Trojaner-Board - Bitte um Kontrolle meines LogFiles wegen Verdacht auf Virus befall

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Bitte um Kontrolle meines LogFiles wegen Verdacht auf Virus befall (https://www.trojaner-board.de/75759-bitte-um-kontrolle-meines-logfiles-wegen-verdacht-virus-befall.html)

Bitte um Kontrolle meines LogFiles wegen Verdacht auf Virus befall

Hallo,

In letzter Zeit passieren Merkwürdige dinge mit meinem System so das ich den Verdacht habe es könnten sich einige schädlinge eingenistet haben.

Als ich heute morgen meine Festplatte bereinigen wollte kamm eine Meldung mit "Teile Ihres Betriebssystem wurden ersetzt...das kann zu problemen führen usw." Ich solle Windows CD einlegen usw.

Und beim Surfen gehen Seiten die sich vor ein paar minuten ganz normal geöffnet haben nicht mehr "Link is broken".

Ich weiss nicht, sieht es euch mal bitte an.

Code:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 21:16:09, on 25.07.2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16791)

Boot mode: Normal
 

Running processes:

C:\WINXP\System32\smss.exe

C:\WINXP\system32\winlogon.exe

C:\WINXP\system32\services.exe

C:\WINXP\system32\lsass.exe

C:\WINXP\system32\Ati2evxx.exe

C:\WINXP\system32\svchost.exe

C:\WINXP\System32\svchost.exe

C:\WINXP\system32\Ati2evxx.exe

C:\WINXP\system32\ZoneLabs\vsmon.exe

C:\WINXP\Explorer.EXE

C:\WINXP\system32\spoolsv.exe

C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Programme\Bonjour\mDNSResponder.exe

C:\Programme\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe

C:\Programme\Java\jre6\bin\jqs.exe

C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe

C:\Programme\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe

C:\Programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe

C:\Programme\Nero\Nero8\Nero BackItUp\NBService.exe

C:\Programme\CDBurnerXP\NMSAccessU.exe

C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe

C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe

C:\WINXP\system32\IoctlSvc.exe

C:\WINXP\system32\svchost.exe

C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe

C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe

C:\WINXP\system32\wbem\wmiapsrv.exe

C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe

C:\Programme\Java\jre6\bin\jusched.exe

C:\WINXP\system32\ctfmon.exe

C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Programme\Microsoft ActiveSync\Wcescomm.exe

C:\PROGRA~1\MICROS~3\rapimgr.exe

C:\WINXP\System32\svchost.exe

C:\Dokumente und Einstellungen\XXX\Eigene Dateien\Software\HiJackThis\HiJackThis.exe
 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://www.google.de/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h**p://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINXP\pchealth\helpctr\System\panels\blank.htm

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINXP\pchealth\helpctr\System\panels\blank.htm

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll

O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Programme\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll

O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll

O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe"

O4 - HKLM\..\Run: [MSConfig] C:\WINXP\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINXP\system32\ctfmon.exe

O4 - HKCU\..\Run: [swg] "C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Programme\Microsoft ActiveSync\Wcescomm.exe"

O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'LOKALER DIENST')

O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'NETZWERKDIENST')

O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')

O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll

O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll

O9 - Extra 'Tools' menuitem: Mobilen Favoriten erstellen... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINXP\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINXP\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINXP\system32\shdocvw.dll

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINXP\system32\shdocvw.dll

O13 - DefaultPrefix: h**p://www.myhottersearchbox.com/not_found_de/?url=

O13 - WWW Prefix: h**p://www.myhottersearchbox.com/not_found_de/?url=

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - h**p://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1226073950328

O16 - DPF: {65EEE2E1-B8D5-4724-8489-048B551045BF} (PPI Chipcard-Browser-Plugin) - h**ps://karte.seb-bank.de/gei/plugins/SEBChipcardPlugin1210.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - h**p://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O18 - Protocol: haufereader - (no CLSID) - (no file)

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINXP\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINXP\system32\ati2sgag.exe

O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Programme\Bonjour\mDNSResponder.exe

O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe

O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Programme\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Programme\Uninstall Information\iPod\bin\iPodService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe

O23 - Service: LVCOMSer - Logitech Inc. - C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe

O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe

O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Programme\Nero\Nero8\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Programme\Gemeinsame Dateien\Nero\Lib\NMIndexingService.exe

O23 - Service: NMSAccessU - Unknown owner - C:\Programme\CDBurnerXP\NMSAccessU.exe

O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe

O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe

O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINXP\system32\IoctlSvc.exe

O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINXP\system32\ZoneLabs\vsmon.exe
 

--

End of file - 8755 bytes

Hallo volldrauf:)

Du hast eventuell Schädling auf deinem Rechner;)

- Die Anweisungen bitte gründlich lesen und immer streng einhalten, da ich die Reihenfolge nach bestimmten Kriterien vorbereitet habe:

1.
Lade Dir Malwarebytes Anti-Malware von→ malwarebytes.org

Installieren und per Doppelklick starten.
Deutsch einstellen und gleich mal die Datenbanken zu aktualisieren - online updaten
"Komplett Scan durchführen" wählen (überall Haken setzen)
wenn der Scanvorgang beendet ist, klicke auf "Zeige Resultate"
alle Funde markieren und auf "Löschen" - "Ausgewähltes entfernen") klicken.
Poste das Ergebnis hier in den Thread - den Bericht findest Du unter "Scan-Berichte"

eine bebilderte Anleitung findest Du hier: Malwarebytes Anti-Malware

2.
poste erneut:
Trend Micro HijackThis-Logfile

3.
ich brauche mehr `Übersicht` bzw Daten über einen längeren Zeitraum - dazu bitte Versteckte - und Systemdateien sichtbar machen::
→ Klicke unter Start auf Arbeitsplatz.
→ Klicke im Menü Extras auf Ordneroptionen.
→ Dateien und Ordner/Erweiterungen bei bekannten Dateitypen ausblenden → Haken entfernen
→ Geschützte und Systemdateien ausblenden → Haken entfernen
→ Versteckte Dateien und Ordner/Alle Dateien und Ordner anzeigen → Haken setzen.
→ Bei "Geschützte Systemdateien ausblenden" darf kein Häkchen sein und "Alle Dateien und Ordner anzeigen" muss aktiviert sein.

4.
Für XP und Win2000 (ansonsten auslassen)
→ lade Dir das filelist.zip auf deinen Desktop herunter
→ entpacke die Zip-Datei auf deinen Desktop
→ starte nun mit einem Doppelklick auf die Datei "filelist.bat" - Dein Editor (Textverarbeitungsprogramm) wird sich öffnen
→ kopiere aus die erzeugten Logfile alle 7 Verzeichnisse ("C\...") usw - aber nur die Einträge der letzten 6 Monate - hier in deinem Thread
** vor jedem Eintrag steht ein Datum, also Einträge, die älter als 6 Monate sind bitte herauslöschen!

5.
Ich würde gerne noch all deine installierten Programme sehen:
Lade dir das Tool ccleaner herunter
installieren ("Füge CCleaner Yahoo! Toolbar hinzu" abwählen)→ starten→ unter Options settings-> "german" einstellen
dann klick auf "Extra (um die installierten Programme auch anzuzeigen)→ weiter auf "Als Textdatei speichern..."
wird eine Textdatei (*.txt) erstellt, kopiere dazu den Inhalt und füge ihn da ein

Damit dein Thread übersichtlicher und schön lesbar bleibt, am besten nutze den Code-Tags für deinen Post:
→ vor dein log schreibst du:[code]
hier kommt dein logfile rein
→ dahinter:[/code]

gruß
Coverflow

Ganz schön viel arbeit, aber habs doch gepackt...

Hier der HiJack Log File mit den ordner änderungen

Code:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 17:11:10, on 26.07.2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16791)

Boot mode: Normal
 

Running processes:

C:\WINXP\System32\smss.exe

C:\WINXP\system32\winlogon.exe

C:\WINXP\system32\services.exe

C:\WINXP\system32\lsass.exe

C:\WINXP\system32\Ati2evxx.exe

C:\WINXP\system32\svchost.exe

C:\WINXP\System32\svchost.exe

C:\WINXP\system32\Ati2evxx.exe

C:\WINXP\system32\ZoneLabs\vsmon.exe

C:\WINXP\Explorer.EXE

C:\WINXP\system32\spoolsv.exe

C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Programme\Bonjour\mDNSResponder.exe

C:\Programme\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe

C:\Programme\Java\jre6\bin\jqs.exe

C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe

C:\Programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe

C:\Programme\Nero\Nero8\Nero BackItUp\NBService.exe

C:\Programme\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe

C:\Programme\CDBurnerXP\NMSAccessU.exe

C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe

C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe

C:\WINXP\system32\IoctlSvc.exe

C:\WINXP\system32\svchost.exe

C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe

C:\WINXP\system32\wbem\wmiapsrv.exe

C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe

C:\WINXP\system32\wscntfy.exe

C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe

C:\Programme\Java\jre6\bin\jusched.exe

C:\WINXP\system32\ctfmon.exe

C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Programme\Microsoft ActiveSync\Wcescomm.exe

C:\PROGRA~1\MICROS~3\rapimgr.exe

C:\WINXP\System32\svchost.exe

C:\Dokumente und Einstellungen\XXX\Eigene Dateien\Software\HiJackThis\HiJackThis.exe
 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://www.google.de/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h**p://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINXP\pchealth\helpctr\System\panels\blank.htm

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINXP\pchealth\helpctr\System\panels\blank.htm

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll

O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Programme\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll

O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll

O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe"

O4 - HKLM\..\Run: [MSConfig] C:\WINXP\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINXP\system32\ctfmon.exe

O4 - HKCU\..\Run: [swg] "C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Programme\Microsoft ActiveSync\Wcescomm.exe"

O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'LOKALER DIENST')

O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'NETZWERKDIENST')

O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')

O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll

O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll

O9 - Extra 'Tools' menuitem: Mobilen Favoriten erstellen... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINXP\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINXP\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINXP\system32\shdocvw.dll

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINXP\system32\shdocvw.dll

O13 - DefaultPrefix: h**p://www.myhottersearchbox.com/not_found_de/?url=

O13 - WWW Prefix: h**p://www.myhottersearchbox.com/not_found_de/?url=

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - h**p://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1226073950328

O16 - DPF: {65EEE2E1-B8D5-4724-8489-048B551045BF} (PPI Chipcard-Browser-Plugin) - h**ps://karte.seb-bank.de/gei/plugins/SEBChipcardPlugin1210.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - h**p://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O18 - Protocol: haufereader - (no CLSID) - (no file)

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINXP\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINXP\system32\ati2sgag.exe

O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Programme\Bonjour\mDNSResponder.exe

O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe

O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Programme\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Programme\Uninstall Information\iPod\bin\iPodService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe

O23 - Service: LVCOMSer - Logitech Inc. - C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe

O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe

O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Programme\Nero\Nero8\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Programme\Gemeinsame Dateien\Nero\Lib\NMIndexingService.exe

O23 - Service: NMSAccessU - Unknown owner - C:\Programme\CDBurnerXP\NMSAccessU.exe

O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe

O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe

O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINXP\system32\IoctlSvc.exe

O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINXP\system32\ZoneLabs\vsmon.exe
 

--

End of file - 8786 bytes

...und der Scan bericht von Malwarebytes.

Das programm hat mehr als 20 Viren gefunden:eek:.

Code:

Malwarebytes' Anti-Malware 1.39

Datenbank Version: 2504

Windows 5.1.2600 Service Pack 3
 

26.07.2009 16:53:17

mbam-log-2009-07-26 (16-53-17).txt
 

Scan-Methode: Vollständiger Scan (C:\|)

Durchsuchte Objekte: 135787

Laufzeit: 38 minute(s), 17 second(s)
 

Infizierte Speicherprozesse: 0

Infizierte Speichermodule: 0

Infizierte Registrierungsschlüssel: 1

Infizierte Registrierungswerte: 0

Infizierte Dateiobjekte der Registrierung: 3

Infizierte Verzeichnisse: 4

Infizierte Dateien: 14
 

Infizierte Speicherprozesse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{d032570a-5f63-4812-a094-87d007c23012} (Trojan.BHO) -> Quarantined and deleted successfully.
 

Infizierte Registrierungswerte:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
 

Infizierte Verzeichnisse:

C:\Dokumente und Einstellungen\XXX\Anwendungsdaten\Privacy components (Rogue.PrivacyComponents) -> Quarantined and deleted successfully.

c:\dokumente und einstellungen\XXX\anwendungsdaten\privacy components\dbases (Rogue.PrivacyComponents) -> Quarantined and deleted successfully.

c:\dokumente und einstellungen\XXX\anwendungsdaten\privacy components\keys (Rogue.PrivacyComponents) -> Quarantined and deleted successfully.

c:\dokumente und einstellungen\XXX\anwendungsdaten\privacy components\temp (Rogue.PrivacyComponents) -> Quarantined and deleted successfully.
 

Infizierte Dateien:

c:\WINXP\system32\softwares.dll (Trojan.Bot) -> Quarantined and deleted successfully.

c:\WINXP\system32\stray.dll (Trojan.Bot) -> Quarantined and deleted successfully.

c:\WINXP\system32\uinput.dll (Trojan.Bot) -> Quarantined and deleted successfully.

c:\dokumente und einstellungen\XXX\anwendungsdaten\privacy components\dbases\cg.dat (Rogue.PrivacyComponents) -> Quarantined and deleted successfully.

c:\dokumente und einstellungen\XXX\anwendungsdaten\privacy components\dbases\mw.dat (Rogue.PrivacyComponents) -> Quarantined and deleted successfully.

c:\dokumente und einstellungen\XXX\anwendungsdaten\privacy components\dbases\rd.dat (Rogue.PrivacyComponents) -> Quarantined and deleted successfully.

c:\dokumente und einstellungen\XXX\anwendungsdaten\privacy components\dbases\sc.dat (Rogue.PrivacyComponents) -> Quarantined and deleted successfully.

c:\dokumente und einstellungen\XXX\anwendungsdaten\privacy components\dbases\sm.dat (Rogue.PrivacyComponents) -> Quarantined and deleted successfully.

c:\dokumente und einstellungen\XXX\anwendungsdaten\privacy components\dbases\sp.dat (Rogue.PrivacyComponents) -> Quarantined and deleted successfully.

c:\dokumente und einstellungen\XXX\anwendungsdaten\privacy components\keys\cg.key (Rogue.PrivacyComponents) -> Quarantined and deleted successfully.

c:\dokumente und einstellungen\XXX\anwendungsdaten\privacy components\keys\rd.key (Rogue.PrivacyComponents) -> Quarantined and deleted successfully.

c:\dokumente und einstellungen\XXX\anwendungsdaten\privacy components\keys\sc.key (Rogue.PrivacyComponents) -> Quarantined and deleted successfully.

c:\dokumente und einstellungen\XXX\anwendungsdaten\privacy components\keys\sp.key (Rogue.PrivacyComponents) -> Quarantined and deleted successfully.

c:\dokumente und einstellungen\XXX\anwendungsdaten\privacy components\temp\settings.ini (Rogue.PrivacyComponents) -> Quarantined and deleted successfully.

Ich hoffe das hat was gebracht:)

Hat nicht reingepasst...FileList.:)

Code:

----- Root ----------------------------- 

 Volume in Laufwerk C: hat keine Bezeichnung.

 Volumeseriennummer: 1829-BF73
 

 Verzeichnis von C:\
 

26.07.2009  17:04                43 filelist.txt

26.07.2009  16:55     1.610.612.736 pagefile.sys

26.07.2009  13:39             1.892 rollback.ini

23.07.2009  16:16               232 boot.ini

06.07.2009  17:50           191.506 wialog.txt

18.06.2009  19:05             2.046 ASLog.txt
 

----- Windows -------------------------- 

 Volume in Laufwerk C: hat keine Bezeichnung.

 Volumeseriennummer: 1829-BF73
 

 Verzeichnis von C:\WINXP
 

26.07.2009  16:57                 0 0.log

26.07.2009  16:57               159 wiadebug.log

26.07.2009  16:57                50 wiaservc.log

26.07.2009  16:57         1.353.640 WindowsUpdate.log

26.07.2009  16:55             2.048 bootstat.dat

26.07.2009  16:54            32.644 SchedLgU.Txt

26.07.2009  16:02            48.541 wmsetup.log

25.07.2009  21:43           213.844 setupact.log

25.07.2009  14:17                69 NeroDigital.ini

24.07.2009  13:27           374.566 setupapi.log

23.07.2009  16:16               227 system.ini

23.07.2009  16:16               507 win.ini

12.07.2009  16:49                 0 setuperr.log

08.07.2009  12:54           139.588 ntbtlog.txt

06.07.2009  17:45               432 BRWMARK.INI

02.07.2009  11:07             2.438 regopt.log

13.06.2009  10:35               208 GSdx9.INI

13.06.2009  10:30               203 GSdx9 sse2.INI

24.04.2009  21:14             3.898 spupdsvc.log

24.04.2009  21:14               187 spupdsvc.log.1.log

24.04.2009  21:06           119.717 comsetup.log

24.04.2009  21:06            74.978 ntdtcsetup.log

24.04.2009  21:06            55.192 KB959426.log

24.04.2009  21:06            18.689 ocmsn.log

24.04.2009  21:06           162.756 tsoc.log

24.04.2009  21:06            15.869 tabletoc.log

24.04.2009  21:06             1.374 imsins.log

24.04.2009  21:06           460.936 iis6.log

24.04.2009  21:06            24.398 MedCtrOC.log

24.04.2009  21:06            57.866 netfxocm.log

24.04.2009  21:06           214.345 ocgen.log

24.04.2009  21:06            17.064 msgsocm.log

24.04.2009  21:06           323.321 FaxSetup.log

24.04.2009  21:06           125.138 msmqinst.log

24.04.2009  21:06            16.779 updspapi.log

24.04.2009  21:06             1.374 imsins.BAK

24.04.2009  21:06            54.282 KB961373.log

24.04.2009  21:05           100.587 KB963027-IE7.log

24.04.2009  21:05            19.858 KB960225.log

24.04.2009  21:05            17.514 KB956572.log

24.04.2009  21:04            17.099 KB952004.log

24.04.2009  21:04            15.452 KB958690.log

24.04.2009  21:03             8.058 KB959772.log

24.04.2009  21:03            15.269 KB960803.log

24.04.2009  21:03            10.896 KB923561.log

24.04.2009  19:47           320.928 DirectX.log

24.04.2009  19:47             1.786 KB954708.log

19.04.2009  11:40               528 PRESTO.INI

19.03.2009  15:43               104 wiso.ini

18.03.2009  18:32             1.334 KB829558.log

16.03.2009  14:11             9.193 KB955704.log

28.02.2009  02:42             5.387 KB961118.log

28.02.2009  02:34           321.908 ie8_main.log

28.02.2009  02:34            11.391 ie8.log

28.02.2009  02:15            18.812 KB967715.log

28.02.2009  01:52            28.792 WgaNotify.log

28.02.2009  01:07            16.488 KB892130.log

13.02.2009  22:09               315 nsw.log

13.02.2009  20:19               125 hotcore3.log

13.02.2009  20:19               604 uiminstall.log

12.02.2009  02:02            12.133 KB960715.log

12.02.2009  02:01            18.266 KB961260-IE7.log

04.02.2009  18:42            21.056 KB952954.log

04.02.2009  18:42            15.429 KB956803.log

04.02.2009  18:42            34.192 KB955839.log

04.02.2009  18:42            15.014 KB956391.log

04.02.2009  18:42            20.907 KB958215-IE7.log

04.02.2009  18:41            10.575 KB960714-IE7.log

04.02.2009  18:41            14.973 KB950974.log

04.02.2009  18:41             9.363 KB954211.log

04.02.2009  18:41             9.086 KB938127-v2-IE7.log

04.02.2009  18:41            10.284 KB956841.log

04.02.2009  18:41             9.265 KB957097.log

04.02.2009  18:41             9.189 KB958687.log

04.02.2009  18:40             8.895 KB952287.log

04.02.2009  18:40            10.322 KB929399.log

04.02.2009  18:40            10.043 KB939683.log

04.02.2009  18:40             8.874 KB951066.log

04.02.2009  18:40            14.427 KB954459.log

04.02.2009  18:40            14.659 KB952069.log

04.02.2009  18:40             6.716 KB938464.log

04.02.2009  18:40             8.969 KB954600.log

04.02.2009  18:40             9.285 KB958644.log

04.02.2009  18:39             8.785 KB955069.log

04.02.2009  18:39            14.086 KB956802.log

04.02.2009  18:39           315.578 msxml4-KB954430-enu.LOG

04.02.2009  18:39             5.580 KB954154.log

04.02.2009  18:39             9.013 KB936782.log

20.01.2009  21:22            17.156 DPINST.LOG
 

----- System 32 (Achtung: Zeitfenster beachten!) --- 

 Volume in Laufwerk C: hat keine Bezeichnung.

 Volumeseriennummer: 1829-BF73
 

 Verzeichnis von C:\WINXP\system32
 

26.07.2009  16:57             2.206 wpa.dbl

26.07.2009  16:57           360.556 vsconfig.xml

26.07.2009  16:57                 0 _nvidia_xxx_.log

26.07.2009  16:55            44.964 ativvaxx.cap

21.07.2009  21:56                 0 nmp.log

05.07.2009  13:23           121.336 FNTCACHE.DAT

05.07.2009  09:59           148.888 javaws.exe

05.07.2009  09:59            73.728 javacpl.cpl

05.07.2009  09:59           144.792 javaw.exe

05.07.2009  09:59           144.792 java.exe

05.07.2009  09:59           410.984 deploytk.dll

03.07.2009  20:36           502.710 perfh009.dat

03.07.2009  20:36            81.308 perfc009.dat

03.07.2009  20:36           525.756 perfh007.dat

03.07.2009  20:36            96.796 perfc007.dat

03.07.2009  20:36             4.526 PerfStringBackup.TMP

29.06.2009  09:57                34 BD2030.DAT

24.06.2009  11:45            54.624 7eb3.sys

24.06.2009  11:44         2.335.270 9fe2.mht

13.06.2009  20:47            33.723 lvcoinst.log

04.06.2009  16:53         2.335.270 35a34.mht

23.04.2009  23:46               180 test.aok

01.04.2009  19:51         1.215.524 PerfStringBackup.INI

01.04.2009  10:11             4.212 zllictbl.dat

29.03.2009  12:48               188 MsiExec.exe.log

28.02.2009  01:52               140 spupdsvc.inf

20.02.2009  12:21           389.120 html.iec

04.02.2009  18:42           362.622 TZLog.log

03.02.2009  16:21        21.244.864 MRT.exe

16.01.2009  22:01         3.594.752 mshtml.dll

14.01.2009  19:13               129 267340.reg

14.01.2009  19:13               129 293842.reg

14.01.2009  19:00             2.379 mirc.ini

14.01.2009  19:00                48 value.ini

04.01.2009  17:39           187.392 d3d10core.dll

04.01.2009  17:37         1.029.120 d3d10.dll
 

----- Prefetch ------------------------- 

 Volume in Laufwerk C: hat keine Bezeichnung.

 Volumeseriennummer: 1829-BF73
 

 Verzeichnis von C:\WINXP\Prefetch
 

26.07.2009  17:04            37.044 NOTEPAD.EXE-0815DEA3.pf

26.07.2009  17:04           129.138 WINRAR.EXE-31EFFFD3.pf

26.07.2009  17:01            16.244 WMIADAP.EXE-132905C9.pf

26.07.2009  16:58            18.856 VERCLSID.EXE-1C385444.pf

26.07.2009  16:58            94.704 IEXPLORE.EXE-2CA9778D.pf

26.07.2009  16:58            64.558 WUAUCLT.EXE-13B6AD34.pf

26.07.2009  16:57            25.302 GOOGLETOOLBARNOTIFIER.EXE-09E6E9C6.pf

26.07.2009  16:57            14.884 CTFMON.EXE-00681DDA.pf

26.07.2009  16:57            51.688 ZLCLIENT.EXE-0120F620.pf

26.07.2009  16:57            10.398 QTTASK.EXE-2D7EEF34.pf

26.07.2009  16:57            71.534 WMIPRVSE.EXE-2F9046ED.pf

26.07.2009  16:57            49.710 SVCHOST.EXE-064839DA.pf

26.07.2009  16:57         1.099.072 NTOSBOOT-B00DFAAD.pf

26.07.2009  16:54            18.388 LOGONUI.EXE-308706F5.pf

26.07.2009  16:34            74.260 UPDCLIENT.EXE-07EF9AF9.pf

26.07.2009  16:10            20.704 REGSVR32.EXE-2CB1139E.pf

26.07.2009  16:01            39.924 SETUP_WM.EXE-19AC5A9B.pf

26.07.2009  15:48           105.062 WMPLAYER.EXE-09969333.pf

26.07.2009  15:39            25.702 GOOGLEUPDATERSERVICE.EXE-19F5FCF4.pf

26.07.2009  10:30            73.310 USNSVC.EXE-1CEFA315.pf

26.07.2009  10:29            72.742 MSNMSGR.EXE-3ACF7E89.pf

26.07.2009  00:56            80.994 RUNDLL32.EXE-0CA36AED.pf

25.07.2009  18:00            59.726 SCANNINGPROCESS.EXE-3A7FDD83.pf

25.07.2009  17:59            25.928 VSMON.EXE-0E166C2C.pf

25.07.2009  14:13            12.308 RUNDLL32.EXE-3FAF52DE.pf

25.07.2009  13:05            80.842 ACRORD32INFO.EXE-19B1D743.pf

25.07.2009  11:47            81.460 EXPORTCONTROLLER.EXE-2AE60AF2.pf

25.07.2009  11:47            95.076 QUICKTIMEPLAYER.EXE-1683395B.pf

25.07.2009  11:47            32.686 NMINDEXINGSERVICE.EXE-1C758E9B.pf

25.07.2009  11:47           113.752 NMINDEXSTORESVR.EXE-249DD3AC.pf

24.07.2009  14:53           525.720 Layout.ini

24.07.2009  14:36            26.144 DWWIN.EXE-2B5302A0.pf

24.07.2009  14:35            77.638 DUMPREP.EXE-320A42A5.pf

24.07.2009  14:06            77.100 RUNDLL32.EXE-3B9F2C65.pf

24.07.2009  14:00            96.998 FIREFOX.EXE-3A53C5FB.pf

24.07.2009  12:49            34.322 WORDPAD.EXE-1EFCC5C1.pf

24.07.2009  12:45           142.476 MSIEXEC.EXE-0BEEA39E.pf

20.07.2009  20:00            19.028 DLLHOST.EXE-380141C8.pf

20.07.2009  20:00            59.488 SOFTWAREUPDATE.EXE-1E90DF1F.pf

18.07.2009  13:20            75.212 EXPLORER.EXE-0D300D8F.pf

04.07.2009  23:55            20.152 RUNDLL32.EXE-1B7BDCB0.pf

03.07.2009  19:10            66.724 CDBXPP.EXE-2D1BFE11.pf

01.07.2009  20:52            14.274 IPODSERVICE.EXE-20B03513.pf

01.07.2009  20:52            94.828 ITUNES.EXE-15E88941.pf

12.06.2009  11:00            59.476 MANAGER09.EXE-2C8E16A7.pf

10.06.2009  12:21            22.462 LULNCHR.EXE-0048470A.pf

10.06.2009  12:21            19.080 LULNCHR.EXE-33CDCC3A.pf

10.06.2009  12:21            18.750 LOGITECHUPDATE.EXE-18D46509.pf

10.06.2009  12:20            26.446 COCIMANAGER.EXE-2D6000D8.pf

10.06.2009  12:20            33.380 ITUNESHELPER.EXE-08906EB7.pf

10.06.2009  12:20            63.896 QUICKCAM.EXE-07B0F701.pf

10.06.2009  12:20            15.600 NBKEYSCAN.EXE-026FD067.pf

10.06.2009  12:20            10.966 NEROCHECK.EXE-00C15CF5.pf

10.06.2009  12:07            74.772 COMMUNICATIONS_HELPER.EXE-25B96193.pf

04.06.2009  16:57            31.442 RUNDLL32.EXE-2AF667BD.pf

15.05.2009  13:45            36.616 IMAPI.EXE-20F8CDD2.pf

30.04.2009  15:13            29.336 EPSXE.EXE-0521721E.pf

25.04.2009  20:26            58.440 RUNDLL32.EXE-1D9442AE.pf

25.04.2009  20:24            36.684 NEROPATENTACTIVATION.EXE-2B4E8875.pf

25.04.2009  20:20            81.104 NEROVISION.EXE-3AA003CF.pf

24.04.2009  22:05            43.192 WLCOMM.EXE-222494DB.pf

24.04.2009  21:52            10.548 NGEN.EXE-13DF7A17.pf

24.04.2009  21:17            55.284 WLTUSER.EXE-231BB668.pf

24.04.2009  21:15            15.506 IPODSERVICE.EXE-233792DA.pf

24.04.2009  21:05            16.608 INSTALL.EXE-3B86D6B4.pf

24.04.2009  21:05            15.200 UACLAUNCHER.EXE-00041757.pf

24.04.2009  21:05             4.650 MSI13D.TMP-0C18EE75.pf

24.04.2009  21:05            74.238 UPDATE.EXE-00C0ED3D.pf

24.04.2009  21:05            74.004 UPDATE.EXE-3660F584.pf

24.04.2009  21:04             5.706 SPUPDSVC.EXE-1476F501.pf

24.04.2009  21:04            71.934 UPDATE.EXE-20B73D6C.pf

24.04.2009  21:04            71.996 UPDATE.EXE-1A946C9A.pf

24.04.2009  21:04            71.986 UPDATE.EXE-0D999E12.pf

24.04.2009  21:03            19.052 UNREGMP2.EXE-123DF8DE.pf

24.04.2009  21:03            29.008 UPDATE.EXE-2A7CE54E.pf

24.04.2009  21:03            71.756 UPDATE.EXE-37AB7C5A.pf

24.04.2009  21:03            10.970 RUNDLL32.EXE-45AD421A.pf

24.04.2009  21:03            82.704 UPDATE.EXE-063708F1.pf

24.04.2009  21:02           125.210 MSCORSVW.EXE-03E840EB.pf

24.04.2009  20:58            59.938 WLARP.EXE-0359A09C.pf

24.04.2009  20:56            68.180 WLOOBE.EXE-0D1C45BB.pf

24.04.2009  20:55            42.654 WLSETUP-WEB_8064.EXE-3212CD9F.pf

24.04.2009  20:38            74.826 UPDATE.EXE-02005B5D.pf

24.04.2009  20:38            71.740 UPDATE.EXE-1915F10A.pf

24.04.2009  20:38            73.960 UPDATE.EXE-3805A122.pf

24.04.2009  20:37            71.580 UPDATE.EXE-0451CC95.pf

24.04.2009  20:37            71.788 UPDATE.EXE-34D528A7.pf

24.04.2009  20:37            71.988 UPDATE.EXE-07B757FF.pf

24.04.2009  20:37            77.592 UPDATE.EXE-2394A8A1.pf

24.04.2009  20:27            13.090 WLCSTART.EXE-28613604.pf

24.04.2009  20:23            37.926 WLSETUP-CUSTOM[1].EXE-0948D7A3.pf

24.04.2009  20:15            36.772 WLLOGINPROXY.EXE-33926225.pf

24.04.2009  20:12            55.836 INFOCARD.EXE-333AD298.pf

24.04.2009  19:51             9.760 CGUARD.EXE-32B2F82B.pf

24.04.2009  19:49            17.928 INSTALL.EXE-262D53F4.pf

24.04.2009  19:49            16.180 UACLAUNCHER.EXE-16059E70.pf

24.04.2009  19:49            55.260 SILVERLIGHT.2.0.EXE-0186810E.pf

24.04.2009  19:49             3.720 MSIC3.TMP-21EB7AD2.pf

24.04.2009  19:48            16.280 SEAPORT.EXE-2EBAF56A.pf

24.04.2009  19:48            17.206 WINDOWSLIVESYNC.EXE-01C58826.pf

24.04.2009  19:48            32.068 NETSH.EXE-24930E98.pf

24.04.2009  19:48            21.236 TASKKILL.EXE-2BA75342.pf

24.04.2009  19:47             9.664 DXDLLREG.EXE-0C643980.pf

24.04.2009  19:47            14.936 DXSETUP.EXE-073D9757.pf

24.04.2009  19:47            69.268 UPDATE.EXE-1D5889AC.pf

24.04.2009  19:47            47.812 WINDOWSXP-KB954708-X86-ENU.EX-0061C02D.pf

24.04.2009  19:47            49.758 WLSETUPSVC.EXE-150896E6.pf

24.04.2009  19:33            58.994 1G63.EXE-09F9D924.pf

24.04.2009  17:05            57.390 LIVECALL.EXE-2A89F0B5.pf

24.04.2009  17:02            21.790 RAUI.EXE-3A8A6552.pf

24.04.2009  01:05            15.470 RUNDLL32.EXE-1437DB72.pf

24.04.2009  00:59            15.372 RUNDLL32.EXE-26DD0DA1.pf

24.04.2009  00:43            15.564 RUNDLL32.EXE-1BBE9F6D.pf

24.04.2009  00:42            23.394 DIFXINSTALL32.EXE-307FE1E4.pf

24.04.2009  00:41            23.598 ALLOK 3GP PSP MP4 IPOD VIDEO -1714ED87.pf

24.04.2009  00:40            93.736 AVE.EXE-0DD378D1.pf

24.04.2009  00:33            15.472 RUNDLL32.EXE-39E68A1F.pf

24.04.2009  00:29            38.590 DISTNOTED.EXE-39B306B0.pf

24.04.2009  00:29            53.494 APPLEMOBILEDEVICEHELPER.EXE-079D1945.pf

24.04.2009  00:21            16.012 RUNDLL32.EXE-40691BE3.pf

23.04.2009  23:31            17.588 IS-Q27I5.TMP-1CC7F35E.pf

23.04.2009  23:31            16.944 SETUP.EXE-09D1E5A5.pf

23.04.2009  23:03            35.986 W32MKDE.EXE-08AA6696.pf

23.04.2009  23:02            46.526 STEUER2008.EXE-2A0D8989.pf

23.04.2009  21:00            15.588 RUNDLL32.EXE-26A0F2B8.pf

23.04.2009  20:59            15.588 RUNDLL32.EXE-2CBCD193.pf

23.04.2009  20:59            15.588 RUNDLL32.EXE-3721B27E.pf

23.04.2009  19:54            26.892 RUNDLL32.EXE-407BBF86.pf

23.04.2009  19:52            15.722 RUNDLL32.EXE-42331ED3.pf

23.04.2009  18:17            13.980 RUNDLL32.EXE-1FC9231F.pf

             130 Datei(en)      7.392.326 Bytes

               0 Verzeichnis(se), 121.687.150.592 Bytes frei
 

----- Tasks ---------------------------- 

 Volume in Laufwerk C: hat keine Bezeichnung.

 Volumeseriennummer: 1829-BF73
 

 Verzeichnis von C:\WINXP\tasks
 

26.07.2009  16:56                 6 SA.DAT

20.07.2009  20:00               276 AppleSoftwareUpdate.job

14.04.2008  14:00                65 desktop.ini

               3 Datei(en)            347 Bytes

               0 Verzeichnis(se), 121.687.154.688 Bytes frei
 

----- Windows/Temp ----------------------- 

 Volume in Laufwerk C: hat keine Bezeichnung.

 Volumeseriennummer: 1829-BF73
 

 Verzeichnis von C:\WINXP\Temp
 

26.07.2009  16:57             1.703 LVCOMSX.LOG

26.07.2009  16:56            16.384 Perflib_Perfdata_734.dat

26.07.2009  16:56               256 ZLT03a1a.TMP

26.07.2009  16:56               256 ZLT03a16.TMP

26.07.2009  16:56               483 WGAErrLog.txt

26.07.2009  15:38               256 ZLT0161e.TMP

26.07.2009  15:38               256 ZLT07e6d.TMP

26.07.2009  10:17               256 ZLT02489.TMP

26.07.2009  10:17               256 ZLT008b1.TMP

25.07.2009  19:39               256 ZLT06a30.TMP

25.07.2009  19:39               256 ZLT0688e.TMP

              11 Datei(en)         20.618 Bytes

               0 Verzeichnis(se), 121.687.150.592 Bytes frei
 

----- Temp ----------------------------- 

 Volume in Laufwerk C: hat keine Bezeichnung.

 Volumeseriennummer: 1829-BF73
 

 Verzeichnis von C:\DOKUME~1\XXX~1\LOKALE~1\Temp
 

26.07.2009  17:02             1.791 jusched.log

26.07.2009  16:57            16.384 ~DF409F.tmp

26.07.2009  16:57               375 WCESCOMM.LOG

26.07.2009  16:57           152.071 WCESLog.log

26.07.2009  16:29             1.664 wmplog00.sqm

26.07.2009  15:39            16.384 ~DF3C62.tmp

26.07.2009  10:18            16.384 ~DF5BE7.tmp

25.07.2009  19:40            16.384 ~DF4BEF.tmp

               8 Datei(en)        221.437 Bytes

               0 Verzeichnis(se), 121.687.150.592 Bytes frei

hi

Es folgt die Reinigung:

1.
den Quarantäne Ordner überall leeren - Antivirus bzw Anti-Spy-Programm usw
das Malwarebytes deinstallieren

2.
Schliesse alle Programme einschliesslich Internet Explorer und fixe mit Hijackthis die Einträge aus der nachfolgenden Codebox (HijackThis starten→ Einträge auswählen→ Häckhen setzen→ "Fix checked"klicken→ PC neu aufstarten):

Zitat:

O13 - DefaultPrefix: h**p://www.myhottersearchbox.com/not_found_de/?url=
O13 - WWW Prefix: h**p://www.myhottersearchbox.com/not_found_de/?url=

3.
alle Anwendungen schließen → Ordner für temporäre Dateien bitte leeren
lösche nur den Inhalt der Ordner, nicht die Ordner selbst! - Dateien, die noch in Benutzung sind,nicht löschbar.

Start → ausführen "cleanmgr" reinschreiben ohne "" → "ok" - die Temporary Files, Temporary Internet Files, und der Papierkorb (Recycle Bin) muss geleert werden→ "Ok"
[b]Start → ausführen → %temp% reinschreiben ohne ""→ "Ok"
für jedes Benutzerkonto bitte durchführen
anschließend den Papierkorb leeren

4.
reinige dein System mit Ccleaner:

"Cleaner"→ "Analysieren"→ Klick auf den Button "Start CCleaner"
"Registry""Fehler suchen"→ "Fehler beheben"→ "Alle beheben"
Starte dein System neu auf

lade Dir SUPERAntiSpyware FREE Edition herunter.
installiere das Programm und update online.
starte SUPERAntiSpyware und klicke auf "Ihren Computer durchsuchen"
setze ein Häkchen bei "Kompletter Scan" und klicke auf "Weiter"
anschließend alle gefundenen Schadprogramme werden aufgelistet, bei alle Funde Häkchen setzen und mit "OK" bestätigen
auf "Weiter" klicken dann "OK" und auf "Fertig stellen"
um die Ergebnisse anzuzeigen: auf "Präferenzen" dann auf den "Statistiken und Protokolle" klicken
drücke auf "Protokoll anzeigen" - anschließend diesen Bericht bitte speichern und hier posten

6.
Den kompletten Rechner zu überprüfen (Systemprüfung ohne Säuberung) mit Kaspersky Online - Scanner - wähle "My Computer" aus:
im Internet Explorer:
- "Extras→ Internetoptionen→ Sicherheit":
- alles auf Standardstufe stellen
- Active X erlauben
- speichere die Ergebnis als *.txt Datei und poste das Logfile des Scans

Hier der Scan von Super Anti Spyware

Code:

SUPERAntiSpyware Scan Log

http://www.superantispyware.com
 

Generated 07/26/2009 at 10:26 PM
 

Application Version : 4.26.1006
 

Core Rules Database Version : 4020

Trace Rules Database Version: 1960
 

Scan type       : Complete Scan

Total Scan Time : 00:25:06
 

Memory items scanned      : 491

Memory threats detected   : 0

Registry items scanned    : 5953

Registry threats detected : 0

File items scanned        : 12946

File threats detected     : 1
 

Adware.Tracking Cookie

        C:\Dokumente und Einstellungen\XXX\Cookies\XXX@doubleclick[1].txt

Ich wollte noch dazu sagen das nach dem Löschen beim Neustart das System ein CHKDSK durchführen will aber immer genau beim 3 punkt "Sicherheitsprüfung" stürzt der pc einfach ab und wiederholt das ganze wieder, so das ich die prüfung abbrechen muss damit der pc normal startet.

Hat das vielleicht auch damit zutun?

Gibt es bei dem Vorgang eine Meldung bevor der Rechner abstürtzt und neu startet ?

Nein es stürtzt einfach ab.

hi

1.
Lade und installiere das Tool RootRepeal herunter

- setze einen Hacken bei: "Drivers", "Stealth Objects" und "Hidden Services" dann klick auf "OK"
- nach der Scan, klick auf "Save Report"

2.

Lade Dir die MBR.exe von Gmer herunter
Speichere auf deinem Desktop
Per Doppelklick starten.
wenn das Programm fertig ist, das erhaltene Log mbr.log hier posten

3.
Punkt 5. fehlt noch, bitte nachreichen! → http://www.trojaner-board.de/75759-b...tml#post451249

Ich habe das Programm RootRepeal gestartet und da kamm der "Error-invalid PE image found!"

Und da sind keine Häckchen usw.

Punkt 2. und 3. weiter bitte

Ok, hat bisschen gedauert.
Hier der Report von Root Repeal.

Code:

ROOTREPEAL (c) AD, 2007-2009

==================================================

Scan Start Time:                2009/08/01 10:40

Program Version:                Version 1.3.3.0

Windows Version:                Windows XP SP3

==================================================
 

Drivers

-------------------

Name: 1394BUS.SYS

Image Path: C:\WINXP\system32\DRIVERS\1394BUS.SYS

Address: 0xF7497000        Size: 57344        File Visible: -        Signed: -

Status: -
 

Name: ACPI.sys

Image Path: ACPI.sys

Address: 0xF723E000        Size: 188800        File Visible: -        Signed: -

Status: -
 

Name: ACPI_HAL

Image Path: \Driver\ACPI_HAL

Address: 0x804D7000        Size: 2068352        File Visible: -        Signed: -

Status: -
 

Name: AegisP.sys

Image Path: C:\WINXP\system32\DRIVERS\AegisP.sys

Address: 0xED40B000        Size: 18720        File Visible: -        Signed: -

Status: -
 

Name: afd.sys

Image Path: C:\WINXP\System32\drivers\afd.sys

Address: 0xB262F000        Size: 138496        File Visible: -        Signed: -

Status: -
 

Name: arp1394.sys

Image Path: C:\WINXP\system32\DRIVERS\arp1394.sys

Address: 0xEF9CA000        Size: 60800        File Visible: -        Signed: -

Status: -
 

Name: atapi.sys

Image Path: atapi.sys

Address: 0xF71D0000        Size: 98304        File Visible: -        Signed: -

Status: -
 

Name: atapi.sys

Image Path: atapi.sys

Address: 0x00000000        Size: 0        File Visible: -        Signed: -

Status: -
 

Name: ati2cqag.dll

Image Path: C:\WINXP\System32\ati2cqag.dll

Address: 0xBF062000        Size: 561152        File Visible: -        Signed: -

Status: -
 

Name: ati2dvag.dll

Image Path: C:\WINXP\System32\ati2dvag.dll

Address: 0xBF012000        Size: 327680        File Visible: -        Signed: -

Status: -
 

Name: ati2mtag.sys

Image Path: C:\WINXP\system32\DRIVERS\ati2mtag.sys

Address: 0xF5CEF000        Size: 5300224        File Visible: -        Signed: -

Status: -
 

Name: ati3duag.dll

Image Path: C:\WINXP\System32\ati3duag.dll

Address: 0xBF19B000        Size: 4096000        File Visible: -        Signed: -

Status: -
 

Name: atikvmag.dll

Image Path: C:\WINXP\System32\atikvmag.dll

Address: 0xBF0EB000        Size: 446464        File Visible: -        Signed: -

Status: -
 

Name: atiok3x2.dll

Image Path: C:\WINXP\System32\atiok3x2.dll

Address: 0xBF158000        Size: 274432        File Visible: -        Signed: -

Status: -
 

Name: ativvaxx.dll

Image Path: C:\WINXP\System32\ativvaxx.dll

Address: 0xBF583000        Size: 2379776        File Visible: -        Signed: -

Status: -
 

Name: ATMFD.DLL

Image Path: C:\WINXP\System32\ATMFD.DLL

Address: 0xBFFA0000        Size: 286720        File Visible: -        Signed: -

Status: -
 

Name: audstub.sys

Image Path: C:\WINXP\system32\DRIVERS\audstub.sys

Address: 0xF7ADC000        Size: 3072        File Visible: -        Signed: -

Status: -
 

Name: Beep.SYS

Image Path: C:\WINXP\System32\Drivers\Beep.SYS

Address: 0xF7A4D000        Size: 4224        File Visible: -        Signed: -

Status: -
 

Name: BOOTVID.dll

Image Path: C:\WINXP\system32\BOOTVID.dll

Address: 0xF7897000        Size: 12288        File Visible: -        Signed: -

Status: -
 

Name: Cdfs.SYS

Image Path: C:\WINXP\System32\Drivers\Cdfs.SYS

Address: 0xEF96A000        Size: 63744        File Visible: -        Signed: -

Status: -
 

Name: cdrom.sys

Image Path: C:\WINXP\system32\DRIVERS\cdrom.sys

Address: 0xF67AC000        Size: 62976        File Visible: -        Signed: -

Status: -
 

Name: CLASSPNP.SYS

Image Path: C:\WINXP\system32\DRIVERS\CLASSPNP.SYS

Address: 0xF74E7000        Size: 53248        File Visible: -        Signed: -

Status: -
 

Name: disk.sys

Image Path: disk.sys

Address: 0xF74D7000        Size: 36352        File Visible: -        Signed: -

Status: -
 

Name: dmio.sys

Image Path: dmio.sys

Address: 0xF71E8000        Size: 154112        File Visible: -        Signed: -

Status: -
 

Name: dmload.sys

Image Path: dmload.sys

Address: 0xF798B000        Size: 5888        File Visible: -        Signed: -

Status: -
 

Name: drmk.sys

Image Path: C:\WINXP\system32\drivers\drmk.sys

Address: 0xF675C000        Size: 61440        File Visible: -        Signed: -

Status: -
 

Name: dump_nvata.sys

Image Path: C:\WINXP\System32\Drivers\dump_nvata.sys

Address: 0xB2212000        Size: 102400        File Visible: No        Signed: -

Status: -
 

Name: dump_WMILIB.SYS

Image Path: C:\WINXP\System32\Drivers\dump_WMILIB.SYS

Address: 0xF79C7000        Size: 8192        File Visible: No        Signed: -

Status: -
 

Name: Dxapi.sys

Image Path: C:\WINXP\System32\drivers\Dxapi.sys

Address: 0xF0C4C000        Size: 12288        File Visible: -        Signed: -

Status: -
 

Name: dxg.sys

Image Path: C:\WINXP\System32\drivers\dxg.sys

Address: 0xBF000000        Size: 73728        File Visible: -        Signed: -

Status: -
 

Name: dxgthk.sys

Image Path: C:\WINXP\System32\drivers\dxgthk.sys

Address: 0xF7BCC000        Size: 4096        File Visible: -        Signed: -

Status: -
 

Name: Fips.SYS

Image Path: C:\WINXP\System32\Drivers\Fips.SYS

Address: 0xEF9AA000        Size: 44672        File Visible: -        Signed: -

Status: -
 

Name: fltMgr.sys

Image Path: fltMgr.sys

Address: 0xF7197000        Size: 129792        File Visible: -        Signed: -

Status: -
 

Name: Fs_Rec.SYS

Image Path: C:\WINXP\System32\Drivers\Fs_Rec.SYS

Address: 0xF795F000        Size: 9216        File Visible: -        Signed: -

Status: -
 

Name: ftdisk.sys

Image Path: ftdisk.sys

Address: 0xF720E000        Size: 126336        File Visible: -        Signed: -

Status: -
 

Name: GEARAspiWDM.sys

Image Path: C:\WINXP\system32\DRIVERS\GEARAspiWDM.sys

Address: 0xF6C0B000        Size: 9984        File Visible: -        Signed: -

Status: -
 

Name: hal.dll

Image Path: C:\WINXP\system32\hal.dll

Address: 0x806D0000        Size: 131840        File Visible: -        Signed: -

Status: -
 

Name: HIDCLASS.SYS

Image Path: C:\WINXP\system32\DRIVERS\HIDCLASS.SYS

Address: 0xEF97A000        Size: 36864        File Visible: -        Signed: -

Status: -
 

Name: HIDPARSE.SYS

Image Path: C:\WINXP\system32\DRIVERS\HIDPARSE.SYS

Address: 0xF7847000        Size: 28672        File Visible: -        Signed: -

Status: -
 

Name: hidusb.sys

Image Path: C:\WINXP\system32\DRIVERS\hidusb.sys

Address: 0xEF665000        Size: 10368        File Visible: -        Signed: -

Status: -
 

Name: HTTP.sys

Image Path: C:\WINXP\System32\Drivers\HTTP.sys

Address: 0xAF447000        Size: 264832        File Visible: -        Signed: -

Status: -
 

Name: i8042prt.sys

Image Path: C:\WINXP\system32\DRIVERS\i8042prt.sys

Address: 0xF677C000        Size: 52992        File Visible: -        Signed: -

Status: -
 

Name: imapi.sys

Image Path: C:\WINXP\system32\DRIVERS\imapi.sys

Address: 0xF67BC000        Size: 42112        File Visible: -        Signed: -

Status: -
 

Name: ipnat.sys

Image Path: C:\WINXP\system32\DRIVERS\ipnat.sys

Address: 0xB2651000        Size: 152832        File Visible: -        Signed: -

Status: -
 

Name: ipsec.sys

Image Path: C:\WINXP\system32\DRIVERS\ipsec.sys

Address: 0xB2758000        Size: 75264        File Visible: -        Signed: -

Status: -
 

Name: isapnp.sys

Image Path: isapnp.sys

Address: 0xF74A7000        Size: 37632        File Visible: -        Signed: -

Status: -
 

Name: ISODrive.sys

Image Path: C:\Programme\UltraISO\drivers\ISODrive.sys

Address: 0xB2535000        Size: 81920        File Visible: -        Signed: -

Status: -
 

Name: kbdclass.sys

Image Path: C:\WINXP\system32\DRIVERS\kbdclass.sys

Address: 0xF785F000        Size: 25216        File Visible: -        Signed: -

Status: -
 

Name: KDCOM.DLL

Image Path: C:\WINXP\system32\KDCOM.DLL

Address: 0xF7987000        Size: 8192        File Visible: -        Signed: -

Status: -
 

Name: klif.sys

Image Path: C:\WINXP\system32\DRIVERS\klif.sys

Address: 0xB278B000        Size: 143360        File Visible: -        Signed: -

Status: -
 

Name: kmixer.sys

Image Path: C:\WINXP\system32\drivers\kmixer.sys

Address: 0xAF048000        Size: 172416        File Visible: -        Signed: -

Status: -
 

Name: ks.sys

Image Path: C:\WINXP\system32\DRIVERS\ks.sys

Address: 0xF6270000        Size: 143360        File Visible: -        Signed: -

Status: -
 

Name: KSecDD.sys

Image Path: KSecDD.sys

Address: 0xF716E000        Size: 92288        File Visible: -        Signed: -

Status: -
 

Name: lv302af.sys

Image Path: C:\WINXP\system32\DRIVERS\lv302af.sys

Address: 0xF79A1000        Size: 7168        File Visible: -        Signed: -

Status: -
 

Name: LV302V32.SYS

Image Path: C:\WINXP\system32\DRIVERS\LV302V32.SYS

Address: 0xB22C3000        Size: 2563840        File Visible: -        Signed: -

Status: -
 

Name: LVPr2Mon.sys

Image Path: C:\WINXP\system32\DRIVERS\LVPr2Mon.sys

Address: 0xED3FB000        Size: 18944        File Visible: -        Signed: -

Status: -
 

Name: lvrs.sys

Image Path: C:\WINXP\system32\DRIVERS\lvrs.sys

Address: 0xB222B000        Size: 621184        File Visible: -        Signed: -

Status: -
 

Name: LVUSBSta.sys

Image Path: C:\WINXP\system32\drivers\LVUSBSta.sys

Address: 0xEF95A000        Size: 35072        File Visible: -        Signed: -

Status: -
 

Name: mnmdd.SYS

Image Path: C:\WINXP\System32\Drivers\mnmdd.SYS

Address: 0xF798F000        Size: 4224        File Visible: -        Signed: -

Status: -
 

Name: mouclass.sys

Image Path: C:\WINXP\system32\DRIVERS\mouclass.sys

Address: 0xF777F000        Size: 23552        File Visible: -        Signed: -

Status: -
 

Name: mouhid.sys

Image Path: C:\WINXP\system32\DRIVERS\mouhid.sys

Address: 0xEF661000        Size: 12288        File Visible: -        Signed: -

Status: -
 

Name: MountMgr.sys

Image Path: MountMgr.sys

Address: 0xF74B7000        Size: 42368        File Visible: -        Signed: -

Status: -
 

Name: mrxdav.sys

Image Path: C:\WINXP\system32\DRIVERS\mrxdav.sys

Address: 0xAFC82000        Size: 180608        File Visible: -        Signed: -

Status: -
 

Name: mrxsmb.sys

Image Path: C:\WINXP\system32\DRIVERS\mrxsmb.sys

Address: 0xB2549000        Size: 455296        File Visible: -        Signed: -

Status: -
 

Name: Msfs.SYS

Image Path: C:\WINXP\System32\Drivers\Msfs.SYS

Address: 0xF7787000        Size: 19072        File Visible: -        Signed: -

Status: -
 

Name: msgpc.sys

Image Path: C:\WINXP\system32\DRIVERS\msgpc.sys

Address: 0xF76B7000        Size: 35072        File Visible: -        Signed: -

Status: -
 

Name: mssmbios.sys

Image Path: C:\WINXP\system32\DRIVERS\mssmbios.sys

Address: 0xF703E000        Size: 15488        File Visible: -        Signed: -

Status: -
 

Name: Mup.sys

Image Path: Mup.sys

Address: 0xF7086000        Size: 105344        File Visible: -        Signed: -

Status: -
 

Name: NDIS.sys

Image Path: NDIS.sys

Address: 0xF70B4000        Size: 182656        File Visible: -        Signed: -

Status: -
 

Name: ndistapi.sys

Image Path: C:\WINXP\system32\DRIVERS\ndistapi.sys

Address: 0xF7056000        Size: 10112        File Visible: -        Signed: -

Status: -
 

Name: ndiswan.sys

Image Path: C:\WINXP\system32\DRIVERS\ndiswan.sys

Address: 0xF4E57000        Size: 91520        File Visible: -        Signed: -

Status: -
 

Name: NDProxy.SYS

Image Path: C:\WINXP\System32\Drivers\NDProxy.SYS

Address: 0xF75F7000        Size: 40576        File Visible: -        Signed: -

Status: -
 

Name: netbios.sys

Image Path: C:\WINXP\system32\DRIVERS\netbios.sys

Address: 0xEF9BA000        Size: 34688        File Visible: -        Signed: -

Status: -
 

Name: netbt.sys

Image Path: C:\WINXP\system32\DRIVERS\netbt.sys

Address: 0xB26D7000        Size: 162816        File Visible: -        Signed: -

Status: -
 

Name: nic1394.sys

Image Path: C:\WINXP\system32\DRIVERS\nic1394.sys

Address: 0xF7517000        Size: 61824        File Visible: -        Signed: -

Status: -
 

Name: Npfs.SYS

Image Path: C:\WINXP\System32\Drivers\Npfs.SYS

Address: 0xF778F000        Size: 30848        File Visible: -        Signed: -

Status: -
 

Name: Ntfs.sys

Image Path: Ntfs.sys

Address: 0xF70E1000        Size: 574976        File Visible: -        Signed: -

Status: -
 

Name: ntkrnlpa.exe

Image Path: C:\WINXP\system32\ntkrnlpa.exe

Address: 0x804D7000        Size: 2068352        File Visible: -        Signed: -

Status: -
 

Name: Null.SYS

Image Path: C:\WINXP\System32\Drivers\Null.SYS

Address: 0xED57C000        Size: 2944        File Visible: -        Signed: -

Status: -
 

Name: nvapu.sys

Image Path: C:\WINXP\system32\drivers\nvapu.sys

Address: 0xF3154000        Size: 414464        File Visible: -        Signed: -

Status: -
 

Name: nvarm.sys

Image Path: C:\WINXP\system32\drivers\nvarm.sys

Address: 0xF303A000        Size: 69632        File Visible: -        Signed: -

Status: -
 

Name: nvata.sys

Image Path: nvata.sys

Address: 0xF71B7000        Size: 100736        File Visible: -        Signed: -

Status: -
 

Name: nvax.sys

Image Path: C:\WINXP\system32\drivers\nvax.sys

Address: 0xF7647000        Size: 53376        File Visible: -        Signed: -

Status: -
 

Name: NVENETFD.sys

Image Path: C:\WINXP\system32\DRIVERS\NVENETFD.sys

Address: 0xEDCEE000        Size: 33536        File Visible: -        Signed: -

Status: -
 

Name: nvmcp.sys

Image Path: C:\WINXP\system32\drivers\nvmcp.sys

Address: 0xF304B000        Size: 937984        File Visible: -        Signed: -

Status: -
 

Name: nvnetbus.sys

Image Path: C:\WINXP\system32\DRIVERS\nvnetbus.sys

Address: 0xF6C03000        Size: 12928        File Visible: -        Signed: -

Status: -
 

Name: NVNRM.SYS

Image Path: C:\WINXP\system32\DRIVERS\NVNRM.SYS

Address: 0xF6230000        Size: 262144        File Visible: -        Signed: -

Status: -
 

Name: NVSNPU.SYS

Image Path: C:\WINXP\system32\DRIVERS\NVSNPU.SYS

Address: 0xF61FD000        Size: 208896        File Visible: -        Signed: -

Status: -
 

Name: ohci1394.sys

Image Path: ohci1394.sys

Address: 0xF7487000        Size: 61696        File Visible: -        Signed: -

Status: -
 

Name: parport.sys

Image Path: C:\WINXP\system32\DRIVERS\parport.sys

Address: 0xF5CC7000        Size: 80384        File Visible: -        Signed: -

Status: -
 

Name: PartMgr.sys

Image Path: PartMgr.sys

Address: 0xF770F000        Size: 19712        File Visible: -        Signed: -

Status: -
 

Name: ParVdm.SYS

Image Path: C:\WINXP\System32\Drivers\ParVdm.SYS

Address: 0xF79AF000        Size: 7040        File Visible: -        Signed: -

Status: -
 

Name: pci.sys

Image Path: pci.sys

Address: 0xF722D000        Size: 68224        File Visible: -        Signed: -

Status: -
 

Name: PCI_PNP8630

Image Path: \Driver\PCI_PNP8630

Address: 0x00000000        Size: 0        File Visible: No        Signed: -

Status: -
 

Name: pciide.sys

Image Path: pciide.sys

Address: 0xF7A4F000        Size: 3328        File Visible: -        Signed: -

Status: -
 

Name: PCIIDEX.SYS

Image Path: C:\WINXP\system32\DRIVERS\PCIIDEX.SYS

Address: 0xF7707000        Size: 28672        File Visible: -        Signed: -

Status: -
 

Name: PnpManager

Image Path: \Driver\PnpManager

Address: 0x804D7000        Size: 2068352        File Visible: -        Signed: -

Status: -
 

Name: portcls.sys

Image Path: C:\WINXP\system32\drivers\portcls.sys

Address: 0xF3130000        Size: 147456        File Visible: -        Signed: -

Status: -
 

Name: PQNTDrv.SYS

Image Path: C:\WINXP\System32\Drivers\PQNTDrv.SYS

Address: 0xEF75F000        Size: 2688        File Visible: -        Signed: -

Status: -
 

Name: processr.sys

Image Path: C:\WINXP\system32\DRIVERS\processr.sys

Address: 0xF7627000        Size: 39936        File Visible: -        Signed: -

Status: -
 

Name: psched.sys

Image Path: C:\WINXP\system32\DRIVERS\psched.sys

Address: 0xF4E46000        Size: 69120        File Visible: -        Signed: -

Status: -
 

Name: ptilink.sys

Image Path: C:\WINXP\system32\DRIVERS\ptilink.sys

Address: 0xF7777000        Size: 17792        File Visible: -        Signed: -

Status: -
 

Name: rasacd.sys

Image Path: C:\WINXP\system32\DRIVERS\rasacd.sys

Address: 0xF7967000        Size: 8832        File Visible: -        Signed: -

Status: -
 

Name: rasl2tp.sys

Image Path: C:\WINXP\system32\DRIVERS\rasl2tp.sys

Address: 0xF7687000        Size: 51328        File Visible: -        Signed: -

Status: -
 

Name: raspppoe.sys

Image Path: C:\WINXP\system32\DRIVERS\raspppoe.sys

Address: 0xF7697000        Size: 41472        File Visible: -        Signed: -

Status: -
 

Name: raspptp.sys

Image Path: C:\WINXP\system32\DRIVERS\raspptp.sys

Address: 0xF76A7000        Size: 48384        File Visible: -        Signed: -

Status: -
 

Name: raspti.sys

Image Path: C:\WINXP\system32\DRIVERS\raspti.sys

Address: 0xF776F000        Size: 16512        File Visible: -        Signed: -

Status: -
 

Name: RAW

Image Path: \FileSystem\RAW

Address: 0x804D7000        Size: 2068352        File Visible: -        Signed: -

Status: -
 

Name: rdbss.sys

Image Path: C:\WINXP\system32\DRIVERS\rdbss.sys

Address: 0xB25B9000        Size: 175744        File Visible: -        Signed: -

Status: -
 

Name: RDPCDD.sys

Image Path: C:\WINXP\System32\DRIVERS\RDPCDD.sys

Address: 0xF7993000        Size: 4224        File Visible: -        Signed: -

Status: -
 

Name: rdpdr.sys

Image Path: C:\WINXP\system32\DRIVERS\rdpdr.sys

Address: 0xF4E16000        Size: 196224        File Visible: -        Signed: -

Status: -
 

Name: redbook.sys

Image Path: C:\WINXP\system32\DRIVERS\redbook.sys

Address: 0xF679C000        Size: 57728        File Visible: -        Signed: -

Status: -
 

Name: rootrepeal.sys

Image Path: C:\WINXP\system32\drivers\rootrepeal.sys

Address: 0xAF9A0000        Size: 49152        File Visible: No        Signed: -

Status: -
 

Name: SASDIFSV.SYS

Image Path: C:\Programme\SUPERAntiSpyware\SASDIFSV.SYS

Address: 0xF49BF000        Size: 24576        File Visible: -        Signed: -

Status: -
 

Name: SASENUM.SYS

Image Path: C:\Programme\SUPERAntiSpyware\SASENUM.SYS

Address: 0xED3F3000        Size: 20480        File Visible: -        Signed: -

Status: -
 

Name: SASKUTIL.sys

Image Path: C:\Programme\SUPERAntiSpyware\SASKUTIL.sys

Address: 0xB25E4000        Size: 151552        File Visible: -        Signed: -

Status: -
 

Name: SCSIPORT.SYS

Image Path: C:\WINXP\System32\Drivers\SCSIPORT.SYS

Address: 0xF726D000        Size: 98304        File Visible: -        Signed: -

Status: -
 

Name: serenum.sys

Image Path: C:\WINXP\system32\DRIVERS\serenum.sys

Address: 0xF6BFF000        Size: 15744        File Visible: -        Signed: -

Status: -
 

Name: serial.sys

Image Path: C:\WINXP\system32\DRIVERS\serial.sys

Address: 0xF678C000        Size: 65536        File Visible: -        Signed: -

Status: -
 

Name: spgl.sys

Image Path: spgl.sys

Address: 0xF7285000        Size: 1052672        File Visible: No        Signed: -

Status: -
 

Name: sptd

Image Path: \Driver\sptd

Address: 0x00000000        Size: 0        File Visible: No        Signed: -

Status: -
 

Name: sr.sys

Image Path: sr.sys

Address: 0xF7185000        Size: 73472        File Visible: -        Signed: -

Status: -
 

Name: srescan.sys

Image Path: srescan.sys

Address: 0xF70A0000        Size: 81920        File Visible: No        Signed: -

Status: -
 

Name: srv.sys

Image Path: C:\WINXP\system32\DRIVERS\srv.sys

Address: 0xAFB40000        Size: 333952        File Visible: -        Signed: -

Status: -
 

Name: swenum.sys

Image Path: C:\WINXP\system32\DRIVERS\swenum.sys

Address: 0xF7A13000        Size: 4352        File Visible: -        Signed: -

Status: -
 

Name: sysaudio.sys

Image Path: C:\WINXP\system32\drivers\sysaudio.sys

Address: 0xEB75F000        Size: 60800        File Visible: -        Signed: -

Status: -
 

Name: tcpip.sys

Image Path: C:\WINXP\system32\DRIVERS\tcpip.sys

Address: 0xB26FF000        Size: 361600        File Visible: -        Signed: -

Status: -
 

Name: TDI.SYS

Image Path: C:\WINXP\system32\DRIVERS\TDI.SYS

Address: 0xF7767000        Size: 20480        File Visible: -        Signed: -

Status: -
 

Name: termdd.sys

Image Path: C:\WINXP\system32\DRIVERS\termdd.sys

Address: 0xF76C7000        Size: 40704        File Visible: -        Signed: -

Status: -
 

Name: Udfs.SYS

Image Path: C:\WINXP\System32\Drivers\Udfs.SYS

Address: 0xAF073000        Size: 66048        File Visible: -        Signed: -

Status: -
 

Name: update.sys

Image Path: C:\WINXP\system32\DRIVERS\update.sys

Address: 0xF4DB8000        Size: 384768        File Visible: -        Signed: -

Status: -
 

Name: usbaudio.sys

Image Path: C:\WINXP\system32\drivers\usbaudio.sys

Address: 0xEF5A1000        Size: 60032        File Visible: -        Signed: -

Status: -
 

Name: usbccgp.sys

Image Path: C:\WINXP\system32\DRIVERS\usbccgp.sys

Address: 0xF2371000        Size: 32128        File Visible: -        Signed: -

Status: -
 

Name: USBD.SYS

Image Path: C:\WINXP\system32\DRIVERS\USBD.SYS

Address: 0xF7A47000        Size: 8192        File Visible: -        Signed: -

Status: -
 

Name: usbehci.sys

Image Path: C:\WINXP\system32\DRIVERS\usbehci.sys

Address: 0xF7857000        Size: 30208        File Visible: -        Signed: -

Status: -
 

Name: usbhub.sys

Image Path: C:\WINXP\system32\DRIVERS\usbhub.sys

Address: 0xF7607000        Size: 59520        File Visible: -        Signed: -

Status: -
 

Name: usbohci.sys

Image Path: C:\WINXP\system32\DRIVERS\usbohci.sys

Address: 0xF784F000        Size: 17152        File Visible: -        Signed: -

Status: -
 

Name: USBPORT.SYS

Image Path: C:\WINXP\system32\DRIVERS\USBPORT.SYS

Address: 0xF6293000        Size: 147456        File Visible: -        Signed: -

Status: -
 

Name: vga.sys

Image Path: C:\WINXP\System32\drivers\vga.sys

Address: 0xF782F000        Size: 20992        File Visible: -        Signed: -

Status: -
 

Name: VIDEOPRT.SYS

Image Path: C:\WINXP\system32\DRIVERS\VIDEOPRT.SYS

Address: 0xF5CDB000        Size: 81920        File Visible: -        Signed: -

Status: -
 

Name: vmm.sys

Image Path: C:\WINXP\system32\Drivers\vmm.sys

Address: 0xB2609000        Size: 155648        File Visible: -        Signed: -

Status: -
 

Name: VMNetSrv.sys

Image Path: C:\WINXP\system32\DRIVERS\VMNetSrv.sys

Address: 0xF676C000        Size: 57344        File Visible: -        Signed: -

Status: -
 

Name: VolSnap.sys

Image Path: VolSnap.sys

Address: 0xF74C7000        Size: 53760        File Visible: -        Signed: -

Status: -
 

Name: vsdatant.sys

Image Path: C:\WINXP\System32\vsdatant.sys

Address: 0xB2677000        Size: 389344        File Visible: -        Signed: -

Status: -
 

Name: wanarp.sys

Image Path: C:\WINXP\system32\DRIVERS\wanarp.sys

Address: 0xEDC9E000        Size: 34560        File Visible: -        Signed: -

Status: -
 

Name: watchdog.sys

Image Path: C:\WINXP\System32\watchdog.sys

Address: 0xEF731000        Size: 20480        File Visible: -        Signed: -

Status: -
 

Name: wdmaud.sys

Image Path: C:\WINXP\system32\drivers\wdmaud.sys

Address: 0xAFDCD000        Size: 83072        File Visible: -        Signed: -

Status: -
 

Name: Win32k

Image Path: \Driver\Win32k

Address: 0xBF800000        Size: 1847296        File Visible: -        Signed: -

Status: -
 

Name: win32k.sys

Image Path: C:\WINXP\System32\win32k.sys

Address: 0xBF800000        Size: 1847296        File Visible: -        Signed: -

Status: -
 

Name: WMILIB.SYS

Image Path: C:\WINXP\System32\Drivers\WMILIB.SYS

Address: 0xF7989000        Size: 8192        File Visible: -        Signed: -

Status: -
 

Name: WMIxWDM

Image Path: \Driver\WMIxWDM

Address: 0x804D7000        Size: 2068352        File Visible: -        Signed: -

Status: -
 

Name: ws2ifsl.sys

Image Path: C:\WINXP\System32\drivers\ws2ifsl.sys

Address: 0xF6BF7000        Size: 12032        File Visible: -        Signed: -

Status: -

Hier Punkt 2

Code:

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.6 by Gmer, http://www.gmer.net
 

device: opened successfully

user: MBR read successfully

kernel: MBR read successfully

user & kernel MBR OK

Die Programme habe ich nicht vergessen da mach ich mich jetzt an die arbeit

Meine Installierten Programme:

Code:

7-Zip 4.64

Adobe Flash Player ActiveX

Adobe Reader 9 - Deutsch

Apple Mobile Device Support

Apple Software Update

ATI Display Driver

AVM FRITZ!Box Dokumentation

Bewerbungsfoto-/Passbild-Generator v3.2a

Biet-O-Matic v2.12.0

CCleaner (remove only)

CDBurnerXP

Gimp 2.6.1

Google Toolbar for Internet Explorer

Hama Wireless LAN Adapter

IrfanView (remove only)

iTunes

Java(TM) 6 Update 13

Java(TM) 6 Update 7

Logitech QuickCam

Logitech QuickCam-Treiberpaket

Logitech Updater

Microsoft .NET Framework 2.0 Service Pack 2

Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - DEU

Microsoft .NET Framework 3.0 Service Pack 2

Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - DEU

Microsoft .NET Framework 3.5 Language Pack SP1 - DEU

Microsoft .NET Framework 3.5 SP1

Mozilla Firefox (3.0.12)

MSN

MSXML 4.0 SP2 (KB954430)

Nero 8 Ultra Edition HD

Nokia Connectivity Cable Driver

Nokia PC Suite

NVIDIA Drivers

NVIDIA ForceWare Network Access Manager

NvMixer

OpenOffice.org 3.1

Port Splitter

Project64 1.6

QuickSteuer Deluxe 2008

QuickSteuer DELUXE Wissens-Center 2008

QuickTime

SUPERAntiSpyware Free Edition

Ubuntu

UltraISO Premium V8.61

USB Scanner

Windows Genuine Advantage Validation Tool (KB892130)

Windows Live installer

Windows Live Messenger

WinRAR archiver

WinZip

ZoneAlarm Security Suite

Hast Du (immer noch) Probleme?

Also ich hatte das Programm Lime wire installiert wenn mann drauf kligt passiert einfach garnichts also es startet nicht. Habe es auch deinstalliert neu innstalliert, trotzdem das gleiche Problem.

Sonst keine Probleme mehr.

Wenn du weist woran das liegt kannst du ja nochmal antworten sonst können wir das hier beenden. Danke nochmal fü deine Bemühungen.