Trojaner-Board - BOO/Sinowal.H entfernen

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - BOO/Sinowal.H entfernen (https://www.trojaner-board.de/97797-boo-sinowal-h-entfernen.html)

Dann erstmal Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Downloade Dir danach bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.

Doppelklick auf die MBRCheck.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Das Tool braucht nur wenige Sekunden.
Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.

Poste mir bitte den Inhalt des .txt Dokumentes

Bin gerade aus meinen Ostertagen zurück, werde morgen die Ergebnisse senden.

Hallo,
habe den GMER drei mal starten müssen, da er sich zweimal so aufgehengen hatte, daß ich den Computer neu starten mußte.

Jetzt, beim dritten mal hat es geklappt.
GMER Logfile:

Code:

GMER 1.0.15.15570 - GMER - Rootkit Detector and Remover

Rootkit scan 2011-05-04 20:20:32

Windows 5.1.2600 Service Pack 3 Harddisk2\DR2 -> \Device\Ide\IdeDeviceP0T0L0-3 WDC_WD1600AAJB-00J3A0 rev.01.03E01

Running: i7g54zzw.exe; Driver: C:\DOKUME~1\EILEEN~1\LOKALE~1\Temp\uxlyipog.sys
 
 

---- System - GMER 1.0.15 ----
 

SSDT     F8B27A76                                                                            ZwCreateKey

SSDT     F8B27A6C                                                                            ZwCreateThread

SSDT     F8B27A7B                                                                            ZwDeleteKey

SSDT     F8B27A85                                                                            ZwDeleteValueKey

SSDT     F8B27AA3                                                                            ZwLoadDriver

SSDT     F8B27A8A                                                                            ZwLoadKey

SSDT     F8B27A58                                                                            ZwOpenProcess

SSDT     F8B27A5D                                                                            ZwOpenThread

SSDT     F8B27A94                                                                            ZwReplaceKey

SSDT     F8B27A8F                                                                            ZwRestoreKey

SSDT     F8B27AA8                                                                            ZwSetSystemInformation

SSDT     F8B27A80                                                                            ZwSetValueKey

SSDT     F8B27A67                                                                            ZwTerminateProcess

SSDT     F8B27A62                                                                            ZwWriteVirtualMemory
 

---- Kernel code sections - GMER 1.0.15 ----
 

.text    C:\WINDOWS\system32\DRIVERS\nv4_mini.sys                                            section is writeable [0xF7C95360, 0x372FAD, 0xE8000020]

.text    C:\WINDOWS\system32\drivers\ACEDRV06.sys                                            section is writeable [0xBA64C000, 0x319AA, 0xE8000020]

.pklstb  C:\WINDOWS\system32\drivers\ACEDRV06.sys                                            entry point in ".pklstb" section [0xBA68F000]

.relo2   C:\WINDOWS\system32\drivers\ACEDRV06.sys                                            unknown last section [0xBA6AA000, 0x8E, 0x42000040]
 

---- User code sections - GMER 1.0.15 ----
 

.text    C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1212] kernel32.dll!DeviceIoControl                7C801629 7 Bytes  JMP 0060800C C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)

.text    C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1212] kernel32.dll!IsDebuggerPresent              7C813133 6 Bytes  JMP 0060794C C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)

.text    C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1212] ADVAPI32.dll!RegOpenKeyExW                  77DA6AAF 5 Bytes  JMP 00607CC8 C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)

.text    C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1212] ADVAPI32.dll!RegCloseKey                    77DA6C27 5 Bytes  JMP 00607950 C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)

.text    C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1212] ADVAPI32.dll!RegQueryValueExW               77DA6FFF 5 Bytes  JMP 00607E3C C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)

.text    C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1212] ADVAPI32.dll!RegCreateKeyExW                77DA776C 5 Bytes  JMP 00607A34 C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)

.text    C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1212] ADVAPI32.dll!RegOpenKeyExA                  77DA7852 5 Bytes  JMP 00607C90 C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)

.text    C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1212] ADVAPI32.dll!RegOpenKeyW                    77DA7946 5 Bytes  JMP 00607C64 C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)

.text    C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1212] ADVAPI32.dll!RegQueryValueExA               77DA7ABB 5 Bytes  JMP 00607E00 C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)

.text    C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1212] ADVAPI32.dll!RegEnumKeyExW                  77DA7BD9 5 Bytes  JMP 00607B6C C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)

.text    C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1212] ADVAPI32.dll!RegEnumValueW                  77DA7EED 5 Bytes  JMP 00607BF4 C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)

.text    C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1212] ADVAPI32.dll!RegSetValueExW                 77DAD767 7 Bytes  JMP 00607F24 C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)

.text    C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1212] ADVAPI32.dll!RegQueryValueW                 77DAD87A 5 Bytes  JMP 00607DCC C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)

.text    C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1212] ADVAPI32.dll!RegCreateKeyExA                77DAE9F4 5 Bytes  JMP 006079F0 C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)

.text    C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1212] ADVAPI32.dll!RegSetValueExA                 77DAEAE7 7 Bytes  JMP 00607EE8 C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)

.text    C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1212] ADVAPI32.dll!RegDeleteValueA                77DAECE5 5 Bytes  JMP 00607AD0 C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)

.text    C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1212] ADVAPI32.dll!RegDeleteValueW                77DAEDF1 5 Bytes  JMP 00607AFC C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)

.text    C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1212] ADVAPI32.dll!RegOpenKeyA                    77DAEFC8 5 Bytes  JMP 00607C38 C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)

.text    C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1212] ADVAPI32.dll!RegDeleteKeyA                  77DB42A0 5 Bytes  JMP 00607A78 C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)

.text    C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1212] ADVAPI32.dll!RegQueryInfoKeyA               77DB4332 5 Bytes  JMP 00607D00 C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)

.text    C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1212] ADVAPI32.dll!RegQueryInfoKeyW               77DB49CE 5 Bytes  JMP 00607D4C C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)

.text    C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1212] ADVAPI32.dll!RegEnumKeyExA                  77DB51B6 5 Bytes  JMP 00607B28 C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)

.text    C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1212] ADVAPI32.dll!RegDeleteKeyW                  77DB559B 5 Bytes  JMP 00607AA4 C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)

.text    C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1212] ADVAPI32.dll!RegFlushKey                    77DC4CE0 5 Bytes  JMP 00607974 C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)

.text    C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1212] ADVAPI32.dll!RegEnumValueA                  77DC9BBF 5 Bytes  JMP 00607BB0 C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)

.text    C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1212] ADVAPI32.dll!RegCreateKeyW                  77DCBA55 5 Bytes  JMP 006079C4 C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)

.text    C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1212] ADVAPI32.dll!RegQueryValueA                 77DCBB8D 5 Bytes  JMP 00607D98 C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)

.text    C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1212] ADVAPI32.dll!RegCreateKeyA                  77DCBCF3 5 Bytes  JMP 00607998 C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)

.text    C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1212] ADVAPI32.dll!RegSetValueA                   77DCC79E 5 Bytes  JMP 00607E78 C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)

.text    C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1212] ADVAPI32.dll!RegSetValueW                   77E06116 5 Bytes  JMP 00607EB0 C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)

.text    C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1212] USER32.dll!ChangeDisplaySettingsExA         7E37384E 5 Bytes  JMP 00607FB4 C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)

.text    C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1212] USER32.dll!ChangeDisplaySettingsExW         7E3A95BD 5 Bytes  JMP 00607FE0 C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)

.text    C:\PROGRA~1\THEKMP~1\KMPlayer.exe[1212] ole32.dll!CoCreateInstance                  774CF1AC 5 Bytes  JMP 00606EF4 C:\PROGRA~1\THEKMP~1\KMPlayer.exe (The KMPlayer/Pandora.TV)
 

---- Devices - GMER 1.0.15 ----
 

Device                                                                                       ACPI.sys (ACPI-Treiber für NT/Microsoft Corporation)
 

---- Registry - GMER 1.0.15 ----
 

Reg      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@DeviceNotSelectedTimeout  15

Reg      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@GDIProcessHandleQuota     10000

Reg      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@Spooler                   yes

Reg      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@swapdisk                  

Reg      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@TransmissionRetryTimeout  90

Reg      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@USERProcessHandleQuota    10000
 

---- Disk sectors - GMER 1.0.15 ----
 

Disk     \Device\Harddisk2\DR2                                                               PE file @ sector 312576730
 

---- EOF - GMER 1.0.15 ----

--- --- ---

Hier der OSAM log
OSAM Logfile:

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

Online Solutions. Complex Protection for Information Systems

Saved at 20:36:09 on 04.05.2011
 

OS: Windows XP Professional Service Pack 3 (Build 2600)

Default Browser: Mozilla Corporation Firefox 3.6.17
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Common]

-----( %SystemRoot%\Tasks )-----

"AppleSoftwareUpdate.job" - "Apple Inc." - C:\Programme\Apple Software Update\SoftwareUpdate.exe

"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe

"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe
 

[Control Panel Objects]

-----( %SystemRoot%\system32 )-----

"DivXControlPanelApplet.cpl" - "DivX, Inc." - C:\WINDOWS\system32\DivXControlPanelApplet.cpl

"infocardcpl.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\infocardcpl.cpl

"javacpl.cpl" - "Sun Microsystems, Inc." - C:\WINDOWS\system32\javacpl.cpl

"nvcpl.cpl" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvcpl.cpl

"nvtuicpl.cpl" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvtuicpl.cpl

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----

"Avira AntiVir Personal - Free Antivirus " - "Avira GmbH" - C:\PROGRA~1\Avira\ANTIVI~1\avconfig.cpl

"NokiaConnectionManager" - "Nokia" - C:\PROGRA~1\Nokia\NOKIAP~1\CONNEC~1.CPL

"QuickTime" - "Apple Inc." - C:\Programme\QuickTime\QTSystem\QuickTime.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"ACEDRV06" (ACEDRV06) - "Protect Software GmbH" - C:\WINDOWS\system32\drivers\ACEDRV06.sys

"AEGIS Protocol (IEEE 802.1x) v3.4.5.0" (AegisP) - "Meetinghouse Data Communications" - C:\WINDOWS\System32\DRIVERS\AegisP.sys

"avgio" (avgio) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avgio.sys

"avgntflt" (avgntflt) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avgntflt.sys

"avipbb" (avipbb) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avipbb.sys

"Changer" (Changer) - ? - C:\WINDOWS\system32\drivers\Changer.sys  (File not found)

"ElbyCDFL" (ElbyCDFL) - "SlySoft, Inc." - C:\WINDOWS\System32\Drivers\ElbyCDFL.sys

"ElbyCDIO Driver" (ElbyCDIO) - "Elaborate Bytes AG" - C:\WINDOWS\System32\Drivers\ElbyCDIO.sys

"i2omgmt" (i2omgmt) - ? - C:\WINDOWS\system32\drivers\i2omgmt.sys  (File not found)

"InCD File System" (InCDfs) - "Nero AG" - C:\WINDOWS\system32\drivers\InCDfs.sys

"InCD Reader" (incdrm) - "Nero AG" - C:\WINDOWS\system32\drivers\incdrm.sys

"InCDPass" (InCDPass) - "Nero AG" - C:\WINDOWS\System32\DRIVERS\InCDPass.sys

"InCDrec" (InCDrec) - "Nero AG" - C:\WINDOWS\system32\drivers\InCDrec.sys

"IPSEC-Treiber" (xpsec) - ? - C:\WINDOWS\system32\drivers\xpsec.sys  (File not found)

"lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys  (File not found)

"PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys  (File not found)

"PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys  (File not found)

"PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys  (File not found)

"PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys  (File not found)

"PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys  (File not found)

"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\WINDOWS\System32\Drivers\PxHelp20.sys

"SjyPkt" (SjyPkt) - ? - C:\WINDOWS\System32\Drivers\SjyPkt.sys  (File not found)

"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\ssmdrv.sys

"TCP/IP-Protokolltreiber" (xcpip) - ? - C:\WINDOWS\system32\drivers\xcpip.sys  (File not found)

"uxlyipog" (uxlyipog) - ? - C:\DOKUME~1\EILEEN~1\LOKALE~1\Temp\uxlyipog.sys  (Hidden registry entry, rootkit activity | File not found)

"WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys  (File not found)
 

[Explorer]

-----( HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{BDEADF00-C265-11d0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL

-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----

{89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{7D4D6379-F301-4311-BEBA-E26EB0561882} "NeroDigitalColumnHandler Class" - "Nero AG" - C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroDigitalExt.dll

{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Programme\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll

{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - ? - C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

-----( HKLM\Software\Classes\Protocols\Filter )-----

{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? - deskpan.dll  (File not found)

{1CDB2949-8F65-4355-8456-263E7C208A5D} "Desktop Explorer" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll

{1E9B04FB-F9E5-4718-997B-B8DA88302A47} "Desktop Explorer Menu" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll

{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Programme\iTunes\iTunesMiniPlayer.dll

{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? -   (File not found | COM-object registry key not found)

{B327765E-D724-4347-8B16-78AE18552FC3} "NeroDigitalIconHandler Class" - "Nero AG" - C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroDigitalExt.dll

{7F1CF152-04F8-453A-B34C-E609530A9DC8} "NeroDigitalPropSheetHandler Class" - "Nero AG" - C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroDigitalExt.dll

{416651E4-9C3C-11D9-8BDE-F66BAD1E3F3A} "Nokia Phone Browser" - "Nokia" - C:\Programme\Nokia\Nokia PC Suite 6\PhoneBrowser.dll

{1E9B04FB-F9E5-4718-997B-B8DA88302A48} "nView Desktop Context Menu" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll

{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - ? - C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

{087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - ? - C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

{63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - ? - C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

{3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - ? - C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

{0006F045-0000-0000-C000-000000000046} "Outlook-Dateisymbolerweiterung" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office\OLKFSTUB.DLL

{950FF917-7A57-46BC-8017-59D9BF474000} "Shell Extension for CDRW" - "Nero AG" - C:\Programme\Ahead\InCD\incdshx.dll

{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\shlext.dll

{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll

{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? -   (File not found | COM-object registry key not found)

{e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll

{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - ? - C:\Programme\WinRAR\rarext.dll  (File found, but it contains no detailed information)
 

[Internet Explorer]

-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----

<binary data> "Ask Toolbar" - "Ask.com" - C:\Programme\AskTBar\bar\1.bin\ASKTBAR.DLL

<binary data> "Google Toolbar" - "Google Inc." - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll

<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)

<binary data> "ITBarLayout" - ? -   (File not found | COM-object registry key not found)

-----( HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks )-----

{9CB65206-89C4-402c-BA80-02D8C59F9B1D} "{9CB65206-89C4-402c-BA80-02D8C59F9B1D}" - "Ask.com" - C:\Programme\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_23" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_23.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab

{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} "Java Plug-in 1.6.0_23" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_23.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_23" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_23.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab

{D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" - "Adobe Systems, Inc." - C:\WINDOWS\system32\Macromed\Flash\Flash10b.ocx / hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----

{FE063DB9-4EC0-403e-8DD8-394C54984B2C} "Ask Toolbar" - "Ask.com" - C:\Programme\AskTBar\bar\1.bin\ASKTBAR.DLL

<binary data> "Google Toolbar" - "Google Inc." - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "Adobe PDF Reader Link Helper" - "Adobe Systems Incorporated" - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

{9CB65201-89C4-402c-BA80-02D8C59F9B1D} "Ask Search Assistant BHO" - "Ask.com" - C:\Programme\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL

{FE063DB1-4EC0-403e-8DD8-394C54984B2C} "Ask Toolbar BHO" - "Ask.com" - C:\Programme\AskTBar\bar\1.bin\ASKTBAR.DLL

{AA58ED58-01DD-4d91-8333-CF10577473F7} "Google Toolbar Helper" - "Google Inc." - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll

{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} "Google Toolbar Notifier BHO" - "Google Inc." - C:\Programme\Google\GoogleToolbarNotifier\5.6.6209.1142\swg.dll

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jp2ssv.dll

{E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
 

[Logon]

-----( %AllUsersProfile%\Startmenü\Programme\Autostart )-----

"Belkin Wireless G Desktop Card Client Utility.lnk" - "Belkin" - C:\Programme\Belkin\F5D7000v7032\Belkinwcui.exe  (Shortcut exists | File exists)

"desktop.ini" - ? - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini

-----( %UserProfile%\Startmenü\Programme\Autostart )-----

"desktop.ini" - ? - C:\Dokumente und Einstellungen\Eileen Berg\Startmenü\Programme\Autostart\desktop.ini

-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----

"ccleaner" - "Piriform Ltd" - "C:\Programme\CCleaner\CCleaner.exe" /AUTO

"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}" - "Nero AG" - "C:\Programme\Gemeinsame Dateien\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020

"PcSync" - "Time Information Services Ltd." - C:\Programme\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog

"swg" - "Google Inc." - "C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"avgnt" - "Avira GmbH" - "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min

"InCD" - "Nero AG" - C:\Programme\Ahead\InCD\InCD.exe

"NBKeyScan" - ? - "C:\Programme\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"  (File not found)

"NeroFilterCheck" - "Ahead Software Gmbh" - C:\WINDOWS\system32\NeroCheck.exe

"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe"
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

".NET Runtime Optimization Service v2.0.50727_X86" (clr_optimization_v2.0.50727_32) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

"ASP.NET State Service" (aspnet_state) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe

"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avguard.exe

"Avira AntiVir MailGuard" (AntiVirMailService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avmailc.exe

"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\sched.exe

"Avira AntiVir WebGuard" (AntiVirWebService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\AVWEBGRD.EXE

"Bonjour-Dienst" (Bonjour Service) - "Apple Inc." - C:\Programme\Bonjour\mDNSResponder.exe

"Firebird Server - MAGIX Instance" (FirebirdServerMAGIXInstance) - "MAGIX®" - D:\Common\Database\bin\fbserver.exe

"Google Software Updater" (gusvc) - "Google" - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe

"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe

"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe

"InCD Helper" (InCDsrv) - "Nero AG" - C:\Programme\Ahead\InCD\InCDsrv.exe

"InCD Helper (read only)" (InCDsrvR) - "Nero AG" - C:\Programme\Ahead\InCD\InCDsrv.exe

"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Programme\iPod\bin\iPodService.exe

"Java Quick Starter" (JavaQuickStarterService) - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jqs.exe

"NMIndexingService" (NMIndexingService) - "Nero AG" - C:\Programme\Gemeinsame Dateien\Nero\Lib\NMIndexingService.exe

"ServiceLayer" (ServiceLayer) - "Nokia." - C:\Programme\Gemeinsame Dateien\PCSuite\Services\ServiceLayer.exe

"Windows CardSpace" (idsvc) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe

"Windows Presentation Foundation Font Cache 3.0.0.0" (FontCache3.0.0.0) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
 

[Winlogon]

-----( HKCU\Control Panel\IOProcs )-----

"MVB" - ? - mvfs32.dll  (File not found)
 

[Winsock Providers]

-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----

"mdnsNSP" - "Apple Inc." - C:\Programme\Bonjour\mdnsNSP.dll

-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries )-----

"AVSDA" - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avsda.dll
 

===[ Logfile end ]=========================================[ Logfile end ]===

--- --- ---
If You have questions or want to get some help, You can visit Online Solutions :: Index

Hier der OSAM log

OSAM Logfile:

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

Online Solutions. Complex Protection for Information Systems

Saved at 20:36:09 on 04.05.2011
 

OS: Windows XP Professional Service Pack 3 (Build 2600)

Default Browser: Mozilla Corporation Firefox 3.6.17
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Common]

-----( %SystemRoot%\Tasks )-----

"AppleSoftwareUpdate.job" - "Apple Inc." - C:\Programme\Apple Software Update\SoftwareUpdate.exe

"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe

"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe
 

[Control Panel Objects]

-----( %SystemRoot%\system32 )-----

"DivXControlPanelApplet.cpl" - "DivX, Inc." - C:\WINDOWS\system32\DivXControlPanelApplet.cpl

"infocardcpl.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\infocardcpl.cpl

"javacpl.cpl" - "Sun Microsystems, Inc." - C:\WINDOWS\system32\javacpl.cpl

"nvcpl.cpl" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvcpl.cpl

"nvtuicpl.cpl" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvtuicpl.cpl

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----

"Avira AntiVir Personal - Free Antivirus " - "Avira GmbH" - C:\PROGRA~1\Avira\ANTIVI~1\avconfig.cpl

"NokiaConnectionManager" - "Nokia" - C:\PROGRA~1\Nokia\NOKIAP~1\CONNEC~1.CPL

"QuickTime" - "Apple Inc." - C:\Programme\QuickTime\QTSystem\QuickTime.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"ACEDRV06" (ACEDRV06) - "Protect Software GmbH" - C:\WINDOWS\system32\drivers\ACEDRV06.sys

"AEGIS Protocol (IEEE 802.1x) v3.4.5.0" (AegisP) - "Meetinghouse Data Communications" - C:\WINDOWS\System32\DRIVERS\AegisP.sys

"avgio" (avgio) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avgio.sys

"avgntflt" (avgntflt) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avgntflt.sys

"avipbb" (avipbb) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avipbb.sys

"Changer" (Changer) - ? - C:\WINDOWS\system32\drivers\Changer.sys  (File not found)

"ElbyCDFL" (ElbyCDFL) - "SlySoft, Inc." - C:\WINDOWS\System32\Drivers\ElbyCDFL.sys

"ElbyCDIO Driver" (ElbyCDIO) - "Elaborate Bytes AG" - C:\WINDOWS\System32\Drivers\ElbyCDIO.sys

"i2omgmt" (i2omgmt) - ? - C:\WINDOWS\system32\drivers\i2omgmt.sys  (File not found)

"InCD File System" (InCDfs) - "Nero AG" - C:\WINDOWS\system32\drivers\InCDfs.sys

"InCD Reader" (incdrm) - "Nero AG" - C:\WINDOWS\system32\drivers\incdrm.sys

"InCDPass" (InCDPass) - "Nero AG" - C:\WINDOWS\System32\DRIVERS\InCDPass.sys

"InCDrec" (InCDrec) - "Nero AG" - C:\WINDOWS\system32\drivers\InCDrec.sys

"IPSEC-Treiber" (xpsec) - ? - C:\WINDOWS\system32\drivers\xpsec.sys  (File not found)

"lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys  (File not found)

"PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys  (File not found)

"PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys  (File not found)

"PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys  (File not found)

"PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys  (File not found)

"PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys  (File not found)

"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\WINDOWS\System32\Drivers\PxHelp20.sys

"SjyPkt" (SjyPkt) - ? - C:\WINDOWS\System32\Drivers\SjyPkt.sys  (File not found)

"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\ssmdrv.sys

"TCP/IP-Protokolltreiber" (xcpip) - ? - C:\WINDOWS\system32\drivers\xcpip.sys  (File not found)

"uxlyipog" (uxlyipog) - ? - C:\DOKUME~1\EILEEN~1\LOKALE~1\Temp\uxlyipog.sys  (Hidden registry entry, rootkit activity | File not found)

"WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys  (File not found)
 

[Explorer]

-----( HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{BDEADF00-C265-11d0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL

-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----

{89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{7D4D6379-F301-4311-BEBA-E26EB0561882} "NeroDigitalColumnHandler Class" - "Nero AG" - C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroDigitalExt.dll

{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Programme\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll

{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - ? - C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

-----( HKLM\Software\Classes\Protocols\Filter )-----

{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? - deskpan.dll  (File not found)

{1CDB2949-8F65-4355-8456-263E7C208A5D} "Desktop Explorer" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll

{1E9B04FB-F9E5-4718-997B-B8DA88302A47} "Desktop Explorer Menu" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll

{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Programme\iTunes\iTunesMiniPlayer.dll

{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? -   (File not found | COM-object registry key not found)

{B327765E-D724-4347-8B16-78AE18552FC3} "NeroDigitalIconHandler Class" - "Nero AG" - C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroDigitalExt.dll

{7F1CF152-04F8-453A-B34C-E609530A9DC8} "NeroDigitalPropSheetHandler Class" - "Nero AG" - C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroDigitalExt.dll

{416651E4-9C3C-11D9-8BDE-F66BAD1E3F3A} "Nokia Phone Browser" - "Nokia" - C:\Programme\Nokia\Nokia PC Suite 6\PhoneBrowser.dll

{1E9B04FB-F9E5-4718-997B-B8DA88302A48} "nView Desktop Context Menu" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll

{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - ? - C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

{087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - ? - C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

{63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - ? - C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

{3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - ? - C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

{0006F045-0000-0000-C000-000000000046} "Outlook-Dateisymbolerweiterung" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office\OLKFSTUB.DLL

{950FF917-7A57-46BC-8017-59D9BF474000} "Shell Extension for CDRW" - "Nero AG" - C:\Programme\Ahead\InCD\incdshx.dll

{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\shlext.dll

{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll

{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? -   (File not found | COM-object registry key not found)

{e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll

{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - ? - C:\Programme\WinRAR\rarext.dll  (File found, but it contains no detailed information)
 

[Internet Explorer]

-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----

<binary data> "Ask Toolbar" - "Ask.com" - C:\Programme\AskTBar\bar\1.bin\ASKTBAR.DLL

<binary data> "Google Toolbar" - "Google Inc." - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll

<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)

<binary data> "ITBarLayout" - ? -   (File not found | COM-object registry key not found)

-----( HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks )-----

{9CB65206-89C4-402c-BA80-02D8C59F9B1D} "{9CB65206-89C4-402c-BA80-02D8C59F9B1D}" - "Ask.com" - C:\Programme\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_23" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_23.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab

{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} "Java Plug-in 1.6.0_23" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_23.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_23" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_23.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab

{D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" - "Adobe Systems, Inc." - C:\WINDOWS\system32\Macromed\Flash\Flash10b.ocx / hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----

{FE063DB9-4EC0-403e-8DD8-394C54984B2C} "Ask Toolbar" - "Ask.com" - C:\Programme\AskTBar\bar\1.bin\ASKTBAR.DLL

<binary data> "Google Toolbar" - "Google Inc." - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "Adobe PDF Reader Link Helper" - "Adobe Systems Incorporated" - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

{9CB65201-89C4-402c-BA80-02D8C59F9B1D} "Ask Search Assistant BHO" - "Ask.com" - C:\Programme\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL

{FE063DB1-4EC0-403e-8DD8-394C54984B2C} "Ask Toolbar BHO" - "Ask.com" - C:\Programme\AskTBar\bar\1.bin\ASKTBAR.DLL

{AA58ED58-01DD-4d91-8333-CF10577473F7} "Google Toolbar Helper" - "Google Inc." - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll

{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} "Google Toolbar Notifier BHO" - "Google Inc." - C:\Programme\Google\GoogleToolbarNotifier\5.6.6209.1142\swg.dll

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jp2ssv.dll

{E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
 

[Logon]

-----( %AllUsersProfile%\Startmenü\Programme\Autostart )-----

"Belkin Wireless G Desktop Card Client Utility.lnk" - "Belkin" - C:\Programme\Belkin\F5D7000v7032\Belkinwcui.exe  (Shortcut exists | File exists)

"desktop.ini" - ? - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini

-----( %UserProfile%\Startmenü\Programme\Autostart )-----

"desktop.ini" - ? - C:\Dokumente und Einstellungen\Eileen Berg\Startmenü\Programme\Autostart\desktop.ini

-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----

"ccleaner" - "Piriform Ltd" - "C:\Programme\CCleaner\CCleaner.exe" /AUTO

"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}" - "Nero AG" - "C:\Programme\Gemeinsame Dateien\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020

"PcSync" - "Time Information Services Ltd." - C:\Programme\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog

"swg" - "Google Inc." - "C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"avgnt" - "Avira GmbH" - "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min

"InCD" - "Nero AG" - C:\Programme\Ahead\InCD\InCD.exe

"NBKeyScan" - ? - "C:\Programme\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"  (File not found)

"NeroFilterCheck" - "Ahead Software Gmbh" - C:\WINDOWS\system32\NeroCheck.exe

"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe"
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

".NET Runtime Optimization Service v2.0.50727_X86" (clr_optimization_v2.0.50727_32) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

"ASP.NET State Service" (aspnet_state) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe

"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avguard.exe

"Avira AntiVir MailGuard" (AntiVirMailService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avmailc.exe

"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\sched.exe

"Avira AntiVir WebGuard" (AntiVirWebService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\AVWEBGRD.EXE

"Bonjour-Dienst" (Bonjour Service) - "Apple Inc." - C:\Programme\Bonjour\mDNSResponder.exe

"Firebird Server - MAGIX Instance" (FirebirdServerMAGIXInstance) - "MAGIX®" - D:\Common\Database\bin\fbserver.exe

"Google Software Updater" (gusvc) - "Google" - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe

"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe

"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe

"InCD Helper" (InCDsrv) - "Nero AG" - C:\Programme\Ahead\InCD\InCDsrv.exe

"InCD Helper (read only)" (InCDsrvR) - "Nero AG" - C:\Programme\Ahead\InCD\InCDsrv.exe

"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Programme\iPod\bin\iPodService.exe

"Java Quick Starter" (JavaQuickStarterService) - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jqs.exe

"NMIndexingService" (NMIndexingService) - "Nero AG" - C:\Programme\Gemeinsame Dateien\Nero\Lib\NMIndexingService.exe

"ServiceLayer" (ServiceLayer) - "Nokia." - C:\Programme\Gemeinsame Dateien\PCSuite\Services\ServiceLayer.exe

"Windows CardSpace" (idsvc) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe

"Windows Presentation Foundation Font Cache 3.0.0.0" (FontCache3.0.0.0) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
 

[Winlogon]

-----( HKCU\Control Panel\IOProcs )-----

"MVB" - ? - mvfs32.dll  (File not found)
 

[Winsock Providers]

-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----

"mdnsNSP" - "Apple Inc." - C:\Programme\Bonjour\mdnsNSP.dll

-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries )-----

"AVSDA" - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avsda.dll
 

===[ Logfile end ]=========================================[ Logfile end ]===

--- --- ---

If You have questions or want to get some help, You can visit Online Solutions :: Index

Was ist mit mbrcheck?

Habs noch schnell ausgeführt!!!!!!!

Hier das Ergebniss:
MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Professional
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x000018fd

Kernel Drivers (total 137):
0x804D7000 \WINDOWS\system32\ntoskrnl.exe
0x806EF000 \WINDOWS\system32\hal.dll
0xF8A35000 \WINDOWS\system32\KDCOM.DLL
0xF8945000 \WINDOWS\system32\BOOTVID.dll
0xF84E5000 ACPI.sys
0xF8A37000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xF84D4000 pci.sys
0xF8535000 isapnp.sys
0xF8A39000 intelide.sys
0xF87B5000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xF8545000 MountMgr.sys
0xF84B5000 ftdisk.sys
0xF8A3B000 dmload.sys
0xF848F000 dmio.sys
0xF87BD000 PartMgr.sys
0xF8555000 VolSnap.sys
0xF847C000 pnp680r.sys
0xF8464000 \WINDOWS\system32\DRIVERS\SCSIPORT.SYS
0xF844C000 atapi.sys
0xF8565000 disk.sys
0xF8575000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xF842C000 fltmgr.sys
0xF841A000 sr.sys
0xF8585000 PxHelp20.sys
0xF8403000 KSecDD.sys
0xF8376000 Ntfs.sys
0xF8349000 NDIS.sys
0xF832F000 Mup.sys
0xF8595000 agp440.sys
0xF85B5000 \SystemRoot\system32\DRIVERS\p3.sys
0xF7C95000 \SystemRoot\system32\DRIVERS\nv4_mini.sys
0xF7C81000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xF7C36000 \SystemRoot\system32\DRIVERS\BLKWGDv7.sys
0xF87ED000 \SystemRoot\system32\DRIVERS\usbohci.sys
0xF7C12000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xF87F5000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xF880D000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xF881D000 \SystemRoot\system32\DRIVERS\fdc.sys
0xF7BFE000 \SystemRoot\system32\DRIVERS\parport.sys
0xF85D5000 \SystemRoot\system32\DRIVERS\serial.sys
0xF89CD000 \SystemRoot\system32\DRIVERS\serenum.sys
0xF882D000 \SystemRoot\System32\Drivers\ElbyCDFL.sys
0xF85E5000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xF85F5000 \SystemRoot\system32\DRIVERS\redbook.sys
0xF7BDB000 \SystemRoot\system32\DRIVERS\ks.sys
0xF8605000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
0xF8845000 \SystemRoot\System32\DRIVERS\InCDPass.sys
0xF884D000 \SystemRoot\System32\Drivers\incdrm.SYS
0xF8615000 \SystemRoot\system32\DRIVERS\imapi.sys
0xF885D000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0xF7BC3000 \SystemRoot\system32\drivers\ac97intc.sys
0xF7B9F000 \SystemRoot\system32\drivers\portcls.sys
0xF8625000 \SystemRoot\system32\drivers\drmk.sys
0xF8C2C000 \SystemRoot\system32\DRIVERS\audstub.sys
0xF8875000 \SystemRoot\system32\DRIVERS\rasirda.sys
0xF8885000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xF8635000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xF89F5000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xF7B88000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xF8645000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xF8655000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xF7B77000 \SystemRoot\system32\DRIVERS\psched.sys
0xF8665000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xF88A5000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xF88B5000 \SystemRoot\system32\DRIVERS\raspti.sys
0xF7B47000 \SystemRoot\system32\DRIVERS\rdpdr.sys
0xF8675000 \SystemRoot\system32\DRIVERS\termdd.sys
0xF88C5000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xF8A41000 \SystemRoot\system32\DRIVERS\swenum.sys
0xF7A21000 \SystemRoot\system32\DRIVERS\update.sys
0xF8A15000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xF8685000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xF8695000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xF8A45000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xF88E5000 \SystemRoot\system32\DRIVERS\flpydisk.sys
0xF8A49000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xF8B00000 \SystemRoot\System32\Drivers\Null.SYS
0xF8A4D000 \SystemRoot\System32\Drivers\Beep.SYS
0xF86B5000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0xF890D000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0xF8915000 \SystemRoot\System32\drivers\vga.sys
0xF8A51000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xF8A55000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xF82D6000 \SystemRoot\System32\Drivers\InCDrec.SYS
0xF68C0000 \SystemRoot\System32\Drivers\InCDfs.SYS
0xF8925000 \SystemRoot\System32\Drivers\Msfs.SYS
0xF8935000 \SystemRoot\System32\Drivers\Npfs.SYS
0xF89C5000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xF68AD000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xF6854000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xF682C000 \SystemRoot\system32\DRIVERS\netbt.sys
0xF6806000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xF86C5000 \SystemRoot\system32\DRIVERS\wanarp.sys
0xF89FD000 \SystemRoot\System32\drivers\ws2ifsl.sys
0xF67BC000 \SystemRoot\System32\drivers\afd.sys
0xF86D5000 \SystemRoot\system32\DRIVERS\netbios.sys
0xF87E5000 \SystemRoot\system32\DRIVERS\ssmdrv.sys
0xF6791000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xF6721000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xF86E5000 \SystemRoot\System32\Drivers\Fips.SYS
0xF66FB000 \SystemRoot\system32\DRIVERS\avipbb.sys
0xF8A5D000 \??\C:\Programme\Avira\AntiVir Desktop\avgio.sys
0xF7A19000 \SystemRoot\system32\DRIVERS\hidusb.sys
0xF8705000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0xF7A09000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0xF7A05000 \SystemRoot\system32\DRIVERS\mouhid.sys
0xF8715000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xF66C2000 \SystemRoot\System32\Drivers\Udfs.SYS
0xF66AA000 \SystemRoot\System32\Drivers\dump_atapi.sys
0xF8A63000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xF67FE000 \SystemRoot\System32\drivers\Dxapi.sys
0xF8855000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xF8C82000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF012000 \SystemRoot\System32\nv4_disp.dll
0xBF5E6000 \SystemRoot\System32\ATMFD.DLL
0xBA6D3000 \SystemRoot\system32\DRIVERS\avgntflt.sys
0xBA673000 \??\C:\WINDOWS\system32\drivers\ACEDRV06.sys
0xF88DD000 \SystemRoot\system32\DRIVERS\AegisP.sys
0xBA5BD000 \SystemRoot\system32\DRIVERS\irda.sys
0xBA5A7000 \SystemRoot\system32\DRIVERS\nwlnkipx.sys
0xF8795000 \SystemRoot\system32\DRIVERS\nwlnknb.sys
0xBA62F000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xBA377000 \SystemRoot\system32\DRIVERS\nwrdr.sys
0xF88BD000 \SystemRoot\System32\Drivers\TDTCP.SYS
0xBA32C000 \SystemRoot\System32\Drivers\RDPWD.SYS
0xF8A4F000 \SystemRoot\System32\Drivers\ParVdm.SYS
0xBA4B7000 \SystemRoot\System32\Drivers\ElbyCDIO.sys
0xBA2AC000 \SystemRoot\system32\DRIVERS\nwlnkspx.sys
0xBA144000 \SystemRoot\system32\DRIVERS\srv.sys
0xB9EAF000 \SystemRoot\system32\drivers\wdmaud.sys
0xBA00C000 \SystemRoot\system32\drivers\sysaudio.sys
0xB9AF8000 \SystemRoot\System32\Drivers\HTTP.sys
0xB8FEA000 \SystemRoot\system32\drivers\kmixer.sys
0xF888D000 \??\C:\DOKUME~1\******~1\LOKALE~1\Temp\mbr.sys
0x7C910000 \WINDOWS\system32\ntdll.dll

Processes (total 40):
0 System Idle Process
4 System
608 C:\WINDOWS\system32\smss.exe
660 csrss.exe
684 C:\WINDOWS\system32\winlogon.exe
728 C:\WINDOWS\system32\services.exe
740 C:\WINDOWS\system32\lsass.exe
900 C:\WINDOWS\system32\svchost.exe
980 svchost.exe
1024 C:\WINDOWS\system32\svchost.exe
1048 C:\Programme\Ahead\InCD\InCDsrv.exe
1308 svchost.exe
1340 svchost.exe
1580 C:\WINDOWS\system32\spoolsv.exe
1628 C:\Programme\Avira\AntiVir Desktop\sched.exe
1804 C:\Programme\Avira\AntiVir Desktop\avguard.exe
1824 C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
1848 C:\Programme\Bonjour\mDNSResponder.exe
1936 C:\Programme\Avira\AntiVir Desktop\avshadow.exe
1972 C:\Programme\Java\jre6\bin\jqs.exe
212 C:\WINDOWS\system32\nvsvc32.exe
1692 C:\WINDOWS\explorer.exe
1460 C:\Programme\Avira\AntiVir Desktop\avmailc.exe
1496 C:\Programme\Avira\AntiVir Desktop\avwebgrd.exe
2732 alg.exe
2832 C:\Programme\Avira\AntiVir Desktop\avgnt.exe
2932 C:\Programme\Ahead\InCD\InCD.exe
3008 C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
3100 C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
3160 C:\WINDOWS\system32\ctfmon.exe
3200 C:\Programme\Messenger\msmsgs.exe
3248 C:\Programme\Nokia\Nokia PC Suite 6\PcSync2.exe
3380 C:\Programme\Gemeinsame Dateien\Nero\Lib\NMIndexStoreSvr.exe
3916 C:\Programme\Belkin\F5D7000v7032\Belkinwcui.exe
2420 C:\PROGRA~1\GEMEIN~1\Nokia\MPAPI\MPAPI3s.exe
2428 C:\Programme\Gemeinsame Dateien\Nero\Lib\NMIndexingService.exe
528 C:\Programme\Gemeinsame Dateien\PCSuite\Services\ServiceLayer.exe
3152 C:\WINDOWS\system32\svchost.exe
2600 C:\Programme\Mozilla Firefox\firefox.exe
3872 C:\Dokumente und Einstellungen\***********\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive2 at offset 0x00000000`00007e00 (NTFS)
\\.\D: --> \\.\PhysicalDrive2 at offset 0x00000007`7fe09800 (NTFS)
\\.\E: --> \\.\PhysicalDrive2 at offset 0x0000000e`d2a67800 (NTFS)
\\.\F: --> \\.\PhysicalDrive2 at offset 0x0000001b`07994400 (NTFS)
\\.\G: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)
\\.\H: --> \\.\PhysicalDrive1 at offset 0x00000000`00007e00 (NTFS)

PhysicalDrive2 Model Number: WDCWD1600AAJB-00J3A0, Rev: 01.03E01
PhysicalDrive0 Model Number: ST3120022A, Rev: 8.54
PhysicalDrive1 Model Number: ST3120022A, Rev: 8.54

Size Device Name MBR Status
--------------------------------------------
149 GB \\.\PhysicalDrive2 Known-bad MBR code detected (Whistler / Black Internet)!
SHA1: 837BFB0D14AAC6B731E258D6EFB1EEDC92CA6581
111 GB \\.\PhysicalDrive0 RE: Windows XP MBR code detected
SHA1: ADFE55CD0C6ED2E00B22375835E4C2736CE9AD11
232 GB \\.\PhysicalDrive1 RE: Unknown MBR code
SHA1: BB91F7E34FF3754A41F2830964B0DA1B003BCA73

Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:

Zitat:

2011/04/21 21:28:39.0547 3696 Detected object count: 1
2011/04/21 21:34:34.0977 3696 Rootkit.Win32.BackBoot.gen(\HardDisk0) - User select action: Skip

Das seh ich ja jetzt erst!!
Wieso hast du da auf Skip gedrückt? Solche Funde musst du natürlich entfernen! Bitte umgehend nachholen! Führ den TDSS-Killer neu aus (neue Version davon runterladen, alte vorher löschen) und alle Funde entfernen!

Hallo,

Beim 1. Ausführen des TDSS-Killer war die funktion "cure" nicht ausführbar, daher habe ich das genommen was dort statt dessen stand: "skip".

Jetzt bei der 2. Ausführung war "cure" freigegebnen und ich konnte es ausführen. Das habe ich auch gemacht. Ergebniss: AntiVir zeigt mir keine Meldung mehr an. Auch Anti-Malware zeigt mir nichts an. Hier das log von Anti-Malware:

Malwarebytes' Anti-Malware 1.50.1.1100
Malwarebytes : Free anti-malware, anti-virus and spyware removal download

Datenbank Version: 6414

Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

06.05.2011 15:01:24
mbam-log-2011-05-06 (15-01-24).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 146152
Laufzeit: 7 Minute(n), 0 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

Starte Windows neu, lösch die alte cofi.exe, lade CF neu als cofi.exe runter und probier es bitte nochmal.

Cofi.exe hat dieses mal auch funktioniert, allerdings hat AntiVir trotz deaktivierung angeschlagen. Außerdem mußte ich nach dem Neustart AntiVir aufs neue deaktivieren und auch da hat es trotzdem angeschlagen. Ist das schlimm?

Hier das Log con cofi:
Combofix Logfile:

Code:

ComboFix 11-05-05.04 - ********** 06.05.2011  16:49:09.1.1 - x86

Microsoft Windows XP Professional  5.1.2600.3.1252.49.1031.18.511.204 [GMT 2:00]

ausgeführt von:: c:\dokumente und einstellungen\**********\Desktop\cofi.exe

AV: AntiVir Desktop *Disabled/Updated* {C19476D9-52BC-4E93-8AF3-CCF59F7AE8FE}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\dokumente und einstellungen\**********\WINDOWS

.

.

(((((((((((((((((((((((   Dateien erstellt von 2011-04-06 bis 2011-05-06  ))))))))))))))))))))))))))))))

.

.

2011-05-06 15:06 . 2011-05-06 15:06        0        ---ha-w-        c:\dokumente und einstellungen\***********\Lokale Einstellungen\Anwendungsdaten\BIT7.tmp

2011-05-06 15:06 . 2011-05-06 15:06        0        ---ha-w-        c:\dokumente und einstellungen\**********\Lokale Einstellungen\Anwendungsdaten\BIT6.tmp

2011-04-21 18:52 . 2011-04-21 18:52        --------        d-----w-        c:\dokumente und einstellungen\***********\Anwendungsdaten\Malwarebytes

2011-04-21 18:52 . 2010-12-20 16:09        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys

2011-04-21 18:51 . 2011-04-21 18:51        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes

2011-04-21 18:51 . 2010-12-20 16:08        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys

2011-04-21 18:51 . 2011-04-21 18:52        --------        d-----w-        c:\programme\Malwarebytes' Anti-Malware

2011-04-20 18:53 . 2011-04-20 18:53        --------        d-----w-        c:\dokumente und einstellungen\LocalService\Anwendungsdaten\Avira

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-04-22 12:02 . 2011-04-22 12:02        9067        -c--a-w-        C:\Qoobox.zip

2011-04-20 21:07 . 2009-09-11 07:32        45416        ----a-w-        c:\windows\system32\drivers\avgntdd.sys

2011-04-20 21:07 . 2009-09-11 07:32        22360        ----a-w-        c:\windows\system32\drivers\avgntmgr.sys

2011-03-19 21:43 . 2009-09-11 07:32        137656        ----a-w-        c:\windows\system32\drivers\avipbb.sys

2011-03-07 05:33 . 2009-03-23 15:22        692736        ----a-w-        c:\windows\system32\inetcomm.dll

2011-03-04 06:44 . 2002-12-31 12:00        434176        ----a-w-        c:\windows\system32\vbscript.dll

2011-03-03 13:53 . 2002-12-31 12:00        1858048        ----a-w-        c:\windows\system32\win32k.sys

2011-02-17 18:56 . 2002-12-31 12:00        832512        ----a-w-        c:\windows\system32\wininet.dll

2011-02-17 18:56 . 2002-12-31 12:00        1830912        ----a-w-        c:\windows\system32\inetcpl.cpl

2011-02-17 18:56 . 2002-12-31 12:00        78336        ----a-w-        c:\windows\system32\ieencode.dll

2011-02-17 18:56 . 2002-12-31 12:00        17408        ----a-w-        c:\windows\system32\corpol.dll

2011-02-17 13:18 . 2002-12-31 12:00        455936        ----a-w-        c:\windows\system32\drivers\mrxsmb.sys

2011-02-17 13:18 . 2002-12-31 12:00        357888        ----a-w-        c:\windows\system32\drivers\srv.sys

2011-02-17 12:54 . 2008-05-05 05:25        5632        ----a-w-        c:\windows\system32\xpsp4res.dll

2011-02-17 11:44 . 2002-12-31 12:00        389120        ----a-w-        c:\windows\system32\html.iec

2011-02-15 12:56 . 2002-12-31 12:00        290432        ----a-w-        c:\windows\system32\atmfd.dll

2011-02-09 13:53 . 2002-12-31 12:00        270848        ----a-w-        c:\windows\system32\sbe.dll

2011-02-09 13:53 . 2002-12-31 12:00        186880        ----a-w-        c:\windows\system32\encdec.dll

2011-02-08 13:33 . 2002-12-31 12:00        978944        ----a-w-        c:\windows\system32\mfc42.dll

2011-02-08 13:33 . 2002-12-31 12:00        974848        ----a-w-        c:\windows\system32\mfc42u.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{9CB65206-89C4-402c-BA80-02D8C59F9B1D}"= "c:\programme\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL" [2011-01-27 57344]

.

[HKEY_CLASSES_ROOT\clsid\{9cb65206-89c4-402c-ba80-02d8c59f9b1d}]

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"swg"="c:\programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-09 39408]

"PcSync"="c:\programme\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-06-27 1449984]

"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\programme\Gemeinsame Dateien\Nero\Lib\NMIndexStoreSvr.exe" [2008-06-24 1840424]

"ccleaner"="c:\programme\CCleaner\CCleaner.exe" [2011-04-01 2228536]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-03 13529088]

"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2011-04-20 281768]

"InCD"="c:\programme\Ahead\InCD\InCD.exe" [2005-05-13 1397760]

"SunJavaUpdateSched"="c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe" [2010-05-14 248552]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

.

c:\dokumente und einstellungen\All Users\Startmen\Programme\Autostart\

Belkin Wireless G Desktop Card Client Utility.lnk - c:\programme\Belkin\F5D7000v7032\Belkinwcui.exe [2009-4-11 1560576]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"QuickTime Task"="c:\programme\QuickTime\QTTask.exe" -atboottime

"iTunesHelper"="c:\programme\iTunes\iTunesHelper.exe"

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"c:\\WINDOWS\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Programme\\Ahead\\Nero ShowTime\\ShowTime.exe"=

"c:\\Programme\\Mozilla Firefox\\firefox.exe"=

"c:\\Programme\\eMule\\emule.exe"=

"c:\\Programme\\Bonjour\\mDNSResponder.exe"=

"c:\\Programme\\iTunes\\iTunes.exe"=

"c:\\Programme\\Google\\Google Earth\\client\\googleearth.exe"=

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"65533:TCP"= 65533:TCP:Services

"52344:TCP"= 52344:TCP:Services

"6013:TCP"= 6013:TCP:Services

"6014:TCP"= 6014:TCP:Services

"3389:TCP"= 3389:TCP:Remote Desktop

.

R2 ACEDRV06;ACEDRV06;c:\windows\system32\drivers\ACEDRV06.sys [04.08.2010 13:30 99840]

R2 AntiVirMailService;Avira AntiVir MailGuard;c:\programme\Avira\AntiVir Desktop\avmailc.exe [20.04.2011 23:10 339624]

R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [11.09.2009 09:32 136360]

R2 AntiVirWebService;Avira AntiVir WebGuard;c:\programme\Avira\AntiVir Desktop\avwebgrd.exe [20.04.2011 23:10 421032]

R3 Belkin700F;Belkin Wireless G Desktop Card Service v7;c:\windows\system32\drivers\BLKWGDv7.sys [11.04.2009 17:01 303616]

S2 gupdate;Google Update Service (gupdate);c:\programme\Google\Update\GoogleUpdate.exe [06.04.2010 16:10 135664]

S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;d:\common\Database\bin\fbserver.exe [04.08.2010 13:27 1527900]

S3 gupdatem;Google Update-Dienst (gupdatem);c:\programme\Google\Update\GoogleUpdate.exe [06.04.2010 16:10 135664]

S3 SjyPkt;SjyPkt;\??\c:\windows\System32\Drivers\SjyPkt.sys --> c:\windows\System32\Drivers\SjyPkt.sys [?]

S3 Wdm1;USB Bridge Cable Driver;c:\windows\system32\drivers\usbbc.sys [21.07.2009 12:04 15576]

S3 xcpip;TCP/IP-Protokolltreiber;c:\windows\system32\drivers\xcpip.sys --> c:\windows\system32\drivers\xcpip.sys [?]

S3 xpsec;IPSEC-Treiber;c:\windows\system32\drivers\xpsec.sys --> c:\windows\system32\drivers\xpsec.sys [?]

.

Inhalt des "geplante Tasks" Ordners

.

2011-05-04 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\programme\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]

.

2011-05-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\programme\Google\Update\GoogleUpdate.exe [2010-04-06 14:10]

.

2011-05-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\programme\Google\Update\GoogleUpdate.exe [2010-04-06 14:10]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://www.google.de/

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uInternet Settings,ProxyOverride = *.local

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: Google Sidewiki... - c:\programme\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html

LSP: c:\programme\Avira\AntiVir Desktop\avsda.dll

FF - ProfilePath - c:\dokumente und einstellungen\Eileen Berg\Anwendungsdaten\Mozilla\Firefox\Profiles\2c2e8dml.default\

FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=

FF - prefs.js: browser.search.selectedEngine - GMX Suche mit Google

FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/

FF - prefs.js: keyword.URL - hxxp://go.gmx.net/suchbox/gmxsuche?su=

FF - Ext: Google Toolbar for Firefox: {3112ca9c-de6d-4884-a869-9855de68056c} - c:\programme\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\programme\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} - c:\programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}

FF - Ext: FireFTP: {a7c6cf7f-112c-4500-a7ea-39801a327e5f} - %profile%\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}

FF - Ext: Google Toolbar for Firefox: {3112ca9c-de6d-4884-a869-9855de68056c} - %profile%\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}

FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}

FF - Ext: DownloadHelper: {b9db16a4-6edc-47ec-a1f4-b86292ed211d} - %profile%\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}

FF - Ext: FireTorrent: firetorrent@radicalsoft.com - %profile%\extensions\firetorrent@radicalsoft.com

FF - Ext: Java Quick Starter: jqs@sun.com - c:\programme\Java\jre6\lib\deploy\jqs\ff

FF - user.js: yahoo.homepage.dontask - true

FF - user.js: network.http.max-persistent-connections-per-server - 4

FF - user.js: nglayout.initialpaint.delay - 600

FF - user.js: content.notify.interval - 600000

FF - user.js: content.max.tokenizing.time - 1800000

FF - user.js: content.switch.threshold - 600000

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

HKLM-Run-NBKeyScan - c:\programme\Nero\Nero8\Nero BackItUp\NBKeyScan.exe

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2011-05-06 17:05

Windows 5.1.2600 Service Pack 3 NTFS

.

Scanne versteckte Prozesse... 

.

Scanne versteckte Autostarteinträge... 

.

Scanne versteckte Dateien... 

.

Scan erfolgreich abgeschlossen

versteckte Dateien: 0

.

**************************************************************************

.

--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

.

- - - - - - - > 'lsass.exe'(740)

c:\programme\Avira\AntiVir Desktop\avsda.dll

.

- - - - - - - > 'explorer.exe'(2404)

c:\programme\Avira\AntiVir Desktop\avsda.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\programme\Ahead\InCD\InCDsrv.exe

c:\programme\Avira\AntiVir Desktop\avguard.exe

c:\programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

c:\programme\Bonjour\mDNSResponder.exe

c:\programme\Avira\AntiVir Desktop\avshadow.exe

c:\programme\Java\jre6\bin\jqs.exe

c:\windows\system32\nvsvc32.exe

c:\progra~1\GEMEIN~1\Nokia\MPAPI\MPAPI3s.exe

c:\programme\Gemeinsame Dateien\Nero\Lib\NMIndexingService.exe

c:\programme\Gemeinsame Dateien\PCSuite\Services\ServiceLayer.exe

c:\windows\system32\wscntfy.exe

c:\programme\Avira\AntiVir Desktop\checkt.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2011-05-06  17:13:27 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2011-05-06 15:13

.

Vor Suchlauf: 8 Verzeichnis(se), 14.389.616.640 Bytes frei

Nach Suchlauf: 10 Verzeichnis(se), 14.398.681.088 Bytes frei

.

- - End Of File - - 8C29DB6E77F08138F6275A658E31439D

--- --- ---

Combofix - Scripten

1. Starte das Notepad (Start / Ausführen / notepad[Enter])

2. Jetzt füge mit copy/paste den ganzen Inhalt der untenstehenden Codebox in das Notepad Fenster ein.

Code:

Registry::

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"65533:TCP"=-

"52344:TCP"=-

"6013:TCP"=-

"6014:TCP"=-

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"c:\\Programme\\eMule\\emule.exe"=-
 

Driver::

xcpip

xpsec

3. Speichere im Notepad als CFScript.txt auf dem Desktop.

4. Deaktivere den Guard Deines Antivirenprogramms und eine eventuell vorhandene Software Firewall.
(Auch Guards von Ad-, Spyware Programmen und den Tea Timer (wenn vorhanden) !)

5. Dann ziehe die CFScript.txt auf die cofi.exe, so wie es im unteren Bild zu sehen ist. Damit wird Combofix neu gestartet.

http://users.pandora.be/bluepatchy/m...s/CFScript.gif

6. Nach dem Neustart (es wird gefragt ob Du neustarten willst), poste bitte die folgenden Log Dateien:
Combofix.txt

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

OTL - Fix ???????

Was genau soll das sein und wo finde ich es?

Und wie kann ich Antivir noch mehr deaktivieren, wenn ich es bereits deaktiviert habe?

Oh sry da hab ich mich ja voll vertan :rofl: :uglyhammer: :D

Ich meinte natürlich was ganz anderes. Werd es umgehend editieren, sonst trägt man diese Peinlichkeit von mir nach jahrelang nach ;)

Edit: Gut dass dir OTL noch unbekannt ist. Ich hab ganz vergessen, dass du noch OTL-Logs machen musst oder hast du schon welche erstellt? :confused:

Hallöchen,
es gibt ein kleines Problem, besser gesagt zwei

1. Beim Neustart des PC fährt AntiVir immer noch wieder hoch, wie bekomme ich auch das deaktiviert?
2. Nach dem Neustart hat sich cofi Aufgehängt und hat nicht weiter gemacht.

Was tun?

:headbang: Soll ich AntiVir löschen bis das hier beendet ist, denn das nervt gewaltig.:headbang: