Trojaner-Board - Trojaner im Computer. Combofix findet immer wieder: c:\windows\explorer.exe . . . ist infiziert!

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Trojaner im Computer. Combofix findet immer wieder: c:\windows\explorer.exe . . . ist infiziert! (https://www.trojaner-board.de/90741-trojaner-computer-combofix-findet-immer-c-windows-explorer-exe-infiziert.html)

[code]
Combofix Logfile:

Code:

ComboFix 10-09-14.05 - vvjj 15.09.2010  21:40:23.10.1 - x86

Microsoft Windows XP Professional  5.1.2600.3.1252.49.1033.18.953.595 [GMT 2:00]

ausgeführt von:: c:\documents and settings\vvjj\My Documents\cofi.exe

Benutzte Befehlsschalter :: c:\documents and settings\vvjj\My Documents\CFScript.txt

AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
 

FILE ::

"c:\windows\bnetunin.exe"

"c:\windows\diabunin.exe"

"c:\windows\dlinfo_0.drv"

"c:\windows\dlinfo_1.drv"

.
 

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.
 

c:\windows\bnetunin.exe

c:\windows\diabunin.exe

c:\windows\dlinfo_0.drv

c:\windows\dlinfo_1.drv
 

c:\windows\system32\winlogon.exe . . . ist infiziert!!
 

c:\windows\explorer.exe . . . ist infiziert!!
 

.

(((((((((((((((((((((((   Dateien erstellt von 2010-08-15 bis 2010-09-15  ))))))))))))))))))))))))))))))

.
 

2010-09-15 17:56 . 2010-09-15 18:03        --------        d-----w-        C:\cofi

2010-09-15 17:41 . 2010-09-15 17:41        --------        d-----w-        C:\_OTL

2010-09-13 20:52 . 2010-09-13 20:52        --------        d-----w-        c:\documents and settings\vvjj\Application Data\Malwarebytes

2010-09-13 20:52 . 2010-04-29 10:19        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys

2010-09-13 20:52 . 2010-09-13 20:52        --------        d-----w-        c:\documents and settings\All Users\Application Data\Malwarebytes

2010-09-13 20:52 . 2010-04-29 10:19        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys

2010-09-13 20:45 . 2010-09-13 20:52        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware

2010-09-05 19:19 . 2010-09-05 19:19        --------        d-----w-        c:\program files\Flip Video

2010-09-05 19:04 . 2010-09-05 19:04        --------        d-----w-        c:\documents and settings\All Users\Application Data\Flip Video

2010-09-03 18:00 . 2010-09-04 08:21        --------        d-----w-        c:\documents and settings\vvjj\Application Data\vlc

2010-09-03 17:59 . 2010-09-03 17:59        --------        d-----w-        c:\program files\VideoLAN

2010-08-30 18:47 . 2010-09-13 20:35        --------        d-----w-        c:\program files\eMule

2010-08-29 07:10 . 2010-08-29 07:10        --------        d-----w-        c:\documents and settings\All Users\Application Data\McAfee
 

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-09-15 17:54 . 2009-05-31 11:07        --------        d-----w-        c:\documents and settings\vvjj\Application Data\Media Player Classic

2010-09-15 17:52 . 2009-05-19 17:05        --------        d-----w-        c:\program files\CCleaner

2010-09-06 16:10 . 2009-06-11 08:59        --------        d-----w-        c:\documents and settings\vvjj\Application Data\uTorrent

2010-09-03 17:48 . 2009-08-04 20:43        --------        d-----w-        c:\documents and settings\vvjj\Application Data\DivX

2010-09-02 11:31 . 2009-12-01 21:52        --------        d-----w-        c:\documents and settings\All Users\Application Data\Storm

2010-08-27 22:55 . 2009-05-25 16:57        --------        d-----w-        c:\documents and settings\vvjj\Application Data\SogouPY

2010-07-29 21:48 . 2010-07-29 21:48        --------        d-----w-        c:\program files\QMI

2010-07-29 21:48 . 2009-05-20 22:36        --------        d--h--w-        c:\program files\InstallShield Installation Information

2010-07-25 10:12 . 2009-07-25 08:48        --------        d-----w-        c:\program files\DOSBox-0.73

2010-07-18 08:15 . 2010-06-30 16:49        --------        d-----w-        c:\documents and settings\vvjj\Application Data\SGPPLog

2010-07-08 18:48 . 2010-07-08 18:48        98304        ----a-w-        c:\windows\system32\CmdLineExt.dll

2010-06-30 12:31 . 2008-04-14 12:00        149504        ----a-w-        c:\windows\system32\schannel.dll

2010-06-24 12:10 . 2008-04-14 12:00        81920        ----a-w-        c:\windows\system32\ieencode.dll

2010-06-24 12:10 . 2008-04-14 12:00        667136        ----a-w-        c:\windows\system32\wininet.dll

2010-06-23 13:44 . 2008-04-14 12:00        1851904        ----a-w-        c:\windows\system32\win32k.sys

2010-06-21 15:27 . 2008-04-14 12:00        354304        ----a-w-        c:\windows\system32\drivers\srv.sys

.
 

------- Sigcheck -------
 

[7] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys

[7] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\system32\dllcache\tcpip.sys

[-] 2008-06-20 . EEC9730F9CC03819111D90E6CAA2DCC9 . 361600 . . [5.1.2600.5625] . . c:\windows\system32\drivers\tcpip.sys

[7] 2008-04-14 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB951748$\tcpip.sys
 

[-] 2008-04-14 . 2A39241E5FBED9C12BE29850232B8D89 . 507904 . . [5.1.2600.5512] . . c:\windows\system32\winlogon.exe
 

[-] 2008-04-14 . DE4AA5D5375FFEFB183C103F3E50B3D3 . 1033728 . . [6.00.2900.5512] . . c:\windows\explorer.exe

.

(((((((((((((((((((((((((((((   SnapShot@2010-09-15_18.01.38   )))))))))))))))))))))))))))))))))))))))))

.

+ 2010-09-15 19:44 . 2010-09-15 19:44        16384              c:\windows\temp\Perflib_Perfdata_224.dat

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4
 

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]

2009-04-02 10:47        333192        ----a-w-        c:\program files\AskBarDis\bar\bin\askBar.dll
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2009-04-02 333192]
 

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]

[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
 

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2009-04-02 333192]
 

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]

[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-06-17 150040]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-06-17 170520]

"Persistence"="c:\windows\system32\igfxpers.exe" [2008-06-17 141848]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

"RTHDCPL"="RTHDCPL.EXE" [2008-05-16 16862720]

"AzMixerSel"="c:\program files\Realtek\Audio\InstallShield\AzMixerSel.exe" [2006-07-18 53248]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-08-14 149280]

"UpdatePPShortCut"="c:\program files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" [2008-12-03 218408]

"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-04-12 1135912]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\PokerStrategy\\PokerStrategy Equilator\\Equilator.exe"=

"c:\\Program Files\\uTorrent\\uTorrent.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"c:\\Program Files\\Google\\Google Talk\\googletalk.exe"=

"e:\\World of Warcraft\\WoW-3.2.0-deDE-downloader.exe"=

"e:\\World of Warcraft\\Launcher.exe"=

"e:\\World of Warcraft\\WoW-3.2.0.10192-to-3.2.0.10314-deDE-downloader.exe"=

"e:\\World of Warcraft\\WoW-3.2.0.10314-to-3.2.2.10482-deDE-downloader.exe"=

"e:\\World of Warcraft\\WoW-3.2.2.10482-to-3.2.2.10505-deDE-downloader.exe"=

"c:\\WINDOWS\\system32\\PnkBstrA.exe"=

"c:\\WINDOWS\\system32\\PnkBstrB.exe"=

"c:\\Documents and Settings\\vvjj\\My Documents\\Downloads\\qq2009sp6_installer.exe"=

"c:\\Program Files\\Tencent\\QQ\\Bin\\QQ.exe"=

"c:\\Program Files\\Tencent\\QQ\\Bin\\auclt.exe"=

"c:\\spiele\\Qianhong\\Qianhong.exe"=

"e:\\Diablo\\diablo.exe"=

"c:\\Program Files\\SogouInput\\5.0.1.4185\\PinyinUp.exe"=
 

R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [19.05.2009 19:33 108289]

R2 pgsql-8.3;PostgreSQL Database Server 8.3;c:\program files\PostgreSQL\8.3\bin\pg_ctl.exe [01.02.2008 04:02 65536]

R3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI Service;c:\windows\system32\drivers\IntcHdmi.sys [19.05.2009 19:02 108032]

R3 O2MDRDR;O2MDRDR;c:\windows\system32\drivers\o2media.sys [21.05.2009 00:59 51288]

R3 O2SDRDR;O2SDRDR;c:\windows\system32\drivers\o2sd.sys [21.05.2009 00:37 43608]

S2 ASKUpgrade;ASKUpgrade;c:\program files\AskBarDis\bar\bin\ASKUpgrade.exe [11.06.2009 11:00 234888]

S3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [21.08.2009 23:39 8704]

S3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [21.08.2009 23:39 3072]

S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [08.06.2010 20:04 691696]

.

Inhalt des "geplante Tasks" Ordners
 

2010-09-05 c:\windows\Tasks\SogouImeMgr.job

- c:\progra~1\SOGOUI~1\501~1.418\SGTool.exe [2010-06-25 13:10]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = 

mLocal Page = 

uSearchURL,(Default) = hxxp://toolbar.ask.com/toolbarv/askRedirect?o=13925&gct=&gc=1&q=%s

IE: ???QQ?? - c:\program files\Tencent\QQ\Bin\AddEmotion.htm

DPF: {3D8F74EE-8692-4F8F-B8D2-7522E732519E} - hxxp://game-web.qq.com/client/QQGame2.cab

FF - ProfilePath - c:\documents and settings\vvjj\Application Data\Mozilla\Firefox\Profiles\opx683lu.default\

FF - component: c:\documents and settings\vvjj\Application Data\Mozilla\Firefox\Profiles\opx683lu.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\FFExternalAlert.dll

FF - component: c:\documents and settings\vvjj\Application Data\Mozilla\Firefox\Profiles\opx683lu.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\RadioWMPCore.dll

FF - plugin: c:\documents and settings\All Users\Application Data\id Software\QuakeLive\npquakezero.dll

FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
 

---- FIREFOX Richtlinien ----

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true); 

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true); 

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -
 

AddRemove-Battle.net - c:\windows\bnetunin.exe

AddRemove-Diablo - c:\windows\diabunin.exe
 
 
 

**************************************************************************
 

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net

Rootkit scan 2010-09-15 21:44

Windows 5.1.2600 Service Pack 3 NTFS
 

Scanne versteckte Prozesse... 
 

Scanne versteckte Autostarteinträge... 
 

Scanne versteckte Dateien... 
 

Scan erfolgreich abgeschlossen

versteckte Dateien: 0
 

**************************************************************************

.

--------------------- Gesperrte Registrierungsschluessel ---------------------
 

[HKEY_USERS\S-1-5-21-2025429265-299502267-1801674531-1003\Software\Microsoft\Internet Explorer\MenuExt\ûm*R0RQ*Q*hˆÅ`]

"contexts"=dword:00000002

@="c:\\Program Files\\Tencent\\QQ\\Bin\\AddEmotion.htm"
 

[HKEY_LOCAL_MACHINE\software\Microsoft\Internet Explorer\MenuExt\ûm*R0RQ*Q*hˆÅ`]

"contexts"=dword:00000002

@="c:\\Program Files\\Tencent\\QQ\\Bin\\AddEmotion.htm"

.

--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
 

- - - - - - - > 'winlogon.exe'(760)

c:\program files\Citrix\ICA Client\pnsson.dll
 

- - - - - - - > 'lsass.exe'(820)

c:\program files\Citrix\ICA Client\pnsson.dll

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\windows\system32\brss01a.exe

c:\program files\Citrix\ICA Client\ssonsvr.exe

c:\program files\Avira\AntiVir Desktop\avguard.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\O2Micro Flash Memory Card Driver\o2flash.exe

c:\windows\RTHDCPL.EXE

c:\windows\system32\igfxsrvc.exe

c:\windows\system32\PnkBstrA.exe

c:\program files\PostgreSQL\8.3\bin\postgres.exe

c:\program files\PostgreSQL\8.3\bin\postgres.exe

c:\program files\PostgreSQL\8.3\bin\postgres.exe

c:\program files\PostgreSQL\8.3\bin\postgres.exe

c:\program files\PostgreSQL\8.3\bin\postgres.exe

c:\program files\PostgreSQL\8.3\bin\postgres.exe

c:\docume~1\vvjj\LOCALS~1\Temp\RtkBtMnt.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2010-09-15  21:47:07 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2010-09-15 19:47

ComboFix2.txt  2010-09-15 18:02
 

Vor Suchlauf: 5.908.217.856 bytes free

Nach Suchlauf: 5.896.331.264 bytes free
 

- - End Of File - - 0539605378F46242ED2321D7E774AD89

--- --- ---

Lad mal saubere Versionen von winlogon.exe und explorer.exe bitte direkt auf C:\ herunter. Hier die Links:

File-Upload.net - winlogon.exe
File-Upload.net - explorer.exe

Das ist wichtig das die direkt auf C: liegen!

Wenn das gemacht ist so bitte weitermachen:

1.) Lade Dir von hier Avenger:
Swandog46's Public Anti-Malware Tools (Download, linksseitig)

2.) Entpack das zip-Archiv, führe die Datei "avenger.exe" aus (unter Vista per Rechtsklick => als Administrator ausführen). Die Haken unten wie abgebildet setzen:

http://mitglied.lycos.de/efunction/tb123/avenger.png

3.) Kopiere Dir exakt die Zeilen aus dem folgenden Code-Feld:

Code:

files to move:

c:\winlogon.exe | c:\windows\system32\winlogon.exe

c:\explorer.exe | c:\windows\explorer.exe

4.) Geh in "The Avenger" nun oben auf "Load Script", dort auf "Paste from Clipboard".

5.) Der Code-Text hier aus meinem Beitrag müsste nun unter "Input Script here" in "The Avenger" zu sehen sein.

6.) Falls dem so ist, klick unten rechts auf "Execute". Bestätige die nächste Abfrage mit "Ja", die Frage zu "Reboot now" (Neustart des Systems) ebenso.

7.) Nach dem Neustart erhältst Du ein LogFile von Avenger eingeblendet. Kopiere dessen Inhalt und poste ihn hier.

8.) Die Datei c:\avenger\backup.zip bei File-Upload.net hochladen und hier verlinken

Code:

Logfile of The Avenger Version 2.0, (c) by Swandog46

hxxp://swandog46.geekstogo.com
 

Platform:  Windows XP
 

*******************
 

Script file opened successfully.

Script file read successfully.
 

Backups directory opened successfully at C:\Avenger
 

*******************
 

Beginning to process script file:
 

Rootkit scan active.

No rootkits found!
 
 

Error:  file "c:\windows\system32\winlogon.exe" is whitelisted

File move operation "c:\winlogon.exe|c:\windows\system32\winlogon.exe" failed!

Status: 0xc0000022 (STATUS_ACCESS_DENIED)
 
 

Error:  file "c:\windows\explorer.exe" is whitelisted

File move operation "c:\explorer.exe|c:\windows\explorer.exe" failed!

Status: 0xc0000022 (STATUS_ACCESS_DENIED)
 
 

Completed script processing.
 

*******************
 

Finished!  Terminate.

hxxp://www.file-upload.net/download-2823965/backup.zip.html

Mist der Avenger überschriebt die Dateien nicht :mad:
Hast Du ne WindowsXP-CD zur Hand? Du kannst auch die Wiederherstellungskonsole starten, wenn sie über Combofix installiert wurde. Hast du beim Rechnerstart ein Bootmenü mit Windows und der Wiederherstellungskonsole zur Auswahl?

Wenn Du weder die CD zur Hand noch die Wiederherstellungskonsole installiert hast, müssen wir das über eine Live-Linux-CD machen. :schmoll:

ich bin leider gerade auf einer Reise und habe keine CDs zur Hand. Ich habe allerdings beim Rechnerstart so ne Konsole zur Auswahl.

Diese Konsole gabs schon als vor vielen Monaten Combofix benutzt habe. Was passiert jetzt wenn ich von dort aus Windows wiederherstelle? Welcher Stand wird genommen? Den vor vielen Monaten oder als ich vor paar Tagen Combofix laufen ließ?

Das ist gut, wenn Du in die Wiederherstellungskonsole kommst. Tipp mal nacheinander diese Befehle ein. Mit Enter jeden Befahl ausführen. Du kannst auch den Text in eine Textdaei abspeichern und diese zB als c:\tb.bat abspeichern und in der Konsole einfach nur c:\tb.bat eintippen und die Stapeldatei (das Script) somit ausführen.

Code:

ren c:\windows\explorer.exe explorer.exe.vir

ren c:\c:\windows\system32\winlogon.exe winlogon.exe.vir

copy c:\explorer.exe c:\windows

copy c:\winlogon.exe c:\windows\system32

scheint wieder alles zu funktionieren. Muss ich jetzt noch irgendetwas machen?

Ja. Bitte die Dateien

Zitat:

c:\windows\explorer.exe.vir
c:\windows\system32\winlogon.exe.vir

bei uns hochladen => http://www.trojaner-board.de/54791-a...ner-board.html

Ich hatte einen kleinen Fehler im vorherigen Beitrag:

Zitat:

ren c:\c:\windows\system32\winlogon.exe winlogon.exe.vir

Hast Du daraus ein ren "c:\windows\system32\winlogon.exe winlogon.exe.vir" gemacht? :wtf:

ja ich hatte das doppelte c:\ weggelassen. komischerweise ist die winlogon.exe.vir bei mir im c:\windows statt in c:\windows\system32.

habe die 2 Dateien hochgeladen.

Ok. Dann mach mal nen neuen Durchgang mit Combofix. Die Datei bitte wieder neu herunterladen und beim herunterladen als cofi.exe abspeichern.

Hab die beiden Dateien mal scannen lassen:

VirusTotal - explorer.exe
VirusTotal - winlogon.exe

[code]
Combofix Logfile:

Code:

ComboFix 10-09-24.05 - vvjj 25.09.2010  17:10:16.11.1 - x86

Microsoft Windows XP Professional  5.1.2600.3.1252.49.1033.18.953.611 [GMT 2:00]

ausgeführt von:: c:\documents and settings\vvjj\My Documents\cofi.exe

AV: AntiVir Desktop *On-access scanning disabled* (Outdated) {AD166499-45F9-482A-A743-FDD3350758C7}

.
 

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.
 

C:\explorer.exe

c:\windows\system32\sda

c:\windows\system32\sda\SDPA7120.dll

C:\winlogon.exe
 

.

(((((((((((((((((((((((   Dateien erstellt von 2010-08-25 bis 2010-09-25  ))))))))))))))))))))))))))))))

.
 

2010-09-21 11:38 . 2010-09-21 11:38        179        ----a-w-        C:\virus.bat

2010-09-15 20:48 . 2010-09-15 20:48        724952        ----a-w-        C:\avenger.zip

2010-09-15 20:47 . 2010-09-15 20:47        1036800        ----a-w-        c:\windows\explorer.exe

2010-09-15 20:47 . 2010-09-15 20:47        513024        ----a-w-        c:\windows\system32\winlogon.exe

2010-09-15 19:39 . 2010-09-15 19:47        --------        d-----w-        C:\cofi19554c

2010-09-15 17:56 . 2010-09-15 18:03        --------        d-----w-        C:\cofi

2010-09-15 17:41 . 2010-09-15 17:41        --------        d-----w-        C:\_OTL

2010-09-13 20:52 . 2010-09-13 20:52        --------        d-----w-        c:\documents and settings\vvjj\Application Data\Malwarebytes

2010-09-13 20:52 . 2010-04-29 10:19        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys

2010-09-13 20:52 . 2010-09-13 20:52        --------        d-----w-        c:\documents and settings\All Users\Application Data\Malwarebytes

2010-09-13 20:52 . 2010-04-29 10:19        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys

2010-09-13 20:45 . 2010-09-13 20:52        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware

2010-09-05 19:19 . 2010-09-05 19:19        --------        d-----w-        c:\program files\Flip Video

2010-09-05 19:04 . 2010-09-05 19:04        --------        d-----w-        c:\documents and settings\All Users\Application Data\Flip Video

2010-09-03 18:00 . 2010-09-22 17:55        --------        d-----w-        c:\documents and settings\vvjj\Application Data\vlc

2010-09-03 17:59 . 2010-09-03 17:59        --------        d-----w-        c:\program files\VideoLAN

2010-08-30 18:47 . 2010-09-13 20:35        --------        d-----w-        c:\program files\eMule

2010-08-29 07:10 . 2010-08-29 07:10        --------        d-----w-        c:\documents and settings\All Users\Application Data\McAfee
 

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-09-21 14:21 . 2009-06-11 08:59        --------        d-----w-        c:\documents and settings\vvjj\Application Data\uTorrent

2010-09-18 14:16 . 2009-05-31 11:07        --------        d-----w-        c:\documents and settings\vvjj\Application Data\Media Player Classic

2010-09-15 17:52 . 2009-05-19 17:05        --------        d-----w-        c:\program files\CCleaner

2010-09-03 17:48 . 2009-08-04 20:43        --------        d-----w-        c:\documents and settings\vvjj\Application Data\DivX

2010-09-02 11:31 . 2009-12-01 21:52        --------        d-----w-        c:\documents and settings\All Users\Application Data\Storm

2010-08-27 22:55 . 2009-05-25 16:57        --------        d-----w-        c:\documents and settings\vvjj\Application Data\SogouPY

2010-08-17 13:17 . 2008-04-14 12:00        58880        ----a-w-        c:\windows\system32\spoolsv.exe

2010-07-29 21:48 . 2010-07-29 21:48        --------        d-----w-        c:\program files\QMI

2010-07-29 21:48 . 2009-05-20 22:36        --------        d--h--w-        c:\program files\InstallShield Installation Information

2010-07-22 15:49 . 2008-04-14 12:00        590848        ----a-w-        c:\windows\system32\rpcrt4.dll

2010-07-22 05:57 . 2009-05-20 15:57        5120        ----a-w-        c:\windows\system32\xpsp4res.dll

2010-07-08 18:48 . 2010-07-08 18:48        98304        ----a-w-        c:\windows\system32\CmdLineExt.dll

2010-06-30 12:31 . 2008-04-14 12:00        149504        ----a-w-        c:\windows\system32\schannel.dll

.
 

------- Sigcheck -------
 

[7] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys

[7] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\system32\dllcache\tcpip.sys

[-] 2008-06-20 . EEC9730F9CC03819111D90E6CAA2DCC9 . 361600 . . [5.1.2600.5625] . . c:\windows\system32\drivers\tcpip.sys

[7] 2008-04-14 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB951748$\tcpip.sys
 

[-] 2010-09-15 . F09A527B422E25C478E38CAA0E44417A . 513024 . . [5.1.2600.5512] . . c:\windows\system32\winlogon.exe
 

[-] 2010-09-15 . 418045A93CD87A352098AB7DABE1B53E . 1036800 . . [6.00.2900.5512] . . c:\windows\explorer.exe

.

(((((((((((((((((((((((((((((   SnapShot@2010-09-15_18.01.38   )))))))))))))))))))))))))))))))))))))))))

.

+ 2010-09-25 03:09 . 2010-09-25 03:09        16384              c:\windows\temp\Perflib_Perfdata_1dc.dat

- 2009-05-19 22:32 . 2010-02-22 14:23        17272              c:\windows\system32\spmsg.dll

+ 2009-05-19 22:32 . 2009-05-26 09:01        17272              c:\windows\system32\spmsg.dll

+ 2008-04-14 12:00 . 2010-08-17 13:17        58880              c:\windows\system32\dllcache\spoolsv.exe

- 2008-04-14 12:00 . 2008-04-14 12:00        293376              c:\windows\system32\winsrv.dll

+ 2008-04-14 12:00 . 2010-06-18 17:45        293376              c:\windows\system32\winsrv.dll

+ 2008-04-14 12:00 . 2010-04-16 15:36        406016              c:\windows\system32\usp10.dll

- 2008-04-14 12:00 . 2008-04-14 12:00        406016              c:\windows\system32\usp10.dll

+ 2008-04-14 12:00 . 2010-04-05 09:54        384512              c:\windows\system32\mp4sdmod.dll

- 2008-04-14 12:00 . 2008-04-14 12:00        384512              c:\windows\system32\mp4sdmod.dll

+ 2009-05-19 16:52 . 2010-06-09 07:43        692736              c:\windows\system32\inetcomm.dll

- 2008-04-14 12:00 . 2008-04-14 12:00        293376              c:\windows\system32\dllcache\winsrv.dll

+ 2008-04-14 12:00 . 2010-06-18 17:45        293376              c:\windows\system32\dllcache\winsrv.dll

- 2008-04-14 12:00 . 2008-04-14 12:00        406016              c:\windows\system32\dllcache\usp10.dll

+ 2008-04-14 12:00 . 2010-04-16 15:36        406016              c:\windows\system32\dllcache\usp10.dll

+ 2008-04-14 12:00 . 2010-07-22 15:49        590848              c:\windows\system32\dllcache\rpcrt4.dll

+ 2008-04-14 12:00 . 2010-04-05 09:54        384512              c:\windows\system32\dllcache\mp4sdmod.dll

- 2008-04-14 12:00 . 2008-04-14 12:00        384512              c:\windows\system32\dllcache\mp4sdmod.dll

+ 2009-05-19 16:52 . 2010-06-09 07:43        692736              c:\windows\system32\dllcache\inetcomm.dll

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4
 

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]

2009-04-02 10:47        333192        ----a-w-        c:\program files\AskBarDis\bar\bin\askBar.dll
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2009-04-02 333192]
 

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]

[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
 

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2009-04-02 333192]
 

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]

[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-06-17 150040]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-06-17 170520]

"Persistence"="c:\windows\system32\igfxpers.exe" [2008-06-17 141848]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

"RTHDCPL"="RTHDCPL.EXE" [2008-05-16 16862720]

"AzMixerSel"="c:\program files\Realtek\Audio\InstallShield\AzMixerSel.exe" [2006-07-18 53248]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-08-14 149280]

"UpdatePPShortCut"="c:\program files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" [2008-12-03 218408]

"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-04-12 1135912]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\PokerStrategy\\PokerStrategy Equilator\\Equilator.exe"=

"c:\\Program Files\\uTorrent\\uTorrent.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"c:\\Program Files\\Google\\Google Talk\\googletalk.exe"=

"e:\\World of Warcraft\\WoW-3.2.0-deDE-downloader.exe"=

"e:\\World of Warcraft\\Launcher.exe"=

"e:\\World of Warcraft\\WoW-3.2.0.10192-to-3.2.0.10314-deDE-downloader.exe"=

"e:\\World of Warcraft\\WoW-3.2.0.10314-to-3.2.2.10482-deDE-downloader.exe"=

"e:\\World of Warcraft\\WoW-3.2.2.10482-to-3.2.2.10505-deDE-downloader.exe"=

"c:\\WINDOWS\\system32\\PnkBstrA.exe"=

"c:\\WINDOWS\\system32\\PnkBstrB.exe"=

"c:\\Documents and Settings\\vvjj\\My Documents\\Downloads\\qq2009sp6_installer.exe"=

"c:\\Program Files\\Tencent\\QQ\\Bin\\QQ.exe"=

"c:\\Program Files\\Tencent\\QQ\\Bin\\auclt.exe"=

"c:\\spiele\\Qianhong\\Qianhong.exe"=

"e:\\Diablo\\diablo.exe"=

"c:\\Program Files\\SogouInput\\5.0.1.4185\\PinyinUp.exe"=
 

R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [19.05.2009 19:33 108289]

R2 pgsql-8.3;PostgreSQL Database Server 8.3;c:\program files\PostgreSQL\8.3\bin\pg_ctl.exe [01.02.2008 04:02 65536]

R3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI Service;c:\windows\system32\drivers\IntcHdmi.sys [19.05.2009 19:02 108032]

R3 O2MDRDR;O2MDRDR;c:\windows\system32\drivers\o2media.sys [21.05.2009 00:59 51288]

R3 O2SDRDR;O2SDRDR;c:\windows\system32\drivers\o2sd.sys [21.05.2009 00:37 43608]

S2 ASKUpgrade;ASKUpgrade;c:\program files\AskBarDis\bar\bin\ASKUpgrade.exe [11.06.2009 11:00 234888]

S3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [21.08.2009 23:39 8704]

S3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [21.08.2009 23:39 3072]

S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [08.06.2010 20:04 691696]

.

Inhalt des "geplante Tasks" Ordners
 

2010-09-25 c:\windows\Tasks\SogouImeMgr.job

- c:\progra~1\SOGOUI~1\501~1.418\SGTool.exe [2010-06-25 13:10]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = 

mLocal Page = 

uSearchURL,(Default) = hxxp://toolbar.ask.com/toolbarv/askRedirect?o=13925&gct=&gc=1&q=%s

IE: ???QQ?? - c:\program files\Tencent\QQ\Bin\AddEmotion.htm

TCP: {3BB7F6C7-0862-4303-A207-4C8B05C3659B} = 202.96.69.38 202.96.64.68

DPF: {3D8F74EE-8692-4F8F-B8D2-7522E732519E} - hxxp://game-web.qq.com/client/QQGame2.cab

FF - ProfilePath - c:\documents and settings\vvjj\Application Data\Mozilla\Firefox\Profiles\opx683lu.default\

FF - component: c:\documents and settings\vvjj\Application Data\Mozilla\Firefox\Profiles\opx683lu.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\FFExternalAlert.dll

FF - component: c:\documents and settings\vvjj\Application Data\Mozilla\Firefox\Profiles\opx683lu.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\RadioWMPCore.dll

FF - plugin: c:\documents and settings\All Users\Application Data\id Software\QuakeLive\npquakezero.dll

FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
 

---- FIREFOX Richtlinien ----

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true); 

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true); 

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);

.

.

------- Dateityp-Verknüpfung -------

.

txtfile=c:\windows\notepad.exe %1

.
 

**************************************************************************
 

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net

Rootkit scan 2010-09-25 17:12

Windows 5.1.2600 Service Pack 3 NTFS
 

Scanne versteckte Prozesse... 
 

Scanne versteckte Autostarteinträge... 
 

Scanne versteckte Dateien... 
 

Scan erfolgreich abgeschlossen

versteckte Dateien: 0
 

**************************************************************************

.

--------------------- Gesperrte Registrierungsschluessel ---------------------
 

[HKEY_USERS\S-1-5-21-2025429265-299502267-1801674531-1003\Software\Microsoft\Internet Explorer\MenuExt\ûm*R0RQ*Q*hˆÅ`]

"contexts"=dword:00000002

@="c:\\Program Files\\Tencent\\QQ\\Bin\\AddEmotion.htm"
 

[HKEY_LOCAL_MACHINE\software\Microsoft\Internet Explorer\MenuExt\ûm*R0RQ*Q*hˆÅ`]

"contexts"=dword:00000002

@="c:\\Program Files\\Tencent\\QQ\\Bin\\AddEmotion.htm"

.

--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
 

- - - - - - - > 'winlogon.exe'(772)

c:\program files\Citrix\ICA Client\pnsson.dll

c:\windows\system32\igfxdev.dll
 

- - - - - - - > 'lsass.exe'(828)

c:\program files\Citrix\ICA Client\pnsson.dll

.

Zeit der Fertigstellung: 2010-09-25  17:14:24

ComboFix-quarantined-files.txt  2010-09-25 15:14

ComboFix2.txt  2010-09-15 19:47

ComboFix3.txt  2010-09-15 18:02
 

Vor Suchlauf: 5.759.598.592 bytes free

Nach Suchlauf: 5.747.945.472 bytes free
 

- - End Of File - - 044726E793154AC2AB60AFDEB4BD1D4A

--- --- ---

Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten. GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus

Anschließend den bootkit_remover herunterladen. Entpacke das Tool in einen eigenen Ordner auf dem Desktop und führe in diesem Ordner die Datei remove.exe aus.

Wenn Du Windows Vista oder Windows 7 verwendest, musst Du die remover.exe über ein Rechtsklick => als Administrator ausführen

Ein schwarzes Fenster wird sich öffnen und automatisch nach bösartigen Veränderungen im MBR suchen.
Poste dann bitte, ob es Veränderungen gibt und wenn ja in welchem device. Am besten alles posten was die remover.exe ausgibt.

Code:

GMER 1.0.15.15281 - hxxp://www.gmer.net

Rootkit scan 2010-09-27 06:01:30

Windows 5.1.2600 Service Pack 3

Running: ehnoqj1f.exe; Driver: C:\DOCUME~1\vvjj\LOCALS~1\Temp\kfldafod.sys
 
 

---- System - GMER 1.0.15 ----
 

SSDT  F7BCB23E                                                                                                            ZwCreateKey

SSDT  F7BCB234                                                                                                            ZwCreateThread

SSDT  F7BCB243                                                                                                            ZwDeleteKey

SSDT  F7BCB24D                                                                                                            ZwDeleteValueKey

SSDT  F7BCB252                                                                                                            ZwLoadKey

SSDT  F7BCB220                                                                                                            ZwOpenProcess

SSDT  F7BCB225                                                                                                            ZwOpenThread

SSDT  F7BCB25C                                                                                                            ZwReplaceKey

SSDT  F7BCB257                                                                                                            ZwRestoreKey

SSDT  F7BCB248                                                                                                            ZwSetValueKey

SSDT  F7BCB22F                                                                                                            ZwTerminateProcess
 

---- Registry - GMER 1.0.15 ----
 

Reg   HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC                                    

Reg   HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                 C:\Program Files\DAEMON Tools Lite\

Reg   HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                 0x00 0x00 0x00 0x00 ...

Reg   HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                 0

Reg   HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                              0xC0 0x2F 0x79 0x8F ...

Reg   HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001                           

Reg   HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                        0x20 0x01 0x00 0x00 ...

Reg   HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                     0xD4 0x85 0x87 0xE8 ...

Reg   HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0                      

Reg   HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                0x18 0xE4 0xAA 0x7A ...

Reg   HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)                

Reg   HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                     C:\Program Files\DAEMON Tools Lite\

Reg   HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                     0x00 0x00 0x00 0x00 ...

Reg   HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                     0

Reg   HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                  0xC0 0x2F 0x79 0x8F ...

Reg   HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)       

Reg   HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                            0x20 0x01 0x00 0x00 ...

Reg   HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                         0xD4 0x85 0x87 0xE8 ...

Reg   HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)  

Reg   HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                    0x18 0xE4 0xAA 0x7A ...
 

---- EOF - GMER 1.0.15 ----

OSAM Logfile:

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

hxxp://www.online-solutions.ru/en/

Saved at 14:27:05 on 27.09.2010
 

OS: Windows XP Professional Service Pack 3 (Build 2600)

Default Browser: Mozilla Corporation Firefox 3.6.10
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Common]

-----( %SystemRoot%\Tasks )-----

"SogouImeMgr.job" - "Sogou.com Inc." - C:\PROGRA~1\SOGOUI~1\501~1.418\SGTool.exe
 

[Control Panel Objects]

-----( %SystemRoot%\system32 )-----

"DivXControlPanelApplet.cpl" - "DivX, Inc." - C:\WINDOWS\system32\DivXControlPanelApplet.cpl

"infocardcpl.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\infocardcpl.cpl

"javacpl.cpl" - "Sun Microsystems, Inc." - C:\WINDOWS\system32\javacpl.cpl

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----

"Avira AntiVir Personal - Free Antivirus " - "Avira GmbH" - C:\PROGRA~1\Avira\ANTIVI~1\avconfig.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"amqysger" (amqysger) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\amqysger.sys  (Hidden registry entry, rootkit activity | File signed by Microsoft)

"avgio" (avgio) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avgio.sys

"avgntflt" (avgntflt) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avgntflt.sys

"avipbb" (avipbb) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avipbb.sys

"catchme" (catchme) - ? - C:\DOCUME~1\vvjj\LOCALS~1\Temp\catchme.sys  (File not found)

"Changer" (Changer) - ? - C:\WINDOWS\system32\drivers\Changer.sys  (File not found)

"epmntdrv" (epmntdrv) - ? - C:\WINDOWS\system32\epmntdrv.sys  (File found, but it contains no detailed information)

"EuGdiDrv" (EuGdiDrv) - ? - C:\WINDOWS\system32\EuGdiDrv.sys  (File found, but it contains no detailed information)

"i2omgmt" (i2omgmt) - ? - C:\WINDOWS\system32\drivers\i2omgmt.sys  (File not found)

"lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys  (File not found)

"PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys  (File not found)

"PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys  (File not found)

"PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys  (File not found)

"PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys  (File not found)

"PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys  (File not found)

"PQNTDrv" (PQNTDrv) - "PowerQuest Corporation" - C:\WINDOWS\system32\drivers\PQNTDrv.sys

"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\WINDOWS\System32\Drivers\PxHelp20.sys

"sptd" (sptd) - "Duplex Secure Ltd." - C:\WINDOWS\System32\Drivers\sptd.sys  (File is exclusively opened, access blocked)

"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\ssmdrv.sys

"TCP/IP Protocol Driver" (Tcpip) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\tcpip.sys

"WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys  (File not found)
 

[Explorer]

-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----

{89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll

-----( HKLM\Software\Classes\Protocols\Filter )-----

{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{42071714-76d4-11d1-8b24-00a0c9068ff3} "Display Panning CPL Extension" - ? - deskpan.dll  (File not found)

{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Encryption Context Menu" - ? -   (File not found | COM-object registry key not found)

{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll

{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shell extensions for file compression" - ? -   (File not found | COM-object registry key not found)

{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll

{e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll

{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - ? - C:\Program Files\WinRAR\rarext.dll
 

[Internet Explorer]

-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----

<binary data> "Ask Toolbar" - "Ask.com" - C:\Program Files\AskBarDis\bar\bin\askBar.dll

<binary data> "ITBarLayout" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_15" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_15.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab

{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} "Java Plug-in 1.6.0_15" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_15.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_15" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_15.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab

{B8BE5E93-A60C-4D26-A2DC-220313175592} "MSN Games - Installer" - "Microsoft Corporation" - C:\WINDOWS\Downloaded Program Files\Zintro.ocx / hxxp://cdn2.zone.msn.com/binFramework/v10/ZPAFramework.cab102118.cab

{3D8F74EE-8692-4F8F-B8D2-7522E732519E} "WebActivater Control" - "QQ" - C:\WINDOWS\system32\WEBACT~1.OCX / hxxp://game-web.qq.com/client/QQGame2.cab

{A4110378-789B-455F-AE86-3A1BFC402853} "ZPA_SHVL Object" - "Microsoft Corporation" - C:\WINDOWS\Downloaded Program Files\zpa_shvl.ocx / hxxp://zone.msn.com/bingame/zpagames/zpa_shvl.cab55579.cab

{8FFBE65D-2C9C-4669-84BD-5829DC0B603C} "{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}" - ? -   (File not found | COM-object registry key not found) / hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

"PartyPoker.com" - ? - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe

"PokerStars" - "PokerStars" - C:\Program Files\PokerStars\PokerStarsUpdate.exe

"Titan Poker" - ? - C:\Poker\Titan Poker\casino.exe

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----

<binary data> "Ask Toolbar" - "Ask.com" - C:\Program Files\AskBarDis\bar\bin\askBar.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

{201f27d4-3704-41d6-89c1-aa35e39143ed} "AskBar BHO" - "Ask.com" - C:\Program Files\AskBarDis\bar\bin\askBar.dll

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll

{E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
 

[Logon]

-----( %AllUsersProfile%\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\Documents and Settings\All Users\Start Menu\Programs\Startup\desktop.ini

-----( %UserProfile%\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\Documents and Settings\vvjj\Start Menu\Programs\Startup\desktop.ini

-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----

"DAEMON Tools Lite" - "DT Soft Ltd" - "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun

-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon )-----

"Shell" - "Microsoft Corporation" - C:\WINDOWS\Explorer.exe

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"Adobe ARM" - "Adobe Systems Incorporated" - "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

"avgnt" - "Avira GmbH" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

"AzMixerSel" - "Realtek Semiconductor Corp." - C:\Program Files\Realtek\Audio\InstallShield\AzMixerSel.exe

"DivXUpdate" - ? - "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW

"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Java\jre6\bin\jusched.exe"

"UpdatePPShortCut" - "CyberLink Corp." - "C:\Program Files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\PowerProducer" UpdateWithCreateOnce "Software\CyberLink\PowerProducer\5.0"
 

[Network Providers]

-----( HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order )-----

"Citrix Single Sign-on" - "Citrix Systems, Inc." - C:\Program Files\Citrix\ICA Client\pnsson.dll
 

[Print Monitors]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----

"Bullzip PDF Print Monitor" - "Bullzip" - C:\WINDOWS\system32\bzpdf.dll
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

".NET Runtime Optimization Service v2.0.50727_X86" (clr_optimization_v2.0.50727_32) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

"ASKUpgrade" (ASKUpgrade) - ? - C:\Program Files\AskBarDis\bar\bin\ASKUpgrade.exe  (File found, but it contains no detailed information)

"ASP.NET State Service" (aspnet_state) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe

"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\sched.exe

"Java Quick Starter" (JavaQuickStarterService) - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jqs.exe

"O2Micro Flash Memory Card Service" (o2flash) - "O2Micro International" - C:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe

"PnkBstrA" (PnkBstrA) - ? - C:\WINDOWS\system32\PnkBstrA.exe  (File found, but it contains no detailed information)

"PostgreSQL Database Server 8.3" (pgsql-8.3) - "PostgreSQL Global Development Group" - C:\Program Files\PostgreSQL\8.3\bin\pg_ctl.exe

"Windows CardSpace" (idsvc) - "Microsoft Corporation" - c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe

"Windows Presentation Foundation Font Cache 3.0.0.0" (FontCache3.0.0.0) - "Microsoft Corporation" - c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
 

[Winlogon]

-----( HKCU\Control Panel\IOProcs )-----

"MVB" - ? - mvfs32.dll  (File not found)
 

===[ Logfile end ]=========================================[ Logfile end ]===

--- --- ---
If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru
[/code]

MBR war OK.

Edit: Ok, und das Log vom Bootkit Remover?