Hallom
gmer ist zweimal abgestürzt. Lief aber schonmal durch siehe erster Post.
OSAM log.
OSAM Logfile:

Report of OSAM: Autorun Manager v5.0.11926.0
Online Solutions. Complex Protection for Information Systems
Saved at 21:38:56 on 08.12.2010

OS: Windows XP Home Edition Service Pack 3 (Build 2600)
Default Browser: Mozilla Corporation Firefox 3.6.10

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Common]
-----( %SystemRoot%\Tasks )-----
"AppleSoftwareUpdate.job" - "Apple Inc." - C:\Programme\Apple Software Update\SoftwareUpdate.exe

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"bdeadmin.cpl" - ? - C:\WINDOWS\system32\bdeadmin.cpl
"javacpl.cpl" - "Sun Microsystems, Inc." - C:\WINDOWS\system32\javacpl.cpl
"S7epaepx.cpl" - "SIEMENS AG" - C:\WINDOWS\system32\S7epaepx.cpl
"S7EPATDX.CPL" - "SIEMENS AG" - C:\WINDOWS\system32\S7EPATDX.CPL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"Adobe Gamma" - "Adobe Systems, Inc." - C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma.cpl
"Avira AntiVir Personal" - "Avira GmbH" - C:\PROGRA~1\Avira\ANTIVI~1\avconfig.cpl
"ECSEPM" - "Sony Ericsson Mobile Communications AB" - C:\Programme\Sony Ericsson\Mobile2\Mobile Phone Monitor\ecsepm.cpl
"QuickTime" - "Apple Inc." - C:\Programme\QuickTime\QTSystem\QuickTime.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"ASPI32" (ASPI32) - "Adaptec" - C:\WINDOWS\system32\drivers\ASPI32.sys
"avgio" (avgio) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avgio.sys
"avgntflt" (avgntflt) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avipbb.sys
"catchme" (catchme) - ? - C:\DOKUME~1\martin\LOKALE~1\Temp\catchme.sys  (File not found)
"Changer" (Changer) - ? - C:\WINDOWS\system32\drivers\Changer.sys  (File not found)
"dgderdrv" (dgderdrv) - "Devguru Co., Ltd" - C:\WINDOWS\System32\drivers\dgderdrv.sys
"DirectNT" (DirectNT) - "c't" - C:\WINDOWS\system32\drivers\DirectNT.sys
"FsUsbExDisk" (FsUsbExDisk) - ? - C:\WINDOWS\system32\FsUsbExDisk.SYS  (File found, but it contains no detailed information)
"gstpaloph" (gstpaloph) - ? - C:\WINDOWS\system32\drivers\gstpaloph.sys  (File not found)
"i2omgmt" (i2omgmt) - ? - C:\WINDOWS\system32\drivers\i2omgmt.sys  (File not found)
"INO_FLPY" (INO_FLPY) - "Computer Associates" - C:\WINDOWS\System32\Drivers\ino_flpy.sys
"INO_FLTR" (INO_FLTR) - "Computer Associates" - C:\WINDOWS\system32\Drivers\ino_fltr.sys
"lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys  (File not found)
"ModiTel" (BALU) - ? - C:\WINDOWS\System32\DRIVERS\balu.sys
"Motorola USB Modem Driver for MPT" (usbsermpt) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\usbsermpt.sys
"MxlW2k" (MxlW2k) - "MusicMatch, Inc." - C:\WINDOWS\system32\drivers\MxlW2k.sys
"Navman In-car Navigator USB Driver Service" (Navcar) - "NAVMAN" - C:\WINDOWS\System32\DRIVERS\Navcar.sys
"PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys  (File not found)
"PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys  (File not found)
"PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys  (File not found)
"PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys  (File not found)
"PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys  (File not found)
"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\WINDOWS\System32\Drivers\PxHelp20.sys
"s7oppitx" (s7oppitx) - "SIEMENS AG" - C:\WINDOWS\System32\Drivers\S7oppitx.sys
"s7otranx" (s7otranx) - "SIEMENS AG" - C:\WINDOWS\System32\Drivers\S7otranx.sys
"Siemens PC/PPI Cable" (S7oppilx) - "SIEMENS AG" - C:\WINDOWS\System32\Drivers\S7oppilx.sys
"Sony Ericsson W800 driver (WDM)" (w800bus) - "MCCI" - C:\WINDOWS\System32\DRIVERS\w800bus.sys
"Sony Ericsson W800 USB WMC Device Management Drivers" (w800mgmt) - "MCCI" - C:\WINDOWS\System32\DRIVERS\w800mgmt.sys
"Sony Ericsson W800 USB WMC Modem Drivers" (w800mdm) - "MCCI" - C:\WINDOWS\System32\DRIVERS\w800mdm.sys
"Sony Ericsson W800 USB WMC Modem Filter" (w800mdfl) - "MCCI" - C:\WINDOWS\System32\DRIVERS\w800mdfl.sys
"Sony Ericsson W800 USB WMC OBEX Interface Drivers" (w800obex) - "MCCI" - C:\WINDOWS\System32\DRIVERS\w800obex.sys
"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\ssmdrv.sys
"TerraTec Cinergy T² (BDA)" (TTCinergyT2) - "TerraTec Electronic GmbH" - C:\WINDOWS\System32\DRIVERS\TTCinergyT2BDA.sys
"WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys  (File not found)

[Explorer]
-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----
{89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{0561EC90-CE54-4f0c-9C55-E226110A740C} "Haali Column Provider" - ? - C:\Programme\Haali\MatroskaSplitter\mmfinfo.dll  (File found, but it contains no detailed information)
{7D4D6379-F301-4311-BEBA-E26EB0561882} "NeroDigitalColumnHandler Class" - "Nero AG" - C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroDigitalExt.dll
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Programme\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
-----( HKLM\Software\Classes\Protocols\Handler )-----
{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~1\MSNMES~1\msgrapp.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - ? - C:\Programme\7-Zip\7-zip.dll
{42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? - deskpan.dll  (File not found)
{B28C18DB-6816-4F31-9630-397683E3C2C3} "Filzip Shell Extension" - ? - C:\Programme\Filzip\fzshext.dll
{1D2680C9-0E2A-469d-B787-065558BC7D43} "Fusion Cache" - "Microsoft Corporation" - c:\WINDOWS\system32\mscoree.dll
{0561EC90-CE54-4f0c-9C55-E226110A740C} "Haali Column Provider" - ? - C:\Programme\Haali\MatroskaSplitter\mmfinfo.dll  (File found, but it contains no detailed information)
{5574006C-28F5-4a65-A28C-74DE6BFBE0BB} "Haali Matroska Shell Property Page" - ? - C:\Programme\Haali\MatroskaSplitter\mmfinfo.dll  (File found, but it contains no detailed information)
{327669A0-59A7-4be9-B99E-1C9F3A57611A} "Haali Matroska Thumbnail Extractor" - ? - C:\Programme\Haali\MatroskaSplitter\mmfinfo.dll  (File found, but it contains no detailed information)
{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? -   (File not found | COM-object registry key not found)
{DCED20BE-3645-11D4-BC95-00C04F0E0588} "InoShell" - ? -   (File not found | COM-object registry key not found)
{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Programme\iTunes\iTunesMiniPlayer.dll
{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? -   (File not found | COM-object registry key not found)
{B327765E-D724-4347-8B16-78AE18552FC3} "NeroDigitalIconHandler Class" - "Nero AG" - C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroDigitalExt.dll
{7F1CF152-04F8-453A-B34C-E609530A9DC8} "NeroDigitalPropSheetHandler Class" - "Nero AG" - C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroDigitalExt.dll
{63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice Property Sheet Handler" - ? - C:\Programme\StarOffice7\program\shlxthdl.dll
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\shlext.dll
{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll
{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? -   (File not found | COM-object registry key not found)
{e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll
{03DAACC5-10BA-4E3E-9D54-2A569F6B4B87} "Sony Ericsson Datei-Manager" - "Popwire AB" - C:\Programme\Sony Ericsson\Mobile2\File Manager\FM.dll
{738D66C6-0149-4D40-84E4-A7BB2D0CE949} "Sony Ericsson Datei-Manager" - "Popwire AB" - C:\Programme\Sony Ericsson\Mobile2\File Manager\FM.dll
{7020EDF4-B454-4814-9AA4-1D604D3F1417} "TraXExCM" - "Alexander Miehlke Softwareentwicklung" - C:\Programme\TraXEx\Integration\TraXExCM.dll

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
ITBar7Height "ITBar7Height" - ? -   (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_22" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_22.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} "Java Plug-in 1.6.0_22" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_22.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_22" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_22.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
{02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} "QuickTime Object" - "Apple Inc." - C:\Programme\QuickTime\QTPlugin.ocx / hxxp://www.apple.com/qtactivex/qtplugin.cab
{D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" - "Adobe Systems, Inc." - C:\WINDOWS\system32\Macromed\Flash\Flash10a.ocx / hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
{17492023-C23A-453E-A040-C7C580BBF700} "Windows Genuine Advantage Validation Tool" - "Microsoft Corporation" - C:\WINDOWS\system32\LegitCheckControl.DLL / hxxp://go.microsoft.com/fwlink/?linkid=39204
{166B1BCA-3F9C-11CF-8075-444553540000} "{166B1BCA-3F9C-11CF-8075-444553540000}" - ? -   (File not found | COM-object registry key not found) / hxxp://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab
{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA} "{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA}" - ? -   (File not found | COM-object registry key not found) / Java Plug-in Technology
{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA} "{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA}" - ? -   (File not found | COM-object registry key not found) / hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_03-windows-i586.cab
{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} "{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}" - ? -   (File not found | COM-object registry key not found) / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab
{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} "{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}" - ? -   (File not found | COM-object registry key not found) / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} "{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}" - ? -   (File not found | COM-object registry key not found) / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} "{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}" - ? -   (File not found | COM-object registry key not found) / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} "{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}" - ? -   (File not found | COM-object registry key not found) / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{53707962-6F74-2D53-2644-206D7942484F} "ClsidExtension" - "Safer Networking Limited" - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
{AD6E6555-FB2C-47D4-8339-3E2965509877} "&TerraTec Home Cinema" - "TerraTec Electronic GmbH" - C:\PROGRA~1\TerraTec\TERRAT~1\THCDES~1.DLL
{327C2873-E90D-4c37-AA9D-10AC9BABA46C} "Easy-WebPrint" - ? - C:\Programme\Canon\Easy-WebPrint\Toolband.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "Adobe PDF Reader Link Helper" - "Adobe Systems Incorporated" - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jp2ssv.dll
{E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
{53707962-6F74-2D53-2644-206D7942484F} "Spybot-S&D IE Protection" - "Safer Networking Limited" - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
{68F9551E-0411-48E4-9AAF-4BC42A6A46BE} "{68F9551E-0411-48E4-9AAF-4BC42A6A46BE}" - ? -   (File not found | COM-object registry key not found)
{AA58ED58-01DD-4d91-8333-CF10577473F7} "{AA58ED58-01DD-4d91-8333-CF10577473F7}" - ? -   (File not found | COM-object registry key not found)
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} "{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}" - ? -   (File not found | COM-object registry key not found)
{C84D72FE-E17D-4195-BB24-76C02E2E7C4E} "{C84D72FE-E17D-4195-BB24-76C02E2E7C4E}" - ? -   (File not found | COM-object registry key not found)

[Logon]
-----( %AllUsersProfile%\Startmenü\Programme\Autostart )-----
"desktop.ini" - ? - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini
-----( %UserProfile%\Startmenü\Programme\Autostart )-----
"Adobe Gamma.lnk" - "Adobe Systems, Inc." - C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe  (Shortcut exists | File exists)
"desktop.ini" - ? - C:\Dokumente und Einstellungen\martin\Startmenü\Programme\Autostart\desktop.ini
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"SpybotSD TeaTimer" - "Safer-Networking Ltd." - C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"AppleSyncNotifier" - "Apple Inc." - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
"avgnt" - "Avira GmbH" - "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min
"FLMOFFICE4DMOUSE" - ? - C:\Programme\Browser MOUSE\mouse32a.exe
"iTunesHelper" - "Apple Inc." - "C:\Programme\iTunes\iTunesHelper.exe"
"mmtask" - "Musicmatch Inc." - C:\Programme\Musicmatch\Musicmatch Jukebox\mmtask.exe
"NeroFilterCheck" - "Ahead Software Gmbh" - C:\WINDOWS\system32\NeroCheck.exe
"QuickTime Task" - "Apple Inc." - "C:\Programme\QuickTime\QTTask.exe" -atboottime
"RemoteControl" - "Cyberlink Corp." - "C:\Programme\Home Cinema\PowerDVD\PDVDServ.exe"
"Sony Ericsson PC Suite" - ? - "C:\Programme\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe"

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"Adobe LM Service" (Adobe LM Service) - "Adobe Systems" - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
"Anwendungsverwaltung" (AppMgmt) - ? - C:\WINDOWS\System32\appmgmts.dll  (File not found)
"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
"ASP.NET State Service" (aspnet_state) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avguard.exe
"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\sched.exe
"Device Error Recovery Service" (dgdersvc) - "Devguru Co., Ltd." - C:\WINDOWS\system32\dgdersvc.exe
"eTrust Antivirus Job Server" (InoTask) - ? - "C:\Programme\CA\eTrust Antivirus\InoTask.exe"  (File not found)
"eTrust Antivirus Realtime Server" (InoRT) - ? - "C:\Programme\CA\eTrust Antivirus\InoRT.exe"  (File not found)
"eTrust Antivirus RPC Server" (InoRPC) - ? - "C:\Programme\CA\eTrust Antivirus\InoRpc.exe"  (File not found)
"Firebird Server - MAGIX Instance" (FirebirdServerMAGIXInstance) - "MAGIX®" - C:\Programme\Common\Database\bin\fbserver.exe
"FsUsbExService" (FsUsbExService) - "Teruten" - C:\WINDOWS\system32\FsUsbExService.Exe
"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Programme\iPod\bin\iPodService.exe
"Java Quick Starter" (JavaQuickStarterService) - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jqs.exe
"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
"PEVSystemStart" (PEVSystemStart) - ? - C:\Cofi\PEV.cfxxe  (File found, but it contains no detailed information)
"SIMATIC IEPG Help Service" (s7oiehsx) - "SIEMENS AG" - C:\program files\common files\Siemens\S7IEPG\s7oiehsx.exe
"UPnPService" (UPnPService) - ? - C:\Programme\Gemeinsame Dateien\MAGIX Shared\UPnPService\UPnPService.exe
"Windows Presentation Foundation Font Cache 4.0.0.0" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe

[Winlogon]
-----( HKCU\Control Panel\IOProcs )-----
"MVB" - ? - mvfs32.dll  (File not found)
-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions )-----
{c6dc5466-785a-11d2-84d0-00c04fb169f7} "Softwareinstallation" - ? - appmgmts.dll  (File not found)
-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )-----
"WgaLogon" - "Microsoft Corporation" - C:\WINDOWS\system32\WgaLogon.dll

===[ Logfile end ]=========================================[ Logfile end ]===
         

--- --- ---

If You have questions or want to get some help, You can visit Online Solutions :: Index

Und MBR Check
Brauchte zwar länger ~20s aber lief:
MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Home Edition
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x0000003c

Kernel Drivers (total 137):
0x804D7000 \WINDOWS\system32\ntkrnlpa.exe
0x806D1000 \WINDOWS\system32\hal.dll
0xF7B47000 \WINDOWS\system32\KDCOM.DLL
0xF7A57000 \WINDOWS\system32\BOOTVID.dll
0xF7517000 ACPI.sys
0xF7B49000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xF7506000 pci.sys
0xF7647000 isapnp.sys
0xF7657000 ohci1394.sys
0xF7667000 \WINDOWS\system32\DRIVERS\1394BUS.SYS
0xF7A5B000 compbatt.sys
0xF7A5F000 \WINDOWS\system32\DRIVERS\BATTC.SYS
0xF7C0F000 pciide.sys
0xF78C7000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xF7B4B000 intelide.sys
0xF74E8000 pcmcia.sys
0xF7677000 MountMgr.sys
0xF74C9000 ftdisk.sys
0xF7A63000 ACPIEC.sys
0xF7C10000 \WINDOWS\system32\DRIVERS\OPRGHDLR.SYS
0xF78CF000 PartMgr.sys
0xF7687000 VolSnap.sys
0xF74B1000 atapi.sys
0xF7697000 disk.sys
0xF76A7000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xF7491000 fltmgr.sys
0xF747F000 sr.sys
0xF78D7000 ino_flpy.sys
0xF76B7000 PxHelp20.sys
0xF7468000 KSecDD.sys
0xF73DB000 Ntfs.sys
0xF73AE000 NDIS.sys
0xF7394000 Mup.sys
0xF7887000 \SystemRoot\system32\DRIVERS\intelppm.sys
0xF7B17000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0xF654E000 \SystemRoot\system32\DRIVERS\ialmnt5.sys
0xF653A000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xF6512000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0xF79CF000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0xF64EE000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xF79D7000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xF64DC000 \SystemRoot\system32\DRIVERS\oxser.sys
0xF7B1B000 \SystemRoot\system32\DRIVERS\serenum.sys
0xF7897000 \SystemRoot\system32\DRIVERS\nic1394.sys
0xF64B5000 \SystemRoot\system32\DRIVERS\Rtlnicxp.sys
0xF78A7000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0xF79DF000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xF6486000 \SystemRoot\system32\DRIVERS\SynTP.sys
0xF7B7B000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xF79E7000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xF78B7000 \SystemRoot\system32\DRIVERS\imapi.sys
0xF79EF000 \SystemRoot\System32\Drivers\MxlW2k.SYS
0xF76E7000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xF76F7000 \SystemRoot\system32\DRIVERS\redbook.sys
0xF6463000 \SystemRoot\system32\DRIVERS\ks.sys
0xF7B1F000 \SystemRoot\System32\Drivers\GEARAspiWDM.sys
0xF7C84000 \SystemRoot\system32\DRIVERS\audstub.sys
0xF7B7D000 \SystemRoot\System32\Drivers\RootMdm.sys
0xF79F7000 \SystemRoot\System32\Drivers\Modem.SYS
0xF7707000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xF7B27000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xF644C000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xF7717000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xF7727000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xF79FF000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xF643B000 \SystemRoot\system32\DRIVERS\psched.sys
0xF7737000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xF7A07000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xF7A0F000 \SystemRoot\system32\DRIVERS\raspti.sys
0xF7747000 \SystemRoot\system32\DRIVERS\termdd.sys
0xF6412000 \SystemRoot\System32\Drivers\S7oppilx.sys
0xF7B7F000 \SystemRoot\system32\DRIVERS\swenum.sys
0xF63B4000 \SystemRoot\system32\DRIVERS\update.sys
0xF7B37000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xF7757000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xAA3F5000 \SystemRoot\system32\drivers\RtkHDAud.sys
0xAA3D1000 \SystemRoot\system32\drivers\portcls.sys
0xF7777000 \SystemRoot\system32\drivers\drmk.sys
0xAA3A8000 \SystemRoot\system32\DRIVERS\HSFHWAZL.sys
0xAA2AB000 \SystemRoot\system32\DRIVERS\HSF_DPV.sys
0xAA1FE000 \SystemRoot\system32\DRIVERS\HSF_CNXT.sys
0xF66DF000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xF7B83000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xF6436000 \SystemRoot\System32\Drivers\Null.SYS
0xF7B85000 \SystemRoot\System32\Drivers\Beep.SYS
0xF7A2F000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0xF7A37000 \SystemRoot\System32\drivers\vga.sys
0xF7B87000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xF7B89000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xF7A3F000 \SystemRoot\System32\Drivers\Msfs.SYS
0xF7A47000 \SystemRoot\System32\Drivers\Npfs.SYS
0xF7350000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xAA1A3000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xAA14A000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xAA122000 \SystemRoot\system32\DRIVERS\netbt.sys
0xAA100000 \SystemRoot\System32\drivers\afd.sys
0xF66CF000 \SystemRoot\system32\DRIVERS\netbios.sys
0xF7A4F000 \SystemRoot\system32\DRIVERS\ssmdrv.sys
0xAA0D5000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xAA065000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xF66BF000 \SystemRoot\System32\Drivers\Fips.SYS
0xAA03F000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xF66AF000 \SystemRoot\system32\DRIVERS\wanarp.sys
0xF669F000 \SystemRoot\system32\DRIVERS\arp1394.sys
0xA9FF4000 \SystemRoot\system32\DRIVERS\avipbb.sys
0xF7B8F000 \??\C:\Programme\Avira\AntiVir Desktop\avgio.sys
0xF6CFD000 \SystemRoot\system32\DRIVERS\hidusb.sys
0xF666F000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0xF7AE3000 \SystemRoot\system32\DRIVERS\mouhid.sys
0xA9FD0000 \SystemRoot\System32\Drivers\Fastfat.SYS
0xA9FB8000 \SystemRoot\System32\Drivers\dump_atapi.sys
0xF7B91000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xF7AFB000 \SystemRoot\System32\drivers\Dxapi.sys
0xF78F7000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xF7D1A000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF020000 \SystemRoot\System32\ialmdnt5.dll
0xBF012000 \SystemRoot\System32\ialmrnt5.dll
0xBF042000 \SystemRoot\System32\ialmdev5.DLL
0xBF073000 \SystemRoot\System32\ialmdd5.DLL
0xA9DC3000 \SystemRoot\system32\DRIVERS\avgntflt.sys
0xA9D9D000 \??\C:\WINDOWS\system32\Drivers\ino_fltr.sys
0xA9DF8000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xA9B18000 \SystemRoot\system32\DRIVERS\mrxdav.sys
0xF7D42000 \SystemRoot\System32\Drivers\DirectNT.SYS
0xA9A4F000 \SystemRoot\System32\Drivers\S7otranx.sys
0xA9972000 \SystemRoot\system32\drivers\wdmaud.sys
0xA9B85000 \SystemRoot\system32\drivers\sysaudio.sys
0xA9B10000 \SystemRoot\System32\Drivers\ASPI32.SYS
0xA963B000 \SystemRoot\System32\Drivers\HTTP.sys
0xA968C000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys
0xA9339000 \SystemRoot\system32\DRIVERS\srv.sys
0xA94A1000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xA8FA1000 \SystemRoot\System32\drivers\dgderdrv.sys
0xA96B4000 \??\C:\WINDOWS\system32\FsUsbExDisk.SYS
0x7C910000 \WINDOWS\system32\ntdll.dll

Processes (total 46):
0 System Idle Process
4 SYSTEM
472 C:\WINDOWS\system32\smss.exe
528 csrss.exe
552 C:\WINDOWS\system32\winlogon.exe
596 C:\WINDOWS\system32\services.exe
616 C:\WINDOWS\system32\lsass.exe
784 C:\WINDOWS\system32\svchost.exe
840 svchost.exe
880 C:\WINDOWS\system32\svchost.exe
948 svchost.exe
1016 svchost.exe
1224 C:\WINDOWS\explorer.exe
1320 C:\WINDOWS\system32\spoolsv.exe
1368 C:\Programme\Avira\AntiVir Desktop\sched.exe
1416 svchost.exe
1516 C:\Programme\Synaptics\SynTP\SynTPEnh.exe
1524 C:\WINDOWS\system32\igfxtray.exe
1540 C:\Programme\Avira\AntiVir Desktop\avguard.exe
1548 C:\WINDOWS\system32\hkcmd.exe
1556 C:\WINDOWS\RTHDCPL.EXE
1564 C:\Programme\Home Cinema\PowerDVD\PDVDServ.exe
1576 C:\Programme\Musicmatch\Musicmatch Jukebox\mmtask.exe
1596 C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
1616 C:\Programme\Browser MOUSE\mouse32a.exe
1692 C:\Programme\QuickTime\QTTask.exe
1716 C:\Programme\iTunes\iTunesHelper.exe
1744 C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
1760 C:\Programme\Avira\AntiVir Desktop\avgnt.exe
1780 C:\WINDOWS\system32\dgdersvc.exe
1836 C:\Programme\Windows Media Player\wmpnscfg.exe
1904 C:\WINDOWS\system32\ctfmon.exe
1948 C:\WINDOWS\system32\FsUsbExService.Exe
188 C:\WINDOWS\system32\svchost.exe
200 C:\Programme\Avira\AntiVir Desktop\avshadow.exe
316 C:\Programme\Java\jre6\bin\jqs.exe
504 C:\Program Files\common files\Siemens\S7IEPG\s7oiehsx.exe
1656 wmpnetwk.exe
2652 C:\Programme\Gemeinsame Dateien\Teleca Shared\Generic.exe
2840 C:\Programme\iPod\bin\iPodService.exe
2920 alg.exe
3236 C:\WINDOWS\system32\wbem\wmiapsrv.exe
3552 C:\Programme\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
4036 C:\WINDOWS\explorer.exe
620 C:\WINDOWS\system32\wscntfy.exe
3688 C:\Dokumente und Einstellungen\martin\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x0000001d`4c130200 (NTFS)
\\.\E: --> \\.\PhysicalDrive0 at offset 0x00000038`270f1000 (FAT32)

PhysicalDrive0 Model Number: WDCWD2500BEVE-22WZT0, Rev: 01.01A01

Size Device Name MBR Status
--------------------------------------------
232 GB \\.\PhysicalDrive0 Windows XP MBR code detected
SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A


Done!

Mann habe ich viel Mist auf dem Rechner! (Viel installiert nie was gelöscht)
Martin

Bin mit meinem Internet explorer online.
Hoffe es passiert nichts
Martin

"gstpaloph" (gstpaloph) - ? - C:\WINDOWS\system32\drivers\gstpaloph.sys (File not found)

Bitte mit Hilfe der OSAM Anleitung deaktivieren und löschen

Meldung von Osam
(Success) HKLM\SYSTEM\CurrentControlSet\Services\gstpaloph gstpaloph C:\WINDOWS\system32\drivers\gstpaloph.sys

OSAM Logfile:

Report of OSAM: Autorun Manager v5.0.11926.0
Online Solutions. Complex Protection for Information Systems
Saved at 13:30:46 on 09.12.2010

OS: Windows XP Home Edition Service Pack 3 (Build 2600)
Default Browser: Microsoft Corporation Internet Explorer 8.00.6001.18702

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Common]
-----( %SystemRoot%\Tasks )-----
"AppleSoftwareUpdate.job" - "Apple Inc." - C:\Programme\Apple Software Update\SoftwareUpdate.exe

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"bdeadmin.cpl" - ? - C:\WINDOWS\system32\bdeadmin.cpl
"javacpl.cpl" - "Sun Microsystems, Inc." - C:\WINDOWS\system32\javacpl.cpl
"S7epaepx.cpl" - "SIEMENS AG" - C:\WINDOWS\system32\S7epaepx.cpl
"S7EPATDX.CPL" - "SIEMENS AG" - C:\WINDOWS\system32\S7EPATDX.CPL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"Adobe Gamma" - "Adobe Systems, Inc." - C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma.cpl
"Avira AntiVir Personal" - "Avira GmbH" - C:\PROGRA~1\Avira\ANTIVI~1\avconfig.cpl
"ECSEPM" - "Sony Ericsson Mobile Communications AB" - C:\Programme\Sony Ericsson\Mobile2\Mobile Phone Monitor\ecsepm.cpl
"QuickTime" - "Apple Inc." - C:\Programme\QuickTime\QTSystem\QuickTime.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"ASPI32" (ASPI32) - "Adaptec" - C:\WINDOWS\system32\drivers\ASPI32.sys
"avgio" (avgio) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avgio.sys
"avgntflt" (avgntflt) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avipbb.sys
"catchme" (catchme) - ? - C:\DOKUME~1\martin\LOKALE~1\Temp\catchme.sys  (File not found)
"Changer" (Changer) - ? - C:\WINDOWS\system32\drivers\Changer.sys  (File not found)
"dgderdrv" (dgderdrv) - "Devguru Co., Ltd" - C:\WINDOWS\System32\drivers\dgderdrv.sys
"DirectNT" (DirectNT) - "c't" - C:\WINDOWS\system32\drivers\DirectNT.sys
"FsUsbExDisk" (FsUsbExDisk) - ? - C:\WINDOWS\system32\FsUsbExDisk.SYS  (File found, but it contains no detailed information)
"i2omgmt" (i2omgmt) - ? - C:\WINDOWS\system32\drivers\i2omgmt.sys  (File not found)
"INO_FLPY" (INO_FLPY) - "Computer Associates" - C:\WINDOWS\System32\Drivers\ino_flpy.sys
"INO_FLTR" (INO_FLTR) - "Computer Associates" - C:\WINDOWS\system32\Drivers\ino_fltr.sys
"lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys  (File not found)
"ModiTel" (BALU) - ? - C:\WINDOWS\System32\DRIVERS\balu.sys
"Motorola USB Modem Driver for MPT" (usbsermpt) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\usbsermpt.sys
"MxlW2k" (MxlW2k) - "MusicMatch, Inc." - C:\WINDOWS\system32\drivers\MxlW2k.sys
"Navman In-car Navigator USB Driver Service" (Navcar) - "NAVMAN" - C:\WINDOWS\System32\DRIVERS\Navcar.sys
"PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys  (File not found)
"PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys  (File not found)
"PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys  (File not found)
"PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys  (File not found)
"PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys  (File not found)
"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\WINDOWS\System32\Drivers\PxHelp20.sys
"s7oppitx" (s7oppitx) - "SIEMENS AG" - C:\WINDOWS\System32\Drivers\S7oppitx.sys
"s7otranx" (s7otranx) - "SIEMENS AG" - C:\WINDOWS\System32\Drivers\S7otranx.sys
"Siemens PC/PPI Cable" (S7oppilx) - "SIEMENS AG" - C:\WINDOWS\System32\Drivers\S7oppilx.sys
"Sony Ericsson W800 driver (WDM)" (w800bus) - "MCCI" - C:\WINDOWS\System32\DRIVERS\w800bus.sys
"Sony Ericsson W800 USB WMC Device Management Drivers" (w800mgmt) - "MCCI" - C:\WINDOWS\System32\DRIVERS\w800mgmt.sys
"Sony Ericsson W800 USB WMC Modem Drivers" (w800mdm) - "MCCI" - C:\WINDOWS\System32\DRIVERS\w800mdm.sys
"Sony Ericsson W800 USB WMC Modem Filter" (w800mdfl) - "MCCI" - C:\WINDOWS\System32\DRIVERS\w800mdfl.sys
"Sony Ericsson W800 USB WMC OBEX Interface Drivers" (w800obex) - "MCCI" - C:\WINDOWS\System32\DRIVERS\w800obex.sys
"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\ssmdrv.sys
"TerraTec Cinergy T² (BDA)" (TTCinergyT2) - "TerraTec Electronic GmbH" - C:\WINDOWS\System32\DRIVERS\TTCinergyT2BDA.sys
"WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys  (File not found)
(Disabled) "gstpaloph" (gstpaloph) - ? - C:\WINDOWS\system32\drivers\gstpaloph.sys  (File not found)

[Explorer]
-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----
{89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{0561EC90-CE54-4f0c-9C55-E226110A740C} "Haali Column Provider" - ? - C:\Programme\Haali\MatroskaSplitter\mmfinfo.dll  (File found, but it contains no detailed information)
{7D4D6379-F301-4311-BEBA-E26EB0561882} "NeroDigitalColumnHandler Class" - "Nero AG" - C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroDigitalExt.dll
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Programme\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
-----( HKLM\Software\Classes\Protocols\Handler )-----
{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~1\MSNMES~1\msgrapp.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - ? - C:\Programme\7-Zip\7-zip.dll
{42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? - deskpan.dll  (File not found)
{B28C18DB-6816-4F31-9630-397683E3C2C3} "Filzip Shell Extension" - ? - C:\Programme\Filzip\fzshext.dll
{1D2680C9-0E2A-469d-B787-065558BC7D43} "Fusion Cache" - "Microsoft Corporation" - c:\WINDOWS\system32\mscoree.dll
{0561EC90-CE54-4f0c-9C55-E226110A740C} "Haali Column Provider" - ? - C:\Programme\Haali\MatroskaSplitter\mmfinfo.dll  (File found, but it contains no detailed information)
{5574006C-28F5-4a65-A28C-74DE6BFBE0BB} "Haali Matroska Shell Property Page" - ? - C:\Programme\Haali\MatroskaSplitter\mmfinfo.dll  (File found, but it contains no detailed information)
{327669A0-59A7-4be9-B99E-1C9F3A57611A} "Haali Matroska Thumbnail Extractor" - ? - C:\Programme\Haali\MatroskaSplitter\mmfinfo.dll  (File found, but it contains no detailed information)
{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? -   (File not found | COM-object registry key not found)
{DCED20BE-3645-11D4-BC95-00C04F0E0588} "InoShell" - ? -   (File not found | COM-object registry key not found)
{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Programme\iTunes\iTunesMiniPlayer.dll
{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? -   (File not found | COM-object registry key not found)
{B327765E-D724-4347-8B16-78AE18552FC3} "NeroDigitalIconHandler Class" - "Nero AG" - C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroDigitalExt.dll
{7F1CF152-04F8-453A-B34C-E609530A9DC8} "NeroDigitalPropSheetHandler Class" - "Nero AG" - C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroDigitalExt.dll
{63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice Property Sheet Handler" - ? - C:\Programme\StarOffice7\program\shlxthdl.dll
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\shlext.dll
{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll
{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? -   (File not found | COM-object registry key not found)
{e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll
{03DAACC5-10BA-4E3E-9D54-2A569F6B4B87} "Sony Ericsson Datei-Manager" - "Popwire AB" - C:\Programme\Sony Ericsson\Mobile2\File Manager\FM.dll
{738D66C6-0149-4D40-84E4-A7BB2D0CE949} "Sony Ericsson Datei-Manager" - "Popwire AB" - C:\Programme\Sony Ericsson\Mobile2\File Manager\FM.dll
{7020EDF4-B454-4814-9AA4-1D604D3F1417} "TraXExCM" - "Alexander Miehlke Softwareentwicklung" - C:\Programme\TraXEx\Integration\TraXExCM.dll

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
ITBar7Height "ITBar7Height" - ? -   (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_22" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_22.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} "Java Plug-in 1.6.0_22" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_22.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_22" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_22.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
{02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} "QuickTime Object" - "Apple Inc." - C:\Programme\QuickTime\QTPlugin.ocx / hxxp://www.apple.com/qtactivex/qtplugin.cab
{D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" - "Adobe Systems, Inc." - C:\WINDOWS\system32\Macromed\Flash\Flash10a.ocx / hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
{17492023-C23A-453E-A040-C7C580BBF700} "Windows Genuine Advantage Validation Tool" - "Microsoft Corporation" - C:\WINDOWS\system32\LegitCheckControl.DLL / hxxp://go.microsoft.com/fwlink/?linkid=39204
{166B1BCA-3F9C-11CF-8075-444553540000} "{166B1BCA-3F9C-11CF-8075-444553540000}" - ? -   (File not found | COM-object registry key not found) / hxxp://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab
{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA} "{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA}" - ? -   (File not found | COM-object registry key not found) / Java Plug-in Technology
{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA} "{CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA}" - ? -   (File not found | COM-object registry key not found) / hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_03-windows-i586.cab
{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} "{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}" - ? -   (File not found | COM-object registry key not found) / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab
{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} "{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}" - ? -   (File not found | COM-object registry key not found) / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} "{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}" - ? -   (File not found | COM-object registry key not found) / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} "{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}" - ? -   (File not found | COM-object registry key not found) / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} "{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}" - ? -   (File not found | COM-object registry key not found) / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{53707962-6F74-2D53-2644-206D7942484F} "ClsidExtension" - "Safer Networking Limited" - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
{AD6E6555-FB2C-47D4-8339-3E2965509877} "&TerraTec Home Cinema" - "TerraTec Electronic GmbH" - C:\PROGRA~1\TerraTec\TERRAT~1\THCDES~1.DLL
{327C2873-E90D-4c37-AA9D-10AC9BABA46C} "Easy-WebPrint" - ? - C:\Programme\Canon\Easy-WebPrint\Toolband.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "Adobe PDF Reader Link Helper" - "Adobe Systems Incorporated" - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jp2ssv.dll
{E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
{53707962-6F74-2D53-2644-206D7942484F} "Spybot-S&D IE Protection" - "Safer Networking Limited" - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
{68F9551E-0411-48E4-9AAF-4BC42A6A46BE} "{68F9551E-0411-48E4-9AAF-4BC42A6A46BE}" - ? -   (File not found | COM-object registry key not found)
{AA58ED58-01DD-4d91-8333-CF10577473F7} "{AA58ED58-01DD-4d91-8333-CF10577473F7}" - ? -   (File not found | COM-object registry key not found)
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} "{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}" - ? -   (File not found | COM-object registry key not found)
{C84D72FE-E17D-4195-BB24-76C02E2E7C4E} "{C84D72FE-E17D-4195-BB24-76C02E2E7C4E}" - ? -   (File not found | COM-object registry key not found)

[Logon]
-----( %AllUsersProfile%\Startmenü\Programme\Autostart )-----
"desktop.ini" - ? - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini
-----( %UserProfile%\Startmenü\Programme\Autostart )-----
"Adobe Gamma.lnk" - "Adobe Systems, Inc." - C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe  (Shortcut exists | File exists)
"desktop.ini" - ? - C:\Dokumente und Einstellungen\martin\Startmenü\Programme\Autostart\desktop.ini
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"SpybotSD TeaTimer" - "Safer-Networking Ltd." - C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"AppleSyncNotifier" - "Apple Inc." - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
"avgnt" - "Avira GmbH" - "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min
"FLMOFFICE4DMOUSE" - ? - C:\Programme\Browser MOUSE\mouse32a.exe
"iTunesHelper" - "Apple Inc." - "C:\Programme\iTunes\iTunesHelper.exe"
"mmtask" - "Musicmatch Inc." - C:\Programme\Musicmatch\Musicmatch Jukebox\mmtask.exe
"NeroFilterCheck" - "Ahead Software Gmbh" - C:\WINDOWS\system32\NeroCheck.exe
"QuickTime Task" - "Apple Inc." - "C:\Programme\QuickTime\QTTask.exe" -atboottime
"RemoteControl" - "Cyberlink Corp." - "C:\Programme\Home Cinema\PowerDVD\PDVDServ.exe"
"Sony Ericsson PC Suite" - ? - "C:\Programme\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe"

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"Adobe LM Service" (Adobe LM Service) - "Adobe Systems" - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
"Anwendungsverwaltung" (AppMgmt) - ? - C:\WINDOWS\System32\appmgmts.dll  (File not found)
"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
"ASP.NET State Service" (aspnet_state) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avguard.exe
"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\sched.exe
"Device Error Recovery Service" (dgdersvc) - "Devguru Co., Ltd." - C:\WINDOWS\system32\dgdersvc.exe
"eTrust Antivirus Job Server" (InoTask) - ? - "C:\Programme\CA\eTrust Antivirus\InoTask.exe"  (File not found)
"eTrust Antivirus Realtime Server" (InoRT) - ? - "C:\Programme\CA\eTrust Antivirus\InoRT.exe"  (File not found)
"eTrust Antivirus RPC Server" (InoRPC) - ? - "C:\Programme\CA\eTrust Antivirus\InoRpc.exe"  (File not found)
"Firebird Server - MAGIX Instance" (FirebirdServerMAGIXInstance) - "MAGIX®" - C:\Programme\Common\Database\bin\fbserver.exe
"FsUsbExService" (FsUsbExService) - "Teruten" - C:\WINDOWS\system32\FsUsbExService.Exe
"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Programme\iPod\bin\iPodService.exe
"Java Quick Starter" (JavaQuickStarterService) - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jqs.exe
"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
"PEVSystemStart" (PEVSystemStart) - ? - C:\Cofi\PEV.cfxxe  (File found, but it contains no detailed information)
"SIMATIC IEPG Help Service" (s7oiehsx) - "SIEMENS AG" - C:\program files\common files\Siemens\S7IEPG\s7oiehsx.exe
"UPnPService" (UPnPService) - ? - C:\Programme\Gemeinsame Dateien\MAGIX Shared\UPnPService\UPnPService.exe
"Windows Presentation Foundation Font Cache 4.0.0.0" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe

[Winlogon]
-----( HKCU\Control Panel\IOProcs )-----
"MVB" - ? - mvfs32.dll  (File not found)
-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions )-----
{c6dc5466-785a-11d2-84d0-00c04fb169f7} "Softwareinstallation" - ? - appmgmts.dll  (File not found)
-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )-----
"WgaLogon" - "Microsoft Corporation" - C:\WINDOWS\system32\WgaLogon.dll

===[ Logfile end ]=========================================[ Logfile end ]===
         

--- --- ---

Martin

Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SUPERAntiSpyware und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

Hallo Arne,
ich habe nur Malware geschafft und fahre nun ins Lange WE ohne Internetanschluss. Superantispyware kommt dann am So oder im Laufe des Mo
Dir auch ein schönes Wochenende und Danke für die Hilfe
Martin

Malwarebytes' Anti-Malware 1.50
Malwarebytes

Datenbank Version: 5279

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

09.12.2010 16:07:36
mbam-log-2010-12-09 (16-07-36).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Durchsuchte Objekte: 267008
Laufzeit: 59 Minute(n), 20 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

So der Scan dauerte ganz schön lange. Dann wurde ich aufgefordert neu zu starten. BZW es wurden schon 10 (1+9) schädliche Objekte gefunden.
Scan:
SUPERAntiSpyware Scan Log
SUPERAntiSpyware.com | Remove Malware | Remove Spyware - AntiMalware, AntiSpyware, AntiAdware!

Generated 12/12/2010 at 10:42 PM

Application Version : 4.46.1000

Core Rules Database Version : 5992
Trace Rules Database Version: 3804

Scan type : Complete Scan
Total Scan Time : 02:16:20

Memory items scanned : 541
Memory threats detected : 0
Registry items scanned : 6978
Registry threats detected : 9
File items scanned : 139518
File threats detected : 1

Adware.Tracking Cookie
C:\Dokumente und Einstellungen\martin\Cookies\martin@doubleclick[1].txt

Trojan.Agent/Gen-SSHNAS
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SSHNAS
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SSHNAS#NextInstance
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SSHNAS\0000
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SSHNAS\0000#Service
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SSHNAS\0000#Legacy
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SSHNAS\0000#ConfigFlags
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SSHNAS\0000#Class
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SSHNAS\0000#ClassGUID
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SSHNAS\0000#DeviceDesc

Sieht ok aus, da wurden nur Überreste gefunden.
Noch Probleme oder weitere Funde in der Zwischenzeit?

Hallo Arne,
Habe keine Probleme mehr beim surfen.
Nur zwei updates von MS sind nicht durchgeführt worden. Net 1.1 und 2.0 werde ich nochmal überprüfen was das sein kann.

Kann man denn sagen was der Rechner hatte?
bzw wo das Einfallstor war, oder wer versagt hatte. Virenscanner oder update zu langsam.
Martin

Kann man denn sagen was der Rechner hatte?

So im Nachhinein schlecht. Begünstigt werden Infektionen durch sorgloses Surfen mit Adminrechten, während kritische Applikationen wie Browser, Java RE, Flashplayer und PDF-Viewer nicht aktualisiert werden.

Ansonsten wären wir aber jetzt durch!

Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.


Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update



PDF-Reader aktualisieren
Dein Adobe Reader ist nicht aktuell, was ein großes Sicherheitsrisiko darstellt. Du solltest daher besser die alte Version über Systemsteuerung => Software deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst.

Ich empfehle einen alternativen PDF-Reader wie SumatraPDF oder Foxit PDF Reader, beide sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers, hier der direkte Downloadlink => http://filepony.de/?q=Flash+Player


Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.

Hallo Arne,
vielen Dank für die Hilfe.

Werde ich machen und auch sonst noch einigen Mist deinstallieren. Ist leider zur Zeit einfacher eine größere Festplatte zu kaufen als Ordnung zu machen und "Dreck" mal runterzuwerfen.

Martin