TDSSKiller startet nicht

PepeWerder · 30.05.2011, 20:27

kann ich dir den zip ordner bzw den richtigen ordner nicht i-wie anders schicken??

PepeWerder · 30.05.2011, 20:31

ok die datei hats jetzte hochgeladen!!!

Zitat:

Datei: Qoobox.zip empfangen

Vorgang erfolgreich abgeschlossen.

cosinus · 30.05.2011, 21:12

Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Downloade Dir danach bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.

Doppelklick auf die MBRCheck.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Das Tool braucht nur wenige Sekunden.
Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.

Poste mir bitte den Inhalt des .txt Dokumentes

PepeWerder · 31.05.2011, 17:40

hier der GMER logfile

[QUOTEGMER Logfile:

Code:

ATTFilter

GMER 1.0.15.15640 - hxxp://www.gmer.net
Rootkit scan 2011-05-31 18:36:06
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 MAXTOR_STM380811AS rev.3.AAE
Running: k744yl6c.exe; Driver: C:\DOKUME~1\Anwender\LOKALE~1\Temp\pxtdapog.sys


---- System - GMER 1.0.15 ----

SSDT            F8D899BE                                                                                                         ZwCreateKey
SSDT            F8D899B4                                                                                                         ZwCreateThread
SSDT            F8D899C3                                                                                                         ZwDeleteKey
SSDT            F8D899CD                                                                                                         ZwDeleteValueKey
SSDT            F8D899D2                                                                                                         ZwLoadKey
SSDT            F8D899A0                                                                                                         ZwOpenProcess
SSDT            F8D899A5                                                                                                         ZwOpenThread
SSDT            F8D899DC                                                                                                         ZwReplaceKey
SSDT            F8D899D7                                                                                                         ZwRestoreKey
SSDT            F8D899C8                                                                                                         ZwSetValueKey

---- Kernel code sections - GMER 1.0.15 ----

.text           C:\WINDOWS\System32\DRIVERS\nv4_mini.sys                                                                         section is writeable [0xF7AE6360, 0x240F7E, 0xE8000020]

---- User code sections - GMER 1.0.15 ----

.text           C:\Programme\Internet Explorer\IEXPLORE.EXE[3612] USER32.dll!DialogBoxParamW                                     7E3747AB 5 Bytes  JMP 411954BD C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Programme\Internet Explorer\IEXPLORE.EXE[3612] USER32.dll!CreateWindowExW                                     7E37D0A3 5 Bytes  JMP 4126DB5C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Programme\Internet Explorer\IEXPLORE.EXE[3612] USER32.dll!DialogBoxIndirectParamW                             7E382072 5 Bytes  JMP 41365117 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Programme\Internet Explorer\IEXPLORE.EXE[3612] USER32.dll!MessageBoxIndirectA                                 7E38A082 5 Bytes  JMP 41365049 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Programme\Internet Explorer\IEXPLORE.EXE[3612] USER32.dll!DialogBoxParamA                                     7E38B144 5 Bytes  JMP 413650B4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Programme\Internet Explorer\IEXPLORE.EXE[3612] USER32.dll!MessageBoxExW                                       7E3A0838 5 Bytes  JMP 41364F1A C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Programme\Internet Explorer\IEXPLORE.EXE[3612] USER32.dll!MessageBoxExA                                       7E3A085C 5 Bytes  JMP 41364F7C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Programme\Internet Explorer\IEXPLORE.EXE[3612] USER32.dll!DialogBoxIndirectParamA                             7E3A6D7D 5 Bytes  JMP 4136517A C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Programme\Internet Explorer\IEXPLORE.EXE[3612] USER32.dll!MessageBoxIndirectW                                 7E3B64D5 5 Bytes  JMP 41364FDE C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Programme\Internet Explorer\IEXPLORE.EXE[3612] WININET.dll!HttpAddRequestHeadersA                             408CCF4E 5 Bytes  JMP 00B06B70 
.text           C:\Programme\Internet Explorer\IEXPLORE.EXE[3612] WININET.dll!HttpAddRequestHeadersW                             408CFE49 5 Bytes  JMP 00B06D70 
.text           C:\Programme\Internet Explorer\IEXPLORE.EXE[3612] WS2_32.dll!getaddrinfo                                         71A12A6F 5 Bytes  JMP 011D000A 
.text           C:\Programme\Internet Explorer\IEXPLORE.EXE[3612] WS2_32.dll!closesocket                                         71A13E2B 5 Bytes  JMP 011A000A 
.text           C:\Programme\Internet Explorer\IEXPLORE.EXE[3612] WS2_32.dll!connect                                             71A14A07 5 Bytes  JMP 0119000A 
.text           C:\Programme\Internet Explorer\IEXPLORE.EXE[3612] WS2_32.dll!send                                                71A14C27 5 Bytes  JMP 011B000A 
.text           C:\Programme\Internet Explorer\IEXPLORE.EXE[3612] WS2_32.dll!gethostbyname                                       71A15355 5 Bytes  JMP 011C000A 
.text           C:\Programme\Internet Explorer\IEXPLORE.EXE[3612] WS2_32.dll!recv                                                71A1676F 5 Bytes  JMP 0118000A 
.text           C:\Programme\Internet Explorer\IEXPLORE.EXE[3824] USER32.dll!DialogBoxParamW                                     7E3747AB 5 Bytes  JMP 411954BD C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Programme\Internet Explorer\IEXPLORE.EXE[3824] USER32.dll!SetWindowsHookExW                                   7E37820F 5 Bytes  JMP 41269B01 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Programme\Internet Explorer\IEXPLORE.EXE[3824] USER32.dll!CallNextHookEx                                      7E37B3C6 5 Bytes  JMP 4125D125 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Programme\Internet Explorer\IEXPLORE.EXE[3824] USER32.dll!CreateWindowExW                                     7E37D0A3 5 Bytes  JMP 4126DB5C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Programme\Internet Explorer\IEXPLORE.EXE[3824] USER32.dll!UnhookWindowsHookEx                                 7E37D5F3 5 Bytes  JMP 411D4664 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Programme\Internet Explorer\IEXPLORE.EXE[3824] USER32.dll!DialogBoxIndirectParamW                             7E382072 5 Bytes  JMP 41365117 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Programme\Internet Explorer\IEXPLORE.EXE[3824] USER32.dll!MessageBoxIndirectA                                 7E38A082 5 Bytes  JMP 41365049 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Programme\Internet Explorer\IEXPLORE.EXE[3824] USER32.dll!DialogBoxParamA                                     7E38B144 5 Bytes  JMP 413650B4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Programme\Internet Explorer\IEXPLORE.EXE[3824] USER32.dll!MessageBoxExW                                       7E3A0838 5 Bytes  JMP 41364F1A C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Programme\Internet Explorer\IEXPLORE.EXE[3824] USER32.dll!MessageBoxExA                                       7E3A085C 5 Bytes  JMP 41364F7C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Programme\Internet Explorer\IEXPLORE.EXE[3824] USER32.dll!DialogBoxIndirectParamA                             7E3A6D7D 5 Bytes  JMP 4136517A C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Programme\Internet Explorer\IEXPLORE.EXE[3824] USER32.dll!MessageBoxIndirectW                                 7E3B64D5 5 Bytes  JMP 41364FDE C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Programme\Internet Explorer\IEXPLORE.EXE[3824] ole32.dll!CoCreateInstance                                     774CF1AC 5 Bytes  JMP 4126DBB8 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Programme\Internet Explorer\IEXPLORE.EXE[3824] ole32.dll!OleLoadFromStream                                    774F981B 5 Bytes  JMP 4136547F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text           C:\Programme\Internet Explorer\IEXPLORE.EXE[3824] WS2_32.dll!getaddrinfo                                         71A12A6F 5 Bytes  JMP 00C4000A 
.text           C:\Programme\Internet Explorer\IEXPLORE.EXE[3824] WS2_32.dll!closesocket                                         71A13E2B 5 Bytes  JMP 00C1000A 
.text           C:\Programme\Internet Explorer\IEXPLORE.EXE[3824] WS2_32.dll!connect                                             71A14A07 5 Bytes  JMP 00C0000A 
.text           C:\Programme\Internet Explorer\IEXPLORE.EXE[3824] WS2_32.dll!send                                                71A14C27 5 Bytes  JMP 00C2000A 
.text           C:\Programme\Internet Explorer\IEXPLORE.EXE[3824] WS2_32.dll!gethostbyname                                       71A15355 5 Bytes  JMP 00C3000A 
.text           C:\Programme\Internet Explorer\IEXPLORE.EXE[3824] WS2_32.dll!recv                                                71A1676F 5 Bytes  JMP 00BF000A 
.text           C:\Programme\Internet Explorer\IEXPLORE.EXE[3824] WININET.dll!HttpAddRequestHeadersA                             408CCF4E 5 Bytes  JMP 00B06B70 
.text           C:\Programme\Internet Explorer\IEXPLORE.EXE[3824] WININET.dll!HttpAddRequestHeadersW                             408CFE49 5 Bytes  JMP 00B06D70 

---- User IAT/EAT - GMER 1.0.15 ----

IAT             C:\Programme\Internet Explorer\IEXPLORE.EXE[3824] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW]  [451F1ACB] C:\Programme\Internet Explorer\xpshims.dll (Internet Explorer Compatibility Shims for XP/Microsoft Corporation)

---- Devices - GMER 1.0.15 ----

AttachedDevice  \FileSystem\Fastfat \Fat                                                                                         fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

---- Threads - GMER 1.0.15 ----

Thread          System [4:124]                                                                                                   824DDE7A
Thread          System [4:128]                                                                                                   824E0008

---- Registry - GMER 1.0.15 ----

Reg             HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@DeviceNotSelectedTimeout                               15
Reg             HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@GDIProcessHandleQuota                                  10000
Reg             HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@Spooler                                                yes
Reg             HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@swapdisk                                               
Reg             HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@TransmissionRetryTimeout                               90
Reg             HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@USERProcessHandleQuota                                 10000
Reg             HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@RequireSignedAppInit_DLLs                              1

---- EOF - GMER 1.0.15 ----

--- --- ---
][/QUOTE]

PepeWerder · 31.05.2011, 18:12

hier jetzte das osam log:

OSAM Logfile:

Code:

ATTFilter

Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 19:09:48 on 31.05.2011

OS: Windows XP Professional Service Pack 3 (Build 2600)
Default Browser: Unable to get information

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Common]
-----( %SystemRoot%\Tasks )-----
"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskUserS-1-5-21-299502267-1682526488-682003330-1003Core.job" - "Google Inc." - C:\Dokumente und Einstellungen\Anwender\Lokale Einstellungen\Anwendungsdaten\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskUserS-1-5-21-299502267-1682526488-682003330-1003UA.job" - "Google Inc." - C:\Dokumente und Einstellungen\Anwender\Lokale Einstellungen\Anwendungsdaten\Google\Update\GoogleUpdate.exe

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"alsndmgr.cpl" - ? - C:\WINDOWS\system32\alsndmgr.cpl  (File found, but it contains no detailed information)
"infocardcpl.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\infocardcpl.cpl
"javacpl.cpl" - "Sun Microsystems, Inc." - C:\WINDOWS\system32\javacpl.cpl
"nvcpl.cpl" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvcpl.cpl
"nvtuicpl.cpl" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvtuicpl.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"Avira AntiVir Personal" - "Avira GmbH" - C:\PROGRA~1\Avira\ANTIVI~1\avconfig.cpl
"ECSEPM" - "Sony Ericsson Mobile Communications AB" - C:\Programme\Sony Ericsson\Mobile2\Mobile Phone Monitor\ecsepm.cpl
"Nero BurnRights" - "Nero AG" - C:\Programme\Nero\Nero 7\Nero Toolkit\NeroBurnRights.cpl
"NokiaConnectionManager" - "Nokia" - C:\PROGRA~1\Nokia\NOKIAP~1\CONNEC~1.CPL
"Pando" - "Pando Networks" - C:\Programme\Pando Networks\Media Booster\PMB.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"AMD Processor Driver" (AmdK8) - "Advanced Micro Devices" - C:\WINDOWS\System32\DRIVERS\AmdK8.sys
"avgio" (avgio) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avgio.sys
"avgntflt" (avgntflt) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avipbb.sys
"catchme" (catchme) - ? - C:\DOKUME~1\Anwender\LOKALE~1\Temp\catchme.sys  (File not found)
"Changer" (Changer) - ? - C:\WINDOWS\system32\drivers\Changer.sys  (File not found)
"GMSIPCI" (GMSIPCI) - ? - D:\INSTALL\GMSIPCI.SYS  (File not found)
"i2omgmt" (i2omgmt) - ? - C:\WINDOWS\system32\drivers\i2omgmt.sys  (File not found)
"lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys  (File not found)
"nv" (nv) - "NVIDIA Corporation" - C:\WINDOWS\System32\DRIVERS\nv4_mini.sys
"PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys  (File not found)
"PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys  (File not found)
"PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys  (File not found)
"PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys  (File not found)
"PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys  (File not found)
"Realtek 10/100/1000 PCI NIC Family NDIS XP Driver" (RTL8023xp) - "Realtek Semiconductor Corporation                           " - C:\WINDOWS\System32\DRIVERS\Rtnicxp.sys
"Service for Realtek AC97 Audio (WDM)" (ALCXWDM) - "Realtek Semiconductor Corp." - C:\WINDOWS\System32\drivers\ALCXWDM.SYS
"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\ssmdrv.sys
"StarForce Protection Environment Driver (version 1.x)" (sfdrv01) - "Protection Technology" - C:\WINDOWS\System32\drivers\sfdrv01.sys
"StarForce Protection Helper Driver (version 2.x)" (sfhlp02) - "Protection Technology" - C:\WINDOWS\System32\drivers\sfhlp02.sys
"upperdev" (upperdev) - ? - C:\WINDOWS\System32\DRIVERS\usbser_lowerflt.sys  (File not found)
"VIA SATA IDE Hot-plug Driver" (xfilt) - "VIA Technologies,Inc" - C:\WINDOWS\System32\DRIVERS\xfilt.sys
"videX32" (videX32) - "VIA Technologies, Inc." - C:\WINDOWS\System32\DRIVERS\videX32.sys
"VolSnap" (VolSnap) - ? - C:\WINDOWS\system32\drivers\VolSnap.sys  (File is exclusively opened, access blocked | File found, but it contains no detailed information)
"WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys  (File not found)

[Explorer]
-----( HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{BDEADF00-C265-11d0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL
-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----
{89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{7D4D6379-F301-4311-BEBA-E26EB0561882} "NeroDigitalColumnHandler Class" - "Nero AG" - C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroDigitalExt.dll
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - ? - C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
-----( HKLM\Software\Classes\Protocols\Handler )-----
{828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{D5906221-A717-479B-9B49-CD848F9CE816} "BZShlExtImpl Class" - "Bitberry Software" - C:\Programme\BitZipper\BZShlExt.dll
{42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? - deskpan.dll  (File not found)
{1CDB2949-8F65-4355-8456-263E7C208A5D} "Desktop Explorer" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll
{1E9B04FB-F9E5-4718-997B-B8DA88302A47} "Desktop Explorer Menu" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll
{A70C977A-BF00-412C-90B7-034C51DA2439} "DesktopContext Class" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvcpl.dll
{1D2680C9-0E2A-469d-B787-065558BC7D43} "Fusion Cache" - "Microsoft Corporation" - c:\WINDOWS\system32\mscoree.dll
{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? -   (File not found | COM-object registry key not found)
{32683183-48a0-441b-a342-7c2a440a9478} "Media Band" - ? -   (File not found | COM-object registry key not found)
{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D} "Meine freigegebenen Ordner" - "Microsoft Corporation" - C:\Programme\Windows Live\Messenger\fsshext.8.5.1302.1018.dll
{59850401-6664-101B-B21C-00AA004BA90B} "Microsoft Office Binder Unbind" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office\1031\UNBIND.DLL
{B327765E-D724-4347-8B16-78AE18552FC3} "NeroDigitalIconHandler Class" - "Nero AG" - C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroDigitalExt.dll
{7F1CF152-04F8-453A-B34C-E609530A9DC8} "NeroDigitalPropSheetHandler Class" - "Nero AG" - C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroDigitalExt.dll
{416651E4-9C3C-11D9-8BDE-F66BAD1E3F3A} "Nokia Phone Browser" - "Nokia" - C:\Programme\Nokia\Nokia PC Suite 7\PhoneBrowser.dll
{FFB699E0-306A-11d3-8BD1-00104B6F7516} "NVIDIA CPL Extension" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvcpl.dll
{1E9B04FB-F9E5-4718-997B-B8DA88302A48} "nView Desktop Context Menu" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - ? - C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - ? - C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - ? - C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - ? - C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{0006F045-0000-0000-C000-000000000046} "Outlook-Dateisymbolerweiterung" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office\OLKFSTUB.DLL
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\shlext.dll
{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" - "Microsoft Corporation" - c:\WINDOWS\system32\dfshim.dll
{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? -   (File not found | COM-object registry key not found)
{e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" - "Microsoft Corporation" - c:\WINDOWS\system32\dfshim.dll
{03DAACC5-10BA-4E3E-9D54-2A569F6B4B87} "Sony Ericsson File Manager" - "Popwire AB" - C:\Programme\Sony Ericsson\Mobile2\File Manager\FM.dll
{738D66C6-0149-4D40-84E4-A7BB2D0CE949} "Sony Ericsson File Manager" - "Popwire AB" - C:\Programme\Sony Ericsson\Mobile2\File Manager\FM.dll

[Internet Explorer]
-----( HKCU\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars )-----
{32683183-48a0-441b-a342-7c2a440a9478} "{32683183-48a0-441b-a342-7c2a440a9478}" - ? -   (File not found | COM-object registry key not found)
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "Google Toolbar" - "Google Inc." - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll
ITBar7Height "ITBar7Height" - ? -   (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)
<binary data> "ITBarLayout" - ? -   (File not found | COM-object registry key not found)
<binary data> "{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" - ? -   (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{A21769F8-CEC5-4AFA-A6A4-CC921A15DF40} "ActiveXControl Object" - "L39 Studios" - C:\WINDOWS\Downloaded Program Files\atlas_activex.dll / hxxp://62.146.191.133/atlas_activex.dll
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_24" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_24.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} "Java Plug-in 1.6.0_24" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_24.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_24" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_24.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
{C3F79A2B-B9B4-4A66-B012-3EE46475B072} "MessengerStatsClient Class" - "Microsoft Corporation" - C:\WINDOWS\Downloaded Program Files\MessengerStatsPAClient.dll / hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
{B8BE5E93-A60C-4D26-A2DC-220313175592} "MSN Games - Installer" - "Microsoft Corporation" - C:\WINDOWS\Downloaded Program Files\ZIntro.ocx / hxxp://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
{166B1BCA-3F9C-11CF-8075-444553540000} "Shockwave ActiveX Control" - "Adobe Systems, Inc." - C:\WINDOWS\system32\Adobe\Director\SwDir.dll / hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
{233C1507-6A77-46A4-9443-F871F945D258} "Shockwave ActiveX Control" - "Adobe Systems, Inc." - C:\WINDOWS\system32\Adobe\Director\SwDir.dll / hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
{D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" - "Adobe Systems, Inc." - C:\WINDOWS\system32\Macromed\Flash\Flash10l.ocx / hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
{BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} "Zylom Games Player" - "Zylom Games" - C:\WINDOWS\Downloaded Program Files\zylomgamesplayer.dll / hxxp://game09.zylom.com/activex/zylomgamesplayer.cab
{8FFBE65D-2C9C-4669-84BD-5829DC0B603C} "{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}" - ? -   (File not found | COM-object registry key not found) / hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} "{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}" - ? -   (File not found | COM-object registry key not found) / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} "{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}" - ? -   (File not found | COM-object registry key not found) / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} "{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}" - ? -   (File not found | COM-object registry key not found) / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} "{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}" - ? -   (File not found | COM-object registry key not found) / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
"ICQ6" - "ICQ, LLC." - C:\Dokumente und Einstellungen\Anwender\Eigene Dateien\Peter\Friends\ICQ6.5\ICQ.exe
"PokerStars.net" - "PokerStars" - C:\Programme\PokerStars.NET\PokerStarsUpdate.exe
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
<binary data> "Google Toolbar" - "Google Inc." - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "Adobe PDF Reader" - "Adobe Systems Incorporated" - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
{AA58ED58-01DD-4d91-8333-CF10577473F7} "Google Toolbar Helper" - "Google Inc." - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} "Google Toolbar Notifier BHO" - "Google Inc." - C:\Programme\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jp2ssv.dll
{E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
{7E853D72-626A-48EC-A868-BA8D5E23E045} "{7E853D72-626A-48EC-A868-BA8D5E23E045}" - ? -   (File not found | COM-object registry key not found)

[Logon]
-----( %UserProfile%\Startmenü\Programme\Autostart )-----
"desktop.ini" - ? - C:\Dokumente und Einstellungen\Anwender\Startmenü\Programme\Autostart\desktop.ini
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"PC Suite Tray" - "Nokia" - "C:\Programme\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
"swg" - "Google Inc." - "C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe"
"avgnt" - "Avira GmbH" - "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min
"IATSKY" - ? - C:\Programme\iatsky\iatsky.exe  (File found, but it contains no detailed information)
"NvCplDaemon" - "NVIDIA Corporation" - RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
"NvMediaCenter" - "NVIDIA Corporation" - RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
"nwiz" - "NVIDIA Corporation" - nwiz.exe /install
"RemoteControl" - "Cyberlink Corp." - C:\Programme\CyberLink\PowerDVD\PDVDServ.exe
"SetDefPrt" - "Brother Industories, Ltd." - C:\Programme\Brother\Brmfl06a\BrStDvPt.exe
"SoundMan" - "Realtek Semiconductor Corp." - SOUNDMAN.EXE
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe"
"SW20" - ? - C:\WINDOWS\system32\sw20.exe  (File not found)
"SW24" - ? - C:\WINDOWS\system32\sw24.exe  (File not found)

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"OLFax Ports" - "Microsoft Corporation" - C:\WINDOWS\system32\OLFMNT40.DLL

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
".NET Runtime Optimization Service v2.0.50727_X86" (clr_optimization_v2.0.50727_32) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
"ASP.NET State Service" (aspnet_state) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avguard.exe
"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\sched.exe
"Canon Camera Access Library 8" (CCALib8) - "Canon Inc." - C:\Programme\Canon\CAL\CALMAIN.exe
"Google Software Updater" (gusvc) - "Google" - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe
"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe
"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe
"InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1150\Intel 32\IDriverT.exe
"Java Quick Starter" (JavaQuickStarterService) - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jqs.exe
"NMIndexingService" (NMIndexingService) - "Nero AG" - C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe
"NVIDIA Display Driver Service" (NVSvc) - "NVIDIA Corporation" - C:\WINDOWS\system32\nvsvc32.exe
"ServiceLayer" (ServiceLayer) - "Nokia" - C:\Programme\PC Connectivity Solution\ServiceLayer.exe
"Windows CardSpace" (idsvc) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
"Windows Presentation Foundation Font Cache 3.0.0.0" (FontCache3.0.0.0) - "Microsoft Corporation" - c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe

[Winlogon]
-----( HKCU\Control Panel\IOProcs )-----
"MVB" - ? - mvfs32.dll  (File not found)
-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )-----
"WgaLogon" - "Microsoft Corporation" - C:\WINDOWS\system32\WgaLogon.dll

===[ Logfile end ]=========================================[ Logfile end ]===

--- --- ---

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru[/QUOTE]

PepeWerder · 31.05.2011, 18:17

und noch das MBRCheck dokument:

Zitat:

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Professional
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x0000003d

Kernel Drivers (total 122):
0x804D7000 \WINDOWS\system32\ntkrnlpa.exe
0x806D1000 \WINDOWS\system32\hal.dll
0xF8B66000 \WINDOWS\system32\KDCOM.DLL
0xF8A76000 \WINDOWS\system32\BOOTVID.dll
0xF8536000 ACPI.sys
0xF8B68000 \WINDOWS\System32\DRIVERS\WMILIB.SYS
0xF8525000 pci.sys
0xF8666000 isapnp.sys
0xF8C2E000 pciide.sys
0xF88E6000 \WINDOWS\System32\DRIVERS\PCIIDEX.SYS
0xF8676000 MountMgr.sys
0xF8506000 ftdisk.sys
0xF8B6A000 dmload.sys
0xF84E0000 dmio.sys
0xF88EE000 PartMgr.sys
0xF88F6000 videX32.sys
0xF8686000 VolSnap.sys
0xF84C8000 atapi.sys
0xF8696000 disk.sys
0xF86A6000 \WINDOWS\System32\DRIVERS\CLASSPNP.SYS
0xF84A8000 fltmgr.sys
0xF8496000 sr.sys
0xF88FE000 xfilt.sys
0xF847F000 KSecDD.sys
0xF846C000 WudfPf.sys
0xF83DF000 Ntfs.sys
0xF83B2000 NDIS.sys
0xF8906000 sfhlp02.sys
0xF83A0000 sfdrv01.sys
0xF8386000 Mup.sys
0xF86B6000 gagp30kx.sys
0xF88C6000 \SystemRoot\System32\DRIVERS\processr.sys
0xF7F7F000 \SystemRoot\System32\DRIVERS\nv4_mini.sys
0xF7F6B000 \SystemRoot\System32\DRIVERS\VIDEOPRT.SYS
0xF7F57000 \SystemRoot\system32\DRIVERS\Rtnicxp.sys
0xF88D6000 \SystemRoot\system32\DRIVERS\imapi.sys
0xF86E6000 \SystemRoot\System32\DRIVERS\cdrom.sys
0xF86F6000 \SystemRoot\System32\DRIVERS\redbook.sys
0xF7F34000 \SystemRoot\System32\DRIVERS\ks.sys
0xF898E000 \SystemRoot\System32\DRIVERS\usbuhci.sys
0xF7F10000 \SystemRoot\System32\DRIVERS\USBPORT.SYS
0xF8996000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xF7B39000 \SystemRoot\system32\drivers\ALCXWDM.SYS
0xF7B15000 \SystemRoot\system32\drivers\portcls.sys
0xF8706000 \SystemRoot\system32\drivers\drmk.sys
0xF899E000 \SystemRoot\System32\DRIVERS\fdc.sys
0xF8716000 \SystemRoot\system32\DRIVERS\serial.sys
0xF8B2A000 \SystemRoot\system32\DRIVERS\serenum.sys
0xF7B01000 \SystemRoot\system32\DRIVERS\parport.sys
0xF8726000 \SystemRoot\System32\DRIVERS\i8042prt.sys
0xF89A6000 \SystemRoot\System32\DRIVERS\mouclass.sys
0xF89AE000 \SystemRoot\System32\DRIVERS\kbdclass.sys
0xF8D85000 \SystemRoot\System32\DRIVERS\audstub.sys
0xF8736000 \SystemRoot\System32\DRIVERS\rasl2tp.sys
0xF8B2E000 \SystemRoot\System32\DRIVERS\ndistapi.sys
0xF7AEA000 \SystemRoot\System32\DRIVERS\ndiswan.sys
0xF8746000 \SystemRoot\System32\DRIVERS\raspppoe.sys
0xF8756000 \SystemRoot\System32\DRIVERS\raspptp.sys
0xF89B6000 \SystemRoot\System32\DRIVERS\TDI.SYS
0xF7AD9000 \SystemRoot\System32\DRIVERS\psched.sys
0xF8766000 \SystemRoot\System32\DRIVERS\msgpc.sys
0xF89BE000 \SystemRoot\System32\DRIVERS\ptilink.sys
0xF89C6000 \SystemRoot\System32\DRIVERS\raspti.sys
0xF7A81000 \SystemRoot\System32\DRIVERS\rdpdr.sys
0xF8776000 \SystemRoot\System32\DRIVERS\termdd.sys
0xF8B8C000 \SystemRoot\System32\DRIVERS\swenum.sys
0xF7A23000 \SystemRoot\System32\DRIVERS\update.sys
0xF8B46000 \SystemRoot\System32\DRIVERS\mssmbios.sys
0xF8786000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xF8796000 \SystemRoot\System32\DRIVERS\usbhub.sys
0xF8B8E000 \SystemRoot\System32\DRIVERS\USBD.SYS
0xF89CE000 \SystemRoot\System32\DRIVERS\flpydisk.sys
0xF8B90000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xF8CCB000 \SystemRoot\System32\Drivers\Null.SYS
0xF8B92000 \SystemRoot\System32\Drivers\Beep.SYS
0xF89DE000 \SystemRoot\System32\drivers\vga.sys
0xF8B94000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xF8B96000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xF89E6000 \SystemRoot\System32\Drivers\Msfs.SYS
0xF89EE000 \SystemRoot\System32\Drivers\Npfs.SYS
0xF8346000 \SystemRoot\System32\DRIVERS\rasacd.sys
0xF67E2000 \SystemRoot\System32\DRIVERS\ipsec.sys
0xF6789000 \SystemRoot\System32\DRIVERS\tcpip.sys
0xF6761000 \SystemRoot\System32\DRIVERS\netbt.sys
0xF673F000 \SystemRoot\System32\drivers\afd.sys
0xF87B6000 \SystemRoot\System32\DRIVERS\netbios.sys
0xF89F6000 \SystemRoot\system32\DRIVERS\ssmdrv.sys
0xF6714000 \SystemRoot\System32\DRIVERS\rdbss.sys
0xF667C000 \SystemRoot\System32\DRIVERS\mrxsmb.sys
0xF87D6000 \SystemRoot\System32\Drivers\Fips.SYS
0xF6656000 \SystemRoot\System32\DRIVERS\ipnat.sys
0xF87E6000 \SystemRoot\System32\DRIVERS\wanarp.sys
0xF8B1E000 \SystemRoot\system32\DRIVERS\hidusb.sys
0xF87F6000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0xF8A06000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0xF8A0E000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0xF6630000 \SystemRoot\system32\DRIVERS\avipbb.sys
0xF8A16000 \SystemRoot\system32\DRIVERS\usbprint.sys
0xF8B26000 \SystemRoot\system32\DRIVERS\BrScnUsb.sys
0xF8A1E000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
0xF8B9A000 \??\C:\Programme\Avira\AntiVir Desktop\avgio.sys
0xF8826000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xF6618000 \SystemRoot\System32\Drivers\dump_atapi.sys
0xF8BA4000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xF7AB9000 \SystemRoot\System32\drivers\Dxapi.sys
0xF8A26000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xF8C8D000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF012000 \SystemRoot\System32\nv4_disp.dll
0xBF464000 \SystemRoot\System32\ATMFD.DLL
0xBA4AB000 \SystemRoot\system32\DRIVERS\avgntflt.sys
0xBA49F000 \SystemRoot\System32\DRIVERS\ndisuio.sys
0xB9926000 \SystemRoot\system32\drivers\wdmaud.sys
0xF799D000 \SystemRoot\system32\drivers\sysaudio.sys
0xB980B000 \SystemRoot\System32\DRIVERS\mrxdav.sys
0xF8C16000 \SystemRoot\System32\Drivers\ParVdm.SYS
0xB9469000 \SystemRoot\System32\DRIVERS\srv.sys
0xB8E81000 \SystemRoot\System32\Drivers\HTTP.sys
0xB8023000 \SystemRoot\System32\Drivers\Fastfat.SYS
0xB66B5000 \SystemRoot\system32\drivers\kmixer.sys
0x7C910000 \WINDOWS\system32\ntdll.dll

Processes (total 38):
0 System Idle Process
4 System
600 C:\WINDOWS\system32\smss.exe
664 csrss.exe
704 C:\WINDOWS\system32\winlogon.exe
748 C:\WINDOWS\system32\services.exe
760 C:\WINDOWS\system32\lsass.exe
956 C:\WINDOWS\system32\svchost.exe
1024 svchost.exe
1120 C:\WINDOWS\system32\svchost.exe
1156 C:\WINDOWS\system32\svchost.exe
1272 svchost.exe
1412 svchost.exe
1648 C:\WINDOWS\explorer.exe
1772 C:\WINDOWS\system32\spoolsv.exe
1852 C:\Programme\Avira\AntiVir Desktop\sched.exe
1964 C:\WINDOWS\soundman.exe
2036 C:\Programme\Internet Explorer\iexplore.exe
200 svchost.exe
280 C:\Programme\CyberLink\PowerDVD\PDVDServ.exe
476 C:\Programme\Avira\AntiVir Desktop\avgnt.exe
488 C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
508 C:\Programme\iatsky\iatsky.exe
520 C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
528 C:\Programme\Nokia\Nokia PC Suite 7\PCSuite.exe
548 C:\WINDOWS\system32\ctfmon.exe
1444 C:\Programme\Avira\AntiVir Desktop\avguard.exe
640 C:\Programme\Java\jre6\bin\jqs.exe
1340 C:\Programme\Avira\AntiVir Desktop\avshadow.exe
1376 C:\WINDOWS\system32\nvsvc32.exe
1508 C:\WINDOWS\system32\svchost.exe
2064 C:\Programme\Canon\CAL\CALMAIN.exe
3256 C:\Programme\PC Connectivity Solution\ServiceLayer.exe
3488 alg.exe
3496 C:\Programme\PC Connectivity Solution\Transports\NclUSBSrv.exe
3540 C:\Programme\PC Connectivity Solution\Transports\NclRSSrv.exe
3812 C:\Programme\Internet Explorer\iexplore.exe
184 C:\Dokumente und Einstellungen\Anwender\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)

PhysicalDrive0 Model Number: MAXTORSTM380811AS, Rev: 3.AAE

Size Device Name MBR Status
--------------------------------------------
74 GB \\.\PhysicalDrive0 Windows XP MBR code detected
SHA1: ADFE55CD0C6ED2E00B22375835E4C2736CE9AD11

Done!]

PepeWerder · 31.05.2011, 18:22

außerdem hatte ich bei osam ne meldung von antivir dass es ne malware gefunden hat!!

cosinus · 31.05.2011, 18:41

Zitat:

außerdem hatte ich bei osam ne meldung von antivir dass es ne malware gefunden hat!!

geht das auch bitte genauer!

PepeWerder · 31.05.2011, 18:49

das waren die drei meldungen:

Zitat:

In der Datei 'C:\WINDOWS\system32\drivers\volsnap.sys'
wurde ein Virus oder unerwünschtes Programm 'TR/Patched.Gen' [trojan] gefunden.
Ausgeführte Aktion: Zugriff verweigern

In der Datei 'C:\WINDOWS\system32\drivers\volsnap.sys'
wurde ein Virus oder unerwünschtes Programm 'TR/Patched.Gen' [trojan] gefunden.
Ausgeführte Aktion: Zugriff verweigern

In der Datei 'C:\WINDOWS\system32\drivers\volsnap.sys'
wurde ein Virus oder unerwünschtes Programm 'TR/Patched.Gen' [trojan] gefunden.
Ausgeführte Aktion: Zugriff verweigern

PepeWerder · 31.05.2011, 19:27

was soll ich jetzt machen?

cosinus · 31.05.2011, 19:57

Da ist noch ein TDSS am werkeln. Probier den TDSS-Killer bitte nochmal aus.

PepeWerder · 31.05.2011, 20:30

also es passiert einfach nichts...haste ne andere idee wie ich den tdss-killer zum laufen bekomme??

PepeWerder · 31.05.2011, 20:37

hab grad ne meldung bekommen( ist heut schon zum zweiten mal) oben links roter button mit weißem kreuz...dann steht da dass windows heruntergefahren wird..."Das Herunterfahren wurde von NT-AUTORITÄT/SYSTEM ausgelöst" "Der Systemprozess C\WINDOWS\system32\services.exe wurde unerwartet mit dem Statuscode 1073740972 beendet. Das System wird heruntergefahren und neugestartet"
hat das irgendwas zu bedeuten?

cosinus · 31.05.2011, 21:06

Eigentlich sollte CF die gepatchte volsnap.sys wiederherstellen, aber es lief ja nicht komplett durch.
Starte Windows neu, lösch die alte cofi.exe, lade CF neu als cofi.exe runter und probier es bitte nochmal.
Wenn CF immer noch nicht komplett durchlaufen will, machen wir es manuell. Ist aber mehr Aufwand für dich.

PepeWerder · 01.06.2011, 15:19

gut cofi.exe ist neu heruntegeladen und läuft gerade!!

... mist beim neustart hat sich antivir automatisch aktiviert... -.-

31.05.2011, 19:57	#26
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	TDSSKiller startet nicht Da ist noch ein TDSS am werkeln. Probier den TDSS-Killer bitte nochmal aus. __________________ Logfiles bitte immer in CODE-Tags posten

TDSSKiller startet nicht

Plagegeister aller Art und deren Bekämpfung: TDSSKiller startet nicht