Trojaner-Board
Seite 2 von 3 1 2 3
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Moskau - Plötzlich langsame Internetverbindung trotz gutem Netzwerk (https://www.trojaner-board.de/116808-moskau-ploetzlich-langsame-internetverbindung-trotz-gutem-netzwerk.html)

cosinus 14.06.2012 13:39
Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg

mkid76 14.06.2012 21:28
Hi Arne,

alles wie beschrieben durchgeführt und hier nun das tdss log file:

lg mario

Code:
22:19:59.0119 4468        TDSS rootkit removing tool 2.7.39.0 Jun 14 2012 08:11:46
22:20:00.0133 4468        ============================================================
22:20:00.0133 4468        Current date / time: 2012/06/14 22:20:00.0133
22:20:00.0133 4468        SystemInfo:
22:20:00.0133 4468       
22:20:00.0133 4468        OS Version: 6.1.7601 ServicePack: 1.0
22:20:00.0133 4468        Product type: Workstation
22:20:00.0133 4468        ComputerName: M-MKINDERMANN
22:20:00.0133 4468        UserName: mkindermann
22:20:00.0133 4468        Windows directory: C:\Windows
22:20:00.0133 4468        System windows directory: C:\Windows
22:20:00.0133 4468        Running under WOW64
22:20:00.0133 4468        Processor architecture: Intel x64
22:20:00.0133 4468        Number of processors: 4
22:20:00.0133 4468        Page size: 0x1000
22:20:00.0133 4468        Boot type: Normal boot
22:20:00.0133 4468        ============================================================
22:20:00.0382 4468        Drive \Device\Harddisk0\DR0 - Size: 0x1DCFE00000 (119.25 Gb), SectorSize: 0x200, Cylinders: 0x3CCE, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
22:20:00.0398 4468        ============================================================
22:20:00.0398 4468        \Device\Harddisk0\DR0:
22:20:00.0398 4468        MBR partitions:
22:20:00.0398 4468        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0xFF5000, BlocksNum 0x32000
22:20:00.0398 4468        \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x1027000, BlocksNum 0xDE57800
22:20:00.0398 4468        ============================================================
22:20:00.0398 4468        Initialize success
22:20:00.0398 4468        ============================================================
22:20:15.0031 5672        ============================================================
22:20:15.0031 5672        Scan started
22:20:15.0031 5672        Mode: Manual; SigCheck; TDLFS;
22:20:15.0031 5672        ============================================================
22:20:15.0062 5672        1394ohci - ok
22:20:15.0062 5672        ACDaemon - ok
22:20:15.0062 5672        ACPI - ok
22:20:15.0062 5672        AcpiPmi - ok
22:20:15.0077 5672        AdobeARMservice - ok
22:20:15.0077 5672        AdobeFlashPlayerUpdateSvc - ok
22:20:15.0077 5672        adp94xx - ok
22:20:15.0093 5672        adpahci - ok
22:20:15.0093 5672        adpu320 - ok
22:20:15.0093 5672        AeLookupSvc - ok
22:20:15.0093 5672        AFD - ok
22:20:15.0109 5672        agp440 - ok
22:20:15.0109 5672        ALG - ok
22:20:15.0109 5672        aliide - ok
22:20:15.0109 5672        amdide - ok
22:20:15.0124 5672        AmdK8 - ok
22:20:15.0124 5672        AmdPPM - ok
22:20:15.0124 5672        amdsata - ok
22:20:15.0124 5672        amdsbs - ok
22:20:15.0124 5672        amdxata - ok
22:20:15.0140 5672        AppID - ok
22:20:15.0140 5672        AppIDSvc - ok
22:20:15.0140 5672        Appinfo - ok
22:20:15.0140 5672        Apple Mobile Device - ok
22:20:15.0155 5672        AppMgmt - ok
22:20:15.0155 5672        arc - ok
22:20:15.0155 5672        arcsas - ok
22:20:15.0171 5672        aspnet_state - ok
22:20:15.0171 5672        AsyncMac - ok
22:20:15.0171 5672        atapi - ok
22:20:15.0171 5672        atksgt - ok
22:20:15.0171 5672        AudioEndpointBuilder - ok
22:20:15.0187 5672        AudioSrv - ok
22:20:15.0187 5672        AxInstSV - ok
22:20:15.0187 5672        b06bdrv - ok
22:20:15.0202 5672        b57nd60a - ok
22:20:15.0202 5672        BDESVC - ok
22:20:15.0202 5672        Beep - ok
22:20:15.0202 5672        BFE - ok
22:20:15.0218 5672        BITS - ok
22:20:15.0218 5672        blbdrive - ok
22:20:15.0218 5672        Bonjour Service - ok
22:20:15.0218 5672        bowser - ok
22:20:15.0218 5672        BrFiltLo - ok
22:20:15.0233 5672        BrFiltUp - ok
22:20:15.0233 5672        Browser - ok
22:20:15.0233 5672        Brserid - ok
22:20:15.0233 5672        BrSerWdm - ok
22:20:15.0249 5672        BrUsbMdm - ok
22:20:15.0249 5672        BrUsbSer - ok
22:20:15.0249 5672        BthEnum - ok
22:20:15.0249 5672        BTHMODEM - ok
22:20:15.0249 5672        BthPan - ok
22:20:15.0265 5672        BTHPORT - ok
22:20:15.0265 5672        bthserv - ok
22:20:15.0265 5672        BTHUSB - ok
22:20:15.0265 5672        btwampfl - ok
22:20:15.0265 5672        btwaudio - ok
22:20:15.0280 5672        btwavdt - ok
22:20:15.0280 5672        btwdins - ok
22:20:15.0280 5672        btwl2cap - ok
22:20:15.0280 5672        btwrchid - ok
22:20:15.0296 5672        cdfs - ok
22:20:15.0296 5672        cdrom - ok
22:20:15.0296 5672        CertPropSvc - ok
22:20:15.0296 5672        circlass - ok
22:20:15.0296 5672        CLFS - ok
22:20:15.0311 5672        clr_optimization_v2.0.50727_32 - ok
22:20:15.0311 5672        clr_optimization_v2.0.50727_64 - ok
22:20:15.0311 5672        clr_optimization_v4.0.30319_32 - ok
22:20:15.0311 5672        clr_optimization_v4.0.30319_64 - ok
22:20:15.0327 5672        CmBatt - ok
22:20:15.0327 5672        cmdide - ok
22:20:15.0327 5672        CNG - ok
22:20:15.0327 5672        Compbatt - ok
22:20:15.0327 5672        CompositeBus - ok
22:20:15.0343 5672        COMSysApp - ok
22:20:15.0343 5672        crcdisk - ok
22:20:15.0343 5672        CryptSvc - ok
22:20:15.0343 5672        CSC - ok
22:20:15.0343 5672        CscService - ok
22:20:15.0358 5672        dc3d - ok
22:20:15.0358 5672        DcomLaunch - ok
22:20:15.0358 5672        defragsvc - ok
22:20:15.0358 5672        DfsC - ok
22:20:15.0358 5672        Dhcp - ok
22:20:15.0374 5672        discache - ok
22:20:15.0374 5672        Disk - ok
22:20:15.0374 5672        Dnscache - ok
22:20:15.0374 5672        dot3svc - ok
22:20:15.0389 5672        Dot4 - ok
22:20:15.0389 5672        Dot4Print - ok
22:20:15.0389 5672        dot4usb - ok
22:20:15.0389 5672        DPS - ok
22:20:15.0389 5672        drmkaud - ok
22:20:15.0405 5672        DXGKrnl - ok
22:20:15.0405 5672        e1kexpress - ok
22:20:15.0405 5672        EapHost - ok
22:20:15.0405 5672        ebdrv - ok
22:20:15.0405 5672        EFS - ok
22:20:15.0421 5672        ehRecvr - ok
22:20:15.0421 5672        ehSched - ok
22:20:15.0421 5672        elxstor - ok
22:20:15.0421 5672        ErrDev - ok
22:20:15.0421 5672        EventSystem - ok
22:20:15.0436 5672        EvtEng - ok
22:20:15.0436 5672        exfat - ok
22:20:15.0436 5672        F-Secure Gatekeeper - ok
22:20:15.0436 5672        F-Secure Gatekeeper Handler Starter - ok
22:20:15.0452 5672        F-Secure HIPS - ok
22:20:15.0452 5672        F-Secure Network Request Broker - ok
22:20:15.0452 5672        fastfat - ok
22:20:15.0452 5672        Fax - ok
22:20:15.0452 5672        fdc - ok
22:20:15.0467 5672        fdPHost - ok
22:20:15.0467 5672        FDResPub - ok
22:20:15.0467 5672        FileInfo - ok
22:20:15.0467 5672        Filetrace - ok
22:20:15.0467 5672        flpydisk - ok
22:20:15.0483 5672        FltMgr - ok
22:20:15.0483 5672        FontCache - ok
22:20:15.0483 5672        FontCache3.0.0.0 - ok
22:20:15.0483 5672        fsbts - ok
22:20:15.0499 5672        FsDepends - ok
22:20:15.0499 5672        FSDFWD - ok
22:20:15.0499 5672        FSES - ok
22:20:15.0499 5672        FSFW - ok
22:20:15.0499 5672        FSMA - ok
22:20:15.0514 5672        FSORSPClient - ok
22:20:15.0514 5672        fsvista - ok
22:20:15.0514 5672        Fs_Rec - ok
22:20:15.0514 5672        fvevol - ok
22:20:15.0514 5672        gagp30kx - ok
22:20:15.0530 5672        GEARAspiWDM - ok
22:20:15.0530 5672        gpsvc - ok
22:20:15.0530 5672        hcw85cir - ok
22:20:15.0530 5672        HdAudAddService - ok
22:20:15.0530 5672        HDAudBus - ok
22:20:15.0545 5672        HECIx64 - ok
22:20:15.0545 5672        HidBatt - ok
22:20:15.0545 5672        HidBth - ok
22:20:15.0545 5672        HidIr - ok
22:20:15.0545 5672        hidserv - ok
22:20:15.0561 5672        HidUsb - ok
22:20:15.0561 5672        hkmsvc - ok
22:20:15.0561 5672        HomeGroupListener - ok
22:20:15.0561 5672        HomeGroupProvider - ok
22:20:15.0561 5672        hpqcxs08 - ok
22:20:15.0577 5672        hpqddsvc - ok
22:20:15.0577 5672        HpSAMD - ok
22:20:15.0577 5672        HPSLPSVC - ok
22:20:15.0592 5672        HTTP - ok
22:20:15.0592 5672        hwdatacard - ok
22:20:15.0592 5672        hwpolicy - ok
22:20:15.0608 5672        i8042prt - ok
22:20:15.0608 5672        iaStor - ok
22:20:15.0608 5672        IAStorDataMgrSvc - ok
22:20:15.0608 5672        iaStorV - ok
22:20:15.0608 5672        idsvc - ok
22:20:15.0623 5672        iirsp - ok
22:20:15.0623 5672        IKEEXT - ok
22:20:15.0623 5672        Impcd - ok
22:20:15.0623 5672        IntcAzAudAddService - ok
22:20:15.0639 5672        intelide - ok
22:20:15.0639 5672        intelppm - ok
22:20:15.0639 5672        IPBusEnum - ok
22:20:15.0639 5672        IpFilterDriver - ok
22:20:15.0639 5672        iphlpsvc - ok
22:20:15.0655 5672        IPMIDRV - ok
22:20:15.0655 5672        IPNAT - ok
22:20:15.0655 5672        iPod Service - ok
22:20:15.0655 5672        IRENUM - ok
22:20:15.0655 5672        isapnp - ok
22:20:15.0670 5672        iScsiPrt - ok
22:20:15.0670 5672        kbdclass - ok
22:20:15.0670 5672        kbdhid - ok
22:20:15.0670 5672        KeyIso - ok
22:20:15.0670 5672        KSecDD - ok
22:20:15.0686 5672        KSecPkg - ok
22:20:15.0686 5672        ksthunk - ok
22:20:15.0686 5672        KtmRm - ok
22:20:15.0686 5672        LanmanServer - ok
22:20:15.0686 5672        LanmanWorkstation - ok
22:20:15.0701 5672        lirsgt - ok
22:20:15.0701 5672        lltdio - ok
22:20:15.0701 5672        lltdsvc - ok
22:20:15.0717 5672        lmhosts - ok
22:20:15.0717 5672        LMS - ok
22:20:15.0717 5672        LSI_FC - ok
22:20:15.0717 5672        LSI_SAS - ok
22:20:15.0733 5672        LSI_SAS2 - ok
22:20:15.0733 5672        LSI_SCSI - ok
22:20:15.0733 5672        luafv - ok
22:20:15.0733 5672        massfilter - ok
22:20:15.0748 5672        MBAMProtector - ok
22:20:15.0748 5672        MBAMService - ok
22:20:15.0748 5672        Mcx2Svc - ok
22:20:15.0748 5672        megasas - ok
22:20:15.0764 5672        MegaSR - ok
22:20:15.0764 5672        Microsoft Office Groove Audit Service - ok
22:20:15.0764 5672        MMCSS - ok
22:20:15.0764 5672        Modem - ok
22:20:15.0764 5672        monitor - ok
22:20:15.0779 5672        mouclass - ok
22:20:15.0779 5672        mouhid - ok
22:20:15.0779 5672        mountmgr - ok
22:20:15.0779 5672        MozillaMaintenance - ok
22:20:15.0795 5672        mpio - ok
22:20:15.0795 5672        mpsdrv - ok
22:20:15.0795 5672        MpsSvc - ok
22:20:15.0795 5672        MRxDAV - ok
22:20:15.0795 5672        mrxsmb - ok
22:20:15.0811 5672        mrxsmb10 - ok
22:20:15.0811 5672        mrxsmb20 - ok
22:20:15.0811 5672        msahci - ok
22:20:15.0811 5672        msdsm - ok
22:20:15.0811 5672        MSDTC - ok
22:20:15.0826 5672        Msfs - ok
22:20:15.0826 5672        mshidkmdf - ok
22:20:15.0826 5672        msisadrv - ok
22:20:15.0826 5672        MSiSCSI - ok
22:20:15.0842 5672        msiserver - ok
22:20:15.0842 5672        MSKSSRV - ok
22:20:15.0842 5672        MSPCLOCK - ok
22:20:15.0842 5672        MSPQM - ok
22:20:15.0842 5672        MsRPC - ok
22:20:15.0857 5672        mssmbios - ok
22:20:15.0857 5672        MSTEE - ok
22:20:15.0857 5672        MTConfig - ok
22:20:15.0857 5672        Mup - ok
22:20:15.0857 5672        napagent - ok
22:20:15.0873 5672        NativeWifiP - ok
22:20:15.0873 5672        NDIS - ok
22:20:15.0873 5672        NdisCap - ok
22:20:15.0873 5672        NdisTapi - ok
22:20:15.0873 5672        Ndisuio - ok
22:20:15.0889 5672        NdisWan - ok
22:20:15.0889 5672        NDProxy - ok
22:20:15.0889 5672        Net Driver HPZ12 - ok
22:20:15.0904 5672        Netaapl - ok
22:20:15.0904 5672        NetBIOS - ok
22:20:15.0904 5672        NetBT - ok
22:20:15.0904 5672        Netlogon - ok
22:20:15.0904 5672        Netman - ok
22:20:15.0920 5672        NetMsmqActivator - ok
22:20:15.0920 5672        NetPipeActivator - ok
22:20:15.0920 5672        netprofm - ok
22:20:15.0920 5672        NetTcpActivator - ok
22:20:15.0920 5672        NetTcpPortSharing - ok
22:20:15.0935 5672        NETw5s64 - ok
22:20:15.0935 5672        nfrd960 - ok
22:20:15.0935 5672        NlaSvc - ok
22:20:15.0935 5672        Npfs - ok
22:20:15.0951 5672        nsi - ok
22:20:15.0951 5672        nsiproxy - ok
22:20:15.0951 5672        Ntfs - ok
22:20:15.0951 5672        Null - ok
22:20:15.0951 5672        NVHDA - ok
22:20:15.0967 5672        nvlddmkm - ok
22:20:15.0967 5672        nvraid - ok
22:20:15.0967 5672        nvstor - ok
22:20:15.0967 5672        nvsvc - ok
22:20:15.0982 5672        nv_agp - ok
22:20:15.0982 5672        odserv - ok
22:20:15.0982 5672        ohci1394 - ok
22:20:15.0982 5672        ose - ok
22:20:15.0982 5672        p2pimsvc - ok
22:20:15.0998 5672        p2psvc - ok
22:20:15.0998 5672        Parport - ok
22:20:15.0998 5672        partmgr - ok
22:20:15.0998 5672        PcaSvc - ok
22:20:15.0998 5672        pci - ok
22:20:16.0013 5672        pciide - ok
22:20:16.0013 5672        pcmcia - ok
22:20:16.0013 5672        pcw - ok
22:20:16.0013 5672        PEAUTH - ok
22:20:16.0013 5672        PeerDistSvc - ok
22:20:16.0029 5672        PerfHost - ok
22:20:16.0029 5672        pla - ok
22:20:16.0029 5672        PlugPlay - ok
22:20:16.0045 5672        Pml Driver HPZ12 - ok
22:20:16.0045 5672        PNRPAutoReg - ok
22:20:16.0045 5672        PNRPsvc - ok
22:20:16.0045 5672        Point64 - ok
22:20:16.0060 5672        PolicyAgent - ok
22:20:16.0060 5672        postgresql-8.4 - ok
22:20:16.0060 5672        Power - ok
22:20:16.0060 5672        PptpMiniport - ok
22:20:16.0076 5672        Processor - ok
22:20:16.0076 5672        ProfSvc - ok
22:20:16.0076 5672        ProtectedStorage - ok
22:20:16.0076 5672        Psched - ok
22:20:16.0076 5672        qcfiltersny2k - ok
22:20:16.0091 5672        qcombussny - ok
22:20:16.0091 5672        qcusbnetsny2k - ok
22:20:16.0091 5672        qcusbsersny2k - ok
22:20:16.0091 5672        QDLService2kSony - ok
22:20:16.0091 5672        ql2300 - ok
22:20:16.0107 5672        ql40xx - ok
22:20:16.0107 5672        QWAVE - ok
22:20:16.0107 5672        QWAVEdrv - ok
22:20:16.0107 5672        RasAcd - ok
22:20:16.0107 5672        RasAgileVpn - ok
22:20:16.0123 5672        RasAuto - ok
22:20:16.0123 5672        Rasl2tp - ok
22:20:16.0123 5672        RasMan - ok
22:20:16.0123 5672        RasPppoe - ok
22:20:16.0123 5672        RasSstp - ok
22:20:16.0138 5672        rdbss - ok
22:20:16.0138 5672        rdpbus - ok
22:20:16.0138 5672        RDPCDD - ok
22:20:16.0138 5672        RDPDR - ok
22:20:16.0154 5672        RDPENCDD - ok
22:20:16.0154 5672        RDPREFMP - ok
22:20:16.0154 5672        RDPWD - ok
22:20:16.0154 5672        rdyboost - ok
22:20:16.0154 5672        RegSrvc - ok
22:20:16.0169 5672        RemoteAccess - ok
22:20:16.0169 5672        RemoteRegistry - ok
22:20:16.0169 5672        RFCOMM - ok
22:20:16.0169 5672        rimspci - ok
22:20:16.0169 5672        risdsnpe - ok
22:20:16.0185 5672        RpcEptMapper - ok
22:20:16.0185 5672        RpcLocator - ok
22:20:16.0185 5672        RpcSs - ok
22:20:16.0185 5672        rspndr - ok
22:20:16.0185 5672        s3cap - ok
22:20:16.0201 5672        SamSs - ok
22:20:16.0201 5672        sbp2port - ok
22:20:16.0201 5672        SCardSvr - ok
22:20:16.0201 5672        scfilter - ok
22:20:16.0216 5672        Schedule - ok
22:20:16.0216 5672        SCPolicySvc - ok
22:20:16.0216 5672        sdbus - ok
22:20:16.0216 5672        SDRSVC - ok
22:20:16.0216 5672        secdrv - ok
22:20:16.0232 5672        seclogon - ok
22:20:16.0232 5672        SENS - ok
22:20:16.0232 5672        SensrSvc - ok
22:20:16.0232 5672        Serenum - ok
22:20:16.0232 5672        Serial - ok
22:20:16.0247 5672        sermouse - ok
22:20:16.0247 5672        SessionEnv - ok
22:20:16.0247 5672        SFEP - ok
22:20:16.0247 5672        sffdisk - ok
22:20:16.0263 5672        sffp_mmc - ok
22:20:16.0263 5672        sffp_sd - ok
22:20:16.0263 5672        sfloppy - ok
22:20:16.0263 5672        SharedAccess - ok
22:20:16.0263 5672        ShellHWDetection - ok
22:20:16.0279 5672        SiSRaid2 - ok
22:20:16.0279 5672        SiSRaid4 - ok
22:20:16.0279 5672        SkypeUpdate - ok
22:20:16.0279 5672        Smb - ok
22:20:16.0294 5672        SNMPTRAP - ok
22:20:16.0294 5672        spldr - ok
22:20:16.0294 5672        Spooler - ok
22:20:16.0294 5672        sppsvc - ok
22:20:16.0294 5672        sppuinotify - ok
22:20:16.0310 5672        srv - ok
22:20:16.0310 5672        srv2 - ok
22:20:16.0310 5672        srvnet - ok
22:20:16.0310 5672        SSDPSRV - ok
22:20:16.0310 5672        SstpSvc - ok
22:20:16.0325 5672        Steam Client Service - ok
22:20:16.0325 5672        stexstor - ok
22:20:16.0325 5672        StillCam - ok
22:20:16.0325 5672        stisvc - ok
22:20:16.0341 5672        storflt - ok
22:20:16.0341 5672        StorSvc - ok
22:20:16.0341 5672        storvsc - ok
22:20:16.0341 5672        swenum - ok
22:20:16.0341 5672        swprv - ok
22:20:16.0357 5672        SysMain - ok
22:20:16.0357 5672        TabletInputService - ok
22:20:16.0357 5672        tap0901 - ok
22:20:16.0357 5672        TapiSrv - ok
22:20:16.0357 5672        TBS - ok
22:20:16.0372 5672        Tcpip - ok
22:20:16.0372 5672        TCPIP6 - ok
22:20:16.0372 5672        tcpipreg - ok
22:20:16.0372 5672        TDPIPE - ok
22:20:16.0388 5672        TDTCP - ok
22:20:16.0388 5672        tdx - ok
22:20:16.0388 5672        TeamViewer6 - ok
22:20:16.0388 5672        TermDD - ok
22:20:16.0403 5672        TermService - ok
22:20:16.0403 5672        Themes - ok
22:20:16.0403 5672        THREADORDER - ok
22:20:16.0403 5672        TPM - ok
22:20:16.0419 5672        TrkWks - ok
22:20:16.0419 5672        truecrypt - ok
22:20:16.0419 5672        TrustedInstaller - ok
22:20:16.0419 5672        tssecsrv - ok
22:20:16.0435 5672        TsUsbFlt - ok
22:20:16.0435 5672        tunnel - ok
22:20:16.0435 5672        uagp35 - ok
22:20:16.0435 5672        udfs - ok
22:20:16.0450 5672        UI0Detect - ok
22:20:16.0450 5672        uliagpkx - ok
22:20:16.0450 5672        umbus - ok
22:20:16.0450 5672        UmPass - ok
22:20:16.0450 5672        UmRdpService - ok
22:20:16.0466 5672        UNS - ok
22:20:16.0466 5672        upnphost - ok
22:20:16.0466 5672        USBAAPL64 - ok
22:20:16.0466 5672        usbaudio - ok
22:20:16.0481 5672        usbccgp - ok
22:20:16.0481 5672        usbcir - ok
22:20:16.0481 5672        usbehci - ok
22:20:16.0481 5672        usbhub - ok
22:20:16.0481 5672        usbohci - ok
22:20:16.0497 5672        usbprint - ok
22:20:16.0497 5672        usbscan - ok
22:20:16.0497 5672        USBSTOR - ok
22:20:16.0497 5672        usbuhci - ok
22:20:16.0497 5672        usbvideo - ok
22:20:16.0513 5672        UxSms - ok
22:20:16.0513 5672        VAIO Event Service - ok
22:20:16.0513 5672        VAIO Power Management - ok
22:20:16.0513 5672        VaultSvc - ok
22:20:16.0513 5672        VCService - ok
22:20:16.0528 5672        vdrvroot - ok
22:20:16.0528 5672        vds - ok
22:20:16.0528 5672        vga - ok
22:20:16.0528 5672        VgaSave - ok
22:20:16.0528 5672        vhdmp - ok
22:20:16.0544 5672        viaide - ok
22:20:16.0544 5672        vmbus - ok
22:20:16.0544 5672        VMBusHID - ok
22:20:16.0544 5672        volmgr - ok
22:20:16.0544 5672        volmgrx - ok
22:20:16.0559 5672        volsnap - ok
22:20:16.0559 5672        vsmraid - ok
22:20:16.0559 5672        VSNService - ok
22:20:16.0559 5672        VSS - ok
22:20:16.0559 5672        VUAgent - ok
22:20:16.0575 5672        vwifibus - ok
22:20:16.0575 5672        vwififlt - ok
22:20:16.0575 5672        vwifimp - ok
22:20:16.0575 5672        W32Time - ok
22:20:16.0591 5672        WacomPen - ok
22:20:16.0591 5672        WANARP - ok
22:20:16.0591 5672        Wanarpv6 - ok
22:20:16.0591 5672        WatAdminSvc - ok
22:20:16.0591 5672        wbengine - ok
22:20:16.0606 5672        WbioSrvc - ok
22:20:16.0606 5672        wcncsvc - ok
22:20:16.0606 5672        WcsPlugInService - ok
22:20:16.0606 5672        Wd - ok
22:20:16.0606 5672        Wdf01000 - ok
22:20:16.0622 5672        WdiServiceHost - ok
22:20:16.0622 5672        WdiSystemHost - ok
22:20:16.0622 5672        WebClient - ok
22:20:16.0622 5672        Wecsvc - ok
22:20:16.0622 5672        wercplsupport - ok
22:20:16.0637 5672        WerSvc - ok
22:20:16.0637 5672        WfpLwf - ok
22:20:16.0637 5672        WIMMount - ok
22:20:16.0637 5672        WinDefend - ok
22:20:16.0653 5672        WinHttpAutoProxySvc - ok
22:20:16.0653 5672        Winmgmt - ok
22:20:16.0653 5672        WinRM - ok
22:20:16.0653 5672        WinUsb - ok
22:20:16.0669 5672        Wlansvc - ok
22:20:16.0669 5672        WmiAcpi - ok
22:20:16.0669 5672        wmiApSrv - ok
22:20:16.0669 5672        WMPNetworkSvc - ok
22:20:16.0684 5672        WPCSvc - ok
22:20:16.0684 5672        WPDBusEnum - ok
22:20:16.0684 5672        ws2ifsl - ok
22:20:16.0684 5672        wscsvc - ok
22:20:16.0684 5672        WSearch - ok
22:20:16.0700 5672        wuauserv - ok
22:20:16.0700 5672        WudfPf - ok
22:20:16.0700 5672        WUDFRd - ok
22:20:16.0700 5672        wudfsvc - ok
22:20:16.0700 5672        WwanSvc - ok
22:20:16.0715 5672        ZTEusbmdm6k - ok
22:20:16.0715 5672        ZTEusbnmea - ok
22:20:16.0715 5672        ZTEusbser6k - ok
22:20:16.0731 5672        MBR (0x1B8)    (9c58313c5dda6d94904a3d60ad87b6bb) \Device\Harddisk0\DR0
22:20:16.0965 5672        \Device\Harddisk0\DR0 - ok
22:20:16.0965 5672        Boot (0x1200)  (55bdeec1821354ec2fcfa704d677a74f) \Device\Harddisk0\DR0\Partition0
22:20:16.0965 5672        \Device\Harddisk0\DR0\Partition0 - ok
22:20:16.0965 5672        Boot (0x1200)  (51c913004fe5b829d5db81ad31ec7a47) \Device\Harddisk0\DR0\Partition1
22:20:16.0965 5672        \Device\Harddisk0\DR0\Partition1 - ok
22:20:16.0965 5672        ============================================================
22:20:16.0965 5672        Scan finished
22:20:16.0965 5672        ============================================================
22:20:16.0965 1092        Detected object count: 0
22:20:16.0965 1092        Actual detected object count: 0

cosinus 15.06.2012 14:02
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

mkid76 15.06.2012 14:56
Hi Arne,

Combo Fix wurde durchgeführt und folgendes Logfile gespeichert. Vielen Dank nochmal für Deine Mühe!

Lg,
Mario

Code:
ComboFix 12-06-15.02 - *** 15.06.2012  15:30:45.1.4 - x64
Microsoft Windows 7 Professional  6.1.7601.1.1252.49.1031.18.3766.2197 [GMT 2:00]
ausgeführt von:: c:\users\***\Desktop\ComboFix.exe
AV: F-Secure Client Security 9.01 *Disabled/Updated* {15414183-282E-D62C-CA37-EF24860A2F17}
FW: F-Secure Client Security 9.01 *Disabled* {2D7AC0A6-6241-D774-E168-461178D9686C}
SP: F-Secure Client Security 9.01 *Disabled/Updated* {AE20A067-0E14-D9A2-F087-D456FD8D65AA}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\***\AppData\Roaming\Local
c:\users\***\AppData\Roaming\Local\Temp\DDM\Settings\0.ddi
c:\users\***\AppData\Roaming\Local\Temp\DDM\Settings\Inception_Trailer_592.divx.ddr
c:\users\***\AppData\Roaming\Local\Temp\DDM\Settings\settings.ddi
c:\users\***\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\Inception_Trailer_592.divx
c:\windows\system32\drivers\etc\hosts.ics
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-05-15 bis 2012-06-15  ))))))))))))))))))))))))))))))
.
.
2012-06-15 13:35 . 2012-06-15 13:35        --------        d-----w-        c:\users\postgres\AppData\Local\temp
2012-06-15 13:35 . 2012-06-15 13:35        --------        d-----w-        c:\users\postgres.m-***\AppData\Local\temp
2012-06-15 13:35 . 2012-06-15 13:35        --------        d-----w-        c:\users\Default\AppData\Local\temp
2012-06-14 11:59 . 2012-06-14 11:59        --------        d-----w-        C:\_OTL
2012-06-13 23:15 . 2012-04-26 05:41        149504        ----a-w-        c:\windows\system32\rdpcorekmts.dll
2012-06-13 23:15 . 2012-05-01 05:40        209920        ----a-w-        c:\windows\system32\profsvc.dll
2012-06-13 23:15 . 2012-04-26 05:41        77312        ----a-w-        c:\windows\system32\rdpwsx.dll
2012-06-13 23:15 . 2012-04-26 05:34        9216        ----a-w-        c:\windows\system32\rdrmemptylst.exe
2012-06-13 23:15 . 2012-05-04 11:06        5559664        ----a-w-        c:\windows\system32\ntoskrnl.exe
2012-06-13 23:15 . 2012-05-04 10:03        3968368        ----a-w-        c:\windows\SysWow64\ntkrnlpa.exe
2012-06-13 23:15 . 2012-05-04 10:03        3913072        ----a-w-        c:\windows\SysWow64\ntoskrnl.exe
2012-06-13 23:13 . 2012-05-15 01:32        3146752        ----a-w-        c:\windows\system32\win32k.sys
2012-06-13 23:13 . 2012-04-28 03:55        210944        ----a-w-        c:\windows\system32\drivers\rdpwd.sys
2012-06-13 23:13 . 2012-04-07 12:31        3216384        ----a-w-        c:\windows\system32\msi.dll
2012-06-13 23:13 . 2012-04-07 11:26        2342400        ----a-w-        c:\windows\SysWow64\msi.dll
2012-06-13 23:13 . 2012-04-24 05:37        1462272        ----a-w-        c:\windows\system32\crypt32.dll
2012-06-13 23:13 . 2012-04-24 04:36        1158656        ----a-w-        c:\windows\SysWow64\crypt32.dll
2012-06-13 23:13 . 2012-04-24 05:37        184320        ----a-w-        c:\windows\system32\cryptsvc.dll
2012-06-13 23:13 . 2012-04-24 05:37        140288        ----a-w-        c:\windows\system32\cryptnet.dll
2012-06-13 23:13 . 2012-04-24 04:36        140288        ----a-w-        c:\windows\SysWow64\cryptsvc.dll
2012-06-13 23:13 . 2012-04-24 04:36        103936        ----a-w-        c:\windows\SysWow64\cryptnet.dll
2012-06-11 18:34 . 2012-06-11 18:34        --------        d-----w-        c:\program files (x86)\ESET
2012-06-11 18:17 . 2012-06-11 18:17        --------        d-----w-        c:\program files (x86)\Mozilla Maintenance Service
2012-06-10 05:15 . 2012-06-11 00:53        69000        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{E71BB62F-0D52-4A0F-9881-4BD116551309}\offreg.dll
2012-06-08 16:33 . 2012-05-08 17:02        8955792        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{E71BB62F-0D52-4A0F-9881-4BD116551309}\mpengine.dll
2012-06-07 23:27 . 2012-06-07 23:27        --------        d-----w-        c:\users\***\AppData\Roaming\Malwarebytes
2012-06-07 23:27 . 2012-06-07 23:27        --------        d-----w-        c:\programdata\Malwarebytes
2012-06-07 23:27 . 2012-06-07 23:27        --------        d-----w-        c:\program files (x86)\Malwarebytes' Anti-Malware
2012-06-07 23:27 . 2012-04-04 13:56        24904        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-06-06 21:55 . 2012-06-06 22:00        --------        d-----w-        c:\users\***\AppData\Local\Deployment
2012-06-06 21:55 . 2012-06-06 21:55        --------        d-----w-        c:\users\***\AppData\Local\Apps
2012-06-01 04:32 . 2012-06-01 04:32        163048        ----a-w-        c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10141.bin
2012-05-29 13:41 . 2012-05-29 13:43        --------        d-----w-        c:\users\***\AppData\Local\Equilab
2012-05-29 13:41 . 2012-05-29 13:41        --------        d-----w-        c:\program files (x86)\PokerStrategy.com
2012-05-29 13:40 . 2012-05-29 13:40        --------        d-----w-        c:\users\***\AppData\Local\Downloaded Installations
2012-05-27 13:15 . 2012-05-27 13:29        --------        d-----w-        c:\users\***\AppData\Roaming\PacificPoker
2012-05-27 13:15 . 2012-05-27 13:15        --------        d-----w-        c:\program files (x86)\PacificPoker
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-09 12:14 . 2012-05-09 12:14        55960        ----a-w-        c:\windows\system32\drivers\fsbts.sys
2012-05-04 01:39 . 2012-05-04 01:39        418464        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe
2012-05-04 01:39 . 2011-07-27 23:58        70304        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-03-30 11:35 . 2012-05-13 14:24        1918320        ----a-w-        c:\windows\system32\drivers\tcpip.sys
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TrueCrypt"="c:\program files\TrueCrypt\TrueCrypt.exe" [2010-11-24 1496528]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"F-Secure Manager"="c:\program files (x86)\F-Secure\Common\FSM32.EXE" [2010-03-26 301744]
"F-Secure TNB"="c:\program files (x86)\F-Secure\FSGUI\TNBUtil.exe" [2010-03-26 1653424]
"HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"AppleSyncNotifier"="c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-12-14 47904]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-04-14 421160]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [2009-5-21 275768]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages        REG_MULTI_SZ          scecli c:\program files\Protector Suite\psqlpwd.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-02-29 158856]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-04 253088]
R3 btwampfl;Bluetooth AMP USB Filter;c:\windows\system32\drivers\btwampfl.sys [x]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x]
R3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\DRIVERS\dc3d.sys [x]
R3 massfilter;Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [x]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-06-01 113120]
R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl64.sys [x]
R3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
R3 VCService;VCService;c:\program files\Sony\VAIO Care\VCService.exe [2011-02-14 44736]
R3 VUAgent;VUAgent;c:\program files\Sony\VAIO Update Common\VUAgent.exe [2012-01-13 1256040]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S0 fsbts;fsbts;c:\windows\system32\Drivers\fsbts.sys [2012-05-09 55960]
S1 F-Secure HIPS;F-Secure HIPS Driver;c:\program files (x86)\F-Secure\HIPS\drivers\fshs.sys [2010-03-26 58000]
S1 FSES;F-Secure Email Scanning Driver;c:\windows\system32\drivers\fses.sys [x]
S1 FSFW;F-Secure Firewall Driver;c:\windows\system32\drivers\fsdfw.sys [x]
S1 fsvista;F-Secure Vista Support Driver;c:\program files (x86)\F-Secure\Anti-Virus\minifilter\fsvista.sys [2010-03-26 14904]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-03-04 13336]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-04-04 654408]
S2 postgresql-8.4;PostgreSQL Server 8.4;C:/Program Files (x86)/PostgreSQL/8.4/bin/pg_ctl.exe runservice -N postgresql-8.4 -D C:/Program Files (x86)/PostgreSQL/8.4/data -w [x]
S2 QDLService2kSony;Qualcomm Gobi 2000 Download Service (Sony);c:\program files (x86)\QUALCOMM\QDLService2k\QDLService2kSony.exe [2010-06-03 332024]
S2 rimspci;rimspci;c:\windows\system32\drivers\rimssne64.sys [x]
S2 risdsnpe;risdsnpe;c:\windows\system32\drivers\risdsne64.sys [x]
S2 SampleCollector;VAIO Care Performance Service;c:\program files\Sony\VAIO Care\VCPerfService.exe [2011-01-29 259192]
S2 TeamViewer6;TeamViewer 6;c:\program files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2011-04-15 2280312]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-02-23 2320920]
S2 VAIO Power Management;VAIO Power Management;c:\program files\Sony\VAIO Power Management\SPMService.exe [2010-06-21 575856]
S2 VSNService;VSNService;c:\program files\Sony\VAIO Smart Network\VSNService.exe [2010-08-11 845312]
S3 e1kexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\DRIVERS\e1k62x64.sys [x]
S3 F-Secure Gatekeeper;F-Secure Gatekeeper;c:\program files (x86)\F-Secure\Anti-Virus\minifilter\fsgk.sys [2012-05-29 199848]
S3 FSORSPClient;F-Secure ORSP Client;c:\program files (x86)\F-Secure\ORSP Client\fsorsp.exe [2011-05-23 61088]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\drivers\HECIx64.sys [x]
S3 Impcd;Impcd;c:\windows\system32\drivers\Impcd.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
S3 NETw5s64;Intel(R) Wireless WiFi Link der Serie 5000 Adaptertreiber für Windows 7 64-Bit;c:\windows\system32\DRIVERS\NETw5s64.sys [x]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [x]
S3 qcfiltersny2k;Qualcomm Gobi 2000 USB Composite Device Filter 9225;c:\windows\system32\DRIVERS\qcfiltersny2k.sys [x]
S3 qcombussny;Gobi 2000 USB Composite Device Driver(05C6-9225);c:\windows\system32\DRIVERS\qcombussny.sys [x]
S3 qcusbnetsny2k;Gobi 2000 USB-NDIS miniport(05C6-9225);c:\windows\system32\DRIVERS\qcusbnetsny2k.sys [x]
S3 qcusbsersny2k;Gobi 2000 USB Device for Legacy Serial Communication(05C6-9225);c:\windows\system32\DRIVERS\qcusbserSny2k.sys [x]
S3 SFEP;Sony Firmware Extension Parser;c:\windows\system32\DRIVERS\SFEP.sys [x]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt        REG_MULTI_SZ          hpqcxs08 hpqddsvc
.
Inhalt des "geplante Tasks" Ordners
.
2012-06-15 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-04 01:39]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlay]
@="{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}"
[HKEY_CLASSES_ROOT\CLSID\{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}]
2010-04-27 13:48        5947656        ----a-w-        c:\program files\Protector Suite\farchns.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlayOpen]
@="{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}"
[HKEY_CLASSES_ROOT\CLSID\{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}]
2010-04-27 13:48        5947656        ----a-w-        c:\program files\Protector Suite\farchns.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Logitech Download Assistant"="c:\windows\system32\rundll32.exe" [2009-07-14 45568]
"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2011-04-13 1860496]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2011-04-13 2399632]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://vshare.toolbarhome.com/?hp=df
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local;<local>
IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: {{90EAE591-7E7E-434a-8E28-ECFD00071806} - c:\program files (x86)\PokerStars.FR\PokerStarsUpdate.exe
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\***\AppData\Roaming\Mozilla\Firefox\Profiles\471wfo9m.default\
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
AddRemove-Convert XLS_is1 - c:\program files (x86)\Softinterface
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\postgresql-8.4]
"ImagePath"="C:/Program Files (x86)/PostgreSQL/8.4/bin/pg_ctl.exe runservice -N \"postgresql-8.4\" -D \"C:/Program Files (x86)/PostgreSQL/8.4/data\" -w"
--
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SampleCollector]
"ImagePath"="\"c:\program files\Sony\VAIO Care\VCPerfService.exe\" \"/service\" \"/sstates\" \"/sampleinterval=5000\" \"/procinterval=5\" \"/dllinterval=120\" \"/counter=\Processor(_Total)\% Processor Time:1/counter=\PhysicalDisk(_Total)\Disk Bytes/sec:1\" \"/counter=\Network Interface(*)\Bytes Total/sec:1\" \"/expandcounter=\Processor Information(*)\Processor Frequency:1\" \"/expandcounter=\Processor(*)\% Idle Time:1\" \"/expandcounter=\Processor(*)\% C1 Time:1\" \"/expandcounter=\Processor(*)\% C2 Time:1\" \"/expandcounter=\Processor(*)\% C3 Time:1\" \"/expandcounter=\Processor(*)\% Processor Time:1\" \"/directory=c:\programdata\Sony Corporation\VAIO Care\inteldata\""
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\postgresql-8.4]
"ImagePath"="C:/Program Files (x86)/PostgreSQL/8.4/bin/pg_ctl.exe runservice -N \"postgresql-8.4\" -D \"C:/Program Files (x86)/PostgreSQL/8.4/data\" -w"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10e.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10e.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
  00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\RNG*]
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
  bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
  bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
  bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
  bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
  bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
  bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
  bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
  bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
  bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
  bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
  bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Bonjour\mDNSResponder.exe
c:\program files (x86)\F-Secure\Anti-Virus\fsgk32st.exe
c:\program files (x86)\F-Secure\Anti-Virus\FSGK32.EXE
c:\program files (x86)\F-Secure\Common\FSMA32.EXE
c:\program files (x86)\F-Secure\Common\FSHDLL32.EXE
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
c:\program files (x86)\PostgreSQL\8.4\bin\pg_ctl.exe
c:\program files (x86)\PostgreSQL\8.4\bin\postgres.exe
c:\program files (x86)\Sony\VAIO Event Service\VESMgr.exe
c:\program files (x86)\PostgreSQL\8.4\bin\postgres.exe
c:\program files (x86)\PostgreSQL\8.4\bin\postgres.exe
c:\program files (x86)\PostgreSQL\8.4\bin\postgres.exe
c:\program files (x86)\PostgreSQL\8.4\bin\postgres.exe
c:\program files (x86)\PostgreSQL\8.4\bin\postgres.exe
c:\windows\SysWOW64\DllHost.exe
c:\program files (x86)\Sony\VAIO Event Service\VESMgrSub.exe
c:\program files (x86)\F-Secure\Common\FNRB32.EXE
c:\program files (x86)\F-Secure\Common\FIH32.EXE
c:\program files (x86)\F-Secure\Anti-Virus\fssm32.exe
c:\program files (x86)\F-Secure\Anti-Virus\fsav32.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-06-15  15:41:41 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2012-06-15 13:41
.
Vor Suchlauf: 17 Verzeichnis(se), 31.363.178.496 Bytes frei
Nach Suchlauf: 21 Verzeichnis(se), 30.913.597.440 Bytes frei
.
- - End Of File - - D6FFA2E464F8C7F60CDE1884E9E3067F

cosinus 15.06.2012 15:29
Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe - (aswMBR.exe Anleitung)
    Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
    Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS-Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).



Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

mkid76 15.06.2012 16:37
Hi Arne,

hier die gewünschten Logs:

Code:
GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-06-15 17:21:13
Windows 6.1.7601 Service Pack 1
Running: s9qu6kus.exe


---- Registry - GMER 1.0.15 ----

Reg  HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\506313dbb8cf                     
Reg  HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\c0cb38d528be                     
Reg  HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\506313dbb8cf (not active ControlSet) 
Reg  HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\c0cb38d528be (not active ControlSet) 

---- EOF - GMER 1.0.15 ----

Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 17:32:56 on 15.06.2012

OS: Windows 7  Service Pack 1 (Build 7601), 64-bit
Default Browser: Mozilla Corporation Firefox 13.0

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Common]
-----( %SystemRoot%\Tasks )-----
"Adobe Flash Player Updater.job" - "Adobe Systems Incorporated" - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"nvcpl.cpl" - "NVIDIA Corporation" - C:\Windows\system32\nvcpl.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"mlcfg32.cpl" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~1\Office12\MLCFG32.CPL
"QuickTime" - "Apple Inc." - C:\Program Files (x86)\QuickTime\QTSystem\QuickTime.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"atksgt" (atksgt) - ? - C:\Windows\System32\DRIVERS\atksgt.sys  (File found, but it contains no detailed information)
"catchme" (catchme) - ? - C:\ComboFix\catchme.sys  (File not found)
"F-Secure Email Scanning Driver" (FSES) - "F-Secure Corporation" - C:\Windows\System32\drivers\fses.sys
"F-Secure Firewall Driver" (FSFW) - "F-Secure Corporation" - C:\Windows\System32\drivers\fsdfw.sys
"F-Secure Gatekeeper" (F-Secure Gatekeeper) - "F-Secure Corporation" - C:\Program Files (x86)\F-Secure\Anti-Virus\minifilter\fsgk.sys
"F-Secure HIPS Driver" (F-Secure HIPS) - "F-Secure Corporation" - C:\Program Files (x86)\F-Secure\HIPS\drivers\fshs.sys
"F-Secure Vista Support Driver" (fsvista) - "F-Secure Corporation" - C:\Program Files (x86)\F-Secure\Anti-Virus\minifilter\fsvista.sys
"fsbts" (fsbts) - "F-Secure Corporation" - C:\Windows\System32\Drivers\fsbts.sys
"lirsgt" (lirsgt) - ? - C:\Windows\System32\DRIVERS\lirsgt.sys  (File found, but it contains no detailed information)
"Mass Storage Filter Driver" (massfilter) - ? - C:\Windows\System32\drivers\massfilter.sys  (File not found)
"MBAMProtector" (MBAMProtector) - "Malwarebytes Corporation" - C:\Windows\system32\drivers\mbam.sys
"truecrypt" (truecrypt) - "TrueCrypt Foundation" - C:\Windows\System32\drivers\truecrypt.sys
"ZTE Diagnostic Port" (ZTEusbser6k) - ? - C:\Windows\System32\DRIVERS\ZTEusbser6k.sys  (File not found)
"ZTE NMEA Port" (ZTEusbnmea) - ? - C:\Windows\System32\DRIVERS\ZTEusbnmea.sys  (File not found)
"ZTE Proprietary USB Driver" (ZTEusbmdm6k) - ? - C:\Windows\System32\DRIVERS\ZTEusbmdm6k.sys  (File not found)

[Explorer]
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\Help\hxds.dll
{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
{88FED34C-F0CA-4636-A375-3CB6248B04CD} "Local Groove Web Services Protocol" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
{91774881-D725-4E58-B298-07617B9B86A8} "Skype IE add-on Pluggable Protocol" - "Skype Technologies S.A." - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----
{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{99FD978C-D287-4F50-827F-B2C658EDA8E7} "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} "Groove Explorer Icon Overlay 2 (GFS Stub)" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
{920E6DB1-9907-4370-B3A0-BAFC03D81399} "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
{16F3DD56-1AF5-4347-846D-7C10C4192619} "Groove Explorer Icon Overlay 3 (GFS Folder)" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
{2916C86E-86A6-43FE-8112-43ABE6BF8DCC} "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
{2A541AE1-5BF6-4665-A8A3-CFA9672E4291} "Groove Folder Synchronization" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
{6C467336-8281-4E60-8204-430CED96822D} "Groove GFS Context Menu Handler" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
{A449600E-1DC6-4232-B948-9BD794D62056} "Groove GFS Stub Icon Handler" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
{387E725D-DC16-4D76-B310-2C93ED4752A0} "Groove XML Icon Handler" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\msohevi.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~1\Office12\ONFILTER.DLL
{00020D75-0000-0000-C000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~1\Office12\MLSHEXT.DLL
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~1\Office12\OLKFSTUB.DLL
{8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} "Snagit" - "TechSmith Corporation" - C:\Program Files (x86)\TechSmith\Snagit 10\SnagitIEAddin.dll
{CF74B903-3389-469c-B3B6-0204D204FCBD} "SnagItShellExt Class" - "TechSmith Corporation" - C:\Program Files (x86)\TechSmith\Snagit 10\SnagitShellExt.dll

[Internet Explorer]
-----( HKCU\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars )-----
{555D4D79-4BD2-4094-A395-CFC534424A05} "HP Smart Web Printing" - "Hewlett-Packard Co." - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_bho.dll
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
ITBar7Height "ITBar7Height" - ? -  (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? -  (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_23" - "Sun Microsystems, Inc." - C:\Program Files (x86)\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} "Java Plug-in 1.6.0_23" - "Sun Microsystems, Inc." - C:\Program Files (x86)\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_23" - "Sun Microsystems, Inc." - C:\Program Files (x86)\Java\jre6\bin\npjpi160_23.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{BC0E0A5D-AB5A-4fa4-A5FA-280E1D58EEEE} "Add to Evernote" - "Evernote Corporation" - C:\Program Files (x86)\Evernote\Evernote3.5\enbar.dll
{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
{DDE87865-83C5-48c4-8357-2F5B1AA84522} "HP Smart Web Printing ein- oder ausblenden" - "Hewlett-Packard Co." - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
"PokerStars" - "PokerStars" - C:\Program Files (x86)\PokerStars\PokerStarsUpdate.exe
"PokerStars.fr" - "PokerStars" - C:\Program Files (x86)\PokerStars.FR\PokerStarsUpdate.exe
"PokerStars.net" - "PokerStars" - C:\Program Files (x86)\PokerStars.NET\PokerStarsUpdate.exe
{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
{898EA8C8-E7FF-479B-8935-AEC46303B9E5} "Skype Click to Call" - "Skype Technologies S.A." - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
{265EEE8E-3228-44D3-AEA5-F7FDF5860049} "Browsing Protection Toolbar" - "F-Secure Corporation" - C:\Program Files (x86)\F-Secure\NRS\iescript\baselitmus.dll
{8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} "Snagit" - "TechSmith Corporation" - C:\Program Files (x86)\TechSmith\Snagit 10\SnagitIEAddin.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
{C6867EB7-8350-4856-877F-93CF8AE3DC9C} "Browsing Protection Class" - "F-Secure Corporation" - C:\Program Files (x86)\F-Secure\NRS\iescript\baselitmus.dll
{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
{0347C33E-8762-4905-BF09-768834316C61} "HP Print Enhancer" - "Hewlett-Packard Co." - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
{FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} "HP Smart BHO Class" - "Hewlett-Packard Co." - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} "Skype Browser Helper" - "Skype Technologies S.A." - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
{00C6482D-C502-44C8-8409-FCE54AD9C208} "SnagIt Toolbar Loader" - "TechSmith Corporation" - C:\Program Files (x86)\TechSmith\Snagit 10\SnagitBHO.dll

[LSA Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Lsa )-----
"Notification packages" - "UPEK Inc." - C:\Program Files\Protector Suite\psqlpwd.dll

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
"HP Digital Imaging Monitor.lnk" - "Hewlett-Packard Co." - C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe  (Shortcut exists | File exists)
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"TrueCrypt" - "TrueCrypt Foundation" - "C:\Program Files\TrueCrypt\TrueCrypt.exe" /q preferences /a logon
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"Adobe ARM" - "Adobe Systems Incorporated" - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"AppleSyncNotifier" - "Apple Inc." - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
"F-Secure Manager" - "F-Secure Corporation" - "C:\Program Files (x86)\F-Secure\Common\FSM32.EXE" /splash
"F-Secure TNB" - "F-Secure Corporation" - "C:\Program Files (x86)\F-Secure\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
"GrooveMonitor" - "Microsoft Corporation" - "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
"HP Software Update" - "Hewlett-Packard" - C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
"iTunesHelper" - "Apple Inc." - "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
"Malwarebytes' Anti-Malware" - "Malwarebytes Corporation" - "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"@%ProgramFiles%\Windows Defender\MsMpRes.dll,-103" (WinDefend) - ? - C:\Program Files (x86)\Windows Defender\mpsvc.dll  (File not found)
"@%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101" (WMPNetworkSvc) - ? - "C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe"  (File not found)
"Adobe Acrobat Update Service" (AdobeARMservice) - "Adobe Systems Incorporated" - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
"Adobe Flash Player Update Service" (AdobeFlashPlayerUpdateSvc) - "Adobe Systems Incorporated" - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
"ArcSoft Connect Daemon" (ACDaemon) - "ArcSoft Inc." - C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
"ASP.NET-Zustandsdienst" (aspnet_state) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
"Bluetooth Service" (btwdins) - "Broadcom Corporation." - C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
"Dienst "Bonjour"" (Bonjour Service) - "Apple Inc." - C:\Program Files (x86)\Bonjour\mDNSResponder.exe
"F-Secure Anti-Virus Firewall Daemon" (FSDFWD) - "F-Secure Corporation" - C:\Program Files (x86)\F-Secure\FWES\Program\fsdfwd.exe
"F-Secure Management Agent" (FSMA) - "F-Secure Corporation" - C:\Program Files (x86)\F-Secure\Common\FSMA32.EXE
"F-Secure Netzwerk-Anfragebroker" (F-Secure Network Request Broker) - "F-Secure Corporation" - C:\Program Files (x86)\F-Secure\Common\FNRB32.EXE
"F-Secure ORSP Client" (FSORSPClient) - "F-Secure Corporation" - C:\Program Files (x86)\F-Secure\ORSP Client\fsorsp.exe
"FSGKHS" (F-Secure Gatekeeper Handler Starter) - "F-Secure Corporation" - C:\Program Files (x86)\F-Secure\Anti-Virus\fsgk32st.exe
"HP CUE DeviceDiscovery Service" (hpqddsvc) - "Hewlett-Packard Co." - C:\Program Files (x86)\HP\Digital Imaging\bin\hpqddsvc.dll
"HP Network Devices Support" (HPSLPSVC) - "Hewlett-Packard Co." - C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL
"hpqcxs08" (hpqcxs08) - "Hewlett-Packard Co." - C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll
"Intel(R) Management & Security Application User Notification Service" (UNS) - "Intel Corporation" - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
"Intel(R) Management and Security Application Local Management Service" (LMS) - "Intel Corporation" - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
"Intel(R) PROSet/Wireless Event Log" (EvtEng) - "Intel(R) Corporation" - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
"Intel(R) PROSet/Wireless Registry Service" (RegSrvc) - "Intel(R) Corporation" - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
"Intel(R) Rapid Storage Technology" (IAStorDataMgrSvc) - "Intel Corporation" - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Program Files\iPod\bin\iPodService.exe
"MBAMService" (MBAMService) - "Malwarebytes Corporation" - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
"Microsoft .NET Framework NGEN v4.0.30319_X64" (clr_optimization_v4.0.30319_64) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
"Microsoft Office Groove Audit Service" (Microsoft Office Groove Audit Service) - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe
"Mozilla Maintenance Service" (MozillaMaintenance) - "Mozilla Foundation" - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"Net Driver HPZ12" (Net Driver HPZ12) - "Hewlett-Packard" - C:\Windows\system32\HPZinw12.dll
"NVIDIA Display Driver Service" (nvsvc) - "NVIDIA Corporation" - C:\Windows\system32\nvvsvc.exe
"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"Pml Driver HPZ12" (Pml Driver HPZ12) - "Hewlett-Packard" - C:\Windows\system32\HPZipm12.dll
"PostgreSQL Server 8.4" (postgresql-8.4) - "PostgreSQL Global Development Group" - C:\Program Files (x86)\PostgreSQL\8.4\bin\pg_ctl.exe
"Qualcomm Gobi 2000 Download Service (Sony)" (QDLService2kSony) - "QUALCOMM, Inc." - C:\Program Files (x86)\QUALCOMM\QDLService2k\QDLService2kSony.exe
"Skype Updater" (SkypeUpdate) - "Skype Technologies" - C:\Program Files (x86)\Skype\Updater\Updater.exe
"Steam Client Service" (Steam Client Service) - "Valve Corporation" - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
"TeamViewer 6" (TeamViewer6) - "TeamViewer GmbH" - C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe
"VAIO Care Performance Service" (SampleCollector) - "Sony Corporation" - C:\Program Files\Sony\VAIO Care\VCPerfService.exe
"VAIO Event Service" (VAIO Event Service) - "Sony Corporation" - C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe
"VAIO Power Management" (VAIO Power Management) - "Sony Corporation" - C:\Program Files\Sony\VAIO Power Management\SPMService.exe
"VCService" (VCService) - "Sony Corporation" - C:\Program Files\Sony\VAIO Care\VCService.exe
"VSNService" (VSNService) - "Sony Corporation" - C:\Program Files\Sony\VAIO Smart Network\VSNService.exe
"VUAgent" (VUAgent) - "Sony Corporation" - C:\Program Files\Sony\VAIO Update Common\VUAgent.exe

[Winsock Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----
"mdnsNSP" - "Apple Inc." - C:\Program Files (x86)\Bonjour\mdnsNSP.dll

===[ Logfile end ]=========================================[ Logfile end ]===

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

cosinus 15.06.2012 17:32
aswMBR kommt noch?

mkid76 15.06.2012 19:28
Hi Arne,

und hier der letzte Log. Hat leider etwas länger gedauert, da die Verbindung (4KB/s) momentam extrem suckt. Ich hoffe es hat alles geklappt...

danke und lg
mario

Code:
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-06-15 20:12:11
-----------------------------
20:12:11.855    OS Version: Windows x64 6.1.7601 Service Pack 1
20:12:11.855    Number of processors: 4 586 0x2505
20:12:11.855    ComputerName: M-***  UserName: ***
20:12:12.058    Initialize success
20:20:25.189    AVAST engine defs: 12061500
20:22:14.003    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
20:22:14.003    Disk 0 Vendor: Intel___ 1.0. Size: 122110MB BusType: 8
20:22:14.003    Disk 0 MBR read successfully
20:22:14.019    Disk 0 MBR scan
20:22:14.050    Disk 0 unknown MBR code
20:22:14.050    Disk 0 Partition 1 00    27 Hidden NTFS WinRE OA$µÙq~v    8169 MB offset 2048
20:22:14.066    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS              100 MB offset 16732160
20:22:14.081    Disk 0 Partition 3 00    07    HPFS/NTFS            113839 MB offset 16936960
20:22:14.081    Disk 0 scanning C:\Windows\system32\drivers
20:22:14.097    Service scanning
20:22:30.914    Modules scanning
20:22:30.914    Disk 0 trace - called modules:
20:22:30.914    ntoskrnl.exe CLASSPNP.SYS disk.sys iaStor.sys
20:22:31.428    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa80067fb060]
20:22:31.428    3 CLASSPNP.SYS[fffff8800180143f] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa80047f1050]
20:22:31.616    AVAST engine scan C:\Windows
20:22:31.631    AVAST engine scan C:\Windows\system32
20:22:31.631    AVAST engine scan C:\Windows\system32\drivers
20:22:31.631    AVAST engine scan C:\Users\***
20:22:31.647    AVAST engine scan C:\ProgramData
20:22:31.647    Scan finished successfully
20:22:52.613    Disk 0 MBR has been saved successfully to "C:\Users\***\Desktop\MBR.dat"
20:22:52.613    The log file has been saved successfully to "C:\Users\***\Desktop\aswMBR.txt"

cosinus 15.06.2012 20:33
Wir sollten den MBR fixen, sichere für den Fall der Fälle ALLE wichtigen Daten, auch wenn meistens alles glatt geht.

Hinweis: Mach bitte NICHT den MBR-Fix, wenn du noch andere Betriebssysteme wie zB Ubuntu installiert hast, ein MBR-Fix mit Windows-Tools macht ein parallel installiertes (Dualboot) Linux unbootbar.
Mach den Fix auch dann nicht, wenn du zB mit TrueCrypt oder anderen Verschlüsselungsprogrammen eine Vollverschlüsselung der Windowspartition bzw. gesamten Festplatte hast

Starte nach der Datensicherung aswmbr erneut und klick auf den Button FIXMBR.

Hinweis: Bitte den Virenscanner abstellen bevor du aswMBR ausführst, denn v.a. Avira meldet darin oft einen Fehalalrm!

Anschließend Windows neu starten und ein neues Log mit aswMBR machen.

mkid76 15.06.2012 20:49
Hi Arne,

ich hab TrueCrypt laufen! Also werde ich diesen Schritt unterlassen?!

Lg,
Mario

cosinus 15.06.2012 21:19
Ja wäre besser. Wenn du deine ganze Platte verschlüsselt hast bzw. die Systempartition.
Oder was anderes?

mkid76 15.06.2012 21:22
also ich hab die ganze Platte verschlüsselt, bzw. der Systemadmin von meiner alten Firma. Ich durfte den Laptop behalten und hab Truecrypt immer noch drauf.

lg mario

cosinus 15.06.2012 21:26
Kurz gesagt, du bist garnicht Herr über dein System :confused:
Naja musst du wissen

Musst auch bedenken, dass so ein Rechner aus der Firma evtl. noch für den privaten Bereich sehr störende Einstellungen hat, die er noch aus der Firmendomäne bekommen hat. Das macht man nicht mal eben so rückgängig.

mkid76 15.06.2012 22:46
Hi Arne,

musste damals Truecrypt installieren, weil es die Firma so wollte und hab es nach meinem Abgang so belassen. Ansonsten bin ich schon Herr über mein System. Mehr oder weniger...naja jetzt ja eben nicht mehr. Geht es jetzt noch weiter oder meinst du ich soll das System neu aufsetzen, wenn ich wieder in Deutschland bin?

Vielen Dank für deine Hilfe bisher!

Lg,
Mario

cosinus 15.06.2012 22:55
Na ich mein ja nur. Falls das Gerät mal in der Domäne der Firma war. Einfach nur aus der Domäne rausnehmen hilft da nicht, wenn per Gruppenrichtlinien bestimmte Dinge gesetzt wurden müssen diese auch wieder explizit rausgenommen werden. Das passiert natürlich nicht wenn man den Rechner von A nach B trägt und ihn einfach als privat definiert. :D

Aber lassen wir das. :)

Wir sollten fast durch sein. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!


Alle Zeitangaben in WEZ +1. Es ist jetzt 20:08 Uhr.
Seite 2 von 3 1 2 3
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131