Trojaner-Board
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Win32/Kryptik.EKH Trojaner lässt sich nicht entfernen/MBAM startet nicht (https://www.trojaner-board.de/86935-win32-kryptik-ekh-trojaner-laesst-entfernen-mbam-startet.html)

LongM 09.06.2010 22:48
Win32/Kryptik.EKH Trojaner lässt sich nicht entfernen/MBAM startet nicht
 
Hallo, bin neu hier und war gerade dabei diese liste abzuarbeiten...(da mein pc plötzlich viel länger zum herunterfahren braucht und ich ein paar dubiose prozesse gefunden hab)

Der CCleaner unter a) hat einwandfrei funktioniert, hab alles gemacht wie es in der anleitung drinn stand.

Nun bei b) angekommen, hab ich mir das programm " Malwarebytes-Anti-Malware Download" version 1.46 heruntergeladen, installiert und musste feststellen dass es sich nicht starten lässt. Es kommt für ca 2 sekunden die sanduhr, danach passiert nichts... im taskmanager ist auch kein prozess dazugekommen...

was kann ich da machen?

Hab einmal Eset-onlinescanner drüber laufen lassen, der hat folgendes gefunden:
C:\WINDOWS\system32\pmnnlk.dll Variante von Win32/Kryptik.EKH Trojaner Gesäubert durch Löschen (nach dem nächsten Neustart) - in Quarantäne kopiert
C:\WINDOWS\system32\rqrqpp.dll Variante von Win32/Kryptik.EKH Trojaner Gesäubert durch Löschen (nach dem nächsten Neustart) - in Quarantäne kopiert
Arbeitsspeicher Variante von Win32/Kryptik.EKH Trojaner Enthielt infizierte Datei(en)

kann das der grund dafür sein, dass das programm nicht starten kann? Also nach den prozessen (zum beispiel der "qomnkh.dll") kann ich auch nicht googlen da dann mein browser abschmiert...


info.txtRSIT Logfile:
RSIT Logfile:
Code:
logfile of random's system information tool 1.06 2010-06-09 23:52:11

======Uninstall list======

-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 9.3.2 - Deutsch-->MsiExec.exe /I{AC76BA86-7AD7-1031-7B44-A93000000001}
Adobe® Photoshop® Album Starter Edition 3.0-->MsiExec.exe /I{4BDFD2CE-6329-42E4-9801-9B3D1F10D79B}
ATI - Software Uninstall Utility-->C:\Programme\ATI Technologies\UninstallAll\AtiCimUn.exe
ATI Display Driver-->rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
avast! Free Antivirus-->C:\Programme\Alwil Software\Avast5\aswRunDll.exe "C:\Programme\Alwil Software\Avast5\Setup\setiface.dll" RunSetup
Battlefield 1942: Secret Weapons of WWII-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{B73B4A99-4173-4747-BBEC-0F05E966F9D2}\Setup.exe" -l0x7
Battlefield 1942: The Road To Rome-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{D057AA08-8CBF-42E3-9EAB-23B8FED1C279}\Setup.exe" -l0x7
Battlefield 1942-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{698D7E61-E4BF-4CA6-8A09-CF6BDBFDEF65}\Setup.exe" -l0x7
Canon MP270 series Benutzerregistrierung-->C:\Programme\Canon\IJEREG\MP270 series\UNINST.EXE
Canon MP270 series MP Drivers-->"C:\WINDOWS\system32\CanonIJ Uninstaller Information\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP270_series\DelDrv.exe" /U:{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP270_series
CCleaner-->"C:\Programme\CCleaner\uninst.exe"
Compatibility Pack für 2007 Office System-->MsiExec.exe /X{90120000-0020-0407-0000-0000000FF1CE}
Diablo II-->C:\Programme\Gemeinsame Dateien\Blizzard Entertainment\Diablo II\Uninstall.exe
Die Sims™ 2 Deluxe-->D:\Spiele\SIMS II\EAUninstall.exe
Die Sims™ 3 Luxus-Accessoires-->"C:\Programme\InstallShield Installation Information\{71828142-5A24-4BD0-97E7-976DA08CE6CF}\setup.exe" -runfromtemp -l0x0007 -removeonly
Die Sims™ 3-->"C:\Programme\InstallShield Installation Information\{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}\setup.exe" -runfromtemp -l0x0007 -removeonly
DivX Player-->C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DivX\DivX7\DivX Player\DivXPlayerUninstall.exe /PLAYER
DivX Plus DirectShow Filters-->C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DivX\DivX7\DivX Plus DirectShow Filters\DivXDSFiltersUninstall.exe /DSFILTERS
DivX-Setup-->C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DivX\Setup\DivXSetup.exe /uninstall /bundleGroupId divx.com
ESET Online Scanner v3-->C:\Programme\ESET\ESET Online Scanner\OnlineScannerUninstaller.exe
Hotfix for Windows XP (KB926239)-->"C:\WINDOWS\$NtUninstallKB926239$\spuninst\spuninst.exe"
ICQ6.5-->"C:\Programme\InstallShield Installation Information\{60DE4033-9503-48D1-A483-7846BD217CA9}\setup.exe" -runfromtemp -l0x0009 -removeonly
Java(TM) 6 Update 20-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216020FF}
jetAudio Basic-->C:\Programme\InstallShield Installation Information\{DF8195AF-8E6F-4487-A0EE-196F7E3F4B8A}\setup.exe -runfromtemp -l0x0007 -removeonly
K-Lite Codec Pack 5.7.0 (Full)-->"C:\Programme\K-Lite Codec Pack\unins000.exe"
Lexware Info Service-->MsiExec.exe /X{59624372-3B85-47f4-9B04-4911E551DF1E}
Malwarebytes' Anti-Malware-->"C:\Programme\Malwarebytes' Anti-Malware\unins000.exe"
Marvell Miniport Driver-->MsiExec.exe /X{C950420B-4182-49EA-850A-A6A2ABF06C6B}
Microsoft .NET Framework 2.0 Service Pack 1-->MsiExec.exe /I{B508B3F1-A24A-32C0-B310-85786919EF28}
Microsoft Office Excel Viewer 2003-->MsiExec.exe /I{90840407-6000-11D3-8CFE-0150048383C9}
Microsoft Office PowerPoint Viewer 2007 (German)-->MsiExec.exe /X{95120000-00AF-0407-0000-0000000FF1CE}
Microsoft Office XP Professional-->MsiExec.exe /I{90110407-6000-11D3-8CFE-0050048383C9}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148-->MsiExec.exe /X{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}
Mozilla Firefox (3.6.3)-->C:\Programme\Mozilla Firefox\uninstall\helper.exe
Nokia Connectivity Cable Driver-->C:\PROGRA~1\GEMEIN~1\INSTAL~1\Driver\9\INTEL3~1\IDriver.exe /M{3C1599DA-9ED9-4090-930F-B8BC4D99D6B0} /l1031
Nokia PC Suite-->C:\PROGRA~1\GEMEIN~1\INSTAL~1\Driver\9\INTEL3~1\IDriver.exe /M{FBD6A335-7E02-43B0-AF58-1B472F9BD3E1} /l1031
Panda ActiveScan 2.0-->C:\Programme\Panda Security\ActiveScan 2.0\as2uninst.exe
QuickTime-->MsiExec.exe /I{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}
Realtek AC'97 Audio-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{FB08F381-6533-4108-B7DD-039E11FBC27E}\setup.exe" REMOVE
Skype™ 4.1-->MsiExec.exe /X{D103C4BA-F905-437A-8049-DB24763BBE36}
Sony Ericsson PC Suite 1.20.224-->MsiExec.exe /I{7689CA7A-1270-425A-9959-EB4CB25EA29A}
Sony Ericsson PC Suite 6.011.00-->"C:\Programme\InstallShield Installation Information\{2FFE93F0-BB72-4E52-8761-354D1AAA9387}\ISAdmin.exe" -runfromtemp -l0x0009 -removeonly
Steuer 2009-->MsiExec.exe /X{410AB9BC-B057-4D39-9260-660EE1B4BED2}
Steuer Hilfesammlung-->MsiExec.exe /X{67DABCB4-239C-4E02-805E-DEA0DDCB1926}
SUperior SU-->C:\WINDOWS\ISUNINST.EXE -f"C:\Programme\SUperior SU\Uninst.isu" -o="SUperior SU" -c"C:\Programme\SUperior SU\Uninst.dll
TeamSpeak 2 RC2-->C:\Programme\Teamspeak2_RC2\unins000.exe
Update Service-->C:\Programme\Sony Ericsson\Update Service\uninst.exe
VC80CRTRedist - 8.0.50727.4053-->MsiExec.exe /I{5EE7D259-D137-4438-9A5F-42F432EC0421}
Veetle TV 0.9.16-->C:\Programme\Veetle\UninstallVeetleTV.exe
VIA Plattform-Geräte-Manager-->C:\PROGRA~1\GEMEIN~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{20D4A895-748C-4D88-871C-FDB1695B0169}
Warcraft III-->C:\Programme\Gemeinsame Dateien\Blizzard Entertainment\Warcraft III\Uninstall.exe
Windows Media Format 11 runtime-->"C:\Programme\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
WinRAR-->C:\Programme\WinRAR\uninstall.exe

======Security center information======

AV: avast! Antivirus

======System event log======

Computer Name: ***
Event Code: 7036
Message: Dienst "Windows Installer" befindet sich jetzt im Status "Beendet".

Record Number: 29803
Source Name: Service Control Manager
Time Written: 20100503022615.000000+120
Event Type: Informationen
User:

Computer Name: ***
Event Code: 7036
Message: Dienst "WMI-Leistungsadapter" befindet sich jetzt im Status "Beendet".

Record Number: 29802
Source Name: Service Control Manager
Time Written: 20100503021608.000000+120
Event Type: Informationen
User:

Computer Name: ***
Event Code: 7036
Message: Dienst "WMI-Leistungsadapter" befindet sich jetzt im Status "Ausgeführt".

Record Number: 29801
Source Name: Service Control Manager
Time Written: 20100503021608.000000+120
Event Type: Informationen
User:

Computer Name: ***
Event Code: 7035
Message: Der Steuerbefehl "starten" wurde erfolgreich an den Dienst "WMI-Leistungsadapter" gesendet.

Record Number: 29800
Source Name: Service Control Manager
Time Written: 20100503021608.000000+120
Event Type: Informationen
User: NT-AUTORITÄT\SYSTEM

Computer Name: ***
Event Code: 7036
Message: Dienst "Java Quick Starter" befindet sich jetzt im Status "Ausgeführt".

Record Number: 29799
Source Name: Service Control Manager
Time Written: 20100503021601.000000+120
Event Type: Informationen
User:

=====Application event log=====

Computer Name: ***
Event Code: 4098
Message: SUperior Service has been started.

Record Number: 3529
Source Name: SUperior
Time Written: 20100428201940.000000+120
Event Type: Informationen
User:

Computer Name: ***
Event Code: 105
Message: The service was started.

Record Number: 3528
Source Name: ATI Smart
Time Written: 20100428201939.000000+120
Event Type: Informationen
User:

Computer Name:***
Event Code: 1800
Message: Der Windows-Sicherheitscenterdienst wurde gestartet.

Record Number: 3527
Source Name: SecurityCenter
Time Written: 20100428115635.000000+120
Event Type: Informationen
User:

Computer Name: ***
Event Code: 4098
Message: SUperior Service has been started.

Record Number: 3526
Source Name: SUperior
Time Written: 20100428115630.000000+120
Event Type: Informationen
User:

Computer Name: ***
Event Code: 105
Message: The service was started.

Record Number: 3525
Source Name: ATI Smart
Time Written: 20100428115629.000000+120
Event Type: Informationen
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Programme\Gemeinsame Dateien\DivX Shared\;C:\Programme\SUperior SU;C:\Programme\Haufe\iDesk\iDeskService\;C:\Programme\QuickTime\QTSystem\;C:\Programme\Gemeinsame Dateien\Teleca Shared
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 31 Stepping 0, AuthenticAMD
"PROCESSOR_REVISION"=1f00
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"CLASSPATH"=.;C:\Programme\Java\jre6\lib\ext\QTJava.zip
"QTJAVA"=C:\Programme\Java\jre6\lib\ext\QTJava.zip

-----------------EOF-----------------
--- --- ---

--- --- ---
RSIT Logfile:
Code:
Logfile of random's system information tool 1.07 (written by random/random)
Run by *** at 2010-06-09 23:52:02
Microsoft Windows XP Professional Service Pack 2
System drive C: has 3 GB (21%) free of 15 GB
Total RAM: 2047 MB (78% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 23:52:10, on 09.06.2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Java\jre6\bin\jqs.exe
C:\Programme\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\SUperior SU\susrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\Dokumente und Einstellungen\***\Eigene Dateien\Downloads\RSIT.exe
C:\Programme\trend micro\***.exe

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKLM\..\Run: [khijjjdrv] rundll32.exe "qomnkh.dll",s
O4 - HKLM\..\Run: [wvtqomsys] rundll32.exe "rqrqpp.dll",DllRegisterServer
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [ICQ] "C:\Programme\ICQ6.5\ICQ.exe" silent
O4 - HKCU\..\Run: [opqonkdrv] rundll32.exe "qomnkh.dll",s
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [cbyvvwdrv] rundll32.exe "qomnkh.dll",s (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O18 - Protocol: haufereader - (no CLSID) - (no file)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: suwlnfwd - C:\Programme\SUperior SU\suwlnfwd.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programme\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Programme\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Programme\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe
O23 - Service: Sony Ericsson OMSI download service (OMSI download service) - Unknown owner - C:\Programme\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe
O23 - Service: SUperior - Stefan Kuhr Software - C:\Programme\SUperior SU\susrvc.exe

--
End of file - 4611 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-04-04 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Programme\Java\jre6\bin\jp2ssv.dll [2010-05-03 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-05-03 79648]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"avast5"=C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe [2010-05-06 2815192]
"khijjjdrv"=qomnkh.dll,s []
"wvtqomsys"=rqrqpp.dll,DllRegisterServer []
"Adobe Reader Speed Launcher"=C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-04-04 36272]
"Adobe ARM"=C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe [2010-03-24 952768]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Malwarebytes' Anti-Malware"=C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe [2010-03-29 437584]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ICQ"=C:\Programme\ICQ6.5\ICQ.exe [2009-11-16 172792]
"opqonkdrv"=qomnkh.dll,s []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe [2010-03-24 952768]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
C:\Programme\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe [2005-06-23 57344]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-04-04 36272]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cbxwvtdrv]
pmnnlk.dll,s []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
C:\Programme\DAEMON Tools Lite\daemon.exe [2008-12-29 687560]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
C:\Programme\DivX\DivX Update\DivXUpdate.exe [2010-04-13 1135912]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EA Core]
C:\Programme\Electronic Arts\EADM\Core.exe -silent []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\fcbcyvdrv]
pmnnlk.dll,s []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\jkhhgedrv]
pmnnlk.dll,s []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LexwareInfoService]
C:\Programme\Gemeinsame Dateien\Lexware\Update Manager\LxUpdateManager.exe [2008-11-03 339240]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ljgeedsys]
rqrqpp.dll,DllRegisterServer []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\opmkkjsys]
rqrqpp.dll,DllRegisterServer []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\qonlmnsys]
rqrqpp.dll,DllRegisterServer []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Programme\QuickTime\QTTask.exe [2010-03-17 421888]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
C:\Programme\Skype\Phone\Skype.exe [2009-10-09 25623336]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
C:\Programme\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe [2005-10-26 159744]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
C:\WINDOWS\SOUNDMAN.EXE [2005-02-02 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe [2010-02-18 248040]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUperior Switcher]
C:\Programme\SUperior SU\swtchsvc.exe [2004-07-24 274432]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateMyDrivers]
C:\Programme\SmartTweak Software\UpdateMyDrivers\UpdateMyDrivers.exe -t []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\urpoomdrv]
pmnnlk.dll,s []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\xxyvtudrv]
pmnnlk.dll,s []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Microsoft Office.lnk]
C:\PROGRA~1\MICROS~2\Office10\OSA.EXE [2001-02-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"wuauserv"=2

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2006-05-03 61440]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\suwlnfwd]
C:\Programme\SUperior SU\suwlnfwd.dll [2004-07-24 49152]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"authentication packages"=msv1_0
rqrqpp.dll

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Programme\Miranda IM\miranda32.exe"="C:\Programme\Miranda IM\miranda32.exe:*:Enabled:Miranda IM"
"C:\Programme\uTorrent\uTorrent.exe"="C:\Programme\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"D:\Spiele\Warcraft III\Warcraft III.exe"="D:\Spiele\Warcraft III\Warcraft III.exe:*:Enabled:Warcraft III"
"C:\Programme\PFPortChecker\PFPortChecker.exe"="C:\Programme\PFPortChecker\PFPortChecker.exe:*:Enabled:PFPortchecker by portforward.com helps check if your ports are properly forwarded."
"C:\Programme\ICQ6.5\ICQ.exe"="C:\Programme\ICQ6.5\ICQ.exe:*:Enabled:ICQ6"
"C:\Programme\Skype\Plugin Manager\skypePM.exe"="C:\Programme\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Programme\Sony Ericsson\Update Service\Update Service.exe"="C:\Programme\Sony Ericsson\Update Service\Update Service.exe:*:Enabled:Update Service"
"C:\Programme\Skype\Phone\Skype.exe"="C:\Programme\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
shell\AutoRun\command - E:\AUTORUN.EXE

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{95e5b868-d7d3-11de-acda-00112fdc01cf}]
shell\AutoRun\command - G:\Menu.exe


======List of files/folders created in the last 1 months======

2010-06-09 23:52:02 ----D---- C:\rsit
2010-06-09 23:52:02 ----D---- C:\Programme\trend micro
2010-06-09 23:25:06 ----D---- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Malwarebytes
2010-06-09 23:19:49 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
2010-06-09 23:19:48 ----D---- C:\Programme\Malwarebytes' Anti-Malware
2010-06-09 23:02:35 ----D---- C:\Programme\CCleaner
2010-06-04 22:42:48 ----AH---- C:\WINDOWS\system32\qomnkh.dll
2010-06-04 20:24:07 ----AH---- C:\WINDOWS\system32\nnkhif.dll
2010-06-04 18:24:05 ----AH---- C:\WINDOWS\system32\yabbaw.dll
2010-06-04 17:24:08 ----AH---- C:\WINDOWS\system32\ddbxvu.dll
2010-06-04 17:03:57 ----D---- C:\Programme\Panda Security
2010-06-04 16:24:04 ----AH---- C:\WINDOWS\system32\ssrpqn.dll
2010-06-04 08:20:15 ----D---- C:\Programme\ESET
2010-06-04 01:57:06 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\BVRP Software
2010-06-04 01:54:39 ----A---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\hpe2C3.dll
2010-06-04 01:53:20 ----N---- C:\WINDOWS\system32\spmsg.dll
2010-06-04 01:53:16 ----HDC---- C:\WINDOWS\$NtUninstallKB926239$
2010-06-04 01:52:45 ----HDC---- C:\WINDOWS\$NtUninstallWMFDist11$
2010-06-04 01:52:13 ----A---- C:\WINDOWS\system32\spupdsvc.exe
2010-06-04 01:34:12 ----D---- C:\Dokumente und Einstellungen\***\Anwendungsdaten\AdobeUM
2010-06-04 01:32:32 ----SHD---- C:\Config.Msi
2010-06-04 01:22:11 ----HD---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonIJScan
2010-06-04 01:22:11 ----D---- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Canon
2010-06-04 01:03:42 ----D---- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Teleca
2010-06-04 01:01:46 ----DC---- C:\WINDOWS\system32\DRVSTORE
2010-06-04 01:01:27 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sony Ericsson
2010-06-04 01:01:22 ----D---- C:\Programme\Gemeinsame Dateien\Teleca Shared
2010-06-04 01:01:21 ----D---- C:\Programme\Sony Ericsson
2010-06-04 01:01:21 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Teleca
2010-06-04 00:59:29 ----D---- C:\WINDOWS\Downloaded Installations
2010-05-16 07:09:48 ----AH---- C:\WINDOWS\system32\awtqpo.dll
2010-05-16 01:11:01 ----AH---- C:\WINDOWS\system32\rqrqpp.dll
2010-05-15 17:35:55 ----RHD---- C:\Dokumente und Einstellungen\***\Anwendungsdaten\SecuROM
2010-05-15 17:35:55 ----A---- C:\WINDOWS\system32\CmdLineExt.dll
2010-05-15 13:26:43 ----N---- C:\WINDOWS\system32\difxapi.dll
2010-05-15 13:26:42 ----D---- C:\Programme\VIA

======List of files/folders modified in the last 1 months======

2010-06-09 23:52:06 ----D---- C:\WINDOWS\Prefetch
2010-06-09 23:52:02 ----RD---- C:\Programme
2010-06-09 23:50:10 ----D---- C:\WINDOWS\system32\drivers
2010-06-09 23:29:22 ----D---- C:\WINDOWS
2010-06-09 23:29:21 ----D---- C:\WINDOWS\Temp
2010-06-09 23:29:02 ----D---- C:\Dokumente und Einstellungen\***\Anwendungsdaten\ICQ
2010-06-09 23:27:29 ----D---- C:\WINDOWS\system32\CatRoot2
2010-06-09 23:27:29 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-06-09 23:04:03 ----D---- C:\WINDOWS\Minidump
2010-06-09 23:04:03 ----D---- C:\WINDOWS\Debug
2010-06-09 22:46:05 ----SHD---- C:\WINDOWS\Installer
2010-06-09 22:45:25 ----D---- C:\WINDOWS\system32
2010-06-09 01:13:05 ----SHD---- C:\WINDOWS\CSC
2010-06-08 20:43:56 ----SH---- C:\boot.ini
2010-06-08 20:43:56 ----A---- C:\WINDOWS\win.ini
2010-06-08 20:43:56 ----A---- C:\WINDOWS\system.ini
2010-06-08 20:43:08 ----SD---- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Microsoft
2010-06-08 20:43:07 ----RSD---- C:\WINDOWS\assembly
2010-06-08 11:58:36 ----SHD---- C:\System Volume Information
2010-06-08 11:58:36 ----D---- C:\WINDOWS\system32\Restore
2010-06-07 02:26:36 ----D---- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Skype
2010-06-07 01:21:23 ----D---- C:\Dokumente und Einstellungen\***\Anwendungsdaten\skypePM
2010-06-04 17:04:36 ----HD---- C:\WINDOWS\inf
2010-06-04 08:36:01 ----D---- C:\Programme\Everest Poker.net
2010-06-04 08:35:47 ----D---- C:\Programme\Everest Poker
2010-06-04 07:56:23 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-06-04 07:56:23 ----D---- C:\WINDOWS\AppPatch
2010-06-04 01:54:27 ----HD---- C:\Programme\InstallShield Installation Information
2010-06-04 01:52:56 ----D---- C:\Programme\Windows Media Player
2010-06-04 01:52:20 ----D---- C:\WINDOWS\system32\LogFiles
2010-06-04 01:42:33 ----D---- C:\WINDOWS\system32\ReinstallBackups
2010-06-04 01:34:12 ----D---- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Adobe
2010-06-04 01:18:56 ----RSD---- C:\WINDOWS\Fonts
2010-06-04 01:18:54 ----D---- C:\Programme\Adobe
2010-06-04 01:18:54 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Adobe
2010-06-04 01:03:47 ----D---- C:\WINDOWS\system32\CatRoot
2010-06-04 01:01:45 ----D---- C:\WINDOWS\WinSxS
2010-06-04 01:01:22 ----D---- C:\Programme\Gemeinsame Dateien

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2010-05-06 28880]
R1 aswSP;aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [2010-05-06 164048]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2010-05-06 46672]
R1 kbdhid;Tastatur-HID-Treiber; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2004-08-04 14848]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\drivers\aswFsBlk.sys [2010-05-06 19024]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2010-05-06 100432]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2005-02-02 2310720]
R3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2010-05-06 23376]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2006-05-03 1540608]
R3 hidusb;Microsoft HID Class-Treiber; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2004-08-04 9600]
R3 mouhid;Maus-HID-Treiber; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2004-08-04 12288]
R3 seehcri;Sony Ericsson seehcri Device Driver; C:\WINDOWS\system32\DRIVERS\seehcri.sys [2010-06-04 27632]
R3 usbccgp;Microsoft Standard-USB-Haupttreiber; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-04 31616]
R3 usbehci;Miniporttreiber für erweiterten Microsoft USB 2.0-Hostcontroller; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-04 26624]
R3 usbhub;USB2-aktivierter Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-03 57600]
R3 usbuhci;Miniporttreiber für universellen Microsoft USB-Hostcontroller; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-04 20480]
R3 yukonwxp;NDIS5.1 Miniport Driver for Marvell Yukon Gigabit Ethernet Adapter; C:\WINDOWS\system32\DRIVERS\yukonwxp.sys [2003-11-10 174464]
S3 a0ar7fkf;a0ar7fkf; C:\WINDOWS\system32\drivers\a0ar7fkf.sys []
S3 Arp1394;1394-ARP-Clientprotokoll; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2004-08-04 60800]
S3 FETNDIS;VIA PCI 10/100-MBit/s-Fast Ethernetadapter-NT-Treiber; C:\WINDOWS\system32\DRIVERS\fetnd5.sys [2001-08-17 27165]
S3 NIC1394;1394-Netzwerktreiber; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2004-08-04 61824]
S3 NTSIM;NTSIM; \??\C:\WINDOWS\system32\ntsim.sys []
S3 s0016bus;Sony Ericsson Device 0016 driver (WDM); C:\WINDOWS\system32\DRIVERS\s0016bus.sys [2008-05-16 89256]
S3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\s0016mdfl.sys [2008-05-16 15016]
S3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\s0016mdm.sys [2008-05-16 120744]
S3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\s0016mgmt.sys [2008-05-16 114216]
S3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS); C:\WINDOWS\system32\DRIVERS\s0016nd5.sys [2008-05-16 25512]
S3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\s0016obex.sys [2008-05-16 110632]
S3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM); C:\WINDOWS\system32\DRIVERS\s0016unic.sys [2008-05-16 115752]
S3 usbprint;Microsoft USB-Druckerklasse; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-04 25856]
S3 usbscan;USB-Scannertreiber; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104]
S3 USBSTOR;USB-Massenspeichertreiber; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 26496]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2006-05-03 413696]
R2 avast! Antivirus;avast! Antivirus; C:\Programme\Alwil Software\Avast5\AvastSvc.exe [2010-05-06 40384]
R2 JavaQuickStarterService;Java Quick Starter; C:\Programme\Java\jre6\bin\jqs.exe [2010-05-03 153376]
R2 OMSI download service;Sony Ericsson OMSI download service; C:\Programme\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe [2009-04-30 90112]
R2 SUperior;SUperior; C:\Programme\SUperior SU\susrvc.exe [2004-07-24 81920]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Programme\Alwil Software\Avast5\AvastSvc.exe [2010-05-06 40384]
R3 avast! Web Scanner;avast! Web Scanner; C:\Programme\Alwil Software\Avast5\AvastSvc.exe [2010-05-06 40384]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2006-05-03 520192]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
S3 IDriverT;InstallDriver Table Manager; C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728]
S3 ose;Office Source Engine; C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]

-----------------EOF-----------------
--- --- ---

cosinus 10.06.2010 10:55
Hallo und :hallo:

Zitat:
was kann ich da machen?
Das schon probiert => http://www.trojaner-board.de/82699-m...tet-nicht.html

LongM 11.06.2010 21:52
Hi, :dankeschoen: erstmal für die antwort!

Das programm startet nun, kann aber nicht wirklich viel ausrichten, da nach einem neustart wieder alle schädlinge da sind.

Hier das erste logfile:

Code:
Malwarebytes' Anti-Malware 1.45
www.malwarebytes.org

Datenbank Version: 3930

Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

11.06.2010 03:33:23
mbam-log-2010-06-11 (03-33-23).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Durchsuchte Objekte: 186747
Laufzeit: 23 Minute(n), 19 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 9
Infizierte Dateiobjekte der Registrierung: 3
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\opqonkdrv (??????) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\khijjjdrv (??????) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tuvutrdrv (??????) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cbyvvwdrv (??????) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tuvutrdrv (??????) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cbyvvwdrv (??????) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wvtqomsys (??????) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jkhihhsys (??????) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jkhihhsys (??????) -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (???????????r) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (???????????r) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (???????????r) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

Hier das zweite logfile, nach erneutem scan.

Code:
Malwarebytes' Anti-Malware 1.45
www.malwarebytes.org

Datenbank Version: 3930

Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

11.06.2010 06:04:17
mbam-log-2010-06-11 (06-04-17).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Durchsuchte Objekte: 157966
Laufzeit: 2 Stunde(n), 17 Minute(n), 8 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 7
Infizierte Dateiobjekte der Registrierung: 2
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\geecdcdrv (??????) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rqpmkjdrv (??????) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bywtusdrv (??????) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bywtusdrv (??????) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yaawvusys (??????) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ssqnljsys (??????) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ssqnljsys (??????) -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (???????????r) -> Bad: (1) Good: (0) -> Not selected for removal.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (???????????r) -> Bad: (1) Good: (0) -> Not selected for removal.

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

cosinus 13.06.2010 13:40
Zitat:
Malwarebytes' Anti-Malware 1.45
http://www.trojaner-board.de/51187-anleitung-malwarebytes-anti-malware.html

Datenbank Version: 3930
Warum benutzt Du diese alte Version??
Wir sind bei Version 1.46 und Datenbank Version 4190 oder noch höher!! Bitte Malwabytes updaten und den Scan wiederholen!!

LongM 14.06.2010 10:36
Zitat:
Zitat von cosinus (Beitrag 533087)
Warum benutzt Du diese alte Version??

Gute frage,
weiß ich gerade selber nicht.. ich denke das kommt dadurch das sich mbam nicht starten lies und ich es mit der vorigen version probiert hab...


hier das log

Code:
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4052

Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

14.06.2010 12:14:04
mbam-log-2010-06-14 (12-14-04).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Durchsuchte Objekte: 200856
Laufzeit: 22 Minute(n), 53 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 7
Infizierte Dateiobjekte der Registrierung: 2
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ssrstudrv (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ljiggddrv (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ssrrrpdrv (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ssrrrpdrv (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mlmljisys (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rqomllsys (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rqomllsys (Trojan.Vundo) -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Not selected for removal.

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

LongM 14.06.2010 12:03
ok, hab nochmals gescannt(nach update der datenbank der version1.46) und er hat erfreulicherweise direkt nochmal 3 dateien mehr gefunden :dummguck:

Allerdings gab es auch direkt mal probleme beim löschen... :koch:
Log:

Code:
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4196

Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

14.06.2010 12:55:52
mbam-log-2010-06-14 (12-55-52).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Durchsuchte Objekte: 207443
Laufzeit: 22 Minute(n), 23 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 1
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 7
Infizierte Dateiobjekte der Registrierung: 1
Infizierte Verzeichnisse: 0
Infizierte Dateien: 3

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
C:\WINDOWS\system32\rqrqpp.dll (Trojan.Hiloti.Gen) -> Delete on reboot.

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xxywutdrv (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vtutqnsys (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wvwxvudrv (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vtroomsys (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tussppdrv (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vtroomsys (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tussppdrv (Trojan.Vundo) -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Not selected for removal.

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\WINDOWS\system32\rqrqpp.dll (Trojan.Hiloti.Gen) -> Delete on reboot.
C:\System Volume Information\_restore{5E2526C3-5693-47AE-951B-1B840EA31A17}\RP1\A0000004.dll (Trojan.Hiloti.Gen) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{5E2526C3-5693-47AE-951B-1B840EA31A17}\RP2\A0000070.dll (Trojan.Hiloti.Gen) -> Quarantined and deleted successfully.

Hab jetzt nach fund der neuen datein nochmal gescannt, die 3 neuen datein sind verschwunden aber die alten sind immernoch da! Hat sich der trojaner jetzt nochmal "besser" versteckt weil er einmal gefunden wurde?
Achja hab zu dem thema "Trojan.Hiloti.Gen" einen beitrag hier im forum gefunden, wo zur Systemwiederherstellungs-deaktivierung geraten wird, das ist aus! Schon ein paar tage... wie also kommen die dateien immer wieder auf meinen rechner? ? ?

Code:
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4196

Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

14.06.2010 13:33:14
mbam-log-2010-06-14 (13-33-14).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Durchsuchte Objekte: 207432
Laufzeit: 23 Minute(n), 15 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 7
Infizierte Dateiobjekte der Registrierung: 1
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\geefgedrv (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nnkljgsys (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cbbaaadrv (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xxvwvtsys (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\urrqondrv (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xxvwvtsys (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\urrqondrv (Trojan.Vundo) -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Not selected for removal.

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)
€dit: Achja nochwas, nachdem ich mit dem scannen mit neuester datenbankversion fertig war und gerebootet hab, stand da Fehler beim laden von rqrqpp.dll
Das angegebene Modul wurde nicht gefunden.

cosinus 14.06.2010 13:20
Ok. Erstell bitte nun Logs mit OTL.exe und poste sie

LongM 14.06.2010 15:31
Hallo, hier das log des u.g. programms!

Code:
OTL logfile created on: 14.06.2010 16:03:02 - Run 1
OTL by OldTimer - Version 3.2.6.0    Folder = C:\Dokumente und Einstellungen\***\Eigene Dateien\Downloads
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 69,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 90,00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 14,65 Gb Total Space | 2,63 Gb Free Space | 17,92% Space Free | Partition Type: NTFS
Drive D: | 171,65 Gb Total Space | 62,19 Gb Free Space | 36,23% Space Free | Partition Type: NTFS
Drive E: | 4,03 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: ***
Current User Name: ***
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Processes (SafeList) ==========
 
PRC - C:\Dokumente und Einstellungen\***\Eigene Dateien\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Alwil Software\Avast5\AvastUI.exe (ALWIL Software)
PRC - C:\Programme\Alwil Software\Avast5\AvastSvc.exe (ALWIL Software)
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.)
PRC - C:\Programme\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe ()
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Dokumente und Einstellungen\***\Eigene Dateien\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (avast! Web Scanner) -- C:\Programme\Alwil Software\Avast5\AvastSvc.exe (ALWIL Software)
SRV - (avast! Mail Scanner) -- C:\Programme\Alwil Software\Avast5\AvastSvc.exe (ALWIL Software)
SRV - (avast! Antivirus) -- C:\Programme\Alwil Software\Avast5\AvastSvc.exe (ALWIL Software)
SRV - (OMSI download service) -- C:\Programme\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe ()
SRV - (IDriverT) -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe (Macrovision Corporation)
SRV - (ose) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (seehcri) -- C:\WINDOWS\system32\drivers\seehcri.sys (Sony Ericsson Mobile Communications)
DRV - (aswTdi) -- C:\WINDOWS\system32\drivers\aswTdi.sys (ALWIL Software)
DRV - (aswSP) -- C:\WINDOWS\system32\drivers\aswSP.sys (ALWIL Software)
DRV - (aswRdr) -- C:\WINDOWS\system32\drivers\aswRdr.sys (ALWIL Software)
DRV - (aswMon2) -- C:\WINDOWS\system32\drivers\aswmon2.sys (ALWIL Software)
DRV - (aswFsBlk) -- C:\WINDOWS\system32\drivers\aswFsBlk.sys (ALWIL Software)
DRV - (Aavmker4) -- C:\WINDOWS\system32\drivers\aavmker4.sys (ALWIL Software)
DRV - (videX32) -- C:\WINDOWS\system32\DRIVERS\videX32.sys (VIA Technologies, Inc.)
DRV - (sptd) -- C:\WINDOWS\System32\Drivers\sptd.sys ()
DRV - (s0016unic) Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM) -- C:\WINDOWS\system32\drivers\s0016unic.sys (MCCI Corporation)
DRV - (s0016nd5) Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS) -- C:\WINDOWS\system32\drivers\s0016nd5.sys (MCCI Corporation)
DRV - (s0016mdfl) -- C:\WINDOWS\system32\drivers\s0016mdfl.sys (MCCI Corporation)
DRV - (s0016mdm) -- C:\WINDOWS\system32\drivers\s0016mdm.sys (MCCI Corporation)
DRV - (s0016mgmt) Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM) -- C:\WINDOWS\system32\drivers\s0016mgmt.sys (MCCI Corporation)
DRV - (s0016obex) -- C:\WINDOWS\system32\drivers\s0016obex.sys (MCCI Corporation)
DRV - (s0016bus) Sony Ericsson Device 0016 driver (WDM) -- C:\WINDOWS\system32\drivers\s0016bus.sys (MCCI Corporation)
DRV - (ati2mtag) -- C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS (Realtek Semiconductor Corp.)
DRV - (yukonwxp) -- C:\WINDOWS\system32\drivers\yukonwxp.sys (Marvell Semiconductor Inc.)
DRV - (viaagp1) -- C:\WINDOWS\system32\DRIVERS\viaagp1.sys (VIA Technologies, Inc.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-1220945662-1770027372-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
 
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Programme\Mozilla Firefox\components [2010.04.09 21:59:50 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2010.06.09 22:45:59 | 000,000,000 | ---D | M]
 
[2009.01.04 02:48:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Extensions
[2010.05.03 02:39:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\g8266f5i.default\extensions
[2010.06.13 15:48:41 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions
[2010.05.03 02:16:01 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010.05.03 02:15:46 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll
[2010.03.14 10:54:37 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.03.14 10:54:37 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.03.14 10:54:37 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.03.14 10:54:37 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.03.14 10:54:37 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2004.08.04 14:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avast5] C:\Programme\Alwil Software\Avast5\AvastUI.exe (ALWIL Software)
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Programme\Malwarebytes' Anti-Malware\mbam.exe File not found
O4 - HKLM..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe (Microsoft Corporation)
O4 - HKLM..\Run: [ssqpnldrv] C:\WINDOWS\System32\qomnkh.dll ()
O4 - HKU\S-1-5-21-1220945662-1770027372-839522115-1003..\Run: [ICQ] C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.)
O4 - HKU\S-1-5-21-1220945662-1770027372-839522115-1003..\Run: [rqppnndrv] C:\WINDOWS\System32\qomnkh.dll ()
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1220945662-1770027372-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - C:\Programme\Microsoft Office\Office10\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\cdo {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)
O18 - Protocol\Handler\haufereader - No CLSID value found
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O30 - LSA: Authentication Packages - (rqrqpp.dll) -  File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.01.04 02:41:44 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2007.04.05 04:04:07 | 000,000,000 | R--D | M] - E:\AutoRun -- [ UDF ]
O32 - AutoRun File - [2007.04.05 04:04:05 | 000,700,416 | R--- | M] (Electronic Arts Inc.) - E:\AutoRun.exe -- [ UDF ]
O32 - AutoRun File - [2007.04.05 00:40:43 | 000,667,648 | R--- | M] (Electronic Arts Inc.) - E:\AutoRunGUI.dll -- [ UDF ]
O32 - AutoRun File - [2007.04.05 04:14:01 | 000,000,151 | R--- | M] () - E:\autorun.inf -- [ UDF ]
O33 - MountPoints2\{95e5b868-d7d3-11de-acda-00112fdc01cf}\Shell\AutoRun\command - "" = G:\Menu.exe -- File not found
O33 - MountPoints2\{d906b392-d9fd-11dd-a1a2-806d6172696f}\Shell - "" = AutoRun
O33 - MountPoints2\{d906b392-d9fd-11dd-a1a2-806d6172696f}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{d906b392-d9fd-11dd-a1a2-806d6172696f}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- [2007.04.05 04:04:05 | 000,700,416 | R--- | M] (Electronic Arts Inc.)
O33 - MountPoints2\E\Shell - "" = AutoRun
O33 - MountPoints2\E\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\AutoRun.exe -- [2007.04.05 04:04:05 | 000,700,416 | R--- | M] (Electronic Arts Inc.)
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.06.14 12:18:47 | 000,000,000 | -H-D | C] -- C:\WINDOWS\PIF
[2010.06.14 12:08:19 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\***\Recent
[2010.06.14 11:47:39 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010.06.14 11:47:38 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010.06.14 11:47:38 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2010.06.09 23:52:02 | 000,000,000 | ---D | C] -- C:\Programme\trend micro
[2010.06.09 23:52:02 | 000,000,000 | ---D | C] -- C:\rsit
[2010.06.09 23:25:06 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Malwarebytes
[2010.06.09 23:19:49 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2010.06.09 23:02:35 | 000,000,000 | ---D | C] -- C:\Programme\CCleaner
[2010.06.04 17:03:57 | 000,000,000 | ---D | C] -- C:\Programme\Panda Security
[2010.06.04 08:20:15 | 000,000,000 | ---D | C] -- C:\Programme\ESET
[2010.06.04 02:00:08 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\***\Desktop\Fiiiesch
[2010.06.04 01:57:06 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\BVRP Software
[2010.06.04 01:57:05 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\Sony Ericsson
[2010.06.04 01:54:49 | 000,115,752 | ---- | C] (MCCI Corporation) -- C:\WINDOWS\System32\drivers\s0016unic.sys
[2010.06.04 01:54:49 | 000,010,792 | ---- | C] (MCCI Corporation) -- C:\WINDOWS\System32\drivers\s0016cr.sys
[2010.06.04 01:54:48 | 000,114,216 | ---- | C] (MCCI Corporation) -- C:\WINDOWS\System32\drivers\s0016mgmt.sys
[2010.06.04 01:54:47 | 000,110,632 | ---- | C] (MCCI Corporation) -- C:\WINDOWS\System32\drivers\s0016obex.sys
[2010.06.04 01:54:47 | 000,025,512 | ---- | C] (MCCI Corporation) -- C:\WINDOWS\System32\drivers\s0016nd5.sys
[2010.06.04 01:54:46 | 000,120,744 | ---- | C] (MCCI Corporation) -- C:\WINDOWS\System32\drivers\s0016mdm.sys
[2010.06.04 01:54:46 | 000,015,016 | ---- | C] (MCCI Corporation) -- C:\WINDOWS\System32\drivers\s0016mdfl.sys
[2010.06.04 01:54:46 | 000,012,200 | ---- | C] (MCCI Corporation) -- C:\WINDOWS\System32\drivers\s0016cmnt.sys
[2010.06.04 01:54:46 | 000,012,200 | ---- | C] (MCCI Corporation) -- C:\WINDOWS\System32\drivers\s0016cm.sys
[2010.06.04 01:54:45 | 000,089,256 | ---- | C] (MCCI Corporation) -- C:\WINDOWS\System32\drivers\s0016bus.sys
[2010.06.04 01:54:45 | 000,012,200 | ---- | C] (MCCI Corporation) -- C:\WINDOWS\System32\drivers\s0016whnt.sys
[2010.06.04 01:54:45 | 000,012,200 | ---- | C] (MCCI Corporation) -- C:\WINDOWS\System32\drivers\s0016wh.sys
[2010.06.04 01:54:39 | 000,148,736 | ---- | C] (Avanquest Software) -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\hpe2C3.dll
[2010.06.04 01:53:20 | 000,014,048 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\spmsg.dll
[2010.06.04 01:52:20 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\UMDF
[2010.06.04 01:52:13 | 000,023,856 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\spupdsvc.exe
[2010.06.04 01:41:38 | 000,027,632 | ---- | C] (Sony Ericsson Mobile Communications) -- C:\WINDOWS\System32\drivers\seehcri.sys
[2010.06.04 01:34:12 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\AdobeUM
[2010.06.04 01:32:40 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Documents
[2010.06.04 01:32:32 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2010.06.04 01:22:11 | 000,000,000 | -H-D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonIJScan
[2010.06.04 01:22:11 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Canon
[2010.06.04 01:03:42 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Teleca
[2010.06.04 01:01:46 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\DRVSTORE
[2010.06.04 01:01:27 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sony Ericsson
[2010.06.04 01:01:22 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\Teleca Shared
[2010.06.04 01:01:21 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Teleca
[2010.06.04 01:01:21 | 000,000,000 | ---D | C] -- C:\Programme\Sony Ericsson
[2010.06.04 00:59:29 | 000,000,000 | ---D | C] -- C:\WINDOWS\Downloaded Installations
[2010.05.15 17:36:07 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Dokumente\EA Games
[2010.05.15 17:35:55 | 000,108,144 | ---- | C] (Sony DADC Austria AG.) -- C:\WINDOWS\System32\CmdLineExt.dll
[2010.05.15 17:35:55 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\SecuROM
[2010.05.15 17:34:05 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\***\Eigene Dateien\EA Games
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2010.06.14 15:29:03 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010.06.14 15:29:00 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010.06.14 15:27:35 | 003,670,016 | ---- | M] () -- C:\Dokumente und Einstellungen\***\ntuser.dat
[2010.06.14 15:27:35 | 000,000,190 | -HS- | M] () -- C:\Dokumente und Einstellungen\***\ntuser.ini
[2010.06.14 14:23:43 | 000,000,522 | ---- | M] () -- C:\WINDOWS\win.ini
[2010.06.14 14:23:43 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2010.06.14 14:23:43 | 000,000,211 | -HS- | M] () -- C:\boot.ini
[2010.06.14 12:18:47 | 000,002,855 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.pif
[2010.06.14 12:15:56 | 004,788,542 | -H-- | M] () -- C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\IconCache.db
[2010.06.14 11:00:36 | 000,000,019 | ---- | M] () -- C:\WINDOWS\SoundConverter.INI
[2010.06.12 15:29:44 | 005,487,029 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\spielplan_neu.pdf
[2010.06.10 09:20:45 | 000,086,341 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\100415_turnier-2010.pdf
[2010.06.09 23:02:36 | 000,001,512 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Desktop\CCleaner.lnk
[2010.06.09 22:45:59 | 000,001,709 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Adobe Reader 9.lnk
[2010.06.04 22:42:49 | 000,095,232 | -H-- | M] () -- C:\WINDOWS\System32\qomnkh.dll
[2010.06.04 20:24:07 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\nnkhif.dll
[2010.06.04 18:24:05 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\yabbaw.dll
[2010.06.04 17:24:08 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\ddbxvu.dll
[2010.06.04 16:24:04 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\ssrpqn.dll
[2010.06.04 12:14:47 | 000,025,896 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\GDIPFONTCACHEV1.DAT
[2010.06.04 07:56:29 | 000,149,992 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010.06.04 01:54:39 | 000,148,736 | ---- | M] (Avanquest Software) -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\hpe2C3.dll
[2010.06.04 01:53:05 | 000,316,640 | ---- | M] () -- C:\WINDOWS\WMSysPr9.prx
[2010.06.04 01:52:23 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\UMDF\MsftWdf_user_01_00_00.Wdf
[2010.06.04 01:41:38 | 000,027,632 | ---- | M] (Sony Ericsson Mobile Communications) -- C:\WINDOWS\System32\drivers\seehcri.sys
[2010.06.04 01:25:20 | 000,023,552 | ---- | M] () -- C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.05.24 20:46:11 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010.05.16 07:09:48 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\awtqpo.dll
[2010.05.15 17:35:55 | 000,108,144 | ---- | M] (Sony DADC Austria AG.) -- C:\WINDOWS\System32\CmdLineExt.dll
[2010.05.15 17:35:32 | 000,000,714 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Die Sims™ 2 Deluxe.lnk
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2010.06.14 11:47:42 | 000,002,855 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.pif
[2010.06.14 11:00:36 | 000,000,019 | ---- | C] () -- C:\WINDOWS\SoundConverter.INI
[2010.06.12 15:29:44 | 005,487,029 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\spielplan_neu.pdf
[2010.06.10 09:20:45 | 000,086,341 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\100415_turnier-2010.pdf
[2010.06.09 23:02:36 | 000,001,512 | ---- | C] () -- C:\Dokumente und Einstellungen\***\Desktop\CCleaner.lnk
[2010.06.09 22:45:59 | 000,001,709 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Adobe Reader 9.lnk
[2010.06.04 22:42:48 | 000,095,232 | -H-- | C] () -- C:\WINDOWS\System32\qomnkh.dll
[2010.06.04 20:24:07 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\nnkhif.dll
[2010.06.04 18:24:05 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\yabbaw.dll
[2010.06.04 17:24:08 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\ddbxvu.dll
[2010.06.04 16:24:04 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\ssrpqn.dll
[2010.06.04 01:52:23 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\UMDF\MsftWdf_user_01_00_00.Wdf
[2010.05.16 07:09:48 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\awtqpo.dll
[2010.05.15 17:35:32 | 000,000,714 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Die Sims™ 2 Deluxe.lnk
[2010.04.18 22:40:44 | 000,000,010 | ---- | C] () -- C:\WINDOWS\WININIT.INI
[2010.02.20 02:11:59 | 000,178,176 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2010.02.20 02:11:58 | 000,000,038 | ---- | C] () -- C:\WINDOWS\avisplitter.ini
[2010.02.20 02:11:56 | 000,881,664 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2010.02.20 02:11:55 | 000,205,824 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2010.02.20 02:11:55 | 000,085,504 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2010.02.20 02:11:55 | 000,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest
[2009.11.23 04:13:06 | 000,000,032 | ---- | C] () -- C:\WINDOWS\Menu.INI
[2009.09.14 14:38:10 | 000,237,568 | ---- | C] () -- C:\WINDOWS\System32\lame_enc.dll
[2009.04.06 00:43:28 | 000,717,296 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys
[2009.03.30 16:20:04 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2009.01.04 03:19:18 | 000,156,672 | ---- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll
[2004.08.04 14:00:00 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\ieencode.dll
 
========== LOP Check ==========
 
[2010.02.26 09:46:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Alwil Software
[2010.01.22 17:57:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\BTrieve
[2010.06.04 01:57:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\BVRP Software
[2009.12.01 21:43:26 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonBJ
[2009.12.01 22:03:30 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonIJEGV
[2010.06.04 01:22:11 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonIJScan
[2009.04.06 00:45:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DAEMON Tools Lite
[2010.04.11 16:54:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Electronic Arts
[2010.01.22 17:25:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\elsterformular
[2010.01.22 17:45:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Haufe
[2010.01.22 17:50:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Lexware
[2010.06.04 01:01:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Teleca
[2010.06.04 01:22:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Canon
[2009.09.14 14:38:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\concept design
[2009.01.10 21:55:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\COWON
[2009.04.06 00:46:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\DAEMON Tools
[2009.04.06 00:50:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\DAEMON Tools Lite
[2009.04.06 00:46:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\DAEMON Tools Pro
[2009.04.01 06:41:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Datalayer
[2010.06.14 15:29:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\ICQ
[2010.01.22 17:50:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Lexware
[2009.06.19 20:24:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Miranda
[2010.02.12 21:33:35 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\Nokia
[2009.03.26 02:24:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\OpenOffice.org
[2009.04.01 06:32:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\PC Suite
[2009.10.05 21:38:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\SecondLife
[2010.06.04 01:04:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***Anwendungsdaten\Teleca
[2010.04.14 02:41:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***Anwendungsdaten\uTorrent
[2010.02.22 10:34:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\***\Anwendungsdaten\COWON
 
========== Purity Check ==========
 
 
< End of report >

cosinus 14.06.2010 21:33
Beende alle Programme, starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:
:OTL
O4 - HKLM..\Run: [ssqpnldrv] C:\WINDOWS\System32\qomnkh.dll ()
O4 - HKU\S-1-5-21-1220945662-1770027372-839522115-1003..\Run: [rqppnndrv] C:\WINDOWS\System32\qomnkh.dll ()
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1220945662-1770027372-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O30 - LSA: Authentication Packages - (rqrqpp.dll) -  File not found
[2010.06.04 22:42:49 | 000,095,232 | -H-- | M] () -- C:\WINDOWS\System32\qomnkh.dll
[2010.06.04 20:24:07 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\nnkhif.dll
[2010.06.04 18:24:05 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\yabbaw.dll
[2010.06.04 17:24:08 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\ddbxvu.dll
[2010.06.04 16:24:04 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\ssrpqn.dll
[2010.05.16 07:09:48 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\awtqpo.dll
:Commands
[purity]
[resethosts]
[emptytemp]
Klick dann auf den Button Run Fixes!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

LongM 14.06.2010 22:33
Hi

Code:
All processes killed
========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ssqpnldrv not found.
C:\WINDOWS\system32\qomnkh.dll moved successfully.
Registry value HKEY_USERS\S-1-5-21-1220945662-1770027372-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Run\\rqppnndrv not found.
File move failed. C:\WINDOWS\system32\qomnkh.dll scheduled to be moved on reboot.
Registry value HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun not found.
Registry value HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1220945662-1770027372-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\\Authentication Packages:rqrqpp.dll deleted successfully.
File move failed. C:\WINDOWS\system32\qomnkh.dll scheduled to be moved on reboot.
C:\WINDOWS\system32\nnkhif.dll moved successfully.
C:\WINDOWS\system32\yabbaw.dll moved successfully.
C:\WINDOWS\system32\ddbxvu.dll moved successfully.
C:\WINDOWS\system32\ssrpqn.dll moved successfully.
C:\WINDOWS\system32\awtqpo.dll moved successfully.
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
[EMPTYTEMP]
 
User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 159272 bytes
 
User: All Users
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: LocalService
->Temp folder emptied: 65984 bytes
->Temporary Internet Files folder emptied: 58521 bytes
 
User: ***       
->Temp folder emptied: 81579799 bytes
->Temporary Internet Files folder emptied: 2141733 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 87826746 bytes
->Flash cache emptied: 6489 bytes
 
User: ***
->Temp folder emptied: 729391 bytes
->Temporary Internet Files folder emptied: 185224 bytes
->FireFox cache emptied: 30988072 bytes
->Flash cache emptied: 1540 bytes
 
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2114764 bytes
%systemroot%\System32 .tmp files removed: 2676103 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 16528992 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 215,00 mb
 
 
OTL by OldTimer - Version 3.2.6.0 log created on 06142010_232406

Files\Folders moved on Reboot...
C:\WINDOWS\system32\qomnkh.dll moved successfully.
File move failed. C:\WINDOWS\temp\_avast5_\Webshlock.txt scheduled to be moved on reboot.

Registry entries deleted on Reboot...

€: Ach ehm, ne meldung kam noch:

"Fehler beim laden von qomnkh.dll
Das angegebene Modul wurde nicht gefunden." <---- das ganze 2x

cosinus 15.06.2010 08:30
Dann jetzt bitte CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Lade dir ComboFix hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.
http://saved.im/mtm0nzyzmzd5/cofi.jpg
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

LongM 15.06.2010 13:53
Hi, hier das log

Code:
ComboFix 10-06-14.03 - *** 15.06.2010  14:37:28.1.1 - x86
Microsoft Windows XP Professional  5.1.2600.2.1252.49.1031.18.2047.1689 [GMT 2:00]
ausgeführt von:: c:\dokumente und einstellungen\***\Desktop\CoFi.exe
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\dokumente und einstellungen\All Users\Anwendungsdaten\hpe2C3.dll

.
(((((((((((((((((((((((  Dateien erstellt von 2010-05-15 bis 2010-06-15  ))))))))))))))))))))))))))))))
.

2010-06-14 21:24 . 2010-06-14 21:24        --------        d-----w-        C:\_OTL
2010-06-14 10:18 . 2010-06-14 10:18        --------        d--h--w-        c:\windows\PIF
2010-06-14 09:47 . 2010-04-29 13:39        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys
2010-06-14 09:47 . 2010-06-14 11:07        --------        d-----w-        c:\programme\Malwarebytes' Anti-Malware
2010-06-14 09:47 . 2010-04-29 13:39        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys
2010-06-09 21:52 . 2010-06-09 21:52        --------        d-----w-        C:\rsit
2010-06-09 21:52 . 2010-06-09 21:52        --------        d-----w-        c:\programme\trend micro
2010-06-09 21:25 . 2010-06-09 21:25        --------        d-----w-        c:\dokumente und einstellungen\***\Anwendungsdaten\Malwarebytes
2010-06-09 21:19 . 2010-06-09 21:19        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes
2010-06-09 21:02 . 2010-06-09 21:02        --------        d-----w-        c:\programme\CCleaner
2010-06-04 15:03 . 2010-06-14 08:59        --------        d-----w-        c:\programme\Panda Security
2010-06-04 06:20 . 2010-06-04 06:20        --------        d-----w-        c:\programme\ESET
2010-06-03 23:57 . 2010-06-03 23:57        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\BVRP Software
2010-06-03 23:57 . 2010-06-03 23:57        --------        d-----w-        c:\dokumente und einstellungen\***\Lokale Einstellungen\Anwendungsdaten\Sony Ericsson
2010-06-03 23:54 . 2008-05-16 09:33        115752        ----a-w-        c:\windows\system32\drivers\s0016unic.sys
2010-06-03 23:54 . 2008-05-16 09:33        10792        ----a-w-        c:\windows\system32\drivers\s0016cr.sys
2010-06-03 23:54 . 2008-05-16 09:33        114216        ----a-w-        c:\windows\system32\drivers\s0016mgmt.sys
2010-06-03 23:54 . 2008-05-16 09:33        25512        ----a-w-        c:\windows\system32\drivers\s0016nd5.sys
2010-06-03 23:54 . 2008-05-16 09:33        110632        ----a-w-        c:\windows\system32\drivers\s0016obex.sys
2010-06-03 23:54 . 2008-05-16 09:33        15016        ----a-w-        c:\windows\system32\drivers\s0016mdfl.sys
2010-06-03 23:54 . 2008-05-16 09:33        12200        ----a-w-        c:\windows\system32\drivers\s0016cmnt.sys
2010-06-03 23:54 . 2008-05-16 09:33        12200        ----a-w-        c:\windows\system32\drivers\s0016cm.sys
2010-06-03 23:54 . 2008-05-16 09:33        120744        ----a-w-        c:\windows\system32\drivers\s0016mdm.sys
2010-06-03 23:54 . 2008-05-16 09:33        89256        ----a-w-        c:\windows\system32\drivers\s0016bus.sys
2010-06-03 23:54 . 2008-05-16 09:33        12200        ----a-w-        c:\windows\system32\drivers\s0016whnt.sys
2010-06-03 23:54 . 2008-05-16 09:33        12200        ----a-w-        c:\windows\system32\drivers\s0016wh.sys
2010-06-03 23:52 . 2010-06-03 23:52        --------        d-----w-        c:\windows\system32\drivers\UMDF
2010-06-03 23:52 . 2006-09-15 23:05        23856        ----a-w-        c:\windows\system32\spupdsvc.exe
2010-06-03 23:41 . 2010-06-03 23:41        27632        ----a-w-        c:\windows\system32\drivers\seehcri.sys
2010-06-03 23:34 . 2010-06-03 23:34        --------        d-----w-        c:\dokumente und einstellungen\***\Anwendungsdaten\AdobeUM
2010-06-03 23:32 . 2010-06-03 23:32        --------        d-----w-        c:\dokumente und einstellungen\All Users\Documents
2010-06-03 23:22 . 2010-06-03 23:22        --------        d--h--w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\CanonIJScan
2010-06-03 23:22 . 2010-06-03 23:22        --------        d-----w-        c:\dokumente und einstellungen\***\Anwendungsdaten\Canon
2010-06-03 23:03 . 2010-06-03 23:04        --------        d-----w-        c:\dokumente und einstellungen\***\Anwendungsdaten\Teleca
2010-06-03 23:01 . 2010-06-03 23:55        --------        dc----w-        c:\windows\system32\DRVSTORE
2010-06-03 23:01 . 2010-06-03 23:54        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Sony Ericsson
2010-06-03 23:01 . 2010-06-03 23:32        --------        d-----w-        c:\programme\Gemeinsame Dateien\Teleca Shared
2010-06-03 23:01 . 2010-06-14 08:58        --------        d-----w-        c:\programme\Sony Ericsson
2010-06-03 23:01 . 2010-06-03 23:01        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Teleca
2010-06-03 22:59 . 2010-06-03 23:01        --------        d-----w-        c:\windows\Downloaded Installations
2010-05-24 18:52 . 2010-05-24 18:52        503808        ----a-w-        c:\dokumente und einstellungen\***\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-6e155fc7-n\msvcp71.dll
2010-05-24 18:52 . 2010-05-24 18:52        499712        ----a-w-        c:\dokumente und einstellungen\***\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-6e155fc7-n\jmc.dll
2010-05-24 18:52 . 2010-05-24 18:52        348160        ----a-w-        c:\dokumente und einstellungen\***\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-6e155fc7-n\msvcr71.dll
2010-05-24 18:52 . 2010-05-24 18:52        61440        ----a-w-        c:\dokumente und einstellungen\***\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-78270d85-n\decora-sse.dll
2010-05-24 18:52 . 2010-05-24 18:52        12800        ----a-w-        c:\dokumente und einstellungen\***\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-78270d85-n\decora-d3d.dll

.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-15 12:14 . 2009-10-10 04:17        --------        d-----w-        c:\dokumente und einstellungen\***\Anwendungsdaten\ICQ
2010-06-14 09:01 . 2010-01-22 15:34        --------        d-----w-        c:\programme\Gemeinsame Dateien\Lexware
2010-06-14 09:01 . 2009-01-04 01:19        --------        d--h--w-        c:\programme\InstallShield Installation Information
2010-06-14 08:59 . 2010-01-11 08:21        --------        d-----w-        c:\programme\SUperior SU
2010-06-07 00:26 . 2009-01-04 03:20        --------        d-----w-        c:\dokumente und einstellungen\***\Anwendungsdaten\Skype
2010-06-06 23:21 . 2009-01-04 03:22        --------        d-----w-        c:\dokumente und einstellungen\***\Anwendungsdaten\skypePM
2010-06-04 10:14 . 2009-01-04 01:37        25896        ----a-w-        c:\dokumente und einstellungen\***\Lokale Einstellungen\Anwendungsdaten\GDIPFONTCACHEV1.DAT
2010-06-04 06:36 . 2009-02-16 22:20        --------        d-----w-        c:\programme\Everest Poker.net
2010-06-04 06:35 . 2010-02-07 13:26        --------        d-----w-        c:\programme\Everest Poker
2010-05-15 15:35 . 2010-05-15 15:35        108144        ----a-w-        c:\windows\system32\CmdLineExt.dll
2010-05-15 15:35 . 2010-05-15 15:35        --------        d--h--r-        c:\dokumente und einstellungen\***\Anwendungsdaten\SecuROM
2010-05-15 11:26 . 2010-05-15 11:26        --------        d-----w-        c:\programme\VIA
2010-05-13 03:45 . 2009-12-15 22:52        16        ----a-w-        c:\dokumente und einstellungen\***\WarcraftIIIAutoRefresh_Config.dat
2010-05-06 20:59 . 2010-02-26 07:46        165032        ----a-w-        c:\windows\system32\aswBoot.exe
2010-05-06 20:39 . 2010-02-26 07:46        46672        ----a-w-        c:\windows\system32\drivers\aswTdi.sys
2010-05-06 20:39 . 2010-02-26 07:46        164048        ----a-w-        c:\windows\system32\drivers\aswSP.sys
2010-05-06 20:34 . 2010-02-26 07:46        23376        ----a-w-        c:\windows\system32\drivers\aswRdr.sys
2010-05-06 20:33 . 2010-02-26 07:46        100432        ----a-w-        c:\windows\system32\drivers\aswmon2.sys
2010-05-06 20:33 . 2010-02-26 07:46        94800        ----a-w-        c:\windows\system32\drivers\aswmon.sys
2010-05-06 20:33 . 2010-02-26 07:46        19024        ----a-w-        c:\windows\system32\drivers\aswFsBlk.sys
2010-05-06 20:33 . 2010-02-26 07:46        28880        ----a-w-        c:\windows\system32\drivers\aavmker4.sys
2010-05-03 00:16 . 2010-05-03 00:16        --------        d-----w-        c:\programme\Gemeinsame Dateien\Java
2010-05-03 00:15 . 2010-05-02 23:48        411368        ----a-w-        c:\windows\system32\deployJava1.dll
2010-05-02 23:46 . 2009-04-16 15:40        --------        d-----w-        c:\programme\DivX
2010-04-28 21:59 . 2010-04-28 21:59        57344        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\RunAsUser\RUNASUSERPROCESS.dll
2010-04-28 21:58 . 2010-04-28 21:58        56766        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\DivXPlusShortcuts\Uninstaller.exe
2010-04-28 21:58 . 2010-04-28 21:55        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX
2010-04-28 21:58 . 2010-04-28 21:58        56978        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\DivX\WebPlayer\Uninstaller.exe
2010-04-17 23:27 . 2009-04-05 22:26        1324        ----a-w-        c:\windows\system32\d3d9caps.dat
2010-04-14 16:47 . 2010-02-26 07:46        38848        ----a-w-        c:\windows\system32\avastSS.scr
2010-03-28 11:55 . 2004-08-04 12:00        72490        ----a-w-        c:\windows\system32\perfc007.dat
2010-03-28 11:55 . 2004-08-04 12:00        411266        ----a-w-        c:\windows\system32\perfh007.dat
2010-03-23 19:53 . 2010-01-11 01:05        1352        ----a-w-        c:\windows\DIIUnin.dat
.

((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-05-06 2815192]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]

[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Microsoft Office.lnk]
path=c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-03-24 18:17        952768        ----a-w-        c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
2005-06-23 18:33        57344        ----a-w-        c:\programme\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-04-04 05:42        36272        ----a-w-        c:\programme\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2008-12-29 10:40        687560        ----a-w-        c:\programme\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2010-04-12 22:46        1135912        ----a-w-        c:\programme\DivX\DivX Update\DivXUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ]
2009-11-16 15:36        172792        ----a-w-        c:\programme\ICQ6.5\ICQ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-03-17 19:53        421888        ----a-w-        c:\programme\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2009-10-09 12:11        25623336        ----a-r-        c:\programme\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
2005-10-26 15:17        159744        ----a-r-        c:\programme\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
2005-02-02 09:47        77824        ----a-w-        c:\windows\SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-02-18 09:43        248040        ----a-w-        c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"wuauserv"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programme\\Miranda IM\\miranda32.exe"=
"c:\\Programme\\uTorrent\\uTorrent.exe"=
"d:\\Spiele\\Warcraft III\\Warcraft III.exe"=
"c:\\Programme\\ICQ6.5\\ICQ.exe"=
"c:\\Programme\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Programme\\Skype\\Phone\\Skype.exe"=
"c:\\Programme\\Mozilla Firefox\\firefox.exe"=

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [26.02.2010 09:46 164048]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [26.02.2010 09:46 19024]
R3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\drivers\seehcri.sys [04.06.2010 01:41 27632]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [06.04.2009 00:43 717296]
S2 OMSI download service;Sony Ericsson OMSI download service;c:\programme\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe [04.06.2010 01:54 90112]
S3 s0016bus;Sony Ericsson Device 0016 driver (WDM);c:\windows\system32\drivers\s0016bus.sys [04.06.2010 01:54 89256]
S3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter;c:\windows\system32\drivers\s0016mdfl.sys [04.06.2010 01:54 15016]
S3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver;c:\windows\system32\drivers\s0016mdm.sys [04.06.2010 01:54 120744]
S3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s0016mgmt.sys [04.06.2010 01:54 114216]
S3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS);c:\windows\system32\drivers\s0016nd5.sys [04.06.2010 01:54 25512]
S3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface;c:\windows\system32\drivers\s0016obex.sys [04.06.2010 01:54 110632]
S3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM);c:\windows\system32\drivers\s0016unic.sys [04.06.2010 01:54 115752]
.
.
------- Zusätzlicher Suchlauf -------
.
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
FF - ProfilePath - c:\dokumente und einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\g8266f5i.default\
FF - plugin: c:\programme\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\programme\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\programme\Veetle\Player\npvlc.dll
FF - plugin: c:\programme\Veetle\plugins\npVeetle.dll
FF - plugin: c:\programme\Veetle\VLCBroadcast\npvbp.dll

---- FIREFOX Richtlinien ----
c:\programme\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation",  false);
c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -

MSConfigStartUp-cbxwvtdrv - pmnnlk.dll
MSConfigStartUp-EA Core - c:\programme\Electronic Arts\EADM\Core.exe
MSConfigStartUp-fcbcyvdrv - pmnnlk.dll
MSConfigStartUp-jkhhgedrv - pmnnlk.dll
MSConfigStartUp-LexwareInfoService - c:\programme\Gemeinsame Dateien\Lexware\Update Manager\LxUpdateManager.exe
MSConfigStartUp-ljgeedsys - rqrqpp.dll
MSConfigStartUp-opmkkjsys - rqrqpp.dll
MSConfigStartUp-qonlmnsys - rqrqpp.dll
MSConfigStartUp-SUperior Switcher - c:\programme\SUperior SU\swtchsvc.exe
MSConfigStartUp-UpdateMyDrivers - c:\programme\SmartTweak Software\UpdateMyDrivers\UpdateMyDrivers.exe
MSConfigStartUp-urpoomdrv - pmnnlk.dll
MSConfigStartUp-xxyvtudrv - pmnnlk.dll



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2010-06-15 14:41
Windows 5.1.2600 Service Pack 2 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

- - - - - - - > 'winlogon.exe'(688)
c:\windows\system32\Ati2evxx.dll
.
Zeit der Fertigstellung: 2010-06-15  14:41:58
ComboFix-quarantined-files.txt  2010-06-15 12:41

Vor Suchlauf: 4.071.886.848 Bytes frei
Nach Suchlauf: 4.170.526.720 Bytes frei

WindowsXP-KB310994-SP2-Pro-BootDisk-DEU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - D9E0010AF6D1476A941B3C140C59B4CF

cosinus 16.06.2010 09:36
Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten. GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus

LongM 16.06.2010 15:25
GMER Logfile:
GMER Logfile:
Code:
GMER 1.0.15.15281 - hxxp://www.gmer.net
Rootkit scan 2010-06-16 16:21:13
Windows 5.1.2600 Service Pack 2
Running: 1ediymnz.exe; Driver: C:\DOKUME~1\***\LOKALE~1\Temp\pgldqpoc.sys


---- System - GMER 1.0.15 ----

SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)                                ZwClose [0xB1B6BC7A]
SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)                                ZwCreateKey [0xB1B6BB36]
SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)                                ZwDeleteKey [0xB1B6C0EA]
SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)                                ZwDeleteValueKey [0xB1B6C014]
SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)                                ZwDuplicateObject [0xB1B6B70C]
SSDT            spqz.sys                                                                                                            ZwEnumerateKey [0xBA6C6CA2]
SSDT            spqz.sys                                                                                                            ZwEnumerateValueKey [0xBA6C7030]
SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)                                ZwOpenKey [0xB1B6BC10]
SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)                                ZwOpenProcess [0xB1B6B64C]
SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)                                ZwOpenThread [0xB1B6B6B0]
SSDT            spqz.sys                                                                                                            ZwQueryKey [0xBA6C7108]
SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)                                ZwQueryValueKey [0xB1B6BD30]
SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)                                ZwRenameKey [0xB1B6C1B8]
SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)                                ZwRestoreKey [0xB1B6BCF0]
SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)                                ZwSetValueKey [0xB1B6BE70]

INT 0x62        ?                                                                                                                    89E55BF8
INT 0x63        ?                                                                                                                    89C23BF8
INT 0x63        ?                                                                                                                    89C23BF8
INT 0x63        ?                                                                                                                    89C23BF8
INT 0x63        ?                                                                                                                    89C23BF8
INT 0x63        ?                                                                                                                    89C23BF8
INT 0x63        ?                                                                                                                    89C23BF8
INT 0x82        ?                                                                                                                    89E55BF8

Code            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)                                ZwCreateProcessEx [0xB1B78AC6]
Code            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)                                ZwCreateSection [0xB1B788EA]
Code            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)                                ZwLoadDriver [0xB1B78A24]
Code            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)                                NtCreateSection
Code            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)                                ObInsertObject
Code            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)                                ObMakeTemporaryObject

---- Kernel code sections - GMER 1.0.15 ----

.text          ntkrnlpa.exe!ZwCallbackReturn + 2428                                                                                8050112C 4 Bytes  JMP 0AB1B6C0
PAGE            ntkrnlpa.exe!ZwLoadDriver                                                                                            8057832A 7 Bytes  JMP B1B78A28 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)
PAGE            ntkrnlpa.exe!NtCreateSection                                                                                        8059F23E 7 Bytes  JMP B1B788EE \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)
PAGE            ntkrnlpa.exe!ObMakeTemporaryObject                                                                                  805B073A 5 Bytes  JMP B1B74536 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)
PAGE            ntkrnlpa.exe!ObInsertObject                                                                                          805B7428 5 Bytes  JMP B1B75EC2 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)
PAGE            ntkrnlpa.exe!ZwCreateProcessEx                                                                                      805C5C32 7 Bytes  JMP B1B78ACA \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)
?              spqz.sys                                                                                                            Das System kann die angegebene Datei nicht finden. !
.text          USBPORT.SYS!DllUnload                                                                                                BA29962C 5 Bytes  JMP 89C231D8
.text          a0l4hayx.SYS                                                                                                        B9FCD386 35 Bytes  [00, 00, 00, 00, 00, 00, 20, ...]
.text          a0l4hayx.SYS                                                                                                        B9FCD3AA 24 Bytes  [00, 00, 00, 00, 00, 00, 00, ...]
.text          a0l4hayx.SYS                                                                                                        B9FCD3C4 3 Bytes  [00, 70, 02] {ADD [EAX+0x2], DH}
.text          a0l4hayx.SYS                                                                                                        B9FCD3C9 1 Byte  [2E]
.text          a0l4hayx.SYS                                                                                                        B9FCD3C9 11 Bytes  [2E, 00, 00, 00, 5C, 02, 00, ...] {ADD CS:[EAX], AL; ADD [EDX+EAX+0x0], BL; ADD [EAX], AL; ADD [EAX], AL}
.text          ...                                                                                                                 

---- User code sections - GMER 1.0.15 ----

.text          C:\Programme\Mozilla Firefox\firefox.exe[2640] ntdll.dll!LdrLoadDll                                                  7C9261CA 5 Bytes  JMP 004013F0 C:\Programme\Mozilla Firefox\firefox.exe (Firefox/Mozilla Corporation)

---- Kernel IAT/EAT - GMER 1.0.15 ----

IAT            atapi.sys[HAL.dll!READ_PORT_UCHAR]                                                                                  [BA6A9040] spqz.sys
IAT            atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT]                                                                          [BA6A913C] spqz.sys
IAT            atapi.sys[HAL.dll!READ_PORT_USHORT]                                                                                  [BA6A90BE] spqz.sys
IAT            atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT]                                                                          [BA6A97FC] spqz.sys
IAT            atapi.sys[HAL.dll!WRITE_PORT_UCHAR]                                                                                  [BA6A96D2] spqz.sys
IAT            \SystemRoot\System32\Drivers\a0l4hayx.SYS[HAL.dll!KfAcquireSpinLock]                                                8A000002
IAT            \SystemRoot\System32\Drivers\a0l4hayx.SYS[HAL.dll!READ_PORT_UCHAR]                                                  83880846
IAT            \SystemRoot\System32\Drivers\a0l4hayx.SYS[HAL.dll!KeGetCurrentIrql]                                                  000001C0
IAT            \SystemRoot\System32\Drivers\a0l4hayx.SYS[HAL.dll!KfRaiseIrql]                                                      2C4EB70F
IAT            \SystemRoot\System32\Drivers\a0l4hayx.SYS[HAL.dll!KfLowerIrql]                                                      8303C183
IAT            \SystemRoot\System32\Drivers\a0l4hayx.SYS[HAL.dll!HalGetInterruptVector]                                            D103FCE1
IAT            \SystemRoot\System32\Drivers\a0l4hayx.SYS[HAL.dll!HalTranslateBusAddress]                                            2E7E8366
IAT            \SystemRoot\System32\Drivers\a0l4hayx.SYS[HAL.dll!KeStallExecutionProcessor]                                        8D1C7400
IAT            \SystemRoot\System32\Drivers\a0l4hayx.SYS[HAL.dll!KfReleaseSpinLock]                                                83893204
IAT            \SystemRoot\System32\Drivers\a0l4hayx.SYS[HAL.dll!READ_PORT_BUFFER_USHORT]                                          00000218
IAT            \SystemRoot\System32\Drivers\a0l4hayx.SYS[HAL.dll!READ_PORT_USHORT]                                                  2E4EB70F
IAT            \SystemRoot\System32\Drivers\a0l4hayx.SYS[HAL.dll!WRITE_PORT_BUFFER_USHORT]                                          021C8B89
IAT            \SystemRoot\System32\Drivers\a0l4hayx.SYS[HAL.dll!WRITE_PORT_UCHAR]                                                  B70F0000
IAT            \SystemRoot\System32\Drivers\a0l4hayx.SYS[WMILIB.SYS!WmiSystemControl]                                              03D00304
IAT            \SystemRoot\System32\Drivers\a0l4hayx.SYS[WMILIB.SYS!WmiCompleteRequest]                                            0CB389F2

---- User IAT/EAT - GMER 1.0.15 ----

IAT            C:\WINDOWS\system32\services.exe[748] @ C:\WINDOWS\system32\services.exe [ADVAPI32.dll!CreateProcessAsUserW]        00370002
IAT            C:\WINDOWS\system32\services.exe[748] @ C:\WINDOWS\system32\services.exe [KERNEL32.dll!CreateProcessW]              00370000

---- Devices - GMER 1.0.15 ----

Device          \FileSystem\Ntfs \Ntfs                                                                                              aswSP.SYS (avast! self protection module/ALWIL Software)
Device          \FileSystem\Ntfs \Ntfs                                                                                              89E541F8

AttachedDevice  \FileSystem\Ntfs \Ntfs                                                                                              aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)

Device          \FileSystem\Udfs \UdfsCdRom                                                                                          8987E500
Device          \FileSystem\Udfs \UdfsDisk                                                                                          8987E500
Device          \Driver\sptd \Device\4201961806                                                                                      spqz.sys

AttachedDevice  \Driver\Tcpip \Device\Ip                                                                                            aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

Device          \Driver\usbuhci \Device\USBPDO-0                                                                                    89B611F8
Device          \Driver\dmio \Device\DmControl\DmIoDaemon                                                                            89DE91F8
Device          \Driver\dmio \Device\DmControl\DmConfig                                                                              89DE91F8
Device          \Driver\dmio \Device\DmControl\DmPnP                                                                                89DE91F8
Device          \Driver\dmio \Device\DmControl\DmInfo                                                                                89DE91F8
Device          \Driver\usbuhci \Device\USBPDO-1                                                                                    89B611F8
Device          \Driver\usbuhci \Device\USBPDO-2                                                                                    89B611F8
Device          \Driver\usbuhci \Device\USBPDO-3                                                                                    89B611F8
Device          \Driver\PCI_PNP3056 \Device\00000047                                                                                spqz.sys
Device          \Driver\usbehci \Device\USBPDO-4                                                                                    89B4A1F8

AttachedDevice  \Driver\Tcpip \Device\Tcp                                                                                            aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

Device          \Driver\Ftdisk \Device\HarddiskVolume1                                                                              89E561F8
Device          \Driver\Ftdisk \Device\HarddiskVolume2                                                                              89E561F8
Device          \Driver\Cdrom \Device\CdRom0                                                                                        89B6B1F8
Device          \Driver\Cdrom \Device\CdRom1                                                                                        89B6B1F8
Device          \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3                                                                          89E551F8
Device          \Driver\atapi \Device\Ide\IdePort0                                                                                  89E551F8
Device          \Driver\atapi \Device\Ide\IdePort1                                                                                  89E551F8
Device          \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-e                                                                          89E551F8
Device          \Driver\NetBT \Device\NetBt_Wins_Export                                                                              899031F8
Device          \Driver\NetBT \Device\NetbiosSmb                                                                                    899031F8
Device          \Driver\NetBT \Device\NetBT_Tcpip_{D4B99205-D22E-402D-AA95-6A47330CB4C4}                                            899031F8

AttachedDevice  \Driver\Tcpip \Device\Udp                                                                                            aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice  \Driver\Tcpip \Device\RawIp                                                                                          aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

Device          \Driver\usbuhci \Device\USBFDO-0                                                                                    89B611F8
Device          \Driver\usbuhci \Device\USBFDO-1                                                                                    89B611F8
Device          \FileSystem\MRxSmb \Device\LanmanDatagramReceiver                                                                    895421F8
Device          \Driver\usbuhci \Device\USBFDO-2                                                                                    89B611F8
Device          \FileSystem\MRxSmb \Device\LanmanRedirector                                                                          895421F8
Device          \Driver\usbuhci \Device\USBFDO-3                                                                                    89B611F8
Device          \Driver\usbehci \Device\USBFDO-4                                                                                    89B4A1F8
Device          \Driver\Ftdisk \Device\FtControl                                                                                    89E561F8
Device          \Driver\a0l4hayx \Device\Scsi\a0l4hayx1Port2Path0Target0Lun0                                                        89BA11F8
Device          \Driver\a0l4hayx \Device\Scsi\a0l4hayx1                                                                              89BA11F8
Device          \FileSystem\Cdfs \Cdfs                                                                                              89979500

---- Registry - GMER 1.0.15 ----

Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1                                                                  771343423
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2                                                                  285507792
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0                                                                  1
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4                                   
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0                                  C:\Programme\DAEMON Tools Lite\
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0                                  0
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh                              0xBE 0x4A 0x63 0x77 ...
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001                           
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0                        0x20 0x01 0x00 0x00 ...
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh                      0xF9 0x51 0xB5 0xC7 ...
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40                     
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh                0x91 0x2B 0x93 0xD2 ...
Reg            HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)               
Reg            HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0                                      C:\Programme\DAEMON Tools Lite\
Reg            HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0                                      0
Reg            HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh                                  0xBE 0x4A 0x63 0x77 ...
Reg            HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)       
Reg            HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0                            0x20 0x01 0x00 0x00 ...
Reg            HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh                          0xF9 0x51 0xB5 0xC7 ...
Reg            HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet) 
Reg            HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh                    0x91 0x2B 0x93 0xD2 ...

---- EOF - GMER 1.0.15 ----
[/CODE]
--- --- ---
--- --- ---

--- --- ---


hier das 2te:

Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 16:37:46 on 16.06.2010

OS: Windows XP Professional Service Pack 2 (Build 2600)
Default Browser: Mozilla Corporation Firefox 3.6.3

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"ALSNDMGR.CPL" - ? - C:\WINDOWS\system32\ALSNDMGR.CPL  (File found, but it contains no detailed information)
"DivXControlPanelApplet.cpl" - "DivX, Inc." - C:\WINDOWS\system32\DivXControlPanelApplet.cpl
"javacpl.cpl" - "Sun Microsystems, Inc." - C:\WINDOWS\system32\javacpl.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"ECSEPM" - "Sony Ericsson Mobile Communications AB" - C:\Programme\Sony Ericsson\Mobile2\Mobile Phone Monitor\ecsepm.cpl
"QuickTime" - "Apple Inc." - C:\Programme\QuickTime\QTSystem\QuickTime.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"a0l4hayx" (a0l4hayx) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\a0l4hayx.sys  (Hidden registry entry, rootkit activity | File signed by Microsoft)
"aswFsBlk" (aswFsBlk) - "ALWIL Software" - C:\WINDOWS\system32\drivers\aswFsBlk.sys
"aswRdr" (aswRdr) - "ALWIL Software" - C:\WINDOWS\system32\drivers\aswRdr.sys
"aswSP" (aswSP) - "ALWIL Software" - C:\WINDOWS\system32\drivers\aswSP.sys
"avast! Asynchronous Virus Monitor" (Aavmker4) - "ALWIL Software" - C:\WINDOWS\system32\drivers\Aavmker4.sys
"avast! Network Shield Support" (aswTdi) - "ALWIL Software" - C:\WINDOWS\system32\drivers\aswTdi.sys
"avast! Standard Shield Support" (aswMon2) - "ALWIL Software" - C:\WINDOWS\system32\drivers\aswMon2.sys
"catchme" (catchme) - ? - C:\DOKUME~1\***\LOKALE~1\Temp\catchme.sys  (File not found)
"Changer" (Changer) - ? - C:\WINDOWS\system32\drivers\Changer.sys  (File not found)
"i2omgmt" (i2omgmt) - ? - C:\WINDOWS\system32\drivers\i2omgmt.sys  (File not found)
"lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys  (File not found)
"NTSIM" (NTSIM) - "VIA Networking Technologies, Inc.      " - C:\WINDOWS\system32\ntsim.sys
"PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys  (File not found)
"PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys  (File not found)
"PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys  (File not found)
"PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys  (File not found)
"PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys  (File not found)
"pgldqpoc" (pgldqpoc) - ? - C:\DOKUME~1\***\LOKALE~1\Temp\pgldqpoc.sys  (Hidden registry entry, rootkit activity | File not found)
"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\WINDOWS\System32\Drivers\PxHelp20.sys
"Secdrv" (Secdrv) - "Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K." - C:\WINDOWS\System32\DRIVERS\secdrv.sys
"Service for Realtek AC97 Audio (WDM)" (ALCXWDM) - "Realtek Semiconductor Corp." - C:\WINDOWS\System32\drivers\ALCXWDM.SYS
"sptd" (sptd) - "Duplex Secure Ltd." - C:\WINDOWS\System32\Drivers\sptd.sys  (File is exclusively opened, access blocked)
"WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys  (File not found)

[Explorer]
-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----
{89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
-----( HKLM\Software\Classes\Protocols\Handler )-----
{3D9F03FA-7A94-11D3-BE81-0050048385D1} "Data Page Pluggable Protocol mso-offdap Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBCOM~1\10\OWC10.DLL
{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
{CD00020A-8B95-11D1-82DB-00C04FB1625D} "Microsoft PKM KnowledgePluggable Class" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\PKMCDO.DLL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{472083B0-C522-11CF-8763-00608CC02F24} "avast" - "ALWIL Software" - C:\Programme\Alwil Software\Avast5\ashShell.dll
{42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? - deskpan.dll  (File not found)
{FBF23B40-E3F0-101B-8488-00AA003E56F8} "Internetverknüpfung" - ? - C:\WINDOWS\system32\ieframe.dll  (File not found)
{8D1636FD-CA49-4B4E-90E4-0A20E03A15E8} "JetFlExt Class" - "COWON America" - C:\Programme\JetAudio\JetFlExt.dll
{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? -  (File not found | COM-object registry key not found)
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office10\msohev.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll
{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll
{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? -  (File not found | COM-object registry key not found)
{e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll
{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL
{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - ? - C:\Programme\WinRAR\rarext.dll

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "ITBarLayout" - ? -  (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_20" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_20.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} "Java Plug-in 1.6.0_20" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_20.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_20" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_20.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
{D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" - "Adobe Systems, Inc." - C:\WINDOWS\system32\Macromed\Flash\Flash10e.ocx / hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
"ICQ6" - "ICQ, LLC." - C:\Programme\ICQ6.5\ICQ.exe
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jp2ssv.dll
{E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

[Logon]
-----( %AllUsersProfile%\Startmenü\Programme\Autostart )-----
"desktop.ini" - ? - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini
-----( %UserProfile%\Startmenü\Programme\Autostart )-----
"desktop.ini" - ? - C:\Dokumente und Einstellungen\***\Startmenü\Programme\Autostart\desktop.ini
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"avast5" - "ALWIL Software" - C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
".NET Runtime Optimization Service v2.0.50727_X86" (clr_optimization_v2.0.50727_32) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
"ASP.NET State Service" (aspnet_state) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
"ATI Smart" (ATI Smart) - ? - C:\WINDOWS\system32\ati2sgag.exe
"avast! Antivirus" (avast! Antivirus) - "ALWIL Software" - C:\Programme\Alwil Software\Avast5\AvastSvc.exe
"avast! Mail Scanner" (avast! Mail Scanner) - "ALWIL Software" - C:\Programme\Alwil Software\Avast5\AvastSvc.exe
"avast! Web Scanner" (avast! Web Scanner) - "ALWIL Software" - C:\Programme\Alwil Software\Avast5\AvastSvc.exe
"InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe
"Java Quick Starter" (JavaQuickStarterService) - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jqs.exe
"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE
"Sony Ericsson OMSI download service" (OMSI download service) - ? - C:\Programme\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe  (File found, but it contains no detailed information)

[Winlogon]
-----( HKCU\Control Panel\IOProcs )-----
"MVB" - ? - mvfs32.dll  (File not found)

===[ Logfile end ]=========================================[ Logfile end ]===

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

cosinus 17.06.2010 11:33
Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!


Alle Zeitangaben in WEZ +1. Es ist jetzt 01:53 Uhr.
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27