Nach Angriff von User Protection funktioniert das Sicherheitscenter weiterhin nicht

Badelatsche

Hallo StLB und Trojanerboard-Crew,

zunächst einmal vielen Dank für die schnelle Hilfe. Da du alles haargenau beschrieben hattest, war ich in der Lage deinen Anweisungen zu folgen.
Hier die gewünschte Logdatei, wobei mich wundert, dass nichts gefunden / entfernt wurde:

14:29:34:801 5788 TDSS rootkit removing tool 2.2.8.1 Mar 22 2010 10:43:04
14:29:34:801 5788 ================================================================================
14:29:34:801 5788 SystemInfo:

14:29:34:801 5788 OS Version: 6.0.6002 ServicePack: 2.0
14:29:34:801 5788 Product type: Workstation
14:29:34:801 5788 ComputerName: ST32E5
14:29:34:801 5788 UserName: Oliver
14:29:34:801 5788 Windows directory: C:\Windows
14:29:34:801 5788 Processor architecture: Intel x86
14:29:34:801 5788 Number of processors: 2
14:29:34:801 5788 Page size: 0x1000
14:29:34:801 5788 Boot type: Normal boot
14:29:34:801 5788 ================================================================================
14:29:34:817 5788 UnloadDriverW: NtUnloadDriver error 2
14:29:34:817 5788 ForceUnloadDriverW: UnloadDriverW(klmd21) error 2
14:29:34:863 5788 wfopen_ex: Trying to open file C:\Windows\system32\config\system
14:29:34:863 5788 wfopen_ex: MyNtCreateFileW error 32 (C0000043)
14:29:34:863 5788 wfopen_ex: Trying to KLMD file open
14:29:34:863 5788 wfopen_ex: File opened ok (Flags 2)
14:29:34:895 5788 wfopen_ex: Trying to open file C:\Windows\system32\config\software
14:29:34:895 5788 wfopen_ex: MyNtCreateFileW error 32 (C0000043)
14:29:34:895 5788 wfopen_ex: Trying to KLMD file open
14:29:34:910 5788 wfopen_ex: File opened ok (Flags 2)
14:29:34:910 5788 Initialize success
14:29:34:910 5788
14:29:34:910 5788 Scanning Services ...
14:29:35:784 5788 Raw services enum returned 438 services
14:29:35:799 5788
14:29:35:799 5788 Scanning Kernel memory ...
14:29:35:799 5788 Devices to scan: 1
14:29:35:799 5788
14:29:35:799 5788 Driver Name: atapi
14:29:35:799 5788 IRP_MJ_CREATE : 878F1140
14:29:35:799 5788 IRP_MJ_CREATE_NAMED_PIPE : 8222DA22
14:29:35:799 5788 IRP_MJ_CLOSE : 878F1140
14:29:35:799 5788 IRP_MJ_READ : 8222DA22
14:29:35:799 5788 IRP_MJ_WRITE : 8222DA22
14:29:35:799 5788 IRP_MJ_QUERY_INFORMATION : 8222DA22
14:29:35:799 5788 IRP_MJ_SET_INFORMATION : 8222DA22
14:29:35:799 5788 IRP_MJ_QUERY_EA : 8222DA22
14:29:35:799 5788 IRP_MJ_SET_EA : 8222DA22
14:29:35:799 5788 IRP_MJ_FLUSH_BUFFERS : 8222DA22
14:29:35:799 5788 IRP_MJ_QUERY_VOLUME_INFORMATION : 8222DA22
14:29:35:799 5788 IRP_MJ_SET_VOLUME_INFORMATION : 8222DA22
14:29:35:799 5788 IRP_MJ_DIRECTORY_CONTROL : 8222DA22
14:29:35:799 5788 IRP_MJ_FILE_SYSTEM_CONTROL : 8222DA22
14:29:35:799 5788 IRP_MJ_DEVICE_CONTROL : 878DFA5A
14:29:35:799 5788 IRP_MJ_INTERNAL_DEVICE_CONTROL : 878DFA2C
14:29:35:799 5788 IRP_MJ_SHUTDOWN : 8222DA22
14:29:35:799 5788 IRP_MJ_LOCK_CONTROL : 8222DA22
14:29:35:799 5788 IRP_MJ_CLEANUP : 8222DA22
14:29:35:799 5788 IRP_MJ_CREATE_MAILSLOT : 8222DA22
14:29:35:799 5788 IRP_MJ_QUERY_SECURITY : 8222DA22
14:29:35:799 5788 IRP_MJ_SET_SECURITY : 8222DA22
14:29:35:799 5788 IRP_MJ_POWER : 878DFA88
14:29:35:799 5788 IRP_MJ_SYSTEM_CONTROL : 878ECB70
14:29:35:799 5788 IRP_MJ_DEVICE_CHANGE : 8222DA22
14:29:35:799 5788 IRP_MJ_QUERY_QUOTA : 8222DA22
14:29:35:799 5788 IRP_MJ_SET_QUOTA : 8222DA22
14:29:35:815 5788 C:\Windows\system32\drivers\atapi.sys - Verdict: 1
14:29:35:815 5788
14:29:35:815 5788 Completed
14:29:35:815 5788
14:29:35:815 5788 Results:
14:29:35:815 5788 Memory objects infected / cured / cured on reboot: 0 / 0 / 0
14:29:35:815 5788 Registry objects infected / cured / cured on reboot: 0 / 0 / 0
14:29:35:815 5788 File objects infected / cured / cured on reboot: 0 / 0 / 0
14:29:35:815 5788
14:29:35:831 5788 fclose_ex: Trying to close file C:\Windows\system32\config\system
14:29:35:831 5788 fclose_ex: Trying to close file C:\Windows\system32\config\software
14:29:35:831 5788 KLMD(ARK) unloaded successfully

Bin gespannt, was du daraus entnehmen kannst, denn mein Sicherheitscenter funzt momentan noch nicht...