Trojaner-Board - Ein oder mehrere Trojanaer (Ursprung Facebook)

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - Ein oder mehrere Trojanaer (Ursprung Facebook) (https://www.trojaner-board.de/103970-mehrere-trojanaer-ursprung-facebook.html)

Okay Done. (Das war nur ein Eintrag, den ich gelöscht habe)

Dann mach bitte ein neues Log mit dem TDSS-Killer.

20:45:37.0281 1796 TDSS rootkit removing tool 2.6.12.0 Oct 21 2011 11:23:48
20:45:37.0484 1796 ============================================================
20:45:37.0484 1796 Current date / time: 2011/10/24 20:45:37.0484
20:45:37.0484 1796 SystemInfo:
20:45:37.0484 1796
20:45:37.0484 1796 OS Version: 5.1.2600 ServicePack: 3.0
20:45:37.0484 1796 Product type: Workstation
20:45:37.0484 1796 ComputerName: EU
20:45:37.0484 1796 UserName: xxx
20:45:37.0484 1796 Windows directory: C:\WINDOWS
20:45:37.0484 1796 System windows directory: C:\WINDOWS
20:45:37.0484 1796 Processor architecture: Intel x86
20:45:37.0484 1796 Number of processors: 3
20:45:37.0484 1796 Page size: 0x1000
20:45:37.0484 1796 Boot type: Normal boot
20:45:37.0484 1796 ============================================================
20:45:38.0578 1796 Initialize success
20:45:43.0421 2736 ============================================================
20:45:43.0421 2736 Scan started
20:45:43.0421 2736 Mode: Manual; SigCheck; TDLFS;
20:45:43.0421 2736 ============================================================
20:45:44.0609 2736 Abiosdsk - ok
20:45:44.0625 2736 abp480n5 - ok
20:45:44.0671 2736 ACPI (ac407f1a62c3a300b4f2b5a9f1d55b2c) C:\WINDOWS\system32\DRIVERS\ACPI.sys
20:45:44.0859 2736 ACPI - ok
20:45:44.0875 2736 ACPIEC (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\drivers\ACPIEC.sys
20:45:44.0968 2736 ACPIEC - ok
20:45:44.0968 2736 adpu160m - ok
20:45:44.0984 2736 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
20:45:45.0031 2736 aec - ok
20:45:45.0078 2736 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
20:45:45.0093 2736 AFD - ok
20:45:45.0093 2736 Aha154x - ok
20:45:45.0109 2736 aic78u2 - ok
20:45:45.0109 2736 aic78xx - ok
20:45:45.0125 2736 AliIde - ok
20:45:45.0125 2736 amsint - ok
20:45:45.0140 2736 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
20:45:45.0203 2736 Arp1394 - ok
20:45:45.0218 2736 asc - ok
20:45:45.0218 2736 asc3350p - ok
20:45:45.0218 2736 asc3550 - ok
20:45:45.0250 2736 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
20:45:45.0312 2736 AsyncMac - ok
20:45:45.0328 2736 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
20:45:45.0390 2736 atapi - ok
20:45:45.0390 2736 Atdisk - ok
20:45:45.0484 2736 ati2mtag (caadf7aa3abc6afcb3d02b129de9863a) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys
20:45:45.0593 2736 ati2mtag - ok
20:45:45.0640 2736 atksgt (f0d933b42cd0594048e4d5200ae9e417) C:\WINDOWS\system32\DRIVERS\atksgt.sys
20:45:45.0671 2736 atksgt - ok
20:45:45.0718 2736 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
20:45:45.0781 2736 Atmarpc - ok
20:45:45.0796 2736 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
20:45:45.0875 2736 audstub - ok
20:45:45.0906 2736 avgntflt (7713e4eb0276702faa08e52a6e23f2a6) C:\WINDOWS\system32\DRIVERS\avgntflt.sys
20:45:45.0921 2736 avgntflt - ok
20:45:45.0953 2736 avipbb (912d23140cd05980f6cdae790ddafc8d) C:\WINDOWS\system32\DRIVERS\avipbb.sys
20:45:45.0968 2736 avipbb - ok
20:45:46.0000 2736 avkmgr (271cfd1a989209b1964e24d969552bf7) C:\WINDOWS\system32\DRIVERS\avkmgr.sys
20:45:46.0015 2736 avkmgr - ok
20:45:46.0046 2736 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
20:45:46.0125 2736 Beep - ok
20:45:46.0156 2736 BTCFilterService (4813df77ede536a52e3737971f910baa) C:\WINDOWS\system32\DRIVERS\motfilt.sys
20:45:46.0187 2736 BTCFilterService - ok
20:45:46.0218 2736 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
20:45:46.0312 2736 cbidf2k - ok
20:45:46.0312 2736 cd20xrnt - ok
20:45:46.0359 2736 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
20:45:46.0437 2736 Cdaudio - ok
20:45:46.0468 2736 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
20:45:46.0531 2736 Cdfs - ok
20:45:46.0546 2736 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
20:45:46.0609 2736 Cdrom - ok
20:45:46.0625 2736 Changer - ok
20:45:46.0625 2736 CmdIde - ok
20:45:46.0640 2736 Cpqarray - ok
20:45:46.0703 2736 cpuz130 - ok
20:45:46.0750 2736 d347bus (5776322f93cdb91086111f5ffbfda2a0) C:\WINDOWS\System32\DRIVERS\d347bus.sys
20:45:46.0765 2736 d347bus ( UnsignedFile.Multi.Generic ) - warning
20:45:46.0765 2736 d347bus - detected UnsignedFile.Multi.Generic (1)
20:45:46.0765 2736 d347prt (b49f79ace459763f4e0380071be9cb45) C:\WINDOWS\System32\Drivers\d347prt.sys
20:45:46.0781 2736 d347prt ( UnsignedFile.Multi.Generic ) - warning
20:45:46.0781 2736 d347prt - detected UnsignedFile.Multi.Generic (1)
20:45:46.0781 2736 dac2w2k - ok
20:45:46.0781 2736 dac960nt - ok
20:45:46.0828 2736 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
20:45:46.0890 2736 Disk - ok
20:45:46.0906 2736 dmboot (0dcfc8395a99fecbb1ef771cec7fe4ea) C:\WINDOWS\system32\drivers\dmboot.sys
20:45:46.0984 2736 dmboot - ok
20:45:47.0000 2736 dmio (53720ab12b48719d00e327da470a619a) C:\WINDOWS\system32\drivers\dmio.sys
20:45:47.0078 2736 dmio - ok
20:45:47.0093 2736 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
20:45:47.0171 2736 dmload - ok
20:45:47.0187 2736 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
20:45:47.0265 2736 DMusic - ok
20:45:47.0265 2736 dpti2o - ok
20:45:47.0265 2736 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
20:45:47.0328 2736 drmkaud - ok
20:45:47.0375 2736 ENTECH (16ebd8bf1d5090923694cc972c7ce1b4) C:\WINDOWS\System32\DRIVERS\ENTECH.sys
20:45:47.0375 2736 ENTECH - ok
20:45:47.0390 2736 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
20:45:47.0453 2736 Fastfat - ok
20:45:47.0468 2736 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
20:45:47.0531 2736 Fdc - ok
20:45:47.0546 2736 Fips (b0678a548587c5f1967b0d70bacad6c1) C:\WINDOWS\system32\drivers\Fips.sys
20:45:47.0593 2736 Fips - ok
20:45:47.0609 2736 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
20:45:47.0671 2736 Flpydisk - ok
20:45:47.0703 2736 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
20:45:47.0765 2736 FltMgr - ok
20:45:47.0781 2736 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
20:45:47.0843 2736 Fs_Rec - ok
20:45:47.0843 2736 Ftdisk (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
20:45:47.0937 2736 Ftdisk - ok
20:45:47.0953 2736 gdrv (c6e3105b8c68c35cc1eb26a00fd1a8c6) C:\WINDOWS\gdrv.sys
20:45:47.0968 2736 gdrv - ok
20:45:47.0984 2736 giveio (77ebf3e9386daa51551af429052d88d0) C:\WINDOWS\system32\giveio.sys
20:45:47.0984 2736 giveio ( UnsignedFile.Multi.Generic ) - warning
20:45:47.0984 2736 giveio - detected UnsignedFile.Multi.Generic (1)
20:45:48.0015 2736 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
20:45:48.0078 2736 Gpc - ok
20:45:48.0093 2736 hamachi (d30b31375c40309425c21efe75db90bb) C:\WINDOWS\system32\DRIVERS\hamachi.sys
20:45:48.0109 2736 hamachi - ok
20:45:48.0125 2736 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
20:45:48.0171 2736 HDAudBus - ok
20:45:48.0203 2736 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
20:45:48.0265 2736 HidUsb - ok
20:45:48.0281 2736 hpn - ok
20:45:48.0328 2736 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
20:45:48.0343 2736 HTTP - ok
20:45:48.0343 2736 i2omgmt - ok
20:45:48.0359 2736 i2omp - ok
20:45:48.0390 2736 i8042prt (e283b97cfbeb86c1d86baed5f7846a92) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
20:45:48.0437 2736 i8042prt - ok
20:45:48.0484 2736 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
20:45:48.0546 2736 Imapi - ok
20:45:48.0546 2736 ini910u - ok
20:45:48.0656 2736 IntcAzAudAddService (2feb5bf0312e1cb76cd2caa875cbaa5d) C:\WINDOWS\system32\drivers\RtkHDAud.sys
20:45:48.0796 2736 IntcAzAudAddService - ok
20:45:48.0796 2736 IntelIde - ok
20:45:48.0828 2736 ip6fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
20:45:48.0906 2736 ip6fw - ok
20:45:48.0921 2736 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
20:45:49.0015 2736 IpFilterDriver - ok
20:45:49.0031 2736 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
20:45:49.0093 2736 IpInIp - ok
20:45:49.0109 2736 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
20:45:49.0187 2736 IpNat - ok
20:45:49.0203 2736 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
20:45:49.0265 2736 IPSec - ok
20:45:49.0281 2736 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
20:45:49.0343 2736 IRENUM - ok
20:45:49.0359 2736 isapnp (6dfb88f64135c525433e87648bda30de) C:\WINDOWS\system32\DRIVERS\isapnp.sys
20:45:49.0421 2736 isapnp - ok
20:45:49.0453 2736 Kbdclass (1704d8c4c8807b889e43c649b478a452) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
20:45:49.0515 2736 Kbdclass - ok
20:45:49.0531 2736 kbdhid (b6d6c117d771c98130497265f26d1882) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
20:45:49.0578 2736 kbdhid - ok
20:45:49.0609 2736 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
20:45:49.0671 2736 kmixer - ok
20:45:49.0718 2736 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
20:45:49.0734 2736 KSecDD - ok
20:45:49.0750 2736 L8042Kbd (0c6e346cde730cf1356dd69ad6e9bc42) C:\WINDOWS\system32\DRIVERS\L8042Kbd.sys
20:45:49.0765 2736 L8042Kbd - ok
20:45:49.0781 2736 L8042mou (8a5993705add14352c9a279fa8338334) C:\WINDOWS\system32\DRIVERS\L8042mou.Sys
20:45:49.0781 2736 L8042mou - ok
20:45:49.0812 2736 LBeepKE (9ffd1cf2a782f2560e78eec4b8b8689e) C:\WINDOWS\system32\Drivers\LBeepKE.sys
20:45:49.0828 2736 LBeepKE - ok
20:45:49.0828 2736 lbrtfdc - ok
20:45:49.0843 2736 LHidFilt (7f9c7b28cf1c859e1c42619eea946dc8) C:\WINDOWS\system32\DRIVERS\LHidFilt.Sys
20:45:49.0843 2736 LHidFilt - ok
20:45:49.0875 2736 lirsgt (f8a7212d0864ef5e9185fb95e6623f4d) C:\WINDOWS\system32\DRIVERS\lirsgt.sys
20:45:49.0875 2736 lirsgt - ok
20:45:49.0875 2736 LMouFilt (ab33792a87285344f43b5ce23421bab0) C:\WINDOWS\system32\DRIVERS\LMouFilt.Sys
20:45:49.0890 2736 LMouFilt - ok
20:45:49.0890 2736 LMouKE (9837e55673818ecd8febb47f7f77521a) C:\WINDOWS\system32\DRIVERS\LMouKE.Sys
20:45:49.0890 2736 LMouKE - ok
20:45:49.0968 2736 lredbooo - ok
20:45:49.0984 2736 LUsbFilt (77030525cd86a93f1af34fa9b96d33ce) C:\WINDOWS\system32\Drivers\LUsbFilt.Sys
20:45:49.0984 2736 LUsbFilt - ok
20:45:50.0000 2736 MBAMSwissArmy - ok
20:45:50.0031 2736 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
20:45:50.0109 2736 mnmdd - ok
20:45:50.0140 2736 Modem (6fb74ebd4ec57a6f1781de3852cc3362) C:\WINDOWS\system32\drivers\Modem.sys
20:45:50.0203 2736 Modem - ok
20:45:50.0234 2736 motccgp (1088f75c09ebb0a8b0f13b886fd67c52) C:\WINDOWS\system32\DRIVERS\motccgp.sys
20:45:50.0265 2736 motccgp - ok
20:45:50.0312 2736 motccgpfl (b812da6605caf02641312f1f65c75419) C:\WINDOWS\system32\DRIVERS\motccgpfl.sys
20:45:50.0343 2736 motccgpfl - ok
20:45:50.0375 2736 motmodem (8f408e9ed2feb8a8b8837c380faf7ad6) C:\WINDOWS\system32\DRIVERS\motmodem.sys
20:45:50.0421 2736 motmodem - ok
20:45:50.0421 2736 MotoSwitchService (fd8c2cef7ad8b23c6714103d621fac1f) C:\WINDOWS\system32\DRIVERS\motswch.sys
20:45:50.0453 2736 MotoSwitchService - ok
20:45:50.0468 2736 Motousbnet (ddc489d40b49f443787e7ffa75373522) C:\WINDOWS\system32\DRIVERS\Motousbnet.sys
20:45:50.0484 2736 Motousbnet - ok
20:45:50.0515 2736 motusbdevice (2136cca3d1bf7c0248e5366b1a6c24e3) C:\WINDOWS\system32\DRIVERS\motusbdevice.sys
20:45:50.0531 2736 motusbdevice - ok
20:45:50.0562 2736 Mouclass (b24ce8005deab254c0251e15cb71d802) C:\WINDOWS\system32\DRIVERS\mouclass.sys
20:45:50.0625 2736 Mouclass - ok
20:45:50.0625 2736 mouhid (66a6f73c74e1791464160a7065ce711a) C:\WINDOWS\system32\DRIVERS\mouhid.sys
20:45:50.0703 2736 mouhid - ok
20:45:50.0734 2736 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
20:45:50.0781 2736 MountMgr - ok
20:45:50.0796 2736 mraid35x - ok
20:45:50.0796 2736 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
20:45:50.0859 2736 MRxDAV - ok
20:45:50.0890 2736 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
20:45:50.0921 2736 MRxSmb - ok
20:45:50.0937 2736 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
20:45:51.0000 2736 Msfs - ok
20:45:51.0015 2736 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
20:45:51.0093 2736 MSKSSRV - ok
20:45:51.0109 2736 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
20:45:51.0171 2736 MSPCLOCK - ok
20:45:51.0187 2736 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
20:45:51.0250 2736 MSPQM - ok
20:45:51.0265 2736 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
20:45:51.0312 2736 mssmbios - ok
20:45:51.0343 2736 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
20:45:51.0390 2736 Mup - ok
20:45:51.0406 2736 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
20:45:51.0468 2736 NDIS - ok
20:45:51.0500 2736 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
20:45:51.0515 2736 NdisTapi - ok
20:45:51.0531 2736 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
20:45:51.0593 2736 Ndisuio - ok
20:45:51.0593 2736 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
20:45:51.0656 2736 NdisWan - ok
20:45:51.0687 2736 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
20:45:51.0687 2736 NDProxy - ok
20:45:51.0703 2736 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
20:45:51.0765 2736 NetBIOS - ok
20:45:51.0781 2736 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
20:45:51.0843 2736 NetBT - ok
20:45:51.0859 2736 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
20:45:51.0921 2736 NIC1394 - ok
20:45:51.0968 2736 nltdi (19c50a0051fed34cc2544cd45114e4e5) C:\WINDOWS\system32\drivers\nltdi.sys
20:45:51.0968 2736 nltdi ( UnsignedFile.Multi.Generic ) - warning
20:45:51.0968 2736 nltdi - detected UnsignedFile.Multi.Generic (1)
20:45:52.0000 2736 nmwcd (c82f4cc10ad315b6d6bcb14d0a7cad66) C:\WINDOWS\system32\drivers\ccdcmb.sys
20:45:52.0031 2736 nmwcd - ok
20:45:52.0046 2736 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
20:45:52.0109 2736 Npfs - ok
20:45:52.0125 2736 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
20:45:52.0187 2736 Ntfs - ok
20:45:52.0234 2736 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
20:45:52.0296 2736 Null - ok
20:45:52.0343 2736 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
20:45:52.0406 2736 NwlnkFlt - ok
20:45:52.0406 2736 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
20:45:52.0484 2736 NwlnkFwd - ok
20:45:52.0500 2736 ohci1394 (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
20:45:52.0562 2736 ohci1394 - ok
20:45:52.0578 2736 Parport (f84785660305b9b903fb3bca8ba29837) C:\WINDOWS\system32\DRIVERS\parport.sys
20:45:52.0640 2736 Parport - ok
20:45:52.0656 2736 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
20:45:52.0703 2736 PartMgr - ok
20:45:52.0734 2736 ParVdm (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys
20:45:52.0796 2736 ParVdm - ok
20:45:52.0796 2736 PCAMPR5 - ok
20:45:52.0828 2736 PCANDIS5 (2f9806b52cb3748b1e49222744b28e3c) C:\WINDOWS\system32\PCANDIS5.SYS
20:45:52.0843 2736 PCANDIS5 ( UnsignedFile.Multi.Generic ) - warning
20:45:52.0843 2736 PCANDIS5 - detected UnsignedFile.Multi.Generic (1)
20:45:52.0875 2736 PCI (387e8dedc343aa2d1efbc30580273acd) C:\WINDOWS\system32\DRIVERS\pci.sys
20:45:52.0937 2736 PCI - ok
20:45:52.0937 2736 PCIDump - ok
20:45:52.0968 2736 PCIIde (59ba86d9a61cbcf4df8e598c331f5b82) C:\WINDOWS\system32\DRIVERS\pciide.sys
20:45:53.0031 2736 PCIIde - ok
20:45:53.0062 2736 Pcmcia (a2a966b77d61847d61a3051df87c8c97) C:\WINDOWS\system32\drivers\Pcmcia.sys
20:45:53.0140 2736 Pcmcia - ok
20:45:53.0140 2736 PDCOMP - ok
20:45:53.0140 2736 PDFRAME - ok
20:45:53.0156 2736 PDRELI - ok
20:45:53.0156 2736 PDRFRAME - ok
20:45:53.0171 2736 perc2 - ok
20:45:53.0171 2736 perc2hib - ok
20:45:53.0187 2736 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
20:45:53.0250 2736 PptpMiniport - ok
20:45:53.0265 2736 Processor (2cb55427c58679f49ad600fccba76360) C:\WINDOWS\system32\DRIVERS\processr.sys
20:45:53.0312 2736 Processor - ok
20:45:53.0328 2736 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
20:45:53.0390 2736 PSched - ok
20:45:53.0390 2736 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
20:45:53.0453 2736 Ptilink - ok
20:45:53.0484 2736 PxHelp20 (153d02480a0a2f45785522e814c634b6) C:\WINDOWS\system32\Drivers\PxHelp20.sys
20:45:53.0484 2736 PxHelp20 - ok
20:45:53.0500 2736 ql1080 - ok
20:45:53.0500 2736 Ql10wnt - ok
20:45:53.0515 2736 ql12160 - ok
20:45:53.0515 2736 ql1240 - ok
20:45:53.0515 2736 ql1280 - ok
20:45:53.0531 2736 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
20:45:53.0593 2736 RasAcd - ok
20:45:53.0609 2736 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
20:45:53.0671 2736 Rasl2tp - ok
20:45:53.0687 2736 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
20:45:53.0750 2736 RasPppoe - ok
20:45:53.0750 2736 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
20:45:53.0828 2736 Raspti - ok
20:45:53.0843 2736 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
20:45:53.0906 2736 Rdbss - ok
20:45:53.0921 2736 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
20:45:53.0984 2736 RDPCDD - ok
20:45:54.0031 2736 RDPWD (fc105dd312ed64eb66bff111e8ec6eac) C:\WINDOWS\system32\drivers\RDPWD.sys
20:45:54.0046 2736 RDPWD - ok
20:45:54.0078 2736 redbook (ed761d453856f795a7fe056e42c36365) C:\WINDOWS\system32\DRIVERS\redbook.sys
20:45:54.0125 2736 redbook - ok
20:45:54.0218 2736 RTHDMIAzAudService (a5a9f4b77d7ff2b02633999ff71a7e9b) C:\WINDOWS\system32\drivers\RtKHDMI.sys
20:45:54.0281 2736 RTHDMIAzAudService - ok
20:45:54.0312 2736 RTLE8023xp (839141088ad7ee90f5b441b2d1afd22c) C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys
20:45:54.0328 2736 RTLE8023xp - ok
20:45:54.0359 2736 SCREAMINGBDRIVER (a689d522eedf89401e1da2fe883aa7ec) C:\WINDOWS\system32\drivers\ScreamingBAudio.sys
20:45:54.0359 2736 SCREAMINGBDRIVER - ok
20:45:54.0390 2736 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
20:45:54.0468 2736 Secdrv - ok
20:45:54.0468 2736 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
20:45:54.0531 2736 serenum - ok
20:45:54.0531 2736 Serial (cf24eb4f0412c82bcd1f4f35a025e31d) C:\WINDOWS\system32\DRIVERS\serial.sys
20:45:54.0593 2736 Serial - ok
20:45:54.0609 2736 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
20:45:54.0671 2736 Sfloppy - ok
20:45:54.0718 2736 Simbad - ok
20:45:54.0765 2736 SMCSMC WirelessUSB(SMC2662W)(R) (eaa9a0911c5cefaab85b57e2b1a7cd54) C:\WINDOWS\system32\DRIVERS\Net62151.sys
20:45:54.0765 2736 SMCSMC WirelessUSB(SMC2662W)(R) ( UnsignedFile.Multi.Generic ) - warning
20:45:54.0765 2736 SMCSMC WirelessUSB(SMC2662W)(R) - detected UnsignedFile.Multi.Generic (1)
20:45:54.0781 2736 Sparrow - ok
20:45:54.0812 2736 speedfan (9f70cd5edcc4efc48ae21e04fb03be9d) C:\WINDOWS\system32\speedfan.sys
20:45:54.0828 2736 speedfan - ok
20:45:54.0828 2736 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
20:45:54.0890 2736 splitter - ok
20:45:54.0921 2736 sptd (cdddec541bc3c96f91ecb48759673505) C:\WINDOWS\System32\Drivers\sptd.sys
20:45:54.0937 2736 sptd - ok
20:45:54.0953 2736 sr (50fa898f8c032796d3b1b9951bb5a90f) C:\WINDOWS\system32\DRIVERS\sr.sys
20:45:55.0000 2736 sr - ok
20:45:55.0031 2736 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
20:45:55.0046 2736 Srv - ok
20:45:55.0062 2736 SSHDRV5C - ok
20:45:55.0078 2736 ssmdrv (a36ee93698802cd899f98bfd553d8185) C:\WINDOWS\system32\DRIVERS\ssmdrv.sys
20:45:55.0093 2736 ssmdrv - ok
20:45:55.0093 2736 SVKP (f05028b163b92c302a74409d683ac9b0) C:\WINDOWS\system32\SVKP.sys
20:45:55.0109 2736 SVKP ( UnsignedFile.Multi.Generic ) - warning
20:45:55.0109 2736 SVKP - detected UnsignedFile.Multi.Generic (1)
20:45:55.0125 2736 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
20:45:55.0187 2736 swenum - ok
20:45:55.0203 2736 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
20:45:55.0265 2736 swmidi - ok
20:45:55.0265 2736 symc810 - ok
20:45:55.0281 2736 symc8xx - ok
20:45:55.0281 2736 sym_hi - ok
20:45:55.0296 2736 sym_u3 - ok
20:45:55.0296 2736 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
20:45:55.0359 2736 sysaudio - ok
20:45:55.0390 2736 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
20:45:55.0406 2736 Tcpip - ok
20:45:55.0421 2736 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
20:45:55.0500 2736 TDPIPE - ok
20:45:55.0515 2736 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
20:45:55.0593 2736 TDTCP - ok
20:45:55.0609 2736 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
20:45:55.0656 2736 TermDD - ok
20:45:55.0671 2736 TosIde - ok
20:45:55.0687 2736 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
20:45:55.0750 2736 Udfs - ok
20:45:55.0750 2736 ultra - ok
20:45:55.0843 2736 UnlockerDriver5 (d0cb75386d9e89c864d808d64ec9160f) C:\Programme\Unlocker\UnlockerDriver5.sys
20:45:55.0859 2736 UnlockerDriver5 ( UnsignedFile.Multi.Generic ) - warning
20:45:55.0859 2736 UnlockerDriver5 - detected UnsignedFile.Multi.Generic (1)
20:45:55.0875 2736 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
20:45:55.0953 2736 Update - ok
20:45:55.0984 2736 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
20:45:56.0046 2736 usbccgp - ok
20:45:56.0062 2736 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
20:45:56.0109 2736 usbehci - ok
20:45:56.0125 2736 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
20:45:56.0187 2736 usbhub - ok
20:45:56.0187 2736 usbohci (0daecce65366ea32b162f85f07c6753b) C:\WINDOWS\system32\DRIVERS\usbohci.sys
20:45:56.0250 2736 usbohci - ok
20:45:56.0265 2736 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
20:45:56.0343 2736 usbscan - ok
20:45:56.0359 2736 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
20:45:56.0406 2736 USBSTOR - ok
20:45:56.0437 2736 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
20:45:56.0500 2736 VgaSave - ok
20:45:56.0500 2736 ViaIde - ok
20:45:56.0515 2736 VolSnap (a5a712f4e880874a477af790b5186e1d) C:\WINDOWS\system32\drivers\VolSnap.sys
20:45:56.0578 2736 VolSnap - ok
20:45:56.0609 2736 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
20:45:56.0671 2736 Wanarp - ok
20:45:56.0765 2736 Wdf01000 (bbcfeab7e871cddac2d397ee7fa91fdc) C:\WINDOWS\system32\DRIVERS\Wdf01000.sys
20:45:56.0781 2736 Wdf01000 - ok
20:45:56.0796 2736 WDICA - ok
20:45:56.0812 2736 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
20:45:56.0859 2736 wdmaud - ok
20:45:56.0921 2736 WmiAcpi (c42584fd66ce9e17403aebca199f7bdb) C:\WINDOWS\system32\DRIVERS\wmiacpi.sys
20:45:56.0968 2736 WmiAcpi - ok
20:45:57.0015 2736 WpdUsb (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\DRIVERS\wpdusb.sys
20:45:57.0031 2736 WpdUsb - ok
20:45:57.0046 2736 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
20:45:57.0062 2736 WudfPf - ok
20:45:57.0062 2736 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
20:45:57.0078 2736 WudfRd - ok
20:45:57.0109 2736 xusb21 (a640c90b007762939507c28a021be3b3) C:\WINDOWS\system32\DRIVERS\xusb21.sys
20:45:57.0125 2736 xusb21 - ok
20:45:57.0140 2736 MBR (0x1B8) (72b8ce41af0de751c946802b3ed844b4) \Device\Harddisk0\DR0
20:45:57.0265 2736 \Device\Harddisk0\DR0 - ok
20:45:57.0265 2736 Boot (0x1200) (ce398dda82b6ab33ed783adf7de862b8) \Device\Harddisk0\DR0\Partition0
20:45:57.0265 2736 \Device\Harddisk0\DR0\Partition0 - ok
20:45:57.0296 2736 Boot (0x1200) (a24c4fed5e76d76c6ec730d1352760b0) \Device\Harddisk0\DR0\Partition1
20:45:57.0296 2736 \Device\Harddisk0\DR0\Partition1 - ok
20:45:57.0312 2736 Boot (0x1200) (f786a216f49ed491b8582010c35c534d) \Device\Harddisk0\DR0\Partition2
20:45:57.0312 2736 \Device\Harddisk0\DR0\Partition2 - ok
20:45:57.0312 2736 ============================================================
20:45:57.0312 2736 Scan finished
20:45:57.0312 2736 ============================================================
20:45:57.0406 1792 Detected object count: 8
20:45:57.0406 1792 Actual detected object count: 8
20:46:01.0062 1792 d347bus ( UnsignedFile.Multi.Generic ) - skipped by user
20:46:01.0062 1792 d347bus ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:46:01.0062 1792 d347prt ( UnsignedFile.Multi.Generic ) - skipped by user
20:46:01.0062 1792 d347prt ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:46:01.0062 1792 giveio ( UnsignedFile.Multi.Generic ) - skipped by user
20:46:01.0062 1792 giveio ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:46:01.0062 1792 nltdi ( UnsignedFile.Multi.Generic ) - skipped by user
20:46:01.0062 1792 nltdi ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:46:01.0062 1792 PCANDIS5 ( UnsignedFile.Multi.Generic ) - skipped by user
20:46:01.0062 1792 PCANDIS5 ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:46:01.0062 1792 SMCSMC WirelessUSB(SMC2662W)(R) ( UnsignedFile.Multi.Generic ) - skipped by user
20:46:01.0062 1792 SMCSMC WirelessUSB(SMC2662W)(R) ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:46:01.0062 1792 SVKP ( UnsignedFile.Multi.Generic ) - skipped by user
20:46:01.0062 1792 SVKP ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:46:01.0062 1792 UnlockerDriver5 ( UnsignedFile.Multi.Generic ) - skipped by user
20:46:01.0062 1792 UnlockerDriver5 ( UnsignedFile.Multi.Generic ) - User select action: Skip

Die Einträge da sind ok. Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop.

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

Combofix Logfile:

Code:

ComboFix 11-10-27.03 - xxx 27.10.2011  13:32:37.1.3 - x86

Microsoft Windows XP Home Edition  5.1.2600.3.1252.49.1031.18.3326.2617 [GMT 2:00]

ausgeführt von:: c:\dokumente und einstellungen\xxx\Eigene Dateien\Downloads\ComboFix.exe

 * Neuer Wiederherstellungspunkt wurde erstellt

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\dokumente und einstellungen\xxx\Anwendungsdaten\chrtmp

c:\dokumente und einstellungen\xxx\Eigene Dateien\~WRL0084.tmp

c:\dokumente und einstellungen\xxx\Eigene Dateien\~WRL0384.tmp

c:\dokumente und einstellungen\xxx\Eigene Dateien\~WRL0393.tmp

c:\dokumente und einstellungen\xxx\Eigene Dateien\~WRL0764.tmp

c:\dokumente und einstellungen\xxx\Eigene Dateien\~WRL1643.tmp

c:\dokumente und einstellungen\xxx\Eigene Dateien\~WRL1973.tmp

c:\dokumente und einstellungen\xxx\Eigene Dateien\~WRL2515.tmp

c:\dokumente und einstellungen\xxx\Eigene Dateien\~WRL2624.tmp

c:\dokumente und einstellungen\xxx\Eigene Dateien\~WRL2683.tmp

c:\dokumente und einstellungen\xxx\Eigene Dateien\~WRL3025.tmp

c:\dokumente und einstellungen\xxx\Eigene Dateien\~WRL3163.tmp

c:\dokumente und einstellungen\xxx\Eigene Dateien\~WRL3166.tmp

c:\dokumente und einstellungen\xxx\WINDOWS

c:\programme\messenger\msmsgsin.exe

c:\programme\msn\msncorefiles\copymar.exe

c:\programme\msn\msncorefiles\custdial.dll

c:\programme\msn\msncorefiles\logonmgr.dll

c:\windows\daemon.dll

c:\windows\help\tours\htmltour\unlock_playing.htm

c:\windows\IsUn0407.exe

c:\windows\system32\d3d9caps.dat

c:\windows\tsoc.log

.

.

(((((((((((((((((((((((   Dateien erstellt von 2011-09-27 bis 2011-10-27  ))))))))))))))))))))))))))))))

.

.

2011-10-20 09:52 . 2011-10-20 09:52        --------        d-----w-        C:\_OTL

2011-10-17 18:00 . 2011-10-17 18:00        --------        d-----w-        c:\dokumente und einstellungen\xxx\Anwendungsdaten\Avira

2011-10-17 17:59 . 2011-10-11 13:00        74640        ----a-w-        c:\windows\system32\drivers\avgntflt.sys

2011-10-17 17:59 . 2011-10-11 13:00        36000        ----a-w-        c:\windows\system32\drivers\avkmgr.sys

2011-10-17 17:59 . 2011-10-11 13:00        134344        ----a-w-        c:\windows\system32\drivers\avipbb.sys

2011-10-17 17:59 . 2011-10-17 17:59        --------        d-----w-        c:\programme\Avira

2011-10-17 17:59 . 2011-10-17 17:59        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Avira

2011-10-10 09:09 . 2011-10-10 09:09        4550304        ----a-w-        c:\programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\components\SkypeFfComponent.dll

2011-10-08 17:55 . 2011-10-08 17:55        --------        d-----w-        c:\dokumente und einstellungen\xxx\Anwendungsdaten\Malwarebytes

2011-10-08 17:55 . 2011-10-08 17:55        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes

2011-10-08 17:55 . 2011-10-08 19:02        --------        d-----w-        c:\programme\Malwarebytes' Anti-Malware

2011-10-08 17:55 . 2011-08-31 15:00        22216        ----a-w-        c:\windows\system32\drivers\mbam.sys

2011-10-07 12:49 . 2011-10-08 12:43        --------        d-s---w-        c:\dokumente und einstellungen\NetworkService\UserData

2011-10-06 12:42 . 2011-10-06 12:42        --------        d-----w-        c:\programme\ESET

2011-10-05 20:27 . 2011-09-29 07:09        773080        ----a-w-        c:\programme\Mozilla Firefox\mozsqlite3.dll

2011-10-05 20:27 . 2011-09-29 07:09        16856        ----a-w-        c:\programme\Mozilla Firefox\plugin-container.exe

2011-10-05 20:27 . 2011-09-29 07:09        134104        ----a-w-        c:\programme\Mozilla Firefox\components\browsercomps.dll

2011-10-05 20:27 . 2011-09-29 07:09        89048        ----a-w-        c:\programme\Mozilla Firefox\libEGL.dll

2011-10-05 20:27 . 2011-09-29 07:09        719832        ----a-w-        c:\programme\Mozilla Firefox\mozcpp19.dll

2011-10-05 20:27 . 2011-09-29 07:09        478168        ----a-w-        c:\programme\Mozilla Firefox\libGLESv2.dll

2011-10-05 20:27 . 2011-09-29 07:09        1833944        ----a-w-        c:\programme\Mozilla Firefox\mozjs.dll

2011-10-05 20:27 . 2011-09-29 07:09        15832        ----a-w-        c:\programme\Mozilla Firefox\mozalloc.dll

2011-10-05 20:27 . 2011-09-29 00:26        2106216        ----a-w-        c:\programme\Mozilla Firefox\D3DCompiler_43.dll

2011-10-05 20:27 . 2011-09-29 00:26        1998168        ----a-w-        c:\programme\Mozilla Firefox\d3dx9_43.dll

2011-09-28 05:26 . 2010-09-29 15:13        24064        ----a-w-        c:\windows\system32\drivers\motmodem.sys

2011-09-28 05:26 . 2010-04-01 11:31        23424        ----a-w-        c:\windows\system32\drivers\Motousbnet.sys

2011-09-28 05:26 . 2010-01-25 16:56        9472        ----a-w-        c:\windows\system32\drivers\motusbdevice.sys

2011-09-28 05:26 . 2009-01-29 14:11        6016        ----a-w-        c:\windows\system32\drivers\motfilt.sys

2011-09-28 05:26 . 2010-12-03 12:03        20352        ----a-w-        c:\windows\system32\drivers\motccgp.sys

2011-09-28 05:26 . 2009-01-29 14:18        8320        ----a-w-        c:\windows\system32\drivers\motccgpfl.sys

2011-09-28 05:26 . 2007-11-02 12:51        6400        ----a-w-        c:\windows\system32\drivers\motswch.sys

2011-09-28 05:26 . 2011-09-28 05:26        --------        d-----w-        c:\programme\Gemeinsame Dateien\Motorola Shared

2011-09-28 05:26 . 2011-09-28 05:26        --------        d-----w-        c:\programme\Motorola

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-09-26 09:41 . 2008-07-29 17:59        614912        ----a-w-        c:\windows\system32\uiautomationcore.dll

2011-09-26 09:41 . 2002-08-29 12:00        23040        ----a-w-        c:\windows\system32\oleaccrc.dll

2011-09-26 09:41 . 2002-08-29 12:00        220160        ----a-w-        c:\windows\system32\oleacc.dll

2011-09-09 09:11 . 2002-08-29 12:00        604160        ----a-w-        c:\windows\system32\crypt32.dll

2011-09-06 14:10 . 2002-08-29 12:00        1859072        ----a-w-        c:\windows\system32\win32k.sys

2011-09-05 13:55 . 2002-08-29 12:00        672768        ----a-w-        c:\windows\system32\wininet.dll

2011-09-05 13:55 . 2009-07-23 03:05        81920        ------w-        c:\windows\system32\ieencode.dll

2011-09-05 13:55 . 2002-08-29 12:00        61952        ----a-w-        c:\windows\system32\tdc.ocx

2011-09-05 13:54 . 2009-07-23 03:05        371200        ------w-        c:\windows\system32\html.iec

2011-08-19 16:32 . 2011-06-14 12:48        404640        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl

2011-08-17 13:49 . 2002-08-29 12:00        138496        ----a-w-        c:\windows\system32\drivers\afd.sys

2011-08-12 11:51 . 2009-07-22 06:24        26488        ----a-w-        c:\windows\system32\spupdsvc.exe

2011-09-29 07:09 . 2011-10-05 20:27        134104        ----a-w-        c:\programme\mozilla firefox\components\browsercomps.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Skype"="c:\programme\Skype\Phone\Skype.exe" [2011-10-13 17351304]

"ICQ"="c:\programme\ICQ7.5\ICQ.exe" [2011-08-01 124480]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2011-10-11 258512]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

.

c:\dokumente und einstellungen\xxx\Startmenü\Programme\Autostart\

EZ Connect Wireless USB Utility.lnk - c:\programme\SMC\EZ Connect Wireless USB\WlanMonitor.exe [2004-7-9 532480]

.

c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\

LOLRecorder.lnk - c:\programme\LOLReplay\LOLRecorder.exe [2011-10-7 406016]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]

2009-07-20 10:28        72208        ----a-w-        c:\programme\Gemeinsame Dateien\Logishrd\Bluetooth\LBTWLgn.dll

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]

@=""

.

[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Logitech SetPoint.lnk]

path=c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\Logitech SetPoint.lnk

backup=c:\windows\pss\Logitech SetPoint.lnkCommon Startup

.

[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Microsoft Office.lnk]

path=c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\Microsoft Office.lnk

backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

.

[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^xxx^Startmenü^Programme^Autostart^Registration Prince of Persia Warrior Within.LNK]

path=c:\dokumente und einstellungen\xxx\Startmenü\Programme\Autostart\Registration Prince of Persia Warrior Within.LNK

backup=c:\windows\pss\Registration Prince of Persia Warrior Within.LNKStartup

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]

2008-06-19 08:20        57344        ----a-w-        c:\windows\ALCMTR.EXE

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICustomerCare]

2010-03-04 12:31        311296        ----a-w-        c:\programme\ATI\ATICustomerCare\ATICustomerCare.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]

2010-04-01 09:16        357696        ----a-w-        c:\programme\DAEMON Tools Lite\DTLite.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033]

2004-08-22 15:05        81920        ----a-w-        c:\programme\D-Tools\daemon.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]

2011-07-28 23:08        1259376        ----a-w-        c:\programme\DivX\DivX Update\DivXUpdate.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]

2004-06-16 04:03        221184        ----a-w-        c:\progra~1\GEMEIN~1\INSTAL~1\UPDATE~1\ISUSPM.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]

2004-06-16 04:03        81920        ----a-w-        c:\programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kernel and Hardware Abstraction Layer]

2009-06-17 16:55        55824        ----a-w-        c:\windows\KHALMNPR.Exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]

2010-04-16 20:12        3872080        ----a-w-        c:\programme\Windows Live\Messenger\msnmsgr.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]

2010-07-06 19:19        98304        ----a-w-        c:\programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2010-02-18 09:43        248040        ----a-w-        c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant]

2010-03-09 02:52        15872        ----a-w-        c:\programme\Unlocker\UnlockerAssistant.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"ICQ Service"=2 (0x2)

"Ati HotKey Poller"=2 (0x2)

"JavaQuickStarterService"=2 (0x2)

"PnkBstrA"=2 (0x2)

"WMPNetworkSvc"=3 (0x3)

"npggsvc"=3 (0x3)

"MotoHelper"=2 (0x2)

"LBTServ"=3 (0x3)

"gupdatem"=3 (0x3)

"gupdate"=2 (0x2)

"nlsvc"=2 (0x2)

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"d:\\Age of Empires III\\age3.exe"=

"d:\\Kopie von Warcraft III \\Warcraft III.exe"=

"c:\\WINDOWS\\system32\\PnkBstrA.exe"=

"c:\\WINDOWS\\system32\\PnkBstrB.exe"=

"c:\\Programme\\Hamachi\\hamachi.exe"=

"d:\\Valve\\hl.exe"=

"d:\\EE\\Empire Earth I ZdE\\EE-AOC.exe"=

"d:\\LucasArts\\Star Wars JK II Jedi Outcast\\GameData\\jk2mp.exe"=

"d:\\Star Wars Jedi Knight Jedi Academy\\GameData\\jamp.exe"=

"c:\\Programme\\7-Zip\\7zFM.exe"=

"c:\\Programme\\TeamViewer\\Version5\\TeamViewer.exe"=

"c:\\Programme\\Ubisoft\\Ubisoft Game Launcher\\UbisoftGameLauncher.exe"=

"d:\\League of Legends\\lol.launcher.exe"=

"c:\\Programme\\Windows Live\\Messenger\\wlcsdk.exe"=

"c:\\Programme\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Programme\\ICQ7.5\\ICQ.exe"=

"c:\\Programme\\Skype\\Phone\\Skype.exe"=

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"8395:TCP"= 8395:TCP:League of Legends Launcher

"8395:UDP"= 8395:UDP:League of Legends Launcher

"8396:TCP"= 8396:TCP:League of Legends Launcher

"8396:UDP"= 8396:UDP:League of Legends Launcher

"6910:TCP"= 6910:TCP:League of Legends Launcher

"6910:UDP"= 6910:UDP:League of Legends Launcher

"6888:TCP"= 6888:TCP:League of Legends Launcher

"6888:UDP"= 6888:UDP:League of Legends Launcher

"6947:TCP"= 6947:TCP:League of Legends Launcher

"6947:UDP"= 6947:UDP:League of Legends Launcher

"6886:TCP"= 6886:TCP:League of Legends Launcher

"6886:UDP"= 6886:UDP:League of Legends Launcher

"6892:TCP"= 6892:TCP:League of Legends Launcher

"6892:UDP"= 6892:UDP:League of Legends Launcher

"6899:TCP"= 6899:TCP:League of Legends Launcher

"6899:UDP"= 6899:UDP:League of Legends Launcher

"6925:TCP"= 6925:TCP:League of Legends Launcher

"6925:UDP"= 6925:UDP:League of Legends Launcher

"6946:TCP"= 6946:TCP:League of Legends Launcher

"6946:UDP"= 6946:UDP:League of Legends Launcher

"8397:TCP"= 8397:TCP:League of Legends Launcher

"8397:UDP"= 8397:UDP:League of Legends Launcher

"6940:TCP"= 6940:TCP:League of Legends Launcher

"6940:UDP"= 6940:UDP:League of Legends Launcher

"6984:TCP"= 6984:TCP:League of Legends Launcher

"6984:UDP"= 6984:UDP:League of Legends Launcher

"6967:TCP"= 6967:TCP:League of Legends Launcher

"6967:UDP"= 6967:UDP:League of Legends Launcher

"6976:TCP"= 6976:TCP:League of Legends Launcher

"6976:UDP"= 6976:UDP:League of Legends Launcher

"6921:TCP"= 6921:TCP:League of Legends Launcher

"6921:UDP"= 6921:UDP:League of Legends Launcher

"6902:TCP"= 6902:TCP:League of Legends Launcher

"6902:UDP"= 6902:UDP:League of Legends Launcher

"8398:TCP"= 8398:TCP:League of Legends Launcher

"8398:UDP"= 8398:UDP:League of Legends Launcher

"8393:TCP"= 8393:TCP:League of Legends Lobby

"8393:UDP"= 8393:UDP:League of Legends Lobby

"8390:TCP"= 8390:TCP:League of Legends Game Client

"8390:UDP"= 8390:UDP:League of Legends Game Client

.

R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [17.10.2011 19:59 36000]

R1 nltdi;nltdi;c:\windows\system32\drivers\nltdi.sys [23.04.2007 18:08 81688]

R2 AntiVirSchedulerService;Avira Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [17.10.2011 19:59 86224]

R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [22.10.2010 15:53 10384]

R2 SVKP;SVKP;c:\windows\system32\SVKP.sys [18.04.2010 14:11 2368]

R3 SMCSMC WirelessUSB(SMC2662W)(R);SMC SMC WirelessUSB(SMC2662W)(R) Service for SMC  EZ Connect Wireless USB Adapter(SMC2662W);c:\windows\system32\drivers\Net62151.sys [21.09.2004 17:43 121344]

S1 SSHDRV5C;SSHDRV5C;\??\c:\windows\system32\drivers\SSHDRV5C.sys --> c:\windows\system32\drivers\SSHDRV5C.sys [?]

S2 gupdate;Google Update Service (gupdate);c:\programme\Google\Update\GoogleUpdate.exe [02.07.2010 00:01 136176]

S3 BTCFilterService;USB Networking Driver Filter Service;c:\windows\system32\drivers\motfilt.sys [28.09.2011 07:26 6016]

S3 clr_optimization_v4.0.20506_32;.NET Runtime Optimization Service v4.0.20506_X86;c:\windows\Microsoft.NET\Framework\v4.0.20506\mscorsvw.exe [06.05.2009 09:08 104272]

S3 cpuz130;cpuz130;\??\c:\dokume~1\xxx\LOKALE~1\Temp\cpuz130\cpuz_x32.sys --> c:\dokume~1\xxx\LOKALE~1\Temp\cpuz130\cpuz_x32.sys [?]

S3 gupdatem;Google Update-Dienst (gupdatem);c:\programme\Google\Update\GoogleUpdate.exe [02.07.2010 00:01 136176]

S3 lredbooo;lredbooo;\??\c:\dokume~1\xxx\LOKALE~1\Temp\lredbooo.sys --> c:\dokume~1\xxx\LOKALE~1\Temp\lredbooo.sys [?]

S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys --> c:\windows\system32\drivers\mbamswissarmy.sys [?]

S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [28.09.2011 07:26 20352]

S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [28.09.2011 07:26 8320]

S3 Motousbnet;Motorola USB Networking Driver Service;c:\windows\system32\drivers\Motousbnet.sys [28.09.2011 07:26 23424]

S3 motusbdevice;Motorola USB Dev Driver;c:\windows\system32\drivers\motusbdevice.sys [28.09.2011 07:26 9472]

S3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [01.07.2010 15:21 34896]

S4 d347bus;d347bus;c:\windows\system32\drivers\d347bus.sys [22.07.2009 08:56 155136]

S4 d347prt;d347prt;c:\windows\system32\drivers\d347prt.sys [22.07.2009 08:56 5248]

S4 ICQ Service;ICQ Service;c:\programme\ICQ6Toolbar\ICQ Service.exe [28.06.2010 08:46 247608]

S4 MotoHelper;MotoHelper Service;c:\programme\Motorola\MotoHelper\MotoHelperService.exe [27.01.2011 23:13 226624]

S4 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]

S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [26.08.2009 16:25 691696]

.

Inhalt des "geplante Tasks" Ordners

.

2011-10-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\programme\Google\Update\GoogleUpdate.exe [2010-07-01 22:01]

.

2011-10-26 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\programme\Google\Update\GoogleUpdate.exe [2010-07-01 22:01]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = 

mLocal Page = 

IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000

IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\programme\ICQ7.5\ICQ.exe

TCP: DhcpNameServer = 192.168.1.1

DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab

DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab

FF - ProfilePath - c:\dokumente und einstellungen\xxx\Anwendungsdaten\Mozilla\Firefox\Profiles\32qewamd.default\

FF - prefs.js: browser.search.defaulturl - 

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://de.start3.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:de:official

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

MSConfigStartUp-Microsoft® Windows Update - c:\dokumente und einstellungen\xxx\M-1-52-5782-8752-5245\winsvc.exe

MSConfigStartUp-RGSC - d:\gta\Rockstar Games Social Club\RGSCLauncher.exe

AddRemove-Call of Duty Modern Warfare 2_is1 - d:\cod 6 -v1\unins000.exe

AddRemove-conduitEngine - c:\programme\ConduitEngine\ConduitEngineUninstall.exe

AddRemove-Free YouTube Download_is1 - c:\programme\Gemeinsame Dateien\DVDVideoSoft\Uninstall.exe

AddRemove-FreeDoko - d:\ doppelkopf\uninst.exe

AddRemove-Gothic II - Die Nacht des Raben - d:\jowood\GOTHIC~1\UNWISE.EXE

AddRemove-HijackThis - c:\dokumente und einstellungen\xxx\Eigene Dateien\Downloads\HijackThis.exe

AddRemove-Mafia II_is1 - d:\mafia ii\unins000.exe

AddRemove-Worms2 - d:\team18\Worms2\Uninst.isu

AddRemove-Worms2 Demo - d:\team17\Worms2\Uninst.isu

AddRemove-{2A9F95AB-65A3-432c-8631-B8BC5BF7477A} - d:\herr der ringe2\EAUninstall.exe

AddRemove-NCsoft-GuildWars - d:\gw\NCLauncher.exe

AddRemove-Octoshape add-in for Adobe Flash Player - c:\dokumente und einstellungen\xxx\Anwendungsdaten\Macromedia\Flash Player\www.macromedia.com\bin\octoshape\octoshape.exe

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net

Rootkit scan 2011-10-27 13:35

Windows 5.1.2600 Service Pack 3 NTFS

.

Scanne versteckte Prozesse... 

.

Scanne versteckte Autostarteinträge... 

.

Scanne versteckte Dateien... 

.

Scan erfolgreich abgeschlossen

versteckte Dateien: 0

.

**************************************************************************

.

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]

"ImagePath"="c:\windows\system32\GameMon.des -service"

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_USERS\S-1-5-21-117609710-1417001333-839522115-1004\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]

@Allowed: (Read) (RestrictedCode)

@Allowed: (Read) (RestrictedCode)

"??"=hex:39,e3,38,1e,5c,e9,24,8d,31,27,09,80,6c,75,91,0b,9c,66,48,7b,75,c3,38,

   00,28,c9,ac,04,9c,51,b7,53,03,10,e3,0c,0b,f4,29,a4,fd,69,7c,2a,2d,31,b2,d4,\

"??"=hex:1b,c6,eb,3d,78,e8,25,f7,56,67,94,1c,cb,98,93,af

.

[HKEY_USERS\S-1-5-21-117609710-1417001333-839522115-1004\Software\SecuROM\License information*]

"datasecu"=hex:38,d2,18,94,45,dd,3b,cc,ae,73,66,8b,22,dd,1d,dd,14,da,75,9b,a7,

   8e,6d,8e,09,97,bb,5c,e4,08,86,3b,54,1b,ec,18,1a,4d,a7,1e,09,fe,b8,2c,16,60,\

"rkeysecu"=hex:c4,20,84,99,8c,51,94,c9,1d,77,da,0a,60,e3,39,47

.

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Reinstall\:ôwjY*]

"DisplayName"="???\16?\11\09"

"DeviceDesc"="???\16?\11\09"

"ProviderName"="?A?\11?\16?\11??"

"MFG"="???????"

"ReinstallString"=".10.1000.8"

"DeviceInstanceIds"=multi:"f:\\chipset\\7-ser\\xp\\sbdrv\\smbus\\smbusati.inf\00"

.

--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

.

- - - - - - - > 'winlogon.exe'(1080)

c:\windows\system32\Ati2evxx.dll

c:\windows\system32\atiadlxx.dll

c:\programme\gemeinsame dateien\logishrd\bluetooth\LBTWlgn.dll

c:\programme\gemeinsame dateien\logishrd\bluetooth\LBTServ.dll

.

Zeit der Fertigstellung: 2011-10-27  13:36:49

ComboFix-quarantined-files.txt  2011-10-27 11:36

.

Vor Suchlauf: 14 Verzeichnis(se), 165.458.481.152 Bytes frei

Nach Suchlauf: 16 Verzeichnis(se), 165.642.477.568 Bytes frei

.

WindowsXP-KB310994-SP2-Home-BootDisk-DEU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

UnsupportedDebug="do not select this" /debug

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn /usepmtimer

.

- - End Of File - - F77567AD0A66B2E0CD283A23629463B1

--- --- ---

Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte

aswMBR.exe und speichere die Datei auf deinem Desktop.

Starte die aswMBR.exe - (aswMBR.exe Anleitung)
Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
Klicke auf Scan.
Warte bitte bis Scan finished successfully im DOS-Fenster steht.
Drücke auf Save Log und speichere diese auf dem Desktop.

Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).

GMER Logfile:

Code:

GMER 1.0.15.15641 - hxxp://www.gmer.net

Rootkit scan 2011-10-29 16:59:31

Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP3T0L0-7 ST3500418AS rev.CC34

Running: m1jzpld5.exe; Driver: C:\DOKUME~1\Valentin\LOKALE~1\Temp\pxtdapob.sys
 
 

---- System - GMER 1.0.15 ----
 

SSDT            BA73206C                                                                                                            ZwClose

SSDT            BA732026                                                                                                            ZwCreateKey

SSDT            BA732076                                                                                                            ZwCreateSection

SSDT            BA73201C                                                                                                            ZwCreateThread

SSDT            BA73202B                                                                                                            ZwDeleteKey

SSDT            BA732035                                                                                                            ZwDeleteValueKey

SSDT            BA732067                                                                                                            ZwDuplicateObject

SSDT            BA73203A                                                                                                            ZwLoadKey

SSDT            BA732008                                                                                                            ZwOpenProcess

SSDT            BA73200D                                                                                                            ZwOpenThread

SSDT            BA73208F                                                                                                            ZwQueryValueKey

SSDT            BA732044                                                                                                            ZwReplaceKey

SSDT            BA732080                                                                                                            ZwRequestWaitReplyPort

SSDT            BA73203F                                                                                                            ZwRestoreKey

SSDT            BA73207B                                                                                                            ZwSetContextThread

SSDT            BA732085                                                                                                            ZwSetSecurityObject

SSDT            BA732030                                                                                                            ZwSetValueKey

SSDT            BA73208A                                                                                                            ZwSystemDebugControl

SSDT            BA732017                                                                                                            ZwTerminateProcess
 

---- Kernel code sections - GMER 1.0.15 ----
 

.text           C:\WINDOWS\System32\DRIVERS\ati2mtag.sys                                                                            section is writeable [0xB49E5000, 0x238387, 0xE8000020]

.text           C:\WINDOWS\System32\DRIVERS\atksgt.sys                                                                              section is writeable [0xA4B5A300, 0x3B6D8, 0xE8000020]

.text           C:\WINDOWS\System32\DRIVERS\lirsgt.sys                                                                              section is writeable [0xBA478300, 0x1BEE, 0xE8000020]
 

---- User code sections - GMER 1.0.15 ----
 

.text           C:\Programme\Mozilla Firefox\firefox.exe[3756] ntdll.dll!LdrLoadDll                                                 7C92632D 5 Bytes  JMP 0121FAE0 C:\Programme\Mozilla Firefox\xul.dll (Mozilla Foundation)
 

---- Devices - GMER 1.0.15 ----
 

AttachedDevice  \Driver\Tcpip \Device\Ip                                                                                            nltdi.sys (NetLimiter Driver/Locktime Software)

AttachedDevice  \Driver\Tcpip \Device\Tcp                                                                                           nltdi.sys (NetLimiter Driver/Locktime Software)

AttachedDevice  \Driver\Tcpip \Device\Udp                                                                                           nltdi.sys (NetLimiter Driver/Locktime Software)

AttachedDevice  \Driver\Tcpip \Device\RawIp                                                                                         nltdi.sys (NetLimiter Driver/Locktime Software)
 

---- Registry - GMER 1.0.15 ----
 

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC                                    

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                 0

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                              0xE4 0x29 0xF6 0x56 ...

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                 0xD4 0xC3 0x97 0x02 ...

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                 C:\Programme\DAEMON Tools Lite\

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001                           

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                     0x94 0x99 0x39 0x5B ...

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                        0x20 0x01 0x00 0x00 ...

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0                      

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                0x49 0x15 0xFE 0x8C ...

Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)                

Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                     0

Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                  0xE4 0x29 0xF6 0x56 ...

Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                     0xD4 0xC3 0x97 0x02 ...

Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                     C:\Programme\DAEMON Tools Lite\

Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)       

Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                         0x94 0x99 0x39 0x5B ...

Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                            0x20 0x01 0x00 0x00 ...

Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)  

Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                    0x49 0x15 0xFE 0x8C ...

Reg             HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32                                   

Reg             HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ThreadingModel                    Apartment

Reg             HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL

Reg             HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@cd042efbbd7f7af1647644e76e06692b  0xE2 0x63 0x26 0xF1 ...

Reg             HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32                                   

Reg             HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ThreadingModel                    Apartment

Reg             HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL

Reg             HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@bca643cdc5c2726b20d2ecedcc62c59b  0x71 0x3B 0x04 0x66 ...

Reg             HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32                                   

Reg             HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ThreadingModel                    Apartment

Reg             HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL

Reg             HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@2c81e34222e8052573023a60d06dd016  0x25 0xDA 0xEC 0x7E ...

Reg             HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32                                   

Reg             HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ThreadingModel                    Apartment

Reg             HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL

Reg             HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@2582ae41fb52324423be06337561aa48  0x3E 0x1E 0x9E 0xE0 ...

Reg             HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32                                   

Reg             HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ThreadingModel                    Apartment

Reg             HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL

Reg             HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@caaeda5fd7a9ed7697d9686d4b818472  0xCD 0x44 0xCD 0xB9 ...

Reg             HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32                                   

Reg             HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ThreadingModel                    Apartment

Reg             HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL

Reg             HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@a4a1bcf2cc2b8bc3716b74b2b4522f5d  0xDF 0x20 0x58 0x62 ...

Reg             HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32                                   

Reg             HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ThreadingModel                    Apartment

Reg             HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL

Reg             HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@4d370831d2c43cd13623e232fed27b7b  0x31 0x77 0xE1 0xBA ...

Reg             HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32                                   

Reg             HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ThreadingModel                    Apartment

Reg             HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL

Reg             HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@1d68fe701cdea33e477eb204b76f993d  0x01 0x3A 0x48 0xFC ...

Reg             HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32                                   

Reg             HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ThreadingModel                    Apartment

Reg             HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL

Reg             HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@1fac81b91d8e3c5aa4b0a51804d844a3  0xF6 0x0F 0x4E 0x58 ...

Reg             HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32                                   

Reg             HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ThreadingModel                    Apartment

Reg             HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL

Reg             HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@f5f62a6129303efb32fbe080bb27835b  0x3D 0xCE 0xEA 0x26 ...

Reg             HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32                                   

Reg             HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ThreadingModel                    Apartment

Reg             HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL

Reg             HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@fd4e2e1a3940b94dceb5a6a021f2e3c6  0x2A 0xB7 0xCC 0xB5 ...

Reg             HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32                                   

Reg             HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ThreadingModel                    Apartment

Reg             HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL

Reg             HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@8a8aec57dd6508a385616fbc86791ec2  0xFA 0xEA 0x66 0x7F ...
 

---- EOF - GMER 1.0.15 ----

--- --- ---

OSAM Logfile:

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

hxxp://www.online-solutions.ru/en/

Saved at 17:19:13 on 29.10.2011
 

OS: Windows XP Home Edition Service Pack 3 (Build 2600)

Default Browser: Mozilla Corporation Firefox 7.0.1
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Common]

-----( %SystemRoot%\Tasks )-----

"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe

"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe
 

[Control Panel Objects]

-----( %SystemRoot%\system32 )-----

"DivXControlPanelApplet.cpl" - "DivX, Inc." - C:\WINDOWS\system32\DivXControlPanelApplet.cpl

"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\WINDOWS\system32\FlashPlayerCPLApp.cpl

"infocardcpl.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\infocardcpl.cpl

"ISUSPM.cpl" - "InstallShield Software Corporation" - C:\WINDOWS\system32\ISUSPM.cpl

"javacpl.cpl" - "Sun Microsystems, Inc." - C:\WINDOWS\system32\javacpl.cpl

"QuickTime.cpl" - "Apple Computer, Inc." - C:\WINDOWS\system32\QuickTime.cpl

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----

"Avira AntiVir Personal - Free Antivirus " - "Avira Operations GmbH & Co. KG" - C:\PROGRA~1\Avira\ANTIVI~1\avconfig.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"atksgt" (atksgt) - ? - C:\WINDOWS\System32\DRIVERS\atksgt.sys  (File found, but it contains no detailed information)

"avgntflt" (avgntflt) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avgntflt.sys

"avipbb" (avipbb) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avipbb.sys

"avkmgr" (avkmgr) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avkmgr.sys

"catchme" (catchme) - ? - C:\DOKUME~1\xxx\LOKALE~1\Temp\catchme.sys  (File not found)

"Changer" (Changer) - ? - C:\WINDOWS\system32\drivers\Changer.sys  (File not found)

"cpuz130" (cpuz130) - ? - C:\DOKUME~1\xxx\LOKALE~1\Temp\cpuz130\cpuz_x32.sys  (File not found)

"ENTECH" (ENTECH) - "EnTech Taiwan" - C:\WINDOWS\System32\DRIVERS\ENTECH.sys

"gdrv" (gdrv) - "Windows (R) 2000 DDK provider" - C:\WINDOWS\gdrv.sys

"giveio" (giveio) - ? - C:\WINDOWS\System32\giveio.sys  (File found, but it contains no detailed information)

"Hamachi Network Interface" (hamachi) - "LogMeIn, Inc." - C:\WINDOWS\System32\DRIVERS\hamachi.sys

"i2omgmt" (i2omgmt) - ? - C:\WINDOWS\system32\drivers\i2omgmt.sys  (File not found)

"LBeepKE" (LBeepKE) - "Logitech, Inc." - C:\WINDOWS\System32\Drivers\LBeepKE.sys

"lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys  (File not found)

"lirsgt" (lirsgt) - ? - C:\WINDOWS\System32\DRIVERS\lirsgt.sys  (File found, but it contains no detailed information)

"lredbooo" (lredbooo) - ? - C:\DOKUME~1\xxx\LOKALE~1\Temp\lredbooo.sys  (File not found)

"MBAMSwissArmy" (MBAMSwissArmy) - ? - C:\WINDOWS\system32\drivers\mbamswissarmy.sys  (File not found)

"nltdi" (nltdi) - "Locktime Software" - C:\WINDOWS\system32\drivers\nltdi.sys

"PCAMPR5 NDIS Protocol Driver" (PCAMPR5) - ? - C:\WINDOWS\system32\PCAMPR5.SYS  (File not found)

"PCANDIS5 NDIS Protocol Driver" (PCANDIS5) - "Printing Communications Assoc., Inc. (PCAUSA)" - C:\WINDOWS\system32\PCANDIS5.SYS

"PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys  (File not found)

"PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys  (File not found)

"PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys  (File not found)

"PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys  (File not found)

"PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys  (File not found)

"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\WINDOWS\System32\Drivers\PxHelp20.sys

"SMC SMC WirelessUSB(SMC2662W)(R) Service for SMC  EZ Connect Wireless USB Adapter(SMC2662W)" (SMCSMC WirelessUSB(SMC2662W)(R)) - "ATMEL" - C:\WINDOWS\System32\DRIVERS\Net62151.sys

"speedfan" (speedfan) - "Almico Software" - C:\WINDOWS\System32\speedfan.sys

"SSHDRV5C" (SSHDRV5C) - ? - C:\WINDOWS\system32\drivers\SSHDRV5C.sys  (File not found)

"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\ssmdrv.sys

"SVKP" (SVKP) - "AntiCracking" - C:\WINDOWS\system32\SVKP.sys

"WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys  (File not found)
 

[Explorer]

-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----

{89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install

-----( HKLM\Software\Classes\Protocols\Filter )-----

{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

-----( HKLM\Software\Classes\Protocols\Handler )-----

{3D9F03FA-7A94-11D3-BE81-0050048385D1} "Data Page Pluggable Protocol mso-offdap Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBCOM~1\10\OWC10.DLL

{828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

{91774881-D725-4E58-B298-07617B9B86A8} "Skype IE add-on Pluggable Protocol" - "Skype Technologies S.A." - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

{03C514A3-1EFB-4856-9F99-10D7BE1653C0} "Windows Live Mail HTML Asynchronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\Programme\Windows Live\Mail\mailcomm.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{79BC0345-1015-11D2-A299-006008312725} "///FAST project settings" - ? - C:\Programme\Pinnacle\VideoSpin\Programs\BlueShellExt.dll  (File found, but it contains no detailed information)

{23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Programme\7-Zip\7-zip.dll

{0563DB41-F538-4B37-A92D-4659049B7766} "CLSID_WLMCMimeFilter" - "Microsoft Corporation" - C:\Programme\Windows Live\Mail\mailcomm.dll

{94586423-855F-4EB2-9F6A-D9DA5658DBE3} "Context menu" - ? - C:\PROGRA~1\FREEM4~1\m4a_menu.dll  (File found, but it contains no detailed information)

{42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? -   (File not found | COM-object registry key not found)

{872A9397-E0D6-4e28-B64D-52B8D0A7EA35} "DisplayCplExt Class" - "Advanced Micro Devices, Inc." - C:\Programme\ATI Technologies\ATI.ACE\Core-Static\atiamaxx.dll

{DC70C4A5-2044-4c59-B806-DEFB9AE0DF7C} "KbLogiExt Class" - "Logitech, Inc." - C:\Programme\Logitech\SetPoint\kbcplext.dll

{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? -   (File not found | COM-object registry key not found)

{B9B9F083-2B04-452A-8691-83694AC1037B} "LogiExt Class" - "Logitech, Inc." - C:\Programme\Logitech\SetPoint\mcplext.dll

{32683183-48a0-441b-a342-7c2a440a9478} "Media Band" - ? -   (File not found | COM-object registry key not found)

{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office10\msohev.dll

{0006F045-0000-0000-C000-000000000046} "Outlook-Dateisymbolerweiterung" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office10\OLKFSTUB.DLL

{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira Operations GmbH & Co. KG" - C:\Programme\Avira\AntiVir Desktop\shlext.dll

{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" - "Microsoft Corporation" - c:\WINDOWS\system32\dfshim.dll

{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? -   (File not found | COM-object registry key not found)

{e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" - "Microsoft Corporation" - c:\WINDOWS\system32\dfshim.dll

{5E2121EE-0300-11D4-8D3B-444553540000} "SimpleShlExt Class" - "Advanced Micro Devices, Inc." - C:\Programme\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll

{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83} "UnlockerShellExtension" - ? - C:\Programme\Unlocker\UnlockerCOM.dll  (File found, but it contains no detailed information)

{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL

{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - "Alexander Roshal" - C:\Programme\WinRAR\rarext.dll
 

[Internet Explorer]

-----( HKCU\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars )-----

{32683183-48a0-441b-a342-7c2a440a9478} "{32683183-48a0-441b-a342-7c2a440a9478}" - ? -   (File not found | COM-object registry key not found)

-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----

<binary data> "ITBarLayout" - ? -   (File not found | COM-object registry key not found)

<binary data> "{32099AAC-C132-4136-9E9A-4E364A424E17}" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

DirectAnimation Java Classes "DirectAnimation Java Classes" - ? -   (File not found | COM-object registry key not found) / file://C:\WINDOWS\Java\classes\dajava.cab

{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_20" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_20.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} "Java Plug-in 1.6.0_20" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_20.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_20" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_20.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

Microsoft XML Parser for Java "Microsoft XML Parser for Java" - ? -   (File not found | COM-object registry key not found) / file://C:\WINDOWS\Java\classes\xmldso.cab

{D0C0F75C-683A-4390-A791-1ACFD5599AB8} "Oberon Flash Game Host" - "Oberon Media, Inc." - C:\WINDOWS\Downloaded Program Files\OberonGameHost.dll / hxxp://icq.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab

{D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" - "Adobe Systems, Inc." - C:\WINDOWS\system32\Macromed\Flash\Flash10b.ocx / hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

"ICQ7.5" - "ICQ, LLC." - C:\Programme\ICQ7.5\ICQ.exe

{898EA8C8-E7FF-479B-8935-AEC46303B9E5} "Skype Click to Call" - "Skype Technologies S.A." - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jp2ssv.dll

{E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} "Skype Browser Helper" - "Skype Technologies S.A." - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
 

[Logon]

-----( %AllUsersProfile%\Startmenü\Programme\Autostart )-----

"desktop.ini" - ? - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini

"LOLRecorder.lnk" - ? - C:\Programme\LOLReplay\LOLRecorder.exe  (Shortcut exists | File exists)

-----( %UserProfile%\Startmenü\Programme\Autostart )-----

"desktop.ini" - ? - C:\Dokumente und Einstellungen\xxx\Startmenü\Programme\Autostart\desktop.ini

"EZ Connect Wireless USB Utility.lnk" - "ATMEL" - C:\Programme\SMC\EZ Connect Wireless USB\WlanMonitor.exe  (Shortcut exists | File exists)

-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----

"ICQ" - "ICQ, LLC." - "C:\Programme\ICQ7.5\ICQ.exe" silent loginmode=4

"Skype" - "Skype Technologies S.A." - "C:\Programme\Skype\Phone\Skype.exe" /nosplash /minimized

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"avgnt" - "Avira Operations GmbH & Co. KG" - "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce )-----

"B Register C:\Programme\DivX\DivX Plus Player\DPXPlugins\DPXDownloadManagerPlugin.dll" - ? - "C:\WINDOWS\system32\rundll32.exe" "C:\Programme\DivX\DivX Plus Player\DPXPlugins\DPXDownloadManagerPlugin.dll",DllRegisterServer

"B Register C:\Programme\DivX\DivX Plus Player\DPXPlugins\DPXMediaManagerPlugin.dll" - ? - "C:\WINDOWS\system32\rundll32.exe" "C:\Programme\DivX\DivX Plus Player\DPXPlugins\DPXMediaManagerPlugin.dll",DllRegisterServer

"B Register C:\Programme\DivX\DivX Plus Player\DSEPlugins\Direct3DVideoOutput.dll" - "DivX, Inc." - "C:\WINDOWS\system32\rundll32.exe" "C:\Programme\DivX\DivX Plus Player\DSEPlugins\Direct3DVideoOutput.dll",DllRegisterServer

"B Register C:\Programme\DivX\DivX Plus Player\DSEPlugins\DirectShowAudioDecode.dll" - "DivX, Inc." - "C:\WINDOWS\system32\rundll32.exe" "C:\Programme\DivX\DivX Plus Player\DSEPlugins\DirectShowAudioDecode.dll",DllRegisterServer

"B Register C:\Programme\DivX\DivX Plus Player\DSEPlugins\DirectSoundAudioOutput.dll" - "DivX, Inc." - "C:\WINDOWS\system32\rundll32.exe" "C:\Programme\DivX\DivX Plus Player\DSEPlugins\DirectSoundAudioOutput.dll",DllRegisterServer

"B Register C:\Programme\DivX\DivX Plus Player\DSEPlugins\DivXDeinterlaceFilter.dll" - "DivX, Inc." - "C:\WINDOWS\system32\rundll32.exe" "C:\Programme\DivX\DivX Plus Player\DSEPlugins\DivXDeinterlaceFilter.dll",DllRegisterServer
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

".NET Runtime Optimization Service v2.0.50727_X86" (clr_optimization_v2.0.50727_32) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

".NET Runtime Optimization Service v4.0.20506_X86" (clr_optimization_v4.0.20506_32) - "Microsoft Corporation" - c:\WINDOWS\Microsoft.NET\Framework\v4.0.20506\mscorsvw.exe

"Anwendungsverwaltung" (AppMgmt) - ? - C:\WINDOWS\System32\appmgmts.dll  (File not found)

"ASP.NET State Service" (aspnet_state) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v4.0.20506\aspnet_state.exe

"Avira Echtzeit Scanner" (AntiVirService) - "Avira Operations GmbH & Co. KG" - C:\Programme\Avira\AntiVir Desktop\avguard.exe

"Avira Planer" (AntiVirSchedulerService) - "Avira Operations GmbH & Co. KG" - C:\Programme\Avira\AntiVir Desktop\sched.exe

"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe

"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe

"Windows CardSpace" (idsvc) - "Microsoft Corporation" - c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe

"Windows Presentation Foundation Font Cache 3.0.0.0" (FontCache3.0.0.0) - "Microsoft Corporation" - c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
 

[Winlogon]

-----( HKCU\Control Panel\IOProcs )-----

"MVB" - ? - mvfs32.dll  (File not found)

-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions )-----

{c6dc5466-785a-11d2-84d0-00c04fb169f7} "Softwareinstallation" - ? - appmgmts.dll  (File not found)

-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )-----

"LBTWlgn" - "Logitech, Inc." - c:\programme\gemeinsame dateien\logishrd\bluetooth\LBTWlgn.dll
 

===[ Logfile end ]=========================================[ Logfile end ]===

--- --- ---

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

Wie geht es jetzt weiter?

Ich warte immer noch auf aswMBR :pfeiff:

-.- Das habe ich ganz vergessen. Tut mire Leid kommt sofort!

aswMBR version 0.9.8.986 Copyright(c) 2011 AVAST Software
Run date: 2011-11-12 14:17:45
-----------------------------
14:17:45.000 OS Version: Windows 5.1.2600 Service Pack 3
14:17:45.000 Number of processors: 3 586 0x402
14:17:45.000 ComputerName: EU UserName:
14:17:48.906 Initialize success
14:27:06.968 AVAST engine defs: 11111200
14:27:40.437 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP3T0L0-7
14:27:40.437 Disk 0 Vendor: ST3500418AS CC34 Size: 476938MB BusType: 3
14:27:42.437 Disk 0 MBR read successfully
14:27:42.453 Disk 0 MBR scan
14:27:42.468 Disk 0 Windows XP default MBR code
14:27:42.468 Disk 0 scanning sectors +976752000
14:27:42.531 Disk 0 scanning C:\WINDOWS\system32\drivers
14:27:50.390 Service scanning
14:27:51.390 Modules scanning
14:27:53.640 Disk 0 trace - called modules:
14:27:53.656 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS
14:27:53.656 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8af34ab8]
14:27:53.656 3 CLASSPNP.SYS[ba108fd7] -> nt!IofCallDriver -> \Device\0000007c[0x8af7b718]
14:27:53.656 5 ACPI.sys[b9f7e620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP3T0L0-7[0x8af93d98]
14:27:54.703 AVAST engine scan C:\WINDOWS
14:28:20.578 AVAST engine scan C:\WINDOWS\system32
14:31:41.125 AVAST engine scan C:\WINDOWS\system32\drivers
14:31:57.203 AVAST engine scan C:\Dokumente und Einstellungen\xxx
14:36:02.031 AVAST engine scan C:\Dokumente und Einstellungen\All Users
14:37:32.500 Scan finished successfully
14:51:59.546 Disk 0 MBR has been saved successfully to "C:\Dokumente und Einstellungen\xxx\Desktop\Anti Troj benutzt\MBR.dat"
14:51:59.546 The log file has been saved successfully to "C:\Dokumente und Einstellungen\xxx\Desktop\Anti Troj benutzt\aswMBR.txt"

Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset