Trojaner-Board
Seite 2 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Virus "aus sicherheitsgründen wurde ihr windowssystem blockiert" (https://www.trojaner-board.de/111618-virus-sicherheitsgruenden-wurde-windowssystem-blockiert.html)

Frielchen 19.03.2012 19:54
[code]
Combofix Logfile:
Code:
ComboFix 12-03-18.04 - Laura 19.03.2012  19:40:10.1.2 - x86
Microsoft Windows 7 Home Premium  6.1.7601.1.1252.49.1031.18.2558.1596 [GMT 1:00]
ausgeführt von:: c:\users\Laura\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-02-19 bis 2012-03-19  ))))))))))))))))))))))))))))))
.
.
2012-03-19 18:46 . 2012-03-19 18:46        --------        d-----w-        c:\users\Default\AppData\Local\temp
2012-03-19 18:40 . 2012-03-19 18:40        56200        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{5EABCB5E-EA54-49F4-8EED-B1C0A3FA9A48}\offreg.dll
2012-03-19 18:13 . 2012-03-19 18:13        --------        d-----w-        C:\_OTL
2012-03-16 19:44 . 2012-03-16 19:44        --------        d-----w-        c:\program files\ESET
2012-03-16 18:02 . 2012-03-16 18:02        --------        d-----w-        c:\users\Laura\AppData\Roaming\Malwarebytes
2012-03-16 18:02 . 2012-03-16 18:02        --------        d-----w-        c:\programdata\Malwarebytes
2012-03-16 18:02 . 2012-03-16 18:02        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware
2012-03-16 18:02 . 2011-12-10 14:24        20464        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-03-16 18:01 . 2012-02-08 06:03        6552120        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{5EABCB5E-EA54-49F4-8EED-B1C0A3FA9A48}\mpengine.dll
2012-03-15 21:49 . 2011-11-19 14:50        3968368        ----a-w-        c:\windows\system32\ntkrnlpa.exe
2012-03-15 21:49 . 2011-11-19 14:50        3913584        ----a-w-        c:\windows\system32\ntoskrnl.exe
2012-03-15 20:34 . 2012-02-03 03:54        2343424        ----a-w-        c:\windows\system32\win32k.sys
2012-03-15 20:34 . 2012-02-10 05:38        1077248        ----a-w-        c:\windows\system32\DWrite.dll
2012-03-15 20:34 . 2012-01-25 05:27        8192        ----a-w-        c:\windows\system32\rdrmemptylst.exe
2012-03-15 20:34 . 2012-01-25 05:32        58880        ----a-w-        c:\windows\system32\rdpwsx.dll
2012-03-15 20:34 . 2012-01-25 05:32        129536        ----a-w-        c:\windows\system32\rdpcorekmts.dll
2012-03-15 20:34 . 2012-02-17 05:34        826880        ----a-w-        c:\windows\system32\rdpcore.dll
2012-03-15 20:34 . 2012-02-17 04:14        183808        ----a-w-        c:\windows\system32\drivers\rdpwd.sys
2012-03-15 20:34 . 2012-02-17 04:13        24576        ----a-w-        c:\windows\system32\drivers\tdtcp.sys
2012-03-15 20:18 . 2012-03-15 20:18        --------        d-----w-        c:\users\Laura\AppData\Local\ElevatedDiagnostics
2012-03-11 16:56 . 2012-03-11 16:57        --------        d-----w-        c:\users\Laura\AppData\Roaming\TeamViewer
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-02-23 08:18 . 2009-12-14 08:40        237072        ------w-        c:\windows\system32\MpSigStub.exe
2012-02-20 18:39 . 2011-10-08 12:56        414368        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2012-02-16 21:11 . 2011-10-08 13:01        137416        ----a-w-        c:\windows\system32\drivers\avipbb.sys
2012-01-04 08:58 . 2012-02-16 21:18        442880        ----a-w-        c:\windows\system32\ntshrui.dll
2011-12-30 05:27 . 2012-02-16 21:18        478720        ----a-w-        c:\windows\system32\timedate.cpl
2011-12-17 12:16 . 2011-10-08 14:43        134104        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-09-01 13797992]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-09-16 7739936]
"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RtHDVBg.exe" [2009-09-16 674336]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-08-14 1549608]
"CLMLServer"="c:\program files\CyberLink\Power2Go\CLMLSvc.exe" [2009-06-03 103720]
"UpdateP2GoShortCut"="c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]
"UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]
"YouCam Mirror Tray icon"="c:\program files\CyberLink\YouCam\YouCamTray.exe" [2009-09-04 167008]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-10-05 258512]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-07-05 421888]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-01 59240]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-12-08 421736]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-01-03 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-01-13 460872]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
R2 BBSvc;BingBar Service;c:\program files\Microsoft\BingBar\7.1.361.0\BBSvc.exe [2012-02-10 193816]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2009-07-30 171520]
R3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2011-09-15 36000]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 AntiVirSchedulerService;Avira Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2011-10-05 86224]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2012-01-13 652360]
S2 TeamViewer7;TeamViewer 7;c:\program files\TeamViewer\Version7\TeamViewer_Service.exe [2011-12-14 2984832]
S3 BBUpdate;BBUpdate;c:\program files\Microsoft\BingBar\7.1.361.0\SeaPort.exe [2012-02-10 240408]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-12-10 20464]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2009-06-26 66080]
S3 rtl8192se;Realtek Wireless LAN 802.11n PCI-E NIC NT Driver;c:\windows\system32\DRIVERS\rtl8192se.sys [2009-08-19 859648]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-13 14336]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - 70531875
*Deregistered* - 70531875
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
uInternet Settings,ProxyOverride = *.local
IE: Free YouTube Download - c:\users\Laura\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm
IE: Free YouTube to MP3 Converter - c:\users\Laura\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 62.220.18.8 192.168.0.1
FF - ProfilePath - c:\users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\si0e3yt4.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2012-03-19  19:49:10
ComboFix-quarantined-files.txt  2012-03-19 18:49
.
Vor Suchlauf: 8 Verzeichnis(se), 397.398.929.408 Bytes frei
Nach Suchlauf: 12 Verzeichnis(se), 396.921.384.960 Bytes frei
.
- - End Of File - - AD671B21681007FE55E041FB560AA038
--- --- ---

Frielchen 20.03.2012 14:51
ist der virus jetzt runter?

Wenn ja, kann ich dann die ganzen Programme, die ich auf meinen PC gemacht hab, wie OTL und so löschen ?

cosinus 20.03.2012 16:40
Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe - (aswMBR.exe Anleitung)
    Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
    Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS-Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).

Frielchen 20.03.2012 17:06
so hier GMER:
[code]
GMER Logfile:
Code:
GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-03-20 17:05:01
Windows 6.1.7601 Service Pack 1 Harddisk0\DR0 -> \Device\00000032 ST950032 rev.0003
Running: m1yn9kb9.exe; Driver: C:\Users\Laura\AppData\Local\Temp\uxrirpob.sys


---- System - GMER 1.0.15 ----

SSDT            92A531E6                                                                                                                              ZwCreateSection
SSDT            92A531F0                                                                                                                              ZwRequestWaitReplyPort
SSDT            92A531EB                                                                                                                              ZwSetContextThread
SSDT            92A531F5                                                                                                                              ZwSetSecurityObject
SSDT            92A531FA                                                                                                                              ZwSystemDebugControl
SSDT            92A53187                                                                                                                              ZwTerminateProcess

---- Kernel code sections - GMER 1.0.15 ----

.text          ntkrnlpa.exe!ZwSaveKey + 13C1                                                                                                          82C8E3D9 1 Byte  [06]
.text          ntkrnlpa.exe!KiDispatchInterrupt + 5A2                                                                                                82CC7D52 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text          ntkrnlpa.exe!KeRemoveQueueEx + 11F7                                                                                                    82CCEEEC 4 Bytes  [E6, 31, A5, 92] {OUT 0x31, AL; MOVSD ; XCHG EDX, EAX}
.text          ntkrnlpa.exe!KeRemoveQueueEx + 1553                                                                                                    82CCF248 4 Bytes  [F0, 31, A5, 92]
.text          ntkrnlpa.exe!KeRemoveQueueEx + 1597                                                                                                    82CCF28C 4 Bytes  [EB, 31, A5, 92] {JMP 0x33; MOVSD ; XCHG EDX, EAX}
.text          ntkrnlpa.exe!KeRemoveQueueEx + 1613                                                                                                    82CCF308 4 Bytes  [F5, 31, A5, 92]
.text          ntkrnlpa.exe!KeRemoveQueueEx + 1667                                                                                                    82CCF35C 4 Bytes  [FA, 31, A5, 92]
.text          ...                                                                                                                                   

---- User code sections - GMER 1.0.15 ----

.text          C:\Program Files\Internet Explorer\iexplore.exe[1328] USER32.dll!EnableWindow                                                          765E8D02 5 Bytes  JMP 69F09A14 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text          C:\Program Files\Internet Explorer\iexplore.exe[1328] USER32.dll!DialogBoxParamW                                                      76603B9B 5 Bytes  JMP 69E6170B C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text          C:\Program Files\Internet Explorer\iexplore.exe[1328] USER32.dll!DialogBoxIndirectParamW                                              76613B7F 5 Bytes  JMP 6A056336 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text          C:\Program Files\Internet Explorer\iexplore.exe[1328] USER32.dll!DialogBoxParamA                                                      7662CF42 5 Bytes  JMP 6A0562D1 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text          C:\Program Files\Internet Explorer\iexplore.exe[1328] USER32.dll!DialogBoxIndirectParamA                                              7662D274 5 Bytes  JMP 6A05639B C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text          C:\Program Files\Internet Explorer\iexplore.exe[1328] USER32.dll!MessageBoxIndirectA                                                  7663E869 5 Bytes  JMP 6A056258 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text          C:\Program Files\Internet Explorer\iexplore.exe[1328] USER32.dll!MessageBoxIndirectW                                                  7663E963 5 Bytes  JMP 6A0561DF C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text          C:\Program Files\Internet Explorer\iexplore.exe[1328] USER32.dll!MessageBoxExA                                                        7663E9C9 5 Bytes  JMP 6A05617B C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text          C:\Program Files\Internet Explorer\iexplore.exe[1328] USER32.dll!MessageBoxExW                                                        7663E9ED 5 Bytes  JMP 6A056117 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text          C:\Program Files\Internet Explorer\iexplore.exe[2060] kernel32.dll!CreateThread                                                        768FDCC2 5 Bytes  JMP 69EC7303 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text          C:\Program Files\Internet Explorer\iexplore.exe[2060] USER32.dll!EnableWindow                                                          765E8D02 5 Bytes  JMP 69F09A14 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text          C:\Program Files\Internet Explorer\iexplore.exe[2060] USER32.dll!GetAsyncKeyState                                                      765EA256 5 Bytes  JMP 69EADD8D C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text          C:\Program Files\Internet Explorer\iexplore.exe[2060] USER32.dll!CallNextHookEx                                                        765EABE1 5 Bytes  JMP 69F27BAF C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text          C:\Program Files\Internet Explorer\iexplore.exe[2060] USER32.dll!UnhookWindowsHookEx                                                  765EADF9 5 Bytes  JMP 69F4EB00 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text          C:\Program Files\Internet Explorer\iexplore.exe[2060] USER32.dll!DefWindowProcA                                                        765EBB1C 7 Bytes  JMP 69EC952D C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text          C:\Program Files\Internet Explorer\iexplore.exe[2060] USER32.dll!CreateWindowExA                                                      765EBF40 5 Bytes  JMP 69ED3363 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text          C:\Program Files\Internet Explorer\iexplore.exe[2060] USER32.dll!SetWindowsHookExW                                                    765EE30C 5 Bytes  JMP 69F02194 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text          C:\Program Files\Internet Explorer\iexplore.exe[2060] USER32.dll!CreateWindowExW                                                      765EEC7C 5 Bytes  JMP 69F2FF87 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text          C:\Program Files\Internet Explorer\iexplore.exe[2060] USER32.dll!GetKeyState                                                          765F2B4D 3 Bytes  JMP 69EADC67 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text          C:\Program Files\Internet Explorer\iexplore.exe[2060] USER32.dll!GetKeyState + 4                                                      765F2B51 1 Byte  [F3]
.text          C:\Program Files\Internet Explorer\iexplore.exe[2060] USER32.dll!IsDialogMessageW                                                      765F4104 5 Bytes  JMP 6A056E05 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text          C:\Program Files\Internet Explorer\iexplore.exe[2060] USER32.dll!DefWindowProcW                                                        765F507D 7 Bytes  JMP 69F27C12 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text          C:\Program Files\Internet Explorer\iexplore.exe[2060] USER32.dll!CreateDialogParamA                                                    76601F42 5 Bytes  JMP 6A056668 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text          C:\Program Files\Internet Explorer\iexplore.exe[2060] USER32.dll!IsDialogMessage                                                      76602019 5 Bytes  JMP 6A056DDD C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text          C:\Program Files\Internet Explorer\iexplore.exe[2060] USER32.dll!DialogBoxParamW                                                      76603B9B 5 Bytes  JMP 69E6170B C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text          C:\Program Files\Internet Explorer\iexplore.exe[2060] USER32.dll!CreateDialogIndirectParamA                                            7660721D 5 Bytes  JMP 6A0566D8 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text          C:\Program Files\Internet Explorer\iexplore.exe[2060] USER32.dll!CreateDialogIndirectParamW                                            7660EA10 5 Bytes  JMP 6A056710 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text          C:\Program Files\Internet Explorer\iexplore.exe[2060] USER32.dll!DialogBoxIndirectParamW                                              76613B7F 5 Bytes  JMP 6A056336 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text          C:\Program Files\Internet Explorer\iexplore.exe[2060] USER32.dll!EndDialog                                                            76613BA3 5 Bytes  JMP 6A0570B4 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text          C:\Program Files\Internet Explorer\iexplore.exe[2060] USER32.dll!CreateDialogParamW                                                    76615630 5 Bytes  JMP 6A0566A0 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text          C:\Program Files\Internet Explorer\iexplore.exe[2060] USER32.dll!SetKeyboardState                                                      7661695A 5 Bytes  JMP 6A0576D1 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text          C:\Program Files\Internet Explorer\iexplore.exe[2060] USER32.dll!SendInput                                                            76617019 5 Bytes  JMP 6A057679 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text          C:\Program Files\Internet Explorer\iexplore.exe[2060] USER32.dll!SetCursorPos                                                          7662C1B0 5 Bytes  JMP 6A057752 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text          C:\Program Files\Internet Explorer\iexplore.exe[2060] USER32.dll!DialogBoxParamA                                                      7662CF42 5 Bytes  JMP 6A0562D1 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text          C:\Program Files\Internet Explorer\iexplore.exe[2060] USER32.dll!DialogBoxIndirectParamA                                              7662D274 5 Bytes  JMP 6A05639B C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text          C:\Program Files\Internet Explorer\iexplore.exe[2060] USER32.dll!MessageBoxIndirectA                                                  7663E869 5 Bytes  JMP 6A056258 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text          C:\Program Files\Internet Explorer\iexplore.exe[2060] USER32.dll!MessageBoxIndirectW                                                  7663E963 5 Bytes  JMP 6A0561DF C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text          C:\Program Files\Internet Explorer\iexplore.exe[2060] USER32.dll!MessageBoxExA                                                        7663E9C9 5 Bytes  JMP 6A05617B C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text          C:\Program Files\Internet Explorer\iexplore.exe[2060] USER32.dll!MessageBoxExW                                                        7663E9ED 5 Bytes  JMP 6A056117 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text          C:\Program Files\Internet Explorer\iexplore.exe[2060] USER32.dll!keybd_event                                                          7663EC3B 5 Bytes  JMP 6A057636 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text          C:\Program Files\Internet Explorer\iexplore.exe[2060] SHELL32.dll!RealDriveType + 173D                                                756DFDD0 4 Bytes  [CF, 01, 82, 71]
.text          C:\Program Files\Internet Explorer\iexplore.exe[2060] SHELL32.dll!RealDriveType + 1745                                                756DFDD8 8 Bytes  [E0, 61, 81, 71, 79, F7, 81, ...]
.text          C:\Program Files\Internet Explorer\iexplore.exe[2060] ole32.dll!OleLoadFromStream                                                      76296143 5 Bytes  JMP 6A056B0F C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)

---- User IAT/EAT - GMER 1.0.15 ----

IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress]                [718147BB] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!SearchPathW]                      [7182029E] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW]                  [71815EC7] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!CreateProcessW]                  [71827F4F] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!SetCurrentDirectoryW]            [7182F500] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!FindClose]                        [7182F94D] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!FindNextFileW]                    [718307CA] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!FindFirstFileW]                  [7182FCF6] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExA]                  [71815E4F] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!GetPrivateProfileStringW]        [7182ABDB] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!GetProcAddress]                  [718147BB] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryW]                    [71814E2B] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!CreateFileW]                      [718163E7] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!WritePrivateProfileStringW]      [7182B56B] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!LoadLibraryA]                      [71816D22] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!CopyFileW]                        [7182BC51] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!DeleteFileW]                      [7182C811] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!SearchPathW]                      [7182029E] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!LoadLibraryW]                      [71814E2B] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!LoadLibraryExW]                    [71815EC7] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!GetProcAddress]                    [718147BB] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!CreateFileW]                      [718163E7] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryW]                    [71814E2B] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!DeleteFileW]                    [7182C811] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!ReplaceFileW]                    [7182E457] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetPrivateProfileStringA]        [7182AA37] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetPrivateProfileStringW]        [7182ABDB] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!WritePrivateProfileStringW]      [7182B56B] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryA]                    [71816D22] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExW]                  [71815EC7] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!FindFirstFileW]                  [7182FCF6] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!FindNextFileW]                  [718307CA] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!SetFileAttributesW]              [7182939B] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!CreateFileW]                    [718163E7] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!SearchPathW]                    [7182029E] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetFileAttributesW]              [71815F62] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!SetFileAttributesA]              [71829229] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!CreateFileA]                    [7181F1F1] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress]                  [718147BB] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExA]                  [71815E4F] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetFileAttributesA]              [71820ADF] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!SearchPathA]                    [7182F2BD] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!FindClose]                      [7182F94D] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!FindNextFileA]                  [7183072B] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!FindFirstFileA]                  [7182F9A0] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathIsRootA]                      [71831542] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathStripToRootW]                [71831C5E] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathIsURLW]                      [7181FA79] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathFindOnPathW]                  [71831191] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHCreateStreamOnFileW]            [7181F725] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHOpenRegStream2W]                [7181FB25] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathCombineW]                    [71831095] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHDeleteKeyA]                    [71831F32] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathIsDirectoryW]                [718312D2] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!AssocQueryStringByKeyW]          [71830DFB] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathCreateFromUrlW]              [71820178] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathSkipRootW]                    [71831B2E] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathRelativePathToW]              [7183194A] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathIsContentTypeW]              [71831233] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHRegQueryUSValueW]              [7181F86E] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHRegEnumUSKeyW]                  [7181F472] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHRegOpenUSKeyA]                  [718327C3] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathIsDirectoryEmptyW]            [7183136E] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathIsDirectoryA]                [71831284] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathBuildRootA]                  [71830F4E] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHRegGetPathW]                    [71832769] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathCanonicalizeW]                [7181F9DA] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHRegSetPathW]                    [71832937] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHRegGetUSValueW]                [71817430] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!AssocQueryKeyW]                  [7181F817] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHRegGetBoolUSValueW]            [7181E265] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathIsRelativeW]                  [71815D08] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathIsNetworkPathW]              [7183140A] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathIsRootW]                      [71831590] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHDeleteKeyW]                    [71831F83] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathFileExistsW]                  [71820123] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHEnumValueW]                    [7183218A] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathStripPathW]                  [71831BC6] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHRegOpenUSKeyW]                  [7181FACB] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathRemoveArgsW]                  [718319EE] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHQueryValueExW]                  [7181FC0B] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHEnumKeyExW]                    [718320D3] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHSetValueW]                      [71832B62] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHDeleteValueW]                  [71832028] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathBuildRootW]                  [71830F9F] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHGetValueW]                      [71814927] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!AssocQueryStringW]                [71830D47] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathIsUNCW]                      [7181FA2B] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathMakeSystemFolderW]            [718318A2] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathUnExpandEnvStringsW]          [71831CAC] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathIsUNCServerW]                [7183171C] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!PathIsUNCServerShareW]            [718317B8] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [SHLWAPI.dll!SHRegGetValueW]                  [71814984] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [ntdll.dll!NtQueryDirectoryFile]              [71828C1A] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [USER32.dll!LoadImageW]                        [7182CB0F] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [USER32.dll!WinHelpW]                          [7182D6BF] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [USER32.dll!PrivateExtractIconsW]              [7182D11F] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA]                    [71816D22] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!CreateHardLinkW]                [7182C49D] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!WritePrivateProfileStringW]      [7182B56B] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!WritePrivateProfileSectionW]    [7182B245] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetPrivateProfileSectionNamesW]  [7182A89F] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!MoveFileExW]                    [7182E0C1] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryW]                    [71814E2B] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetPrivateProfileStringW]        [7182ABDB] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetPrivateProfileIntW]          [7182A249] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetShortPathNameA]              [71829AF3] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!ReplaceFileW]                    [7182E457] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!MoveFileW]                      [7182E089] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetBinaryTypeW]                  [71829F4B] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!CopyFileW]                      [7182BC51] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetPrivateProfileSectionW]      [7182A56D] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!LoadLibraryW]                      [71814E2B] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!LoadLibraryA]                      [71816D22] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!PathUnExpandEnvStringsA]          [7181F6D1] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!SHDeleteKeyA]                    [71831F32] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!SHDeleteValueW]                  [71832028] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!SHSetValueA]                      [71832B05] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!SHSetValueW]                      [71832B62] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!PathCreateFromUrlW]              [71820178] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!SHRegGetUSValueA]                [718164C5] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!SHGetValueA]                      [71814CAA] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!SHGetValueW]                      [71814927] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!SHRegGetValueW]                  [71814984] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!SHRegGetValueA]                  [71816528] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\WININET.dll [KERNEL32.dll!GetProcAddress]                  [718147BB] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\Secur32.dll [KERNEL32.dll!GetProcAddress]                  [718147BB] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)
IAT            C:\Program Files\Internet Explorer\iexplore.exe[2060] @ C:\Windows\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress]                  [718147BB] C:\Program Files\Internet Explorer\IEShims.dll (Internet Explorer Compatibility Shims/Microsoft Corporation)

---- Devices - GMER 1.0.15 ----

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                                                                                                Wdf01000.sys (Kernelmodustreiber-Frameworklaufzeit/Microsoft Corporation)
AttachedDevice  \Driver\kbdclass \Device\KeyboardClass1                                                                                                Wdf01000.sys (Kernelmodustreiber-Frameworklaufzeit/Microsoft Corporation)

Device          \Driver\ACPI_HAL \Device\00000045                                                                                                      halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume1                                                                                                fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume2                                                                                                fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume3                                                                                                fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume4                                                                                                fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

---- Disk sectors - GMER 1.0.15 ----

Disk            \Device\Harddisk0\DR0                                                                                                                  MBR read error
Disk            \Device\Harddisk0\DR0                                                                                                                  MBR BIOS signature not found 0

---- EOF - GMER 1.0.15 ----
--- --- ---

Frielchen 20.03.2012 17:13
so hier osam:
ich hoffe das war richtig

Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
 Saved at 17:11:29 on 20.03.2012
OS: Windows 7 Home Premium Edition Service Pack 1 (Build 7601), 32-bit
Default Browser: Opera Software Opera Internet Browser 11.61

Scanner Settings
Rootkits detection (hidden registry)
Rootkits detection (hidden files)
Retrieve files information
Check Microsoft signatures

Filters
Trusted entries
Empty entries
Hidden registry entries (rootkit activity)
Exclusively opened files
Not found files
Files without detailed information
Existing files
Non-startable services
Non-startable drivers
Active entries
Disabled entries
        Risk        Name        Publisher        Full Path        Status
Control Panel Objects
%SystemRoot%\system32
        ||||||        "FlashPlayerCPLApp.cpl"        "Adobe Systems Incorporated"        C:\Windows\system32\FlashPlayerCPLApp.cpl        File exists
        ||||||        "nvcpl.cpl"        "NVIDIA Corporation"        C:\Windows\system32\nvcpl.cpl        File exists
HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls
        ||||||        "mlcfg32.cpl"        "Microsoft Corporation"        C:\PROGRA~1\MICROS~3\Office12\MLCFG32.CPL        File exists
        ||||||        "Nero BurnRights"        "Nero AG"        C:\Program Files\Nero\Nero 9\Nero BurnRights\NeroBurnRights_cpl.cpl        File exists
        ||||||        "QuickTime"        "Apple Inc."        C:\Program Files\QuickTime\QTSystem\QuickTime.cpl        File exists
Drivers
HKLM\SYSTEM\CurrentControlSet\Services
        ||||||        "avgntflt" (avgntflt)        "Avira GmbH"        C:\Windows\System32\DRIVERS\avgntflt.sys        File exists
        ||||||        "avipbb" (avipbb)        "Avira GmbH"        C:\Windows\System32\DRIVERS\avipbb.sys        File exists
        ||||||        "avkmgr" (avkmgr)        "Avira GmbH"        C:\Windows\System32\DRIVERS\avkmgr.sys        File exists
                      "catchme" (catchme)                C:\Users\Laura\AppData\Local\Temp\catchme.sys        File not found
        ||||||        "MBAMProtector" (MBAMProtector)        "Malwarebytes Corporation"        C:\Windows\system32\drivers\mbam.sys        File exists
                      "Realtek IR Driver" (RtsUIR)                C:\Windows\System32\DRIVERS\Rts516xIR.sys        File not found
                      "Realtek Smartcard Reader Driver" (USBCCID)                C:\Windows\System32\DRIVERS\RtsUCcid.sys        File not found
        ||||||        "ssmdrv" (ssmdrv)        "Avira GmbH"        C:\Windows\System32\DRIVERS\ssmdrv.sys        File exists
                      "uxrirpob" (uxrirpob)                C:\Users\Laura\AppData\Local\Temp\uxrirpob.sys        Hidden registry entry, rootkit activity | File not found
Explorer
HKLM\Software\Classes\Folder\shellex\ColumnHandlers
        ||||||        {C9E60ED7-FEAE-477b-B6A6-7D62103A0C6B} "NeroDigitalColumnHandler Class"        "Nero AG"        C:\Program Files\Common Files\Nero\SMC\NeroDigitalExt.dll        File exists
        ||||||        {F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension"        "Adobe Systems, Inc."        C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll        File exists
HKLM\Software\Classes\Protocols\Filter
        ||||||        {807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter"        "Microsoft Corporation"        C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL        File exists
HKLM\Software\Classes\Protocols\Handler
        ||||||        {314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class"        "Microsoft Corporation"        C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll        File exists
        ||||          {828030A1-22C1-4009-854F-8E305202313F} "livecall"        "Microsoft Corporation"        C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL        File exists
        ||||||        {0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0"        "Microsoft Corporation"        C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll        File exists
        ||||          {828030A1-22C1-4009-854F-8E305202313F} "msnim"        "Microsoft Corporation"        C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL        File exists
        ||||||        {03C514A3-1EFB-4856-9F99-10D7BE1653C0} "Windows Live Mail HTML Asynchronous Pluggable Protocol Handler"        "Microsoft Corporation"        C:\Program Files\Windows Live\Mail\mailcomm.dll        File exists
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
        ||||||        {0563DB41-F538-4B37-A92D-4659049B7766} "CLSID_WLMCMimeFilter"        "Microsoft Corporation"        C:\Program Files\Windows Live\Mail\mailcomm.dll        File exists
        ||||||        {A70C977A-BF00-412C-90B7-034C51DA2439} "DesktopContext Class"        "NVIDIA Corporation"        C:\Windows\system32\nvcpl.dll        File exists
                      {B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes"        "Apple Inc."        C:\Program Files\iTunes\iTunesMiniPlayer.dll        File exists
        ||||||        {42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler"        "Microsoft Corporation"        C:\Program Files\Microsoft Office\Office12\msohevi.dll        File exists
        ||||||        {993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler"        "Microsoft Corporation"        C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll        File exists
        ||||||        {5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search"        "Microsoft Corporation"        C:\PROGRA~1\MICROS~3\Office12\ONFILTER.DLL        File exists
        ||||||        {00020D75-0000-0000-C000-000000000046} "Microsoft Office Outlook"        "Microsoft Corporation"        C:\PROGRA~1\MICROS~3\Office12\MLSHEXT.DLL        File exists
        ||||||        {C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler"        "Microsoft Corporation"        C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll        File exists
        ||||||        {97F68CE3-7146-45FF-BE24-D9A7DD7CB8A2} "NeroCoverEdLiveIcons Class"        "Nero AG"        C:\Program Files\Nero\Nero 9\Nero CoverDesigner\CoverEdExtension.dll        File exists
        ||||||        {C9E60ED7-FEAE-477b-B6A6-7D62103A0C6B} "NeroDigitalColumnHandler Class"        "Nero AG"        C:\Program Files\Common Files\Nero\SMC\NeroDigitalExt.dll        File exists
        ||||||        {1CA6BBC9-E9FA-4021-822B-075DF1837B63} "NeroDigitalIconHandler Class"        "Nero AG"        C:\Program Files\Common Files\Nero\SMC\NeroDigitalExt.dll        File exists
        ||||||        {4FBFFA8D-F390-471a-AE46-FEB93623AD63} "NeroDigitalInfoHandler Class"        "Nero AG"        C:\Program Files\Common Files\Nero\SMC\NeroDigitalExt.dll        File exists
        ||||||        {846083A4-BFC6-4447-985C-6578B466A7D7} "NeroDigitalPropSheetHandler Class"        "Nero AG"        C:\Program Files\Common Files\Nero\SMC\NeroDigitalExt.dll        File exists
        ||||||        {EDCC595A-F0EE-4d81-B554-D5D01C7AFB87} "NeroDigitalThumbnailHandler Class"        "Nero AG"        C:\Program Files\Common Files\Nero\SMC\NeroDigitalExt.dll        File exists
        ||||||        {3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} "NVIDIA CPL Context Menu Extension"        "NVIDIA Corporation"        C:\Windows\system32\nvshext.dll        File exists
        ||||||        {FFB699E0-306A-11d3-8BD1-00104B6F7516} "NVIDIA CPL Extension"        "NVIDIA Corporation"        C:\Windows\system32\nvcpl.dll        File exists
        ||||||        {0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension"        "Microsoft Corporation"        C:\PROGRA~1\MICROS~3\Office12\OLKFSTUB.DLL        File exists
        ||||||        {45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning"        "Avira Operations GmbH & Co. KG"        C:\Program Files\Avira\AntiVir Desktop\shlext.dll        File exists
        ||||||        {2BE99FD4-A181-4996-BFA9-58C5FFD11F6C} "Windows Live Photo Gallery Autoplay Drop Target"        "Microsoft Corporation"        C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe        File exists
        ||||||        {00F30F64-AC33-42F5-8FD1-5DC2D3FDE06C} "Windows Live Photo Gallery Editor Drop Target"        "Microsoft Corporation"        C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe        File exists
        ||||||        {00F3712A-CA79-45B4-9E4D-D7891E7F8B9D} "Windows Live Photo Gallery Editor Shim"        "Microsoft Corporation"        C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll        File exists
        ||||||        {00F30F90-3E96-453B-AFCD-D71989ECC2C7} "Windows Live Photo Gallery Viewer Autoplay Shim"        "Microsoft Corporation"        C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll        File exists
        ||||||        {00F33137-EE26-412F-8D71-F84E4C2C6625} "Windows Live Photo Gallery Viewer Autoplay Shim"        "Microsoft Corporation"        C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll        File exists
        ||||||        {00F374B7-B390-4884-B372-2FC349F2172B} "Windows Live Photo Gallery Viewer Drop Target"        "Microsoft Corporation"        C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe        File exists
        ||||||        {00F346CB-35A4-465B-8B8F-65A29DBAB1F6} "Windows Live Photo Gallery Viewer Shim"        "Microsoft Corporation"        C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll        File exists
        ||||||        {B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR"        "Alexander Roshal"        C:\Program Files\WinRAR\rarext.dll        File exists
        ||||||        {06A2568A-CED6-4187-BB20-400B8C02BE5A} "{06A2568A-CED6-4187-BB20-400B8C02BE5A}"        "Microsoft Corporation"        C:\Program Files\Windows Live\Photo Gallery\WLXPhotoAcquireWizard.exe        File exists
Internet Explorer
HKCU\SOFTWARE\Microsoft\Internet Explorer\Extensions
                      "eBay - Der weltweite Online-Marktplatz"                hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4        HTTP value
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser
                      ITBar7Height "ITBar7Height"                        File not found | COM-object registry key not found
                      "ITBar7Layout"                        File not found | COM-object registry key not found
HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units
        ||||          {8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_16"
hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab        "Sun Microsystems, Inc."        C:\Program Files\Java\jre6\bin\jp2iexp.dll        File exists
        ||||          {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} "Java Plug-in 1.6.0_16"
hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab        "Sun Microsystems, Inc."        C:\Program Files\Java\jre6\bin\jp2iexp.dll        File exists
        ||||          {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_16"
hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab        "Sun Microsystems, Inc."        C:\Program Files\Java\jre6\bin\npjpi160_16.dll        File exists
                      {7530BFB8-7293-4D34-9923-61A11451AFC5} "OnlineScanner Control"
hxxp://download.eset.com/special/eos/OnlineScanner.cab        "ESET"        C:\PROGRA~1\ESET\ESETON~1\ONLINE~1.OCX        File exists
        ||||||        {D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object"
hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab        "Adobe Systems, Inc."        C:\Windows\system32\Macromed\Flash\Flash11c.ocx        File exists
HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions
        ||||          {48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden"        "Microsoft Corporation"        C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll        File exists
        ||||          {5F7B1267-94A9-47F5-98DB-E99415F33AEC} "In Blog veröffentlichen"        "Microsoft Corporation"        C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll        File exists
        ||            {FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research"        "Microsoft Corporation"        C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL        File exists
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
        ||||||        {18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper"        "Adobe Systems Incorporated"        C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll        File exists
        ||||          {DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper"        "Sun Microsystems, Inc."        C:\Program Files\Java\jre6\bin\jp2ssv.dll        File exists
Logon
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup
        ||||||        "desktop.ini"                C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini        File exists
%AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup
        ||||||        "desktop.ini"                C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini        File exists
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd
                      "StartupPrograms"                rdpclip        File not found
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
        ||||          "Adobe ARM"        "Adobe Systems Incorporated"        "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"        File exists
        ||||          "Adobe Reader Speed Launcher"        "Adobe Systems Incorporated"        "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"        File exists
        ||||          "APSDaemon"        "Apple Inc."        "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"        File exists
        ||||||        "avgnt"        "Avira Operations GmbH & Co. KG"        "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min        File exists
        ||||          "CLMLServer"        "CyberLink"        "C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe"        File exists
                      "iTunesHelper"        "Apple Inc."        "C:\Program Files\iTunes\iTunesHelper.exe"        File exists
        ||||||        "Malwarebytes' Anti-Malware"        "Malwarebytes Corporation"        "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray        File exists
        ||||||        "NvCplDaemon"        "NVIDIA Corporation"        RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup        File exists
        ||||          "QuickTime Task"        "Apple Inc."        "C:\Program Files\QuickTime\QTTask.exe" -atboottime        File exists
        ||||          "UCam_Menu"        "CyberLink Corp."        "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" UpdateWithCreateOnce "Software\CyberLink\YouCam\3.0"        File exists
        ||||          "UpdateP2GoShortCut"        "CyberLink Corp."        "C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"        File exists
        ||||          "YouCam Mirror Tray icon"        "CyberLink Corp."        "C:\Program Files\CyberLink\YouCam\YouCamTray.exe" /s        File exists
Print Monitors
HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors
        ||||||        "Microsoft Document Imaging Writer Monitor"        "Microsoft Corporation"        C:\Windows\system32\mdimon.dll        File exists
        ||||||        "Send To Microsoft OneNote Monitor"        "Microsoft Corporation"        C:\Windows\system32\msonpmon.dll        File exists
Services
HKLM\SYSTEM\CurrentControlSet\Services
        ||||||        "Apple Mobile Device" (Apple Mobile Device)        "Apple Inc."        C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe        File exists
        ||||||        "Avira Echtzeit Scanner" (AntiVirService)        "Avira Operations GmbH & Co. KG"        C:\Program Files\Avira\AntiVir Desktop\avguard.exe        File exists
        ||||||        "Avira Planer" (AntiVirSchedulerService)        "Avira Operations GmbH & Co. KG"        C:\Program Files\Avira\AntiVir Desktop\sched.exe        File exists
                      "BBUpdate" (BBUpdate)        "Microsoft Corporation."        C:\Program Files\Microsoft\BingBar\7.1.361.0\SeaPort.exe        File exists
                      "BingBar Service" (BBSvc)        "Microsoft Corporation."        C:\Program Files\Microsoft\BingBar\7.1.361.0\BBSvc.exe        File exists
        ||||||        "Dienst "Bonjour"" (Bonjour Service)        "Apple Inc."        C:\Program Files\Bonjour\mDNSResponder.exe        File exists
        ||||||        "iPod-Dienst" (iPod Service)        "Apple Inc."        C:\Program Files\iPod\bin\iPodService.exe        File exists
        ||||||        "MBAMService" (MBAMService)        "Malwarebytes Corporation"        C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe        File exists
        ||||||        "Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32)        "Microsoft Corporation"        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe        File exists
        ||||||        "Microsoft Office Diagnostics Service" (odserv)        "Microsoft Corporation"        C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE        File exists
        ||||||        "Nero BackItUp Scheduler 4.0" (Nero BackItUp Scheduler 4.0)        "Nero AG"        C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe        File exists
        ||||||        "NVIDIA Display Driver Service" (nvsvc)        "NVIDIA Corporation"        C:\Windows\system32\nvvsvc.exe        File exists
        ||||||        "Office Source Engine" (ose)        "Microsoft Corporation"        C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE        File exists
        ||||||        "TeamViewer 7" (TeamViewer7)        "TeamViewer GmbH"        C:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe        File exists
Winsock Providers
HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries
        ||||||        "mdnsNSP"        "Apple Inc."        C:\Program Files\Bonjour\mdnsNSP.dll        File exists


If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

Frielchen 20.03.2012 17:27
so und das letzte:
Code:
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-03-20 17:16:10
-----------------------------
17:16:10.790    OS Version: Windows 6.1.7601 Service Pack 1
17:16:10.790    Number of processors: 2 586 0x170A
17:16:10.805    ComputerName: LAURAS-PC  UserName: Laura
17:16:12.818    Initialize success
17:17:16.285    AVAST engine defs: 12032000
17:17:25.894    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000060
17:17:25.894    Disk 0 Vendor: ST950032 0003 Size: 476940MB BusType: 3
17:17:25.957    Disk 0 MBR read successfully
17:17:25.957    Disk 0 MBR scan
17:17:25.972    Disk 0 unknown MBR code
17:17:25.972    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS          100 MB offset 2048
17:17:25.988    Disk 0 Partition 2 00    07    HPFS/NTFS NTFS      434852 MB offset 206848
17:17:26.035    Disk 0 Partition 3 00    07    HPFS/NTFS NTFS        40960 MB offset 890783744
17:17:26.066    Disk 0 Partition 4 00    12  Compaq diag NTFS        1026 MB offset 974669824
17:17:26.081    Disk 0 scanning sectors +976771120
17:17:26.175    Disk 0 scanning C:\Windows\system32\drivers
17:17:41.792    Service scanning
17:18:06.284    Modules scanning
17:18:14.754    Disk 0 trace - called modules:
17:18:14.770    ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll storport.sys nvstor32.sys
17:18:14.786    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x85f0b810]
17:18:14.786    3 CLASSPNP.SYS[8320459e] -> nt!IofCallDriver -> [0x85e3a0c8]
17:18:14.801    5 ACPI.sys[89cc43d4] -> nt!IofCallDriver -> \Device\00000060[0x85e3a780]
17:18:15.987    AVAST engine scan C:\Windows
17:18:19.902    AVAST engine scan C:\Windows\system32
17:21:42.227    AVAST engine scan C:\Windows\system32\drivers
17:21:58.264    AVAST engine scan C:\Users\Laura
17:25:40.692    AVAST engine scan C:\ProgramData
17:26:25.557    Scan finished successfully
17:26:42.265    Disk 0 MBR has been saved successfully to "C:\Users\Laura\Desktop\MBR.dat"
17:26:42.281    The log file has been saved successfully to "C:\Users\Laura\Desktop\aswMBR.txt"

cosinus 20.03.2012 17:57
Wir sollten den MBR fixen, sichere für den Fall der Fälle ALLE wichtigen Daten, auch wenn meistens alles glatt geht.

Hinweis: Mach bitte NICHT den MBR-Fix, wenn du noch andere Betriebssysteme wie zB Ubuntu installiert hast, ein MBR-Fix mit Windows-Tools macht ein parallel installiertes (Dualboot) Linux unbootbar.
Mach den Fix auch dann nicht, wenn du zB mit TrueCrypt oder anderen Verschlüsselungsprogrammen eine Vollverschlüsselung der Windowspartition bzw. gesamten Festplatte hast

Starte nach der Datensicherung aswmbr erneut und klick auf den Button FIXMBR.

Hinweis: Bitte den Virenscanner abstellen bevor du aswMBR ausführst, denn v.a. Avira meldet darin oft einen Fehalalrm!

Anschließend Windows neu starten und ein neues Log mit aswMBR machen.

Frielchen 20.03.2012 20:51
ist das normal, dass das MBR-Fix sehr schnell geht?

hier das ergebnis:
Code:
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-03-20 20:38:28
-----------------------------
20:38:28.900    OS Version: Windows 6.1.7601 Service Pack 1
20:38:28.900    Number of processors: 2 586 0x170A
20:38:28.900    ComputerName: LAURAS-PC  UserName: Laura
20:38:47.120    Initialize success
20:38:54.546    AVAST engine defs: 12032000
20:38:57.806    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000060
20:38:57.806    Disk 0 Vendor: ST950032 0003 Size: 476940MB BusType: 3
20:38:57.822    Disk 0 MBR read successfully
20:38:57.838    Disk 0 MBR scan
20:38:57.838    Disk 0 Windows 7 default MBR code
20:38:57.853    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS          100 MB offset 2048
20:38:57.869    Disk 0 Partition 2 00    07    HPFS/NTFS NTFS      434852 MB offset 206848
20:38:57.900    Disk 0 Partition 3 00    07    HPFS/NTFS NTFS        40960 MB offset 890783744
20:38:57.916    Disk 0 Partition 4 00    12  Compaq diag NTFS        1026 MB offset 974669824
20:38:57.931    Disk 0 scanning sectors +976771120
20:38:57.994    Disk 0 scanning C:\Windows\system32\drivers
20:39:11.066    Service scanning
20:39:41.549    Modules scanning
20:39:51.314    Disk 0 trace - called modules:
20:39:51.330    ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll storport.sys nvstor32.sys
20:39:51.346    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x85f08838]
20:39:51.346    3 CLASSPNP.SYS[89fbd59e] -> nt!IofCallDriver -> [0x85e3a1b0]
20:39:51.361    5 ACPI.sys[89c8f3d4] -> nt!IofCallDriver -> \Device\00000060[0x85e3a868]
20:39:52.516    AVAST engine scan C:\Windows
20:39:56.104    AVAST engine scan C:\Windows\system32
20:43:23.961    AVAST engine scan C:\Windows\system32\drivers
20:43:47.174    AVAST engine scan C:\Users\Laura
20:47:54.341    AVAST engine scan C:\ProgramData
20:48:28.271    Scan finished successfully
20:49:02.139    Disk 0 MBR has been saved successfully to "C:\Users\Laura\Desktop\MBR.dat"
20:49:02.139    The log file has been saved successfully to "C:\Users\Laura\Desktop\aswMBR2.txt"

cosinus 21.03.2012 15:02
Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

Frielchen 21.03.2012 21:32
so hier das ergebnis von malware:

Code:
Malwarebytes Anti-Malware (Test) 1.60.1.1000
www.malwarebytes.org

Datenbank Version: v2012.03.21.05

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
Laura :: LAURAS-PC [Administrator]

Schutz: Aktiviert

21.03.2012 19:15:30
mbam-log-2012-03-21 (19-15-30).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 291407
Laufzeit: 1 Stunde(n), 22 Minute(n), 26 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
und superantispyware:

Code:
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 03/21/2012 at 09:29 PM

Application Version : 5.0.1146

Core Rules Database Version : 8363
Trace Rules Database Version: 6175

Scan type      : Complete Scan
Total Scan Time : 00:45:22

Operating System Information
Windows 7 Home Premium 32-bit, Service Pack 1 (Build 6.01.7601)
UAC On - Limited User

Memory items scanned      : 636
Memory threats detected  : 0
Registry items scanned    : 34760
Registry threats detected : 0
File items scanned        : 44139
File threats detected    : 49

Adware.Tracking Cookie
        C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Cookies\QZ7VNDWP.txt [ /mediaplex.com ]
        C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Cookies\VSQ3BV6T.txt [ /smartadserver.com ]
        C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Cookies\NJCMDWFX.txt [ /doubleclick.net ]
        C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Cookies\4Y1Q7BND.txt [ /microsoftwllivemkt.112.2o7.net ]
        C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Cookies\2WDMFVRM.txt [ /eaeacom.112.2o7.net ]
        C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Cookies\Y0U80RJ4.txt [ /ad.yieldmanager.com ]
        C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Cookies\EA28YVOY.txt [ /atdmt.com ]
        C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Cookies\EDZFMF63.txt [ /msnportal.112.2o7.net ]
        C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Cookies\B83WPEPX.txt [ /apmebf.com ]
        C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Cookies\D6NDDT4S.txt [ /invitemedia.com ]
        C:\USERS\LAURA\AppData\Roaming\Microsoft\Windows\Cookies\Low\E79R1I3X.txt [ Cookie:laura@doubleclick.net/ ]
        C:\USERS\LAURA\AppData\Roaming\Microsoft\Windows\Cookies\Low\A0DK4SDI.txt [ Cookie:laura@questionmarket.com/ ]
        C:\USERS\LAURA\AppData\Roaming\Microsoft\Windows\Cookies\Low\97GKPV2J.txt [ Cookie:laura@im.banner.t-online.de/ ]
        C:\USERS\LAURA\AppData\Roaming\Microsoft\Windows\Cookies\Low\YX4W1CIG.txt [ Cookie:laura@de.sitestat.com/idgcom-de/gamestar/ ]
        C:\USERS\LAURA\AppData\Roaming\Microsoft\Windows\Cookies\Low\Z722U4NJ.txt [ Cookie:laura@zanox.com/ ]
        C:\USERS\LAURA\AppData\Roaming\Microsoft\Windows\Cookies\Low\TSY1BDYM.txt [ Cookie:laura@adtech.de/ ]
        C:\USERS\LAURA\AppData\Roaming\Microsoft\Windows\Cookies\Low\29B9IDEN.txt [ Cookie:laura@eas.apm.emediate.eu/ ]
        C:\USERS\LAURA\AppData\Roaming\Microsoft\Windows\Cookies\Low\0O3LR6EL.txt [ Cookie:laura@nextag.de/ ]
        C:\USERS\LAURA\AppData\Roaming\Microsoft\Windows\Cookies\Low\SNNMMJDG.txt [ Cookie:laura@tradedoubler.com/ ]
        C:\USERS\LAURA\AppData\Roaming\Microsoft\Windows\Cookies\Low\NMQE1IS7.txt [ Cookie:laura@statse.webtrendslive.com/ ]
        C:\USERS\LAURA\AppData\Roaming\Microsoft\Windows\Cookies\Low\W5K5UHJK.txt [ Cookie:laura@zanox-affiliate.de/ ]
        C:\USERS\LAURA\AppData\Roaming\Microsoft\Windows\Cookies\Low\10ADFAAS.txt [ Cookie:laura@www.burstnet.com/ ]
        C:\USERS\LAURA\AppData\Roaming\Microsoft\Windows\Cookies\Low\8F7XGO8Q.txt [ Cookie:laura@ad1.adfarm1.adition.com/ ]
        C:\USERS\LAURA\AppData\Roaming\Microsoft\Windows\Cookies\Low\G5GPFG97.txt [ Cookie:laura@fastclick.net/ ]
        C:\USERS\LAURA\AppData\Roaming\Microsoft\Windows\Cookies\Low\CM1QGTMI.txt [ Cookie:laura@legolas-media.com/ ]
        C:\USERS\LAURA\AppData\Roaming\Microsoft\Windows\Cookies\Low\VKT728PS.txt [ Cookie:laura@atdmt.com/ ]
        C:\USERS\LAURA\AppData\Roaming\Microsoft\Windows\Cookies\Low\4IWC416S.txt [ Cookie:laura@tracking.quisma.com/ ]
        C:\USERS\LAURA\AppData\Roaming\Microsoft\Windows\Cookies\Low\C4OOQL05.txt [ Cookie:laura@msnportal.112.2o7.net/ ]
        C:\USERS\LAURA\AppData\Roaming\Microsoft\Windows\Cookies\Low\71J8H03R.txt [ Cookie:laura@www.googleadservices.com/pagead/conversion/1069528796/ ]
        C:\USERS\LAURA\AppData\Roaming\Microsoft\Windows\Cookies\Low\M2A4X6M4.txt [ Cookie:laura@unitymedia.de/ ]
        C:\USERS\LAURA\AppData\Roaming\Microsoft\Windows\Cookies\Low\JQWFIAED.txt [ Cookie:laura@atdmt.combing.com/ ]
        C:\USERS\LAURA\AppData\Roaming\Microsoft\Windows\Cookies\Low\YQXE0ROV.txt [ Cookie:laura@apmebf.com/ ]
        C:\USERS\LAURA\AppData\Roaming\Microsoft\Windows\Cookies\Low\2RZIENG6.txt [ Cookie:laura@adviva.net/ ]
        C:\USERS\LAURA\AppData\Roaming\Microsoft\Windows\Cookies\Low\505IPDDQ.txt [ Cookie:laura@adfarm1.adition.com/ ]
        C:\USERS\LAURA\AppData\Roaming\Microsoft\Windows\Cookies\Low\BGQJPHYC.txt [ Cookie:laura@invitemedia.com/ ]
        C:\USERS\LAURA\AppData\Roaming\Microsoft\Windows\Cookies\Low\B56MWGCA.txt [ Cookie:laura@adsystem.tech-review.de/ ]
        C:\USERS\LAURA\AppData\Roaming\Microsoft\Windows\Cookies\Low\3SBX9KSD.txt [ Cookie:laura@ad3.adfarm1.adition.com/ ]
        C:\USERS\LAURA\AppData\Roaming\Microsoft\Windows\Cookies\Low\P16HG4CS.txt [ Cookie:laura@www.googleadservices.com/pagead/conversion/1026198434/ ]
        C:\USERS\LAURA\AppData\Roaming\Microsoft\Windows\Cookies\Low\UNWNNTHE.txt [ Cookie:laura@traffictrack.de/ ]
        C:\USERS\LAURA\AppData\Roaming\Microsoft\Windows\Cookies\Low\6G5ZHU2I.txt [ Cookie:laura@c.atdmt.com/ ]
        C:\USERS\LAURA\Cookies\QZ7VNDWP.txt [ Cookie:laura@mediaplex.com/ ]
        C:\USERS\LAURA\Cookies\NJCMDWFX.txt [ Cookie:laura@doubleclick.net/ ]
        C:\USERS\LAURA\Cookies\2WDMFVRM.txt [ Cookie:laura@eaeacom.112.2o7.net/ ]
        C:\USERS\LAURA\Cookies\EA28YVOY.txt [ Cookie:laura@atdmt.com/ ]
        C:\USERS\LAURA\Cookies\EDZFMF63.txt [ Cookie:laura@msnportal.112.2o7.net/ ]
        C:\USERS\LAURA\Cookies\B83WPEPX.txt [ Cookie:laura@apmebf.com/ ]
        C:\USERS\LAURA\Cookies\D6NDDT4S.txt [ Cookie:laura@invitemedia.com/ ]
        cdn.complexmedianetwork.com [ C:\USERS\LAURA\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\NG9XWQPN ]
        media.mtvnservices.com [ C:\USERS\LAURA\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\NG9XWQPN ]

cosinus 22.03.2012 11:48
Sieht ok aus, da wurden nur Cookies gefunden.
Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

Frielchen 22.03.2012 11:53
also das funktioniert wieder wunderbar..
wenn du mir sagst das da nichts mehr drauf ist das ich irgendwie runter machen muss, dann bin ich froh das wir fertig sind..
ich danke dir =)
LG Laura

cosinus 22.03.2012 13:02
Dann wären wir durch! :abklatsch:

Die Programme, die hier zum Einsatz kamen, können alle wieder runter. CF kann über Start, Ausführen mit combofix /uninstall entfernt werden. Melde dich falls es da Fehlermeldungen zu gibt.
Malwarebytes zu behalten ist kein Fehler. Kannst ja 1x im Monat damit scannen, aber immer vorher ans Update denken.

Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.


Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update


PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:

Adobe - Andere Version des Adobe Flash Player installieren

Notfalls kann man auch von Chip.de runterladen => http://filepony.de/?q=Flash+Player

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.


Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.

Frielchen 22.03.2012 13:41
danke danke.. werd ich auf jeden fall machen.
wenn ich wieder zu Hause bin versuch ich das mal runterzumachen wenns nicht geht sag ich nochmal bescheid ..


Alle Zeitangaben in WEZ +1. Es ist jetzt 09:01 Uhr.
Seite 2 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131