Trojaner-Board - fehlermeldung avgntflt.sys --> mein logfile

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - fehlermeldung avgntflt.sys --> mein logfile (https://www.trojaner-board.de/70070-fehlermeldung-avgntflt-sys-logfile.html)

fehlermeldung avgntflt.sys --> mein logfile

Also, Hi erstmal :),

seit ungefähr 2 Wochen stürzt mein PC dauernd mit Bluescreen ab, aber des Komische ist, nur einmal am Tag und dann nicht mehr :/

Meistens kommt die Fehlermeldung:

STOP: 0x00000008E
avgntflt.sys (<-- gestern statt "avgntflt.sys" - "nv4_disp.dll")

Gegooglet und so hab ich alles schon, hab aber nur (bei "nv_disp.dll") Sachen gefunden wie "neuen Treiber laden bla bla..." ... gemacht...stürzt immer noch ab...^^

Naja hier mein LogFile...vllt. findet ihr ja was :)

Code:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 08:39:10, on 16.02.2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16791)

Boot mode: Normal
 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Programme\AlienGUIse\wbload.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\Explorer.EXE

C:\HP\KBD\KBD.EXE

C:\Programme\iTunes\iTunesHelper.exe

C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe

C:\Programme\HP\HP Software Update\HPWuSchd2.exe

C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe

C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe

C:\Programme\Java\jre6\bin\jusched.exe

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\system32\RUNDLL32.EXE

C:\WINDOWS\system32\rundll32.exe

C:\Programme\Windows Live\Messenger\msnmsgr.exe

C:\Programme\AntiVir PersonalEdition Classic\sched.exe

C:\Programme\AntiVir PersonalEdition Classic\avguard.exe

C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Programme\Bonjour\mDNSResponder.exe

C:\Programme\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe

C:\Programme\CyberLink\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe

C:\Programme\Java\jre6\bin\jqs.exe

C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\WINDOWS\system32\PnkBstrA.exe

C:\WINDOWS\system32\svchost.exe

C:\Programme\CyberLink\PowerCinema\Kernel\TV\CLSched.exe

C:\Programme\iPod\bin\iPodService.exe

C:\WINDOWS\system32\wbem\wmiapsrv.exe

c:\windows\system\hpsysdrv.exe

C:\Programme\Mozilla Firefox\firefox.exe

C:\Dokumente und Einstellungen\HP_Besitzer\Desktop\HiJackThis.exe
 

R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\tbuA4\toolbaru.dll

R3 - URLSearchHook: (no name) - {DB8B2393-7A6C-4C76-88CE-6B1F6FF6FFE9} - (no file)

R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Programme\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL

O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\Programme\ICQToolbar\tbuA4\toolbaru.dll

O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Programme\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: SOSO AddressBar Search - {0C7C23EF-A848-485B-873C-0ED954731014} - (no file)

O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - (no file)

O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar4.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll

O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programme\Windows Live Toolbar\msntb.dll

O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Programme\AskSBar\bar\1.bin\ASKSBAR.DLL

O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\tbuA4\toolbaru.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar4.dll

O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Programme\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll

O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Programme\AskSBar\bar\1.bin\ASKSBAR.DLL

O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programme\Windows Live Toolbar\msntb.dll

O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE

O4 - HKLM\..\Run: [iTunesHelper] "C:\Programme\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [ISUSScheduler] "C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe" -start

O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\ISUSPM.exe" -startup

O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

O4 - HKLM\..\Run: [HPHUPD08] c:\Programme\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe

O4 - HKLM\..\Run: [HPBootOp] "C:\Programme\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run

O4 - HKLM\..\Run: [HP Software Update] C:\Programme\HP\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe"  -osboot

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [stup.exe] C:\PROGRA~2\TENCENT\Adplus\stup.exe

O4 - HKLM\..\Run: [regcmdcons] c:\hp\bin\cloaker.exe c:\hp\bin\cmdcons.cmd

O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [msnmsgr] "C:\Programme\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')

O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Programme\ICQToolbar\toolbaru.dll/SEARCH.HTML

O8 - Extra context menu item: &Windows Live Search - res://C:\Programme\Windows Live Toolbar\msntb.dll/search.htm

O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx

O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: 上传到QQ网络硬盘 - C:\Programme\Tencent\QQ\AddToNetDisk.htm

O8 - Extra context menu item: 添加到QQ自定义面板 - C:\Programme\Tencent\QQ\AddPanel.htm

O8 - Extra context menu item: 添加到QQ表情 - C:\Programme\Tencent\QQ\AddEmotion.htm

O8 - Extra context menu item: 用QQ彩信发送该图片 - C:\Programme\Tencent\QQ\SendMMS.htm

O9 - Extra button: In Blog ver?ffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: In Windows Live Writer in &Blog ver?ffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe

O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe

O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Programme\Tencent\QQ\QQ.EXE (file missing)

O9 - Extra 'Tools' menuitem: ìú??QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Programme\Tencent\QQ\QQ.EXE (file missing)

O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\WINDOWS\system32\shdocvw.dll

O9 - Extra 'Tools' menuitem: QQì?2ê1¤??ì?éè?? - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\WINDOWS\system32\shdocvw.dll

O9 - Extra button: Hilfe zu Verbindungen - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm

O9 - Extra 'Tools' menuitem: Hilfe zu Verbindungen - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe

O11 - Options group: [TBH] SOSO AddressBar Search

O15 - ESC Trusted Zone: http://*.update.microsoft.com

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - h**p://download.bitdefender.com/resources/scan8/oscan8.cab

O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://arcade.icq.com/carlo/zuma/popcaploader_v5.cab

O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Programme\Bonjour\mDNSResponder.exe

O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Programme\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe

O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Programme\CyberLink\PowerCinema\Kernel\TV\CLSched.exe

O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Programme\CyberLink\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Programme\iPod\bin\iPodService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

O23 - Service: TuneUp Drive Defrag-Dienst (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
 

--

End of file - 12035 bytes

DANKE schonmal im Vorraus

Achja, Anti Malware funzt. bei mir nicht, nach der Installation geht nichts... und hier ist der Ordner leer "C:\Programme\Malwarebytes' Anti-Malware"

Hallo chen15,

- geh' mal bitte unter start->ausführen-> "cmd" eingeben (ohne "") -> ok
- dann eingeben "attrib -h c:\windows\system32\drivers"
- dann "dir /a /o:-d c:\windows\system32\drivers > c:\dir.txt"
- öffne die Datei "c:\dir.txt" und poste deren Inhalt (bzw. die Daten des letzten Monats reichen)

Grüße
45cl3p1u5

edit: hatte eben die Pfadangabe bei "dir ..." vergessen, sorry

Code:

 Datentr?ger in Laufwerk C: ist HP_PAVILION

 Volumeseriennummer: 243B-E5FC
 

 Verzeichnis von c:\windows\system32\drivers
 

14.02.2009  10:30    <DIR>          ..

14.02.2009  10:30    <DIR>          .

15.01.2009  08:19         6.301.248 nv4_mini.sys

11.12.2008  11:57           333.952 srv.sys

10.11.2008  20:55            75.072 avipbb.sys

30.10.2008  14:10           117.120 Rtnicxp.sys

24.10.2008  12:21           455.296 mrxsmb.sys

01.10.2008  12:01            32.000 usbaapl.sys

30.09.2008  20:36    <DIR>          UMDF

23.08.2008  11:34    <DIR>          etc

14.08.2008  11:04           138.496 afd.sys

20.06.2008  12:51           361.600 tcpip.sys

20.06.2008  12:08           225.856 tcpip6.sys

14.06.2008  18:32           273.024 bthport.sys

11.06.2008  01:07            43.528 pxhelp20.sys

16.05.2008  12:03            22.328 PnkBstrK.sys

08.05.2008  15:02           203.136 rmcast.sys

17.04.2008  12:12            15.464 GEARAspiWDM.sys

16.04.2008  17:15            21.248 ssmdrv.sys

14.04.2008  07:53            12.040 tdpipe.sys

14.04.2008  07:53            21.896 tdtcp.sys

14.04.2008  07:53           139.656 rdpwd.sys

14.04.2008  07:53            40.840 termdd.sys

14.04.2008  07:52            11.325 vchnt5.dll

14.04.2008  07:52             3.901 siint5.dll

14.04.2008  07:52             3.615 adv05nt5.dll

14.04.2008  07:52             3.711 adv09nt5.dll

14.04.2008  07:52             3.967 adv02nt5.dll

14.04.2008  07:52             3.775 adv11nt5.dll

14.04.2008  07:52             4.255 adv01nt5.dll

14.04.2008  07:52             3.135 adv08nt5.dll

14.04.2008  07:52             3.647 adv07nt5.dll

14.04.2008  07:52            17.279 atv10nt5.dll

14.04.2008  07:52            14.143 atv06nt5.dll

14.04.2008  07:52            25.471 atv04nt5.dll

14.04.2008  07:52            11.359 atv02nt5.dll

14.04.2008  07:52            21.183 atv01nt5.dll

14.04.2008  07:52            15.423 ch7xxnt5.dll

14.04.2008  07:32            73.472 sr.sys

14.04.2008  07:32           120.576 pcmcia.sys

14.04.2008  07:32            68.224 pci.sys

14.04.2008  07:32            80.384 parport.sys

14.04.2008  07:32            46.848 p3.sys

14.04.2008  07:28            25.216 kbdclass.sys

14.04.2008  07:28            14.720 kbdhid.sys

14.04.2008  07:28           154.112 dmio.sys

14.04.2008  07:28           800.384 dmboot.sys

14.04.2008  07:28            37.632 isapnp.sys

14.04.2008  07:27            40.448 intelppm.sys

14.04.2008  07:27             5.504 intelide.sys

14.04.2008  07:26            40.832 crusoe.sys

14.04.2008  07:25            52.992 i8042prt.sys

14.04.2008  07:25            65.536 serial.sys

14.04.2008  07:24            25.856 hidbth.sys

14.04.2008  07:22            57.728 redbook.sys

14.04.2008  07:22            44.672 fips.sys

14.04.2008  07:22            53.760 volsnap.sys

14.04.2008  07:21            39.936 processr.sys

14.04.2008  07:21           701.952 ati2mtag.sys

14.04.2008  07:21           327.168 ati2mtaa.sys

14.04.2008  07:20            41.856 amdk7.sys

14.04.2008  07:20            41.472 amdk6.sys

14.04.2008  07:19            23.552 mouclass.sys

14.04.2008  07:19            30.336 modem.sys

14.04.2008  07:19           188.800 acpi.sys

14.04.2008  00:58           175.744 rdbss.sys

14.04.2008  00:51           162.816 netbt.sys

14.04.2008  00:50            91.520 ndiswan.sys

14.04.2008  00:50           182.656 ndis.sys

14.04.2008  00:49            48.384 raspptp.sys

14.04.2008  00:49            75.264 ipsec.sys

14.04.2008  00:49            51.328 rasl2tp.sys

14.04.2008  00:49           146.048 portcls.sys

14.04.2008  00:47            83.072 wdmaud.sys

14.04.2008  00:47           105.344 mup.sys

14.04.2008  00:46           141.056 ks.sys

14.04.2008  00:46            49.536 classpnp.sys

14.04.2008  00:45            60.800 sysaudio.sys

14.04.2008  00:45           574.976 ntfs.sys

14.04.2008  00:44           143.744 fastfat.sys

14.04.2008  00:44            63.744 cdfs.sys

14.04.2008  00:30            19.072 tdi.sys

14.04.2008  00:27            41.472 raspppoe.sys

14.04.2008  00:27            40.576 ndproxy.sys

14.04.2008  00:27            14.336 asyncmac.sys

14.04.2008  00:27            10.112 ndistapi.sys

14.04.2008  00:27            34.560 wanarp.sys

14.04.2008  00:27           152.832 ipnat.sys

14.04.2008  00:27            20.864 ipinip.sys

14.04.2008  00:26            12.800 usb8023.sys

14.04.2008  00:26            12.800 usb8023x.sys

14.04.2008  00:26            30.592 rndismp.sys

14.04.2008  00:26            30.592 rndismpx.sys

14.04.2008  00:26            69.120 psched.sys

14.04.2008  00:26            35.072 msgpc.sys

14.04.2008  00:26            88.320 nwlnkipx.sys

14.04.2008  00:26            34.688 netbios.sys

14.04.2008  00:26            12.288 tunmp.sys

14.04.2008  00:26            14.592 ndisuio.sys

14.04.2008  00:24            11.264 irenum.sys

14.04.2008  00:23           264.832 http.sys

14.04.2008  00:23            36.608 ip6fw.sys

14.04.2008  00:23            71.552 bridge.sys

14.04.2008  00:23            40.320 nmnt.sys

14.04.2008  00:21           101.120 bthpan.sys

14.04.2008  00:21            55.808 atmlane.sys

14.04.2008  00:21            61.824 nic1394.sys

14.04.2008  00:21            59.904 atmarpc.sys

14.04.2008  00:21            60.800 arp1394.sys

14.04.2008  00:17            25.856 usbprint.sys

14.04.2008  00:16            59.136 rfcomm.sys

14.04.2008  00:16            17.024 bthenum.sys

14.04.2008  00:16            37.888 bthmodem.sys

14.04.2008  00:16            36.480 bthprint.sys

14.04.2008  00:16            18.944 bthusb.sys

14.04.2008  00:16            85.248 nabtsfec.sys

14.04.2008  00:16            19.200 wstcodec.sys

14.04.2008  00:16            10.880 ndisip.sys

14.04.2008  00:16            11.136 slip.sys

14.04.2008  00:16            17.024 ccdecode.sys

14.04.2008  00:16            15.232 mpe.sys

14.04.2008  00:16           121.984 usbvideo.sys

14.04.2008  00:16            11.776 bdasup.sys

14.04.2008  00:16            15.232 streamip.sys

14.04.2008  00:16            53.376 1394bus.sys

14.04.2008  00:16            61.696 ohci1394.sys

14.04.2008  00:16            25.344 sonydcam.sys

14.04.2008  00:15            15.872 usbintel.sys

14.04.2008  00:15            25.728 usbcamd2.sys

14.04.2008  00:15            25.600 usbcamd.sys

14.04.2008  00:15            26.368 usbstor.sys

14.04.2008  00:15            32.128 usbccgp.sys

14.04.2008  00:15           143.872 usbport.sys

14.04.2008  00:15            59.520 usbhub.sys

14.04.2008  00:15            20.608 usbuhci.sys

14.04.2008  00:15            15.104 usbscan.sys

14.04.2008  00:15            17.152 usbohci.sys

14.04.2008  00:15            30.208 usbehci.sys

14.04.2008  00:15            19.200 hidir.sys

14.04.2008  00:15            10.368 hidusb.sys

14.04.2008  00:15            36.864 hidclass.sys

14.04.2008  00:15            24.960 hidparse.sys

14.04.2008  00:15            49.408 stream.sys

14.04.2008  00:15            60.160 drmk.sys

14.04.2008  00:15             2.944 drmkaud.sys

14.04.2008  00:15           172.416 kmixer.sys

14.04.2008  00:15            56.576 swmidi.sys

14.04.2008  00:15             6.272 splitter.sys

14.04.2008  00:15            52.864 dmusic.sys

14.04.2008  00:14            81.664 videoprt.sys

14.04.2008  00:14            20.992 vga.sys

14.04.2008  00:13            14.208 wacompen.sys

14.04.2008  00:13            12.672 mutohpen.sys

14.04.2008  00:11            42.112 imapi.sys

14.04.2008  00:10            14.976 tape.sys

14.04.2008  00:10            10.240 sffp_mmc.sys

14.04.2008  00:10            11.392 sfloppy.sys

14.04.2008  00:10            19.712 partmgr.sys

14.04.2008  00:10            11.008 sffp_sd.sys

14.04.2008  00:10            36.352 disk.sys

14.04.2008  00:10            11.904 sffdisk.sys

14.04.2008  00:10            62.976 cdrom.sys

14.04.2008  00:10            14.208 diskdump.sys

14.04.2008  00:10            96.384 scsiport.sys

14.04.2008  00:10            96.512 atapi.sys

14.04.2008  00:10             5.376 viaide.sys

14.04.2008  00:10            24.960 pciidex.sys

14.04.2008  00:10            27.392 fdc.sys

14.04.2008  00:10            20.480 flpydisk.sys

14.04.2008  00:10            15.744 serenum.sys

14.04.2008  00:09             4.352 swenum.sys

14.04.2008  00:09             7.552 mskssrv.sys

14.04.2008  00:09             5.376 mspclock.sys

14.04.2008  00:09             5.504 mstee.sys

14.04.2008  00:09             4.992 mspqm.sys

14.04.2008  00:09            42.368 mountmgr.sys

14.04.2008  00:09           384.768 update.sys

14.04.2008  00:08            71.168 dxg.sys

14.04.2008  00:06            15.488 mssmbios.sys

14.04.2008  00:06            79.232 sdbus.sys

14.04.2008  00:06            44.672 uagp35.sys

14.04.2008  00:06            46.464 gagp30kx.sys

14.04.2008  00:06            42.240 viaagp.sys

14.04.2008  00:06            63.744 mf.sys

14.04.2008  00:06            42.368 agp440.sys

14.04.2008  00:06            42.752 alim1541.sys

14.04.2008  00:06            40.960 sisagp.sys

14.04.2008  00:06            43.008 amdagp.sys

14.04.2008  00:06            44.928 agpcpq.sys

14.04.2008  00:06             5.888 smbali.sys

14.04.2008  00:03           129.792 fltmgr.sys

14.04.2008  00:02           196.224 rdpdr.sys

14.04.2008  00:02           180.608 mrxdav.sys

14.04.2008  00:02            19.072 msfs.sys

14.04.2008  00:02            30.848 npfs.sys

14.04.2008  00:02            66.048 udfs.sys

14.04.2008  00:01            92.288 ksecdd.sys

13.04.2008  23:53            11.868 mdmxsdk.sys

13.04.2008  23:53         1.041.536 hsfdpsp2.sys

13.04.2008  23:53           685.056 hsfcxts2.sys

13.04.2008  23:53           220.032 hsfbs2s2.sys

13.04.2008  23:53            13.240 slwdmsup.sys

13.04.2008  23:53            95.424 slnthal.sys

13.04.2008  23:53           404.990 slntamr.sys

13.04.2008  23:53           129.535 slnt7554.sys

13.04.2008  23:53            13.776 recagent.sys

13.04.2008  23:53           180.360 ntmtlfax.sys

13.04.2008  23:53           126.686 mtlmnt5.sys

13.04.2008  23:53         1.309.184 mtlstrm.sys

13.04.2008  22:09           142.592 aec.sys

13.04.2008  22:06           144.384 hdaudbus.sys

13.04.2008  22:04           166.912 s3gnbm.sys

13.04.2008  22:04            22.271 watv06nt.sys

13.04.2008  22:04            11.935 wadv11nt.sys

13.04.2008  22:04            25.471 watv10nt.sys

13.04.2008  22:04            11.807 wadv07nt.sys

13.04.2008  22:04            11.871 wadv09nt.sys

13.04.2008  22:04            11.295 wadv08nt.sys

13.04.2008  22:04           452.736 mtxparhm.sys

13.04.2008  22:04            34.735 ati1xsxx.sys

13.04.2008  22:04            29.455 ati1xbxx.sys

13.04.2008  22:04            31.744 atinxbxx.sys

13.04.2008  22:04            63.488 atinxsxx.sys

13.04.2008  22:04            12.047 ati1pdxx.sys

13.04.2008  22:04            30.671 ati1raxx.sys

13.04.2008  22:04            11.615 ati1mdxx.sys

13.04.2008  22:04            57.856 atinbtxx.sys

13.04.2008  22:04            73.216 atintuxx.sys

13.04.2008  22:04            56.623 ati1btxx.sys

13.04.2008  22:04            28.672 atinsnxx.sys

13.04.2008  22:04            63.663 ati1rvxx.sys

13.04.2008  22:04           104.960 atinrvxx.sys

13.04.2008  22:04            52.224 atinraxx.sys

13.04.2008  22:04            14.336 atinpdxx.sys

13.04.2008  22:04            26.367 ati1snxx.sys

13.04.2008  22:04            13.824 atinmdxx.sys

13.04.2008  22:04            21.343 ati1ttxx.sys

13.04.2008  22:04            13.824 atinttxx.sys

13.04.2008  22:04            36.463 ati1tuxx.sys

13.11.2007  11:25            20.480 secdrv.sys

02.04.2007  21:36           129.045 cxthsfs2.cty

26.01.2007  10:42         2.831.232 3xHybrid.sys

29.12.2006  20:21            64.352 ativmc20.cod

29.12.2006  20:02            67.866 netwlan5.img

18.10.2006  20:00            38.528 wpdusb.sys

28.09.2006  18:00            82.944 WudfRd.sys

28.09.2006  17:55            77.568 WudfPf.sys

22.09.2006  15:44            10.578 hamachi.sys

07.09.2006  15:25             1.885 103C_HP_CPC_EZ090AA-ACP w5510.at_YC_0Pavi_QCZB632_E63DEheBLA1_48_IAsterope2_SHewleet-Packard_V1.0_B3.17_T060726_WXH2_L407_M1024_J300_7Intel_8Pentium D_93.4_#060907_N10EC8139_Z_G10DE01DD_OHL-DT-ST DVDRRW GSA-H20L.MRK

26.03.2006  13:22            51.200 sfdrv01.sys

08.03.2006  05:27         4.246.016 RtkHDAud.sys

23.02.2006  17:17            32.768 avgntdd.sys

02.02.2006  08:14            13.440 pcdrndisuio.sys

02.02.2006  08:07            28.848 USBkey.sys

20.01.2006  08:20            11.351 diag69xp.sys

12.12.2005  17:27            19.072 PS2.sys

28.10.2005  01:24            21.568 HPZius12.sys

28.10.2005  01:24            16.496 HPZipr12.sys

28.10.2005  01:24            49.664 HPZid412.sys

20.10.2005  20:31    <DIR>          disdn

19.08.2005  10:00             2.432 cdr4_xp.sys

19.08.2005  10:00             2.560 cdralw2k.sys

04.07.2005  11:58            14.848 avgntmgr.sys

08.01.2005  00:07           145.920 Hdaudio.sys

18.12.2004  19:32            38.229 StMp3Rec.sys

04.08.2004  12:00            11.776 cpqdap01.sys

04.08.2004  12:00            18.688 cdaudio.sys

04.08.2004  12:00            12.032 rio8drv.sys

04.08.2004  12:00            58.112 vdmindvd.sys

04.08.2004  12:00            12.032 riodrv.sys

04.08.2004  12:00           262.528 cinemst2.sys

04.08.2004  12:00            12.032 nikedrv.sys

04.08.2004  12:00            51.712 tosdvd.sys

04.08.2004  12:00            21.376 tsbvcap.sys

04.08.2004  12:00            12.288 mouhid.sys

04.08.2004  12:00            12.288 fsvga.sys

04.08.2004  05:00             7.040 parvdm.sys

04.08.2004  05:00            31.360 atmepvc.sys

04.08.2004  05:00           352.256 atmuni.sys

04.08.2004  05:00             4.224 beep.sys

04.08.2004  05:00            13.952 cbidf2k.sys

04.08.2004  05:00             5.888 dmload.sys

04.08.2004  05:00            10.496 dxapi.sys

04.08.2004  05:00             3.328 dxgthk.sys

04.08.2004  05:00            12.416 nwlnkflt.sys

04.08.2004  05:00             4.736 usbd.sys

04.08.2004  05:00            14.592 smclib.sys

04.08.2004  05:00             7.936 fs_rec.sys

04.08.2004  05:00             2.944 null.sys

04.08.2004  05:00           126.336 ftdisk.sys

04.08.2004  05:00         3.440.660 gm.dls

04.08.2004  05:00               646 gmreadme.txt

04.08.2004  05:00             4.352 wmilib.sys

04.08.2004  05:00            12.032 ws2ifsl.sys

04.08.2004  05:00            17.792 ptilink.sys

04.08.2004  05:00             8.832 rasacd.sys

04.08.2004  05:00             5.888 rootmdm.sys

04.08.2004  05:00             4.224 mnmdd.sys

04.08.2004  05:00            16.512 raspti.sys

04.08.2004  05:00            34.432 rawwan.sys

04.08.2004  05:00            32.896 ipfltdrv.sys

04.08.2004  05:00             7.680 mcd.sys

04.08.2004  05:00            32.512 nwlnkfwd.sys

04.08.2004  05:00            12.160 acpiec.sys

04.08.2004  05:00            63.232 nwlnknb.sys

04.08.2004  05:00            55.936 nwlnkspx.sys

04.08.2004  05:00             4.224 rdpcdd.sys

04.08.2004  05:00             3.456 oprghdlr.sys

03.08.2004  21:31            20.992 RTL8139.sys

30.04.2004  09:37           160.640 a347bus.sys

30.04.2004  09:33             5.248 a347scsi.sys

12.05.2003  11:32           446.064 HCW88vid.sys

09.05.2003  15:38            23.212 HCW88bar.sys

09.05.2003  15:37           143.285 HCW88tun.sys

03.02.2003  17:10            17.345 HCW88rc5.sys

03.02.2003  14:28             8.131 HCW88r9x.sys

18.08.2001  11:30             3.328 pciide.sys

17.08.2001  12:59             3.072 audstub.sys

17.08.2001  12:46             6.400 enum1394.sys

             314 Datei(en)     39.436.853 Bytes

               5 Verzeichnis(se), 50.457.251.840 Bytes frei

thx!:)

meine erste Vermutung ist, dass es sich nicht um einen Virus handelt.
Das wollen wir aber noch überprüfen:

- bitte MalwareBytes Anti-Malware (Download Malwarebytes Anti-Malware 1.34 - FilePony.de) runter laden und ausführend. Während dessen den AntiVir Guard bitte deaktivieren. Logfile posten.
- Anschließend Gmer (http://gmer.net/gmer.zip) runterladen und ausführen (Scan). Logfile bitte bei file-upload.net hochladen und verlinken.

Grüße
45cl3p1u5

Code:

Malwarebytes' Anti-Malware 1.34

Geladene Signaturen: 1765

Windows 5.1.2600 Service Pack 3
 

16.02.2009 12:09:49

mbam-log-2009-02-16 (12-09-49).txt
 

Scan-Methode: Quick-Scan (C:\|D:\|)

Führe Extra- und Heuristik-Scan durch. 259926

Scan-Methode: Vollstädiger Scan 1 hour(s), 10 minute(s), 38 second(s)
 

Infizierte Speichermodule: 0

Infizierte Registrierungsschlüssel: 0

Infizierte Registrierungswerte: 35

Infizierte Dateiobjekte der Registrierung: 8

Infizierte Verzeichnisse: 0

Infizierte Dateien: 0

Regedit wurde deaktiviert und wird den Quarantäne-Vorgang beinträchtigen. Malwarebytes' Anti-Malware wird Regedit wieder aktivieren. 8
 

Infizierte Speichermodule:

Infizierte Speicherprozesse:
 

Infizierte Registrierungsschlüssel:

Infizierte Speicherprozesse:
 

Infizierte Registrierungswerte:

HKEY_CLASSES_ROOT\popcaploader.popcaploaderctrl2 (Adware.PopCap) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\popcaploader.popcaploaderctrl2.1 (Adware.PopCap) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\qqiehelper.qqbrowserhelperobject (Spyware.OnlineGames) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\qqiehelper.qqbrowserhelperobject.1 (Spyware.OnlineGames) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\tctrl.tweb (Adware.Agent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\TypeLib\{b1a7c2cf-bf40-4597-8142-7615d74d0cc3} (Adware.Agent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{3084bc3d-c0d6-4a28-a8a4-5857165886ee} (Adware.Agent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{90b1ecb2-fc3b-49ae-a6bd-f5f11bf5c4ad} (Adware.Agent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\tctrl.tweb.1 (Adware.Agent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{e4e3e0f8-cd30-4380-8ce9-b96904bdefca} (Adware.PopCap) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{fe8a736f-4124-4d9c-b4b1-3b12381efabe} (Adware.PopCap) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{54ebd53a-9bc1-480b-966a-843a333ca162} (Spyware.OnlineGames) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{df780f87-ff2b-4df8-92d0-73db16a1543a} (Adware.PopCap) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Typelib\{c9c5deaf-0a1f-4660-8279-9edfad6fefe1} (Adware.PopCap) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{54ebd53a-9bc1-480b-966a-843a333ca162} (Spyware.OnlineGames) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{0c7c23ef-a848-485b-873c-0ed954731014} (Adware.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{df780f87-ff2b-4df8-92d0-73db16a1543a} (Adware.PopCap) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{54ebd53a-9bc1-480b-966a-843a333ca162} (Spyware.OnlineGames) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0c7c23ef-a848-485b-873c-0ed954731014} (Adware.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\{db8b2393-7a6c-4c76-88ce-6b1f6ff6ffe9} (Adware.Agent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\TypeLib\{f0d4b230-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{f0d4b23a-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{f0d4b23c-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{b15fd82e-85bc-430d-90cb-65db1b030510} (Adware.AskSBAR) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{f0d4b231-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{f0d4b231-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{f0d4b231-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{f0d4b23b-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{f0d4b23b-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\TBH (Adware.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\xttb00001.xttb00001toolbar (Adware.Trace) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{055fd26d-3a88-4e15-963d-dc8493744b1d} (Adware.BHO) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{055fd26d-3a88-4e15-963d-dc8493744b1d} (Adware.BHO) -> Quarantined and deleted successfully.
 

Infizierte Dateiobjekte der Registrierung:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\{db8b2393-7a6c-4c76-88ce-6b1f6ff6ffe9} (Adware.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\{db8b2393-7a6c-4c76-88ce-6b1f6ff6ffe9} (Adware.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{0c7c23ef-a848-485b-873c-0ed954731014} (Adware.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{a57e074f-56d8-4a33-8112-aac9693aa909} (Adware.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{db8b2393-7a6c-4c76-88ce-6b1f6ff6ffe9} (Adware.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\stup.exe (Adware.Agent) -> Quarantined and deleted successfully.
 

Infizierte Verzeichnisse:

Infizierte Speicherprozesse:
 

Infizierte Dateien:

Infizierte Speicherprozesse:
 

Regedit wurde deaktiviert und wird den Quarantäne-Vorgang beinträchtigen. Malwarebytes' Anti-Malware wird Regedit wieder aktivieren.

C:\Program Files\TENCENT\Adplus\scrax.dll (Adware.Agent) -> Quarantined and deleted successfully.

C:\Programme\AskSBar\bar\1.bin\A2HIGHIN.EXE (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Programme\AskSBar\bar\1.bin\A2PLUGIN.DLL (Adware.MyWebSearch) -> Delete on reboot.

C:\Programme\AskSBar\bar\1.bin\ASKSBAR.DLL (Adware.AskSBAR) -> Delete on reboot.

C:\Programme\AskSBar\bar\1.bin\NPASKSBR.DLL (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Programme\Mozilla Firefox\plugins\NPAskSBr.dll (Trojan.Agent) -> Delete on reboot.

C:\Program Files\TENCENT\Adplus\stup.exe (Adware.Agent) -> Quarantined and deleted successfully.

C:\Programme\ICQToolbar\tbuA4\toolbaru.dll (Adware.BHO) -> Quarantined and deleted success

das mit gmer kommt noch :)

File-Upload.net - test.log

...stimmts so?x)

mfg
chen15

ja und die Logfile sieht gut aus.

Dann also bitte Malwarebytes, Avira AntiVir und Acrobat Reader (veraltet) deinstallieren.

Dann HijackThis starten -> im Main Menu auf "Open the Misc Tool Section" -> dann "open uninstall Manager" -> auf "save list" und den Inhalt der Datei posten

...also grad mozilla geöffnet, kam gleich so ne meldung, dass ein virus (TR/trash) oder so ähnlich gefunden wurde... ich start dann gleich noma AntiVir :/

mfg
chen

ist ganz normal. Bestimmt im System Volume...

Du muss die Systemwiderherstellungspunkte löschen, in denen sind die Viren mitgesichert. (Rechtsklick Arbeitsplatz -> Eigenschaften -> Register Systemwiederherstellung -> Systemwiederherstellung auf allen Laufwerken deaktivieren)

so alles deinstalliert...

Code:

Adobe Flash Player 10 Plugin

Adobe Shockwave Player

AlienGUIse Theme Manager

Apple Mobile Device Support

Apple Software Update

Ask Toolbar

Audacity 1.2.6

AviSynth 2.5

Bonjour

Browsen mit Registerkarten (Windows Live Toolbar)

Call of Duty(R) 4 - Modern Warfare(TM)

Call of Duty(R) 4 - Modern Warfare(TM) 1.4 Patch

Call of Duty(R) 4 - Modern Warfare(TM) 1.5 Multiplayer Patch

CCleaner (remove only)

Choice Guard

Counter-Strike: Source

DivX Codec

DivX Converter

DivX Player

DivX Plus DirectShow Filters

DivX Web Player

Einfache Internetanmeldung

Elecard MPEG-2 Decoder&Streaming Pack

Enhanced Multimedia Keyboard Solution

EVEREST Home Edition v2.20

Feederkennung (Windows Live Toolbar)

FrostWire 4.17.0

GdiplusUpgrade

Google Toolbar for Firefox

Google Toolbar for Internet Explorer

Hamachi 1.0.0.61

Hero_Online

Hervorhebe-Funktion (Windows Live Toolbar)

High Definition Audio - KB888111

HijackThis 2.0.2

Hotfix for Windows Media Format 11 SDK (KB929399)

Hotfix für Windows Internet Explorer 7 (KB947864)

Hotfix für Windows Media Player 11 (KB939683)

Hotfix für Windows XP (KB952287)

HP Boot Optimizer

HP Deskjet Printer Preload

HP Document Viewer 6.1

HP DVD Play 2.1

HP Imaging Device Functions 7.0

HP Photosmart 330,380,420,470,7800,8000,8200 Series

HP Photosmart Kameras 6.0

HP Photosmart Premier Software 6.5

HP Product Assistant

HP PSC & OfficeJet 5.3.B

HP PSC & OfficeJet 6.1.A

HP Solution Center and Imaging Support Tools 6.1

HP Update

ICQ  Toolbar

ICQ 5.1

Icy Tower v1.2 (22kHz)

Internetdienste

iPhoneRingToneMaker 2.5.1

iPod for Windows 2006-06-28

iTunes

J2SE Runtime Environment 5.0 Update 10

J2SE Runtime Environment 5.0 Update 11

J2SE Runtime Environment 5.0 Update 5

J2SE Runtime Environment 5.0 Update 6

J2SE Runtime Environment 5.0 Update 7

J2SE Runtime Environment 5.0 Update 9

Java(TM) 6 Update 11

Java(TM) 6 Update 2

Java(TM) 6 Update 7

Java(TM) SE Runtime Environment 6 Update 1

Messenger Plus! Live

METIN2(remove only)

Microsoft .NET Framework 1.1

Microsoft .NET Framework 1.1

Microsoft .NET Framework 1.1 German Language Pack

Microsoft .NET Framework 1.1 Hotfix (KB928366)

Microsoft .NET Framework 2.0 Service Pack 1

Microsoft Compression Client Pack 1.0 for Windows XP

Microsoft Internationalized Domain Names Mitigation APIs

Microsoft National Language Support Downlevel APIs

Microsoft Office Live Add-in 1.3

Microsoft Office Professional Edition 2003

Microsoft Silverlight

Microsoft SQL Server 2005 Compact Edition [ENU]

Microsoft User-Mode Driver Framework Feature Pack 1.0

Microsoft Visual C++ 2005 Redistributable

MobileMe Control Panel

MobMap 3.17

Mozilla Firefox (3.0.6)

MP3 and WAV Solutions 1

MPEG To Wav Converter version 1.0

MSXML 4.0 SP2 (KB925672)

MSXML 4.0 SP2 (KB927978)

MSXML 4.0 SP2 (KB936181)

MSXML 4.0 SP2 (KB954430)

Need for Speed? Most Wanted

NGO NVIDIA Optimized Driver v1.9137

NVIDIA Drivers

OpenOffice.org Installer 1.0

Optimierung aufgrund von Kundenerfahrungen

PC-Doctor 5 for Windows

PowerCinema

Python 2.2 pywin32 extensions (build 203)

Python 2.2.3

QuickTime

RealPlayer

Realtek High Definition Audio Driver

Safari

SbX Rechnungswesen HAK I 08-09

Security Update for CAPICOM (KB931906)

Security Update for CAPICOM (KB931906)

Sicherheitsupdate f¨1r Step by Step Interactive Training (KB923723)

Sicherheitsupdate f¨1r Windows Internet Explorer 7 (KB928090)

Sicherheitsupdate f¨1r Windows Internet Explorer 7 (KB929969)

Sicherheitsupdate f¨1r Windows Internet Explorer 7 (KB931768)

Sicherheitsupdate f¨1r Windows Internet Explorer 7 (KB933566)

Sicherheitsupdate f¨1r Windows Internet Explorer 7 (KB937143)

Sicherheitsupdate f¨1r Windows Internet Explorer 7 (KB938127)

Sicherheitsupdate f¨1r Windows Internet Explorer 7 (KB939653)

Sicherheitsupdate f¨1r Windows Media Player 10 (KB911565)

Sicherheitsupdate f¨1r Windows Media Player 10 (KB936782)

Sicherheitsupdate für Step by Step Interactive Training (KB898458)

Sicherheitsupdate für Windows Internet Explorer 7 (KB942615)

Sicherheitsupdate für Windows Internet Explorer 7 (KB944533)

Sicherheitsupdate für Windows Internet Explorer 7 (KB950759)

Sicherheitsupdate für Windows Internet Explorer 7 (KB953838)

Sicherheitsupdate für Windows Internet Explorer 7 (KB956390)

Sicherheitsupdate für Windows Internet Explorer 7 (KB958215)

Sicherheitsupdate für Windows Internet Explorer 7 (KB960714)

Sicherheitsupdate für Windows Internet Explorer 7 (KB961260)

Sicherheitsupdate für Windows Media Player (KB952069)

Sicherheitsupdate für Windows Media Player 10 (KB917734)

Sicherheitsupdate für Windows Media Player 11 (KB936782)

Sicherheitsupdate für Windows Media Player 11 (KB954154)

Sicherheitsupdate für Windows XP (KB938464)

Sicherheitsupdate für Windows XP (KB941569)

Sicherheitsupdate für Windows XP (KB946648)

Sicherheitsupdate für Windows XP (KB950760)

Sicherheitsupdate für Windows XP (KB950762)

Sicherheitsupdate für Windows XP (KB950974)

Sicherheitsupdate für Windows XP (KB951066)

Sicherheitsupdate für Windows XP (KB951376)

Sicherheitsupdate für Windows XP (KB951376-v2)

Sicherheitsupdate für Windows XP (KB951698)

Sicherheitsupdate für Windows XP (KB951748)

Sicherheitsupdate für Windows XP (KB952954)

Sicherheitsupdate für Windows XP (KB953839)

Sicherheitsupdate für Windows XP (KB954211)

Sicherheitsupdate für Windows XP (KB954459)

Sicherheitsupdate für Windows XP (KB954600)

Sicherheitsupdate für Windows XP (KB955069)

Sicherheitsupdate für Windows XP (KB956391)

Sicherheitsupdate für Windows XP (KB956802)

Sicherheitsupdate für Windows XP (KB956803)

Sicherheitsupdate für Windows XP (KB956841)

Sicherheitsupdate für Windows XP (KB957095)

Sicherheitsupdate für Windows XP (KB957097)

Sicherheitsupdate für Windows XP (KB958644)

Sicherheitsupdate für Windows XP (KB958687)

Sicherheitsupdate für Windows XP (KB960715)

Skype 2.5

Smart Menus (Windows Live Toolbar)

Sonic Express Labeler

Sonic MyDVD Plus

Sonic RecordNow Audio

Sonic RecordNow Copy

Sonic RecordNow Data

Sonic Update Manager

SOSO AddressBar Search

SprayR 1.0 RC7b

Steam(TM)

TeamSpeak 2 RC2

TmNationsForever

Trillian

TuneUp Utilities 2007

TuneUp Utilities 2008

Uniblue DriverScanner 2009

Uniblue DriverScanner 2009

Update für Windows XP (KB951072-v2)

Update für Windows XP (KB951978)

Update für Windows XP (KB955839)

VC80CRTRedist - 8.0.50727.762

VeohTV BETA

Videora iPod Converter 3.07

Windows Imaging Component

Windows Live Anmelde-Assistent

Windows Live Favorites f¨1r Windows Live Toolbar

Windows Live Fotogalerie

Windows Live installer

Windows Live Mail

Windows Live Messenger

Windows Live Toolbar

Windows Live Toolbar

Windows Live Toolbar-Erweiterung (Windows Live Toolbar)

Windows Live Writer

Windows Media Format 11 runtime

Windows Media Format 11 runtime

Windows Media Player 11

Windows Media Player 11

Windows XP Service Pack 3

WinRAR Archivierer

World of Warcraft

Xfire (remove only)

ZAV Schreibtrainer (Schuelerdaten deinstallieren)

Zav_1200 (komplett deinstallieren)

ZipGenius 6 (6.0.2.1060)

lade Dir CCleaner runter und und bereinige Dein System mit der verlinkten Anleitung.
Ich gehe solange Deine Programme durch.

das mit dem CCleaner hab ich heute, bevor ich alles gepostet hab, bereits gemacht ..:)

das hat aber seinen Sinn, das jetzt nochmal zu machen. Vor allem nach der Deinstallation von Avira (werden wir dann wieder installieren - s.u.)

folgene Vorschläge habe ich dann noch:

- Ask Toolbar (Adware) deinstallieren
- ICQ 5.1 (deinstallieren und aktuelle Version aufspielen)
- alles was mit Java/J2SE zu tun hat runter und neu installieren
- PC-Doctor 5 for Windows - benutzt Du den? Sonst weg damit!
- Python runter und bei Bedarf neu (Python 3.0.1)
- ebenso Skype (Skype 4.0)
- TuneUp Utilities 2007 runter, Du hast 2008 drauf
- TuneUp Utilities 2008, wenn Du es nicht benutzt (siehe PC-Doctor)

Und dann wieder die neueste Version von Avira drauf (Avira AntiVir Personal - FREE Antivirus).

Dein "avgntflt.sys"-Problem dürfte somit behoben sein ;-)

Grüße
45cl3p1u5

Sooo^^erstmal vielen Dank für die bisherige Hilfe :party:

alles was aufgelistet ist, deinstalliert / aktualisiert außer Ask Toolbar....
...das funzt. irgendwie nicht. Wenn ich auf "Entfernen" gehe, kommt die Fehlermeldung

"Fehler beim Laden con C:\PROGRA~1\AskSBar\bar\1.bin\AskSBar.dll"
"Das angebene Modul wurde nicht gefunden"

mfg
chen

Ich werd morgen Bescheid geben ob das alles was gebracht hat, ne?^^ - da mein PC ja komischerweise nur einmal am Tag abstürzt xD

morgähn...

PC heute ungefähr 5min nach dem einschalten wieder mit Bluescreen abgestürzt, allerdings mit einer anderen Fehlermeldung, die ich noch nie hatte... :S

"Das Problem wurde möglicherweise von der folgenden Datei verursacht: win32k"
"STOP: 0x00000050 (0xF000EF5D, 0x00000001, 0xBF8016CA, 0x00000000)"
"win32k.sys - Adress BF8016CA base at BF800000 Date Stamp 48cd513a"

mfg
chen

€: kann das sein das es am SP3 liegt --> hab ich erst vor einigen Tagen installiert...