Trojaner-Board - Ein weiterer BKA-Trojaner

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Ein weiterer BKA-Trojaner (https://www.trojaner-board.de/97819-weiterer-bka-trojaner.html)

Ein weiterer BKA-Trojaner

Auch ich bin eines der vielen BKA-Trojaner-Opfer. Habe den Scan mit OTLPE laufen lassen und die Textdatei angehängt.
Würde mich über Hilfe freuen und bedanke mich schon einmal im voraus...

Mach einen OTL-Fix über OTLPE. starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:

:OTL

DRV - File not found [Kernel | On_Demand] --  -- (Profos)

IE - HKU\Anwender_ON_E\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.aldi.com

IE - HKU\Anwender_ON_E\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://medion.msn.com [binary data]

IE - HKU\Anwender_ON_E\Software\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1

IE - HKU\Anwender_ON_E\Software\Microsoft\Internet Explorer\Main,Start Page = http://de.ask.com?o=15003&l=dis

IE - HKU\Anwender_ON_E\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - E:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)

FF - prefs.js..browser.search.defaultengine: "Ask.com"

FF - prefs.js..browser.search.defaultenginename: "Ask.com"

FF - prefs.js..browser.search.order.1: "Ask.com"

FF - prefs.js..keyword.URL: "http://websearch.ask.com/redirect?client=ff&src=kw&tb=SPC2&o=15000&locale=de_DE&q="

[2010/08/28 07:29:52 | 000,000,000 | ---D | M] (Sopcast Ask Toolbar) -- E:\Users\Anwender\AppData\Roaming\Mozilla\Firefox\Profiles\60xwl6n1.default\extensions\toolbar@ask.com

[2010/08/28 07:29:53 | 000,002,253 | ---- | M] () -- E:\Users\Anwender\AppData\Roaming\Mozilla\Firefox\Profiles\60xwl6n1.default\searchplugins\askcom.xml

O2 - BHO: (Sopcast Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - E:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)

O3 - HKLM\..\Toolbar: (Sopcast Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - E:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)

O3 - HKU\Anwender_ON_E\..\Toolbar\WebBrowser: (Sopcast Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - E:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)

O4 - HKU\Anwender_ON_E..\Run: [Xmlcsc] E:\Users\Anwender\AppData\Roaming\Faxtxt\treeuser.exe ()

O4 - HKU\LocalService_ON_E..\RunOnce: [mctadmin] E:\Windows\System32\mctadmin.exe (Microsoft Corporation)

O4 - HKU\NetworkService_ON_E..\RunOnce: [mctadmin] E:\Windows\System32\mctadmin.exe (Microsoft Corporation)

O20 - HKU\Anwender_ON_E Winlogon: Shell - (C:\Users\Anwender\AppData\Local\Temp\0.85603986934946.exe) - E:\Users\Anwender\AppData\Local\Temp\0.85603986934946.exe (Vmfdyadxd Vitipbuc)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009/06/10 17:42:20 | 000,000,024 | ---- | M] () - E:\autoexec.bat -- [ NTFS ]

O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]

O33 - MountPoints2\{d11ffc6b-5de0-11df-ad44-00262df7fb44}\Shell - "" = AutoRun

O33 - MountPoints2\{d11ffc6b-5de0-11df-ad44-00262df7fb44}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence

O33 - MountPoints2\{ed17e8ba-53ab-11df-b7ea-00262df7fb44}\Shell - "" = AutoRun

O33 - MountPoints2\{ed17e8ba-53ab-11df-b7ea-00262df7fb44}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence

O33 - MountPoints2\{ed17e8c0-53ab-11df-b7ea-00262df7fb44}\Shell - "" = AutoRun

O33 - MountPoints2\{ed17e8c0-53ab-11df-b7ea-00262df7fb44}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence

O33 - MountPoints2\{ee6204e3-68c4-11df-8f45-00262df7fb44}\Shell - "" = AutoRun

O33 - MountPoints2\{ee6204e3-68c4-11df-8f45-00262df7fb44}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence

O33 - MountPoints2\F\Shell - "" = AutoRun

O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence

[2011/03/03 17:24:48 | 000,000,000 | ---D | M] -- E:\ProgramData\gDjKlNo06504

@Alternate Data Stream - 113 bytes -> E:\ProgramData\Temp:C765C323

:Commands

[purity]

[resethosts]

[emptytemp]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

vielen dank!!! windows läuft wieder...

allerdings öffnete sich kein logfile oder dergleichen, das ich hätte posten können.

Sieh im Ordner C:\_OTL nach

Die Datei, die nach Datum und Uhrzeit des Scans benannt ist, würde so aussehen:

Zitat:

========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Profos deleted successfully.
Unable to set value : HKU\Anwender_ON_E\Software\Microsoft\Internet Explorer\Main\\Default_Page_URL| /E!
Unable to set value : HKU\Anwender_ON_E\Software\Microsoft\Internet Explorer\Main\\Default_Secondary_Page_URL| /E!
Unable to set value : HKU\Anwender_ON_E\Software\Microsoft\Internet Explorer\Main\\SearchDefaultBranded| /E!
Unable to set value : HKU\Anwender_ON_E\Software\Microsoft\Internet Explorer\Main\\Start Page| /E!
Registry key HKEY_USERS\Anwender_ON_E\Software\Microsoft\Internet Explorer\URLSearchHooks not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}\ deleted successfully.
E:\Program Files\Ask.com\GenericAskToolbar.dll moved successfully.
E:\Users\Anwender\AppData\Roaming\Mozilla\Firefox\Profiles\60xwl6n1.default\extensions\toolbar@ask.com\searchplugins folder moved successfully.
E:\Users\Anwender\AppData\Roaming\Mozilla\Firefox\Profiles\60xwl6n1.default\extensions\toolbar@ask.com\logs folder moved successfully.
E:\Users\Anwender\AppData\Roaming\Mozilla\Firefox\Profiles\60xwl6n1.default\extensions\toolbar@ask.com\defaults\preferences folder moved successfully.
E:\Users\Anwender\AppData\Roaming\Mozilla\Firefox\Profiles\60xwl6n1.default\extensions\toolbar@ask.com\defaults folder moved successfully.
E:\Users\Anwender\AppData\Roaming\Mozilla\Firefox\Profiles\60xwl6n1.default\extensions\toolbar@ask.com\datastore folder moved successfully.
E:\Users\Anwender\AppData\Roaming\Mozilla\Firefox\Profiles\60xwl6n1.default\extensions\toolbar@ask.com\chrome\temp\ff-config.Sat-28-Aug-2010-11-29-53-GMT folder moved successfully.
E:\Users\Anwender\AppData\Roaming\Mozilla\Firefox\Profiles\60xwl6n1.default\extensions\toolbar@ask.com\chrome\temp folder moved successfully.
E:\Users\Anwender\AppData\Roaming\Mozilla\Firefox\Profiles\60xwl6n1.default\extensions\toolbar@ask.com\chrome\skin folder moved successfully.
E:\Users\Anwender\AppData\Roaming\Mozilla\Firefox\Profiles\60xwl6n1.default\extensions\toolbar@ask.com\chrome\content folder moved successfully.
E:\Users\Anwender\AppData\Roaming\Mozilla\Firefox\Profiles\60xwl6n1.default\extensions\toolbar@ask.com\chrome folder moved successfully.
E:\Users\Anwender\AppData\Roaming\Mozilla\Firefox\Profiles\60xwl6n1.default\extensions\toolbar@ask.com folder moved successfully.
E:\Users\Anwender\AppData\Roaming\Mozilla\Firefox\Profiles\60xwl6n1.default\searchplugins\askcom.xml moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully.
File E:\Program Files\Ask.com\GenericAskToolbar.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
File E:\Program Files\Ask.com\GenericAskToolbar.dll not found.
Registry key HKEY_USERS\Anwender_ON_E\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
File E:\Program Files\Ask.com\GenericAskToolbar.dll not found.
Registry key HKEY_USERS\Anwender_ON_E\Software\Microsoft\Windows\CurrentVersion\Run not found.
E:\Users\Anwender\AppData\Roaming\Faxtxt\treeuser.exe moved successfully.
Registry key HKEY_USERS\LocalService_ON_E\Software\Microsoft\Windows\CurrentVersion\RunOnce not found.
E:\Windows\System32\mctadmin.exe moved successfully.
Registry key HKEY_USERS\NetworkService_ON_E\Software\Microsoft\Windows\CurrentVersion\RunOnce not found.
File E:\Windows\System32\mctadmin.exe not found.
Registry key HKEY_USERS\Anwender_ON_E\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon not found.
E:\Users\Anwender\AppData\Local\Temp\0.85603986934946.exe moved successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
E:\autoexec.bat moved successfully.
File move failed. X:\AUTORUN.INF scheduled to be moved on reboot.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d11ffc6b-5de0-11df-ad44-00262df7fb44}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d11ffc6b-5de0-11df-ad44-00262df7fb44}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d11ffc6b-5de0-11df-ad44-00262df7fb44}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d11ffc6b-5de0-11df-ad44-00262df7fb44}\ not found.
File F:\setup_vmc_lite.exe /checkApplicationPresence not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ed17e8ba-53ab-11df-b7ea-00262df7fb44}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ed17e8ba-53ab-11df-b7ea-00262df7fb44}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ed17e8ba-53ab-11df-b7ea-00262df7fb44}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ed17e8ba-53ab-11df-b7ea-00262df7fb44}\ not found.
File F:\setup_vmc_lite.exe /checkApplicationPresence not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ed17e8c0-53ab-11df-b7ea-00262df7fb44}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ed17e8c0-53ab-11df-b7ea-00262df7fb44}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ed17e8c0-53ab-11df-b7ea-00262df7fb44}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ed17e8c0-53ab-11df-b7ea-00262df7fb44}\ not found.
File F:\setup_vmc_lite.exe /checkApplicationPresence not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ee6204e3-68c4-11df-8f45-00262df7fb44}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ee6204e3-68c4-11df-8f45-00262df7fb44}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ee6204e3-68c4-11df-8f45-00262df7fb44}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ee6204e3-68c4-11df-8f45-00262df7fb44}\ not found.
File F:\setup_vmc_lite.exe /checkApplicationPresence not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F\ not found.
File F:\setup_vmc_lite.exe /checkApplicationPresence not found.
Folder E:\ProgramData\gDjKlNo06504\ not found.
ADS E:\ProgramData\Temp:C765C323 deleted successfully.
========== COMMANDS ==========
E:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: All Users

User: Anwender

User: Default

User: Default User

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 829536 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 2514009 bytes

Total Files Cleaned = 3.00 mb

OTLPE by OldTimer - Version 3.1.46.0 log created on 04222011_012845

Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
http://www.trojaner-board.de/images/icons/icon4.gif Vista und 7 User müssen das Tool per Rechtsklick als Administrator ausführen! http://www.trojaner-board.de/images/icons/icon4.gif

Kaspersky-Scan gemacht, kein Ergebnisse...

Du musst auch auf Report klicken :pfeiff:
Oder meinst du mit keine Ergebnisse eher keine Funde?

ja, funde... sorry :pfeiff:

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.

http://saved.im/mtm0nzyzmzd5/cofi.jpg

Dann folgende Anleitung durchlesen und abarbeiten -> CCleaner Systembereinigung

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

war über ostern weg, ohne rechner... hier die log-datei von combofix:

Combofix Logfile:

Code:

ComboFix 11-04-24.06 - Anwender 25.04.2011  18:31:48.1.4 - x86

Microsoft Windows 7 Home Premium   6.1.7600.0.1252.49.1031.18.3511.1952 [GMT 2:00]

ausgeführt von:: c:\users\Anwender\Desktop\cofi.exe

AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}

AV: Lavasoft Ad-Watch Live! Virenschutz *Disabled/Updated* {9FF26384-70D4-CE6B-3ECB-E759A6A40116}

SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}

SP: Lavasoft Ad-Watch Live! *Disabled/Updated* {24938260-56EE-C1E5-047B-DC2BDD234BAB}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

 * Neuer Wiederherstellungspunkt wurde erstellt

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\program files\INSTALL.LOG

.

.

(((((((((((((((((((((((   Dateien erstellt von 2011-03-25 bis 2011-04-25  ))))))))))))))))))))))))))))))

.

.

2011-04-25 16:36 . 2011-04-25 16:36        --------        d-----w-        c:\users\Default\AppData\Local\temp

2011-04-23 10:59 . 2011-04-11 07:04        7071056        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{51A22748-E92F-42A8-AEDD-35831727061C}\mpengine.dll

2011-04-22 05:28 . 2011-03-06 22:12        2234368        ----a-r-        C:\OTLPE.exe

2011-04-22 05:28 . 2011-04-22 05:28        --------        d-----w-        C:\_OTL

2011-04-15 10:46 . 2011-02-23 05:06        311296        ----a-w-        c:\windows\system32\drivers\srv.sys

2011-04-15 10:46 . 2011-02-23 05:05        309760        ----a-w-        c:\windows\system32\drivers\srv2.sys

2011-04-15 10:46 . 2011-02-23 05:05        113664        ----a-w-        c:\windows\system32\drivers\srvnet.sys

2011-04-15 10:46 . 2011-02-18 05:36        428032        ----a-w-        c:\windows\system32\vbscript.dll

2011-04-15 10:46 . 2011-03-03 05:29        132608        ----a-w-        c:\windows\system32\dnsrslvr.dll

2011-04-15 10:46 . 2011-03-03 05:27        28672        ----a-w-        c:\windows\system32\dnscacheugc.exe

2011-04-15 10:46 . 2011-02-19 05:32        34304        ----a-w-        c:\windows\system32\atmlib.dll

2011-04-15 10:46 . 2011-02-19 03:37        294912        ----a-w-        c:\windows\system32\atmfd.dll

2011-04-02 12:31 . 2011-04-22 07:39        --------        d-----r-        c:\users\Anwender\Dropbox

2011-04-02 12:27 . 2011-04-22 07:40        --------        d-----w-        c:\users\Anwender\AppData\Roaming\Dropbox

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-03-30 16:11 . 2010-06-15 12:24        952        --sha-w-        c:\programdata\KGyGaAvL.sys

2011-03-17 19:03 . 2010-08-05 08:35        137656        ----a-w-        c:\windows\system32\drivers\avipbb.sys

2011-02-19 05:33 . 2011-03-09 10:53        802304        ----a-w-        c:\windows\system32\FntCache.dll

2011-02-19 05:32 . 2011-03-09 10:53        1074176        ----a-w-        c:\windows\system32\DWrite.dll

2011-02-19 05:32 . 2011-03-09 10:53        739840        ----a-w-        c:\windows\system32\d2d1.dll

2011-02-18 15:36 . 2011-02-18 15:36        41984        ----a-w-        c:\windows\system32\drivers\usbaapl.sys

2011-02-18 15:36 . 2011-02-18 15:36        4184352        ----a-w-        c:\windows\system32\usbaaplrc.dll

2011-02-08 12:55 . 2010-10-28 10:21        16432        ----a-w-        c:\windows\system32\lsdelete.exe

2011-02-03 05:45 . 2011-02-10 14:25        219008        ----a-w-        c:\windows\system32\drivers\dxgmms1.sys

2011-02-02 16:11 . 2010-03-02 06:22        222080        ------w-        c:\windows\system32\MpSigStub.exe

2001-09-28 16:00 . 2011-03-01 17:02        164864        ----a-w-        c:\program files\UNWISE.EXE

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2011-02-18 05:12        94208        ----a-w-        c:\users\Anwender\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2011-02-18 05:12        94208        ----a-w-        c:\users\Anwender\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2011-02-18 05:12        94208        ----a-w-        c:\users\Anwender\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"HotkeyApp"="c:\program files\Launch Manager\HotkeyApp.exe" [2009-12-14 200704]

"LMgrVolOSD"="c:\program files\Launch Manager\OSD.exe" [2009-12-11 348960]

"Wbutton"="c:\program files\Launch Manager\Wbutton.exe" [2010-01-13 413696]

"CLMLServer"="c:\program files\CyberLink\Power2Go\CLMLSvc.exe" [2009-11-02 103720]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2010-03-02 8522272]

"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RtHDVBg.exe" [2010-03-02 678432]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-11-03 281768]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-08-25 136216]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-08-25 171032]

"Persistence"="c:\windows\system32\igfxpers.exe" [2010-08-25 170520]

"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-09-16 1164584]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-03-07 421160]

.

c:\users\Anwender\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Dropbox.lnk - c:\users\Anwender\AppData\Roaming\Dropbox\bin\Dropbox.exe [2011-3-31 23360040]

OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]

OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-5-20 1195008]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages        REG_MULTI_SZ           kerberos msv1_0 schannel wdigest tspkg pku2u livessp

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

@="Service"

.

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-11-04 136176]

R3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys [2009-06-29 112128]

R3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\Common Files\MAGIX Services\Database\bin\fbserver.exe [2008-08-07 3276800]

R3 hwusbfake;Huawei DataCard USB Fake;c:\windows\system32\DRIVERS\ewusbfake.sys [2009-06-29 102912]

R3 IntcDAud;Intel(R) Display-Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-01-08 232448]

R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\System32\Drivers\RtsUStor.sys [2009-07-31 171520]

R3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys [x]

R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [2010-08-05 1343400]

S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2010-08-12 64288]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]

S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2010-11-03 135336]

S2 Fabs;FABS - Helping agent for MAGIX media database;c:\program files\Common Files\MAGIX Services\Database\bin\FABS.exe [2009-02-03 1155072]

S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2009-10-02 13336]

S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2011-04-21 2146496]

S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-12-10 2320920]

S2 VMCService;Vodafone Mobile Connect Service;c:\program files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe [2009-09-11 9216]

S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2010-02-10 132352]

S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x86.sys [2009-12-22 65576]

S3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys [2011-02-04 15232]

S3 rtl8192se;Realtek Wireless LAN 802.11n PCI-E NIC NT Driver;c:\windows\system32\DRIVERS\rtl8192se.sys [2010-04-01 1009184]

S3 WisLMSvc;WisLMSvc;c:\program files\Launch Manager\WisLMSvc.exe [2009-10-22 118560]

S3 X10Hid;X10 Hid Device;c:\windows\System32\Drivers\x10hid.sys [2009-05-13 13720]

.

.

--- Andere Dienste/Treiber im Speicher ---

.

*NewlyCreated* - LAVASOFT_KERNEXPLORER

*Deregistered* - BMLoad

.

Inhalt des "geplante Tasks" Ordners

.

2011-04-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-11-04 16:16]

.

2011-04-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-11-04 16:16]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://de.ask.com?o=15003&l=dis

uInternet Settings,ProxyOverride = *.local

IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000

IE: {{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4

LSP: bmnet.dll

FF - ProfilePath - c:\users\Anwender\AppData\Roaming\Mozilla\Firefox\Profiles\60xwl6n1.default\

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://www.facebook.com/

FF - prefs.js: keyword.URL - hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=SPC2&o=15000&locale=de_DE&q=

FF - prefs.js: network.proxy.type - 0

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

URLSearchHooks-{00000000-6E41-4FD3-8538-502F5495E5FC} - (no file)

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

HKLM-Run-SynTPEnh - %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe

HKLM-Run-MobileConnect - %programfiles%\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe

SafeBoot-BsScanner

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

.

- - - - - - - > 'lsass.exe'(592)

c:\windows\system32\bmnet.dll

.

Zeit der Fertigstellung: 2011-04-25  18:38:14

ComboFix-quarantined-files.txt  2011-04-25 16:38

.

Vor Suchlauf: 8 Verzeichnis(se), 274.231.832.576 Bytes frei

Nach Suchlauf: 13 Verzeichnis(se), 274.155.327.488 Bytes frei

.

- - End Of File - - DADB0DF42BD469AD1350709CCAE3ED23

--- --- ---

Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Downloade Dir danach bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.

Doppelklick auf die MBRCheck.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Das Tool braucht nur wenige Sekunden.
Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.

Poste mir bitte den Inhalt des .txt Dokumentes

GMER:

GMER Logfile:

Code:

GMER 1.0.15.15570 - hxxp://www.gmer.net

Rootkit scan 2011-04-27 15:28:27

Windows 6.1.7600  Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD50 rev.01.0

Running: fp9hu5bx.exe; Driver: C:\Users\Anwender\AppData\Local\Temp\pwldqkow.sys
 
 

---- Kernel code sections - GMER 1.0.15 ----
 

.text           ntkrnlpa.exe!ZwSaveKeyEx + 13BD          82E96589 1 Byte  [06]

.text           ntkrnlpa.exe!KiDispatchInterrupt + 5A2   82EBB092 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
 

---- Devices - GMER 1.0.15 ----
 

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0  Wdf01000.sys (Kernelmodustreiber-Frameworklaufzeit/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume1   fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume2   fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume3   fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume4   fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
 

Device          \Driver\ACPI_HAL \Device\0000004b        halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)
 

---- EOF - GMER 1.0.15 ----

--- --- ---

OSAM:

OSAM Logfile:

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

hxxp://www.online-solutions.ru/en/

Saved at 14:29:49 on 27.04.2011
 

OS: Windows 7 Home Premium Edition (Build 7600), 32-bit

Default Browser: Mozilla Corporation Firefox 3.6.16
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Boot Execute]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Session Manager )-----

"BootExecute" - ? - C:\Windows\system32\lsdelete.exe  (File found, but it contains no detailed information)
 

[Common]

-----( %SystemRoot%\Tasks )-----

"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
 

[Control Panel Objects]

-----( %SystemRoot%\system32 )-----

"DivXControlPanelApplet.cpl" - "DivX, Inc." - C:\Windows\system32\DivXControlPanelApplet.cpl

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----

"QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys

"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys

"Bytemobile Boot Time Load Driver" (BMLoad) - "Bytemobile, Inc." - C:\Windows\System32\drivers\BMLoad.sys

"Bytemobile Kernel Network Provider" (tcpipBM) - "Bytemobile, Inc." - C:\Windows\system32\drivers\tcpipBM.sys

"catchme" (catchme) - ? - C:\Users\Anwender\AppData\Local\Temp\catchme.sys  (File not found)

"Lavasoft helper driver" (Lavasoft Kernexplorer) - ? - C:\Program Files\Lavasoft\Ad-Aware\KernExplorer.sys  (File found, but it contains no detailed information)

"Realtek IR Driver" (RtsUIR) - ? - C:\Windows\System32\DRIVERS\Rts516xIR.sys  (File not found)

"Realtek Smartcard Reader Driver" (USBCCID) - ? - C:\Windows\System32\DRIVERS\RtsUCcid.sys  (File not found)

"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys
 

[Explorer]

-----( HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -   (File not found | COM-object registry key not found)

{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -   (File not found | COM-object registry key not found)

{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -   (File not found | COM-object registry key not found)

{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll

{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

-----( HKLM\Software\Classes\Protocols\Filter )-----

{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL

-----( HKLM\Software\Classes\Protocols\Handler )-----

{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll

{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

{828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL

{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll

{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL

{91774881-D725-4E58-B298-07617B9B86A8} "Skype IE add-on Pluggable Protocol" - "Skype Technologies S.A." - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

{03C514A3-1EFB-4856-9F99-10D7BE1653C0} "Windows Live Mail HTML Asynchronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\Program Files\Windows Live\Mail\mailcomm.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----

{AEB6717E-7E19-11d0-97EE-00C04FD91972} "{AEB6717E-7E19-11d0-97EE-00C04FD91972}" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{DE902992-61FC-4A01-8091-53E1895C9775} "CDR Icon Handler" - "Corel Corporation" - c:\Program Files\Common Files\Corel\Shared\Shell Extension\ShellXP.dll

{7AD101F2-0B93-4D66-A1CA-DF73F3C4377B} "CDR preview provider" - "Corel Corporation" - c:\Program Files\Common Files\Corel\Shared\Shell Extension\ShellVista.dll

{7FA63AC0-F5BC-4F3B-A9CF-94328D812B62} "CDR Property Handler" - "Corel Corporation" - c:\Program Files\Common Files\Corel\Shared\Shell Extension\ShellVista.dll

{1462EBAA-96E7-4D93-9A66-0E4068DE4FCF} "CDR Thumbnail provider" - "Corel Corporation" - c:\Program Files\Common Files\Corel\Shared\Shell Extension\ShellXP.dll

{0563DB41-F538-4B37-A92D-4659049B7766} "CLSID_WLMCMimeFilter" - "Microsoft Corporation" - C:\Program Files\Windows Live\Mail\mailcomm.dll

{DE902994-61FC-4A01-8091-53E1895C9775} "CMX Icon Handler" - "Corel Corporation" - c:\Program Files\Common Files\Corel\Shared\Shell Extension\ShellXP.dll

{1462EBAC-96E7-4D93-9A66-0E4068DE4FCF} "CMX Thumbnail provider" - "Corel Corporation" - c:\Program Files\Common Files\Corel\Shared\Shell Extension\ShellXP.dll

{DE902993-61FC-4A01-8091-53E1895C9775} "CPT Icon Handler" - "Corel Corporation" - c:\Program Files\Common Files\Corel\Shared\Shell Extension\ShellXP.dll

{7FA63AC1-F5BC-4F3B-A9CF-94328D812B62} "CPT Property Handler" - "Corel Corporation" - c:\Program Files\Common Files\Corel\Shared\Shell Extension\ShellVista.dll

{1462EBAB-96E7-4D93-9A66-0E4068DE4FCF} "CPT Thumbnail provider" - "Corel Corporation" - c:\Program Files\Common Files\Corel\Shared\Shell Extension\ShellXP.dll

{D8D1CE8C-B1EB-4E95-B63B-1531BA60E992} "DivX Property Handler" - "DivX, Inc." - C:\Program Files\DivX\DivX Plus Media Foundation Components\DivXPropertyHandler.dll

{83238FAE-D346-4E12-8734-D42F7554B3E6} "DivX Thumbnail Provider" - "DivX, Inc." - C:\Program Files\DivX\DivX Plus Media Foundation Components\DivXThumbnailProvider.dll

{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Program Files\iTunes\iTunesMiniPlayer.dll

{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\msohevi.dll

{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll

{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\ONFILTER.DLL

{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll

{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

{087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

{63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

{3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll

{2BE99FD4-A181-4996-BFA9-58C5FFD11F6C} "Windows Live Photo Gallery Autoplay Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe

{00F30F64-AC33-42F5-8FD1-5DC2D3FDE06C} "Windows Live Photo Gallery Editor Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe

{00F3712A-CA79-45B4-9E4D-D7891E7F8B9D} "Windows Live Photo Gallery Editor Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll

{00F30F90-3E96-453B-AFCD-D71989ECC2C7} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll

{00F33137-EE26-412F-8D71-F84E4C2C6625} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll

{00F374B7-B390-4884-B372-2FC349F2172B} "Windows Live Photo Gallery Viewer Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe

{00F346CB-35A4-465B-8B8F-65A29DBAB1F6} "Windows Live Photo Gallery Viewer Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll

{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - "Alexander Roshal" - C:\Program Files\WinRAR\rarext.dll

{06A2568A-CED6-4187-BB20-400B8C02BE5A} "{06A2568A-CED6-4187-BB20-400B8C02BE5A}" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoAcquireWizard.exe
 

[Internet Explorer]

-----( HKCU\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

"eBay - Der weltweite Online-Marktplatz" - ? - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4  (HTTP value)

-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----

<binary data> "&Windows Live Toolbar" - "Microsoft Corporation" - C:\Program Files\Windows Live\Toolbar\wltcore.dll

ITBar7Height "ITBar7Height" - ? -   (File not found | COM-object registry key not found)

<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{67DABFBF-D0AB-41FA-9C46-CC0F21721616} "DivXBrowserPlugin Object" - "DivX,Inc." - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll / hxxp://download.divx.com/player/DivXBrowserPlugin.cab

{8100D56A-5661-482C-BEE8-AFECE305D968} "Facebook Photo Uploader 5 Control" - "The Facebook" - C:\Windows\Downloaded Program Files\PhotoUploader55.ocx / hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab

{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_18" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab

{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} "Java Plug-in 1.6.0_18" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_18" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_18.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab

{D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" - "Adobe Systems, Inc." - C:\Windows\system32\Macromed\Flash\Flash10h.ocx / hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab

{32C3FEAE-0877-4767-8C20-62A5829A0945} "{32C3FEAE-0877-4767-8C20-62A5829A0945}" - ? -   (File not found | COM-object registry key not found) / hxxp://static.ak.facebook.com/fbplugin/win32/axfbootloader.cab

{E2883E8F-472F-4FB0-9522-AC9BF37916A7} "{E2883E8F-472F-4FB0-9522-AC9BF37916A7}" - ? -   (File not found | COM-object registry key not found) / hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll

"eBay - Der weltweite Online-Marktplatz" - ? - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4  (HTTP value)

{5F7B1267-94A9-47F5-98DB-E99415F33AEC} "In Blog veröffentlichen" - "Microsoft Corporation" - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL

{898EA8C8-E7FF-479B-8935-AEC46303B9E5} "Skype add-on for Internet Explorer" - "Skype Technologies S.A." - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----

<binary data> "&Windows Live Toolbar" - "Microsoft Corporation" - C:\Program Files\Windows Live\Toolbar\wltcore.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll

{6EBF7485-159F-4bff-A14F-B9E3AAC4465B} "Search Helper" - "Microsoft Corporation" - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll

{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} "Skype add-on for Internet Explorer" - "Skype Technologies S.A." - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live ID-Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} "Windows Live Toolbar Helper" - "Microsoft Corporation" - C:\Program Files\Windows Live\Toolbar\wltcore.dll

{5C255C8A-E604-49b4-9D64-90988571CECB} "{5C255C8A-E604-49b4-9D64-90988571CECB}" - ? -   (File not found | COM-object registry key not found)
 

[LSA Providers]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Lsa )-----

"Security Packages" - "Microsoft Corporation" - C:\Windows\system32\livessp.dll
 

[Logon]

-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE  (Shortcut exists | File exists)

"desktop.ini" - ? - C:\Users\Anwender\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

"Dropbox.lnk" - "Dropbox, Inc." - C:\Users\Anwender\AppData\Roaming\Dropbox\bin\Dropbox.exe  (Shortcut exists | File exists)

"OpenOffice.org 3.2.lnk" - ? - C:\Program Files\OpenOffice.org 3\program\quickstart.exe  (Shortcut exists | File found, but it contains no detailed information | File exists)

-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----

"StartupPrograms" - ? - rdpclip  (File not found)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"Adobe ARM" - "Adobe Systems Incorporated" - "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

"avgnt" - "Avira GmbH" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

"CLMLServer" - "CyberLink" - "C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe"

"DivXUpdate" - ? - "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW

"HotkeyApp" - "Wistron" - "C:\Program Files\Launch Manager\HotkeyApp.exe"

"iTunesHelper" - "Apple Inc." - "C:\Program Files\iTunes\iTunesHelper.exe"

"LMgrVolOSD" - "Wistron Corp." - "C:\Program Files\Launch Manager\OSD.exe"

"QuickTime Task" - "Apple Inc." - "C:\Program Files\QuickTime\QTTask.exe" -atboottime

"Wbutton" - "Wistron Corp." - "C:\Program Files\Launch Manager\Wbutton.exe"
 

[Print Monitors]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----

"Microsoft Document Imaging Writer Monitor" - "Microsoft Corporation" - C:\Windows\system32\mdimon.dll

"Send To Microsoft OneNote Monitor" - "Microsoft Corporation" - C:\Windows\system32\msonpmon.dll
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\sched.exe

"Cyberlink RichVideo Service(CRVS)" (RichVideo) - ? - C:\Program Files\CyberLink\Shared files\RichVideo.exe

"Dienst "Bonjour"" (Bonjour Service) - "Apple Inc." - C:\Program Files\Bonjour\mDNSResponder.exe

"FABS - Helping agent for MAGIX media database" (Fabs) - "MAGIX AG" - C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe

"Firebird Server - MAGIX Instance" (FirebirdServerMAGIXInstance) - "MAGIX®" - C:\Program Files\Common Files\MAGIX Services\Database\bin\fbserver.exe

"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

"Intel(R) Management & Security Application User Notification Service" (UNS) - "Intel Corporation" - C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

"Intel(R) Management and Security Application Local Management Service" (LMS) - "Intel Corporation" - C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

"Intel(R) Rapid Storage Technology" (IAStorDataMgrSvc) - "Intel Corporation" - C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Program Files\iPod\bin\iPodService.exe

"Lavasoft Ad-Aware Service" (Lavasoft Ad-Aware Service) - "Lavasoft Limited" - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE

"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"Protexis Licensing V2" (PSI_SVC_2) - "Protexis Inc." - c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe

"SeaPort" (SeaPort) - "Microsoft Corporation" - C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

"Vodafone Mobile Connect Service" (VMCService) - "Vodafone" - C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe

"Windows Live ID Sign-in Assistant" (wlidsvc) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

"WisLMSvc" (WisLMSvc) - "Wistron Corp." - C:\Program Files\Launch Manager\WisLMSvc.exe

"X10 Device Network Service" (x10nets) - "X10" - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
 

[Winsock Providers]

-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----

"mdnsNSP" - "Apple Inc." - C:\Program Files\Bonjour\mdnsNSP.dll

"WindowsLive Local NSP" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL

"WindowsLive NSP" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL

-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries )-----

"BMI over [MSAFD-Tcpip [RAW/IP]]" - "Bytemobile, Inc." - C:\Windows\system32\bmnet.dll

"BMI over [MSAFD-Tcpip [TCP/IP]]" - "Bytemobile, Inc." - C:\Windows\system32\bmnet.dll

"BMI over [MSAFD-Tcpip [UDP/IP]]" - "Bytemobile, Inc." - C:\Windows\system32\bmnet.dll
 

===[ Logfile end ]=========================================[ Logfile end ]===

--- --- ---

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru[/QUOTE]

MBRCheck:

Zitat:

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows 7 Home Premium Edition
Windows Information: (build 7600), 32-bit
Base Board Manufacturer: MEDION
BIOS Manufacturer: American Megatrends Inc.
System Manufacturer: MEDION
System Product Name: E6214
Logical Drives Mask: 0x0000001c

Kernel Drivers (total 151):
0x82E53000 \SystemRoot\system32\ntkrnlpa.exe
0x82E1C000 \SystemRoot\system32\halmacpi.dll
0x80BAB000 \SystemRoot\system32\kdcom.dll
0x8C000000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x8C078000 \SystemRoot\system32\PSHED.dll
0x8C089000 \SystemRoot\system32\BOOTVID.dll
0x8C091000 \SystemRoot\system32\CLFS.SYS
0x8C0D3000 \SystemRoot\system32\CI.dll
0x8C17E000 \SystemRoot\system32\drivers\Wdf01000.sys
0x8C1EF000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x8C234000 \SystemRoot\system32\DRIVERS\ACPI.sys
0x8C27C000 \SystemRoot\system32\DRIVERS\WMILIB.SYS
0x8C285000 \SystemRoot\system32\DRIVERS\msisadrv.sys
0x8C28D000 \SystemRoot\system32\DRIVERS\pci.sys
0x8C2B7000 \SystemRoot\system32\DRIVERS\vdrvroot.sys
0x8C2C2000 \SystemRoot\System32\drivers\partmgr.sys
0x8C2D3000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x8C2DB000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x8C2E6000 \SystemRoot\system32\DRIVERS\volmgr.sys
0x8C2F6000 \SystemRoot\System32\drivers\volmgrx.sys
0x8C341000 \SystemRoot\System32\drivers\mountmgr.sys
0x8C41A000 \SystemRoot\system32\DRIVERS\iaStor.sys
0x8C5CD000 \SystemRoot\system32\DRIVERS\amdxata.sys
0x8C357000 \SystemRoot\system32\drivers\fltmgr.sys
0x8C5D6000 \SystemRoot\system32\drivers\fileinfo.sys
0x8C5E7000 \SystemRoot\system32\DRIVERS\Lbd.sys
0x8C62C000 \SystemRoot\System32\Drivers\Ntfs.sys
0x8C75B000 \SystemRoot\System32\Drivers\msrpc.sys
0x8C786000 \SystemRoot\System32\Drivers\ksecdd.sys
0x8C799000 \SystemRoot\System32\Drivers\cng.sys
0x8C600000 \SystemRoot\System32\drivers\pcw.sys
0x8C60E000 \SystemRoot\System32\Drivers\Fs_Rec.sys
0x8C815000 \SystemRoot\system32\drivers\ndis.sys
0x8C8CC000 \SystemRoot\system32\drivers\NETIO.SYS
0x8C90A000 \SystemRoot\System32\Drivers\ksecpkg.sys
0x8CA1B000 \SystemRoot\System32\drivers\tcpip.sys
0x8CB64000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x8CB95000 \SystemRoot\system32\DRIVERS\volsnap.sys
0x8CBD4000 \SystemRoot\System32\Drivers\spldr.sys
0x8C92F000 \SystemRoot\System32\drivers\rdyboost.sys
0x8CBDC000 \SystemRoot\System32\Drivers\mup.sys
0x8CBEC000 \SystemRoot\System32\drivers\hwpolicy.sys
0x8C95C000 \SystemRoot\System32\DRIVERS\fvevol.sys
0x8CA00000 \SystemRoot\system32\DRIVERS\disk.sys
0x8C98E000 \SystemRoot\system32\DRIVERS\CLASSPNP.SYS
0x8CA11000 \SystemRoot\system32\drivers\BMLoad.sys
0x919CD000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x919EC000 \SystemRoot\System32\Drivers\Null.SYS
0x919F3000 \SystemRoot\System32\Drivers\Beep.SYS
0x8CBF4000 \SystemRoot\System32\drivers\vga.sys
0x8C9C0000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x8C9E1000 \SystemRoot\System32\drivers\watchdog.sys
0x91800000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x8C9EE000 \SystemRoot\system32\drivers\rdpencdd.sys
0x8C9F6000 \SystemRoot\system32\drivers\rdprefmp.sys
0x8C800000 \SystemRoot\System32\Drivers\Msfs.SYS
0x8C617000 \SystemRoot\System32\Drivers\Npfs.SYS
0x8C400000 \SystemRoot\system32\DRIVERS\tdx.sys
0x8C38B000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x8C396000 \SystemRoot\system32\drivers\afd.sys
0x8C200000 \SystemRoot\System32\DRIVERS\netbt.sys
0x8C80B000 \SystemRoot\system32\drivers\ws2ifsl.sys
0x8C625000 \SystemRoot\system32\DRIVERS\wfplwf.sys
0x9200F000 \SystemRoot\system32\DRIVERS\pacer.sys
0x9202E000 \SystemRoot\system32\DRIVERS\vwififlt.sys
0x9203F000 \SystemRoot\system32\DRIVERS\netbios.sys
0x9204D000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x92060000 \SystemRoot\system32\DRIVERS\termdd.sys
0x92070000 \SystemRoot\system32\DRIVERS\ssmdrv.sys
0x92076000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x920B7000 \SystemRoot\system32\drivers\nsiproxy.sys
0x920C1000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x920CB000 \SystemRoot\System32\drivers\discache.sys
0x920D7000 \SystemRoot\System32\Drivers\dfsc.sys
0x920EF000 \SystemRoot\system32\DRIVERS\blbdrive.sys
0x920FD000 \SystemRoot\system32\DRIVERS\avipbb.sys
0x92123000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x92A32000 \SystemRoot\system32\DRIVERS\igdkmd32.sys
0x92144000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x9334F000 \SystemRoot\System32\drivers\dxgmms1.sys
0x93388000 \SystemRoot\system32\DRIVERS\HECI.sys
0x93393000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x933A2000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x92A00000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x92A1F000 \SystemRoot\system32\DRIVERS\L1C62x86.sys
0x9221B000 \SystemRoot\system32\DRIVERS\rtl8192se.sys
0x9232E000 \SystemRoot\system32\DRIVERS\vwifibus.sys
0x92338000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0x9233C000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x92354000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x92361000 \SystemRoot\system32\DRIVERS\SynTP.sys
0x92398000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x9239A000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x923A7000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
0x923AD000 \SystemRoot\system32\DRIVERS\Impcd.sys
0x923CE000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0x923D7000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x923E9000 \SystemRoot\system32\DRIVERS\CompositeBus.sys
0x923F6000 \SystemRoot\System32\Drivers\x10hid.sys
0x92200000 \SystemRoot\System32\Drivers\HIDCLASS.SYS
0x92213000 \SystemRoot\System32\Drivers\HIDPARSE.SYS
0x933ED000 \SystemRoot\system32\DRIVERS\AgileVpn.sys
0x9262F000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x92647000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x92652000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x92674000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x9268C000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x926A3000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x926BA000 \SystemRoot\system32\DRIVERS\swenum.sys
0x926BC000 \SystemRoot\system32\DRIVERS\ks.sys
0x926F0000 \SystemRoot\system32\DRIVERS\umbus.sys
0x926FE000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x92742000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0x9274E000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x93A1F000 \SystemRoot\system32\drivers\RTKVHDA.sys
0x93D02000 \SystemRoot\system32\drivers\portcls.sys
0x93D31000 \SystemRoot\system32\drivers\drmk.sys
0x93D4A000 \SystemRoot\system32\drivers\HdAudio.sys
0x93D9A000 \SystemRoot\System32\Drivers\x10ufx2.sys
0x9A880000 \SystemRoot\System32\win32k.sys
0x93DA4000 \SystemRoot\System32\drivers\Dxapi.sys
0x93DDB000 \SystemRoot\system32\DRIVERS\monitor.sys
0x93DE6000 \SystemRoot\System32\Drivers\crashdmp.sys
0x9AAE0000 \SystemRoot\System32\TSDDD.dll
0x91808000 \SystemRoot\System32\Drivers\dump_iaStor.sys
0x93A00000 \SystemRoot\System32\Drivers\dump_dumpfve.sys
0x9AB10000 \SystemRoot\System32\cdd.dll
0x93DAE000 \SystemRoot\system32\drivers\luafv.sys
0x9275F000 \SystemRoot\system32\DRIVERS\avgntflt.sys
0x92774000 \SystemRoot\system32\drivers\WudfPf.sys
0x93DC9000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x9278E000 \SystemRoot\system32\DRIVERS\nwifi.sys
0x927D4000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x927E4000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x9CC28000 \SystemRoot\system32\drivers\HTTP.sys
0x9CCAD000 \SystemRoot\system32\DRIVERS\bowser.sys
0x9CCC6000 \SystemRoot\System32\drivers\mpsdrv.sys
0x9CCD8000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0x9CCFB000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0x9CD36000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0x9CD69000 \SystemRoot\system32\drivers\peauth.sys
0x9CC00000 \SystemRoot\System32\Drivers\secdrv.SYS
0x92600000 \SystemRoot\System32\DRIVERS\srvnet.sys
0x9CC0A000 \SystemRoot\System32\drivers\tcpipreg.sys
0xB123D000 \SystemRoot\System32\DRIVERS\srv2.sys
0xB128C000 \SystemRoot\System32\DRIVERS\srv.sys
0xB1348000 \??\C:\Program Files\Lavasoft\Ad-Aware\KernExplorer.sys
0xB134B000 \??\C:\Users\Anwender\AppData\Local\Temp\pwldqkow.sys
0x76F30000 \Windows\System32\ntdll.dll
0x47F90000 \Windows\System32\smss.exe
0x77170000 \Windows\System32\apisetschema.dll

Processes (total 79):
0 System Idle Process
4 System
316 C:\Windows\System32\smss.exe
460 csrss.exe
524 C:\Windows\System32\wininit.exe
532 csrss.exe
572 C:\Windows\System32\services.exe
596 C:\Windows\System32\lsass.exe
604 C:\Windows\System32\lsm.exe
692 C:\Windows\System32\winlogon.exe
760 C:\Windows\System32\svchost.exe
876 C:\Windows\System32\svchost.exe
976 C:\Windows\System32\svchost.exe
1012 C:\Windows\System32\svchost.exe
1040 C:\Windows\System32\svchost.exe
1200 C:\Windows\System32\svchost.exe
1320 C:\Windows\System32\svchost.exe
1576 C:\Windows\System32\spoolsv.exe
1636 C:\Windows\System32\svchost.exe
1900 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
492 C:\Windows\System32\taskhost.exe
432 C:\Windows\System32\dwm.exe
1276 C:\Windows\explorer.exe
400 C:\Program Files\Bonjour\mDNSResponder.exe
1744 C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe
1372 C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
2052 C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
2088 C:\Program Files\CyberLink\Shared files\RichVideo.exe
2116 C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
2176 C:\Windows\System32\svchost.exe
2228 C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
2276 C:\PROGRA~1\COMMON~1\X10\Common\X10nets.exe
2468 WmiPrvSE.exe
2560 C:\Program Files\Launch Manager\HotkeyApp.exe
2572 C:\Program Files\Launch Manager\OSD.exe
2580 C:\Program Files\Launch Manager\WButton.exe
2592 C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe
2624 C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
2632 C:\Program Files\Realtek\Audio\HDA\RtHDVBg.exe
2648 C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
2776 C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
2832 C:\Windows\System32\igfxtray.exe
2864 C:\Windows\System32\hkcmd.exe
2952 C:\Windows\System32\igfxpers.exe
3016 C:\Program Files\DivX\DivX Update\DivXUpdate.exe
3064 C:\Program Files\iTunes\iTunesHelper.exe
3120 C:\Program Files\Windows Sidebar\sidebar.exe
3192 C:\Users\Anwender\AppData\Roaming\Dropbox\bin\Dropbox.exe
3244 C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
3372 C:\Program Files\OpenOffice.org 3\program\soffice.exe
3380 C:\Program Files\OpenOffice.org 3\program\soffice.bin
3984 C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe
2744 C:\Program Files\iPod\bin\iPodService.exe
3184 C:\Program Files\Launch Manager\WisLMSvc.exe
164 C:\Windows\System32\SearchIndexer.exe
4136 C:\Windows\System32\svchost.exe
4652 C:\Program Files\Windows Media Player\wmpnetwk.exe
5376 C:\Windows\System32\svchost.exe
5644 dllhost.exe
3564 C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
2404 C:\Program Files\Avira\AntiVir Desktop\avguard.exe
4172 C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
4232 C:\Windows\System32\conhost.exe
868 C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
2444 C:\Program Files\Avira\AntiVir Desktop\sched.exe
5328 C:\Windows\System32\svchost.exe
3828 C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
4368 C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
2940 unsecapp.exe
4356 C:\Windows\System32\audiodg.exe
4220 C:\Program Files\Windows Live\Mail\wlmail.exe
2552 C:\Program Files\Windows Live\Contacts\wlcomm.exe
2204 C:\Program Files\Mozilla Firefox\firefox.exe
3216 C:\Windows\System32\SearchProtocolHost.exe
4932 C:\Windows\System32\SearchFilterHost.exe
3252 dllhost.exe
5768 dllhost.exe
4984 C:\Users\Anwender\Desktop\MBRCheck.exe
4412 C:\Windows\System32\conhost.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`06500000 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x0000006a`30900000 (NTFS)

PhysicalDrive0 Model Number: WDCWD5000BEVT-00A0RT0, Rev: 01.01A01

Size Device Name MBR Status
--------------------------------------------
465 GB \\.\PhysicalDrive0 Unknown MBR code
SHA1: F61074C24A6DA26C38919A0032AE32ED64E1F93E

Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:

Done!

Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

Malwarebytes:

Zitat:

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6462

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

28.04.2011 15:18:07
mbam-log-2011-04-28 (15-18-07).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Durchsuchte Objekte: 303603
Laufzeit: 1 Stunde(n), 16 Minute(n), 12 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

SuperAntiSpyware:

Zitat:

SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 04/28/2011 at 05:34 PM

Application Version : 4.51.1000

Core Rules Database Version : 6943
Trace Rules Database Version: 4755

Scan type : Complete Scan
Total Scan Time : 02:09:40

Memory items scanned : 1047
Memory threats detected : 0
Registry items scanned : 10103
Registry threats detected : 0
File items scanned : 155851
File threats detected : 2

Adware.Tracking Cookie
C:\Users\Anwender\AppData\Roaming\Microsoft\Windows\Cookies\anwender@atdmt[1].txt
secure-uk.imrworldwide.com [ C:\Users\Anwender\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\5D69UUGS ]

Sieht ok aus, da wurden nur Cookies gefunden.
Noch Probleme oder weitere Funde in der Zwischenzeit?

nein, läuft alles rund...

sollte es das echt gewesen sein?? :Boogie:

Dann wären wir durch! :abklatsch:

Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.

Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update

PDF-Reader aktualisieren
Dein Adobe Reader ist nicht aktuell, was ein großes Sicherheitsrisiko darstellt. Du solltest daher besser die alte Version über Systemsteuerung => Software deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst.

Ich empfehle einen alternativen PDF-Reader wie SumatraPDF oder Foxit PDF Reader, beide sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers, hier der direkte Downloadlink:

Mozilla und andere Browser => http://filepony.de/?q=Flash+Player
Internet Explorer => http://fpdownload.adobe.com/get/flas..._player_ax.exe

Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.

updates alle durchgeführt, bzw laufen gerade.
dann bedanke ich mich ganz herzlich. eine spende für das trojanerboard wird demnächst bei euch eingehen!!!