Trojaner-Board - Trojaner "System Check" deinstalliert

Guten Morgen Arne,

anbei die Log-Files:

1) GMER

Code:

GMER 1.0.15.15641 - hxxp://www.gmer.net

Rootkit scan 2012-03-30 21:45:50

Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-4 FUJITSU_MHV2080AT rev.00000096

Running: yztdzlx6.exe; Driver: C:\DOKUME~1\***\LOKALE~1\Temp\ugldypog.sys
 
 

---- System - GMER 1.0.15 ----
 

SSDT            F7C7942C                                                                                         ZwClose

SSDT            F7C793E6                                                                                         ZwCreateKey

SSDT            F7C79436                                                                                         ZwCreateSection

SSDT            F7C7940E                                                                                         ZwCreateSymbolicLinkObject

SSDT            F7C793DC                                                                                         ZwCreateThread

SSDT            F7C793EB                                                                                         ZwDeleteKey

SSDT            F7C793F5                                                                                         ZwDeleteValueKey

SSDT            F7C79427                                                                                         ZwDuplicateObject

SSDT            F7C79413                                                                                         ZwLoadDriver

SSDT            F7C793FA                                                                                         ZwLoadKey

SSDT            F7C793C8                                                                                         ZwOpenProcess

SSDT            F7C79409                                                                                         ZwOpenSection

SSDT            F7C793CD                                                                                         ZwOpenThread

SSDT            F7C7944F                                                                                         ZwQueryValueKey

SSDT            F7C79404                                                                                         ZwReplaceKey

SSDT            F7C79440                                                                                         ZwRequestWaitReplyPort

SSDT            F7C793FF                                                                                         ZwRestoreKey

SSDT            F7C7943B                                                                                         ZwSetContextThread

SSDT            F7C79445                                                                                         ZwSetSecurityObject

SSDT            F7C79418                                                                                         ZwSetSystemInformation

SSDT            F7C793F0                                                                                         ZwSetValueKey

SSDT            F7C7944A                                                                                         ZwSystemDebugControl

SSDT            F7C793D7                                                                                         ZwTerminateProcess

SSDT            F7C793D2                                                                                         ZwWriteVirtualMemory
 

---- User code sections - GMER 1.0.15 ----
 

.text           C:\WINDOWS\Explorer.EXE[268] SHELL32.dll!SHFileOperationW                                        7E7208A0 5 Bytes  JMP 10001102 C:\Programme\Unlocker\UnlockerHook.dll

.text           C:\Programme\OO Software\Defrag\oodag.exe[384] kernel32.dll!SetUnhandledExceptionFilter          7C84495D 5 Bytes  JMP 00402FD0 C:\Programme\OO Software\Defrag\oodag.exe (O&O Defrag Agent (Win32)/O&O Software GmbH)

.text           C:\WINDOWS\system32\SearchIndexer.exe[2084] kernel32.dll!WriteFile                               7C810E27 7 Bytes  JMP 00585C0C C:\WINDOWS\system32\MSSRCH.DLL (mssrch.dll/Microsoft Corporation)
 

---- Devices - GMER 1.0.15 ----
 

AttachedDevice  \Driver\Tcpip \Device\Ip                                                                         avfwot.sys (TDI filtering kernel driver/Avira GmbH)

AttachedDevice  \Driver\Tcpip \Device\Tcp                                                                        avfwot.sys (TDI filtering kernel driver/Avira GmbH)

AttachedDevice  \Driver\Tcpip \Device\Udp                                                                        avfwot.sys (TDI filtering kernel driver/Avira GmbH)

AttachedDevice  \Driver\Tcpip \Device\RawIp                                                                      avfwot.sys (TDI filtering kernel driver/Avira GmbH)
 

---- Registry - GMER 1.0.15 ----
 

Reg             HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\0011f6043fdd                      

Reg             HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\0011f6043fdd (not active ControlSet)  

Reg             HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System                                            

Reg             HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System@OODEFRAG14.00.00.01PROFESSIONAL            D38C9C9562025B830CCE028CF66DAA91C7DE4C0365E9C7C91F4DB10C28CA6C633954FCE25F3DCF72AEA32FDEE61BB7AB49AE05FEACC6DF388518BB85EB1A2C93EEAB362024E6AB07C85A6027EF0371A3855CF2E2A46436D60FCEFC683FD74E905E713F84A7B76971E8E65AB542BD3010500D4AB54E5FA04A7567B518183F44A54710066BF5FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B9808A6A0AC4980AC7933BA7FD869164D67945D575E7D6A3B98086BAACEF74AE96B9D281F432533C8664B19EAED45875AF0A096530896DCFD1ED99F3EB81ACF847AC847E5F96780CAC0D0B2DE095B94288B3EA6E8EB8F5029A55F2997FE9FBE9CE079ADC51EC162F0850C51D8D0B4006145D6AFD411F1776CCC483A441CB9242A5AA1AD6753EA56E0E8FE09BE32AADBF5EBA5A3DACE5D12261AA3C6026D6F129643C15D279FEC613142C331AB7CEC3A4BF1F5BC715D45E5A7B61488C8B5179F43A172961870A5876E0E85E3ECE47E333B692A7645DBF23BB872CF7B3E9BDF6382995FF60092465698EC84008683B563128DB790B6C800DD91BC206241A9487E9978476356BBD4D9242196AA2ED33CE81139268E570BDD1FE02C6442604D268F45AAFC7F4A82AAA5F81322C84E3892E7EC6F953A6F6CCF53C97C0FE2E05B21BE354569353D6

Reg             HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System@OOBT01.00.00.01PRO                         2F1BE094BA54C068198CF726415520BDDEF9B3066F391B8D2896928579EF382F1FD1E44D96AF437F678A3E059BA7A753D84DC20161C819E7119E31857E9E96F5DA5DCF1B4EAF31C652309CF2CB792CE47007D2D1B6F5E8CC5620BE9A922EA040EDB264DB65E5F31EDB9470F5D9D0C8CABF7D00CA9ED3FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B98085D575E7D6A3B9808A9C6AECB7A5D1407BA7FD869164D6794BDCC818BDC2A88C1630317BAC82082958D3DAB4CB7A0725B3B74895CF3E5E1D118E438933C9F02115BF84561812A17CBF3474FCA85CFABAA8217E8CB39979EAF2C82CBC3EFAB772EAE985075E74A92D2D41DC8119D4995342ED51B586EA63B021B5C354B8EADE9B3AD0E48664EA79DD2D0095EEDAD9D1ED348313AD23FAD8A757ECC051CDFE92FBE9BB050E63ACFB17FF57769F699C203EACF50F3500D2AAFBD5F54DEEAE307F1F230F5236E68B19D0ACAF857827893595EB5FB89A96D7F2410BE15F733C9112EF6987B0B39442305A948C2282E97CA09956023537CA7F2B3250E559EB2F8F637F4748068C473DB5F1B5B2D735AF30CCCFE2A563AA93830813B3401AFEB898D321CD6E8B0D54A78759E64B5DF2A44DBB50960CCBD56504500930DA79FA34909199E493CEB7154796676397CAC85ECA3262A45D

Reg             HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System@OODEFRAG15.00.00.01PROFESSIONAL            B40988F94CB04B5F8774830D5E3103144E909B493E7043E6E4BEC41190AAFCA5FABAEF9A8F192E4FB6ADD9911F554C4325519BD3A5BD880507201931B772DE82DE9CB7C917E078F9571DE46CFADCD7E3F7B3731235CA5E74291F3FE315DA17260ACBA5D12654605E13E853B4C46DD2148B88570E6D398316CE538DC3F39F1C535DC9D7FDF966B13DC61BFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B9808A9C6AECB7A5D1407FEBC9E127BECC74C5D575E7D6A3B9808BDC3EAE032810A09841C1BE5A8BD576164BD040BAD9072AB34CCB72A05C04C4AA2BC65180B9C46A0EA2AD13512609568DBBE2801179B7B8B36AA93C83F364022CEAA2EE326FC136B8A1939F903BF2765279C2F5D177E2AEDD0DB9CFCEEAC0A750F3FCBD3EF798840F84C457B3D341E3BBE0E99C4653431DD84847C6161DE19190932369CEB2FF2DE1DAD5B2A18DA44326FCAD87D4B7975CAA05155B6F6CA8E45B0C05C172DFD5067B229D396FD949773D81254F22BD11108CBEFBADE24B3429552A91DC05E09D4DE4A2FFE766C87458B72A5E632750251CC80133464F0A23C8B8CAFCD3B3CB9E830C6359DA4769CB4EF02C8E0EE3215B6B48BF03EF17961BD0B511B38C9183BA5A760B2E69DC080FCF526488380FDD9F7408E4548576D7EB8DDE839995557F
 

---- EOF - GMER 1.0.15 ----

2) OSAM

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

hxxp://www.online-solutions.ru/en/

Saved at 22:00:45 on 30.03.2012
 

OS: Windows XP Home Edition Service Pack 3 (Build 2600)

Default Browser: Mozilla Corporation Firefox 11.0
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Boot Execute]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Session Manager )-----

"BootExecute" - "O&O Software GmbH" - C:\WINDOWS\system32\OODBS.exe
 

[Control Panel Objects]

-----( %SystemRoot%\system32 )-----

"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\WINDOWS\system32\FlashPlayerCPLApp.cpl

"infocardcpl.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\infocardcpl.cpl

"javacpl.cpl" - "Oracle Corporation" - C:\WINDOWS\system32\javacpl.cpl

"VCCenter.cpl" - "Sony Corporation" - C:\WINDOWS\system32\VCCenter.cpl

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----

"Avira AntiVir Premium" - "Avira Operations GmbH & Co. KG" - C:\PROGRA~1\Avira\ANTIVI~1\avconfig.cpl

"mlcfg32.cpl" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office14\MLCFG32.CPL

"QuickTime" - "Apple Inc." - C:\Programme\QuickTime\QTSystem\QuickTime.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"AEGIS Protocol (IEEE 802.1x) v3.5.3.0" (AegisP) - "Meetinghouse Data Communications" - C:\WINDOWS\System32\DRIVERS\AegisP.sys

"avfwot" (avfwot) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avfwot.sys

"avgntflt" (avgntflt) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avgntflt.sys

"avipbb" (avipbb) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avipbb.sys

"avkmgr" (avkmgr) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avkmgr.sys

"bdsandbox" (bdsandbox) - "BitDefender SRL" - C:\WINDOWS\system32\drivers\bdsandbox.sys

"catchme" (catchme) - ? - C:\DOKUME~1\***\LOKALE~1\Temp\catchme.sys  (File not found)

"Changer" (Changer) - ? - C:\WINDOWS\system32\drivers\Changer.sys  (File not found)

"dgderdrv" (dgderdrv) - ? - C:\WINDOWS\System32\drivers\dgderdrv.sys  (File not found)

"i2omgmt" (i2omgmt) - ? - C:\WINDOWS\system32\drivers\i2omgmt.sys  (File not found)

"lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys  (File not found)

"MBAMProtector" (MBAMProtector) - "Malwarebytes Corporation" - C:\WINDOWS\system32\drivers\mbam.sys

"PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys  (File not found)

"PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys  (File not found)

"PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys  (File not found)

"PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys  (File not found)

"PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys  (File not found)

"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\WINDOWS\System32\Drivers\PxHelp20.sys

"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\ssmdrv.sys

"StarOpen" (StarOpen) - ? - C:\WINDOWS\system32\drivers\StarOpen.sys  (File found, but it contains no detailed information)

"TAP-Win32 Adapter V9" (tap0901) - "The OpenVPN Project" - C:\WINDOWS\System32\DRIVERS\tap0901.sys

"TuneUpUtilitiesDrv" (TuneUpUtilitiesDrv) - "TuneUp Software" - C:\Programme\TuneUp\TuneUpUtilitiesDriver32.sys

"ugldypog" (ugldypog) - ? - C:\DOKUME~1\***\LOKALE~1\Temp\ugldypog.sys  (Hidden registry entry, rootkit activity | File not found)

"WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys  (File not found)

"WLAN Transport" (s24trans) - "Intel Corporation" - C:\WINDOWS\System32\DRIVERS\s24trans.sys
 

[Explorer]

-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----

{89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll

-----( HKLM\Software\Classes\Protocols\Filter )-----

{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

{807573E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE14\MSOXMLMF.DLL

-----( HKLM\Software\Classes\Protocols\Handler )-----

{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll

{828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----

{56F9679E-7826-4C84-81F3-532071A8BCC5} "Windows Desktop Search Namespace Manager" - "Microsoft Corporation" - C:\Programme\Windows Desktop Search\MSNLNamespaceMgr.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Programme\7-Zip\7-zip.dll

{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802} "Acrobat Elements Context Menu" - "Adobe Systems Inc." - C:\Programme\Adobe\PDF Maker\Acrobat Elements\ContextMenu.dll

{0244E652-07EF-43C2-8AAD-ABA3CF40DF16} "Bitdefender SafeBox" - ? -   (File not found | COM-object registry key not found)

{D66DC78C-4F61-447F-942B-3FB6980118CF} "CInfoTipShellExt Class" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office14\VISSHE.DLL

{42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? -   (File not found | COM-object registry key not found)

{2F46275A-B9C5-4C8F-94C0-71BD2B28220C} "ExtPropertySheet Class" - ? -   (File not found | COM-object registry key not found)

{693BE9C0-BEC3-11D2-B4C1-C33BBD3AD64B} "Fast Explorer Shell Extension" - "Alex Yakovlev" - C:\DOKUME~1\ALLUSE~1\ANWEND~1\AllDup\FEShlExt.dll

{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? -   (File not found | COM-object registry key not found)

{506F4668-F13E-4AA1-BB04-B43203AB3CC0} "ImageExtractorShellExt Class" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office14\VISSHE.DLL

{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? -   (File not found | COM-object registry key not found)

{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office14\msohevi.dll

{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE14\msoshext.dll

{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE14\msoshext.dll

{0875DCB6-C686-4243-9432-ADCCF0B9F2D7} "Microsoft OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office14\ONFILTER.DLL

{00020D75-0000-0000-C000-000000000046} "Microsoft Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office14\MLSHEXT.DLL

{48EAD1E1-ECF2-4a85-AA09-1C44FBEED451} "OODShellExtObj Class" - "O&O Software GmbH" - C:\Programme\OO Software\Defrag\oodsh.dll

{0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office14\OLKFSTUB.DLL

{E91B2703-013E-4A99-AD33-2B6FB00AA356} "RecordNow! ContextMenuExt" - ? - C:\Programme\Sonic\RecordNow!\shlext.dll

{DEE12703-6333-4D4E-8F34-738C4DCC2E04} "RecordNow! SendToExt" - ? - C:\Programme\Sonic\RecordNow!\shlext.dll

{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira Operations GmbH & Co. KG" - C:\Programme\Avira\AntiVir Desktop\shlext.dll

{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" - "Microsoft Corporation" - c:\WINDOWS\system32\dfshim.dll

{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? -   (File not found | COM-object registry key not found)

{e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" - "Microsoft Corporation" - c:\WINDOWS\system32\dfshim.dll

{ED58A35B-B554-42AF-A26C-6F3D424200D3} "SPMPanel" - "Sony Corporation" - C:\Programme\Sony\VAIO Power Management\SPMPanel.dll

{4838CD50-7E5D-4811-9B17-C47A85539F28} "TuneUp Disk Space Explorer Shell Extension" - "TuneUp Software" - C:\Programme\TuneUp\DseShExt-x86.dll

{4858E7D9-8E12-45a3-B6A3-1CD128C9D403} "TuneUp Shredder Shell Extension" - "TuneUp Software" - C:\Programme\TuneUp\SDShelEx-win32.dll

{44440D00-FF19-4AFC-B765-9A0970567D97} "TuneUp Theme Extension" - "TuneUp Software" - C:\WINDOWS\System32\uxtuneup.dll

{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83} "UnlockerShellExtension" - ? - C:\Programme\Unlocker\UnlockerCOM.dll  (File found, but it contains no detailed information)

{DBD8E168-244D-448C-9922-25508950D1DC} "USIShellExt Class" - "Ulead Systems, Inc." - c:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\USIShex.dll

{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Web Folders" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\MSONSEXT.DLL

{13E7F612-F261-4391-BEA2-39DF4F3FA311} "Windows Desktop Search" - "Microsoft Corporation" - C:\Programme\Windows Desktop Search\msnlExt.dll

{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -   (File not found | COM-object registry key not found)
 

[Internet Explorer]

-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----

ITBar7Height "ITBar7Height" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.7.0_01" - "Oracle Corporation" - C:\Programme\Java\jre7\bin\npjpi170_01.dll / hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab

{CAFEEFAC-0017-0000-0001-ABCDEFFEDCBA} "Java Plug-in 1.7.0_01" - "Oracle Corporation" - C:\Programme\Java\jre7\bin\npjpi170_01.dll / hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.7.0_01" - "Oracle Corporation" - C:\Programme\Java\jre7\bin\npjpi170_01.dll / hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab

{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBA} "{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBA}" - ? -   (File not found | COM-object registry key not found) / hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_01-windows-i586.cab

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll

{FFFDC614-B694-4AE6-AB38-5D6374584B52} "Verknüpfte &OneNote-Notizen" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "AcroIEHlprObj Class" - "Adobe Systems Incorporated" - C:\Programme\Adobe\PDF Maker\Acrobat\ActiveX\AcroIEHelper.dll

{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Oracle Corporation" - C:\Programme\Java\jre7\bin\jp2ssv.dll

{B4F3A835-0E21-4959-BA22-42B3008E02FF} "Office Document Cache Handler" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL

{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
 

[Logon]

-----( %AllUsersProfile%\Startmenü\Programme\Autostart )-----

"desktop.ini" - ? - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini

"O&O AutoBackup.lnk" - "O&O Software GmbH" - C:\Programme\OO Software\AutoBackup\oobt.exe  (Shortcut exists | File exists)

-----( %UserProfile%\Startmenü\Programme\Autostart )-----

"desktop.ini" - ? - C:\Dokumente und Einstellungen\***\Startmenü\Programme\Autostart\desktop.ini

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"Adobe ARM" - "Adobe Systems Incorporated" - "C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe"

"avgnt" - "Avira Operations GmbH & Co. KG" - "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min

"Malwarebytes' Anti-Malware" - "Malwarebytes Corporation" - "C:\Programme\Malwarebytes Anti-Malware\mbamgui.exe" /starttray

"OODefragTray" - "O&O Software GmbH" - C:\Programme\OO Software\Defrag\oodtray.exe

"PrepareYourVAIO" - "Sony Corporation" - C:\Programme\Sony\Prepare your VAIO\PYVAlert.exe

"SonyPowerCfg" - "Sony Corporation" - C:\Programme\Sony\VAIO Power Management\SPMgr.exe

"UnlockerAssistant" - ? - "C:\Programme\Unlocker\UnlockerAssistant.exe"  (File found, but it contains no detailed information)
 

[Print Monitors]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----

"Adobe PDF Port" - "Adobe Systems Incorporated." - C:\WINDOWS\system32\AdobePDF.dll

"eDocPortMonitor" - ? - C:\WINDOWS\system32\eDocPort.dll  (File not found)

"PDFCreator" - ? - C:\WINDOWS\system32\pdfcmnnt.dll  (File found, but it contains no detailed information)
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

".NET Runtime Optimization Service v2.0.50727_X86" (clr_optimization_v2.0.50727_32) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

"Adobe Active File Monitor V5" (AdobeActiveFileMonitor5.0) - ? - C:\Programme\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe  (File found, but it contains no detailed information)

"Anwendungsverwaltung" (AppMgmt) - ? - C:\WINDOWS\System32\appmgmts.dll  (File not found)

"ASP.NET-Zustandsdienst" (aspnet_state) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe

"Avira Browser Schutz" (AntiVirWebService) - "Avira Operations GmbH & Co. KG" - C:\Programme\Avira\AntiVir Desktop\AVWEBGRD.EXE

"Avira Echtzeit Scanner" (AntiVirService) - "Avira Operations GmbH & Co. KG" - C:\Programme\Avira\AntiVir Desktop\avguard.exe

"Avira Email Schutz" (AntiVirMailService) - "Avira Operations GmbH & Co. KG" - C:\Programme\Avira\AntiVir Desktop\avmailc.exe

"Avira FireWall" (AntiVirFirewallService) - "Avira Operations GmbH & Co. KG" - C:\Programme\Avira\AntiVir Desktop\avfwsvc.exe

"Avira Planer" (AntiVirSchedulerService) - "Avira Operations GmbH & Co. KG" - C:\Programme\Avira\AntiVir Desktop\sched.exe

"BitDefender Update Server v2" (Update Server) - ? - C:\Programme\Gemeinsame Dateien\Bitdefender\Bitdefender Arrakis Server\bin\arrakis3.exe  (File not found)

"Capture Device Service" (Capture Device Service) - "InterVideo Inc." - C:\Programme\Gemeinsame Dateien\InterVideo\DeviceService\DevSvc.exe

"HitmanPro Scheduler" (HitmanProScheduler) - "SurfRight B.V." - C:\Programme\HitmanPro\hmpsched.exe

"InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1150\Intel 32\IDriverT.exe

"Intel(R) PROSet/Wireless Event Log" (EvtEng) - "Intel Corporation" - C:\Programme\Intel\Wireless\Bin\EvtEng.exe

"Intel(R) PROSet/Wireless Registry Service" (RegSrvc) - "Intel Corporation" - C:\Programme\Intel\Wireless\Bin\RegSrvc.exe

"Intel(R) PROSet/Wireless Service" (S24EventMonitor) - "Intel Corporation " - C:\Programme\Intel\Wireless\Bin\S24EvMon.exe

"MBAMService" (MBAMService) - "Malwarebytes Corporation" - C:\Programme\Malwarebytes Anti-Malware\mbamservice.exe

"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

"MSCSPTISRV" (MSCSPTISRV) - "Sony Corporation" - C:\Programme\Gemeinsame Dateien\Sony Shared\AVLib\MSCSPTISRV.exe

"NMSAccess" (NMSAccess) - ? - C:\Programme\CD Burner\NMSAccessU.exe  (File found, but it contains no detailed information)

"O&O Defrag" (OODefragAgent) - "O&O Software GmbH" - C:\Programme\OO Software\Defrag\oodag.exe

"Office  Source Engine" (ose) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE

"Office Software Protection Platform" (osppsvc) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

"OpenVPN Service" (OpenVPNService) - ? - C:\Programme\OpenVPN\bin\openvpnserv.exe  (File found, but it contains no detailed information)

"PACSPTISVR" (PACSPTISVR) - ? - C:\Programme\Gemeinsame Dateien\Sony Shared\AVLib\PACSPTISVR.exe

"Protexis Licensing V2" (PSI_SVC_2) - "Protexis Inc." - c:\Programme\Gemeinsame Dateien\Protexis\License Service\PsiService_2.exe

"SafeBox" (SafeBox) - ? - "C:\Programme\Bitdefender\Bitdefender SafeBox\safeboxservice.exe"  (File not found)

"SonicStage Back-End Service" (SonicStage Back-End Service) - "Sony Corporation" - C:\Programme\Gemeinsame Dateien\Sony Shared\AVLib\SsBeSvc.exe

"SonicStage SCSI Service" (SSScsiSV) - "Sony Corporation" - C:\Programme\Gemeinsame Dateien\Sony Shared\AVLib\SSScsiSV.exe

"Sony SPTI Service" (SPTISRV) - "Sony Corporation" - C:\Programme\Gemeinsame Dateien\Sony Shared\AVLib\SPTISRV.exe

"STRATO HiDrive Service" (STRATO HiDrive Service) - "STRATO" - C:\Programme\STRATO\STRATO HiDrive Service.exe

"TuneUp Designerweiterung" (UxTuneUp) - "TuneUp Software" - C:\WINDOWS\System32\uxtuneup.dll

"TuneUp Utilities Service" (TuneUp.UtilitiesSvc) - "TuneUp Software" - C:\Programme\TuneUp\TuneUpUtilitiesService32.exe

"Ulead Burning Helper" (UleadBurningHelper) - "Ulead Systems, Inc." - C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe

"VAIO Entertainment Aggregation and Control Service" (VAIO Entertainment Aggregation and Control Service) - ? - "C:\Programme\Gemeinsame Dateien\Sony Shared\VAIO Entertainment\VzRs\VzRs.exe"  (File not found)

"VAIO Event Service" (VAIO Event Service) - "Sony Corporation" - C:\Programme\Sony\VAIO Event Service\VESMgr.exe

"Windows CardSpace" (idsvc) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe

"Windows Presentation Foundation Font Cache 3.0.0.0" (FontCache3.0.0.0) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe

"Windows Presentation Foundation Font Cache 4.0.0.0" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
 

[Winlogon]

-----( HKCU\Control Panel\IOProcs )-----

"MVB" - ? - mvfs32.dll  (File not found)

-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions )-----

{c6dc5466-785a-11d2-84d0-00c04fb169f7} "Softwareinstallation" - ? - appmgmts.dll  (File not found)

-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )-----

"VESWinlogon" - "Sony Corporation" - C:\WINDOWS\system32\VESWinlogon.dll
 

[Winsock Providers]

-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries )-----

"AVSDA" - "Avira Operations GmbH & Co. KG" - C:\Programme\Avira\AntiVir Desktop\avsda.dll
 

===[ Logfile end ]=========================================[ Logfile end ]===
 

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

3) aswMBR

Code:

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software

Run date: 2012-03-31 08:52:33

-----------------------------

08:52:33.921    OS Version: Windows 5.1.2600 Service Pack 3

08:52:33.921    Number of processors: 1 586 0xD08

08:52:33.921    ComputerName: VAIO  UserName: 

08:52:36.406    Initialize success

08:52:59.812    AVAST engine defs: 12033000

08:53:08.484    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-4

08:53:08.484    Disk 0 Vendor: FUJITSU_MHV2080AT 00000096 Size: 76319MB BusType: 3

08:53:08.484    Disk 1  \Device\Harddisk1\DR4 -> \Device\0000008f

08:53:08.484    Disk 1 Vendor: (  Size: 76319MB BusType: 0

08:53:08.515    Disk 0 MBR read successfully

08:53:08.515    Disk 0 MBR scan

08:53:08.546    Disk 0 Windows 7 default MBR code

08:53:08.546    Disk 0 Partition 1 00     12  Compaq diag NTFS         7153 MB offset 63

08:53:08.578    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS NTFS        38154 MB offset 14651280

08:53:08.578    Disk 0 Partition - 00     0F Extended LBA             31008 MB offset 92791440

08:53:08.609    Disk 0 Partition 3 00     07    HPFS/NTFS NTFS        31008 MB offset 92791503

08:53:08.640    Disk 0 scanning sectors +156296385

08:53:08.750    Disk 0 scanning C:\WINDOWS\system32\drivers

08:53:24.796    Service scanning

08:53:46.968    Modules scanning

08:53:52.515    Disk 0 trace - called modules:

08:53:52.546    ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS 

08:53:52.546    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86f4fab8]

08:53:52.546    3 CLASSPNP.SYS[f7630fd7] -> nt!IofCallDriver -> \Device\00000085[0x86fa89e8]

08:53:52.546    5 ACPI.sys[f74a6620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-4[0x86f54940]

08:53:52.875    AVAST engine scan C:\WINDOWS

08:54:06.031    AVAST engine scan C:\WINDOWS\system32

08:57:30.843    AVAST engine scan C:\WINDOWS\system32\drivers

08:57:48.015    AVAST engine scan C:\Dokumente und Einstellungen\***

09:10:11.468    AVAST engine scan C:\Dokumente und Einstellungen\All Users

09:13:34.859    Scan finished successfully

09:34:03.656    Disk 0 MBR has been saved successfully to "C:\Dokumente und Einstellungen\***\Desktop\MBR.dat"

09:34:03.656    The log file has been saved successfully to "C:\Dokumente und Einstellungen\***\Desktop\aswMBR.txt"

Guten Morgen Arne,

da ich den Rechner morgen wieder beruflich nutzen muss, habe ich vorab nochmal Scans mit Malwarebytes und SUPERAntiSpyware gemacht. Vielleicht rundet das das Bild ab... Danke fürs Draufschauen!!

Anbei die Logs - beide ohne Funde.

Code:

SUPERAntiSpyware Scan Log

hxxp://www.superantispyware.com
 

Generated 03/31/2012 at 10:22 PM
 

Application Version : 5.0.1146
 

Core Rules Database Version : 8402

Trace Rules Database Version: 6214
 

Scan type       : Complete Scan

Total Scan Time : 02:55:12
 

Operating System Information

Windows XP Home Edition 32-bit, Service Pack 3 (Build 5.01.2600)

Administrator
 

Memory items scanned      : 658

Memory threats detected   : 0

Registry items scanned    : 35501

Registry threats detected : 0

File items scanned        : 108038

File threats detected     : 4
 

Adware.Tracking Cookie

        .playbackfinder.de [ C:\DOKUMENTE UND EINSTELLUNGEN\***\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\EPPJZN1J.DEFAULT\COOKIES.SQLITE ]

        .playbackfinder.de [ C:\DOKUMENTE UND EINSTELLUNGEN\***\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\EPPJZN1J.DEFAULT\COOKIES.SQLITE ]

        .playbackfinder.de [ C:\DOKUMENTE UND EINSTELLUNGEN\***\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\EPPJZN1J.DEFAULT\COOKIES.SQLITE ]

        .playbackfinder.de [ C:\DOKUMENTE UND EINSTELLUNGEN\***\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\EPPJZN1J.DEFAULT\COOKIES.SQLITE ]

Code:

Malwarebytes Anti-Malware (Test) 1.60.1.1000

www.malwarebytes.org
 

Datenbank Version: v2012.03.31.05
 

Windows XP Service Pack 3 x86 NTFS

Internet Explorer 8.0.6001.18702

Marius :: VAIO [Administrator]
 

Schutz: Aktiviert
 

31.03.2012 15:28:43

mbam-log-2012-03-31 (15-28-43).txt
 

Art des Suchlaufs: Vollständiger Suchlauf

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 305553

Laufzeit: 2 Stunde(n), 42 Minute(n), 4 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

Code:

SUPERAntiSpyware Scan Log

hxxp://www.superantispyware.com
 

Generated 03/31/2012 at 10:22 PM
 

Application Version : 5.0.1146
 

Core Rules Database Version : 8402

Trace Rules Database Version: 6214
 

Scan type       : Complete Scan

Total Scan Time : 02:55:12
 

Operating System Information

Windows XP Home Edition 32-bit, Service Pack 3 (Build 5.01.2600)

Administrator
 

Memory items scanned      : 658

Memory threats detected   : 0

Registry items scanned    : 35501

Registry threats detected : 0

File items scanned        : 108038

File threats detected     : 4
 

Adware.Tracking Cookie

        .playbackfinder.de [ C:\DOKUMENTE UND EINSTELLUNGEN\***\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\EPPJZN1J.DEFAULT\COOKIES.SQLITE ]

        .playbackfinder.de [ C:\DOKUMENTE UND EINSTELLUNGEN\***\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\EPPJZN1J.DEFAULT\COOKIES.SQLITE ]

        .playbackfinder.de [ C:\DOKUMENTE UND EINSTELLUNGEN\***\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\EPPJZN1J.DEFAULT\COOKIES.SQLITE ]

        .playbackfinder.de [ C:\DOKUMENTE UND EINSTELLUNGEN\***\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\EPPJZN1J.DEFAULT\COOKIES.SQLITE ]

Code:

Malwarebytes Anti-Malware (Test) 1.60.1.1000

www.malwarebytes.org
 

Datenbank Version: v2012.03.31.05
 

Windows XP Service Pack 3 x86 NTFS

Internet Explorer 8.0.6001.18702

Marius :: VAIO [Administrator]
 

Schutz: Aktiviert
 

31.03.2012 15:28:43

mbam-log-2012-03-31 (15-28-43).txt
 

Art des Suchlaufs: Vollständiger Suchlauf

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 305553

Laufzeit: 2 Stunde(n), 42 Minute(n), 4 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)