Trojaner(?) - "Backdoor:Win32/Cycbot.B" fund durch Windows Defender

cosinus · 17.03.2011, 13:01

Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Conny W. · 17.03.2011, 15:34

Ok, TDSSKiller ist durch. Habe weder das in der Anleitung gezeigten weiß-auf-schwarz-Fenster bekommen, noch die Aufforderung zum Neustart.
Hier das log:

2011/03/17 15:28:39.0125 4892 TDSS rootkit removing tool 2.4.21.0 Mar 10 2011 12:26:28
2011/03/17 15:28:39.0577 4892 ================================================================================
2011/03/17 15:28:39.0577 4892 SystemInfo:
2011/03/17 15:28:39.0577 4892
2011/03/17 15:28:39.0593 4892 OS Version: 6.0.6002 ServicePack: 2.0
2011/03/17 15:28:39.0593 4892 Product type: Workstation
2011/03/17 15:28:39.0593 4892 ComputerName: ADMIN-PC
2011/03/17 15:28:39.0593 4892 UserName: Admin
2011/03/17 15:28:39.0593 4892 Windows directory: C:\Windows
2011/03/17 15:28:39.0593 4892 System windows directory: C:\Windows
2011/03/17 15:28:39.0593 4892 Processor architecture: Intel x86
2011/03/17 15:28:39.0593 4892 Number of processors: 2
2011/03/17 15:28:39.0593 4892 Page size: 0x1000
2011/03/17 15:28:39.0593 4892 Boot type: Normal boot
2011/03/17 15:28:39.0593 4892 ================================================================================
2011/03/17 15:28:40.0248 4892 Initialize success
2011/03/17 15:28:47.0533 5820 ================================================================================
2011/03/17 15:28:47.0533 5820 Scan started
2011/03/17 15:28:47.0533 5820 Mode: Manual;
2011/03/17 15:28:47.0533 5820 ================================================================================
2011/03/17 15:28:48.0688 5820 ACPI (82b296ae1892fe3dbee00c9cf92f8ac7) C:\Windows\system32\drivers\acpi.sys
2011/03/17 15:28:48.0859 5820 adp94xx (2edc5bbac6c651ece337bde8ed97c9fb) C:\Windows\system32\drivers\adp94xx.sys
2011/03/17 15:28:48.0984 5820 adpahci (b84088ca3cdca97da44a984c6ce1ccad) C:\Windows\system32\drivers\adpahci.sys
2011/03/17 15:28:49.0202 5820 adpu160m (7880c67bccc27c86fd05aa2afb5ea469) C:\Windows\system32\drivers\adpu160m.sys
2011/03/17 15:28:49.0452 5820 adpu320 (9ae713f8e30efc2abccd84904333df4d) C:\Windows\system32\drivers\adpu320.sys
2011/03/17 15:28:49.0733 5820 AFD (a201207363aa900abf1a388468688570) C:\Windows\system32\drivers\afd.sys
2011/03/17 15:28:49.0998 5820 AgereSoftModem (ce91b158fa490cf4c4d487a4130f4660) C:\Windows\system32\DRIVERS\AGRSM.sys
2011/03/17 15:28:50.0232 5820 agp440 (ef23439cdd587f64c2c1b8825cead7d8) C:\Windows\system32\drivers\agp440.sys
2011/03/17 15:28:50.0419 5820 aic78xx (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys
2011/03/17 15:28:50.0591 5820 aliide (90395b64600ebb4552e26e178c94b2e4) C:\Windows\system32\drivers\aliide.sys
2011/03/17 15:28:50.0825 5820 amdagp (2b13e304c9dfdfa5eb582f6a149fa2c7) C:\Windows\system32\drivers\amdagp.sys
2011/03/17 15:28:51.0043 5820 amdide (0577df1d323fe75a739c787893d300ea) C:\Windows\system32\drivers\amdide.sys
2011/03/17 15:28:51.0121 5820 AmdK7 (dc487885bcef9f28eece6fac0e5ddfc5) C:\Windows\system32\drivers\amdk7.sys
2011/03/17 15:28:51.0371 5820 AmdK8 (0ca0071da4315b00fc1328ca86b425da) C:\Windows\system32\drivers\amdk8.sys
2011/03/17 15:28:51.0652 5820 arc (5f673180268bb1fdb69c99b6619fe379) C:\Windows\system32\drivers\arc.sys
2011/03/17 15:28:51.0792 5820 arcsas (957f7540b5e7f602e44648c7de5a1c05) C:\Windows\system32\drivers\arcsas.sys
2011/03/17 15:28:51.0886 5820 AsyncMac (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys
2011/03/17 15:28:51.0995 5820 atapi (1f05b78ab91c9075565a9d8a4b880bc4) C:\Windows\system32\drivers\atapi.sys
2011/03/17 15:28:52.0088 5820 athr (0c8dfa21b1d9d2ef14b692104ae68a69) C:\Windows\system32\DRIVERS\athr.sys
2011/03/17 15:28:52.0276 5820 AtiHDAudioService (99a0f5c917558624cbeb113cb12e3f25) C:\Windows\system32\drivers\AtihdLH3.sys
2011/03/17 15:28:52.0432 5820 atikmdag (107d6792a9473b9bfb553b0465460564) C:\Windows\system32\DRIVERS\atikmdag.sys
2011/03/17 15:28:52.0666 5820 avgio (0b497c79824f8e1bf22fa6aacd3de3a0) C:\Program Files\Avira\AntiVir Desktop\avgio.sys
2011/03/17 15:28:52.0775 5820 avgntflt (14fe36d8f2c6a2435275338d061a0b66) C:\Windows\system32\DRIVERS\avgntflt.sys
2011/03/17 15:28:52.0853 5820 avipbb (6d52060b59e7d79cd2a044b6add1f1ef) C:\Windows\system32\DRIVERS\avipbb.sys
2011/03/17 15:28:52.0962 5820 Beep (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys
2011/03/17 15:28:53.0087 5820 bowser (74b442b2be1260b7588c136177ceac66) C:\Windows\system32\DRIVERS\bowser.sys
2011/03/17 15:28:53.0134 5820 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys
2011/03/17 15:28:53.0227 5820 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys
2011/03/17 15:28:53.0305 5820 Brserid (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys
2011/03/17 15:28:53.0352 5820 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys
2011/03/17 15:28:53.0446 5820 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys
2011/03/17 15:28:53.0555 5820 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys
2011/03/17 15:28:53.0648 5820 BTHMODEM (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys
2011/03/17 15:28:53.0898 5820 cdfs (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys
2011/03/17 15:28:53.0976 5820 cdrom (6b4bffb9becd728097024276430db314) C:\Windows\system32\DRIVERS\cdrom.sys
2011/03/17 15:28:54.0132 5820 circlass (e5d4133f37219dbcfe102bc61072589d) C:\Windows\system32\DRIVERS\circlass.sys
2011/03/17 15:28:54.0257 5820 CLFS (d7659d3b5b92c31e84e53c1431f35132) C:\Windows\system32\CLFS.sys
2011/03/17 15:28:54.0428 5820 CmBatt (99afc3795b58cc478fbbbcdc658fcb56) C:\Windows\system32\DRIVERS\CmBatt.sys
2011/03/17 15:28:54.0600 5820 cmdide (45201046c776ffdaf3fc8a0029c581c8) C:\Windows\system32\drivers\cmdide.sys
2011/03/17 15:28:54.0803 5820 Compbatt (6afef0b60fa25de07c0968983ee4f60a) C:\Windows\system32\DRIVERS\compbatt.sys
2011/03/17 15:28:55.0068 5820 CplIR (c3156b712e3873aad354f1696b2b2925) C:\Windows\system32\DRIVERS\CplIR.SYS
2011/03/17 15:28:55.0271 5820 crcdisk (2a213ae086bbec5e937553c7d9a2b22c) C:\Windows\system32\drivers\crcdisk.sys
2011/03/17 15:28:55.0442 5820 Crusoe (22a7f883508176489f559ee745b5bf5d) C:\Windows\system32\drivers\crusoe.sys
2011/03/17 15:28:55.0630 5820 DfsC (218d8ae46c88e82014f5d73d0236d9b2) C:\Windows\system32\Drivers\dfsc.sys
2011/03/17 15:28:55.0801 5820 disk (5d4aefc3386920236a548271f8f1af6a) C:\Windows\system32\drivers\disk.sys
2011/03/17 15:28:56.0004 5820 drmkaud (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys
2011/03/17 15:28:56.0238 5820 DXGKrnl (c68ac676b0ef30cfbb1080adce49eb1f) C:\Windows\System32\drivers\dxgkrnl.sys
2011/03/17 15:28:56.0456 5820 E1G60 (f88fb26547fd2ce6d0a5af2985892c48) C:\Windows\system32\DRIVERS\E1G60I32.sys
2011/03/17 15:28:56.0566 5820 Ecache (7f64ea048dcfac7acf8b4d7b4e6fe371) C:\Windows\system32\drivers\ecache.sys
2011/03/17 15:28:56.0800 5820 elxstor (e8f3f21a71720c84bcf423b80028359f) C:\Windows\system32\drivers\elxstor.sys
2011/03/17 15:28:57.0034 5820 exfat (22b408651f9123527bcee54b4f6c5cae) C:\Windows\system32\drivers\exfat.sys
2011/03/17 15:28:57.0127 5820 fastfat (1e9b9a70d332103c52995e957dc09ef8) C:\Windows\system32\drivers\fastfat.sys
2011/03/17 15:28:57.0408 5820 fdc (63bdada84951b9c03e641800e176898a) C:\Windows\system32\DRIVERS\fdc.sys
2011/03/17 15:28:57.0720 5820 FileInfo (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys
2011/03/17 15:28:58.0032 5820 Filetrace (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys
2011/03/17 15:28:58.0282 5820 flpydisk (6603957eff5ec62d25075ea8ac27de68) C:\Windows\system32\DRIVERS\flpydisk.sys
2011/03/17 15:28:58.0516 5820 FltMgr (01334f9ea68e6877c4ef05d3ea8abb05) C:\Windows\system32\drivers\fltmgr.sys
2011/03/17 15:28:58.0812 5820 Fs_Rec (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys
2011/03/17 15:28:59.0093 5820 gagp30kx (4e1cd0a45c50a8882616cae5bf82f3c5) C:\Windows\system32\drivers\gagp30kx.sys
2011/03/17 15:28:59.0311 5820 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\Windows\system32\Drivers\GEARAspiWDM.sys
2011/03/17 15:28:59.0576 5820 HdAudAddService (3f90e001369a07243763bd5a523d8722) C:\Windows\system32\drivers\HdAudio.sys
2011/03/17 15:28:59.0857 5820 HDAudBus (062452b7ffd68c8c042a6261fe8dff4a) C:\Windows\system32\DRIVERS\HDAudBus.sys
2011/03/17 15:29:00.0138 5820 HidBth (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys
2011/03/17 15:29:00.0185 5820 HidIr (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\DRIVERS\hidir.sys
2011/03/17 15:29:00.0512 5820 HidUsb (cca4b519b17e23a00b826c55716809cc) C:\Windows\system32\DRIVERS\hidusb.sys
2011/03/17 15:29:00.0746 5820 HpCISSs (df353b401001246853763c4b7aaa6f50) C:\Windows\system32\drivers\hpcisss.sys
2011/03/17 15:29:01.0090 5820 HTTP (f870aa3e254628ebeafe754108d664de) C:\Windows\system32\drivers\HTTP.sys
2011/03/17 15:29:01.0339 5820 i2omp (324c2152ff2c61abae92d09f3cca4d63) C:\Windows\system32\drivers\i2omp.sys
2011/03/17 15:29:01.0573 5820 i8042prt (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys
2011/03/17 15:29:01.0682 5820 iaStor (fd7f9d74c2b35dbda400804a3f5ed5d8) C:\Windows\system32\DRIVERS\iaStor.sys
2011/03/17 15:29:02.0041 5820 iaStorV (c957bf4b5d80b46c5017bf0101e6c906) C:\Windows\system32\drivers\iastorv.sys
2011/03/17 15:29:02.0447 5820 iirsp (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys
2011/03/17 15:29:02.0806 5820 IntcAzAudAddService (7bd4e0428776d11c8e8e26f9f5508690) C:\Windows\system32\drivers\RTKVHDA.sys
2011/03/17 15:29:03.0227 5820 intelide (83aa759f3189e6370c30de5dc5590718) C:\Windows\system32\drivers\intelide.sys
2011/03/17 15:29:03.0414 5820 intelppm (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys
2011/03/17 15:29:03.0632 5820 IpFilterDriver (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys
2011/03/17 15:29:03.0944 5820 IPMIDRV (40f34f8aba2a015d780e4b09138b6c17) C:\Windows\system32\drivers\ipmidrv.sys
2011/03/17 15:29:04.0210 5820 IPNAT (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys
2011/03/17 15:29:04.0319 5820 IRENUM (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys
2011/03/17 15:29:04.0568 5820 isapnp (350fca7e73cf65bcef43fae1e4e91293) C:\Windows\system32\drivers\isapnp.sys
2011/03/17 15:29:04.0818 5820 iScsiPrt (232fa340531d940aac623b121a595034) C:\Windows\system32\DRIVERS\msiscsi.sys
2011/03/17 15:29:05.0161 5820 iteatapi (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys
2011/03/17 15:29:05.0395 5820 iteraid (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys
2011/03/17 15:29:05.0536 5820 kbdclass (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys
2011/03/17 15:29:05.0879 5820 kbdhid (d2600cb17b7408b4a83f231dc9a11ac3) C:\Windows\system32\DRIVERS\kbdhid.sys
2011/03/17 15:29:06.0253 5820 KR10I (a383f2cea0a8f4e76e71abc869bd5748) C:\Windows\system32\drivers\kr10i.sys
2011/03/17 15:29:06.0503 5820 KR10N (6e9922332386c2a49936b30b2b6fd298) C:\Windows\system32\drivers\kr10n.sys
2011/03/17 15:29:06.0799 5820 KSecDD (86165728af9bf72d6442a894fdfb4f8b) C:\Windows\system32\Drivers\ksecdd.sys
2011/03/17 15:29:07.0220 5820 lltdio (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys
2011/03/17 15:29:07.0610 5820 LPCFilter (515fc18cabee0158a324b08b1c2667cf) C:\Windows\system32\DRIVERS\LPCFilter.sys
2011/03/17 15:29:07.0907 5820 LSI_FC (a2262fb9f28935e862b4db46438c80d2) C:\Windows\system32\drivers\lsi_fc.sys
2011/03/17 15:29:08.0234 5820 LSI_SAS (30d73327d390f72a62f32c103daf1d6d) C:\Windows\system32\drivers\lsi_sas.sys
2011/03/17 15:29:08.0437 5820 LSI_SCSI (e1e36fefd45849a95f1ab81de0159fe3) C:\Windows\system32\drivers\lsi_scsi.sys
2011/03/17 15:29:08.0671 5820 luafv (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys
2011/03/17 15:29:08.0749 5820 megasas (d153b14fc6598eae8422a2037553adce) C:\Windows\system32\drivers\megasas.sys
2011/03/17 15:29:09.0014 5820 Modem (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys
2011/03/17 15:29:09.0280 5820 monitor (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys
2011/03/17 15:29:09.0685 5820 mouclass (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys
2011/03/17 15:29:09.0997 5820 mouhid (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys
2011/03/17 15:29:10.0309 5820 MountMgr (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys
2011/03/17 15:29:10.0496 5820 mpio (583a41f26278d9e0ea548163d6139397) C:\Windows\system32\drivers\mpio.sys
2011/03/17 15:29:10.0699 5820 mpsdrv (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys
2011/03/17 15:29:10.0918 5820 Mraid35x (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys
2011/03/17 15:29:11.0198 5820 MRxDAV (82cea0395524aacfeb58ba1448e8325c) C:\Windows\system32\drivers\mrxdav.sys
2011/03/17 15:29:11.0386 5820 mrxsmb (454341e652bdf5e01b0f2140232b073e) C:\Windows\system32\DRIVERS\mrxsmb.sys
2011/03/17 15:29:11.0510 5820 mrxsmb10 (2a4901aff069944fa945ed5bbf4dcde3) C:\Windows\system32\DRIVERS\mrxsmb10.sys
2011/03/17 15:29:11.0682 5820 mrxsmb20 (28b3f1ab44bdd4432c041581412f17d9) C:\Windows\system32\DRIVERS\mrxsmb20.sys
2011/03/17 15:29:11.0932 5820 msahci (742aed7939e734c36b7e8d6228ce26b7) C:\Windows\system32\drivers\msahci.sys
2011/03/17 15:29:12.0337 5820 msdsm (3fc82a2ae4cc149165a94699183d3028) C:\Windows\system32\drivers\msdsm.sys
2011/03/17 15:29:12.0493 5820 Msfs (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys
2011/03/17 15:29:12.0634 5820 msisadrv (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys
2011/03/17 15:29:12.0805 5820 MSKSSRV (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys
2011/03/17 15:29:13.0086 5820 MSPCLOCK (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys
2011/03/17 15:29:13.0258 5820 MSPQM (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys
2011/03/17 15:29:13.0492 5820 MsRPC (b49456d70555de905c311bcda6ec6adb) C:\Windows\system32\drivers\MsRPC.sys
2011/03/17 15:29:13.0648 5820 mssmbios (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys
2011/03/17 15:29:13.0757 5820 MSTEE (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys
2011/03/17 15:29:13.0991 5820 Mup (6a57b5733d4cb702c8ea4542e836b96c) C:\Windows\system32\Drivers\mup.sys
2011/03/17 15:29:14.0334 5820 NativeWifiP (85c44fdff9cf7e72a40dcb7ec06a4416) C:\Windows\system32\DRIVERS\nwifi.sys
2011/03/17 15:29:14.0552 5820 NDIS (1357274d1883f68300aeadd15d7bbb42) C:\Windows\system32\drivers\ndis.sys
2011/03/17 15:29:14.0771 5820 NdisTapi (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys
2011/03/17 15:29:14.0911 5820 Ndisuio (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys
2011/03/17 15:29:15.0098 5820 NdisWan (818f648618ae34f729fdb47ec68345c3) C:\Windows\system32\DRIVERS\ndiswan.sys
2011/03/17 15:29:15.0332 5820 NDProxy (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys
2011/03/17 15:29:15.0566 5820 NetBIOS (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys
2011/03/17 15:29:15.0707 5820 netbt (ecd64230a59cbd93c85f1cd1cab9f3f6) C:\Windows\system32\DRIVERS\netbt.sys
2011/03/17 15:29:15.0847 5820 nfrd960 (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys
2011/03/17 15:29:15.0972 5820 Npfs (d36f239d7cce1931598e8fb90a0dbc26) C:\Windows\system32\drivers\Npfs.sys
2011/03/17 15:29:16.0066 5820 nsiproxy (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys
2011/03/17 15:29:16.0159 5820 Ntfs (6a4a98cee84cf9e99564510dda4baa47) C:\Windows\system32\drivers\Ntfs.sys
2011/03/17 15:29:16.0331 5820 ntrigdigi (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys
2011/03/17 15:29:16.0409 5820 Null (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys
2011/03/17 15:29:16.0471 5820 nvraid (e69e946f80c1c31c53003bfbf50cbb7c) C:\Windows\system32\drivers\nvraid.sys
2011/03/17 15:29:16.0549 5820 nvstor (9e0ba19a28c498a6d323d065db76dffc) C:\Windows\system32\drivers\nvstor.sys
2011/03/17 15:29:16.0627 5820 nv_agp (07c186427eb8fcc3d8d7927187f260f7) C:\Windows\system32\drivers\nv_agp.sys
2011/03/17 15:29:16.0768 5820 ohci1394 (6f310e890d46e246e0e261a63d9b36b4) C:\Windows\system32\DRIVERS\ohci1394.sys
2011/03/17 15:29:16.0877 5820 Parport (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys
2011/03/17 15:29:16.0986 5820 partmgr (57389fa59a36d96b3eb09d0cb91e9cdc) C:\Windows\system32\drivers\partmgr.sys
2011/03/17 15:29:17.0017 5820 Parvdm (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys
2011/03/17 15:29:17.0126 5820 pci (941dc1d19e7e8620f40bbc206981efdb) C:\Windows\system32\drivers\pci.sys
2011/03/17 15:29:17.0220 5820 pciide (3b1901e401473e03eb8c874271e50c26) C:\Windows\system32\drivers\pciide.sys
2011/03/17 15:29:17.0282 5820 pcmcia (3bb2244f343b610c29c98035504c9b75) C:\Windows\system32\DRIVERS\pcmcia.sys
2011/03/17 15:29:17.0407 5820 PEAUTH (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys
2011/03/17 15:29:17.0657 5820 PptpMiniport (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys
2011/03/17 15:29:17.0735 5820 Processor (0e3cef5d28b40cf273281d620c50700a) C:\Windows\system32\drivers\processr.sys
2011/03/17 15:29:17.0813 5820 PSched (99514faa8df93d34b5589187db3aa0ba) C:\Windows\system32\DRIVERS\pacer.sys
2011/03/17 15:29:17.0938 5820 ql2300 (ccdac889326317792480c0a67156a1ec) C:\Windows\system32\drivers\ql2300.sys
2011/03/17 15:29:18.0078 5820 ql40xx (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys
2011/03/17 15:29:18.0172 5820 QWAVEdrv (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys
2011/03/17 15:29:18.0281 5820 RasAcd (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys
2011/03/17 15:29:18.0390 5820 Rasl2tp (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys
2011/03/17 15:29:18.0515 5820 RasPppoe (509a98dd18af4375e1fc40bc175f1def) C:\Windows\system32\DRIVERS\raspppoe.sys
2011/03/17 15:29:18.0624 5820 RasSstp (2005f4a1e05fa09389ac85840f0a9e4d) C:\Windows\system32\DRIVERS\rassstp.sys
2011/03/17 15:29:18.0671 5820 rdbss (b14c9d5b9add2f84f70570bbbfaa7935) C:\Windows\system32\DRIVERS\rdbss.sys
2011/03/17 15:29:18.0796 5820 RDPCDD (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys
2011/03/17 15:29:18.0889 5820 rdpdr (e8bd98d46f2ed77132ba927fccb47d8b) C:\Windows\system32\drivers\rdpdr.sys
2011/03/17 15:29:18.0998 5820 RDPENCDD (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys
2011/03/17 15:29:19.0108 5820 RDPWD (30bfbdfb7f95559ede971f9ddb9a00ba) C:\Windows\system32\drivers\RDPWD.sys
2011/03/17 15:29:19.0248 5820 rspndr (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys
2011/03/17 15:29:19.0342 5820 RTL8169 (b8b159fa669c6386a458fcd468ebb1e6) C:\Windows\system32\DRIVERS\Rtlh86.sys
2011/03/17 15:29:19.0451 5820 sbp2port (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys
2011/03/17 15:29:19.0576 5820 sdbus (8f36b54688c31eed4580129040c6a3d3) C:\Windows\system32\DRIVERS\sdbus.sys
2011/03/17 15:29:19.0622 5820 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
2011/03/17 15:29:19.0747 5820 Serenum (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys
2011/03/17 15:29:19.0825 5820 Serial (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys
2011/03/17 15:29:19.0872 5820 sermouse (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys
2011/03/17 15:29:19.0997 5820 sffdisk (103b79418da647736ee95645f305f68a) C:\Windows\system32\drivers\sffdisk.sys
2011/03/17 15:29:20.0075 5820 sffp_mmc (8fd08a310645fe872eeec6e08c6bf3ee) C:\Windows\system32\drivers\sffp_mmc.sys
2011/03/17 15:29:20.0106 5820 sffp_sd (9cfa05fcfcb7124e69cfc812b72f9614) C:\Windows\system32\drivers\sffp_sd.sys
2011/03/17 15:29:20.0184 5820 sfloppy (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys
2011/03/17 15:29:20.0340 5820 sisagp (d2a595d6eebeeaf4334f8e50efbc9931) C:\Windows\system32\drivers\sisagp.sys
2011/03/17 15:29:20.0449 5820 SiSRaid2 (cedd6f4e7d84e9f98b34b3fe988373aa) C:\Windows\system32\drivers\sisraid2.sys
2011/03/17 15:29:20.0543 5820 SiSRaid4 (df843c528c4f69d12ce41ce462e973a7) C:\Windows\system32\drivers\sisraid4.sys
2011/03/17 15:29:20.0652 5820 Smb (7b75299a4d201d6a6533603d6914ab04) C:\Windows\system32\DRIVERS\smb.sys
2011/03/17 15:29:20.0730 5820 spldr (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys
2011/03/17 15:29:20.0855 5820 srv (ff3cbc13db84d81f56931bc922cc37c4) C:\Windows\system32\DRIVERS\srv.sys
2011/03/17 15:29:20.0948 5820 srv2 (d15959d9f69f0d39a0153e9c244f20dd) C:\Windows\system32\DRIVERS\srv2.sys
2011/03/17 15:29:21.0058 5820 srvnet (faa0d553a49e85008c6bb3781987c574) C:\Windows\system32\DRIVERS\srvnet.sys
2011/03/17 15:29:21.0151 5820 ssmdrv (5ec550b8952882ee856b862cf648522d) C:\Windows\system32\DRIVERS\ssmdrv.sys
2011/03/17 15:29:21.0260 5820 swenum (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys
2011/03/17 15:29:21.0354 5820 Symc8xx (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys
2011/03/17 15:29:21.0385 5820 Sym_hi (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys
2011/03/17 15:29:21.0479 5820 Sym_u3 (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys
2011/03/17 15:29:21.0572 5820 SynTP (d2aa5d5fdb821eb5f9366c5e3bc2d9ea) C:\Windows\system32\DRIVERS\SynTP.sys
2011/03/17 15:29:21.0744 5820 Tcpip (6a10afce0b38371064be41c1fbfd3c6b) C:\Windows\system32\drivers\tcpip.sys
2011/03/17 15:29:21.0931 5820 Tcpip6 (6a10afce0b38371064be41c1fbfd3c6b) C:\Windows\system32\DRIVERS\tcpip.sys
2011/03/17 15:29:22.0072 5820 tcpipreg (9bf343f4c878d6ad6922b2c5a4fefe0d) C:\Windows\system32\drivers\tcpipreg.sys
2011/03/17 15:29:22.0165 5820 tdcmdpst (1825bceb47bf41c5a9f0e44de82fc27a) C:\Windows\system32\DRIVERS\tdcmdpst.sys
2011/03/17 15:29:22.0259 5820 TDPIPE (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys
2011/03/17 15:29:22.0321 5820 TDTCP (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys
2011/03/17 15:29:22.0384 5820 tdx (76b06eb8a01fc8624d699e7045303e54) C:\Windows\system32\DRIVERS\tdx.sys
2011/03/17 15:29:22.0493 5820 TermDD (3cad38910468eab9a6479e2f01db43c7) C:\Windows\system32\DRIVERS\termdd.sys
2011/03/17 15:29:22.0618 5820 tifm21 (e4c85c291ddb3dc5e4a2f227ca465ba6) C:\Windows\system32\drivers\tifm21.sys
2011/03/17 15:29:22.0852 5820 tosrfec (5c4103544612e5011ef46301b93d1aa6) C:\Windows\system32\DRIVERS\tosrfec.sys
2011/03/17 15:29:22.0961 5820 tos_sps32 (1ea5f27c29405bf49799feca77186da9) C:\Windows\system32\DRIVERS\tos_sps32.sys
2011/03/17 15:29:23.0179 5820 truecrypt (867d1d7c41e319268d4ef47f1f109199) C:\Windows\system32\drivers\truecrypt.sys
2011/03/17 15:29:23.0288 5820 tssecsrv (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys
2011/03/17 15:29:23.0366 5820 tunmp (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys
2011/03/17 15:29:23.0476 5820 tunnel (300db877ac094feab0be7688c3454a9c) C:\Windows\system32\DRIVERS\tunnel.sys
2011/03/17 15:29:23.0554 5820 TVALZ (521c5f39829875adf5466dd94c6282c7) C:\Windows\system32\DRIVERS\TVALZ_O.SYS
2011/03/17 15:29:23.0663 5820 uagp35 (c3ade15414120033a36c0f293d4a4121) C:\Windows\system32\drivers\uagp35.sys
2011/03/17 15:29:23.0756 5820 udfs (d9728af68c4c7693cb100b8441cbdec6) C:\Windows\system32\DRIVERS\udfs.sys
2011/03/17 15:29:23.0897 5820 uliagpkx (75e6890ebfce0841d3291b02e7a8bdb0) C:\Windows\system32\drivers\uliagpkx.sys
2011/03/17 15:29:23.0990 5820 uliahci (3cd4ea35a6221b85dcc25daa46313f8d) C:\Windows\system32\drivers\uliahci.sys
2011/03/17 15:29:24.0084 5820 UlSata (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys
2011/03/17 15:29:24.0162 5820 ulsata2 (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys
2011/03/17 15:29:24.0240 5820 umbus (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys
2011/03/17 15:29:24.0334 5820 usbccgp (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys
2011/03/17 15:29:24.0427 5820 usbcir (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys
2011/03/17 15:29:24.0552 5820 usbehci (79e96c23a97ce7b8f14d310da2db0c9b) C:\Windows\system32\DRIVERS\usbehci.sys
2011/03/17 15:29:24.0661 5820 usbhub (4673bbcb006af60e7abddbe7a130ba42) C:\Windows\system32\DRIVERS\usbhub.sys
2011/03/17 15:29:24.0755 5820 usbohci (38dbc7dd6cc5a72011f187425384388b) C:\Windows\system32\drivers\usbohci.sys
2011/03/17 15:29:24.0833 5820 usbprint (e75c4b5269091d15a2e7dc0b6d35f2f5) C:\Windows\system32\DRIVERS\usbprint.sys
2011/03/17 15:29:24.0942 5820 usbscan (a508c9bd8724980512136b039bba65e9) C:\Windows\system32\DRIVERS\usbscan.sys
2011/03/17 15:29:25.0036 5820 USBSTOR (be3da31c191bc222d9ad503c5224f2ad) C:\Windows\system32\DRIVERS\USBSTOR.SYS
2011/03/17 15:29:25.0145 5820 usbuhci (814d653efc4d48be3b04a307eceff56f) C:\Windows\system32\DRIVERS\usbuhci.sys
2011/03/17 15:29:25.0223 5820 usbvideo (0a6b81f01bc86399482e27e6fda7b33b) C:\Windows\system32\Drivers\usbvideo.sys
2011/03/17 15:29:25.0332 5820 vga (7d92be0028ecdedec74617009084b5ef) C:\Windows\system32\DRIVERS\vgapnp.sys
2011/03/17 15:29:25.0441 5820 VgaSave (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys
2011/03/17 15:29:25.0550 5820 viaagp (045d9961e591cf0674a920b6ba3ba5cb) C:\Windows\system32\drivers\viaagp.sys
2011/03/17 15:29:25.0644 5820 ViaC7 (56a4de5f02f2e88182b0981119b4dd98) C:\Windows\system32\drivers\viac7.sys
2011/03/17 15:29:25.0691 5820 viaide (fd2e3175fcada350c7ab4521dca187ec) C:\Windows\system32\drivers\viaide.sys
2011/03/17 15:29:25.0800 5820 volmgr (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys
2011/03/17 15:29:25.0909 5820 volmgrx (23e41b834759917bfd6b9a0d625d0c28) C:\Windows\system32\drivers\volmgrx.sys
2011/03/17 15:29:26.0018 5820 volsnap (147281c01fcb1df9252de2a10d5e7093) C:\Windows\system32\drivers\volsnap.sys
2011/03/17 15:29:26.0112 5820 vsmraid (d984439746d42b30fc65a4c3546c6829) C:\Windows\system32\drivers\vsmraid.sys
2011/03/17 15:29:26.0174 5820 WacomPen (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys
2011/03/17 15:29:26.0284 5820 Wanarp (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
2011/03/17 15:29:26.0299 5820 Wanarpv6 (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
2011/03/17 15:29:26.0393 5820 Wd (afc5ad65b991c1e205cf25cfdbf7a6f4) C:\Windows\system32\drivers\wd.sys
2011/03/17 15:29:26.0471 5820 Wdf01000 (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys
2011/03/17 15:29:26.0736 5820 WmiAcpi (701a9f884a294327e9141d73746ee279) C:\Windows\system32\drivers\wmiacpi.sys
2011/03/17 15:29:26.0861 5820 ws2ifsl (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys
2011/03/17 15:29:26.0954 5820 WUDFRd (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys
2011/03/17 15:29:27.0048 5820 ================================================================================
2011/03/17 15:29:27.0048 5820 Scan finished
2011/03/17 15:29:27.0048 5820 ================================================================================

Gruß, Conny

cosinus · 17.03.2011, 19:33

Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Downloade Dir danach bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.

Doppelklick auf die MBRCheck.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Das Tool braucht nur einige Sekunden.
Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.

Poste mir bitte den Inhalt des .txt Dokumentes

Conny W. · 17.03.2011, 22:18

Moin

Und nochmal eine Reihe neue logs.

GMER

GMER Logfile:

Code:

ATTFilter

GMER 1.0.15.15530 - hxxp://www.gmer.net
Rootkit scan 2011-03-17 21:43:43
Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 Hitachi_ rev.BBCO
Running: g2m3e4r.exe; Driver: C:\Users\Admin\AppData\Local\Temp\pwlcrpod.sys


---- System - GMER 1.0.15 ----

SSDT            9A783054                                                                                             ZwCreateThread
SSDT            9A783040                                                                                             ZwOpenProcess
SSDT            9A783045                                                                                             ZwOpenThread
SSDT            9A78304F                                                                                             ZwTerminateProcess

---- Kernel code sections - GMER 1.0.15 ----

.text           ntkrnlpa.exe!KeSetEvent + 221                                                                        820B39A4 4 Bytes  [54, 30, 78, 9A] {PUSH ESP; XOR [EAX-0x66], BH}
.text           ntkrnlpa.exe!KeSetEvent + 3F1                                                                        820B3B74 4 Bytes  [40, 30, 78, 9A] {INC EAX; XOR [EAX-0x66], BH}
.text           ntkrnlpa.exe!KeSetEvent + 40D                                                                        820B3B90 4 Bytes  [45, 30, 78, 9A] {INC EBP; XOR [EAX-0x66], BH}
.text           ntkrnlpa.exe!KeSetEvent + 621                                                                        820B3DA4 4 Bytes  [4F, 30, 78, 9A] {DEC EDI; XOR [EAX-0x66], BH}
.text           C:\Windows\system32\DRIVERS\tos_sps32.sys                                                            section is writeable [0x88555000, 0x4036D, 0xE8000020]
.dsrt           C:\Windows\system32\DRIVERS\tos_sps32.sys                                                            unknown last section [0x8859E000, 0x510, 0x40000040]

---- User IAT/EAT - GMER 1.0.15 ----

IAT             C:\Windows\Explorer.EXE[2920] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown]                [732E7817] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[2920] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage]                 [7333A86D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[2920] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI]             [732EBB22] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[2920] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode]       [732DF695] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[2920] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup]                 [732E75E9] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[2920] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC]              [732DE7CA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[2920] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStreamICM]  [73318395] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[2920] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStream]     [732EDA60] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[2920] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight]             [732DFFFA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[2920] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth]              [732DFF61] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[2920] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage]               [732D71CF] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[2920] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFileICM]       [7336CAE2] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[2920] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFile]          [7330C8D8] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[2920] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics]             [732DD968] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[2920] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree]                       [732D6853] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[2920] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc]                      [732D687E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[2920] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode]         [732E2AD1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

---- Devices - GMER 1.0.15 ----

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                                                              Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice  \Driver\kbdclass \Device\KeyboardClass1                                                              Wdf01000.sys (WDF Dynamic/Microsoft Corporation)

---- EOF - GMER 1.0.15 ----

--- --- ---

Anmerkung: Dass GMER einfach aufhört zu arbeiten ohne extra "done" oder etwas in der Art zu melden ist normal, oder?

OSAM

OSAM Logfile:

Code:

ATTFilter

Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 22:01:10 on 17.03.2011

OS: Windows Vista Home Premium Edition Service Pack 2 (Build 6002), 32-bit
Default Browser: Mozilla Corporation Firefox 3.0.19

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Common]
-----( %SystemRoot%\Tasks )-----
"GoogleUpdateTaskMachine.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"1-Klick-Wartung.job" - "TuneUp Software GmbH" - C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"DivXControlPanelApplet.cpl" - "DivX, Inc." - C:\Windows\system32\DivXControlPanelApplet.cpl
"javacpl.cpl" - "Sun Microsystems, Inc." - C:\Windows\system32\javacpl.cpl
"PhysX.cpl" - ? - C:\Windows\system32\PhysX.cpl
"TOSCDSPD.cpl" - ? - C:\Windows\system32\TOSCDSPD.cpl  (File found, but it contains no detailed information)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"Pando" - "Pando Networks" - C:\Program Files\Pando Networks\Media Booster\PMB.cpl
"QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"avgio" (avgio) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avgio.sys
"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys
"catchme" (catchme) - ? - C:\Users\Admin\AppData\Local\Temp\catchme.sys  (File not found)
"igfx" (igfx) - ? - C:\Windows\System32\DRIVERS\igdkmd32.sys  (File not found)
"IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys  (File not found)
"IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys  (File not found)
"IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys  (File not found)
"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys
"Tosrfcom" (Tosrfcom) - ? - C:\Windows\system32\drivers\Tosrfcom.sys  (File not found)
"Touch Pad Detection Filter driver" (TpChoice) - ? - C:\Windows\System32\DRIVERS\TpChoice.sys  (File not found)
"truecrypt" (truecrypt) - "TrueCrypt Foundation" - C:\Windows\System32\drivers\truecrypt.sys

[Explorer]
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems Incorporated" - C:\Windows\system32\PDFShell.dll
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----
{AEB6717E-7E19-11d0-97EE-00C04FD91972} "{AEB6717E-7E19-11d0-97EE-00C04FD91972}" - ? -   (File not found | COM-object registry key not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? -   (File not found | COM-object registry key not found)
{23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Program Files\7-Zip\7-zip.dll
{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)
{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)
{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? -   (File not found | COM-object registry key not found)
{FCF608CF-5716-47C3-A1A8-991D873AF72B} "Delphi Context Menu Shell Extension Example" - ? - C:\PROGRA~1\Exifer\EXIFER~1.DLL  (File found, but it contains no detailed information)
{8BE13461-936F-11D1-A87D-444553540000} "Eraser Shell Extension" - "-" - C:\Windows\system32\erasext.dll
{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? -   (File not found | COM-object registry key not found)
{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? -   (File not found | COM-object registry key not found)
{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Program Files\iTunes\iTunesMiniPlayer.dll
{00020d75-0000-0000-c000-000000000046} "lnkfile" - ? -   (File not found | COM-object registry key not found)
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\msohevi.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\ONFILTER.DLL
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} "RealOne Player Context Menu Class" - "RealNetworks, Inc." - C:\Program Files\Real\RealPlayer\rpshell.dll
{34F4B935-17DC-4885-8BC9-CCD1ADF42F93} "Record ISO Image to CD" - ? -   (File not found | COM-object registry key not found)
{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)
{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll
{5E2121EE-0300-11D4-8D3B-444553540000} "SimpleShlExt Class" - ? - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll
{4858E7D9-8E12-45a3-B6A3-1CD128C9D403} "TuneUp Shredder Shell Extension" - "TuneUp Software GmbH" - C:\PROGRA~1\TUNEUP~1\SDShelEx-win32.dll
{44440D00-FF19-4AFC-B765-9A0970567D97} "TuneUp Theme Extension" - "TuneUp Software GmbH" - C:\Windows\System32\uxtuneup.dll
{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -   (File not found | COM-object registry key not found)

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
ITBar7Height "ITBar7Height" - ? -   (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)
<binary data> "{C55BBCD6-41AD-48AD-9953-3609C48EACC7}" - ? -   (File not found | COM-object registry key not found)
<binary data> "{EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107}" - ? -   (File not found | COM-object registry key not found)
-----( HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks )-----
{E312764E-7706-43F1-8DAB-FCDD2B1E416D} "{E312764E-7706-43F1-8DAB-FCDD2B1E416D}" - ? -   (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{67DABFBF-D0AB-41FA-9C46-CC0F21721616} "DivXBrowserPlugin Object" - "DivX,Inc." - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll / hxxp://download.divx.com/player/DivXBrowserPlugin.cab
{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} "Java Plug-in 1.6.0" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre1.6.0\bin\ssv.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab
{D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" - "Adobe Systems, Inc." - C:\Windows\system32\Macromed\Flash\Flash10b.ocx / hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
{2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} "Symantec AntiVirus scanner" - "Symantec Corporation" - C:\Windows\Downloaded Program Files\avsniff.dll / hxxp://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
{644E432F-49D3-41A1-8DD5-E099162EEEC5} "Symantec RuFSI Utility Class" - "Symantec Corporation" - C:\Windows\Downloaded Program Files\rufsi.dll / hxxp://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
{8FFBE65D-2C9C-4669-84BD-5829DC0B603C} "{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}" - ? -   (File not found | COM-object registry key not found) / hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars )-----
{855F3B16-6D32-4fe6-8A56-BBB695989046} "{855F3B16-6D32-4fe6-8A56-BBB695989046}" - ? -   (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBC} "ClsidExtension" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
{53707962-6F74-2D53-2644-206D7942484F} "ClsidExtension" - "Safer Networking Limited" - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
"eBay" - ? - hxxp://www.webtip.ch/cgi-bin/toshiba/tracker_url_de.pl?hxxp://www.ebay.de/  (HTTP value)
"ICQ6" - "ICQ, LLC." - C:\Program Files\ICQ6.5\ICQ.exe
{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "AcroIEHlprObj Class" - ? - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} "Java(tm) Plug-In SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
{3049C3E9-B461-4BC5-8870-4C09146192CA} "RealPlayer Download and Record Plugin for Internet Explorer" - "RealPlayer" - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
{53707962-6F74-2D53-2644-206D7942484F} "Spybot-S&D IE Protection" - "Safer Networking Limited" - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
{201f27d4-3704-41d6-89c1-aa35e39143ed} "{201f27d4-3704-41d6-89c1-aa35e39143ed}" - ? -   (File not found | COM-object registry key not found)
{3160baf9-cf68-48ec-9076-faed7ce49467} "{3160baf9-cf68-48ec-9076-faed7ce49467}" - ? -   (File not found | COM-object registry key not found)
{B922D405-6D13-4A2B-AE89-08A030DA4402} "{B922D405-6D13-4A2B-AE89-08A030DA4402}" - ? -   (File not found | COM-object registry key not found)
{C5D07EB6-BBCE-4DAE-ACBB-D13A8D28CB1F} "{C5D07EB6-BBCE-4DAE-ACBB-D13A8D28CB1F}" - ? -   (File not found | COM-object registry key not found)
{fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} "{fc2b76fc-2132-4d80-a9a3-1f5c6e49066b}" - ? -   (File not found | COM-object registry key not found)

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
"OpenOffice.org 3.0.lnk" - ? - C:\Program Files\OpenOffice.org 3\program\quickstart.exe  (Shortcut exists | File found, but it contains no detailed information | File exists)
-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"Acrobat Assistant.lnk" - "Adobe Systems Inc." - C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe  (Shortcut exists | File exists)
"Adobe Gamma Loader.lnk" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe  (Shortcut exists | File exists)
"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
"Privoxy.lnk" - "The Privoxy team - www.privoxy.org" - C:\Program Files\Vidalia Bundle\Privoxy\privoxy.exe  (Shortcut exists | File exists)
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"Eraser" - "The Eraser Project" - C:\Program Files\Eraser\Eraser.exe -hide
"SpybotSD TeaTimer" - "Safer-Networking Ltd." - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
"TrueCrypt" - "TrueCrypt Foundation" - "C:\Program Files\TrueCrypt\TrueCrypt.exe" /q preferences
"Vidalia" - ? - "C:\Program Files\Vidalia Bundle\Vidalia\vidalia.exe"
-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----
"StartupPrograms" - ? - rdpclip  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"AppleSyncNotifier" - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
"ATICustomerCare" - "Advanced Micro Devices, Inc." - "C:\Program Files\ATI\ATICustomerCare\ATICustomerCare.exe"
"avgnt" - "Avira GmbH" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
"DivXUpdate" - ? - "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
"IAAnotif" - "Intel Corporation" - C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
"iTunesHelper" - "Apple Inc." - "C:\Program Files\iTunes\iTunesHelper.exe"
"KeNotify" - ? - C:\Program Files\TOSHIBA\Utilities\KeNotify.exe
"NDSTray.exe" - ? - NDSTray.exe  (File not found)
"OpwareSE4" - "ScanSoft, Inc." - "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
"QuickTime Task" - "Apple Inc." - "C:\Program Files\QuickTime\QTTask.exe" -atboottime
"SearchSettings" - "GreenTree Applications, Inc." - C:\Program Files\pdfforge Toolbar\SearchSettings.exe
"SSBkgdUpdate" - "Nuance Communications, Inc." - "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
"StartCCC" - ? - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe  (File found, but it contains no detailed information)
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Java\jre1.6.0\bin\jusched.exe"
"SVPWUTIL" - "TOSHIBA" - C:\Program Files\TOSHIBA\Utilities\SVPWUTIL.exe SVPwUTIL
"TkBellExe" - "RealNetworks, Inc." - "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
"topi" - "TOSHIBA" - C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe -startup
"Toshiba Registration" - "Toshiba" - C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"PDF Port" - "Adobe Systems Incorporated." - C:\Windows\system32\pdfports.dll
"PDFCreator" - ? - C:\Windows\system32\pdfcmnnt.dll  (File found, but it contains no detailed information)
"Send To Microsoft OneNote Monitor" - "Microsoft Corporation" - C:\Windows\system32\msonpmon.dll
"Toshiba Bluetooth Monitor" - "TOSHIBA CORPORATION." - C:\Windows\system32\tbtmon.dll

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"@%SystemRoot%\System32\TuneUpDefragService.exe,-1" (TuneUp.Defrag) - "TuneUp Software GmbH" - C:\Windows\System32\TuneUpDefragService.exe
"@%SystemRoot%\System32\uxtuneup.dll,-4096" (UxTuneUp) - "TuneUp Software GmbH" - C:\Windows\System32\uxtuneup.dll
"@C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\sched.exe
"Bonjour-Dienst" (Bonjour Service) - "Apple Inc." - C:\Program Files\Bonjour\mDNSResponder.exe
"ConfigFree Service" (CFSvcs) - "TOSHIBA CORPORATION" - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
"Firebird Server - MAGIX Instance" (FirebirdServerMAGIXInstance) - "MAGIX®" - C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe
"Google Update Service (gupdate1c9c02186560296)" (gupdate1c9c02186560296) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"ICQ Service" (ICQ Service) - ? - C:\Program Files\ICQ6Toolbar\ICQ Service.exe
"InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
"Intel(R) Matrix Storage Event Monitor" (IAANTMON) - "Intel Corporation" - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Program Files\iPod\bin\iPodService.exe
"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
"NMSAccessU" (NMSAccessU) - ? - C:\Program Files\CDBurnerXP\NMSAccessU.exe  (File found, but it contains no detailed information)
"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"TOSHIBA Bluetooth Service" (TOSHIBA Bluetooth Service) - ? - c:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe  (File not found)
"TOSHIBA Navi Support Service" (TNaviSrv) - "TOSHIBA Corporation" - C:\Program Files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe
"TOSHIBA Optical Disc Drive Service" (TODDSrv) - "TOSHIBA Corporation" - C:\Windows\system32\TODDSrv.exe
"TOSHIBA Power Saver" (TosCoSrv) - "TOSHIBA Corporation" - C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
"Ulead Burning Helper" (UleadBurningHelper) - "Ulead Systems, Inc." - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

[Winlogon]
-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )-----
"igfxcui" - ? - igfxdev.dll  (File not found)

[Winsock Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----
"mdnsNSP" - "Apple Inc." - C:\Program Files\Bonjour\mdnsNSP.dll

===[ Logfile end ]=========================================[ Logfile end ]===

--- --- ---

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

Anmerkung: Punkt 7. der OSAM-Anleitung konnte ich nicht ausführen, da nach Abfrage der online-Datenbank nur die Option "close" zur Verfügung stand (nicht "next"->"next"->"next"). Habe nach "close" das log dennoch gespeichert - hoffe, es war okay so?

MBR Check

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows Vista Home Premium Edition
Windows Information: Service Pack 2 (build 6002), 32-bit
Base Board Manufacturer: TOSHIBA
BIOS Manufacturer: TOSHIBA
System Manufacturer: TOSHIBA
System Product Name: Satellite A200
Logical Drives Mask: 0x00000034

Kernel Drivers (total 150):
0x8204F000 \SystemRoot\system32\ntkrnlpa.exe
0x8201C000 \SystemRoot\system32\hal.dll
0x80602000 \SystemRoot\system32\kdcom.dll
0x80609000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x80679000 \SystemRoot\system32\PSHED.dll
0x8068A000 \SystemRoot\system32\BOOTVID.dll
0x80692000 \SystemRoot\system32\CLFS.SYS
0x806D3000 \SystemRoot\system32\CI.dll
0x82601000 \SystemRoot\system32\drivers\Wdf01000.sys
0x8267D000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x8268A000 \SystemRoot\system32\drivers\acpi.sys
0x826D0000 \SystemRoot\system32\drivers\WMILIB.SYS
0x826D9000 \SystemRoot\system32\drivers\msisadrv.sys
0x826E1000 \SystemRoot\system32\drivers\pci.sys
0x82708000 \SystemRoot\system32\DRIVERS\LPCFilter.sys
0x82712000 \SystemRoot\System32\drivers\partmgr.sys
0x82721000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x82724000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x8272E000 \SystemRoot\system32\drivers\volmgr.sys
0x8273D000 \SystemRoot\System32\drivers\volmgrx.sys
0x82787000 \SystemRoot\system32\drivers\intelide.sys
0x8278E000 \SystemRoot\system32\drivers\PCIIDEX.SYS
0x8279C000 \SystemRoot\system32\DRIVERS\pcmcia.sys
0x827C9000 \SystemRoot\System32\drivers\mountmgr.sys
0x82C06000 \SystemRoot\system32\DRIVERS\iaStor.sys
0x82CC4000 \SystemRoot\system32\drivers\atapi.sys
0x82CCC000 \SystemRoot\system32\drivers\ataport.SYS
0x82CEA000 \SystemRoot\system32\drivers\msahci.sys
0x82CF3000 \SystemRoot\system32\drivers\fltmgr.sys
0x82D25000 \SystemRoot\system32\drivers\fileinfo.sys
0x82D35000 \SystemRoot\System32\Drivers\ksecdd.sys
0x82E0B000 \SystemRoot\system32\drivers\ndis.sys
0x82F16000 \SystemRoot\system32\drivers\msrpc.sys
0x82F41000 \SystemRoot\system32\drivers\NETIO.SYS
0x88206000 \SystemRoot\System32\drivers\tcpip.sys
0x882F3000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x8840A000 \SystemRoot\System32\Drivers\Ntfs.sys
0x8851A000 \SystemRoot\system32\drivers\volsnap.sys
0x88553000 \SystemRoot\system32\DRIVERS\TVALZ_O.SYS
0x88558000 \SystemRoot\system32\DRIVERS\tos_sps32.sys
0x885A3000 \SystemRoot\System32\Drivers\spldr.sys
0x885AB000 \SystemRoot\System32\Drivers\mup.sys
0x885BA000 \SystemRoot\System32\drivers\ecache.sys
0x885E1000 \SystemRoot\system32\drivers\disk.sys
0x8830E000 \SystemRoot\system32\drivers\CLASSPNP.SYS
0x885F2000 \SystemRoot\system32\drivers\crcdisk.sys
0x88400000 \SystemRoot\system32\DRIVERS\CplIR.SYS
0x8832F000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x8833A000 \SystemRoot\system32\DRIVERS\tunmp.sys
0x88343000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x8BE02000 \SystemRoot\system32\DRIVERS\atikmdag.sys
0x8C4DA000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x8C57A000 \SystemRoot\System32\drivers\watchdog.sys
0x88352000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x8C586000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0x8C591000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x8C5CF000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x8C5DE000 \SystemRoot\system32\DRIVERS\Rtlh86.sys
0x8C80D000 \SystemRoot\system32\DRIVERS\athr.sys
0x8C8BB000 \SystemRoot\system32\DRIVERS\ohci1394.sys
0x8C8CB000 \SystemRoot\system32\DRIVERS\1394BUS.SYS
0x8C8D9000 \SystemRoot\system32\drivers\tifm21.sys
0x8C925000 \SystemRoot\system32\DRIVERS\sdbus.sys
0x8C93F000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0x8C943000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x8C956000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x8C961000 \SystemRoot\system32\DRIVERS\SynTP.sys
0x8C98E000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x8C990000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x8C99B000 \SystemRoot\system32\DRIVERS\tdcmdpst.sys
0x8C99F000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x8C9B7000 \SystemRoot\System32\Drivers\GEARAspiWDM.sys
0x8C9BD000 \SystemRoot\system32\DRIVERS\msiscsi.sys
0x82F7C000 \SystemRoot\system32\DRIVERS\storport.sys
0x8C9EC000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x883DF000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x8C800000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x82FBD000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x82FE0000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x82DA6000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x82DBA000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x82FEF000 \SystemRoot\system32\DRIVERS\termdd.sys
0x8C80B000 \SystemRoot\system32\DRIVERS\swenum.sys
0x82DCF000 \SystemRoot\system32\DRIVERS\ks.sys
0x827D9000 \SystemRoot\system32\DRIVERS\circlass.sys
0x8C5F6000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x827E7000 \SystemRoot\system32\DRIVERS\umbus.sys
0x807B3000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x807E8000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x8CE08000 \SystemRoot\system32\drivers\AtihdLH3.sys
0x8CE24000 \SystemRoot\system32\drivers\portcls.sys
0x8CE51000 \SystemRoot\system32\drivers\drmk.sys
0x8D00E000 \SystemRoot\system32\drivers\RTKVHDA.sys
0x8CE76000 \SystemRoot\system32\DRIVERS\AGRSM.sys
0x8D1C1000 \SystemRoot\system32\drivers\modem.sys
0x8CF92000 \SystemRoot\System32\drivers\truecrypt.sys
0x8D1CE000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0x8D1D7000 \SystemRoot\System32\Drivers\Null.SYS
0x8D1DE000 \SystemRoot\System32\Drivers\Beep.SYS
0x8D1EE000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x8D000000 \SystemRoot\System32\drivers\vga.sys
0x8CFCA000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x8D1E5000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x8D1F5000 \SystemRoot\system32\drivers\rdpencdd.sys
0x8CFEB000 \SystemRoot\System32\Drivers\Msfs.SYS
0x8D206000 \SystemRoot\System32\Drivers\Npfs.SYS
0x8D214000 \SystemRoot\System32\DRIVERS\rasacd.sys
0x8D21D000 \SystemRoot\system32\DRIVERS\tdx.sys
0x8D233000 \SystemRoot\system32\DRIVERS\smb.sys
0x8D247000 \SystemRoot\system32\drivers\afd.sys
0x8D28F000 \SystemRoot\System32\DRIVERS\netbt.sys
0x8D2C1000 \SystemRoot\system32\DRIVERS\pacer.sys
0x8D2D7000 \SystemRoot\system32\DRIVERS\netbios.sys
0x8D2E5000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x8D2F8000 \SystemRoot\system32\DRIVERS\ssmdrv.sys
0x8D2FE000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x8D33A000 \SystemRoot\system32\drivers\nsiproxy.sys
0x8D344000 \SystemRoot\System32\Drivers\dfsc.sys
0x8D35B000 \SystemRoot\system32\DRIVERS\avipbb.sys
0x8D377000 \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys
0x8D379000 \SystemRoot\system32\DRIVERS\hidusb.sys
0x8D382000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x8D392000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x974F0000 \SystemRoot\System32\win32k.sys
0x8D39A000 \SystemRoot\System32\drivers\Dxapi.sys
0x8D3A4000 \SystemRoot\system32\DRIVERS\monitor.sys
0x97710000 \SystemRoot\System32\TSDDD.dll
0x97730000 \SystemRoot\System32\cdd.dll
0x8D3B3000 \SystemRoot\system32\drivers\luafv.sys
0x8D3CE000 \SystemRoot\system32\DRIVERS\avgntflt.sys
0x99E07000 \SystemRoot\system32\drivers\spsys.sys
0x99EB7000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x99EC7000 \SystemRoot\system32\DRIVERS\nwifi.sys
0x99EF1000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x99EFB000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x99F0E000 \SystemRoot\system32\drivers\HTTP.sys
0x99F7B000 \SystemRoot\System32\DRIVERS\srvnet.sys
0x99F98000 \SystemRoot\system32\DRIVERS\bowser.sys
0x99FB1000 \SystemRoot\System32\drivers\mpsdrv.sys
0x99FC6000 \SystemRoot\system32\drivers\mrxdav.sys
0x9B40B000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0x9B42A000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0x9B463000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0x9B47B000 \SystemRoot\System32\DRIVERS\srv2.sys
0x9B4A3000 \SystemRoot\System32\DRIVERS\srv.sys
0x9B509000 \SystemRoot\system32\drivers\peauth.sys
0x9B5E7000 \SystemRoot\System32\Drivers\secdrv.SYS
0x9B5F1000 \SystemRoot\System32\drivers\tcpipreg.sys
0x9B4F1000 \SystemRoot\system32\DRIVERS\cdfs.sys
0x77890000 \Windows\System32\ntdll.dll

Processes (total 85):
0 System Idle Process
4 System
460 C:\Windows\System32\smss.exe
532 csrss.exe
584 C:\Windows\System32\wininit.exe
596 csrss.exe
628 C:\Windows\System32\services.exe
640 C:\Windows\System32\lsass.exe
652 C:\Windows\System32\lsm.exe
692 C:\Windows\System32\winlogon.exe
852 C:\Windows\System32\svchost.exe
916 C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
960 C:\Windows\System32\svchost.exe
1100 C:\Windows\System32\Ati2evxx.exe
1116 C:\Windows\System32\svchost.exe
1168 C:\Windows\System32\svchost.exe
1204 C:\Windows\System32\svchost.exe
1276 C:\Windows\System32\audiodg.exe
1300 C:\Windows\System32\svchost.exe
1320 C:\Windows\System32\SLsvc.exe
1372 C:\Windows\System32\svchost.exe
1432 C:\Windows\System32\Ati2evxx.exe
1592 C:\Windows\System32\svchost.exe
1824 C:\Windows\System32\spoolsv.exe
1848 C:\Program Files\Avira\AntiVir Desktop\sched.exe
1860 C:\Windows\System32\svchost.exe
220 C:\Windows\System32\agrsmsvc.exe
308 C:\Program Files\Avira\AntiVir Desktop\avguard.exe
300 C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
404 C:\Program Files\Bonjour\mDNSResponder.exe
484 C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
1452 C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
1532 C:\Program Files\ICQ6Toolbar\ICQ Service.exe
1608 C:\Program Files\Google\Update\GoogleUpdate.exe
2100 C:\Program Files\CDBurnerXP\NMSAccessU.exe
2136 C:\Windows\System32\svchost.exe
2164 C:\Windows\System32\svchost.exe
2208 C:\Program Files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe
2240 C:\Windows\System32\TODDSrv.exe
2276 C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
2328 C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
2396 C:\Windows\System32\svchost.exe
2420 C:\Windows\System32\SearchIndexer.exe
3552 C:\Windows\System32\dwm.exe
3588 C:\Windows\explorer.exe
3616 C:\Windows\System32\taskeng.exe
4084 C:\Program Files\TOSHIBA\Utilities\KeNotify.exe
336 C:\Windows\RtHDVCpl.exe
1440 C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
2456 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
1064 C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
1584 C:\Program Files\ScanSoft\OmniPageSE4.0\OpWareSE4.exe
624 C:\Program Files\Java\jre1.6.0\bin\jusched.exe
2304 C:\Program Files\pdfforge Toolbar\SearchSettings.exe
2508 C:\Program Files\Common Files\Real\Update_OB\realsched.exe
704 C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
2172 C:\Program Files\iTunes\iTunesHelper.exe
1956 C:\Program Files\DivX\DivX Update\DivXUpdate.exe
1904 C:\Program Files\Windows Sidebar\sidebar.exe
1056 C:\Program Files\Eraser\Eraser.exe
860 C:\Program Files\TrueCrypt\TrueCrypt.exe
580 C:\Program Files\Vidalia Bundle\Vidalia\vidalia.exe
2920 C:\Program Files\Windows Media Player\wmpnscfg.exe
2900 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
2896 C:\Program Files\Windows Media Player\wmpnetwk.exe
2064 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
820 C:\Program Files\Adobe\Acrobat 5.0\Distillr\acrotray.exe
2936 C:\Program Files\Vidalia Bundle\Privoxy\privoxy.exe
984 C:\Program Files\OpenOffice.org 3\program\soffice.exe
2972 C:\Program Files\Synaptics\SynTP\SynToshiba.exe
3180 C:\Program Files\OpenOffice.org 3\program\soffice.bin
3428 C:\Windows\System32\svchost.exe
4080 C:\Program Files\TOSHIBA\ConfigFree\CFSwMgr.exe
3168 C:\Program Files\iPod\bin\iPodService.exe
1668 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
3400 C:\Program Files\Windows Defender\MSASCui.exe
2320 C:\Windows\System32\svchost.exe
4540 C:\Program Files\Mozilla Firefox\firefox.exe
3296 C:\Users\Admin\Desktop\osam_autorun_manager_version_portable\osam.exe
5208 taskeng.exe
5604 C:\Windows\System32\taskeng.exe
5528 C:\Windows\System32\SearchProtocolHost.exe
5696 C:\Windows\System32\SearchFilterHost.exe
3352 C:\Users\Admin\Desktop\MBRCheck.exe
2460 C:\Windows\System32\conime.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`5dd00000 (NTFS)
\\.\E: --> \\.\PhysicalDrive0 at offset 0x00000012`ebd00000 (NTFS)

PhysicalDrive0 Model Number: HitachiHTS542516K9SA00, Rev: BBCOC33P

Size Device Name MBR Status
--------------------------------------------
149 GB \\.\PhysicalDrive0 Windows 2008 MBR code detected
SHA1: 8DF43F2BDE2D9451948FA14B5279969C777A7979

Done!

Besten Gruß, Conny

cosinus · 18.03.2011, 11:41

Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SUPERAntiSpyware und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

Conny W. · 18.03.2011, 19:16

Hier die neuen logs:

mbam:

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6098

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.19019

18.03.2011 15:59:05
mbam-log-2011-03-18 (15-59-05).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|E:\|)
Durchsuchte Objekte: 303551
Laufzeit: 1 Stunde(n), 26 Minute(n), 11 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

SUPERAntiSpyware:

SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 03/18/2011 at 06:30 PM

Application Version : 4.50.1002

Core Rules Database Version : 6623
Trace Rules Database Version: 4435

Scan type : Complete Scan
Total Scan Time : 02:19:12

Memory items scanned : 832
Memory threats detected : 0
Registry items scanned : 7968
Registry threats detected : 0
File items scanned : 154256
File threats detected : 1

Trojan.Agent/Gen-Cryptor[Virut]
C:\TOSHIBA\EBAY\ADDTOOLBARBUTTON.EXE

Gruß, Conny

cosinus · 18.03.2011, 21:15

Nur ein Fehlalarm.
Rechner soweit wieder ok?

Conny W. · 19.03.2011, 15:50

Nur ein Fehlalarm? Inwiefern?
Meinst Du nur die letzte Meldung oder war bei der ganzen Sache von Anfang an gar kein Trojaner (o.ä.) im Spiel? Soll ich Superspyware den Fund löschen lassen oder nicht?

Ob mein Rechner soweit wieder in Ordnung ist kann ich nicht recht sagen. Einerseits läuft er stabiler als vor der Behandlung und erhitzt nicht mehr ganz so schnell, andererseits habe ich das Gefühl das er immernoch ein bisschen angeschlagen ist - aber vielleicht kann das auch andere Gründe haben?

Außerdem tauchen im Taskmanager nun Unmengen von svchost.exen von Netzwerk-, System-, und Lokalen Diensten auf (nachgezählt im Moment 12). Obwohl ich den Taskmanager in letzter Zeit häufig aufmerksam betrachtet habe (nach "trojaner.exe" o.ä. gesucht :P) glaube ich, das so noch nicht gesehen zu haben... kann da was faul sein? :/

Nach der Trojaner-Meldung habe ich mit meinem Rechner nichts daten-empfindliches (email, banking, ebay, paypal etc) mehr gemacht. Sollte ich das auch in Zukunft vermeiden oder sollte mein Rechner soweit (wieder) sicher sein?

Besten Gruß, Conny

cosinus · 19.03.2011, 20:34

Zitat:

Nur ein Fehlalarm? Inwiefern?

Aus dem letzten Kontrollscan. War der Zusammenhang jetzt so schwierig?

Zitat:

andererseits habe ich das Gefühl das er immernoch ein bisschen angeschlagen ist - aber vielleicht kann das auch andere Gründe haben?

Wenn du selbst nicht sagen kannst, ob der Rechner wieder besser läuft kann ich dir nur noch eine Neuinstallation empfehlen.

Zitat:

Nach der Trojaner-Meldung habe ich mit meinem Rechner nichts daten-empfindliches (email, banking, ebay, paypal etc) mehr gemacht. Sollte ich das auch in Zukunft vermeiden oder sollte mein Rechner soweit (wieder) sicher sein?

Siehe oben. Es gibt keine 100% Sicherheit, wenn du alles Risiko minimieren willst, kannst du im Grunde jeden Tag formatieren oder Banking nur noch per Linux-Live-CD erledigen.

17.03.2011, 13:01	#16
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Trojaner(?) - "Backdoor:Win32/Cycbot.B" fund durch Windows Defender Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html __________________ Logfiles bitte immer in CODE-Tags posten

18.03.2011, 11:41	#20
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Trojaner(?) - "Backdoor:Win32/Cycbot.B" fund durch Windows Defender Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SUPERAntiSpyware und poste die Logs. Denk dran beide Tools zu updaten vor dem Scan!! __________________ Logfiles bitte immer in CODE-Tags posten

18.03.2011, 21:15	#22
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Trojaner(?) - "Backdoor:Win32/Cycbot.B" fund durch Windows Defender Nur ein Fehlalarm. Rechner soweit wieder ok? __________________ Logfiles bitte immer in CODE-Tags posten

Trojaner(?) - "Backdoor:Win32/Cycbot.B" fund durch Windows Defender

Plagegeister aller Art und deren Bekämpfung: Trojaner(?) - "Backdoor:Win32/Cycbot.B" fund durch Windows Defender