Hallo zusammen,
seit ein paar Tagen ist mein PC kompromittiert.Kaspersky startet nicht mehr,
Windows-Firewall auch nicht.AVG Anti-Rootkit wird sofort gestoppt.

Ich dachte mir neu aufsetzen wird das einfachste sein.Also mbr.exe installiert.
Die wird aber auch nach ner halben Sekunde gestoppt mit folgender textdatei:
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.6 by Gmer, hp://www.gmer.net

device: opened successfully
user: error reading MBR
kernel: error reading MBR

Denke mal da muss wohl ein Fachmann ran.
Danke im Vorraus.


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:15:42, on 28.08.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\PROGRA~1\SSS\SIMPLESCREENSHOT.EXE
C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\wscntfy.exe
C:\DOKUME~1\poker\LOKALE~1\Temp\Process_Killer.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Programme\Java\jre6\bin\java.exe
C:\WINDOWS\system32\notepad.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Programme\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hp://g.msn.de/0SEDEDE/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hp://g.msn.de/0SEDEDE/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hp://www.spiegel.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hp://go.microsoft.com/fwlink/?LinkId=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hp://go.microsoft.com/fwlink/?LinkId=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hp://go.microsoft.com/fwlink/?LinkId=
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hp://go.microsoft.com/fwlink/?LinkId=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = hp://g.msn.de/0SEDEDE/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = hp://go.microsoft.com/fwlink/?LinkId=
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Download Manager Browser Helper Object - {19C8E43B-07B3-49CB-BFFC-6777B593E6F8} - C:\PROGRA~1\GEMEIN~1\fluxDVD\DOWNLO~1\XEBDLH~1.DLL
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O2 - BHO: (no name) - {7762a897-2a75-4e3f-a3a7-55bd098b9879} - (no file)
O2 - BHO: Google Update Helper - {77D7E795-33C5-4323-974D-A2A49AB75517} - C:\Programme\Google\Update\1.2.131.11\GoopdateBho.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Programme\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programme\Windows Live Toolbar\msntb.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Programme\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programme\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SimpleScreenshot] C:\PROGRA~1\SSS\SIMPLESCREENSHOT.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVP] "C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Programme\MSN Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\GEMEIN~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\GEMEIN~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O8 - Extra context menu item: &Windows Live Search - res://C:\Programme\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O9 - Extra button: UltimateBet - {10F055B8-F443-4adf-948A-EC551E9DBCE4} - C:\Dokumente und Einstellungen\poker\Startmenü\Programme\UltimateBet\UltimateBet.lnk
O9 - Extra 'Tools' menuitem: UltimateBet - {10F055B8-F443-4adf-948A-EC551E9DBCE4} - C:\Dokumente und Einstellungen\poker\Startmenü\Programme\UltimateBet\UltimateBet.lnk
O9 - Extra button: Statistik für den Schutz des Web-Datenverkehrs - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Programme\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe
O9 - Extra 'Tools' menuitem: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe
O9 - Extra button: PartyGammon.com - {59A861EE-32B3-42cd-8CCA-FC130EDF3A44} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: PartyGammon.com - {59A861EE-32B3-42cd-8CCA-FC130EDF3A44} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: PartyCasino - {B4B52284-A248-4c51-9F7C-F0A0C67FCC9D} - C:\Programme\PartyGaming\PartyCasino\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyCasino - {B4B52284-A248-4c51-9F7C-F0A0C67FCC9D} - C:\Programme\PartyGaming\PartyCasino\RunApp.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programme\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programme\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Programme\Bodog Poker\BPGame.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra button: CarbonPoker - {e4e8c758-34b4-44bb-8ef9-1f0786e81d2d} - C:\Dokumente und Einstellungen\poker\Startmenü\Programme\CarbonPoker\CarbonPoker.lnk (HKCU)
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/german/partner/de/kavwebscan_unicode.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - hp://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - hp://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6662.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - hp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1230134455101
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - hp://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - hp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1230134434711
O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} (Java Plug-in 1.5.0_11) -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - hs://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) - hp://drmlicense.one.microsoft.com/crlupdate/en/crlocx.ocx
O18 - Protocol: fluxhttp - {8E2D00A0-82C6-4821-90BC-07F290841BB6} - C:\Programme\Gemeinsame Dateien\fluxDVD\Lib\XEB\xebnavigation.ax
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Programme\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
O23 - Service: Kaspersky Internet Security (avp) - Kaspersky Lab - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PostgreSQL Database Server 8.2 (pgsql-8.2) - PostgreSQL Global Development Group - C:\Programme\PostgreSQL\8.2\bin\pg_ctl.exe

--
End of file - 10197 bytes

Teil2:

Logfile of random's system information tool 1.06 (written by random/random)
Run by poker at 2009-08-28 02:03:17
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 22 GB (29%) free of 76 GB
Total RAM: 2047 MB (52% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 02:03:19, on 28.08.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\PROGRA~1\SSS\SIMPLESCREENSHOT.EXE
C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\wscntfy.exe
C:\DOKUME~1\poker\LOKALE~1\Temp\Process_Killer.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Programme\Java\jre6\bin\java.exe
C:\WINDOWS\system32\notepad.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Programme\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Programme\Internet Explorer\iexplore.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Dokumente und Einstellungen\poker\Desktop\RSIT.exe
C:\Programme\Trend Micro\HijackThis\poker.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hp://g.msn.de/0SEDEDE/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hp://g.msn.de/0SEDEDE/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = ht://www.spiegel.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = p://go.microsoft.com/fwlink/?LinkId=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hp://go.microsoft.com/fwlink/?LinkId=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hp://go.microsoft.com/fwlink/?LinkId=
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hp://go.microsoft.com/fwlink/?LinkId
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = hp://g.msn.de/0SEDEDE/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = hp://go.microsoft.com/fwlink/?LinkId=
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Download Manager Browser Helper Object - {19C8E43B-07B3-49CB-BFFC-6777B593E6F8} - C:\PROGRA~1\GEMEIN~1\fluxDVD\DOWNLO~1\XEBDLH~1.DLL
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O2 - BHO: (no name) - {7762a897-2a75-4e3f-a3a7-55bd098b9879} - (no file)
O2 - BHO: Google Update Helper - {77D7E795-33C5-4323-974D-A2A49AB75517} - C:\Programme\Google\Update\1.2.131.11\GoopdateBho.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Programme\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programme\Windows Live Toolbar\msntb.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Programme\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programme\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SimpleScreenshot] C:\PROGRA~1\SSS\SIMPLESCREENSHOT.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVP] "C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Programme\MSN Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\GEMEIN~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\GEMEIN~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O8 - Extra context menu item: &Windows Live Search - res://C:\Programme\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - [uravorites.live.com/quickadd.aspx[/url]
O9 - Extra button: UltimateBet - {10F055B8-F443-4adf-948A-EC551E9DBCE4} - C:\Dokumente und Einstellungen\poker\Startmenü\Programme\UltimateBet\UltimateBet.lnk
O9 - Extra 'Tools' menuitem: UltimateBet - {10F055B8-F443-4adf-948A-EC551E9DBCE4} - C:\Dokumente und Einstellungen\poker\Startmenü\Programme\UltimateBet\UltimateBet.lnk
O9 - Extra button: Statistik für den Schutz des Web-Datenverkehrs - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Programme\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe
O9 - Extra 'Tools' menuitem: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe
O9 - Extra button: PartyGammon.com - {59A861EE-32B3-42cd-8CCA-FC130EDF3A44} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: PartyGammon.com - {59A861EE-32B3-42cd-8CCA-FC130EDF3A44} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: PartyCasino - {B4B52284-A248-4c51-9F7C-F0A0C67FCC9D} - C:\Programme\PartyGaming\PartyCasino\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyCasino - {B4B52284-A248-4c51-9F7C-F0A0C67FCC9D} - C:\Programme\PartyGaming\PartyCasino\RunApp.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programme\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programme\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Programme\Bodog Poker\BPGame.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra button: CarbonPoker - {e4e8c758-34b4-44bb-8ef9-1f0786e81d2d} - C:\Dokumente und Einstellungen\poker\Startmenü\Programme\CarbonPoker\CarbonPoker.lnk (HKCU)
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - hp://www.kaspersky.com/kos/german/partner/de/kavwebscan_unicode.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) loads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) -.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6662.cab[/url]
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - hp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1230134455101
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - hp://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - hp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1230134434711
O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} (Java Plug-in 1.5.0_11) -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -s://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) - hp://drmlicense.one.microsoft.com/crlupdate/en/crlocx.ocx
O18 - Protocol: fluxhttp - {8E2D00A0-82C6-4821-90BC-07F290841BB6} - C:\Programme\Gemeinsame Dateien\fluxDVD\Lib\XEB\xebnavigation.ax
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Programme\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
O23 - Service: Kaspersky Internet Security (avp) - Kaspersky Lab - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PostgreSQL Database Server 8.2 (pgsql-8.2) - PostgreSQL Global Development Group - C:\Programme\PostgreSQL\8.2\bin\pg_ctl.exe

--
End of file - 10422 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{19C8E43B-07B3-49CB-BFFC-6777B593E6F8}]
Download Manager Browser Helper Object - C:\PROGRA~1\GEMEIN~1\fluxDVD\DOWNLO~1\XEBDLH~1.DLL [2007-05-21 525792]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}]
IEVkbdBHO Class - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll [2008-11-11 62728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7762a897-2a75-4e3f-a3a7-55bd098b9879}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{77D7E795-33C5-4323-974D-A2A49AB75517}]
Google Update Helper - C:\Programme\Google\Update\1.2.131.11\GoopdateBho.dll [2008-08-29 133616]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live Sign-in Helper - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2006-08-31 322368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Programme\Google\Google Toolbar\GoogleToolbar.dll [2009-06-19 259696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Programme\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll [2009-06-28 669168]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}]
Windows Live Toolbar Helper - C:\Programme\Windows Live Toolbar\msntb.dll [2007-10-19 546320]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C84D72FE-E17D-4195-BB24-76C02E2E7C4E}]
Google Dictionary Compression sdch - C:\Programme\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll [2009-04-16 470512]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Programme\Java\jre6\bin\jp2ssv.dll [2009-03-09 35840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-03-09 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - Windows Live Toolbar - C:\Programme\Windows Live Toolbar\msntb.dll [2007-10-19 546320]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Programme\Google\Google Toolbar\GoogleToolbar.dll [2009-06-19 259696]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2006-06-01 16208384]
"SimpleScreenshot"=C:\PROGRA~1\SSS\SIMPLESCREENSHOT.EXE [2005-04-14 962048]
"Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2005-05-03 69632]
"SkyTel"=C:\WINDOWS\SkyTel.EXE [2006-05-16 2879488]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2008-12-26 13680640]
"nwiz"=nwiz.exe /install []
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2008-12-26 86016]
"AVP"=C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe [2009-07-21 208616]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"=C:\Programme\MSN Messenger\msnmsgr.exe [2007-01-19 5674352]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 35696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
C:\WINDOWS\system32\CTFMON.EXE [2008-08-08 24064]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
C:\Dokumente und Einstellungen\poker\Lokale Einstellungen\Anwendungsdaten\Google\Update\GoogleUpdate.exe [2008-08-29 133104]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
C:\WINDOWS\system32\dumprep 0 -k []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechCommunicationsManager]
C:\Programme\Gemeinsame Dateien\LogiShrd\LComMgr\Communications_Helper.exe [2007-07-25 563984]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon]
C:\Programme\Logitech\QuickCam\Quickcam.exe [2007-07-25 2027792]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Programme\Messenger\msmsgs.exe [2008-04-14 1695232]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
C:\Programme\MSN Messenger\msnmsgr.exe [2007-01-19 5674352]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Programme\QuickTime\qttask.exe [2007-07-05 282624]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SnoopFreeUI]
SnoopFreeUI.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Programme\Java\jre6\bin\jusched.exe [2009-03-09 148888]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2009-03-27 39408]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe [2007-05-30 185896]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Ralink Wireless Utility.lnk]
C:\PROGRA~1\RALINK\Common\RaUI.exe [2005-11-09 589824]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Bonjour Service"=2
"WinDefend"=2
"gusvc"=3
"gupdate1c8f92d78ec4eba"=2
"SandraTheSrv"=3
"SandraDataSrv"=3
"OOD2000"=2
"LVSrvLauncher"=2
"LVCOMSer"=2
"ContentMgrService"=2
"WMPNetworkSvc"=3
"usnjsvc"=3
"SQLWriter"=2
"MSSQL$SQLEXPRESS"=2
"SnoopFreeSvc"=2
"idsvc"=3
"LVPrcSrv"=2
"JavaQuickStarterService"=2
"helpsvc"=2
"avp"=2

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
C:\WINDOWS\system32\klogon.dll [2008-11-11 218376]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2007-03-15 236928]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Programme\SiSoftware\SiSoftware Sandra Lite XI.SP1a\RpcSandraSrv.exe"="C:\Programme\SiSoftware\SiSoftware Sandra Lite XI.SP1a\RpcSandraSrv.exe:*:Enabled:SiSoftware Sandra Agent Service"
"C:\Programme\SiSoftware\SiSoftware Sandra Lite XI.SP1a\Win32\RpcDataSrv.exe"="C:\Programme\SiSoftware\SiSoftware Sandra Lite XI.SP1a\Win32\RpcDataSrv.exe:*:Enabled:SiSoftware Database Agent Service"
"C:\Programme\Java\jre1.5.0_11\bin\javaw.exe"="C:\Programme\Java\jre1.5.0_11\bin\javaw.exe:*:Enabled:Java(TM) 2 Platform Standard Edition binary"
"C:\Programme\MySQL\MySQL Server 4.1\bin\mysqld.exe"="C:\Programme\MySQL\MySQL Server 4.1\bin\mysqld.exe:*:Enabled:mysqld"
"C:\Programme\PokerOffice\bin\javaw.exe"="C:\Programme\PokerOffice\bin\javaw.exe:*:Enabled:Java(TM) 2 Platform Standard Edition binary"
"C:\Programme\ChessBase\PlayChess\PlayChess.exe"="C:\Programme\ChessBase\PlayChess\PlayChess.exe:*:Enabled:PlayChess"
"C:\Programme\Last.fm\LastFM.exe"="C:\Programme\Last.fm\LastFM.exe:*:Enabled:LastFM"
"C:\Programme\Bonjour\mDNSResponder.exe"="C:\Programme\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Programme\FlashGet\flashget.exe"="C:\Programme\FlashGet\flashget.exe:*:Enabled:Flashget"
"C:\Programme\PPLive\PPLive.exe"="C:\Programme\PPLive\PPLive.exe:*:Enabled:PPLive"
"C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Kaspersky Lab Setup Files\Kaspersky Internet Security 7.0.1.325\German\setup.exe"="C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Kaspersky Lab Setup Files\Kaspersky Internet Security 7.0.1.325\German\setup.exe:*:Enabled:Installationsprogramm für Kaspersky Internet Security 7.0"
"C:\Programme\MSN Messenger\msnmsgr.exe"="C:\Programme\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Programme\MSN Messenger\livecall.exe"="C:\Programme\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\Programme\Skype\Phone\Skype.exe"="C:\Programme\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Programme\MSN Messenger\msnmsgr.exe"="C:\Programme\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Programme\MSN Messenger\livecall.exe"="C:\Programme\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

Teil3:

======List of files/folders created in the last 1 months======

2009-08-21 21:53:16 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TVU Networks
2009-08-20 19:26:01 ----D---- C:\Programme\RootKit Hook Analyzer
2009-08-20 17:41:10 ----D---- C:\Programme\GRISOFT
2009-08-20 17:08:02 ----D---- C:\WINDOWS\system32\Kaspersky Lab
2009-08-20 17:01:22 ----D---- C:\Programme\trend micro
2009-08-20 17:01:20 ----D---- C:\rsit
2009-08-20 15:54:18 ----D---- C:\Dokumente und Einstellungen\poker\Anwendungsdaten\Malwarebytes
2009-08-20 15:54:07 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
2009-08-20 15:54:06 ----D---- C:\Programme\Malwarebytes' Anti-Malware
2009-07-29 22:06:08 ----HDC---- C:\WINDOWS\$NtUninstallKB973346$
2009-07-29 22:02:36 ----HDC---- C:\WINDOWS\$NtUninstallKB961371$
2009-07-29 22:00:53 ----HDC---- C:\WINDOWS\$NtUninstallKB971633$
2009-07-29 21:57:20 ----HDC---- C:\WINDOWS\$NtUninstallKB970238$
2009-07-29 21:55:56 ----HDC---- C:\WINDOWS\$NtUninstallKB968537$
2009-07-29 21:54:32 ----HDC---- C:\WINDOWS\$NtUninstallKB961501$

======List of files/folders modified in the last 1 months======

2009-08-28 02:03:19 ----D---- C:\WINDOWS\Temp
2009-08-28 02:02:33 ----D---- C:\WINDOWS\Prefetch
2009-08-27 23:52:59 ----A---- C:\index.ini
2009-08-27 23:06:33 ----D---- C:\WINDOWS\system32\CatRoot2
2009-08-27 22:55:54 ----D---- C:\Programme\Mozilla Firefox
2009-08-27 22:53:33 ----D---- C:\Programme\Full Tilt Poker
2009-08-27 12:40:49 ----SHD---- C:\WINDOWS\Installer
2009-08-27 12:39:19 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Kaspersky Lab
2009-08-26 10:31:37 ----RSH---- C:\boot.ini
2009-08-26 10:31:36 ----A---- C:\WINDOWS\win.ini
2009-08-26 10:31:36 ----A---- C:\WINDOWS\system.ini
2009-08-26 01:37:54 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-08-21 21:53:16 ----D---- C:\Programme\TVUPlayer
2009-08-20 19:26:04 ----D---- C:\WINDOWS\system32\drivers
2009-08-20 19:26:01 ----RD---- C:\Programme
2009-08-20 17:37:37 ----D---- C:\WINDOWS
2009-08-20 17:08:12 ----SD---- C:\WINDOWS\Downloaded Program Files
2009-08-20 17:08:02 ----D---- C:\WINDOWS\system32
2009-08-20 17:07:59 ----HD---- C:\WINDOWS\inf
2009-08-20 15:47:09 ----D---- C:\WINDOWS\Debug
2009-08-16 15:19:08 ----D---- C:\Programme\PartyGaming
2009-08-14 01:56:29 ----D---- C:\Programme\PokerStars
2009-08-11 01:18:06 ----D---- C:\FreePHG_HandHistories
2009-08-10 10:49:17 ----D---- C:\Programme\Everest Poker
2009-07-30 23:38:08 ----D---- C:\WINDOWS\system32\CatRoot
2009-07-30 03:59:23 ----D---- C:\WINDOWS\Registration
2009-07-30 03:26:55 ----D---- C:\Programme\Internet Explorer
2009-07-29 22:09:37 ----D---- C:\WINDOWS\WinSxS
2009-07-29 22:08:08 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-07-29 22:07:36 ----D---- C:\WINDOWS\ie8updates
2009-07-29 22:07:27 ----HD---- C:\WINDOWS\$hf_mig$
2009-07-29 22:07:03 ----D---- C:\WINDOWS\Microsoft.NET

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AmdK8;AMD-Prozessortreiber; C:\WINDOWS\system32\DRIVERS\AmdK8.sys [2005-03-09 43008]
R1 AvgArCln;Avg Anti-Rootkit Clean Driver; C:\WINDOWS\System32\DRIVERS\AvgArCln.sys [2007-01-18 3968]
R1 kbdhid;Tastatur-HID-Treiber; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14720]
R1 klif;Kaspersky Lab Driver; C:\WINDOWS\system32\DRIVERS\klif.sys [2009-02-05 226832]
R1 WS2IFSL;Windows Socket 2.0 Non-IFS-Dienstanbieter-Unterstützungsumgebung; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2004-08-04 12032]
R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.4.3.0; C:\WINDOWS\system32\DRIVERS\AegisP.sys [2007-03-08 20747]
R2 EIO;EIO; \??\C:\WINDOWS\system32\drivers\EIO.sys []
R3 HDAudBus;Microsoft UAA-Bustreiber für High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 HidUsb;Microsoft HID Class-Treiber; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2006-06-06 4284928]
R3 KLFLTDEV;Kaspersky Lab KLFltDev; C:\WINDOWS\system32\DRIVERS\klfltdev.sys [2008-03-13 26640]
R3 mouhid;Maus-HID-Treiber; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-18 12288]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2008-12-26 6301344]
R3 RSPSC;RSPSC; C:\WINDOWS\system32\drivers\rspsc.sys [2007-01-21 9472]
R3 RTL8023xp;Realtek 10/100/1000 NIC Family all in one NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2005-11-16 78976]
R3 usbccgp;Microsoft Standard-USB-Haupttreiber; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
R3 usbehci;Miniporttreiber für erweiterten Microsoft USB 2.0-Hostcontroller; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-14 30208]
R3 usbhub;USB2-aktivierter Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-14 59520]
R3 usbuhci;Miniporttreiber für universellen Microsoft USB-Hostcontroller; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-14 20608]
S3 CCDECODE;Untertiteldecoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-14 17024]
S3 klim5;Kaspersky Anti-Virus NDIS Filter; C:\WINDOWS\system32\DRIVERS\klim5.sys []
S3 LVcKap;Logitech AEC Driver; C:\WINDOWS\system32\DRIVERS\LVcKap.sys [2007-07-20 2109592]
S3 LVMVDrv;Logitech Machine Vision Engine Loader; C:\WINDOWS\system32\DRIVERS\LVMVDrv.sys [2007-07-20 2142488]
S3 LVPr2Mon;Logitech LVPr2Mon Driver; C:\WINDOWS\system32\DRIVERS\LVPr2Mon.sys [2007-07-18 25624]
S3 LVUSBSta;Logitech USB Monitor Filter; C:\WINDOWS\system32\drivers\LVUSBSta.sys [2007-03-06 41376]
S3 mbr;mbr; C:\WINDOWS\system32\drivers\mbr.sys []
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink-Konvertierung; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-14 5504]
S3 NABTSFEC;NABTS/FEC VBI-Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-14 85248]
S3 NdisIP;Microsoft TV-/Videoverbindung; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-14 10880]
S3 PID_0928;Logitech QuickCam Express(PID_0928); C:\WINDOWS\system32\DRIVERS\LV561AV.SYS [2007-03-06 491168]
S3 RT61;Ralink RT61 Wireless Driver; C:\WINDOWS\system32\DRIVERS\RT61.sys [2005-10-27 356096]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-14 11136]
S3 streamip;BDA-IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-14 15232]
S3 USBSTOR;USB-Massenspeichertreiber; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 Video3D;ASUS Video3D Service; C:\WINDOWS\System32\Drivers\Video3D32.sys []
S3 WSTCODEC;World Standard Teletext-Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-14 19200]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 avp;Kaspersky Internet Security; C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe [2009-07-21 208616]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2008-12-26 163908]
R2 pgsql-8.2;PostgreSQL Database Server 8.2; C:\Programme\PostgreSQL\8.2\bin\pg_ctl.exe [2007-04-20 79324]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 IDriverT;InstallDriver Table Manager; C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 Bonjour Service;Bonjour Service; C:\Programme\Bonjour\mDNSResponder.exe [2006-02-28 229376]
S4 ContentMgrService;Content Management Service; C:\Programme\Videoload Manager\ContentManager.exe [2008-03-12 508928]
S4 gupdate1c8f92d78ec4eba;Google Update Service (gupdate1c8f92d78ec4eba); C:\Programme\Google\Update\GoogleUpdate.exe [2008-08-29 133104]
S4 gusvc;Google Software Updater; C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-04-16 182768]
S4 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S4 JavaQuickStarterService;Java Quick Starter; C:\Programme\Java\jre6\bin\jqs.exe [2009-03-09 152984]
S4 LVCOMSer;LVCOMSer; C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe [2007-07-20 186904]
S4 LVPrcSrv;Process Monitor; C:\Programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe [2007-07-20 137752]
S4 LVSrvLauncher;LVSrvLauncher; C:\Programme\Gemeinsame Dateien\LogiShrd\SrvLnch\SrvLnch.exe [2007-07-20 141848]
S4 MSSQL$SQLEXPRESS;SQL Server (SQLEXPRESS); c:\Programme\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2008-02-26 29183504]
S4 MSSQLServerADHelper;SQL Server Active Directory Helper; c:\Programme\Microsoft SQL Server\90\Shared\sqladhlp90.exe [2005-10-14 45272]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]
S4 OOD2000;O&O Defrag 2000; C:\WINDOWS\system32\OOD2000.exe [2001-04-06 238080]
S4 SandraDataSrv;SiSoftware Database Agent Service; C:\Programme\SiSoftware\SiSoftware Sandra Lite XI.SP1a\Win32\RpcDataSrv.exe [2007-02-27 123064]
S4 SandraTheSrv;SiSoftware Sandra Agent Service; C:\Programme\SiSoftware\SiSoftware Sandra Lite XI.SP1a\RpcSandraSrv.exe [2007-02-27 1204416]
S4 SQLBrowser;SQL Server Browser; c:\Programme\Microsoft SQL Server\90\Shared\sqlbrowser.exe [2007-02-10 242544]
S4 SQLWriter;SQL Server VSS Writer; c:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe [2007-02-10 89968]
S4 usnjsvc;Messenger USN Journal Reader-Service für freigegebene Ordner; C:\Programme\MSN Messenger\usnsvc.exe [2007-01-19 97136]
S4 WMPNetworkSvc;Windows Media Player-Netzwerkfreigabedienst; C:\Programme\Windows Media Player\WMPNetwk.exe [2006-11-03 920576]

-----------------EOF-----------------


Vor ner Woche hab ich schon mal Malwarebytes und Kasperski online laufen lassen.Kaspersky hat nix gemeldet.


Malwarebytes' Anti-Malware 1.40
Datenbank Version: 2664
Windows 5.1.2600 Service Pack 3

20.08.2009 16:59:39
mbam-log-2009-08-20 (16-59-39).txt

Scan-Methode: Vollständiger Scan (C:\|)
Durchsuchte Objekte: 210680
Laufzeit: 1 hour(s), 2 minute(s), 38 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 1
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 1
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_CURRENT_USER\SOFTWARE\The Weather Channel (Adware.Hotbar) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)


FWIW von Rootkit Hook Analyzer:

Service name Syscall Address Hooked Module Product Company Description
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
NtAdjustPrivilegesToken, ZwAdjustPrivilegesToken 11 0xB50FC1DA YES klif.sys Kaspersky Anti-Virus Kaspersky Lab Klif Mini-Filter fre_wnet_x86
NtClose, ZwClose 25 0xB50FC7AE YES klif.sys Kaspersky Anti-Virus Kaspersky Lab Klif Mini-Filter fre_wnet_x86
NtConnectPort, ZwConnectPort 31 0xB50FE1EA YES klif.sys Kaspersky Anti-Virus Kaspersky Lab Klif Mini-Filter fre_wnet_x86
NtCreateFile, ZwCreateFile 37 0xB50FDB9C YES klif.sys Kaspersky Anti-Virus Kaspersky Lab Klif Mini-Filter fre_wnet_x86
NtCreateKey, ZwCreateKey 41 0xB50FB950 YES klif.sys Kaspersky Anti-Virus Kaspersky Lab Klif Mini-Filter fre_wnet_x86
NtCreateSymbolicLinkObject, ZwCreateSymbolicLinkObject 52 0xB50FFB7C YES klif.sys Kaspersky Anti-Virus Kaspersky Lab Klif Mini-Filter fre_wnet_x86
NtCreateThread, ZwCreateThread 53 0xB50FC5AE YES klif.sys Kaspersky Anti-Virus Kaspersky Lab Klif Mini-Filter fre_wnet_x86
NtDeleteKey, ZwDeleteKey 63 0xB50FBD92 YES klif.sys Kaspersky Anti-Virus Kaspersky Lab Klif Mini-Filter fre_wnet_x86
NtDeleteValueKey, ZwDeleteValueKey 65 0xB50FBF92 YES klif.sys Kaspersky Anti-Virus Kaspersky Lab Klif Mini-Filter fre_wnet_x86
NtDeviceIoControlFile, ZwDeviceIoControlFile 66 0xB50FDEAC YES klif.sys Kaspersky Anti-Virus Kaspersky Lab Klif Mini-Filter fre_wnet_x86
NtDuplicateObject, ZwDuplicateObject 68 0xB5100084 YES klif.sys Kaspersky Anti-Virus Kaspersky Lab Klif Mini-Filter fre_wnet_x86
NtEnumerateKey, ZwEnumerateKey 71 0xB50FC0A8 YES klif.sys Kaspersky Anti-Virus Kaspersky Lab Klif Mini-Filter fre_wnet_x86
NtEnumerateValueKey, ZwEnumerateValueKey 73 0xB50FC110 YES klif.sys Kaspersky Anti-Virus Kaspersky Lab Klif Mini-Filter fre_wnet_x86
NtFsControlFile, ZwFsControlFile 84 0xB50FDD5E YES klif.sys Kaspersky Anti-Virus Kaspersky Lab Klif Mini-Filter fre_wnet_x86
NtLoadDriver, ZwLoadDriver 97 0xB50FF620 YES klif.sys Kaspersky Anti-Virus Kaspersky Lab Klif Mini-Filter fre_wnet_x86
NtOpenFile, ZwOpenFile 116 0xB50FD9F8 YES klif.sys Kaspersky Anti-Virus Kaspersky Lab Klif Mini-Filter fre_wnet_x86
NtOpenKey, ZwOpenKey 119 0xB50FBAB2 YES klif.sys Kaspersky Anti-Virus Kaspersky Lab Klif Mini-Filter fre_wnet_x86
NtOpenProcess, ZwOpenProcess 122 0xB50FC3B2 YES klif.sys Kaspersky Anti-Virus Kaspersky Lab Klif Mini-Filter fre_wnet_x86
NtOpenSection, ZwOpenSection 125 0xB50FFBA6 YES klif.sys Kaspersky Anti-Virus Kaspersky Lab Klif Mini-Filter fre_wnet_x86
NtOpenThread, ZwOpenThread 128 0xB50FC2FE YES klif.sys Kaspersky Anti-Virus Kaspersky Lab Klif Mini-Filter fre_wnet_x86
NtQueryKey, ZwQueryKey 160 0xB50FC178 YES klif.sys Kaspersky Anti-Virus Kaspersky Lab Klif Mini-Filter fre_wnet_x86
NtQueryMultipleValueKey, ZwQueryMultipleValueKey 161 0xB50FBE7C YES klif.sys Kaspersky Anti-Virus Kaspersky Lab Klif Mini-Filter fre_wnet_x86
NtQueryValueKey, ZwQueryValueKey 177 0xB50FBC5A YES klif.sys Kaspersky Anti-Virus Kaspersky Lab Klif Mini-Filter fre_wnet_x86
NtQueueApcThread, ZwQueueApcThread 180 0xB50FF888 YES klif.sys Kaspersky Anti-Virus Kaspersky Lab Klif Mini-Filter fre_wnet_x86
NtReplaceKey, ZwReplaceKey 193 0xB50FB5D2 YES klif.sys Kaspersky Anti-Virus Kaspersky Lab Klif Mini-Filter fre_wnet_x86
NtRequestWaitReplyPort, ZwRequestWaitReplyPort 200 0xB50FEA74 YES klif.sys Kaspersky Anti-Virus Kaspersky Lab Klif Mini-Filter fre_wnet_x86
NtRestoreKey, ZwRestoreKey 204 0xB50FB734 YES klif.sys Kaspersky Anti-Virus Kaspersky Lab Klif Mini-Filter fre_wnet_x86
NtResumeThread, ZwResumeThread 206 0xB50FFF56 YES klif.sys Kaspersky Anti-Virus Kaspersky Lab Klif Mini-Filter fre_wnet_x86
NtSaveKey, ZwSaveKey 207 0xB50FB3D0 YES klif.sys Kaspersky Anti-Virus Kaspersky Lab Klif Mini-Filter fre_wnet_x86
NtSecureConnectPort, ZwSecureConnectPort 210 0xB50FE08C YES klif.sys Kaspersky Anti-Virus Kaspersky Lab Klif Mini-Filter fre_wnet_x86
NtSetContextThread, ZwSetContextThread 213 0xB50FC6AC YES klif.sys Kaspersky Anti-Virus Kaspersky Lab Klif Mini-Filter fre_wnet_x86
NtSetSecurityObject, ZwSetSecurityObject 237 0xB50FF71A YES klif.sys Kaspersky Anti-Virus Kaspersky Lab Klif Mini-Filter fre_wnet_x86
NtSetSystemInformation, ZwSetSystemInformation 240 0xB50FFBD0 YES klif.sys Kaspersky Anti-Virus Kaspersky Lab Klif Mini-Filter fre_wnet_x86
NtSetValueKey, ZwSetValueKey 247 0xB50FBB08 YES klif.sys Kaspersky Anti-Virus Kaspersky Lab Klif Mini-Filter fre_wnet_x86
NtSuspendProcess, ZwSuspendProcess 253 0xB50FFCB4 YES klif.sys Kaspersky Anti-Virus Kaspersky Lab Klif Mini-Filter fre_wnet_x86
NtSuspendThread, ZwSuspendThread 254 0xB50FFDE0 YES klif.sys Kaspersky Anti-Virus Kaspersky Lab Klif Mini-Filter fre_wnet_x86
NtSystemDebugControl, ZwSystemDebugControl 255 0xB50FF54C YES klif.sys Kaspersky Anti-Virus Kaspersky Lab Klif Mini-Filter fre_wnet_x86
NtTerminateProcess, ZwTerminateProcess 257 0xB50FC47E YES klif.sys Kaspersky Anti-Virus Kaspersky Lab Klif Mini-Filter fre_wnet_x86
NtWriteVirtualMemory, ZwWriteVirtualMemory 277 0xB50FC4F0 YES klif.sys Kaspersky Anti-Virus Kaspersky Lab Klif Mini-Filter fre_wnet_x86

Übrigens ich führe bmr.exe als Administrator aus!
Im abgesicherten Modus sieht das Ergebnis so aus:

device: opened successfully
user: Reading succesful MBR oder so
kernel: error reading MBR


Hilfe wär echt klasse.

Hallo und

Da du schon bereit für eine Neuinstallation bist, führe sie einfach nach unserer Anleitung aus. Installiere nicht wieder Kaspersky, sondern die freie Version von Avira.

ciao, andreas

Servus,
Danke für die Antwort.Muss ich denn nicht vor einer Neuinstallation festellen
ob der Bootsektor befallen ist?Oder hab ich da was überlesen?

Nein da sich so gut wie keine Viren mehr dort festsetzen.

@Sven Uwe

Auch wenn du jetzt in Hannover lebst, halte dich lieber raus.

http://www.trojaner-board.de/69603-f...dem-forum.html

@j.a.o.p.

Falls du vor der Neuinstallation sicher gehen möchtest => Darik's Boot And Nuke | Hard Drive Disk Wipe and Data Clearing

Laden, brennen, davon booten, löschen. Danach ist deine Festplatte garantiert sauber.

ciao, andreas

Sorry,
ich will ja nicht insistieren,aber ich zitier mal aus "Bereinigung nach einer Kompromittierung":

Leider tauchen momentan immer mehr Schädlinge auf die sich in den Master Boot Record, kurz MBR einschreiben. Dieser wird bei einer herkömmlichen Neuinstallation nicht komplett überschrieben und stellt somit ein erhebliches Sicherheitsrisiko dar. Vor der Neuinstallation sollte daher sichergegangen werden, dass der MBR in Ordnung ist[

Also was denn nun?

Danke Andreas

Zitat von john.doe

Laden, brennen, davon booten, löschen. Danach ist deine Festplatte garantiert sauber.

DBAN removes the MBR during a full-disk wipe. DBAN does not remove the MBR if individual partitions are being wiped.

Obacht!
Also: Wenn nur eine Partition auf einer Festplatte mit mehreren Partitionen gelöscht wird, hilft das nichts.
j.a.o.p.: Ist das eine 80 GB Festplatte?

Du bist entlassen.

ciao, andreas

Edit: Wie hat mir das gefehlt.

Jo,das ist ne 80 GB Platte.

Ok dann kann ich nur zittern

Du bist entlassen.

Bata

P.S.: Und es soll doch gar kein bashing sein.

Jo danke,
Ich geh mal davon aus das der Kollege mit dem bashing gemeint ist.

Noch ne Frage,gibt es irgendwo ein "empfohlene Tools" oder so?
Ich würd es diesmal gern besser machen.So mit Registry- und Port-Überwachung.Vernünftige Passwortverwaltung wär auch nicht schlecht?