PENDRIVE - alle externen Datenträger werden umbenannt

FBA · 17.12.2009, 19:44

Hallo!

Ich habe meinen Stick bei der Arbeit verwendet. Nun wird er (und auch alle anderen externen Datenträger, zB HDD) als ein Ordner namens "PENDRIVE" mit einem englischen Kontexteintrag "open" angezeigt.
Er lässt sich nur noch über den Explorer öffnen. Obwohl Autoplay ausgeschaltet ist, öffnet sich das Fenster und zeigt die englische Funktion "Open folder", die nicht funktioniert. "Ordner öffnen" weiter unten im Menü funktioniert.

Umbennen lassen sie sich nicht.
Bei mir gibts keine Recycle-Ordner (>Pendrive gegoogelt).

Außerdem sind die Rahmen meiner Fenster auf einmal so schmal. Das kann aber auch nur eine Einstellungssache sein...

Antivir, Ad Aware, Spybot (alle free und geupdatet) finden nichts auf c: und den Externen.

CC benutzt. Malwarebytes benutzt (8 Probleme). Dann kamen 2 Virenmeldungen von Antivir.

Hyjack file und malwarefile gezippt und zum download hier:

Logfile of random's system information tool 1.06 (written by random/random)
Run by **** at 2009-12-17 19:38:31
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 3 GB (13%) free of 21 GB
Total RAM: 1022 MB (61% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:38:39, on 17.12.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Avira\AntiVir Desktop\sched.exe
C:\Programme\Avira\AntiVir Desktop\avguard.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\Programme\MicroStar\WLANUtility\WlanUtility.exe
C:\Programme\MicroStar\WLANUtility\WLAN_Service.exe
C:\WINDOWS\System32\svchost.exe
C:\Dokumente und Einstellungen\****\Desktop\RSIT.exe
C:\Programme\Trend Micro\HijackThis\****.exe

O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\avguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe

--
End of file - 1716 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job

======Registry dump======

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AnyDVD]
C:\Programme\SlySoft\AnyDVD\AnyDVDtray.exe [2009-09-11 3042240]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"wuauserv"=2
"wscsvc"=2
"VMCService"=2
"UxTuneUp"=2
"PnkBstrA"=3
"odserv"=3
"iPod Service"=3
"FLEXnet Licensing Service"=3
"Bonjour Service"=2
"BITS"=3
"Ati HotKey Poller"=2
"Apple Mobile Device"=2
"AcrSch2Svc"=2
"ABBYY.Licensing.FineReader.Professional.9.0"=2
"Schedule"=2
"SENS"=2
"CiSvc"=3
"helpsvc"=2
"Browser"=2

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2008-12-01 143360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"authentication packages"=msv1_0
relog_ap

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=91

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"D:\Programme\eMule.de\eMule\emule.exe"="D:\Programme\eMule.de\eMule\emule.exe:*:Enabled:eMule"
"C:\Programme\ICQLite\ICQLite.exe"="C:\Programme\ICQLite\ICQLite.exe:*:Enabled:ICQ Lite"
"D:\Programme\Azureus\Azureus.exe"="D:\Programme\Azureus\Azureus.exe:*:Enabled:Azureus"
"C:\Programme\Ratajik Software\StationRipper\StationRipperConsole.exe"="C:\Programme\Ratajik Software\StationRipper\StationRipperConsole.exe:*:Enabled:StationRipperConsole"
"D:\Programme\Spiele\BF2\BF2.exe"="D:\Programme\Spiele\BF2\BF2.exe:*:Enabled:Battlefield 2"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Programme\Java\jre1.6.0_02\bin\javaw.exe"="C:\Programme\Java\jre1.6.0_02\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\WINDOWS\system32\java.exe"="C:\WINDOWS\system32\java.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\Programme\VideoLAN\VLC\vlc.exe"="C:\Programme\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player"
"C:\Programme\Java\jre1.6.0_03\bin\javaw.exe"="C:\Programme\Java\jre1.6.0_03\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\Programme\Mozilla Firefox\firefox.exe"="C:\Programme\Mozilla Firefox\firefox.exe:*:Enabled:Firefox"
"C:\Programme\Bonjour\mDNSResponder.exe"="C:\Programme\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Programme\iTunes\iTunes.exe"="C:\Programme\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\Programme\Java\jre6\launch4j-tmp\JDownloader.exe"="C:\Programme\Java\jre6\launch4j-tmp\JDownloader.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\Programme\Ahead\Nero ShowTime\ShowTime.exe"="C:\Programme\Ahead\Nero ShowTime\ShowTime.exe:*:Enabled:Nero ShowTime"
"C:\Programme\Windows Live\Messenger\wlcsdk.exe"="C:\Programme\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\Programme\Windows Live\Messenger\msnmsgr.exe"="C:\Programme\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Programme\Windows Live\Sync\WindowsLiveSync.exe"="C:\Programme\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync"
"C:\Programme\Skype\Phone\Skype.exe"="C:\Programme\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Programme\Windows Live\Messenger\wlcsdk.exe"="C:\Programme\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\Programme\Windows Live\Messenger\msnmsgr.exe"="C:\Programme\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Programme\Windows Live\Sync\WindowsLiveSync.exe"="C:\Programme\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3256e733-7829-11dd-987c-00032510d340}]
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RECYCLER\S-1-5-21-1482476501-3352491937-682996330-1013\svchost.exe
shell\Open\command - I:\RECYCLER\S-1-5-21-1482476501-3352491937-682996330-1013\svchost.exe

======File associations======

.js - open - "C:\Programme\Adobe\Adobe Dreamweaver CS3\Dreamweaver.exe","%1"

======List of files/folders created in the last 1 months======

2009-12-17 19:35:33 ----D---- C:\rsit
2009-12-17 14:36:32 ----D---- C:\Programme\Malwarebytes' Anti-Malware
2009-12-17 14:33:52 ----D---- C:\Programme\CCleaner
2009-12-15 21:01:11 ----A---- C:\Dokumente und Einstellungen\*****\Anwendungsdaten\SQLite3.dll
2009-12-13 20:17:13 ----D---- C:\Programme\OpenXML-ODF Translator
2009-12-07 17:52:05 ----D---- C:\Programme\CRC-Killer_2.0
2009-12-07 15:52:18 ----A---- C:\WINDOWS\system32\javaws.exe
2009-12-07 15:52:18 ----A---- C:\WINDOWS\system32\javaw.exe
2009-12-07 15:52:18 ----A---- C:\WINDOWS\system32\java.exe

======List of files/folders modified in the last 1 months======

2009-12-17 19:35:51 ----D---- C:\WINDOWS\system32
2009-12-17 19:32:57 ----D---- C:\Programme\Mozilla Firefox
2009-12-17 19:29:48 ----D---- C:\WINDOWS\Temp
2009-12-17 19:28:41 ----D---- C:\WINDOWS\system32\CatRoot2
2009-12-17 19:28:40 ----D---- C:\WINDOWS
2009-12-17 19:26:04 ----D---- C:\WINDOWS\system32\drivers
2009-12-17 19:26:04 ----D---- C:\WINDOWS\Prefetch
2009-12-17 17:58:02 ----ASH---- C:\boot.ini
2009-12-17 17:58:02 ----A---- C:\WINDOWS\win.ini
2009-12-17 17:58:02 ----A---- C:\WINDOWS\system.ini
2009-12-17 14:38:12 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
2009-12-17 14:37:24 ----D---- C:\WINDOWS\Debug
2009-12-17 14:37:23 ----D---- C:\WINDOWS\Minidump
2009-12-17 14:36:32 ----RD---- C:\Programme
2009-12-17 12:56:41 ----A---- C:\WINDOWS\system32\lckfldservicelog.txt
2009-12-17 12:56:29 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-12-17 12:56:17 ----SD---- C:\WINDOWS\Downloaded Program Files
2009-12-17 12:07:38 ----D---- C:\Dokumente und Einstellungen\****\Anwendungsdaten\vlc
2009-12-15 21:23:12 ----SD---- C:\WINDOWS\Tasks
2009-12-15 18:56:13 ----D---- C:\WINDOWS\system32\config
2009-12-13 21:19:03 ----D---- C:\WINDOWS\Microsoft.NET
2009-12-13 21:19:02 ----RSD---- C:\WINDOWS\assembly
2009-12-13 20:18:15 ----SHD---- C:\WINDOWS\Installer
2009-12-13 20:17:35 ----HD---- C:\Config.Msi
2009-12-08 22:20:35 ----A---- C:\WINDOWS\system32\lsdelete.exe
2009-12-08 16:49:57 ----D---- C:\Dokumente und Einstellungen\*****\Anwendungsdaten\Image Zone Express
2009-12-07 15:52:12 ----D---- C:\Programme\Java
2009-11-29 12:36:45 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-11-24 20:01:51 ----D---- C:\Dokumente und Einstellungen\****\Anwendungsdaten\dvdcss
2009-11-23 18:08:32 ----D---- C:\Dokumente und Einstellungen\*****\Anwendungsdaten\FileZilla

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AmdK8;AMD Athlon64-Prozessortreiber; C:\WINDOWS\System32\DRIVERS\AmdK8.sys [2003-11-07 38400]
R1 Asapi;Asapi; C:\WINDOWS\system32\drivers\Asapi.sys [2002-04-17 11264]
R1 ASPI32;ASPI32; C:\WINDOWS\system32\drivers\ASPI32.sys [2002-07-17 16877]
R1 avgio;avgio; \??\C:\Programme\Avira\AntiVir Desktop\avgio.sys []
R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2009-03-30 96104]
R1 ElbyCDIO;ElbyCDIO Driver; C:\WINDOWS\System32\Drivers\ElbyCDIO.sys [2009-09-11 24744]
R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2009-05-11 28520]
R1 truecrypt;truecrypt; C:\WINDOWS\System32\drivers\truecrypt.sys [2009-03-01 215872]
R2 avgntflt;avgntflt; C:\WINDOWS\system32\DRIVERS\avgntflt.sys [2009-12-07 56816]
R2 tifsfilter;Acronis TrueImage FS Filter; C:\WINDOWS\System32\DRIVERS\tifsfilt.sys [2006-11-06 30688]
R3 ALCXSENS;Service for WDM 3D Audio Driver; C:\WINDOWS\system32\drivers\ALCXSENS.SYS [2003-11-13 391680]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2003-12-04 536668]
R3 AnyDVD;AnyDVD; C:\WINDOWS\System32\Drivers\AnyDVD.sys [2009-09-10 104512]
R3 Arp1394;1394-ARP-Clientprotokoll; C:\WINDOWS\System32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 ati2mtag;ati2mtag; C:\WINDOWS\System32\DRIVERS\ati2mtag.sys [2008-12-01 3452928]
R3 CmBatt;Treiber für Microsoft-ACPI-Kontrollmethodenkompatible Batterie; C:\WINDOWS\System32\DRIVERS\CmBatt.sys [2008-04-13 13952]
R3 ElbyCDFL;ElbyCDFL; C:\WINDOWS\System32\Drivers\ElbyCDFL.sys [2006-12-26 34760]
R3 ElbyDelay;ElbyDelay; C:\WINDOWS\System32\Drivers\ElbyDelay.sys [2007-02-16 11984]
R3 FETNDISB;VIA Rhine Family Fast Ethernet Adapter Driver Service; C:\WINDOWS\System32\DRIVERS\fetnd5b.sys [2003-04-24 41984]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2008-04-17 15464]
R3 HidUsb;Microsoft HID Class-Treiber; C:\WINDOWS\System32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 M2500;802.11g Wireless Network Driver; C:\WINDOWS\System32\DRIVERS\M2500.sys [2004-06-11 191360]
R3 mouhid;Maus-HID-Treiber; C:\WINDOWS\System32\DRIVERS\mouhid.sys [2001-08-18 12288]
R3 Mtlmnt5;Mtlmnt5; C:\WINDOWS\System32\DRIVERS\Mtlmnt5.sys [2003-07-16 221736]
R3 NIC1394;1394-Netzwerktreiber; C:\WINDOWS\System32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 PCANDIS5;PCANDIS5 NDIS Protocol Driver; \??\C:\WINDOWS\System32\PCANDIS5.SYS []
R3 Slntamr;SmartLink AMR_PCI Driver; C:\WINDOWS\System32\DRIVERS\slntamr.sys [2003-08-18 548888]
R3 SlWdmSup;SlWdmSup; C:\WINDOWS\System32\DRIVERS\SlWdmSup.sys [2003-07-02 39348]
R3 SynTP;Synaptics TouchPad Driver; C:\WINDOWS\System32\DRIVERS\SynTP.sys [2003-10-30 178432]
R3 usbehci;Miniporttreiber für erweiterten Microsoft USB 2.0-Hostcontroller; C:\WINDOWS\System32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Microsoft USB-Standardhubtreiber; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 USBSTOR;USB-Massenspeichertreiber; C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
R3 usbuhci;Miniporttreiber für universellen Microsoft USB-Hostcontroller; C:\WINDOWS\System32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 ZSMC303;YHT 303 PC Camera; C:\WINDOWS\System32\Drivers\usbVM303.sys [2005-07-14 389788]
S3 a11n2tp5;a11n2tp5; C:\WINDOWS\system32\drivers\a11n2tp5.sys []
S3 CCDECODE;Untertiteldecoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 evserial;Virtual Serial Ports Driver (Eltima Softwate); C:\WINDOWS\System32\DRIVERS\evserial.sys [2007-10-09 51584]
S3 FETNDIS;VIA PCI 10/100-MBit/s-Fast Ethernetadapter-NT-Treiber; C:\WINDOWS\System32\DRIVERS\fetnd5.sys [2001-08-17 27165]
S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2006-12-06 49920]
S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2006-12-06 16496]
S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2006-12-06 21568]
S3 hwdatacard;Huawei DataCard USB Modem and USB Serial; C:\WINDOWS\system32\DRIVERS\ewusbmdm.sys [2008-03-17 101376]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink-Konvertierung; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 Mtlstrm;Mtlstrm; C:\WINDOWS\System32\DRIVERS\Mtlstrm.sys [2003-08-18 1301704]
S3 NABTSFEC;NABTS/FEC VBI-Codec; C:\WINDOWS\System32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Microsoft TV-/Videoverbindung; C:\WINDOWS\System32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 NtMtlFax;NtMtlFax; C:\WINDOWS\System32\DRIVERS\NtMtlFax.sys [2003-08-11 167352]
S3 NTSIM;NTSIM; \??\C:\WINDOWS\System32\ntsim.sys []
S3 RecAgent;recagent; \??\C:\WINDOWS\System32\DRIVERS\RecAgent.sys []
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\System32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 SlNtHal;SlNtHal; C:\WINDOWS\System32\DRIVERS\Slnthal.sys [2003-08-18 86512]
S3 streamip;BDA-IPSink; C:\WINDOWS\System32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 usbccgp;Microsoft Standard-USB-Haupttreiber; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 usbprint;Microsoft USB-Druckerklasse; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;USB-Scannertreiber; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 VSBC;Virtual Serial Bus Enumerator (Eltima Software); C:\WINDOWS\system32\DRIVERS\evsbc.sys [2007-10-09 25088]
S3 WSTCODEC;World Standard Teletext-Codec; C:\WINDOWS\System32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AntiVirSchedulerService;Avira AntiVir Planer; C:\Programme\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289]
R2 AntiVirService;Avira AntiVir Guard; C:\Programme\Avira\AntiVir Desktop\avguard.exe [2009-08-05 185089]
R2 hpqddsvc;HP CUE DeviceDiscovery Service; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R2 JavaQuickStarterService;Java Quick Starter; C:\Programme\Java\jre6\bin\jqs.exe [2009-10-11 153376]
R2 Net Driver HPZ12;Net Driver HPZ12; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
R2 SeaPort;SeaPort; C:\Programme\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2009-01-14 226656]
R3 hpqcxs08;hpqcxs08; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S2 SLService;SmartLinkService; C:\WINDOWS\system32\slserv.exe [2003-08-11 45056]
S3 aspnet_state;ASP.NET-Zustandsdienst; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 IDriverT;InstallDriver Table Manager; C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 ose;Office Source Engine; C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WLSetupSvc;Windows Live Setup Service; C:\Programme\Windows Live\installer\WLSetupSvc.exe [2007-10-25 266240]
S3 WMPNetworkSvc;Windows Media Player-Netzwerkfreigabedienst; C:\Programme\Windows Media Player\WMPNetwk.exe [2006-10-24 920576]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 ABBYY.Licensing.FineReader.Professional.9.0;ABBYY FineReader 9.0 PE Licensing Service; C:\Programme\Gemeinsame Dateien\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe [2007-12-06 660768]
S4 AcrSch2Svc;Acronis Scheduler2 Service; C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe [2005-10-14 172032]
S4 Apple Mobile Device;Apple Mobile Device; C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-11-07 132424]
S4 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2008-12-01 598016]
S4 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2008-12-01 593920]
S4 Bonjour Service;Bonjour-Dienst; C:\Programme\Bonjour\mDNSResponder.exe [2008-08-29 238888]
S4 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2008-03-17 654848]
S4 iPod Service;iPod-Dienst; C:\Programme\iPod\bin\iPodService.exe [2008-11-20 536872]
S4 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service; C:\Programme\Lavasoft\Ad-Aware\AAWService.exe [2009-12-08 1184912]
S4 LckFldService;LckFldService; C:\WINDOWS\System32\LckFldService.exe []
S4 NetTcpPortSharing;Net.Tcp-Portfreigabedienst; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]
S4 NMIndexingService;NMIndexingService; C:\Programme\Gemeinsame Dateien\Nero\Lib\NMIndexingService.exe []
S4 odserv;Microsoft Office Diagnostics Service; C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE [2007-08-24 443776]
S4 PLFlash DeviceIoControl Service;PLFlash DeviceIoControl Service; C:\WINDOWS\system32\IoctlSvc.exe [2006-12-19 81920]
S4 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2009-03-22 66872]
S4 UxTuneUp;TuneUp Designerweiterung; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
S4 VMCService;Vodafone Mobile Connect Service; C:\Programme\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe [2008-07-04 14336]

-----------------EOF-----------------

Malwarebytes' Anti-Malware 1.42
Datenbank Version: 3379
Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

17.12.2009 19:23:56
mbam-log-2009-12-17 (19-23-45).txt

Scan-Methode: Vollständiger Scan (C:\|D:\|E:\|L:\|)
Durchsuchte Objekte: 297901
Laufzeit: 4 hour(s), 41 minute(s), 2 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 1
Infizierte Registrierungswerte: 3
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 1
Infizierte Dateien: 3

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{f146c9b1-vmvq-a9rc-nufl-d0ba00b4e888} (Generic.Bot.H) -> No action taken.

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hkcu (Backdoor.Bot) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\policies (Backdoor.Bot) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\policies (Backdoor.Bot) -> No action taken.

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
C:\WINDOWS\svchost (Backdoor.Bot) -> No action taken.

Infizierte Dateien:
C:\Programme\Steinberg\WaveLab\UNWISE.EXE (Malware.Packer.Morphine) -> No action taken.
C:\WINDOWS\svchost\svchost.exe (Backdoor.Bot) -> No action taken.
C:\Dokumente und Einstellungen\****\Anwendungsdaten\logs.dat (Bifrose.Trace) -> No action taken.

Bitte helft mir!

cosinus · 18.12.2009, 11:36

Hallo und

Lade dir Lop S&D herunter.

Führe Lop S&D.exe per Doppelklick aus. VISTA-User: Rechtsklick => Ausführen als Admin!!
Wähle die Sprache deiner Wahl und anschließend die Option 1.
Warte bis der Scanbericht erstellt wird und poste ihn hier (Du findest ihn unter C:\lopR.txt, sollte der Bericht nicht erscheinen).

FBA · 19.12.2009, 11:22

Hallo!

DANke für Dein Interesse und deine Hilfe!!!

Hier das LopLog:

--------------------\\ Lop S&D 4.2.5-0 XP/Vista

Microsoft Windows XP Home Edition ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : Mobile AMD Athlon(tm) 64

Processor 2800+ )
BIOS : PhoenixBIOS 4.0 Release 6.0
USER : Denny ( Administrator )
BOOT : Normal boot
Antivirus : AntiVir Desktop 9.0.1.30 (Not Activated)
C:\ (Local Disk) - NTFS - Total:20 Go (Free:2 Go)
D:\ (Local Disk) - NTFS - Total:30 Go (Free:5 Go)
E:\ (Local Disk) - NTFS - Total:0 Go (Free:0 Go)
G:\ (CD or DVD)
H:\ (CD or DVD) - UDF - Total:1 Go (Free:0 Go)
J:\ (CD or DVD)
O:\ (CD or DVD)

"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
Option : [1] ( 19.12.2009|10:38 )

--------------------\\ Ordner Verzeichnis unter ANWEND~1

[26.06.2009|11:22] C:\DOKUME~1\ADMINI~1\ANWEND~1\Microsoft
[0|Datei(en)] C:\DOKUME~1\ADMINI~1\ANWEND~1\Bytes
[3|Verzeichnis(se),] C:\DOKUME~1\ADMINI~1\ANWEND~1\Bytes frei

[04.01.2009|14:12]

C:\DOKUME~1\ALLUSE~1\ANWEND~1\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
[18.10.2009|22:16]

C:\DOKUME~1\ALLUSE~1\ANWEND~1\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}
[28.09.2008|21:20] C:\DOKUME~1\ALLUSE~1\ANWEND~1\ABBYY
[06.11.2006|12:22] C:\DOKUME~1\ALLUSE~1\ANWEND~1\Acronis
[21.11.2008|17:57] C:\DOKUME~1\ALLUSE~1\ANWEND~1\Adobe
[04.11.2008|00:36] C:\DOKUME~1\ALLUSE~1\ANWEND~1\Ahead
[20.02.2008|16:58] C:\DOKUME~1\ALLUSE~1\ANWEND~1\Apple
[04.01.2009|14:11] C:\DOKUME~1\ALLUSE~1\ANWEND~1\Apple Computer
[19.12.2008|12:41] C:\DOKUME~1\ALLUSE~1\ANWEND~1\ATI
[26.06.2009|11:22] C:\DOKUME~1\ALLUSE~1\ANWEND~1\avg8
[24.06.2009|16:58] C:\DOKUME~1\ALLUSE~1\ANWEND~1\Avira
[24.07.2007|18:24] C:\DOKUME~1\ALLUSE~1\ANWEND~1\Elaborate Bytes
[23.04.2008|14:18] C:\DOKUME~1\ALLUSE~1\ANWEND~1\FLEXnet
[19.07.2007|19:41] C:\DOKUME~1\ALLUSE~1\ANWEND~1\Google
[07.10.2007|15:10] C:\DOKUME~1\ALLUSE~1\ANWEND~1\Hewlett-Packard
[07.10.2007|15:15] C:\DOKUME~1\ALLUSE~1\ANWEND~1\HP
[13.05.2009|03:38] C:\DOKUME~1\ALLUSE~1\ANWEND~1\InstallShield
[31.07.2008|18:10] C:\DOKUME~1\ALLUSE~1\ANWEND~1\Lavasoft
[29.05.2009|11:29] C:\DOKUME~1\ALLUSE~1\ANWEND~1\Macromedia
[06.06.2009|00:08] C:\DOKUME~1\ALLUSE~1\ANWEND~1\Malwarebytes
[11.10.2009|19:50] C:\DOKUME~1\ALLUSE~1\ANWEND~1\Microsoft
[19.11.2008|22:06] C:\DOKUME~1\ALLUSE~1\ANWEND~1\Microsoft Help
[02.06.2008|18:17] C:\DOKUME~1\ALLUSE~1\ANWEND~1\MSN6
[31.10.2008|14:07] C:\DOKUME~1\ALLUSE~1\ANWEND~1\Nero
[06.11.2006|13:06] C:\DOKUME~1\ALLUSE~1\ANWEND~1\Pinnacle
[05.03.2008|11:40] C:\DOKUME~1\ALLUSE~1\ANWEND~1\RapidSolution
[16.10.2007|15:00] C:\DOKUME~1\ALLUSE~1\ANWEND~1\Skype
[18.10.2009|22:45] C:\DOKUME~1\ALLUSE~1\ANWEND~1\SlySoft
[17.12.2009|14:38] C:\DOKUME~1\ALLUSE~1\ANWEND~1\Spybot - Search &

Destroy
[26.10.2007|14:31] C:\DOKUME~1\ALLUSE~1\ANWEND~1\TEMP
[15.11.2007|18:35] C:\DOKUME~1\ALLUSE~1\ANWEND~1\Trymedia
[13.10.2009|21:13] C:\DOKUME~1\ALLUSE~1\ANWEND~1\TuneUp Software
[13.05.2009|03:37] C:\DOKUME~1\ALLUSE~1\ANWEND~1\Vodafone
[13.05.2009|19:37] C:\DOKUME~1\ALLUSE~1\ANWEND~1\WEBDE
[07.10.2007|15:19] C:\DOKUME~1\ALLUSE~1\ANWEND~1\WEBREG
[04.11.2006|18:13] C:\DOKUME~1\ALLUSE~1\ANWEND~1\Windows Genuine

Advantage
[17.04.2008|00:49] C:\DOKUME~1\ALLUSE~1\ANWEND~1\WLInstaller
[0|Datei(en)] C:\DOKUME~1\ALLUSE~1\ANWEND~1\Bytes
[39|Verzeichnis(se),] C:\DOKUME~1\ALLUSE~1\ANWEND~1\Bytes frei

[04.11.2006|12:46] C:\DOKUME~1\DEFAUL~1\ANWEND~1\Microsoft
[0|Datei(en)] C:\DOKUME~1\DEFAUL~1\ANWEND~1\Bytes
[3|Verzeichnis(se),] C:\DOKUME~1\DEFAUL~1\ANWEND~1\Bytes frei

[28.09.2008|21:18] C:\DOKUME~1\****\ANWEND~1\ABBYY
[17.08.2009|20:38] C:\DOKUME~1\++++\ANWEND~1\Adobe
[27.07.2007|15:06] C:\DOKUME~1\****\ANWEND~1\AdobeUM
[02.09.2009|20:58] C:\DOKUME~1\****\ANWEND~1\Ahead
[04.01.2009|14:13] C:\DOKUME~1\****\ANWEND~1\Apple Computer
[19.12.2008|12:41] C:\DOKUME~1\*****\ANWEND~1\ATI
[22.03.2009|14:40] C:\DOKUME~1\*****\ANWEND~1\Audacity
[22.02.2009|16:10] C:\DOKUME~1\*****\ANWEND~1\Azureus
[07.03.2008|21:00] C:\DOKUME~1\*****\ANWEND~1\DivX
[24.06.2009|15:47] C:\DOKUME~1\*****\ANWEND~1\D-Jay
[24.11.2009|20:01] C:\DOKUME~1\*****\ANWEND~1\dvdcss
[03.12.2008|14:45] C:\DOKUME~1\*****\ANWEND~1\eMule
[23.11.2009|18:08] C:\DOKUME~1\*****\ANWEND~1\FileZilla
[08.11.2009|18:03] C:\DOKUME~1\*****\ANWEND~1\gtk-2.0
[23.10.2007|21:25] C:\DOKUME~1\*****\ANWEND~1\Help
[07.10.2007|15:36] C:\DOKUME~1\*****\ANWEND~1\HP
[05.11.2006|14:14] C:\DOKUME~1\****\ANWEND~1\ICQLite
[04.11.2006|12:53] C:\DOKUME~1\*****\ANWEND~1\Identities
[08.12.2009|16:49] C:\DOKUME~1\*****\ANWEND~1\Image Zone Express
[01.09.2009|19:30] C:\DOKUME~1\*****\ANWEND~1\ImgBurn
[26.11.2007|18:54] C:\DOKUME~1\*****\ANWEND~1\Inkscape
[07.12.2008|19:09] C:\DOKUME~1\*****\ANWEND~1\Juce VST Host
[31.07.2008|18:08] C:\DOKUME~1\*****\ANWEND~1\Lavasoft
[29.05.2009|11:39] C:\DOKUME~1\*****\ANWEND~1\Macromedia
[06.06.2009|00:09] C:\DOKUME~1\****\ANWEND~1\Malwarebytes
[21.12.2008|00:55] C:\DOKUME~1\*****\ANWEND~1\Microsoft
[27.08.2008|20:38] C:\DOKUME~1\*****\ANWEND~1\Mozilla
[22.08.2009|11:20] C:\DOKUME~1\*****\ANWEND~1\MSN6
[07.07.2009|18:13] C:\DOKUME~1\*****\ANWEND~1\Pegasys Inc
[02.12.2007|22:26] C:\DOKUME~1\*****\ANWEND~1\Printer Info Cache
[23.04.2008|12:49] C:\DOKUME~1\*****\ANWEND~1\Quark
[12.07.2008|14:40] C:\DOKUME~1\*****\ANWEND~1\RouterControl
[04.03.2008|12:21] C:\DOKUME~1\*****\ANWEND~1\RTPlayer
[20.10.2009|19:09] C:\DOKUME~1\*****\ANWEND~1\Skype
[20.10.2009|16:40] C:\DOKUME~1\*****\ANWEND~1\skypePM
[13.05.2009|19:37] C:\DOKUME~1\****\ANWEND~1\SmartSurfer
[05.11.2006|17:07] C:\DOKUME~1\*\ANWEND~1\Sun
[10.02.2009|18:22] C:\DOKUME~1\*\ANWEND~1\tor
[24.08.2008|20:02] C:\DOKUME~1\*\ANWEND~1\TrueCrypt
[13.10.2009|21:13] C:\DOKUME~1\+\ANWEND~1\TuneUp Software
[12.01.2008|00:44] C:\DOKUME~1\*\ANWEND~1\U3
[12.10.2009|17:03] C:\DOKUME~1\*\ANWEND~1\Uniblue
[10.02.2009|18:45] C:\DOKUME~1\*\ANWEND~1\Vidalia
[17.12.2009|12:07] C:\DOKUME~1\*\ANWEND~1\vlc
[13.05.2009|03:38] C:\DOKUME~1\*\ANWEND~1\Vodafone
[13.05.2009|19:37] C:\DOKUME~1\**\ANWEND~1\WEBDE
[07.11.2009|15:31] C:\DOKUME~1\*\ANWEND~1\WinRAR
[0|Datei(en)] C:\DOKUME~1\Denny\ANWEND~1\Bytes
[49|Verzeichnis(se),] C:\DOKUME~1\*\ANWEND~1\Bytes frei

[26.06.2009|11:22] C:\DOKUME~1\LOCALS~1\ANWEND~1\Microsoft
[13.05.2009|11:56] C:\DOKUME~1\LOCALS~1\ANWEND~1\SmartSurfer
[13.05.2009|03:38] C:\DOKUME~1\LOCALS~1\ANWEND~1\Vodafone
[0|Datei(en)] C:\DOKUME~1\LOCALS~1\ANWEND~1\Bytes
[5|Verzeichnis(se),] C:\DOKUME~1\LOCALS~1\ANWEND~1\Bytes frei

[26.06.2009|11:22] C:\DOKUME~1\NETWOR~1\ANWEND~1\Microsoft
[09.05.2009|10:12] C:\DOKUME~1\NETWOR~1\ANWEND~1\SmartSurfer
[0|Datei(en)] C:\DOKUME~1\NETWOR~1\ANWEND~1\Bytes
[4|Verzeichnis(se),] C:\DOKUME~1\NETWOR~1\ANWEND~1\Bytes frei

--------------------\\ Geplante Aufgaben unter C:\WINDOWS\Tasks

[15.12.2009 21:23][--a------] C:\WINDOWS\tasks\Ad-Aware Update

(Weekly).job
[19.10.2009 16:04][--ah-----] C:\WINDOWS\tasks\SA.DAT
[02.04.2003 13:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini

--------------------\\ Ordner Verzeichnis unter C:\Programme

[11.10.2009|12:16] C:\Programme\7-Zip
[19.08.2008|12:09] C:\Programme\ABBYY FineReader 9.0
[04.11.2006|16:01] C:\Programme\Acronis
[07.03.2009|12:31] C:\Programme\ACSynchro
[07.03.2009|12:27] C:\Programme\acsynchro_free_unzip
[22.05.2009|20:36] C:\Programme\Adobe
[04.11.2008|00:36] C:\Programme\Ahead
[04.11.2006|14:52] C:\Programme\AMD
[26.11.2007|14:51] C:\Programme\Animake
[04.01.2009|14:06] C:\Programme\Apple Software Update
[19.12.2008|12:31] C:\Programme\ATI Technologies
[10.10.2007|20:50] C:\Programme\AutoGK
[24.06.2009|16:58] C:\Programme\Avira
[10.10.2007|20:50] C:\Programme\AviSynth 2.5
[04.01.2009|14:10] C:\Programme\Bonjour
[17.12.2009|14:34] C:\Programme\CCleaner
[04.11.2006|12:43] C:\Programme\ComPlus Applications
[13.06.2008|16:08] C:\Programme\Convar
[07.12.2009|17:52] C:\Programme\CRC-Killer_2.0
[23.10.2009|09:22] C:\Programme\CrystalDiskInfo
[27.05.2009|12:17] C:\Programme\CSS Menu Generator
[10.06.2009|15:48] C:\Programme\Da LAB
[04.11.2006|15:29] C:\Programme\DAEMON Tools
[04.11.2006|16:35] C:\Programme\DAMN NFO Viewer
[04.11.2006|19:15] C:\Programme\Direct Audio Converter & CD Ripper
[07.07.2009|18:04] C:\Programme\DivX
[26.08.2009|11:42] C:\Programme\Dkill95
[01.07.2008|19:48] C:\Programme\Driver-Soft
[28.08.2008|20:06] C:\Programme\DVDVideoSoft
[23.08.2007|23:09] C:\Programme\DynaGeo
[04.11.2006|16:40] C:\Programme\Elaborate Bytes
[26.10.2007|14:31] C:\Programme\Eltima Software
[18.10.2009|16:43] C:\Programme\eRightSoft
[22.10.2009|13:14] C:\Programme\File Scavenger 3.2
[22.06.2009|12:19] C:\Programme\FileZilla FTP Client
[10.06.2009|15:37] C:\Programme\Flash-Creator 1
[17.07.2007|17:33] C:\Programme\FolderAccess
[15.08.2008|13:26] C:\Programme\Free PDF to Word Doc Converter
[23.10.2009|14:56] C:\Programme\FreePDF_XP
[04.11.2006|16:35] C:\Programme\Gabest
[08.06.2009|22:34] C:\Programme\Gemeinsame Dateien
[04.11.2006|14:54] C:\Programme\Generic
[11.08.2009|11:32] C:\Programme\GIMP-2.0
[04.11.2008|00:40] C:\Programme\GoldEsel
[18.10.2008|17:52] C:\Programme\Google
[18.09.2008|20:27] C:\Programme\gs
[07.10.2007|15:13] C:\Programme\Hewlett-Packard
[07.10.2007|15:16] C:\Programme\HP
[10.03.2008|15:09] C:\Programme\i2p
[10.03.2008|15:08] C:\Programme\I2Phex
[05.11.2006|14:14] C:\Programme\ICQLite
[28.02.2008|17:38] C:\Programme\IcyRadio
[16.07.2007|18:09] C:\Programme\Image-Line
[04.02.2009|13:03] C:\Programme\ImgBurn
[26.08.2009|22:59] C:\Programme\inkscape
[23.05.2009|11:44] C:\Programme\InstallShield Installation

Information
[31.10.2008|14:07] C:\Programme\Internet Explorer
[04.01.2009|14:12] C:\Programme\iPod
[21.10.2009|16:57] C:\Programme\IrfanView
[04.01.2009|14:12] C:\Programme\iTunes
[29.05.2009|14:49] C:\Programme\JanSoft
[25.09.2008|12:14] C:\Programme\JAP
[07.12.2009|15:52] C:\Programme\Java
[24.08.2009|22:17] C:\Programme\JDownloader_0.7_2
[06.12.2008|16:13] C:\Programme\LAB1.DE
[16.01.2008|12:06] C:\Programme\Lavalys
[07.02.2009|14:59] C:\Programme\Lavasoft
[29.05.2009|11:29] C:\Programme\Macromedia
[17.12.2009|14:36] C:\Programme\Malwarebytes' Anti-Malware
[02.11.2008|17:51] C:\Programme\Messenger
[11.10.2009|19:52] C:\Programme\Microsoft
[29.12.2008|15:19] C:\Programme\Microsoft Bootvis
[04.11.2006|12:46] C:\Programme\microsoft frontpage
[19.08.2008|11:41] C:\Programme\Microsoft Office
[11.10.2009|19:52] C:\Programme\Microsoft Office Outlook Connector
[12.10.2009|16:15] C:\Programme\Microsoft Silverlight
[11.10.2009|19:48] C:\Programme\Microsoft SQL Server Compact Edition
[11.10.2009|19:50] C:\Programme\Microsoft Sync Framework
[19.08.2008|11:42] C:\Programme\Microsoft Works
[04.11.2006|16:08] C:\Programme\Microsoft.NET
[04.11.2006|15:12] C:\Programme\MicroStar
[02.11.2008|17:44] C:\Programme\Movie Maker
[19.12.2009|09:33] C:\Programme\Mozilla Firefox
[07.01.2008|14:24] C:\Programme\mozilla.org
[24.08.2009|22:18] C:\Programme\MSBuild
[10.11.2008|17:19] C:\Programme\MSECache
[04.11.2006|12:42] C:\Programme\MSN
[04.11.2006|12:42] C:\Programme\MSN Gaming Zone
[17.04.2008|00:52] C:\Programme\MSN Messenger
[08.10.2007|12:36] C:\Programme\MSXML 4.0
[30.10.2008|14:11] C:\Programme\MSXML 6.0
[28.10.2009|12:29] C:\Programme\nandub-binary-1.0rc2
[31.10.2008|14:07] C:\Programme\Nero
[09.04.2008|16:50] C:\Programme\NeroInstall.bak
[02.11.2008|17:35] C:\Programme\NetMeeting
[22.05.2009|02:45] C:\Programme\NetObjects
[04.11.2006|12:42] C:\Programme\Online Services
[04.11.2006|12:45] C:\Programme\Online-Dienste
[24.07.2007|18:25] C:\Programme\OO Software
[13.12.2009|20:17] C:\Programme\OpenXML-ODF Translator
[02.11.2008|17:34] C:\Programme\Outlook Express
[17.06.2008|20:26] C:\Programme\Paint.NET
[14.06.2008|03:40] C:\Programme\PC Inspector File Recovery
[15.11.2007|18:02] C:\Programme\PDF Blender
[03.09.2009|10:01] C:\Programme\PDF Editor 2
[09.08.2007|15:42] C:\Programme\PDFree
[05.11.2006|11:22] C:\Programme\Pegasys Inc
[25.05.2009|12:12] C:\Programme\phase5
[04.03.2008|11:59] C:\Programme\PixiePack Codec Pack
[10.12.2008|20:48] C:\Programme\PolarSoft
[04.01.2009|14:09] C:\Programme\QuickTime
[16.07.2007|17:15] C:\Programme\Ratajik Software
[27.09.2007|21:56] C:\Programme\ratDVD
[27.11.2007|17:48] C:\Programme\Reference Assemblies
[11.02.2009|00:08] C:\Programme\Registry Mechanic
[09.01.2009|15:43] C:\Programme\RouterControl
[17.01.2008|22:54] C:\Programme\SetEditEdision1600
[16.10.2007|15:00] C:\Programme\Skype
[18.10.2009|21:23] C:\Programme\SlySoft
[18.10.2009|16:18] C:\Programme\Spybot - Search & Destroy
[06.11.2006|12:48] C:\Programme\Steinberg
[24.10.2008|14:08] C:\Programme\SubRip
[04.11.2006|12:55] C:\Programme\Synaptics
[29.10.2007|21:52] C:\Programme\Tipp10
[05.11.2006|14:19] C:\Programme\Tools&More
[10.06.2009|15:47] C:\Programme\TopStyle3
[07.06.2009|23:49] C:\Programme\Trend Micro
[01.03.2009|22:31] C:\Programme\TrueCrypt
[13.04.2009|20:28] C:\Programme\TuneUp Utilities 2007
[14.04.2009|12:36] C:\Programme\TuneUpPortable
[12.10.2009|17:03] C:\Programme\Uniblue
[04.11.2006|12:53] C:\Programme\Uninstall Information
[04.11.2006|16:30] C:\Programme\Universal File Splitter & Merger
[17.12.2009|19:31] C:\Programme\VDownloader
[07.01.2008|13:46] C:\Programme\Vidalia Bundle
[04.11.2006|15:35] C:\Programme\VideoLAN
[05.11.2006|13:55] C:\Programme\Vimicro
[05.11.2006|11:26] C:\Programme\VirtualDub 1.6.1
[30.11.2007|16:46] C:\Programme\VirtualDubMod
[04.11.2006|19:27] C:\Programme\VOB
[13.05.2009|03:37] C:\Programme\Vodafone
[10.06.2009|15:48] C:\Programme\VstPlugins
[15.05.2009|17:51] C:\Programme\WBFS
[11.10.2009|19:51] C:\Programme\Windows Live
[30.03.2009|11:45] C:\Programme\Windows Live SkyDrive
[13.11.2007|18:09] C:\Programme\Windows Media Connect 2
[02.11.2008|17:34] C:\Programme\Windows Media Player
[02.11.2008|17:34] C:\Programme\Windows NT
[04.11.2006|15:27] C:\Programme\WindowsUpdate
[07.11.2009|15:30] C:\Programme\WinRAR
[04.11.2006|12:46] C:\Programme\xerox
[05.11.2006|11:13] C:\Programme\xp-AntiSpy
[0|Datei(en)] C:\Programme\Bytes
[154|Verzeichnis(se),] C:\Programme\Bytes frei

--------------------\\ Ordner Verzeichnis unter

C:\Programme\Gemeinsame Dateien

[19.08.2008|11:59] C:\Programme\Gemeinsame Dateien\ABBYY
[04.11.2006|15:56] C:\Programme\Gemeinsame Dateien\Acronis
[22.05.2009|20:15] C:\Programme\Gemeinsame Dateien\Adobe
[04.11.2008|00:33] C:\Programme\Gemeinsame Dateien\Ahead
[04.01.2009|14:11] C:\Programme\Gemeinsame Dateien\Apple
[04.11.2006|16:07] C:\Programme\Gemeinsame Dateien\DESIGNER
[04.11.2006|12:44] C:\Programme\Gemeinsame Dateien\Dienste
[08.06.2009|22:34] C:\Programme\Gemeinsame Dateien\DivX Shared
[08.02.2009|19:24] C:\Programme\Gemeinsame Dateien\DVDVideoSoft
[04.10.2007|13:47] C:\Programme\Gemeinsame Dateien\GTK
[07.10.2007|15:13] C:\Programme\Gemeinsame Dateien\Hewlett-Packard
[07.10.2007|15:16] C:\Programme\Gemeinsame Dateien\HP
[05.11.2006|13:55] C:\Programme\Gemeinsame Dateien\InstallShield
[04.11.2006|18:53] C:\Programme\Gemeinsame Dateien\Java
[29.05.2009|11:31] C:\Programme\Gemeinsame Dateien\Macromedia
[17.03.2008|21:57] C:\Programme\Gemeinsame Dateien\Macrovision

Shared
[12.10.2009|17:09] C:\Programme\Gemeinsame Dateien\Microsoft Shared
[04.11.2006|12:44] C:\Programme\Gemeinsame Dateien\MSSoap
[04.11.2006|12:08] C:\Programme\Gemeinsame Dateien\ODBC
[21.06.2008|11:37] C:\Programme\Gemeinsame Dateien\Skype
[04.11.2006|12:08] C:\Programme\Gemeinsame Dateien\SpeechEngines
[11.10.2009|19:52] C:\Programme\Gemeinsame Dateien\System
[30.03.2009|11:37] C:\Programme\Gemeinsame Dateien\Windows Live
[17.04.2008|00:50] C:\Programme\Gemeinsame

Dateien\WindowsLiveInstaller
[13.04.2009|20:28] C:\Programme\Gemeinsame Dateien\Wise Installation

Wizard
[0|Datei(en)] C:\Programme\Gemeinsame Dateien\Bytes
[27|Verzeichnis(se),] C:\Programme\Gemeinsame Dateien\Bytes frei

--------------------\\ Process

( 38 Processes )

... OK !

--------------------\\ Ueberpruefung mit S_Lop

Kein Lop Ordner gefunden !

--------------------\\ Suche nach Lop Dateien - Ordnern

Kein Lop Ordner gefunden !

--------------------\\ Suche innerhalb der Registry

..... OK !

--------------------\\ Ueberpruefung der Hosts Datei

Hosts Datei SAUBER

--------------------\\ Suche nach verborgenen Dateien mit Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by

Gmer, http://www.gmer.net
Rootkit scan 2009-12-19 10:43:52
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 361

--------------------\\ Suche nach anderen Infektionen

--------------------\\ Cracks & Keygens ..

C:\DOKUME~1\*\Startmenü\Programme\Da LAB\Traktor DJ Studio

3\Keygen.lnk

[F:13][D:5]-> C:\DOKUME~1\*\LOKALE~1\Temp
[F:2][D:0]-> C:\DOKUME~1\*\Cookies
[F:9][D:4]-> C:\DOKUME~1\*\LOKALE~1\TEMPOR~1\content.IE5

1 - "C:\Lop SD\LopR_1.txt" - 19.12.2009|10:58 - Option : [1]

--------------------\\ Scan beendet um 10:58:04

FBA · 19.12.2009, 11:29

Hier noch das GMER log, das hier in einem anderen Beitrag (s. hier

http://www.trojaner-board.de/79211-a...k-oeffnen.html)

schon für dieses Problem erwähnt wurde.

Vielleicht hilfts ja was!

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2009-12-19 09:29:59
Windows 5.1.2600 Service Pack 3
Running: utfq1w37.exe; Driver: C:\DOKUME~1\****\LOKALE~1\Temp\ffrdapog.sys

---- System - GMER 1.0.15 ----

SSDT B7FCC0E6 ZwCreateKey
SSDT B7FCC0DC ZwCreateThread
SSDT B7FCC0EB ZwDeleteKey
SSDT B7FCC0F5 ZwDeleteValueKey
SSDT sptd.sys ZwEnumerateKey [0xF743E84E]
SSDT sptd.sys ZwEnumerateValueKey [0xF743EBEE]
SSDT B7FCC0FA ZwLoadKey
SSDT sptd.sys ZwOpenKey [0xF7439090]
SSDT B7FCC0C8 ZwOpenProcess
SSDT B7FCC0CD ZwOpenThread
SSDT sptd.sys ZwQueryKey [0xF743ECC6]
SSDT sptd.sys ZwQueryValueKey [0xF743EB46]
SSDT B7FCC104 ZwReplaceKey
SSDT B7FCC0FF ZwRestoreKey
SSDT B7FCC0F0 ZwSetValueKey
SSDT B7FCC0D7 ZwTerminateProcess

---- Kernel code sections - GMER 1.0.15 ----

.text ntkrnlpa.exe!ZwCallbackReturn + 2480 80501CB8 4 Bytes CALL 4C111400
? C:\WINDOWS\system32\drivers\sptd.sys Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird.
.text C:\WINDOWS\System32\DRIVERS\ati2mtag.sys section is writeable [0xF5FFA000, 0x1B601E, 0xE8000020]
.text USBPORT.SYS!DllUnload F5FAA8AC 5 Bytes JMP 86FCC960
init C:\WINDOWS\system32\drivers\ALCXSENS.SYS entry point in "init" section [0xF5E7D590]
? System32\Drivers\a4tvxn69.SYS Das System kann den angegebenen Pfad nicht finden. !

---- Kernel IAT/EAT - GMER 1.0.15 ----

IAT atapi.sys[HAL.dll!READ_PORT_UCHAR] [F7439ABA] sptd.sys
IAT atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT] [F7439C00] sptd.sys
IAT atapi.sys[HAL.dll!READ_PORT_USHORT] [F7439B82] sptd.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT] [F743A72E] sptd.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_UCHAR] [F743A604] sptd.sys
IAT \SystemRoot\System32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [F744CA9A] sptd.sys

---- Devices - GMER 1.0.15 ----

Device \FileSystem\Ntfs \Ntfs 871651D8
Device \FileSystem\Udfs \UdfsCdRom 86A26980
Device \FileSystem\Udfs \UdfsDisk 86A26980

AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)

Device \Driver\usbuhci \Device\USBPDO-0 86F3E6A8
Device \Driver\usbuhci \Device\USBPDO-1 86F3E6A8
Device \Driver\usbuhci \Device\USBPDO-2 86F3E6A8
Device \Driver\usbehci \Device\USBPDO-3 87038980
Device \Driver\Ftdisk \Device\HarddiskVolume1 871D31D8

AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume1 snapman.sys (Acronis Snapshot API/Acronis)

Device \Driver\Ftdisk \Device\HarddiskVolume2 871D31D8

AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume2 snapman.sys (Acronis Snapshot API/Acronis)

Device \Driver\Cdrom \Device\CdRom0 86FB11D8
Device \Driver\Ftdisk \Device\HarddiskVolume3 871D31D8

AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume3 snapman.sys (Acronis Snapshot API/Acronis)

Device \Driver\Cdrom \Device\CdRom1 86FB11D8
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 [F7394B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\atapi \Device\Ide\IdePort0 [F7394B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\atapi \Device\Ide\IdePort1 [F7394B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-e [F7394B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\Cdrom \Device\CdRom2 86FB11D8
Device \Driver\Ftdisk \Device\HarddiskVolume4 871D31D8

AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume4 snapman.sys (Acronis Snapshot API/Acronis)

Device \Driver\Ftdisk \Device\HarddiskVolume5 871D31D8

AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume5 snapman.sys (Acronis Snapshot API/Acronis)

Device \Driver\Cdrom \Device\CdRom3 86FB11D8
Device \Driver\NetBT \Device\NetBt_Wins_Export 868D9980
Device \Driver\USBSTOR \Device\00000083 86D68980
Device \Driver\00000045 \Device\0000004a sptd.sys
Device \Driver\USBSTOR \Device\00000084 86D68980
Device \Driver\NetBT \Device\NetbiosSmb 868D9980
Device \Driver\USBSTOR \Device\00000085 86D68980
Device \Driver\USBSTOR \Device\00000086 86D68980
Device \Driver\NetBT \Device\NetBT_Tcpip_{0021001D-1B00-4DA8-A67A-89470ED3F8F8} 868D9980
Device \Driver\usbuhci \Device\USBFDO-0 86F3E6A8
Device \Driver\usbuhci \Device\USBFDO-1 86F3E6A8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 8698E4A0
Device \Driver\usbuhci \Device\USBFDO-2 86F3E6A8
Device \FileSystem\MRxSmb \Device\LanmanRedirector 8698E4A0
Device \Driver\usbehci \Device\USBFDO-3 87038980
Device \Driver\Ftdisk \Device\FtControl 871D31D8
Device \Driver\a4tvxn69 \Device\Scsi\a4tvxn691Port2Path0Target1Lun0 86FA5980
Device \Driver\a4tvxn69 \Device\Scsi\a4tvxn691 86FA5980
Device \Driver\a4tvxn69 \Device\Scsi\a4tvxn691Port2Path0Target0Lun0 86FA5980
Device \Driver\NetBT \Device\NetBT_Tcpip_{46AED3E9-0C1A-41F9-AC97-F92632C7B1B3} 868D9980
Device \FileSystem\Fastfat \Fat 86A1F980
Device \FileSystem\Fastfat \Fat B3FBC297

AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

Device \FileSystem\Cdfs \Cdfs 86ACC980

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Programme\DAEMON Tools\
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x5B 0x61 0x71 0xFD ...
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xAE 0xF4 0x89 0x07 ...
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x3E 0xB9 0xF2 0x79 ...
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41@khjeh 0xF7 0x53 0x17 0xF6 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Programme\DAEMON Tools\
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x48 0x4F 0x02 0x50 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xF8 0xED 0x8A 0x89 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x78 0x65 0x7F 0xC6 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Programme\DAEMON Tools\
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x27 0x5B 0x76 0x80 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xAE 0xF4 0x89 0x07 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x3E 0xB9 0xF2 0x79 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41@khjeh 0x42 0x51 0x52 0x84 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 -704598868
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 178765075
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Programme\DAEMON Tools\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x5B 0x61 0x71 0xFD ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xAE 0xF4 0x89 0x07 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x3E 0xB9 0xF2 0x79 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41@khjeh 0x6C 0x52 0xEE 0x7E ...
Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Programme\DAEMON Tools\
Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x5B 0x61 0x71 0xFD ...
Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xAE 0xF4 0x89 0x07 ...
Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x3E 0xB9 0xF2 0x79 ...
Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41@khjeh 0x6C 0x52 0xEE 0x7E ...
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System@OODEFRAG08.00.00.01WORKSTATION 365A54BF1FD34F17B261114C83081A688EC2DBA2C63836BA0F12E480385A11655B4203C319A69E329DDAA11EF86ED7F6A27B3E1D30463B7FA1A57477D87EE353FADEA3396BE934389A2816 3658FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C8EDD5E5BE2F6E667A9C6AECB7A5D1407A9C6AECB7A5D1407BA 7FD869164D6794FC3E22BC25ED47AA642F3107BB4F36C0393C05B07129FB184152293B5FDA919184E2A57FA9E7090D1A090D86F3AD848E3BC757749F1AF770ABC614835E003F27F9305D8D 0F7104127C96AD277333EDDCB564F74A2BB4ADF6F26C92118A26490E4AF877FDB31047A960754F598C0521460525CC1BFD60088B1567DA63031576103A9096880A0B19A56ECEA0AE288C00 4455A1337013C7267465E095A0F75942D963CF500E19F06FBCA34A43DD40F81E36A8F3FAFC7A5859598A81DE91AEC25D7CAE932E8D7A93790A4F95CFC2643C466054B9679258C82A467FFC 482301E52A6FDDBCAF2FDC06178A1863505CB60DF56904973129E68D50AB1283D765DB9AC00A84B0C5BB8124DA22F569C4CC71E3DE5D3332845E70E1BC5EE6CD050E40FCEC8A0AD5D520BF 088F9536DF9F5B5E80E5AA36B501F0D54711167218BE75436C2D912A1B3B700295B111F78547F2DBE4A4A5304FBA440CFD24EF01226498908EB526746FC
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@cd042efbbd7f7af1647644e76e06692b 0xE2 0x63 0x26 0xF1 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@bca643cdc5c2726b20d2ecedcc62c59b 0x71 0x3B 0x04 0x66 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@2c81e34222e8052573023a60d06dd016 0xFF 0x7C 0x85 0xE0 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@2582ae41fb52324423be06337561aa48 0x3E 0x1E 0x9E 0xE0 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@caaeda5fd7a9ed7697d9686d4b818472 0xF5 0x1D 0x4D 0x73 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@a4a1bcf2cc2b8bc3716b74b2b4522f5d 0xB0 0x18 0xED 0xA7 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@4d370831d2c43cd13623e232fed27b7b 0x97 0x20 0x4E 0x9A ...
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@1d68fe701cdea33e477eb204b76f993d 0x01 0x3A 0x48 0xFC ...
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@1fac81b91d8e3c5aa4b0a51804d844a3 0x51 0xFA 0x6E 0x91 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@f5f62a6129303efb32fbe080bb27835b 0xB1 0xCD 0x45 0x5A ...
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@fd4e2e1a3940b94dceb5a6a021f2e3c6 0xE3 0x0E 0x66 0xD5 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@8a8aec57dd6508a385616fbc86791ec2 0xFA 0xEA 0x66 0x7F ...

---- Files - GMER 1.0.15 ----

6144 bytes

---- EOF - GMER 1.0.15 ----

cosinus · 20.12.2009, 14:51

Zitat:

--------------------\\ Cracks & Keygens ..
C:\DOKUME~1\*\Startmenü\Programme\Da LAB\Traktor DJ Studio 3\Keygen.lnk

Sorry, hier ist Schluss.
Die (Be)nutzung von Cracks, Serials und Keygens ist illegal, somit gibt es im Trojaner-Board keinen weiteren Support mehr.

Für Dich geht es hier weiter => Neuaufsetzen des Systems
Bitte auch alle Passwörter abändern (für E-Mail-Konten, StudiVZ, Ebay...einfach alles!) da nicht selten in dieser dubiosen Software auch Keylogger und Backdoorfunktionen stecken.

Danach nie wieder sowas anrühren!

PENDRIVE - alle externen Datenträger werden umbenannt

Log-Analyse und Auswertung: PENDRIVE - alle externen Datenträger werden umbenannt