Trojaner-Board - searchqu.com/406 löschen unter Windows XT

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - searchqu.com/406 löschen unter Windows XT (https://www.trojaner-board.de/101217-searchqu-com-406-loeschen-windows-xt.html)

aswMBR version 0.9.8.978 Copyright(c) 2011 AVAST Software
Run date: 2011-08-13 17:15:34
-----------------------------
17:15:34.859 OS Version: Windows 5.1.2600 Service Pack 3
17:15:34.859 Number of processors: 2 586 0x401
17:15:34.875 ComputerName: KOCHFAMILY UserName: familykoch
17:15:35.281 Initialize success
17:17:30.718 AVAST engine defs: 11081300
17:17:33.468 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-f
17:17:33.468 Disk 0 Vendor: ST3160023AS 8.12 Size: 152587MB BusType: 3
17:17:33.468 Disk 1 \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP1T1L0-17
17:17:33.468 Disk 1 Vendor: ST3160023AS 8.12 Size: 152587MB BusType: 3
17:17:35.500 Disk 0 MBR read successfully
17:17:35.500 Disk 0 MBR scan
17:17:35.531 Disk 0 unknown MBR code
17:17:35.531 Disk 0 scanning sectors +312496380
17:17:35.609 Disk 0 scanning C:\WINDOWS\system32\drivers
17:17:46.687 Service scanning
17:17:47.593 Modules scanning
17:17:51.406 Disk 0 trace - called modules:
17:17:51.421 ntkrnlpa.exe CLASSPNP.SYS disk.sys atapi.sys hal.dll pciide.sys PCIIDEX.SYS
17:17:51.421 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8714fab8]
17:17:51.421 3 CLASSPNP.SYS[f7692fd7] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP1T0L0-f[0x8715cd98]
17:17:51.921 AVAST engine scan C:\WINDOWS
17:18:03.968 AVAST engine scan C:\WINDOWS\system32
17:19:58.437 AVAST engine scan C:\WINDOWS\system32\drivers
17:20:15.046 AVAST engine scan C:\Dokumente und Einstellungen\familykoch
17:29:19.562 AVAST engine scan C:\Dokumente und Einstellungen\All Users
17:31:43.406 Scan finished successfully
17:32:06.203 Disk 0 MBR has been saved successfully to "C:\Dokumente und Einstellungen\familykoch\Desktop\MBR.dat"
17:32:06.234 The log file has been saved successfully to "C:\Dokumente und Einstellungen\familykoch\Desktop\aswMBR.txt"

Wir sollten den MBR reparieren. Sichere für den Fall der Fälle jetzt alle wichtigen Daten.

Hast Du noch andere Betriebssystem außer WinXP drauf?

Wenn nicht, also WinXP das einzige installierte System ist: Starte den Rechner neu und wähle im Bootmenü die Wiederherstellungskonsole aus.
Tipp dort den Befehl fixmbr ein (dann Enter, mit j bestätigen) danach den Befehl fixboot (dann Enter, mit j bestätigen)
Mit exit (dann enter drücken) wird der Rechner neu gestartet. Führe im normalen Windowsmodus MBRcheck und GMER nochmals aus und poste das neue Log.

Habe nur ein Betriebssystem.
Daten auf externer Festplatte gesichert.

Wie genau komme ich beim Aufstarten des PCs ins Bootmenü?

Gruss
Tom

Das Bootmenü sollte von allein angezeigt werden, CF hat dir ja die Wiederherstellungskonsole installiert. Sollte die Anzeigedauer unter WindowsXP zu kurz sein mach das:

1.) Stell erstmal sicher, dass dir alle Dateien angezeigt werden => http://www.trojaner-board.de/59624-a...-sichtbar.html
2.) Klick auf Arbeitsplatz => C:\
3.) Rechtsklick auf boot.ini => Eigenschaften => Haken bei schreibgeschützt entfernen => ok
4.) Per Doppelklick die boot.ini öffnen
5.) bei Timeout eine größere Zahl eintragen, zB statt timeout=1 trägst du timeout=30 ein
5.) boot.ini abspeichern
6.) Windows neu starten
7.) Nun wirst du das Bootmenü für 30 Sekunden sehen

Funktionierte alles aber bei der Weiderherstellungskonsole kann ich den Befehl fixmbr nicht eingeben. nach einen "f" ist fertig.
Tom

Zitat:

. nach einen "f" ist fertig.

Kannst du das mal so beschreiben, dass man nicht heumraten muss, was du meinst? :wtf:
Um in die Eingabeaufforderung zu kommen, musst du dich ggf. in die Windows-Installation einloggen, dazu auch mal den Text lesen, der die ausgegeben wird, nachdem die WHK gebootet wurde!

Ich bekomme eine Möglichkeit/Aufforderung einen Befehl in die WHK einzugeben. Wie soll das auf dem Bildschirm aussehen: Eine Eingabemaske oder ein blinkender cursor?

Tom

Ich kann nicht auf deinen Monitor schauen :pfeiff:
Vllt postest du mal wortgenau das was auf dem Monitor steht, wo du nicht weiterkommst!

Endlich Zeit zum Weitermachen..
Musste bei der Wiederherstellungskonsole *1* wählen um dann fixmbr eingeben zu könnnen

hier das erste neue mbrcheck log

aswMBR version 0.9.8.978 Copyright(c) 2011 AVAST Software
Run date: 2011-08-13 17:15:34
-----------------------------
17:15:34.859 OS Version: Windows 5.1.2600 Service Pack 3
17:15:34.859 Number of processors: 2 586 0x401
17:15:34.875 ComputerName: KOCHFAMILY UserName: familykoch
17:15:35.281 Initialize success
17:17:30.718 AVAST engine defs: 11081300
17:17:33.468 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-f
17:17:33.468 Disk 0 Vendor: ST3160023AS 8.12 Size: 152587MB BusType: 3
17:17:33.468 Disk 1 \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP1T1L0-17
17:17:33.468 Disk 1 Vendor: ST3160023AS 8.12 Size: 152587MB BusType: 3
17:17:35.500 Disk 0 MBR read successfully
17:17:35.500 Disk 0 MBR scan
17:17:35.531 Disk 0 unknown MBR code
17:17:35.531 Disk 0 scanning sectors +312496380
17:17:35.609 Disk 0 scanning C:\WINDOWS\system32\drivers
17:17:46.687 Service scanning
17:17:47.593 Modules scanning
17:17:51.406 Disk 0 trace - called modules:
17:17:51.421 ntkrnlpa.exe CLASSPNP.SYS disk.sys atapi.sys hal.dll pciide.sys PCIIDEX.SYS
17:17:51.421 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8714fab8]
17:17:51.421 3 CLASSPNP.SYS[f7692fd7] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP1T0L0-f[0x8715cd98]
17:17:51.921 AVAST engine scan C:\WINDOWS
17:18:03.968 AVAST engine scan C:\WINDOWS\system32
17:19:58.437 AVAST engine scan C:\WINDOWS\system32\drivers
17:20:15.046 AVAST engine scan C:\Dokumente und Einstellungen\familykoch
17:29:19.562 AVAST engine scan C:\Dokumente und Einstellungen\All Users
17:31:43.406 Scan finished successfully
17:32:06.203 Disk 0 MBR has been saved successfully to "C:\Dokumente und Einstellungen\familykoch\Desktop\MBR.dat"
17:32:06.234 The log file has been saved successfully to "C:\Dokumente und Einstellungen\familykoch\Desktop\aswMBR.txt"

aswMBR version 0.9.8.978 Copyright(c) 2011 AVAST Software
Run date: 2011-08-27 13:13:06
-----------------------------
13:13:06.968 OS Version: Windows 5.1.2600 Service Pack 3
13:13:06.968 Number of processors: 2 586 0x401
13:13:06.968 ComputerName: KOCHFAMILY UserName: familykoch
13:13:08.859 Initialize success
13:13:50.921 AVAST engine defs: 11082700
13:13:54.171 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-4
13:13:54.171 Disk 0 Vendor: ST3160023AS 8.12 Size: 152587MB BusType: 3
13:13:54.171 Disk 1 \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP0T1L0-c
13:13:54.171 Disk 1 Vendor: ST3160023AS 8.12 Size: 152587MB BusType: 3
13:13:56.171 Disk 0 MBR read successfully
13:13:56.171 Disk 0 MBR scan
13:13:56.187 Disk 0 Windows XP default MBR code
13:13:56.203 Disk 0 scanning sectors +312496380
13:13:56.281 Disk 0 scanning C:\WINDOWS\system32\drivers
13:14:18.406 Service scanning
13:14:18.859 Service MpKsl622e2bf7 C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft\Microsoft Antimalware\Definition Updates\{64302618-3E63-4097-986A-99FCAD5A4053}\MpKsl622e2bf7.sys **LOCKED** 32
13:14:19.546 Modules scanning
13:14:37.937 Disk 0 MBR has been saved successfully to "C:\Dokumente und Einstellungen\familykoch\Desktop\MBR.dat"
13:14:37.937 The log file has been saved successfully to "C:\Dokumente und Einstellungen\familykoch\Desktop\aswMBR.txt"

Ups

aswMBR war noch niicht fertig. ich warte bis der Scan ganz durch ist.

Tom

Zitat:

13:13:56.187 Disk 0 Windows XP default MBR code

Ist doch schon gut so. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Hier jetzt der ganze Scan. ich mache jetzt zuerst noch GMER
------------------------------------------------------------------

aswMBR version 0.9.8.978 Copyright(c) 2011 AVAST Software
Run date: 2011-08-13 17:15:34
-----------------------------
17:15:34.859 OS Version: Windows 5.1.2600 Service Pack 3
17:15:34.859 Number of processors: 2 586 0x401
17:15:34.875 ComputerName: KOCHFAMILY UserName: familykoch
17:15:35.281 Initialize success
17:17:30.718 AVAST engine defs: 11081300
17:17:33.468 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-f
17:17:33.468 Disk 0 Vendor: ST3160023AS 8.12 Size: 152587MB BusType: 3
17:17:33.468 Disk 1 \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP1T1L0-17
17:17:33.468 Disk 1 Vendor: ST3160023AS 8.12 Size: 152587MB BusType: 3
17:17:35.500 Disk 0 MBR read successfully
17:17:35.500 Disk 0 MBR scan
17:17:35.531 Disk 0 unknown MBR code
17:17:35.531 Disk 0 scanning sectors +312496380
17:17:35.609 Disk 0 scanning C:\WINDOWS\system32\drivers
17:17:46.687 Service scanning
17:17:47.593 Modules scanning
17:17:51.406 Disk 0 trace - called modules:
17:17:51.421 ntkrnlpa.exe CLASSPNP.SYS disk.sys atapi.sys hal.dll pciide.sys PCIIDEX.SYS
17:17:51.421 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8714fab8]
17:17:51.421 3 CLASSPNP.SYS[f7692fd7] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP1T0L0-f[0x8715cd98]
17:17:51.921 AVAST engine scan C:\WINDOWS
17:18:03.968 AVAST engine scan C:\WINDOWS\system32
17:19:58.437 AVAST engine scan C:\WINDOWS\system32\drivers
17:20:15.046 AVAST engine scan C:\Dokumente und Einstellungen\familykoch
17:29:19.562 AVAST engine scan C:\Dokumente und Einstellungen\All Users
17:31:43.406 Scan finished successfully
17:32:06.203 Disk 0 MBR has been saved successfully to "C:\Dokumente und Einstellungen\familykoch\Desktop\MBR.dat"
17:32:06.234 The log file has been saved successfully to "C:\Dokumente und Einstellungen\familykoch\Desktop\aswMBR.txt"

aswMBR version 0.9.8.978 Copyright(c) 2011 AVAST Software
Run date: 2011-08-27 13:13:06
-----------------------------
13:13:06.968 OS Version: Windows 5.1.2600 Service Pack 3
13:13:06.968 Number of processors: 2 586 0x401
13:13:06.968 ComputerName: KOCHFAMILY UserName: familykoch
13:13:08.859 Initialize success
13:13:50.921 AVAST engine defs: 11082700
13:13:54.171 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-4
13:13:54.171 Disk 0 Vendor: ST3160023AS 8.12 Size: 152587MB BusType: 3
13:13:54.171 Disk 1 \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP0T1L0-c
13:13:54.171 Disk 1 Vendor: ST3160023AS 8.12 Size: 152587MB BusType: 3
13:13:56.171 Disk 0 MBR read successfully
13:13:56.171 Disk 0 MBR scan
13:13:56.187 Disk 0 Windows XP default MBR code
13:13:56.203 Disk 0 scanning sectors +312496380
13:13:56.281 Disk 0 scanning C:\WINDOWS\system32\drivers
13:14:18.406 Service scanning
13:14:18.859 Service MpKsl622e2bf7 C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft\Microsoft Antimalware\Definition Updates\{64302618-3E63-4097-986A-99FCAD5A4053}\MpKsl622e2bf7.sys **LOCKED** 32
13:14:19.546 Modules scanning
13:14:37.937 Disk 0 MBR has been saved successfully to "C:\Dokumente und Einstellungen\familykoch\Desktop\MBR.dat"
13:14:37.937 The log file has been saved successfully to "C:\Dokumente und Einstellungen\familykoch\Desktop\aswMBR.txt"

aswMBR version 0.9.8.978 Copyright(c) 2011 AVAST Software
Run date: 2011-08-27 13:13:06
-----------------------------
13:13:06.968 OS Version: Windows 5.1.2600 Service Pack 3
13:13:06.968 Number of processors: 2 586 0x401
13:13:06.968 ComputerName: KOCHFAMILY UserName: familykoch
13:13:08.859 Initialize success
13:13:50.921 AVAST engine defs: 11082700
13:13:54.171 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-4
13:13:54.171 Disk 0 Vendor: ST3160023AS 8.12 Size: 152587MB BusType: 3
13:13:54.171 Disk 1 \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP0T1L0-c
13:13:54.171 Disk 1 Vendor: ST3160023AS 8.12 Size: 152587MB BusType: 3
13:13:56.171 Disk 0 MBR read successfully
13:13:56.171 Disk 0 MBR scan
13:13:56.187 Disk 0 Windows XP default MBR code
13:13:56.203 Disk 0 scanning sectors +312496380
13:13:56.281 Disk 0 scanning C:\WINDOWS\system32\drivers
13:14:18.406 Service scanning
13:14:18.859 Service MpKsl622e2bf7 C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft\Microsoft Antimalware\Definition Updates\{64302618-3E63-4097-986A-99FCAD5A4053}\MpKsl622e2bf7.sys **LOCKED** 32
13:14:19.546 Modules scanning
13:14:37.937 Disk 0 MBR has been saved successfully to "C:\Dokumente und Einstellungen\familykoch\Desktop\MBR.dat"
13:14:37.937 The log file has been saved successfully to "C:\Dokumente und Einstellungen\familykoch\Desktop\aswMBR.txt"
13:16:04.593 Disk 0 trace - called modules:
13:16:04.593 ntkrnlpa.exe CLASSPNP.SYS disk.sys atapi.sys hal.dll pciide.sys PCIIDEX.SYS
13:16:04.593 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8717f7a8]
13:16:04.593 3 CLASSPNP.SYS[f7692fd7] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-4[0x87192b00]
13:16:05.140 AVAST engine scan C:\WINDOWS
13:17:06.203 AVAST engine scan C:\WINDOWS\system32
13:24:56.062 AVAST engine scan C:\WINDOWS\system32\drivers
13:25:42.078 AVAST engine scan C:\Dokumente und Einstellungen\familykoch
13:47:05.937 AVAST engine scan C:\Dokumente und Einstellungen\All Users
13:51:21.453 Scan finished successfully
13:52:12.421 Disk 0 MBR has been saved successfully to "C:\Dokumente und Einstellungen\familykoch\Desktop\MBR.dat"
13:52:12.437 The log file has been saved successfully to "C:\Dokumente und Einstellungen\familykoch\Desktop\aswMBR.txt"

GMER Log

GMER Logfile:

Code:

GMER 1.0.15.15641 - hxxp://www.gmer.net

Rootkit scan 2011-08-27 17:54:30

Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-4 ST3160023AS rev.8.12

Running: bdym9u4y.exe; Driver: C:\DOKUME~1\FAMILY~1\LOKALE~1\Temp\pwriyfow.sys
 
 

---- Kernel code sections - GMER 1.0.15 ----
 

?               dimaint.sys                                                                                                         Das System kann die angegebene Datei nicht finden. !

.text           C:\WINDOWS\system32\DRIVERS\ati2mtag.sys                                                                            section is writeable [0xF6453000, 0x198FE0, 0xE8000020]

init            C:\WINDOWS\system32\drivers\senfilt.sys                                                                             entry point in "init" section [0xF6285F80]

.text           C:\WINDOWS\system32\drivers\SSHDRV86.sys                                                                            section is writeable [0xEDDE4000, 0x26354, 0xE8000020]

.pklstb         C:\WINDOWS\system32\drivers\SSHDRV86.sys                                                                            entry point in ".pklstb" section [0xEDE19000]

.relo2          C:\WINDOWS\system32\drivers\SSHDRV86.sys                                                                            unknown last section [0xEDE30000, 0x8E, 0x42000040]

.text           C:\WINDOWS\system32\drivers\ACEDRV05.sys                                                                            section is writeable [0xEB7BE000, 0x30A4A, 0xE8000020]

.pklstb         C:\WINDOWS\system32\drivers\ACEDRV05.sys                                                                            entry point in ".pklstb" section [0xEB800000]

.relo2          C:\WINDOWS\system32\drivers\ACEDRV05.sys                                                                            unknown last section [0xEB81B000, 0x8E, 0x42000040]

.text           C:\WINDOWS\system32\DRIVERS\atksgt.sys                                                                              section is writeable [0xEE024300, 0x3ACC8, 0xE8000020]

.text           C:\WINDOWS\system32\DRIVERS\lirsgt.sys                                                                              section is writeable [0xF78F2300, 0x1B7E, 0xE8000020]

?               C:\DOKUME~1\FAMILY~1\LOKALE~1\Temp\aswMBR.sys                                                                       Das System kann die angegebene Datei nicht finden. !
 

---- User code sections - GMER 1.0.15 ----
 

.text           C:\Programme\Microsoft Office\Office14\OUTLOOK.EXE[472] kernel32.dll!SetUnhandledExceptionFilter                    7C84495D 5 Bytes  JMP 39008FA9 C:\Programme\Gemeinsame Dateien\Microsoft Shared\office14\mso.dll (Microsoft Office 2010 component/Microsoft Corporation)

.text           C:\Programme\Microsoft Office\Office14\OUTLOOK.EXE[472] ole32.dll!OleLoadFromStream                                 774F981B 5 Bytes  JMP 395486A0 C:\Programme\Gemeinsame Dateien\Microsoft Shared\office14\mso.dll (Microsoft Office 2010 component/Microsoft Corporation)

.text           C:\Programme\Mozilla Firefox\firefox.exe[1696] ntdll.dll!LdrLoadDll                                                 7C92632D 5 Bytes  JMP 00401410 C:\Programme\Mozilla Firefox\firefox.exe (Firefox/Mozilla Corporation)

.text           C:\Programme\Microsoft Office\Office14\GROOVE.EXE[3460] kernel32.dll!SetUnhandledExceptionFilter                    7C84495D 5 Bytes  JMP 39008FA9 C:\Programme\Gemeinsame Dateien\Microsoft Shared\office14\mso.dll (Microsoft Office 2010 component/Microsoft Corporation)

.text           C:\Programme\Microsoft Office\Office14\GROOVE.EXE[3460] ole32.dll!OleLoadFromStream                                 774F981B 5 Bytes  JMP 395486A0 C:\Programme\Gemeinsame Dateien\Microsoft Shared\office14\mso.dll (Microsoft Office 2010 component/Microsoft Corporation)

.text           C:\Programme\Mozilla Firefox\plugin-container.exe[3696] USER32.dll!SetWindowLongA                                   7E37C29D 5 Bytes  JMP 106AA2FB C:\Programme\Mozilla Firefox\xul.dll (Mozilla Foundation)

.text           C:\Programme\Mozilla Firefox\plugin-container.exe[3696] USER32.dll!SetWindowLongW                                   7E37C2BB 5 Bytes  JMP 106AA28D C:\Programme\Mozilla Firefox\xul.dll (Mozilla Foundation)

.text           C:\Programme\Mozilla Firefox\plugin-container.exe[3696] USER32.dll!GetWindowInfo                                    7E37C49C 5 Bytes  JMP 104B1BD2 C:\Programme\Mozilla Firefox\xul.dll (Mozilla Foundation)

.text           C:\Programme\Mozilla Firefox\plugin-container.exe[3696] USER32.dll!TrackPopupMenu                                   7E3B531E 5 Bytes  JMP 104B219D C:\Programme\Mozilla Firefox\xul.dll (Mozilla Foundation)
 

---- Devices - GMER 1.0.15 ----
 

Device          \Driver\prodrv06 \Device\ProDrv06                                                                                   E1FAD290

Device          \Driver\prohlp02 \Device\ProHlp02                                                                                   E18C24D8

Device                                                                                                                              mrxsmb.sys (Windows NT SMB Minirdr/Microsoft Corporation)

Device                                                                                                                              B9A71D20
 

AttachedDevice                                                                                                                      fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
 

---- Registry - GMER 1.0.15 ----
 

Reg             HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher@TracesProcessed                                        66

Reg             HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher@TracesSuccessful                                       51

Reg             HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32                                   

Reg             HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ThreadingModel                    Apartment

Reg             HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL

Reg             HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@cd042efbbd7f7af1647644e76e06692b  0xE2 0x63 0x26 0xF1 ...

Reg             HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32                                   

Reg             HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ThreadingModel                    Apartment

Reg             HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL

Reg             HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@bca643cdc5c2726b20d2ecedcc62c59b  0x6A 0x9C 0xD6 0x61 ...

Reg             HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32                                   

Reg             HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ThreadingModel                    Apartment

Reg             HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL

Reg             HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@2c81e34222e8052573023a60d06dd016  0x25 0xDA 0xEC 0x7E ...

Reg             HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32                                   

Reg             HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ThreadingModel                    Apartment

Reg             HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL

Reg             HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@2582ae41fb52324423be06337561aa48  0x3E 0x1E 0x9E 0xE0 ...

Reg             HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32                                   

Reg             HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ThreadingModel                    Apartment

Reg             HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL

Reg             HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@caaeda5fd7a9ed7697d9686d4b818472  0xCD 0x44 0xCD 0xB9 ...

Reg             HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32                                   

Reg             HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ThreadingModel                    Apartment

Reg             HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL

Reg             HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@a4a1bcf2cc2b8bc3716b74b2b4522f5d  0xB0 0x18 0xED 0xA7 ...

Reg             HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32                                   

Reg             HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ThreadingModel                    Apartment

Reg             HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL

Reg             HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@4d370831d2c43cd13623e232fed27b7b  0xFB 0xA7 0x78 0xE6 ...

Reg             HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32                                   

Reg             HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ThreadingModel                    Apartment

Reg             HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL

Reg             HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@1d68fe701cdea33e477eb204b76f993d  0x83 0x6C 0x56 0x8B ...

Reg             HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32                                   

Reg             HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ThreadingModel                    Apartment

Reg             HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL

Reg             HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@1fac81b91d8e3c5aa4b0a51804d844a3  0xF6 0x0F 0x4E 0x58 ...

Reg             HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32                                   

Reg             HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ThreadingModel                    Apartment

Reg             HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL

Reg             HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@f5f62a6129303efb32fbe080bb27835b  0x3D 0xCE 0xEA 0x26 ...

Reg             HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32                                   

Reg             HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ThreadingModel                    Apartment

Reg             HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL

Reg             HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@fd4e2e1a3940b94dceb5a6a021f2e3c6  0xF8 0x31 0x0F 0xA9 ...

Reg             HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32                                   

Reg             HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ThreadingModel                    Apartment

Reg             HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL

Reg             HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@8a8aec57dd6508a385616fbc86791ec2  0xFA 0xEA 0x66 0x7F ...
 

---- EOF - GMER 1.0.15 ----

--- --- ---

Malwarebytes' Anti-Malware 1.51.1.1800
Malwarebytes : Free anti-malware, anti-virus and spyware removal download

Database version: 7587

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

28.08.2011 01:21:59
mbam-log-2011-08-28 (01-21-58).txt

Scan type: Full scan (C:\|D:\|)
Objects scanned: 457147
Time elapsed: 7 hour(s), 19 minute(s), 18 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

ESETSmartInstaller@High as downloader log:
all ok
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=633cc7b6f218dd4980085cb9f3ec7a23
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-08-28 09:12:10
# local_time=2011-08-28 11:12:10 (+0100, Westeuropäische Sommerzeit)
# country="Switzerland"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=512 16777215 100 0 4182722 4182722 0 0
# compatibility_mode=5891 16776533 42 87 0 11384343 0 0
# compatibility_mode=8192 67108863 100 0 177 177 0 0
# scanned=172751
# found=0
# cleaned=0
# scan_time=12873