Antivir und andere Virenprogramme starten nicht / Rootkit?

GumbuEsquire

Guten Abend,

bei mir lassen sich seit gestern Virenprogramme nicht mehr starten. Da anscheinend im Moment mehrere dieses Problem haben, habe ich mich, soweit ich konnte, schonmal bei anderen Threads schlau gemacht.

Soweit ich das überblicke, handelt es sich um "Rootkit".

Gmer spuckt dazu Folgendes aus:

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-01-03 17:43:40
Windows 5.1.2600 Service Pack 3
Running: cew3mevn.exe; Driver: C:\DOKUME~1\Jasper\LOKALE~1\Temp\pglyifow.sys


---- System - GMER 1.0.15 ----

Code 826A10D0 ZwEnumerateKey
Code 826A1958 ZwFlushInstructionCache
Code \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) FsRtlCheckLockForReadAccess
Code \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) IoIsOperationSynchronous
Code 826B14A6 IofCallDriver
Code 826A460E IofCompleteRequest

---- Kernel code sections - GMER 1.0.15 ----

.text ntoskrnl.exe!IofCallDriver 804E37C5 5 Bytes JMP 826B14AB
.text ntoskrnl.exe!IofCompleteRequest 804E3BF6 5 Bytes JMP 826A4613
PAGE ntoskrnl.exe!ZwFlushInstructionCache 8056E42A 5 Bytes JMP 826A195C
PAGE ntoskrnl.exe!ZwEnumerateKey 805735A4 5 Bytes JMP 826A10D4

---- User code sections - GMER 1.0.15 ----

.text C:\Programme\Mozilla Firefox\firefox.exe[4004] WS2_32.dll!closesocket 71A13E2B 5 Bytes JMP 0263000A
.text C:\Programme\Mozilla Firefox\firefox.exe[4004] WS2_32.dll!connect 71A14A07 5 Bytes JMP 0262000A
.text C:\Programme\Mozilla Firefox\firefox.exe[4004] WS2_32.dll!send 71A14C27 5 Bytes JMP 0264000A

---- Kernel IAT/EAT - GMER 1.0.15 ----

IAT \SystemRoot\System32\DRIVERS\tcpip.sys[ntoskrnl.exe!IoCreateDevice] [F372C6D0] \??\C:\WINDOWS.0\system32\drivers\kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT \SystemRoot\System32\DRIVERS\tcpip.sys[TDI.SYS!TdiRegisterDeviceObject] [F372C820] \??\C:\WINDOWS.0\system32\drivers\kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT \SystemRoot\System32\DRIVERS\netbt.sys[ntoskrnl.exe!IoCreateDevice] [F372C6D0] \??\C:\WINDOWS.0\system32\drivers\kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT \SystemRoot\System32\DRIVERS\netbt.sys[TDI.SYS!TdiRegisterDeviceObject] [F372C820] \??\C:\WINDOWS.0\system32\drivers\kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT \SystemRoot\System32\drivers\afd.sys[ntoskrnl.exe!IoCreateDevice] [F372C6D0] \??\C:\WINDOWS.0\system32\drivers\kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT \SystemRoot\System32\Drivers\Fips.SYS[ntoskrnl.exe!IoCreateDevice] [F372C6D0] \??\C:\WINDOWS.0\system32\drivers\kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT \SystemRoot\System32\DRIVERS\ipnat.sys[ntoskrnl.exe!IoCreateDevice] [F372C6D0] \??\C:\WINDOWS.0\system32\drivers\kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT \SystemRoot\System32\DRIVERS\wanarp.sys[ntoskrnl.exe!IoCreateDevice] [F372C6D0] \??\C:\WINDOWS.0\system32\drivers\kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT \SystemRoot\System32\Drivers\Cdfs.SYS[ntoskrnl.exe!IoCreateDevice] [F372C6D0] \??\C:\WINDOWS.0\system32\drivers\kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT \SystemRoot\System32\DRIVERS\irda.sys[ntoskrnl.exe!IoCreateDevice] [F372C6D0] \??\C:\WINDOWS.0\system32\drivers\kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT \SystemRoot\System32\DRIVERS\ndisuio.sys[ntoskrnl.exe!IoCreateDevice] [F372C6D0] \??\C:\WINDOWS.0\system32\drivers\kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT \SystemRoot\System32\DRIVERS\mrxdav.sys[ntoskrnl.exe!IoCreateDevice] [F372C6D0] \??\C:\WINDOWS.0\system32\drivers\kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT \SystemRoot\System32\Drivers\ParVdm.SYS[ntoskrnl.exe!IoCreateDevice] [F372C6D0] \??\C:\WINDOWS.0\system32\drivers\kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT \SystemRoot\System32\DRIVERS\srv.sys[ntoskrnl.exe!IoCreateDevice] [F372C6D0] \??\C:\WINDOWS.0\system32\drivers\kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT \SystemRoot\system32\drivers\wdmaud.sys[ntoskrnl.exe!IoCreateDevice] [F372C6D0] \??\C:\WINDOWS.0\system32\drivers\kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT \SystemRoot\system32\drivers\sysaudio.sys[ntoskrnl.exe!IoCreateDevice] [F372C6D0] \??\C:\WINDOWS.0\system32\drivers\kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT \SystemRoot\System32\Drivers\HTTP.sys[ntoskrnl.exe!IoCreateDevice] [F372C6D0] \??\C:\WINDOWS.0\system32\drivers\kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT \SystemRoot\System32\DRIVERS\usbprint.sys[ntoskrnl.exe!IoCreateDevice] [F372C6D0] \??\C:\WINDOWS.0\system32\drivers\kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2010\klwtblfs.exe[832] @ C:\WINDOWS.0\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00ED2F30] C:\Programme\Gemeinsame Dateien\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2010\klwtblfs.exe[832] @ C:\WINDOWS.0\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00ED2CA0] C:\Programme\Gemeinsame Dateien\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2010\klwtblfs.exe[832] @ C:\WINDOWS.0\system32\kernel32.dll [ntdll.dll!NtClose] [00ED2D00] C:\Programme\Gemeinsame Dateien\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2010\klwtblfs.exe[832] @ C:\WINDOWS.0\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00ED2CD0] C:\Programme\Gemeinsame Dateien\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Dokumente und Einstellungen\Jasper\Desktop\cew3mevn.exe[2036] @ C:\WINDOWS.0\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00F72F30] C:\Programme\Gemeinsame Dateien\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Dokumente und Einstellungen\Jasper\Desktop\cew3mevn.exe[2036] @ C:\WINDOWS.0\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00F72CA0] C:\Programme\Gemeinsame Dateien\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Dokumente und Einstellungen\Jasper\Desktop\cew3mevn.exe[2036] @ C:\WINDOWS.0\system32\kernel32.dll [ntdll.dll!NtClose] [00F72D00] C:\Programme\Gemeinsame Dateien\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Dokumente und Einstellungen\Jasper\Desktop\cew3mevn.exe[2036] @ C:\WINDOWS.0\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00F72CD0] C:\Programme\Gemeinsame Dateien\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS.0\Explorer.EXE[2140] @ C:\WINDOWS.0\Explorer.EXE [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINDOWS.0\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINDOWS.0\Explorer.EXE[2140] @ C:\WINDOWS.0\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00A92F30] C:\Programme\Gemeinsame Dateien\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS.0\Explorer.EXE[2140] @ C:\WINDOWS.0\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00A92CA0] C:\Programme\Gemeinsame Dateien\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS.0\Explorer.EXE[2140] @ C:\WINDOWS.0\system32\kernel32.dll [ntdll.dll!NtClose] [00A92D00] C:\Programme\Gemeinsame Dateien\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS.0\Explorer.EXE[2140] @ C:\WINDOWS.0\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00A92CD0] C:\Programme\Gemeinsame Dateien\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS.0\Explorer.EXE[2140] @ C:\WINDOWS.0\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINDOWS.0\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINDOWS.0\Explorer.EXE[2140] @ C:\WINDOWS.0\system32\RPCRT4.dll [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINDOWS.0\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINDOWS.0\Explorer.EXE[2140] @ C:\WINDOWS.0\system32\Secur32.dll [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINDOWS.0\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINDOWS.0\Explorer.EXE[2140] @ C:\WINDOWS.0\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINDOWS.0\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINDOWS.0\Explorer.EXE[2140] @ C:\WINDOWS.0\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINDOWS.0\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINDOWS.0\Explorer.EXE[2140] @ C:\WINDOWS.0\system32\msvcrt.dll [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINDOWS.0\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINDOWS.0\Explorer.EXE[2140] @ C:\WINDOWS.0\system32\ole32.dll [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINDOWS.0\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINDOWS.0\Explorer.EXE[2140] @ C:\WINDOWS.0\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINDOWS.0\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINDOWS.0\Explorer.EXE[2140] @ C:\WINDOWS.0\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINDOWS.0\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINDOWS.0\Explorer.EXE[2140] @ C:\WINDOWS.0\system32\NETAPI32.dll [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINDOWS.0\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINDOWS.0\Explorer.EXE[2140] @ C:\WINDOWS.0\system32\WININET.dll [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINDOWS.0\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINDOWS.0\Explorer.EXE[2140] @ C:\WINDOWS.0\system32\SHELL32.dll [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINDOWS.0\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINDOWS.0\Explorer.EXE[2140] @ C:\WINDOWS.0\system32\USERENV.dll [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINDOWS.0\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINDOWS.0\Explorer.EXE[2140] @ C:\WINDOWS.0\system32\WS2_32.dll [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINDOWS.0\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINDOWS.0\Explorer.EXE[2140] @ C:\WINDOWS.0\system32\WS2HELP.dll [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINDOWS.0\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINDOWS.0\Explorer.EXE[2140] @ C:\WINDOWS.0\system32\PSAPI.DLL [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINDOWS.0\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINDOWS.0\Explorer.EXE[2140] @ C:\WINDOWS.0\system32\iphlpapi.dll [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINDOWS.0\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINDOWS.0\System32\sistray.EXE[2468] @ C:\WINDOWS.0\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00C42F30] C:\Programme\Gemeinsame Dateien\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS.0\System32\sistray.EXE[2468] @ C:\WINDOWS.0\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00C42CA0] C:\Programme\Gemeinsame Dateien\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS.0\System32\sistray.EXE[2468] @ C:\WINDOWS.0\system32\kernel32.dll [ntdll.dll!NtClose] [00C42D00] C:\Programme\Gemeinsame Dateien\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS.0\System32\sistray.EXE[2468] @ C:\WINDOWS.0\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00C42CD0] C:\Programme\Gemeinsame Dateien\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS.0\System32\khooker.exe[2488] @ C:\WINDOWS.0\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00CD2F30] C:\Programme\Gemeinsame Dateien\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS.0\System32\khooker.exe[2488] @ C:\WINDOWS.0\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00CD2CA0] C:\Programme\Gemeinsame Dateien\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS.0\System32\khooker.exe[2488] @ C:\WINDOWS.0\system32\kernel32.dll [ntdll.dll!NtClose] [00CD2D00] C:\Programme\Gemeinsame Dateien\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS.0\System32\khooker.exe[2488] @ C:\WINDOWS.0\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00CD2CD0] C:\Programme\Gemeinsame Dateien\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe[2532] @ C:\WINDOWS.0\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00EC2F30] C:\Programme\Gemeinsame Dateien\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe[2532] @ C:\WINDOWS.0\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00EC2CA0] C:\Programme\Gemeinsame Dateien\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe[2532] @ C:\WINDOWS.0\system32\kernel32.dll [ntdll.dll!NtClose] [00EC2D00] C:\Programme\Gemeinsame Dateien\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe[2532] @ C:\WINDOWS.0\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00EC2CD0] C:\Programme\Gemeinsame Dateien\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\Gemeinsame Dateien\LogiShrd\LComMgr\Communications_Helper.exe[2632] @ C:\WINDOWS.0\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00CF2F30] C:\Programme\Gemeinsame Dateien\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\Gemeinsame Dateien\LogiShrd\LComMgr\Communications_Helper.exe[2632] @ C:\WINDOWS.0\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00CF2CA0] C:\Programme\Gemeinsame Dateien\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\Gemeinsame Dateien\LogiShrd\LComMgr\Communications_Helper.exe[2632] @ C:\WINDOWS.0\system32\kernel32.dll [ntdll.dll!NtClose] [00CF2D00] C:\Programme\Gemeinsame Dateien\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\Gemeinsame Dateien\LogiShrd\LComMgr\Communications_Helper.exe[2632] @ C:\WINDOWS.0\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00CF2CD0] C:\Programme\Gemeinsame Dateien\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS.0\system32\ctfmon.exe[2764] @ C:\WINDOWS.0\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00AB2F30] C:\Programme\Gemeinsame Dateien\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS.0\system32\ctfmon.exe[2764] @ C:\WINDOWS.0\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00AB2CA0] C:\Programme\Gemeinsame Dateien\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS.0\system32\ctfmon.exe[2764] @ C:\WINDOWS.0\system32\kernel32.dll [ntdll.dll!NtClose] [00AB2D00] C:\Programme\Gemeinsame Dateien\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS.0\system32\ctfmon.exe[2764] @ C:\WINDOWS.0\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00AB2CD0] C:\Programme\Gemeinsame Dateien\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS.0\system32\wuauclt.exe[2808] @ C:\WINDOWS.0\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00AA2F30] C:\Programme\Gemeinsame Dateien\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS.0\system32\wuauclt.exe[2808] @ C:\WINDOWS.0\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00AA2CA0] C:\Programme\Gemeinsame Dateien\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS.0\system32\wuauclt.exe[2808] @ C:\WINDOWS.0\system32\kernel32.dll [ntdll.dll!NtClose] [00AA2D00] C:\Programme\Gemeinsame Dateien\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS.0\system32\wuauclt.exe[2808] @ C:\WINDOWS.0\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00AA2CD0] C:\Programme\Gemeinsame Dateien\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\Microsoft Office\Office10\WINWORD.EXE[2932] @ C:\WINDOWS.0\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00BB2F30] C:\Programme\Gemeinsame Dateien\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\Microsoft Office\Office10\WINWORD.EXE[2932] @ C:\WINDOWS.0\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00BB2CA0] C:\Programme\Gemeinsame Dateien\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\Microsoft Office\Office10\WINWORD.EXE[2932] @ C:\WINDOWS.0\system32\kernel32.dll [ntdll.dll!NtClose] [00BB2D00] C:\Programme\Gemeinsame Dateien\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\Microsoft Office\Office10\WINWORD.EXE[2932] @ C:\WINDOWS.0\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00BB2CD0] C:\Programme\Gemeinsame Dateien\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\Mozilla Firefox\firefox.exe[4004] @ C:\WINDOWS.0\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00C12F30] C:\Programme\Gemeinsame Dateien\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\Mozilla Firefox\firefox.exe[4004] @ C:\WINDOWS.0\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00C12CA0] C:\Programme\Gemeinsame Dateien\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\Mozilla Firefox\firefox.exe[4004] @ C:\WINDOWS.0\system32\kernel32.dll [ntdll.dll!NtClose] [00C12D00] C:\Programme\Gemeinsame Dateien\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\Mozilla Firefox\firefox.exe[4004] @ C:\WINDOWS.0\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00C12CD0] C:\Programme\Gemeinsame Dateien\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)

---- Devices - GMER 1.0.15 ----

AttachedDevice \Driver\Tcpip \Device\Ip kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
AttachedDevice \Driver\Tcpip \Device\Tcp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
AttachedDevice \Driver\Tcpip \Device\Udp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
AttachedDevice \Driver\Tcpip \Device\RawIp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)

---- Modules - GMER 1.0.15 ----

Module \systemroot\system32\drivers\H8SRTbaviyqvppp.sys (*** hidden *** ) F3C11000-F3C2E000 (118784 bytes)
---- Processes - GMER 1.0.15 ----

Library \\?\globalroot\systemroot\system32\H8SRTqxlxmrxqjy.dll (*** hidden *** ) @ C:\WINDOWS.0\System32\svchost.exe [136] 0x10000000
Library \\?\globalroot\systemroot\system32\H8SRTqxlxmrxqjy.dll (*** hidden *** ) @ C:\WINDOWS.0\System32\svchost.exe [436] 0x10000000
Library \\?\globalroot\systemroot\system32\H8SRTqxlxmrxqjy.dll (*** hidden *** ) @ C:\WINDOWS.0\System32\svchost.exe [1016] 0x10000000
Library \\?\globalroot\systemroot\system32\H8SRTqxlxmrxqjy.dll (*** hidden *** ) @ C:\WINDOWS.0\system32\svchost.exe [1336] 0x00D00000
Library \\?\globalroot\systemroot\system32\H8SRTqxlxmrxqjy.dll (*** hidden *** ) @ C:\WINDOWS.0\system32\svchost.exe [1536] 0x10000000
Library \\?\globalroot\systemroot\system32\H8SRTqxlxmrxqjy.dll (*** hidden *** ) @ C:\WINDOWS.0\System32\svchost.exe [1704] 0x10000000
Library \\?\globalroot\systemroot\system32\H8SRTqxlxmrxqjy.dll (*** hidden *** ) @ C:\WINDOWS.0\System32\svchost.exe [1904] 0x10000000
Library \\?\globalroot\systemroot\system32\H8SRTqxlxmrxqjy.dll (*** hidden *** ) @ C:\WINDOWS.0\Explorer.EXE [2140] 0x10000000
Library \\?\globalroot\systemroot\system32\H8SRTqpuirvakoo.dll (*** hidden *** ) @ C:\Programme\Mozilla Firefox\firefox.exe [4004] 0x10000000

---- Services - GMER 1.0.15 ----

Service C:\WINDOWS.0\system32\drivers\H8SRTbaviyqvppp.sys (*** hidden *** ) [SYSTEM] H8SRTd.sys <-- ROOTKIT !!!

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys@start 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys@type 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys@imagepath \systemroot\system32\drivers\H8SRTbaviyqvppp.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys@group file system
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys\modules
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys\modules@H8SRTd \\?\globalroot\systemroot\system32\drivers\H8SRTbaviyqvppp.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys\modules@H8SRTc \\?\globalroot\systemroot\system32\H8SRTqowykmovrg.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys\modules@H8SRTsrcr \\?\globalroot\systemroot\system32\H8SRTrrprqrdylq.dat
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys\modules@h8srtserf \\?\globalroot\systemroot\system32\H8SRTqxlxmrxqjy.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys\modules@h8srtbbr \\?\globalroot\systemroot\system32\H8SRTqpuirvakoo.dll
Reg HKLM\SYSTEM\ControlSet002\Services\H8SRTd.sys (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\H8SRTd.sys@start 1
Reg HKLM\SYSTEM\ControlSet002\Services\H8SRTd.sys@type 1
Reg HKLM\SYSTEM\ControlSet002\Services\H8SRTd.sys@imagepath \systemroot\system32\drivers\H8SRTbaviyqvppp.sys
Reg HKLM\SYSTEM\ControlSet002\Services\H8SRTd.sys@group file system
Reg HKLM\SYSTEM\ControlSet002\Services\H8SRTd.sys\modules (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\H8SRTd.sys\modules@H8SRTd \\?\globalroot\systemroot\system32\drivers\H8SRTbaviyqvppp.sys
Reg HKLM\SYSTEM\ControlSet002\Services\H8SRTd.sys\modules@H8SRTc \\?\globalroot\systemroot\system32\H8SRTqowykmovrg.dll
Reg HKLM\SYSTEM\ControlSet002\Services\H8SRTd.sys\modules@H8SRTsrcr \\?\globalroot\systemroot\system32\H8SRTrrprqrdylq.dat
Reg HKLM\SYSTEM\ControlSet002\Services\H8SRTd.sys\modules@h8srtserf \\?\globalroot\systemroot\system32\H8SRTqxlxmrxqjy.dll
Reg HKLM\SYSTEM\ControlSet002\Services\H8SRTd.sys\modules@h8srtbbr \\?\globalroot\systemroot\system32\H8SRTqpuirvakoo.dll


In anderen Threads habe ich nun gelesen, dass ich mit Avenger Herr des Problems werden kann. Ich weiß allerdings nicht, wie ich das Script hierfür gestalten muss.

Für jede Hilfe bin ich sehr dankbar.

@ Chris4You: Dir jetzt schon einmal besten Dank!!!

Grüße

Gumbu