ACPI - ok
22:20:15.0062 5672	AcpiPmi - ok
22:20:15.0077 5672	AdobeARMservice - ok
22:20:15.0077 5672	AdobeFlashPlayerUpdateSvc - ok
22:20:15.0077 5672	adp94xx - ok
22:20:15.0093 5672	adpahci - ok
22:20:15.0093 5672	adpu320 - ok
22:20:15.0093 5672	AeLookupSvc - ok
22:20:15.0093 5672	AFD - ok
22:20:15.0109 5672	agp440 - ok
22:20:15.0109 5672	ALG - ok
22:20:15.0109 5672	aliide - ok
22:20:15.0109 5672	amdide - ok
22:20:15.0124 5672	AmdK8 - ok
22:20:15.0124 5672	AmdPPM - ok
22:20:15.0124 5672	amdsata - ok
22:20:15.0124 5672	amdsbs - ok
22:20:15.0124 5672	amdxata - ok
22:20:15.0140 5672	AppID - ok
22:20:15.0140 5672	AppIDSvc - ok
22:20:15.0140 5672	Appinfo - ok
22:20:15.0140 5672	Apple Mobile Device - ok
22:20:15.0155 5672	AppMgmt - ok
22:20:15.0155 5672	arc - ok
22:20:15.0155 5672	arcsas - ok
22:20:15.0171 5672	aspnet_state - ok
22:20:15.0171 5672	AsyncMac - ok
22:20:15.0171 5672	atapi - ok
22:20:15.0171 5672	atksgt - ok
22:20:15.0171 5672	AudioEndpointBuilder - ok
22:20:15.0187 5672	AudioSrv - ok
22:20:15.0187 5672	AxInstSV - ok
22:20:15.0187 5672	b06bdrv - ok
22:20:15.0202 5672	b57nd60a - ok
22:20:15.0202 5672	BDESVC - ok
22:20:15.0202 5672	Beep - ok
22:20:15.0202 5672	BFE - ok
22:20:15.0218 5672	BITS - ok
22:20:15.0218 5672	blbdrive - ok
22:20:15.0218 5672	Bonjour Service - ok
22:20:15.0218 5672	bowser - ok
22:20:15.0218 5672	BrFiltLo - ok
22:20:15.0233 5672	BrFiltUp - ok
22:20:15.0233 5672	Browser - ok
22:20:15.0233 5672	Brserid - ok
22:20:15.0233 5672	BrSerWdm - ok
22:20:15.0249 5672	BrUsbMdm - ok
22:20:15.0249 5672	BrUsbSer - ok
22:20:15.0249 5672	BthEnum - ok
22:20:15.0249 5672	BTHMODEM - ok
22:20:15.0249 5672	BthPan - ok
22:20:15.0265 5672	BTHPORT - ok
22:20:15.0265 5672	bthserv - ok
22:20:15.0265 5672	BTHUSB - ok
22:20:15.0265 5672	btwampfl - ok
22:20:15.0265 5672	btwaudio - ok
22:20:15.0280 5672	btwavdt - ok
22:20:15.0280 5672	btwdins - ok
22:20:15.0280 5672	btwl2cap - ok
22:20:15.0280 5672	btwrchid - ok
22:20:15.0296 5672	cdfs - ok
22:20:15.0296 5672	cdrom - ok
22:20:15.0296 5672	CertPropSvc - ok
22:20:15.0296 5672	circlass - ok
22:20:15.0296 5672	CLFS - ok
22:20:15.0311 5672	clr_optimization_v2.0.50727_32 - ok
22:20:15.0311 5672	clr_optimization_v2.0.50727_64 - ok
22:20:15.0311 5672	clr_optimization_v4.0.30319_32 - ok
22:20:15.0311 5672	clr_optimization_v4.0.30319_64 - ok
22:20:15.0327 5672	CmBatt - ok
22:20:15.0327 5672	cmdide - ok
22:20:15.0327 5672	CNG - ok
22:20:15.0327 5672	Compbatt - ok
22:20:15.0327 5672	CompositeBus - ok
22:20:15.0343 5672	COMSysApp - ok
22:20:15.0343 5672	crcdisk - ok
22:20:15.0343 5672	CryptSvc - ok
22:20:15.0343 5672	CSC - ok
22:20:15.0343 5672	CscService - ok
22:20:15.0358 5672	dc3d - ok
22:20:15.0358 5672	DcomLaunch - ok
22:20:15.0358 5672	defragsvc - ok
22:20:15.0358 5672	DfsC - ok
22:20:15.0358 5672	Dhcp - ok
22:20:15.0374 5672	discache - ok
22:20:15.0374 5672	Disk - ok
22:20:15.0374 5672	Dnscache - ok
22:20:15.0374 5672	dot3svc - ok
22:20:15.0389 5672	Dot4 - ok
22:20:15.0389 5672	Dot4Print - ok
22:20:15.0389 5672	dot4usb - ok
22:20:15.0389 5672	DPS - ok
22:20:15.0389 5672	drmkaud - ok
22:20:15.0405 5672	DXGKrnl - ok
22:20:15.0405 5672	e1kexpress - ok
22:20:15.0405 5672	EapHost - ok
22:20:15.0405 5672	ebdrv - ok
22:20:15.0405 5672	EFS - ok
22:20:15.0421 5672	ehRecvr - ok
22:20:15.0421 5672	ehSched - ok
22:20:15.0421 5672	elxstor - ok
22:20:15.0421 5672	ErrDev - ok
22:20:15.0421 5672	EventSystem - ok
22:20:15.0436 5672	EvtEng - ok
22:20:15.0436 5672	exfat - ok
22:20:15.0436 5672	F-Secure Gatekeeper - ok
22:20:15.0436 5672	F-Secure Gatekeeper Handler Starter - ok
22:20:15.0452 5672	F-Secure HIPS - ok
22:20:15.0452 5672	F-Secure Network Request Broker - ok
22:20:15.0452 5672	fastfat - ok
22:20:15.0452 5672	Fax - ok
22:20:15.0452 5672	fdc - ok
22:20:15.0467 5672	fdPHost - ok
22:20:15.0467 5672	FDResPub - ok
22:20:15.0467 5672	FileInfo - ok
22:20:15.0467 5672	Filetrace - ok
22:20:15.0467 5672	flpydisk - ok
22:20:15.0483 5672	FltMgr - ok
22:20:15.0483 5672	FontCache - ok
22:20:15.0483 5672	FontCache3.0.0.0 - ok
22:20:15.0483 5672	fsbts - ok
22:20:15.0499 5672	FsDepends - ok
22:20:15.0499 5672	FSDFWD - ok
22:20:15.0499 5672	FSES - ok
22:20:15.0499 5672	FSFW - ok
22:20:15.0499 5672	FSMA - ok
22:20:15.0514 5672	FSORSPClient - ok
22:20:15.0514 5672	fsvista - ok
22:20:15.0514 5672	Fs_Rec - ok
22:20:15.0514 5672	fvevol - ok
22:20:15.0514 5672	gagp30kx - ok
22:20:15.0530 5672	GEARAspiWDM - ok
22:20:15.0530 5672	gpsvc - ok
22:20:15.0530 5672	hcw85cir - ok
22:20:15.0530 5672	HdAudAddService - ok
22:20:15.0530 5672	HDAudBus - ok
22:20:15.0545 5672	HECIx64 - ok
22:20:15.0545 5672	HidBatt - ok
22:20:15.0545 5672	HidBth - ok
22:20:15.0545 5672	HidIr - ok
22:20:15.0545 5672	hidserv - ok
22:20:15.0561 5672	HidUsb - ok
22:20:15.0561 5672	hkmsvc - ok
22:20:15.0561 5672	HomeGroupListener - ok
22:20:15.0561 5672	HomeGroupProvider - ok
22:20:15.0561 5672	hpqcxs08 - ok
22:20:15.0577 5672	hpqddsvc - ok
22:20:15.0577 5672	HpSAMD - ok
22:20:15.0577 5672	HPSLPSVC - ok
22:20:15.0592 5672	HTTP - ok
22:20:15.0592 5672	hwdatacard - ok
22:20:15.0592 5672	hwpolicy - ok
22:20:15.0608 5672	i8042prt - ok
22:20:15.0608 5672	iaStor - ok
22:20:15.0608 5672	IAStorDataMgrSvc - ok
22:20:15.0608 5672	iaStorV - ok
22:20:15.0608 5672	idsvc - ok
22:20:15.0623 5672	iirsp - ok
22:20:15.0623 5672	IKEEXT - ok
22:20:15.0623 5672	Impcd - ok
22:20:15.0623 5672	IntcAzAudAddService - ok
22:20:15.0639 5672	intelide - ok
22:20:15.0639 5672	intelppm - ok
22:20:15.0639 5672	IPBusEnum - ok
22:20:15.0639 5672	IpFilterDriver - ok
22:20:15.0639 5672	iphlpsvc - ok
22:20:15.0655 5672	IPMIDRV - ok
22:20:15.0655 5672	IPNAT - ok
22:20:15.0655 5672	iPod Service - ok
22:20:15.0655 5672	IRENUM - ok
22:20:15.0655 5672	isapnp - ok
22:20:15.0670 5672	iScsiPrt - ok
22:20:15.0670 5672	kbdclass - ok
22:20:15.0670 5672	kbdhid - ok
22:20:15.0670 5672	KeyIso - ok
22:20:15.0670 5672	KSecDD - ok
22:20:15.0686 5672	KSecPkg - ok
22:20:15.0686 5672	ksthunk - ok
22:20:15.0686 5672	KtmRm - ok
22:20:15.0686 5672	LanmanServer - ok
22:20:15.0686 5672	LanmanWorkstation - ok
22:20:15.0701 5672	lirsgt - ok
22:20:15.0701 5672	lltdio - ok
22:20:15.0701 5672	lltdsvc - ok
22:20:15.0717 5672	lmhosts - ok
22:20:15.0717 5672	LMS - ok
22:20:15.0717 5672	LSI_FC - ok
22:20:15.0717 5672	LSI_SAS - ok
22:20:15.0733 5672	LSI_SAS2 - ok
22:20:15.0733 5672	LSI_SCSI - ok
22:20:15.0733 5672	luafv - ok
22:20:15.0733 5672	massfilter - ok
22:20:15.0748 5672	MBAMProtector - ok
22:20:15.0748 5672	MBAMService - ok
22:20:15.0748 5672	Mcx2Svc - ok
22:20:15.0748 5672	megasas - ok
22:20:15.0764 5672	MegaSR - ok
22:20:15.0764 5672	Microsoft Office Groove Audit Service - ok
22:20:15.0764 5672	MMCSS - ok
22:20:15.0764 5672	Modem - ok
22:20:15.0764 5672	monitor - ok
22:20:15.0779 5672	mouclass - ok
22:20:15.0779 5672	mouhid - ok
22:20:15.0779 5672	mountmgr - ok
22:20:15.0779 5672	MozillaMaintenance - ok
22:20:15.0795 5672	mpio - ok
22:20:15.0795 5672	mpsdrv - ok
22:20:15.0795 5672	MpsSvc - ok
22:20:15.0795 5672	MRxDAV - ok
22:20:15.0795 5672	mrxsmb - ok
22:20:15.0811 5672	mrxsmb10 - ok
22:20:15.0811 5672	mrxsmb20 - ok
22:20:15.0811 5672	msahci - ok
22:20:15.0811 5672	msdsm - ok
22:20:15.0811 5672	MSDTC - ok
22:20:15.0826 5672	Msfs - ok
22:20:15.0826 5672	mshidkmdf - ok
22:20:15.0826 5672	msisadrv - ok
22:20:15.0826 5672	MSiSCSI - ok
22:20:15.0842 5672	msiserver - ok
22:20:15.0842 5672	MSKSSRV - ok
22:20:15.0842 5672	MSPCLOCK - ok
22:20:15.0842 5672	MSPQM - ok
22:20:15.0842 5672	MsRPC - ok
22:20:15.0857 5672	mssmbios - ok
22:20:15.0857 5672	MSTEE - ok
22:20:15.0857 5672	MTConfig - ok
22:20:15.0857 5672	Mup - ok
22:20:15.0857 5672	napagent - ok
22:20:15.0873 5672	NativeWifiP - ok
22:20:15.0873 5672	NDIS - ok
22:20:15.0873 5672	NdisCap - ok
22:20:15.0873 5672	NdisTapi - ok
22:20:15.0873 5672	Ndisuio - ok
22:20:15.0889 5672	NdisWan - ok
22:20:15.0889 5672	NDProxy - ok
22:20:15.0889 5672	Net Driver HPZ12 - ok
22:20:15.0904 5672	Netaapl - ok
22:20:15.0904 5672	NetBIOS - ok
22:20:15.0904 5672	NetBT - ok
22:20:15.0904 5672	Netlogon - ok
22:20:15.0904 5672	Netman - ok
22:20:15.0920 5672	NetMsmqActivator - ok
22:20:15.0920 5672	NetPipeActivator - ok
22:20:15.0920 5672	netprofm - ok
22:20:15.0920 5672	NetTcpActivator - ok
22:20:15.0920 5672	NetTcpPortSharing - ok
22:20:15.0935 5672	NETw5s64 - ok
22:20:15.0935 5672	nfrd960 - ok
22:20:15.0935 5672	NlaSvc - ok
22:20:15.0935 5672	Npfs - ok
22:20:15.0951 5672	nsi - ok
22:20:15.0951 5672	nsiproxy - ok
22:20:15.0951 5672	Ntfs - ok
22:20:15.0951 5672	Null - ok
22:20:15.0951 5672	NVHDA - ok
22:20:15.0967 5672	nvlddmkm - ok
22:20:15.0967 5672	nvraid - ok
22:20:15.0967 5672	nvstor - ok
22:20:15.0967 5672	nvsvc - ok
22:20:15.0982 5672	nv_agp - ok
22:20:15.0982 5672	odserv - ok
22:20:15.0982 5672	ohci1394 - ok
22:20:15.0982 5672	ose - ok
22:20:15.0982 5672	p2pimsvc - ok
22:20:15.0998 5672	p2psvc - ok
22:20:15.0998 5672	Parport - ok
22:20:15.0998 5672	partmgr - ok
22:20:15.0998 5672	PcaSvc - ok
22:20:15.0998 5672	pci - ok
22:20:16.0013 5672	pciide - ok
22:20:16.0013 5672	pcmcia - ok
22:20:16.0013 5672	pcw - ok
22:20:16.0013 5672	PEAUTH - ok
22:20:16.0013 5672	PeerDistSvc - ok
22:20:16.0029 5672	PerfHost - ok
22:20:16.0029 5672	pla - ok
22:20:16.0029 5672	PlugPlay - ok
22:20:16.0045 5672	Pml Driver HPZ12 - ok
22:20:16.0045 5672	PNRPAutoReg - ok
22:20:16.0045 5672	PNRPsvc - ok
22:20:16.0045 5672	Point64 - ok
22:20:16.0060 5672	PolicyAgent - ok
22:20:16.0060 5672	postgresql-8.4 - ok
22:20:16.0060 5672	Power - ok
22:20:16.0060 5672	PptpMiniport - ok
22:20:16.0076 5672	Processor - ok
22:20:16.0076 5672	ProfSvc - ok
22:20:16.0076 5672	ProtectedStorage - ok
22:20:16.0076 5672	Psched - ok
22:20:16.0076 5672	qcfiltersny2k - ok
22:20:16.0091 5672	qcombussny - ok
22:20:16.0091 5672	qcusbnetsny2k - ok
22:20:16.0091 5672	qcusbsersny2k - ok
22:20:16.0091 5672	QDLService2kSony - ok
22:20:16.0091 5672	ql2300 - ok
22:20:16.0107 5672	ql40xx - ok
22:20:16.0107 5672	QWAVE - ok
22:20:16.0107 5672	QWAVEdrv - ok
22:20:16.0107 5672	RasAcd - ok
22:20:16.0107 5672	RasAgileVpn - ok
22:20:16.0123 5672	RasAuto - ok
22:20:16.0123 5672	Rasl2tp - ok
22:20:16.0123 5672	RasMan - ok
22:20:16.0123 5672	RasPppoe - ok
22:20:16.0123 5672	RasSstp - ok
22:20:16.0138 5672	rdbss - ok
22:20:16.0138 5672	rdpbus - ok
22:20:16.0138 5672	RDPCDD - ok
22:20:16.0138 5672	RDPDR - ok
22:20:16.0154 5672	RDPENCDD - ok
22:20:16.0154 5672	RDPREFMP - ok
22:20:16.0154 5672	RDPWD - ok
22:20:16.0154 5672	rdyboost - ok
22:20:16.0154 5672	RegSrvc - ok
22:20:16.0169 5672	RemoteAccess - ok
22:20:16.0169 5672	RemoteRegistry - ok
22:20:16.0169 5672	RFCOMM - ok
22:20:16.0169 5672	rimspci - ok
22:20:16.0169 5672	risdsnpe - ok
22:20:16.0185 5672	RpcEptMapper - ok
22:20:16.0185 5672	RpcLocator - ok
22:20:16.0185 5672	RpcSs - ok
22:20:16.0185 5672	rspndr - ok
22:20:16.0185 5672	s3cap - ok
22:20:16.0201 5672	SamSs - ok
22:20:16.0201 5672	sbp2port - ok
22:20:16.0201 5672	SCardSvr - ok
22:20:16.0201 5672	scfilter - ok
22:20:16.0216 5672	Schedule - ok
22:20:16.0216 5672	SCPolicySvc - ok
22:20:16.0216 5672	sdbus - ok
22:20:16.0216 5672	SDRSVC - ok
22:20:16.0216 5672	secdrv - ok
22:20:16.0232 5672	seclogon - ok
22:20:16.0232 5672	SENS - ok
22:20:16.0232 5672	SensrSvc - ok
22:20:16.0232 5672	Serenum - ok
22:20:16.0232 5672	Serial - ok
22:20:16.0247 5672	sermouse - ok
22:20:16.0247 5672	SessionEnv - ok
22:20:16.0247 5672	SFEP - ok
22:20:16.0247 5672	sffdisk - ok
22:20:16.0263 5672	sffp_mmc - ok
22:20:16.0263 5672	sffp_sd - ok
22:20:16.0263 5672	sfloppy - ok
22:20:16.0263 5672	SharedAccess - ok
22:20:16.0263 5672	ShellHWDetection - ok
22:20:16.0279 5672	SiSRaid2 - ok
22:20:16.0279 5672	SiSRaid4 - ok
22:20:16.0279 5672	SkypeUpdate - ok
22:20:16.0279 5672	Smb - ok
22:20:16.0294 5672	SNMPTRAP - ok
22:20:16.0294 5672	spldr - ok
22:20:16.0294 5672	Spooler - ok
22:20:16.0294 5672	sppsvc - ok
22:20:16.0294 5672	sppuinotify - ok
22:20:16.0310 5672	srv - ok
22:20:16.0310 5672	srv2 - ok
22:20:16.0310 5672	srvnet - ok
22:20:16.0310 5672	SSDPSRV - ok
22:20:16.0310 5672	SstpSvc - ok
22:20:16.0325 5672	Steam Client Service - ok
22:20:16.0325 5672	stexstor - ok
22:20:16.0325 5672	StillCam - ok
22:20:16.0325 5672	stisvc - ok
22:20:16.0341 5672	storflt - ok
22:20:16.0341 5672	StorSvc - ok
22:20:16.0341 5672	storvsc - ok
22:20:16.0341 5672	swenum - ok
22:20:16.0341 5672	swprv - ok
22:20:16.0357 5672	SysMain - ok
22:20:16.0357 5672	TabletInputService - ok
22:20:16.0357 5672	tap0901 - ok
22:20:16.0357 5672	TapiSrv - ok
22:20:16.0357 5672	TBS - ok
22:20:16.0372 5672	Tcpip - ok
22:20:16.0372 5672	TCPIP6 - ok
22:20:16.0372 5672	tcpipreg - ok
22:20:16.0372 5672	TDPIPE - ok
22:20:16.0388 5672	TDTCP - ok
22:20:16.0388 5672	tdx - ok
22:20:16.0388 5672	TeamViewer6 - ok
22:20:16.0388 5672	TermDD - ok
22:20:16.0403 5672	TermService - ok
22:20:16.0403 5672	Themes - ok
22:20:16.0403 5672	THREADORDER - ok
22:20:16.0403 5672	TPM - ok
22:20:16.0419 5672	TrkWks - ok
22:20:16.0419 5672	truecrypt - ok
22:20:16.0419 5672	TrustedInstaller - ok
22:20:16.0419 5672	tssecsrv - ok
22:20:16.0435 5672	TsUsbFlt - ok
22:20:16.0435 5672	tunnel - ok
22:20:16.0435 5672	uagp35 - ok
22:20:16.0435 5672	udfs - ok
22:20:16.0450 5672	UI0Detect - ok
22:20:16.0450 5672	uliagpkx - ok
22:20:16.0450 5672	umbus - ok
22:20:16.0450 5672	UmPass - ok
22:20:16.0450 5672	UmRdpService - ok
22:20:16.0466 5672	UNS - ok
22:20:16.0466 5672	upnphost - ok
22:20:16.0466 5672	USBAAPL64 - ok
22:20:16.0466 5672	usbaudio - ok
22:20:16.0481 5672	usbccgp - ok
22:20:16.0481 5672	usbcir - ok
22:20:16.0481 5672	usbehci - ok
22:20:16.0481 5672	usbhub - ok
22:20:16.0481 5672	usbohci - ok
22:20:16.0497 5672	usbprint - ok
22:20:16.0497 5672	usbscan - ok
22:20:16.0497 5672	USBSTOR - ok
22:20:16.0497 5672	usbuhci - ok
22:20:16.0497 5672	usbvideo - ok
22:20:16.0513 5672	UxSms - ok
22:20:16.0513 5672	VAIO Event Service - ok
22:20:16.0513 5672	VAIO Power Management - ok
22:20:16.0513 5672	VaultSvc - ok
22:20:16.0513 5672	VCService - ok
22:20:16.0528 5672	vdrvroot - ok
22:20:16.0528 5672	vds - ok
22:20:16.0528 5672	vga - ok
22:20:16.0528 5672	VgaSave - ok
22:20:16.0528 5672	vhdmp - ok
22:20:16.0544 5672	viaide - ok
22:20:16.0544 5672	vmbus - ok
22:20:16.0544 5672	VMBusHID - ok
22:20:16.0544 5672	volmgr - ok
22:20:16.0544 5672	volmgrx - ok
22:20:16.0559 5672	volsnap - ok
22:20:16.0559 5672	vsmraid - ok
22:20:16.0559 5672	VSNService - ok
22:20:16.0559 5672	VSS - ok
22:20:16.0559 5672	VUAgent - ok
22:20:16.0575 5672	vwifibus - ok
22:20:16.0575 5672	vwififlt - ok
22:20:16.0575 5672	vwifimp - ok
22:20:16.0575 5672	W32Time - ok
22:20:16.0591 5672	WacomPen - ok
22:20:16.0591 5672	WANARP - ok
22:20:16.0591 5672	Wanarpv6 - ok
22:20:16.0591 5672	WatAdminSvc - ok
22:20:16.0591 5672	wbengine - ok
22:20:16.0606 5672	WbioSrvc - ok
22:20:16.0606 5672	wcncsvc - ok
22:20:16.0606 5672	WcsPlugInService - ok
22:20:16.0606 5672	Wd - ok
22:20:16.0606 5672	Wdf01000 - ok
22:20:16.0622 5672	WdiServiceHost - ok
22:20:16.0622 5672	WdiSystemHost - ok
22:20:16.0622 5672	WebClient - ok
22:20:16.0622 5672	Wecsvc - ok
22:20:16.0622 5672	wercplsupport - ok
22:20:16.0637 5672	WerSvc - ok
22:20:16.0637 5672	WfpLwf - ok
22:20:16.0637 5672	WIMMount - ok
22:20:16.0637 5672	WinDefend - ok
22:20:16.0653 5672	WinHttpAutoProxySvc - ok
22:20:16.0653 5672	Winmgmt - ok
22:20:16.0653 5672	WinRM - ok
22:20:16.0653 5672	WinUsb - ok
22:20:16.0669 5672	Wlansvc - ok
22:20:16.0669 5672	WmiAcpi - ok
22:20:16.0669 5672	wmiApSrv - ok
22:20:16.0669 5672	WMPNetworkSvc - ok
22:20:16.0684 5672	WPCSvc - ok
22:20:16.0684 5672	WPDBusEnum - ok
22:20:16.0684 5672	ws2ifsl - ok
22:20:16.0684 5672	wscsvc - ok
22:20:16.0684 5672	WSearch - ok
22:20:16.0700 5672	wuauserv - ok
22:20:16.0700 5672	WudfPf - ok
22:20:16.0700 5672	WUDFRd - ok
22:20:16.0700 5672	wudfsvc - ok
22:20:16.0700 5672	WwanSvc - ok
22:20:16.0715 5672	ZTEusbmdm6k - ok
22:20:16.0715 5672	ZTEusbnmea - ok
22:20:16.0715 5672	ZTEusbser6k - ok
22:20:16.0731 5672	MBR (0x1B8)     (9c58313c5dda6d94904a3d60ad87b6bb) \Device\Harddisk0\DR0
22:20:16.0965 5672	\Device\Harddisk0\DR0 - ok
22:20:16.0965 5672	Boot (0x1200)   (55bdeec1821354ec2fcfa704d677a74f) \Device\Harddisk0\DR0\Partition0
22:20:16.0965 5672	\Device\Harddisk0\DR0\Partition0 - ok
22:20:16.0965 5672	Boot (0x1200)   (51c913004fe5b829d5db81ad31ec7a47) \Device\Harddisk0\DR0\Partition1
22:20:16.0965 5672	\Device\Harddisk0\DR0\Partition1 - ok
22:20:16.0965 5672	============================================================
22:20:16.0965 5672	Scan finished
22:20:16.0965 5672	============================================================
22:20:16.0965 1092	Detected object count: 0
22:20:16.0965 1092	Actual detected object count: 0

cosinus · 15.06.2012, 14:02

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop.

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

mkid76 · 15.06.2012, 14:56

Hi Arne,

Combo Fix wurde durchgeführt und folgendes Logfile gespeichert. Vielen Dank nochmal für Deine Mühe!

Lg,
Mario

Code:

ATTFilter

ComboFix 12-06-15.02 - *** 15.06.2012  15:30:45.1.4 - x64
Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.3766.2197 [GMT 2:00]
ausgeführt von:: c:\users\***\Desktop\ComboFix.exe
AV: F-Secure Client Security 9.01 *Disabled/Updated* {15414183-282E-D62C-CA37-EF24860A2F17}
FW: F-Secure Client Security 9.01 *Disabled* {2D7AC0A6-6241-D774-E168-461178D9686C}
SP: F-Secure Client Security 9.01 *Disabled/Updated* {AE20A067-0E14-D9A2-F087-D456FD8D65AA}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\***\AppData\Roaming\Local
c:\users\***\AppData\Roaming\Local\Temp\DDM\Settings\0.ddi
c:\users\***\AppData\Roaming\Local\Temp\DDM\Settings\Inception_Trailer_592.divx.ddr
c:\users\***\AppData\Roaming\Local\Temp\DDM\Settings\settings.ddi
c:\users\***\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\Inception_Trailer_592.divx
c:\windows\system32\drivers\etc\hosts.ics
.
.
(((((((((((((((((((((((   Dateien erstellt von 2012-05-15 bis 2012-06-15  ))))))))))))))))))))))))))))))
.
.
2012-06-15 13:35 . 2012-06-15 13:35	--------	d-----w-	c:\users\postgres\AppData\Local\temp
2012-06-15 13:35 . 2012-06-15 13:35	--------	d-----w-	c:\users\postgres.m-***\AppData\Local\temp
2012-06-15 13:35 . 2012-06-15 13:35	--------	d-----w-	c:\users\Default\AppData\Local\temp
2012-06-14 11:59 . 2012-06-14 11:59	--------	d-----w-	C:\_OTL
2012-06-13 23:15 . 2012-04-26 05:41	149504	----a-w-	c:\windows\system32\rdpcorekmts.dll
2012-06-13 23:15 . 2012-05-01 05:40	209920	----a-w-	c:\windows\system32\profsvc.dll
2012-06-13 23:15 . 2012-04-26 05:41	77312	----a-w-	c:\windows\system32\rdpwsx.dll
2012-06-13 23:15 . 2012-04-26 05:34	9216	----a-w-	c:\windows\system32\rdrmemptylst.exe
2012-06-13 23:15 . 2012-05-04 11:06	5559664	----a-w-	c:\windows\system32\ntoskrnl.exe
2012-06-13 23:15 . 2012-05-04 10:03	3968368	----a-w-	c:\windows\SysWow64\ntkrnlpa.exe
2012-06-13 23:15 . 2012-05-04 10:03	3913072	----a-w-	c:\windows\SysWow64\ntoskrnl.exe
2012-06-13 23:13 . 2012-05-15 01:32	3146752	----a-w-	c:\windows\system32\win32k.sys
2012-06-13 23:13 . 2012-04-28 03:55	210944	----a-w-	c:\windows\system32\drivers\rdpwd.sys
2012-06-13 23:13 . 2012-04-07 12:31	3216384	----a-w-	c:\windows\system32\msi.dll
2012-06-13 23:13 . 2012-04-07 11:26	2342400	----a-w-	c:\windows\SysWow64\msi.dll
2012-06-13 23:13 . 2012-04-24 05:37	1462272	----a-w-	c:\windows\system32\crypt32.dll
2012-06-13 23:13 . 2012-04-24 04:36	1158656	----a-w-	c:\windows\SysWow64\crypt32.dll
2012-06-13 23:13 . 2012-04-24 05:37	184320	----a-w-	c:\windows\system32\cryptsvc.dll
2012-06-13 23:13 . 2012-04-24 05:37	140288	----a-w-	c:\windows\system32\cryptnet.dll
2012-06-13 23:13 . 2012-04-24 04:36	140288	----a-w-	c:\windows\SysWow64\cryptsvc.dll
2012-06-13 23:13 . 2012-04-24 04:36	103936	----a-w-	c:\windows\SysWow64\cryptnet.dll
2012-06-11 18:34 . 2012-06-11 18:34	--------	d-----w-	c:\program files (x86)\ESET
2012-06-11 18:17 . 2012-06-11 18:17	--------	d-----w-	c:\program files (x86)\Mozilla Maintenance Service
2012-06-10 05:15 . 2012-06-11 00:53	69000	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{E71BB62F-0D52-4A0F-9881-4BD116551309}\offreg.dll
2012-06-08 16:33 . 2012-05-08 17:02	8955792	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{E71BB62F-0D52-4A0F-9881-4BD116551309}\mpengine.dll
2012-06-07 23:27 . 2012-06-07 23:27	--------	d-----w-	c:\users\***\AppData\Roaming\Malwarebytes
2012-06-07 23:27 . 2012-06-07 23:27	--------	d-----w-	c:\programdata\Malwarebytes
2012-06-07 23:27 . 2012-06-07 23:27	--------	d-----w-	c:\program files (x86)\Malwarebytes' Anti-Malware
2012-06-07 23:27 . 2012-04-04 13:56	24904	----a-w-	c:\windows\system32\drivers\mbam.sys
2012-06-06 21:55 . 2012-06-06 22:00	--------	d-----w-	c:\users\***\AppData\Local\Deployment
2012-06-06 21:55 . 2012-06-06 21:55	--------	d-----w-	c:\users\***\AppData\Local\Apps
2012-06-01 04:32 . 2012-06-01 04:32	163048	----a-w-	c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10141.bin
2012-05-29 13:41 . 2012-05-29 13:43	--------	d-----w-	c:\users\***\AppData\Local\Equilab
2012-05-29 13:41 . 2012-05-29 13:41	--------	d-----w-	c:\program files (x86)\PokerStrategy.com
2012-05-29 13:40 . 2012-05-29 13:40	--------	d-----w-	c:\users\***\AppData\Local\Downloaded Installations
2012-05-27 13:15 . 2012-05-27 13:29	--------	d-----w-	c:\users\***\AppData\Roaming\PacificPoker
2012-05-27 13:15 . 2012-05-27 13:15	--------	d-----w-	c:\program files (x86)\PacificPoker
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-09 12:14 . 2012-05-09 12:14	55960	----a-w-	c:\windows\system32\drivers\fsbts.sys
2012-05-04 01:39 . 2012-05-04 01:39	418464	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2012-05-04 01:39 . 2011-07-27 23:58	70304	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-03-30 11:35 . 2012-05-13 14:24	1918320	----a-w-	c:\windows\system32\drivers\tcpip.sys
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TrueCrypt"="c:\program files\TrueCrypt\TrueCrypt.exe" [2010-11-24 1496528]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"F-Secure Manager"="c:\program files (x86)\F-Secure\Common\FSM32.EXE" [2010-03-26 301744]
"F-Secure TNB"="c:\program files (x86)\F-Secure\FSGUI\TNBUtil.exe" [2010-03-26 1653424]
"HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"AppleSyncNotifier"="c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-12-14 47904]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-04-14 421160]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [2009-5-21 275768]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages	REG_MULTI_SZ   	scecli c:\program files\Protector Suite\psqlpwd.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-02-29 158856]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-04 253088]
R3 btwampfl;Bluetooth AMP USB Filter;c:\windows\system32\drivers\btwampfl.sys [x]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x]
R3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\DRIVERS\dc3d.sys [x]
R3 massfilter;Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [x]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-06-01 113120]
R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl64.sys [x]
R3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
R3 VCService;VCService;c:\program files\Sony\VAIO Care\VCService.exe [2011-02-14 44736]
R3 VUAgent;VUAgent;c:\program files\Sony\VAIO Update Common\VUAgent.exe [2012-01-13 1256040]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S0 fsbts;fsbts;c:\windows\system32\Drivers\fsbts.sys [2012-05-09 55960]
S1 F-Secure HIPS;F-Secure HIPS Driver;c:\program files (x86)\F-Secure\HIPS\drivers\fshs.sys [2010-03-26 58000]
S1 FSES;F-Secure Email Scanning Driver;c:\windows\system32\drivers\fses.sys [x]
S1 FSFW;F-Secure Firewall Driver;c:\windows\system32\drivers\fsdfw.sys [x]
S1 fsvista;F-Secure Vista Support Driver;c:\program files (x86)\F-Secure\Anti-Virus\minifilter\fsvista.sys [2010-03-26 14904]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-03-04 13336]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-04-04 654408]
S2 postgresql-8.4;PostgreSQL Server 8.4;C:/Program Files (x86)/PostgreSQL/8.4/bin/pg_ctl.exe runservice -N postgresql-8.4 -D C:/Program Files (x86)/PostgreSQL/8.4/data -w [x]
S2 QDLService2kSony;Qualcomm Gobi 2000 Download Service (Sony);c:\program files (x86)\QUALCOMM\QDLService2k\QDLService2kSony.exe [2010-06-03 332024]
S2 rimspci;rimspci;c:\windows\system32\drivers\rimssne64.sys [x]
S2 risdsnpe;risdsnpe;c:\windows\system32\drivers\risdsne64.sys [x]
S2 SampleCollector;VAIO Care Performance Service;c:\program files\Sony\VAIO Care\VCPerfService.exe [2011-01-29 259192]
S2 TeamViewer6;TeamViewer 6;c:\program files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2011-04-15 2280312]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-02-23 2320920]
S2 VAIO Power Management;VAIO Power Management;c:\program files\Sony\VAIO Power Management\SPMService.exe [2010-06-21 575856]
S2 VSNService;VSNService;c:\program files\Sony\VAIO Smart Network\VSNService.exe [2010-08-11 845312]
S3 e1kexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\DRIVERS\e1k62x64.sys [x]
S3 F-Secure Gatekeeper;F-Secure Gatekeeper;c:\program files (x86)\F-Secure\Anti-Virus\minifilter\fsgk.sys [2012-05-29 199848]
S3 FSORSPClient;F-Secure ORSP Client;c:\program files (x86)\F-Secure\ORSP Client\fsorsp.exe [2011-05-23 61088]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\drivers\HECIx64.sys [x]
S3 Impcd;Impcd;c:\windows\system32\drivers\Impcd.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
S3 NETw5s64;Intel(R) Wireless WiFi Link der Serie 5000 Adaptertreiber für Windows 7 64-Bit;c:\windows\system32\DRIVERS\NETw5s64.sys [x]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [x]
S3 qcfiltersny2k;Qualcomm Gobi 2000 USB Composite Device Filter 9225;c:\windows\system32\DRIVERS\qcfiltersny2k.sys [x]
S3 qcombussny;Gobi 2000 USB Composite Device Driver(05C6-9225);c:\windows\system32\DRIVERS\qcombussny.sys [x]
S3 qcusbnetsny2k;Gobi 2000 USB-NDIS miniport(05C6-9225);c:\windows\system32\DRIVERS\qcusbnetsny2k.sys [x]
S3 qcusbsersny2k;Gobi 2000 USB Device for Legacy Serial Communication(05C6-9225);c:\windows\system32\DRIVERS\qcusbserSny2k.sys [x]
S3 SFEP;Sony Firmware Extension Parser;c:\windows\system32\DRIVERS\SFEP.sys [x]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt	REG_MULTI_SZ   	hpqcxs08 hpqddsvc
.
Inhalt des "geplante Tasks" Ordners
.
2012-06-15 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-04 01:39]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlay]
@="{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}"
[HKEY_CLASSES_ROOT\CLSID\{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}]
2010-04-27 13:48	5947656	----a-w-	c:\program files\Protector Suite\farchns.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlayOpen]
@="{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}"
[HKEY_CLASSES_ROOT\CLSID\{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}]
2010-04-27 13:48	5947656	----a-w-	c:\program files\Protector Suite\farchns.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Logitech Download Assistant"="c:\windows\system32\rundll32.exe" [2009-07-14 45568]
"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2011-04-13 1860496]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2011-04-13 2399632]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://vshare.toolbarhome.com/?hp=df
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local;<local>
IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: {{90EAE591-7E7E-434a-8E28-ECFD00071806} - c:\program files (x86)\PokerStars.FR\PokerStarsUpdate.exe
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\***\AppData\Roaming\Mozilla\Firefox\Profiles\471wfo9m.default\
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
AddRemove-Convert XLS_is1 - c:\program files (x86)\Softinterface
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\postgresql-8.4]
"ImagePath"="C:/Program Files (x86)/PostgreSQL/8.4/bin/pg_ctl.exe runservice -N \"postgresql-8.4\" -D \"C:/Program Files (x86)/PostgreSQL/8.4/data\" -w"
--
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SampleCollector]
"ImagePath"="\"c:\program files\Sony\VAIO Care\VCPerfService.exe\" \"/service\" \"/sstates\" \"/sampleinterval=5000\" \"/procinterval=5\" \"/dllinterval=120\" \"/counter=\Processor(_Total)\% Processor Time:1/counter=\PhysicalDisk(_Total)\Disk Bytes/sec:1\" \"/counter=\Network Interface(*)\Bytes Total/sec:1\" \"/expandcounter=\Processor Information(*)\Processor Frequency:1\" \"/expandcounter=\Processor(*)\% Idle Time:1\" \"/expandcounter=\Processor(*)\% C1 Time:1\" \"/expandcounter=\Processor(*)\% C2 Time:1\" \"/expandcounter=\Processor(*)\% C3 Time:1\" \"/expandcounter=\Processor(*)\% Processor Time:1\" \"/directory=c:\programdata\Sony Corporation\VAIO Care\inteldata\""
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\postgresql-8.4]
"ImagePath"="C:/Program Files (x86)/PostgreSQL/8.4/bin/pg_ctl.exe runservice -N \"postgresql-8.4\" -D \"C:/Program Files (x86)/PostgreSQL/8.4/data\" -w"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10e.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10e.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
   00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\RNG*]
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
   bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
   bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
   bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
   bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
   bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
   bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
   bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
   bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
   bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
   bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
   bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Bonjour\mDNSResponder.exe
c:\program files (x86)\F-Secure\Anti-Virus\fsgk32st.exe
c:\program files (x86)\F-Secure\Anti-Virus\FSGK32.EXE
c:\program files (x86)\F-Secure\Common\FSMA32.EXE
c:\program files (x86)\F-Secure\Common\FSHDLL32.EXE
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
c:\program files (x86)\PostgreSQL\8.4\bin\pg_ctl.exe
c:\program files (x86)\PostgreSQL\8.4\bin\postgres.exe
c:\program files (x86)\Sony\VAIO Event Service\VESMgr.exe
c:\program files (x86)\PostgreSQL\8.4\bin\postgres.exe
c:\program files (x86)\PostgreSQL\8.4\bin\postgres.exe
c:\program files (x86)\PostgreSQL\8.4\bin\postgres.exe
c:\program files (x86)\PostgreSQL\8.4\bin\postgres.exe
c:\program files (x86)\PostgreSQL\8.4\bin\postgres.exe
c:\windows\SysWOW64\DllHost.exe
c:\program files (x86)\Sony\VAIO Event Service\VESMgrSub.exe
c:\program files (x86)\F-Secure\Common\FNRB32.EXE
c:\program files (x86)\F-Secure\Common\FIH32.EXE
c:\program files (x86)\F-Secure\Anti-Virus\fssm32.exe
c:\program files (x86)\F-Secure\Anti-Virus\fsav32.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-06-15  15:41:41 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2012-06-15 13:41
.
Vor Suchlauf: 17 Verzeichnis(se), 31.363.178.496 Bytes frei
Nach Suchlauf: 21 Verzeichnis(se), 30.913.597.440 Bytes frei
.
- - End Of File - - D6FFA2E464F8C7F60CDE1884E9E3067F

cosinus · 15.06.2012, 15:29

Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte

aswMBR.exe und speichere die Datei auf deinem Desktop.

Starte die aswMBR.exe - (aswMBR.exe Anleitung)
Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
Klicke auf Scan.
Warte bitte bis Scan finished successfully im DOS-Fenster steht.
Drücke auf Save Log und speichere diese auf dem Desktop.

Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).

Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

mkid76 · 15.06.2012, 16:37

Hi Arne,

hier die gewünschten Logs:

Code:

ATTFilter

GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-06-15 17:21:13
Windows 6.1.7601 Service Pack 1 
Running: s9qu6kus.exe


---- Registry - GMER 1.0.15 ----

Reg  HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\506313dbb8cf                      
Reg  HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\c0cb38d528be                      
Reg  HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\506313dbb8cf (not active ControlSet)  
Reg  HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\c0cb38d528be (not active ControlSet)  

---- EOF - GMER 1.0.15 ----

Code:

ATTFilter

Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 17:32:56 on 15.06.2012

OS: Windows 7  Service Pack 1 (Build 7601), 64-bit
Default Browser: Mozilla Corporation Firefox 13.0

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Common]
-----( %SystemRoot%\Tasks )-----
"Adobe Flash Player Updater.job" - "Adobe Systems Incorporated" - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"nvcpl.cpl" - "NVIDIA Corporation" - C:\Windows\system32\nvcpl.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"mlcfg32.cpl" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~1\Office12\MLCFG32.CPL
"QuickTime" - "Apple Inc." - C:\Program Files (x86)\QuickTime\QTSystem\QuickTime.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"atksgt" (atksgt) - ? - C:\Windows\System32\DRIVERS\atksgt.sys  (File found, but it contains no detailed information)
"catchme" (catchme) - ? - C:\ComboFix\catchme.sys  (File not found)
"F-Secure Email Scanning Driver" (FSES) - "F-Secure Corporation" - C:\Windows\System32\drivers\fses.sys
"F-Secure Firewall Driver" (FSFW) - "F-Secure Corporation" - C:\Windows\System32\drivers\fsdfw.sys
"F-Secure Gatekeeper" (F-Secure Gatekeeper) - "F-Secure Corporation" - C:\Program Files (x86)\F-Secure\Anti-Virus\minifilter\fsgk.sys
"F-Secure HIPS Driver" (F-Secure HIPS) - "F-Secure Corporation" - C:\Program Files (x86)\F-Secure\HIPS\drivers\fshs.sys
"F-Secure Vista Support Driver" (fsvista) - "F-Secure Corporation" - C:\Program Files (x86)\F-Secure\Anti-Virus\minifilter\fsvista.sys
"fsbts" (fsbts) - "F-Secure Corporation" - C:\Windows\System32\Drivers\fsbts.sys
"lirsgt" (lirsgt) - ? - C:\Windows\System32\DRIVERS\lirsgt.sys  (File found, but it contains no detailed information)
"Mass Storage Filter Driver" (massfilter) - ? - C:\Windows\System32\drivers\massfilter.sys  (File not found)
"MBAMProtector" (MBAMProtector) - "Malwarebytes Corporation" - C:\Windows\system32\drivers\mbam.sys
"truecrypt" (truecrypt) - "TrueCrypt Foundation" - C:\Windows\System32\drivers\truecrypt.sys
"ZTE Diagnostic Port" (ZTEusbser6k) - ? - C:\Windows\System32\DRIVERS\ZTEusbser6k.sys  (File not found)
"ZTE NMEA Port" (ZTEusbnmea) - ? - C:\Windows\System32\DRIVERS\ZTEusbnmea.sys  (File not found)
"ZTE Proprietary USB Driver" (ZTEusbmdm6k) - ? - C:\Windows\System32\DRIVERS\ZTEusbmdm6k.sys  (File not found)

[Explorer]
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\Help\hxds.dll
{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
{88FED34C-F0CA-4636-A375-3CB6248B04CD} "Local Groove Web Services Protocol" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
{91774881-D725-4E58-B298-07617B9B86A8} "Skype IE add-on Pluggable Protocol" - "Skype Technologies S.A." - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----
{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{99FD978C-D287-4F50-827F-B2C658EDA8E7} "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} "Groove Explorer Icon Overlay 2 (GFS Stub)" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
{920E6DB1-9907-4370-B3A0-BAFC03D81399} "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
{16F3DD56-1AF5-4347-846D-7C10C4192619} "Groove Explorer Icon Overlay 3 (GFS Folder)" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
{2916C86E-86A6-43FE-8112-43ABE6BF8DCC} "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
{2A541AE1-5BF6-4665-A8A3-CFA9672E4291} "Groove Folder Synchronization" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
{6C467336-8281-4E60-8204-430CED96822D} "Groove GFS Context Menu Handler" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
{A449600E-1DC6-4232-B948-9BD794D62056} "Groove GFS Stub Icon Handler" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
{387E725D-DC16-4D76-B310-2C93ED4752A0} "Groove XML Icon Handler" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\msohevi.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~1\Office12\ONFILTER.DLL
{00020D75-0000-0000-C000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~1\Office12\MLSHEXT.DLL
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~1\Office12\OLKFSTUB.DLL
{8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} "Snagit" - "TechSmith Corporation" - C:\Program Files (x86)\TechSmith\Snagit 10\SnagitIEAddin.dll
{CF74B903-3389-469c-B3B6-0204D204FCBD} "SnagItShellExt Class" - "TechSmith Corporation" - C:\Program Files (x86)\TechSmith\Snagit 10\SnagitShellExt.dll

[Internet Explorer]
-----( HKCU\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars )-----
{555D4D79-4BD2-4094-A395-CFC534424A05} "HP Smart Web Printing" - "Hewlett-Packard Co." - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_bho.dll
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
ITBar7Height "ITBar7Height" - ? -   (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_23" - "Sun Microsystems, Inc." - C:\Program Files (x86)\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} "Java Plug-in 1.6.0_23" - "Sun Microsystems, Inc." - C:\Program Files (x86)\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_23" - "Sun Microsystems, Inc." - C:\Program Files (x86)\Java\jre6\bin\npjpi160_23.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{BC0E0A5D-AB5A-4fa4-A5FA-280E1D58EEEE} "Add to Evernote" - "Evernote Corporation" - C:\Program Files (x86)\Evernote\Evernote3.5\enbar.dll
{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
{DDE87865-83C5-48c4-8357-2F5B1AA84522} "HP Smart Web Printing ein- oder ausblenden" - "Hewlett-Packard Co." - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
"PokerStars" - "PokerStars" - C:\Program Files (x86)\PokerStars\PokerStarsUpdate.exe
"PokerStars.fr" - "PokerStars" - C:\Program Files (x86)\PokerStars.FR\PokerStarsUpdate.exe
"PokerStars.net" - "PokerStars" - C:\Program Files (x86)\PokerStars.NET\PokerStarsUpdate.exe
{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
{898EA8C8-E7FF-479B-8935-AEC46303B9E5} "Skype Click to Call" - "Skype Technologies S.A." - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
{265EEE8E-3228-44D3-AEA5-F7FDF5860049} "Browsing Protection Toolbar" - "F-Secure Corporation" - C:\Program Files (x86)\F-Secure\NRS\iescript\baselitmus.dll
{8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} "Snagit" - "TechSmith Corporation" - C:\Program Files (x86)\TechSmith\Snagit 10\SnagitIEAddin.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
{C6867EB7-8350-4856-877F-93CF8AE3DC9C} "Browsing Protection Class" - "F-Secure Corporation" - C:\Program Files (x86)\F-Secure\NRS\iescript\baselitmus.dll
{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
{0347C33E-8762-4905-BF09-768834316C61} "HP Print Enhancer" - "Hewlett-Packard Co." - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
{FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} "HP Smart BHO Class" - "Hewlett-Packard Co." - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} "Skype Browser Helper" - "Skype Technologies S.A." - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
{00C6482D-C502-44C8-8409-FCE54AD9C208} "SnagIt Toolbar Loader" - "TechSmith Corporation" - C:\Program Files (x86)\TechSmith\Snagit 10\SnagitBHO.dll

[LSA Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Lsa )-----
"Notification packages" - "UPEK Inc." - C:\Program Files\Protector Suite\psqlpwd.dll

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
"HP Digital Imaging Monitor.lnk" - "Hewlett-Packard Co." - C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe  (Shortcut exists | File exists)
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"TrueCrypt" - "TrueCrypt Foundation" - "C:\Program Files\TrueCrypt\TrueCrypt.exe" /q preferences /a logon
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"Adobe ARM" - "Adobe Systems Incorporated" - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"AppleSyncNotifier" - "Apple Inc." - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
"F-Secure Manager" - "F-Secure Corporation" - "C:\Program Files (x86)\F-Secure\Common\FSM32.EXE" /splash
"F-Secure TNB" - "F-Secure Corporation" - "C:\Program Files (x86)\F-Secure\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
"GrooveMonitor" - "Microsoft Corporation" - "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
"HP Software Update" - "Hewlett-Packard" - C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
"iTunesHelper" - "Apple Inc." - "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
"Malwarebytes' Anti-Malware" - "Malwarebytes Corporation" - "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"@%ProgramFiles%\Windows Defender\MsMpRes.dll,-103" (WinDefend) - ? - C:\Program Files (x86)\Windows Defender\mpsvc.dll  (File not found)
"@%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101" (WMPNetworkSvc) - ? - "C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe"  (File not found)
"Adobe Acrobat Update Service" (AdobeARMservice) - "Adobe Systems Incorporated" - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
"Adobe Flash Player Update Service" (AdobeFlashPlayerUpdateSvc) - "Adobe Systems Incorporated" - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
"ArcSoft Connect Daemon" (ACDaemon) - "ArcSoft Inc." - C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
"ASP.NET-Zustandsdienst" (aspnet_state) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
"Bluetooth Service" (btwdins) - "Broadcom Corporation." - C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
"Dienst "Bonjour"" (Bonjour Service) - "Apple Inc." - C:\Program Files (x86)\Bonjour\mDNSResponder.exe
"F-Secure Anti-Virus Firewall Daemon" (FSDFWD) - "F-Secure Corporation" - C:\Program Files (x86)\F-Secure\FWES\Program\fsdfwd.exe
"F-Secure Management Agent" (FSMA) - "F-Secure Corporation" - C:\Program Files (x86)\F-Secure\Common\FSMA32.EXE
"F-Secure Netzwerk-Anfragebroker" (F-Secure Network Request Broker) - "F-Secure Corporation" - C:\Program Files (x86)\F-Secure\Common\FNRB32.EXE
"F-Secure ORSP Client" (FSORSPClient) - "F-Secure Corporation" - C:\Program Files (x86)\F-Secure\ORSP Client\fsorsp.exe
"FSGKHS" (F-Secure Gatekeeper Handler Starter) - "F-Secure Corporation" - C:\Program Files (x86)\F-Secure\Anti-Virus\fsgk32st.exe
"HP CUE DeviceDiscovery Service" (hpqddsvc) - "Hewlett-Packard Co." - C:\Program Files (x86)\HP\Digital Imaging\bin\hpqddsvc.dll
"HP Network Devices Support" (HPSLPSVC) - "Hewlett-Packard Co." - C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL
"hpqcxs08" (hpqcxs08) - "Hewlett-Packard Co." - C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll
"Intel(R) Management & Security Application User Notification Service" (UNS) - "Intel Corporation" - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
"Intel(R) Management and Security Application Local Management Service" (LMS) - "Intel Corporation" - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
"Intel(R) PROSet/Wireless Event Log" (EvtEng) - "Intel(R) Corporation" - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
"Intel(R) PROSet/Wireless Registry Service" (RegSrvc) - "Intel(R) Corporation" - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
"Intel(R) Rapid Storage Technology" (IAStorDataMgrSvc) - "Intel Corporation" - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Program Files\iPod\bin\iPodService.exe
"MBAMService" (MBAMService) - "Malwarebytes Corporation" - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
"Microsoft .NET Framework NGEN v4.0.30319_X64" (clr_optimization_v4.0.30319_64) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
"Microsoft Office Groove Audit Service" (Microsoft Office Groove Audit Service) - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe
"Mozilla Maintenance Service" (MozillaMaintenance) - "Mozilla Foundation" - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"Net Driver HPZ12" (Net Driver HPZ12) - "Hewlett-Packard" - C:\Windows\system32\HPZinw12.dll
"NVIDIA Display Driver Service" (nvsvc) - "NVIDIA Corporation" - C:\Windows\system32\nvvsvc.exe
"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"Pml Driver HPZ12" (Pml Driver HPZ12) - "Hewlett-Packard" - C:\Windows\system32\HPZipm12.dll
"PostgreSQL Server 8.4" (postgresql-8.4) - "PostgreSQL Global Development Group" - C:\Program Files (x86)\PostgreSQL\8.4\bin\pg_ctl.exe
"Qualcomm Gobi 2000 Download Service (Sony)" (QDLService2kSony) - "QUALCOMM, Inc." - C:\Program Files (x86)\QUALCOMM\QDLService2k\QDLService2kSony.exe
"Skype Updater" (SkypeUpdate) - "Skype Technologies" - C:\Program Files (x86)\Skype\Updater\Updater.exe
"Steam Client Service" (Steam Client Service) - "Valve Corporation" - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
"TeamViewer 6" (TeamViewer6) - "TeamViewer GmbH" - C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe
"VAIO Care Performance Service" (SampleCollector) - "Sony Corporation" - C:\Program Files\Sony\VAIO Care\VCPerfService.exe
"VAIO Event Service" (VAIO Event Service) - "Sony Corporation" - C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe
"VAIO Power Management" (VAIO Power Management) - "Sony Corporation" - C:\Program Files\Sony\VAIO Power Management\SPMService.exe
"VCService" (VCService) - "Sony Corporation" - C:\Program Files\Sony\VAIO Care\VCService.exe
"VSNService" (VSNService) - "Sony Corporation" - C:\Program Files\Sony\VAIO Smart Network\VSNService.exe
"VUAgent" (VUAgent) - "Sony Corporation" - C:\Program Files\Sony\VAIO Update Common\VUAgent.exe

[Winsock Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----
"mdnsNSP" - "Apple Inc." - C:\Program Files (x86)\Bonjour\mdnsNSP.dll

===[ Logfile end ]=========================================[ Logfile end ]===

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

cosinus · 15.06.2012, 17:32

aswMBR kommt noch?

mkid76 · 15.06.2012, 19:28

Hi Arne,

und hier der letzte Log. Hat leider etwas länger gedauert, da die Verbindung (4KB/s) momentam extrem suckt. Ich hoffe es hat alles geklappt...

danke und lg
mario

Code:

ATTFilter

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-06-15 20:12:11
-----------------------------
20:12:11.855    OS Version: Windows x64 6.1.7601 Service Pack 1
20:12:11.855    Number of processors: 4 586 0x2505
20:12:11.855    ComputerName: M-***  UserName: ***
20:12:12.058    Initialize success
20:20:25.189    AVAST engine defs: 12061500
20:22:14.003    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
20:22:14.003    Disk 0 Vendor: Intel___ 1.0. Size: 122110MB BusType: 8
20:22:14.003    Disk 0 MBR read successfully
20:22:14.019    Disk 0 MBR scan
20:22:14.050    Disk 0 unknown MBR code
20:22:14.050    Disk 0 Partition 1 00     27 Hidden NTFS WinRE OA$µÙq~v     8169 MB offset 2048
20:22:14.066    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS               100 MB offset 16732160
20:22:14.081    Disk 0 Partition 3 00     07    HPFS/NTFS            113839 MB offset 16936960
20:22:14.081    Disk 0 scanning C:\Windows\system32\drivers
20:22:14.097    Service scanning
20:22:30.914    Modules scanning
20:22:30.914    Disk 0 trace - called modules:
20:22:30.914    ntoskrnl.exe CLASSPNP.SYS disk.sys iaStor.sys 
20:22:31.428    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa80067fb060]
20:22:31.428    3 CLASSPNP.SYS[fffff8800180143f] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa80047f1050]
20:22:31.616    AVAST engine scan C:\Windows
20:22:31.631    AVAST engine scan C:\Windows\system32
20:22:31.631    AVAST engine scan C:\Windows\system32\drivers
20:22:31.631    AVAST engine scan C:\Users\***
20:22:31.647    AVAST engine scan C:\ProgramData
20:22:31.647    Scan finished successfully
20:22:52.613    Disk 0 MBR has been saved successfully to "C:\Users\***\Desktop\MBR.dat"
20:22:52.613    The log file has been saved successfully to "C:\Users\***\Desktop\aswMBR.txt"

cosinus · 15.06.2012, 20:33

Wir sollten den MBR fixen, sichere für den Fall der Fälle ALLE wichtigen Daten, auch wenn meistens alles glatt geht.

Hinweis: Mach bitte NICHT den MBR-Fix, wenn du noch andere Betriebssysteme wie zB Ubuntu installiert hast, ein MBR-Fix mit Windows-Tools macht ein parallel installiertes (Dualboot) Linux unbootbar.
Mach den Fix auch dann nicht, wenn du zB mit TrueCrypt oder anderen Verschlüsselungsprogrammen eine Vollverschlüsselung der Windowspartition bzw. gesamten Festplatte hast

Starte nach der Datensicherung aswmbr erneut und klick auf den Button FIXMBR.

Hinweis: Bitte den Virenscanner abstellen bevor du aswMBR ausführst, denn v.a. Avira meldet darin oft einen Fehalalrm!

Anschließend Windows neu starten und ein neues Log mit aswMBR machen.

mkid76 · 15.06.2012, 20:49

Hi Arne,

ich hab TrueCrypt laufen! Also werde ich diesen Schritt unterlassen?!

Lg,
Mario

cosinus · 15.06.2012, 21:19

Ja wäre besser. Wenn du deine ganze Platte verschlüsselt hast bzw. die Systempartition.
Oder was anderes?

mkid76 · 15.06.2012, 21:22

also ich hab die ganze Platte verschlüsselt, bzw. der Systemadmin von meiner alten Firma. Ich durfte den Laptop behalten und hab Truecrypt immer noch drauf.

lg mario

cosinus · 15.06.2012, 21:26

Kurz gesagt, du bist garnicht Herr über dein System

Naja musst du wissen

Musst auch bedenken, dass so ein Rechner aus der Firma evtl. noch für den privaten Bereich sehr störende Einstellungen hat, die er noch aus der Firmendomäne bekommen hat. Das macht man nicht mal eben so rückgängig.

mkid76 · 15.06.2012, 22:46

Hi Arne,

musste damals Truecrypt installieren, weil es die Firma so wollte und hab es nach meinem Abgang so belassen. Ansonsten bin ich schon Herr über mein System. Mehr oder weniger...naja jetzt ja eben nicht mehr. Geht es jetzt noch weiter oder meinst du ich soll das System neu aufsetzen, wenn ich wieder in Deutschland bin?

Vielen Dank für deine Hilfe bisher!

Lg,
Mario

cosinus · 15.06.2012, 22:55

Na ich mein ja nur. Falls das Gerät mal in der Domäne der Firma war. Einfach nur aus der Domäne rausnehmen hilft da nicht, wenn per Gruppenrichtlinien bestimmte Dinge gesetzt wurden müssen diese auch wieder explizit rausgenommen werden. Das passiert natürlich nicht wenn man den Rechner von A nach B trägt und ihn einfach als privat definiert.

Aber lassen wir das.

Wir sollten fast durch sein. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SUPERAntiSpyware und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

15.06.2012, 17:32	#22
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Moskau - Plötzlich langsame Internetverbindung trotz gutem Netzwerk aswMBR kommt noch? __________________ Logfiles bitte immer in CODE-Tags posten

15.06.2012, 21:19	#26
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Moskau - Plötzlich langsame Internetverbindung trotz gutem Netzwerk Ja wäre besser. Wenn du deine ganze Platte verschlüsselt hast bzw. die Systempartition. Oder was anderes? __________________ Logfiles bitte immer in CODE-Tags posten

Moskau - Plötzlich langsame Internetverbindung trotz gutem Netzwerk

Log-Analyse und Auswertung: Moskau - Plötzlich langsame Internetverbindung trotz gutem Netzwerk