Tja auch nach dem 3. Versuch passiert nichts.blaues Fenster geht auf, verschwindet und nichts passiert.hab auch den komletten leitfaden gelesen.nun ist wohl guter Rat teuer.

Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus


Downloade Dir danach bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.

• Doppelklick auf die MBRCheck.exe.
  Vista und Win7 User mit Rechtsklick "als Administrator starten"
• Das Tool braucht nur eine Sekunde.
• Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.

Poste mir bitte den Inhalt des .txt Dokumentes

hier der scan mit GMER

GMER Logfile:

GMER 1.0.15.15477 - hxxp://www.gmer.net
Rootkit scan 2010-10-19 17:13:31
Windows 6.0.6002 Service Pack 2
Running: uctit4zf.exe; Driver: C:\Users\Heidi\AppData\Local\Temp\awlcipob.sys


---- Kernel code sections - GMER 1.0.15 ----

.text           C:\Windows\system32\DRIVERS\tos_sps32.sys                                                            section is writeable [0x88D5C000, 0x4036D, 0xE8000020]
.dsrt           C:\Windows\system32\DRIVERS\tos_sps32.sys                                                            unknown last section [0x88DA5000, 0x510, 0x40000040]
.text           C:\Windows\system32\drivers\ACEDRV07.sys                                                             section is writeable [0xA860B000, 0x328BA, 0xE8000020]
.pklstb         C:\Windows\system32\drivers\ACEDRV07.sys                                                             entry point in ".pklstb" section [0xA864F000]
.relo2          C:\Windows\system32\drivers\ACEDRV07.sys                                                             unknown last section [0xA866B000, 0x8E, 0x42000040]
.reloc          C:\Windows\system32\drivers\acedrv11.sys                                                             section is executable [0xAB70C300, 0x25D4C, 0xE0000060]

---- User IAT/EAT - GMER 1.0.15 ----

IAT             C:\Windows\Explorer.EXE[2976] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown]                [730E7817] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[2976] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage]                 [7313A86D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[2976] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI]             [730EBB22] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[2976] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode]       [730DF695] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[2976] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup]                 [730E75E9] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[2976] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC]              [730DE7CA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[2976] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStreamICM]  [73118395] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[2976] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStream]     [730EDA60] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[2976] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight]             [730DFFFA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[2976] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth]              [730DFF61] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[2976] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage]               [730D71CF] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[2976] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFileICM]       [7316CAE2] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[2976] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFile]          [7310C8D8] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[2976] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics]             [730DD968] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[2976] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree]                       [730D6853] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[2976] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc]                      [730D687E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[2976] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode]         [730E2AD1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

---- Devices - GMER 1.0.15 ----

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                                                              Wdf01000.sys (Kernelmodustreiber-Frameworklaufzeit/Microsoft Corporation)
AttachedDevice  \Driver\kbdclass \Device\KeyboardClass1                                                              Wdf01000.sys (Kernelmodustreiber-Frameworklaufzeit/Microsoft Corporation)
AttachedDevice  \Driver\tdx \Device\Tcp                                                                              Lbd.sys (Boot Driver/Lavasoft AB)

---- Registry - GMER 1.0.15 ----

Reg             HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\0015833a4e24                          
Reg             HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\0015833a4e24 (not active ControlSet)      

---- EOF - GMER 1.0.15 ----
         

--- --- ---

die weiteren folgen dann im anschluß.



OSAM Scan

OSAM Logfile:

Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 17:24:11 on 19.10.2010

OS: Windows Vista Home Premium Edition Service Pack 2 (Build 6002), 32-bit
Default Browser: Mozilla Corporation Firefox 3.6.10

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[AppInit DLLs]
-----( HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows )-----
"AppInit_DLLs" - "Google" - C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL

[Boot Execute]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Session Manager )-----
"BootExecute" - ? - C:\Windows\system32\lsdelete.exe  (File found, but it contains no detailed information)

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"TOSCDSPD.cpl" - "TOSHIBA" - C:\Windows\system32\TOSCDSPD.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"mlcfg32.cpl" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\MLCFG32.CPL
"Nero BurnRights" - "Nero AG" - C:\Program Files\Nero\Nero8\Nero Toolkit\NeroBurnRights.cpl
"QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"ACEDRV07" (ACEDRV07) - "Protect Software GmbH" - C:\Windows\system32\drivers\ACEDRV07.sys
"acedrv11" (acedrv11) - "Protect Software GmbH" - C:\Windows\system32\drivers\acedrv11.sys
"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys
"awlcipob" (awlcipob) - ? - C:\Users\Heidi\AppData\Local\Temp\awlcipob.sys  (Hidden registry entry, rootkit activity | File not found)
"IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys  (File not found)
"IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys  (File not found)
"IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys  (File not found)
"SoC PC-Camera" (SoC PC-Camera Service) - ? - C:\Windows\System32\DRIVERS\pfc027.sys
"Sony Ericsson Device 125 driver (WDM)" (s125bus) - "MCCI Corporation" - C:\Windows\System32\DRIVERS\s125bus.sys
"Sony Ericsson Device 125 USB WMC Device Management Drivers (WDM)" (s125mgmt) - "MCCI Corporation" - C:\Windows\System32\DRIVERS\s125mgmt.sys
"Sony Ericsson Device 125 USB WMC Modem Driver" (s125mdm) - "MCCI Corporation" - C:\Windows\System32\DRIVERS\s125mdm.sys
"Sony Ericsson Device 125 USB WMC Modem Filter" (s125mdfl) - "MCCI Corporation" - C:\Windows\System32\DRIVERS\s125mdfl.sys
"Sony Ericsson Device 125 USB WMC OBEX Interface" (s125obex) - "MCCI Corporation" - C:\Windows\System32\DRIVERS\s125obex.sys
"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys
"StarOpen" (StarOpen) - ? - C:\Windows\system32\drivers\StarOpen.sys  (File found, but it contains no detailed information)

[Explorer]
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{7D4D6379-F301-4311-BEBA-E26EB0561882} "NeroDigitalColumnHandler Class" - "Nero AG" - C:\Program Files\Common Files\Nero\Lib\NeroDigitalExt.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
{828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
{88FED34C-F0CA-4636-A375-3CB6248B04CD} "Local Groove Web Services Protocol" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - c:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll
{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----
{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? -   (File not found | COM-object registry key not found)
{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)
{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)
{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802} "Adobe.Acrobat.ContextMenu" - ? -   (File not found | COM-object registry key not found)
{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? -   (File not found | COM-object registry key not found)
{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? -   (File not found | COM-object registry key not found)
{99FD978C-D287-4F50-827F-B2C658EDA8E7} "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} "Groove Explorer Icon Overlay 2 (GFS Stub)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{920E6DB1-9907-4370-B3A0-BAFC03D81399} "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{16F3DD56-1AF5-4347-846D-7C10C4192619} "Groove Explorer Icon Overlay 3 (GFS Folder)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{2916C86E-86A6-43FE-8112-43ABE6BF8DCC} "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{2A541AE1-5BF6-4665-A8A3-CFA9672E4291} "Groove Folder Synchronization" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{6C467336-8281-4E60-8204-430CED96822D} "Groove GFS Context Menu Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{A449600E-1DC6-4232-B948-9BD794D62056} "Groove GFS Stub Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{387E725D-DC16-4D76-B310-2C93ED4752A0} "Groove XML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? -   (File not found | COM-object registry key not found)
{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - E:\iTunes\iTunesMiniPlayer.dll
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\msohevi.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\ONFILTER.DLL
{00020d75-0000-0000-c000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\MLSHEXT.DLL
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{97F68CE3-7146-45FF-BE24-D9A7DD7CB8A2} "NeroCoverEdLiveIcons Class" - "Nero AG" - C:\Program Files\Nero\Nero8\Nero CoverDesigner\CoverEdExtension.dll
{B327765E-D724-4347-8B16-78AE18552FC3} "NeroDigitalIconHandler Class" - "Nero AG" - C:\Program Files\Common Files\Nero\Lib\NeroDigitalExt.dll
{7F1CF152-04F8-453A-B34C-E609530A9DC8} "NeroDigitalPropSheetHandler Class" - "Nero AG" - C:\Program Files\Common Files\Nero\Lib\NeroDigitalExt.dll
{0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\OLKFSTUB.DLL
{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)
{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll
{738D66C6-0149-4D40-84E4-A7BB2D0CE949} "Sony Ericsson Datei-Manager" - ? -   (File not found | COM-object registry key not found)
{00DF1F20-0849-A4D1-0239-00D0AF3E9CB0} "TuneUp Shredder Shell Context Menu Extension" - "TuneUp Software GmbH" - C:\Program Files\TuneUp Utilities\sdshelex.dll
{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -   (File not found | COM-object registry key not found)

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
ITBar7Height "ITBar7Height" - ? -   (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)
<binary data> "ITBarLayout" - ? -   (File not found | COM-object registry key not found)
-----( HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks )-----
{E312764E-7706-43F1-8DAB-FCDD2B1E416D} "SearchSettings Class" - "Spigot, Inc." - C:\Program Files\Search Settings\SearchSettings.dll
{EF99BD32-C1FB-11D2-892F-0090271D4F88} "Yahoo! Toolbar mit Pop-Up-Blocker" - ? -   (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{4C39376E-FA9D-4349-BACC-D305C1750EF3} "EPUImageControl Class" - "eBay, Inc." - C:\Windows\Downloaded Program Files\EPUWALcontrol.dll / hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-24-0.cab
{C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} "EPUImageControl Class" - "eBay, Inc." - C:\Windows\Downloaded Program Files\EPUWALcontrol.dll / hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-29-0.cab
{5D637FAD-E202-48D1-8F18-5B9C459BD1E3} "Image Uploader Control" - "Aurigma, Inc." - C:\Windows\Downloaded Program Files\ImageUploader5.ocx / hxxp://express.foto.com/ImageUploader5.cab
{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} "Java Plug-in 1.6.0_03" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} "Java Plug-in 1.6.0_07" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_16" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} "Java Plug-in 1.6.0_16" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_16" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_16.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
{9C23D886-43CB-43DE-B2DB-112A68D7E10A} "MySpace Uploader Control" - "MySpace" - C:\Windows\Downloaded Program Files\MySpaceUploader2.ocx / hxxp://lads.myspace.com/upload/MySpaceUploader2.cab
{D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" - "Adobe Systems, Inc." - C:\Windows\system32\Macromed\Flash\Flash10c.ocx / hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
{E2883E8F-472F-4FB0-9522-AC9BF37916A7} "{E2883E8F-472F-4FB0-9522-AC9BF37916A7}" - ? -   (File not found | COM-object registry key not found) / hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
"Amazon.de" - ? - hxxp://www.amazon.de/exec/obidos/redirect-home?tag=Toshibadebholink-21&site=home  (HTTP value)
{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
{53707962-6F74-2D53-2644-206D7942484F} "ClsidExtension" - "Safer Networking Limited" - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
"eBay - Der weltweite Online Marktplatz" - ? - hxxp://rover.ebay.com/rover/1/707-44556-9400-3/4  (HTTP value)
"ICQ6" - "ICQ, LLC." - C:\Program Files\ICQ6.5\ICQ.exe
"PalTalk" - ? - C:\Program Files\Paltalk Messenger\Paltalk.exe  (File not found)
{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll
{E312764E-7706-43F1-8DAB-FCDD2B1E416D} "SearchSettings Class" - "Spigot, Inc." - C:\Program Files\Search Settings\SearchSettings.dll
{53707962-6F74-2D53-2644-206D7942484F} "Spybot-S&D IE Protection" - "Safer Networking Limited" - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\Users\Heidi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"msnmsgr" - "Microsoft Corporation" - "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----
"StartupPrograms" - ? - rdpclip  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"avgnt" - "Avira GmbH" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
"HSON" - "TOSHIBA Corporation" - %ProgramFiles%\TOSHIBA\TBS\HSON.exe
"iTunesHelper" - "Apple Inc." - "E:\iTunes\iTunesHelper.exe"
"QuickTime Task" - "Apple Inc." - "C:\Program Files\QuickTime\QTTask.exe" -atboottime
"SearchSettings" - "Spigot, Inc." - C:\Program Files\Search Settings\SearchSettings.exe

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"Adobe PDF Port" - ? - C:\Windows\system32\AdobePDF.dll  (File not found)
"Canon BJ Language Monitor MP520 series" - "CANON INC." - C:\Windows\system32\CNMLM94.DLL
"PDFCreator" - ? - C:\Windows\system32\pdfcmnnt.dll  (File found, but it contains no detailed information)
"Redirected Port" - ? - C:\Windows\system32\redmonnt.dll  (File found, but it contains no detailed information)
"Send To Microsoft OneNote Monitor" - "Microsoft Corporation" - C:\Windows\system32\msonpmon.dll

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
"Application Updater" (Application Updater) - "Spigot, Inc." - C:\Program Files\Application Updater\ApplicationUpdater.exe
"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\sched.exe
"ConfigFree Service" (ConfigFree Service) - "TOSHIBA CORPORATION" - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
"CyberGhost VPN Client" (CGVPNCliSrvc) - "mobile concepts GmbH" - C:\Program Files\S.A.D\CyberGhost VPN\CGVPNCliService.exe
"Dienst "Bonjour"" (Bonjour Service) - "Apple Inc." - C:\Program Files\Bonjour\mDNSResponder.exe
"GoogleDesktopManager" (GoogleDesktopManager) - "Google" - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Program Files\iPod\bin\iPodService.exe
"Lavasoft Ad-Aware Service" (Lavasoft Ad-Aware Service) - "Lavasoft" - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
"Microsoft Office Groove Audit Service" (Microsoft Office Groove Audit Service) - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe
"Nero BackItUp Scheduler 3" (Nero BackItUp Scheduler 3) - "Nero AG" - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
"NMIndexingService" (NMIndexingService) - "Nero AG" - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"TOSHIBA Navi Support Service" (TNaviSrv) - "TOSHIBA Corporation" - C:\Program Files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe
"TOSHIBA Optical Disc Drive Service" (TODDSrv) - "TOSHIBA Corporation" - C:\Windows\system32\TODDSrv.exe
"TOSHIBA Power Saver" (TosCoSrv) - "TOSHIBA Corporation" - c:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
"TOSHIBA SMART Log Service" (TOSHIBA SMART Log Service) - "TOSHIBA Corporation" - c:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe
"Ulead Burning Helper" (UleadBurningHelper) - "Ulead Systems, Inc." - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

[Winsock Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----
"mdnsNSP" - "Apple Inc." - C:\Program Files\Bonjour\mdnsNSP.dll

===[ Logfile end ]=========================================[ Logfile end ]===
         

--- --- ---

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

und der letzte Scan

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows Vista Home Premium Edition
Windows Information: Service Pack 2 (build 6002), 32-bit
Base Board Manufacturer: Intel Corp.
BIOS Manufacturer: INSYDE
System Manufacturer: TOSHIBA
System Product Name: Satellite L350
Logical Drives Mask: 0x00000034

Kernel Drivers (total 153):
0x82A1A000 \SystemRoot\system32\ntkrnlpa.exe
0x82DD3000 \SystemRoot\system32\hal.dll
0x8040D000 \SystemRoot\system32\kdcom.dll
0x80414000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x80484000 \SystemRoot\system32\PSHED.dll
0x80495000 \SystemRoot\system32\BOOTVID.dll
0x8049D000 \SystemRoot\system32\CLFS.SYS
0x804DE000 \SystemRoot\system32\CI.dll
0x80609000 \SystemRoot\system32\drivers\Wdf01000.sys
0x8067A000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x80688000 \SystemRoot\system32\drivers\acpi.sys
0x806CE000 \SystemRoot\system32\drivers\WMILIB.SYS
0x806D7000 \SystemRoot\system32\drivers\msisadrv.sys
0x806DF000 \SystemRoot\system32\drivers\pci.sys
0x80706000 \SystemRoot\System32\drivers\partmgr.sys
0x80715000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x80718000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x80722000 \SystemRoot\system32\drivers\volmgr.sys
0x80731000 \SystemRoot\System32\drivers\volmgrx.sys
0x8077B000 \SystemRoot\system32\drivers\intelide.sys
0x80782000 \SystemRoot\system32\drivers\PCIIDEX.SYS
0x80790000 \SystemRoot\System32\drivers\mountmgr.sys
0x88601000 \SystemRoot\system32\DRIVERS\iaStor.sys
0x886C9000 \SystemRoot\system32\drivers\atapi.sys
0x886D1000 \SystemRoot\system32\drivers\ataport.SYS
0x886EF000 \SystemRoot\system32\drivers\msahci.sys
0x886F9000 \SystemRoot\system32\drivers\fltmgr.sys
0x8872B000 \SystemRoot\system32\drivers\fileinfo.sys
0x8873B000 \SystemRoot\system32\DRIVERS\Lbd.sys
0x8874A000 \SystemRoot\System32\Drivers\ksecdd.sys
0x88802000 \SystemRoot\system32\drivers\ndis.sys
0x8890D000 \SystemRoot\system32\drivers\msrpc.sys
0x88938000 \SystemRoot\system32\drivers\NETIO.SYS
0x88A00000 \SystemRoot\System32\drivers\tcpip.sys
0x88AEA000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x88C0D000 \SystemRoot\System32\Drivers\Ntfs.sys
0x88D1D000 \SystemRoot\system32\drivers\volsnap.sys
0x88D56000 \SystemRoot\system32\DRIVERS\TVALZ_O.SYS
0x88D5B000 \SystemRoot\system32\DRIVERS\tos_sps32.sys
0x88DA6000 \SystemRoot\System32\Drivers\spldr.sys
0x88DAE000 \SystemRoot\System32\Drivers\mup.sys
0x88DBD000 \SystemRoot\System32\drivers\ecache.sys
0x88DE4000 \SystemRoot\system32\drivers\disk.sys
0x88B05000 \SystemRoot\system32\drivers\CLASSPNP.SYS
0x88DF5000 \SystemRoot\system32\drivers\crcdisk.sys
0x88BEE000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x88973000 \SystemRoot\system32\DRIVERS\tunmp.sys
0x8897C000 \SystemRoot\system32\DRIVERS\FwLnk.sys
0x88984000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x88BF9000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0x8CC0D000 \SystemRoot\system32\DRIVERS\igdkmd32.sys
0x8D244000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x8D2E3000 \SystemRoot\System32\drivers\watchdog.sys
0x8D2EF000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0x8D2FA000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x8D338000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x8D347000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x8D3D4000 \SystemRoot\system32\DRIVERS\Rtlh86.sys
0x88993000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x8D3F1000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x889A6000 \SystemRoot\system32\DRIVERS\SynTP.sys
0x8D3FC000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x8CC00000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x889D5000 \SystemRoot\system32\DRIVERS\tdcmdpst.sys
0x889D9000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x889F1000 \SystemRoot\System32\Drivers\GEARAspiWDM.sys
0x887BB000 \SystemRoot\system32\DRIVERS\msiscsi.sys
0x807A0000 \SystemRoot\system32\DRIVERS\storport.sys
0x887EA000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x807E1000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x887F5000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x805BE000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x805E1000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x8D404000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x8D418000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x8D42D000 \SystemRoot\system32\DRIVERS\tap0901.sys
0x8D434000 \SystemRoot\System32\Drivers\pcouffin.sys
0x8D440000 \SystemRoot\system32\DRIVERS\termdd.sys
0x8D450000 \SystemRoot\system32\DRIVERS\swenum.sys
0x8D452000 \SystemRoot\system32\DRIVERS\ks.sys
0x8D47C000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x8D486000 \SystemRoot\system32\DRIVERS\umbus.sys
0x8D493000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x8D4C8000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x8D800000 \SystemRoot\system32\drivers\RTKVHDA.sys
0x8D4D9000 \SystemRoot\system32\drivers\portcls.sys
0x8D506000 \SystemRoot\system32\drivers\drmk.sys
0x8D52B000 \SystemRoot\system32\DRIVERS\HSXHWAZL.sys
0x8DA00000 \SystemRoot\system32\DRIVERS\HSX_DPV.sys
0x8DB03000 \SystemRoot\system32\DRIVERS\HSX_CNXT.sys
0x8DBB8000 \SystemRoot\system32\drivers\modem.sys
0x8DBC5000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0x8DBCE000 \SystemRoot\System32\Drivers\Null.SYS
0x8DBD5000 \SystemRoot\System32\Drivers\Beep.SYS
0x8DBDC000 \SystemRoot\System32\drivers\vga.sys
0x8D569000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x8DBE8000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x8DBF0000 \SystemRoot\system32\drivers\rdpencdd.sys
0x8D9F5000 \SystemRoot\System32\Drivers\Msfs.SYS
0x8D58A000 \SystemRoot\System32\Drivers\Npfs.SYS
0x8D598000 \SystemRoot\System32\DRIVERS\rasacd.sys
0x8D5A1000 \SystemRoot\system32\DRIVERS\tdx.sys
0x8D5B7000 \SystemRoot\system32\DRIVERS\smb.sys
0x8DC05000 \SystemRoot\system32\drivers\afd.sys
0x8DC4D000 \SystemRoot\System32\DRIVERS\netbt.sys
0x8DC7F000 \SystemRoot\system32\DRIVERS\pacer.sys
0x8DC95000 \SystemRoot\system32\DRIVERS\rtlprot.sys
0x8DC9F000 \SystemRoot\system32\DRIVERS\netbios.sys
0x8DCAD000 \SystemRoot\System32\Drivers\StarOpen.SYS
0x8DCB3000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x8DCC6000 \SystemRoot\system32\DRIVERS\ssmdrv.sys
0x8DCCC000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x8DD08000 \SystemRoot\system32\drivers\nsiproxy.sys
0x8DD12000 \SystemRoot\System32\Drivers\dfsc.sys
0x8DD29000 \SystemRoot\system32\DRIVERS\avipbb.sys
0x8DD4B000 \SystemRoot\system32\DRIVERS\hidusb.sys
0x8DD54000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x8DD64000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x8DD6B000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x8DD73000 \SystemRoot\system32\DRIVERS\RTL8187B.sys
0x8DDC3000 \SystemRoot\System32\Drivers\crashdmp.sys
0x88B26000 \SystemRoot\System32\Drivers\dump_iaStor.sys
0x95420000 \SystemRoot\System32\win32k.sys
0x8DDD0000 \SystemRoot\System32\drivers\Dxapi.sys
0x8DDDA000 \SystemRoot\system32\DRIVERS\monitor.sys
0x95640000 \SystemRoot\System32\TSDDD.dll
0x95660000 \SystemRoot\System32\cdd.dll
0x8D5CB000 \SystemRoot\system32\drivers\luafv.sys
0xA860A000 \??\C:\Windows\system32\drivers\ACEDRV07.sys
0xA866C000 \SystemRoot\system32\drivers\spsys.sys
0xA871C000 \SystemRoot\system32\DRIVERS\lltdio.sys
0xA872C000 \SystemRoot\system32\DRIVERS\nwifi.sys
0xA8756000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xA8760000 \SystemRoot\system32\DRIVERS\rspndr.sys
0xA8773000 \SystemRoot\system32\drivers\HTTP.sys
0xA87E0000 \SystemRoot\System32\DRIVERS\srvnet.sys
0x8D5E6000 \SystemRoot\system32\DRIVERS\bowser.sys
0x8DDE9000 \SystemRoot\System32\drivers\mpsdrv.sys
0xAB60A000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xAB629000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0xAB662000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0xAB67A000 \SystemRoot\System32\DRIVERS\srv2.sys
0xAB6A2000 \SystemRoot\System32\DRIVERS\srv.sys
0xAB6F0000 \??\C:\Windows\system32\drivers\acedrv11.sys
0xAB733000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys
0xAC809000 \SystemRoot\system32\drivers\peauth.sys
0xAC8E7000 \SystemRoot\system32\DRIVERS\avgntflt.sys
0xAC8FC000 \SystemRoot\System32\Drivers\secdrv.SYS
0xAC906000 \SystemRoot\System32\drivers\tcpipreg.sys
0xAC912000 \SystemRoot\system32\DRIVERS\xaudio.sys
0xAC91A000 \SystemRoot\system32\DRIVERS\cdfs.sys
0xAC930000 \??\C:\Users\Heidi\AppData\Local\Temp\awlcipob.sys
0x76F20000 \Windows\System32\ntdll.dll

Processes (total 72):
0 System Idle Process
4 System
448 C:\Windows\System32\smss.exe
588 csrss.exe
632 C:\Windows\System32\wininit.exe
644 csrss.exe
676 C:\Windows\System32\services.exe
688 C:\Windows\System32\lsass.exe
696 C:\Windows\System32\lsm.exe
772 C:\Windows\System32\winlogon.exe
888 C:\Windows\System32\svchost.exe
932 C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
976 C:\Windows\System32\svchost.exe
1016 C:\Windows\System32\svchost.exe
1104 C:\Windows\System32\svchost.exe
1176 C:\Windows\System32\svchost.exe
1224 C:\Windows\System32\svchost.exe
1280 C:\Windows\System32\audiodg.exe
1300 C:\Windows\System32\svchost.exe
1320 C:\Windows\System32\SLsvc.exe
1376 C:\Windows\System32\svchost.exe
1504 C:\Windows\System32\svchost.exe
1628 C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
1728 C:\Windows\System32\spoolsv.exe
1760 C:\Program Files\Avira\AntiVir Desktop\sched.exe
1772 C:\Windows\System32\svchost.exe
1992 C:\Program Files\Avira\AntiVir Desktop\avguard.exe
2032 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
224 C:\Program Files\Application Updater\ApplicationUpdater.exe
296 C:\Program Files\Bonjour\mDNSResponder.exe
320 C:\Windows\System32\svchost.exe
340 C:\Program Files\S.A.D\CyberGhost VPN\CGVPNCliService.exe
476 C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
564 C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
1200 C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
1980 C:\Windows\System32\svchost.exe
2064 C:\Windows\System32\svchost.exe
2104 C:\Program Files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe
2144 C:\Windows\System32\TODDSrv.exe
2180 C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
2216 C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe
2288 C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
2316 C:\Windows\System32\svchost.exe
2336 C:\Windows\System32\SearchIndexer.exe
2380 C:\Windows\System32\drivers\XAudio.exe
2648 C:\Windows\System32\taskeng.exe
2928 C:\Windows\System32\dwm.exe
2968 C:\Windows\System32\taskeng.exe
2976 C:\Windows\explorer.exe
3136 unsecapp.exe
3328 WmiPrvSE.exe
3524 C:\Program Files\Windows Defender\MSASCui.exe
3544 C:\Windows\System32\igfxtray.exe
3552 C:\Windows\System32\hkcmd.exe
3616 C:\Windows\System32\igfxpers.exe
3652 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
3688 E:\iTunes\iTunesHelper.exe
3700 C:\Program Files\Search Settings\SearchSettings.exe
3708 C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
3748 C:\Windows\System32\igfxsrvc.exe
3632 C:\Program Files\Windows Media Player\wmpnscfg.exe
3776 C:\Program Files\Windows Media Player\wmpnetwk.exe
156 C:\Program Files\iPod\bin\iPodService.exe
1744 C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
3388 C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
2712 C:\Program Files\Opera\opera.exe
3040 C:\Windows\System32\SearchProtocolHost.exe
3928 C:\Windows\System32\SearchFilterHost.exe
4072 dllhost.exe
2948 dllhost.exe
2756 C:\Users\Heidi\Downloads\MBRCheck.exe
3420 C:\Windows\System32\conime.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`5dd00000 (NTFS)
\\.\E: --> \\.\PhysicalDrive0 at offset 0x00000025`9c100000 (NTFS)

PhysicalDrive0 Model Number: TOSHIBAMK3252GSX, Rev: LV010M

Size Device Name MBR Status
--------------------------------------------
298 GB \\.\PhysicalDrive0 Windows 2008 MBR code detected
SHA1: 8DF43F2BDE2D9451948FA14B5279969C777A7979


Done!

Sieht alles ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SUPERAntiSpyware und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

Zitat von cosinus

Sieht alles ok aus.

hmm das glaube ich nicht

der erste scan:

SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 10/19/2010 at 08:37 PM

Application Version : 4.44.1000

Core Rules Database Version : 5711
Trace Rules Database Version: 3523

Scan type : Complete Scan
Total Scan Time : 00:50:53

Memory items scanned : 671
Memory threats detected : 0
Registry items scanned : 10867
Registry threats detected : 0
File items scanned : 31746
File threats detected : 4

Adware.Tracking Cookie
C:\Users\Heidi\AppData\Roaming\Microsoft\Windows\Cookies\heidi@atdmt[1].txt
statse.webtrendslive.com [ C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\0hisgm7f.default\cookies.sqlite ]
static1.pornturbo.com [ C:\Users\Heidi\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\3KG875N3 ]

Trojan.Agent/Gen-Cryptor[Virut]
C:\TOSHIBA\WEBSHOPS\ADDEBAYTOOLBARBUTTON.EXE

mach jetzt den 2.

Der Virut ist ein Fehlalarm. Hab ich jetzt schon mehrere Male gesehen, dass angeblich in genau diesem Toshiba-Ordner sowas sein soll
Das andere sind nur harmlose Cookies, Du kannst also entspannt sein.

okay das beruhigt mich

denn der letzte scan zeigt nichts mehr an.

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4883

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18975

19.10.2010 22:17:52
mbam-log-2010-10-19 (22-17-52).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|E:\|)
Durchsuchte Objekte: 307712
Laufzeit: 1 Stunde(n), 32 Minute(n), 40 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

mit anderen worten es war kein befall oder du hast ihn wegbekommen?

mit anderen worten es war kein befall oder du hast ihn wegbekommen?

Jep, oder hast noch Probleme? Oder andere Funde?

Zitat von cosinus

Jep, oder hast noch Probleme? Oder andere Funde?

Befall oder nicht ?

Nein, ich habe ebend mal firefox und outlook getestet und es sceint wirklich wieder zu laufen.Ich beobachte das mal ein paar Tage

Ich sage an dieser Stelle tausend Dank für Deine Hilfe. Es ist für mich immer wieder erstaunlich, das es Leute gibt, die aus diesen riesen Zahlenkolonnen die richtigen Schlüsse ziehen können und in der Lage sind, den Leuten diese Läuse aus den Pelz zu treiben. RESPEKT dafür.

Dann wären wir durch!

Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.


Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update



PDF-Reader aktualisieren
Dein Adobe Reader ist nicht aktuell, was ein großes Sicherheitsrisiko darstellt. Du solltest daher besser die alte Version über Systemsteuerung => Software deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst.

Ich empfehle einen alternativen PDF-Reader wie SumatraPDF oder Foxit PDF Reader, beide sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers, hier der direkte Downloadlink => http://filepony.de/?q=Flash+Player


Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.

Jup, ich werde abschließend diese von Dir genannten Dinge durchführen. Und noch einmal vielen Dank für Deine kompetente und vor allem für jedermann verständliche Hilfe !!

eine letzte Frage habe ich noch Arne, der Interesse halber.

Ist diese Abhandlung die gängige Praxis? Ich meine falls ich der Meinung bin das mich wieder was "befallen" hat kann ich das Prozedere so wiederholen oder ist das von Fall zu Fall verschieden?

Thorsten