Trojaner-Board - TR/Aleuron.EC und BDS/TDSS.TF.1

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - TR/Aleuron.EC und BDS/TDSS.TF.1 (https://www.trojaner-board.de/90822-tr-aleuron-ec-bds-tdss-tf-1-a.html)

das logfile von GMER
GMER Logfile:

Code:

GMER 1.0.15.15281 - hxxp://www.gmer.net

Rootkit scan 2010-09-30 19:40:30

Windows 5.1.2600 Service Pack 3

Running: 3de10dsl.exe; Driver: C:\DOKUME~1\Thomas\LOKALE~1\Temp\uwdoafoc.sys
 
 

---- System - GMER 1.0.15 ----
 

SSDT            FB17BB8E                                 ZwCreateKey

SSDT            FB17BB84                                 ZwCreateThread

SSDT            FB17BB93                                 ZwDeleteKey

SSDT            FB17BB9D                                 ZwDeleteValueKey

SSDT            FB17BBA2                                 ZwLoadKey

SSDT            FB17BB70                                 ZwOpenProcess

SSDT            FB17BB75                                 ZwOpenThread

SSDT            FB17BBAC                                 ZwReplaceKey

SSDT            FB17BBA7                                 ZwRestoreKey

SSDT            FB17BB98                                 ZwSetValueKey

SSDT            FB17BB7F                                 ZwTerminateProcess
 

---- Devices - GMER 1.0.15 ----
 

AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass0  SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)

AttachedDevice  \FileSystem\Fastfat \Fat                 fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
 

---- EOF - GMER 1.0.15 ----

--- --- ---

Logfile von OSAM

Zitat:

Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 19:53:02 on 30.09.2010

OS: Windows XP Home Edition Service Pack 3 (Build 2600)
Default Browser: Microsoft Corporation Internet Explorer 7.00.6000.17080

Scanner Settings
Rootkits detection (hidden registry)
Rootkits detection (hidden files)
Retrieve files information
Check Microsoft signatures

Filters
Trusted entries
Empty entries
Hidden registry entries (rootkit activity)
Exclusively opened files
Not found files
Files without detailed information
Existing files
Non-startable services
Non-startable drivers
Active entries
Disabled entries

Risk Name Publisher Full Path Status
Control Panel Objects
%SystemRoot%\system32
|||||| "JAVACPL.CPL" "Sun Microsystems, Inc." C:\WINDOWS\system32\JAVACPL.CPL File exists
|||||| "TIControlPanel.cpl" "Texas Instruments Incorporated" C:\WINDOWS\system32\TIControlPanel.cpl File exists
HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls
"AntiVir PersonalEdition Classic Konfiguration" C:\PROGRA~1\ANTIVI~1\avconfig.cpl File not found
|||||| "Avira AntiVir Personal - Free Antivirus " "Avira GmbH" C:\PROGRA~1\Avira\ANTIVI~1\avconfig.cpl File exists
Drivers
HKLM\SYSTEM\CurrentControlSet\Services
"Apple Mobile USB Driver" (USBAAPL) C:\WINDOWS\System32\Drivers\usbaapl.sys File not found
|||||| "avgio" (avgio) "Avira GmbH" C:\Programme\Avira\AntiVir Desktop\avgio.sys File exists
|||||| "avgntflt" (avgntflt) "Avira GmbH" C:\WINDOWS\System32\DRIVERS\avgntflt.sys File exists
|||||| "avipbb" (avipbb) "Avira GmbH" C:\WINDOWS\System32\DRIVERS\avipbb.sys File exists
"catchme" (catchme) C:\DOKUME~1\Thomas\LOKALE~1\Temp\catchme.sys File not found
|||||| "cdrbsvsd" (cdrbsvsd) "B.H.A Corporation" C:\WINDOWS\system32\drivers\cdrbsvsd.sys File exists
"Changer" (Changer) C:\WINDOWS\system32\drivers\Changer.sys File not found
"DgiVecp" (DgiVecp) C:\WINDOWS\system32\Drivers\DgiVecp.sys File not found
|||||| "Hotkey" (Hotkey) C:\WINDOWS\system32\drivers\Hotkey.sys File found, but it contains no detailed information
"Icatch(IV) Still Camera Device" (USBCamera) C:\WINDOWS\System32\Drivers\Bulk533.sys File not found
"lbrtfdc" (lbrtfdc) C:\WINDOWS\system32\drivers\lbrtfdc.sys File not found
"mailKmd" (mailKmd) C:\WINDOWS\system32\drivers\mailKmd.sys File not found
|||||| "MREMP50 NDIS Protocol Driver" (MREMP50) "Printing Communications Assoc., Inc. (PCAUSA)" C:\PROGRA~1\GEMEIN~1\Motive\MREMP50.SYS File exists
"MREMP50a64 NDIS Protocol Driver" (MREMP50a64) C:\PROGRA~1\GEMEIN~1\Motive\MREMP50a64.SYS File not found
"MREMPR5 NDIS Protocol Driver" (MREMPR5) C:\PROGRA~1\GEMEIN~1\Motive\MREMPR5.SYS File not found
"MRENDIS5 NDIS Protocol Driver" (MRENDIS5) C:\PROGRA~1\GEMEIN~1\Motive\MRENDIS5.SYS File not found
|||||| "MRESP50 NDIS Protocol Driver" (MRESP50) "Printing Communications Assoc., Inc. (PCAUSA)" C:\PROGRA~1\GEMEIN~1\Motive\MRESP50.SYS File exists
"MRESP50a64 NDIS Protocol Driver" (MRESP50a64) C:\PROGRA~1\GEMEIN~1\Motive\MRESP50a64.SYS File not found
|||||| "Padus ASPI Shell" (pfc) "Padus, Inc." C:\WINDOWS\System32\drivers\pfc.sys File exists
"PCIDump" (PCIDump) C:\WINDOWS\system32\drivers\PCIDump.sys File not found
"PDCOMP" (PDCOMP) C:\WINDOWS\system32\drivers\PDCOMP.sys File not found
"PDFRAME" (PDFRAME) C:\WINDOWS\system32\drivers\PDFRAME.sys File not found
"PDRELI" (PDRELI) C:\WINDOWS\system32\drivers\PDRELI.sys File not found
"PDRFRAME" (PDRFRAME) C:\WINDOWS\system32\drivers\PDRFRAME.sys File not found
"Polaroid Digital Cam Video" (Ca533av) C:\WINDOWS\System32\Drivers\Ca533av.sys File not found
|||||| "POWERKEY" (POWERKEY) C:\Program Files\Launch Manager\POWERKEY.sys File found, but it contains no detailed information
|||||| "ssmdrv" (ssmdrv) "Avira GmbH" C:\WINDOWS\System32\DRIVERS\ssmdrv.sys File exists
"SSPORT" (SSPORT) C:\WINDOWS\system32\Drivers\SSPORT.sys File not found
|||||| "Upper Class Filter Driver" (NTIDrvr) "NewTech Infosystems, Inc." C:\WINDOWS\System32\DRIVERS\NTIDrvr.sys File exists
"uwdoafoc" (uwdoafoc) C:\DOKUME~1\Thomas\LOKALE~1\Temp\uwdoafoc.sys Hidden registry entry, rootkit activity | File not found
"Wbutton" (Wbutton) C:\WINDOWS\system32\drivers\Wbutton.sys File not found
"WDICA" (WDICA) C:\WINDOWS\system32\drivers\WDICA.sys File not found
Explorer
HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components
|||||| {89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" "Microsoft Corporation" C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install File exists
HKLM\Software\Classes\Folder\shellex\ColumnHandlers
|||||| {F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" "Adobe Systems, Inc." C:\Programme\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll File exists
HKLM\Software\Classes\Protocols\Handler
|||||| {3D9F03FA-7A94-11D3-BE81-0050048385D1} "Data Page Pluggable Protocol mso-offdap Handler" "Microsoft Corporation" C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBCOM~1\10\OWC10.DLL File exists
|||||| {CD00020A-8B95-11D1-82DB-00C04FB1625D} "Microsoft PKM KnowledgePluggable Class" "Microsoft Corporation" C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\PKMCDO.DLL File exists
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
{42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" File not found | COM-object registry key not found
|||||| {3FCEF010-09A4-11D4-8D3B-D12F9D3D8B02} "FileTimeShlExt Class" "Texas Instruments Incorporated" C:\PROGRA~1\GEMEIN~1\TISHAR~1\TICONN~1\TIShlExt.dll File exists
{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" File not found | COM-object registry key not found
|||||| {42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" "Microsoft Corporation" C:\Programme\Microsoft Office\Office10\msohev.dll File exists
|||||| {0006F045-0000-0000-C000-000000000046} "Outlook-Dateisymbolerweiterung" "Microsoft Corporation" C:\Programme\Microsoft Office\Office10\OLKFSTUB.DLL File exists
|||||| {45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" "Avira GmbH" C:\Programme\Avira\AntiVir Desktop\shlext.dll File exists
{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} "Shell Extensions for RealOne Player" File not found | COM-object registry key not found
{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" File not found | COM-object registry key not found
{BD88A479-9623-4897-8546-BC62B9628F44} "SPTHandler" File not found | COM-object registry key not found
|||||| {BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Webordner" "Microsoft Corporation" C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL File exists
|||||| {B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" C:\Programme\WinRAR\rarext.dll File found, but it contains no detailed information
Internet Explorer
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser
"ITBar7Layout" File not found | COM-object registry key not found
"ITBarLayout" File not found | COM-object registry key not found
"{2318C2B1-4965-11D4-9B18-009027A5CD4F}" File not found | COM-object registry key not found
HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units
|||||| {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} "BDSCANONLINE Control"
hxxp://download.bitdefender.com/resources/scanner/sources/de/scan8/oscan8.cab "BitDefender" C:\WINDOWS\DOWNLO~1\oscan82.ocx File exists
{DBC4B41E-1BEE-4FC3-A27D-5CF30D11056C} "CM4all Uploader Control"
https://hpt.sso.bluewin.ch/res/js/thirdparty/imageuploader/CM4allUploader.cab "Content Management AG" C:\WINDOWS\Downloaded Program Files\ImageUploader4.ocx File exists
|||| {67DABFBF-D0AB-41FA-9C46-CC0F21721616} "DivXBrowserPlugin Object"
hxxp://download.divx.com/player/DivXBrowserPlugin.cab "DivX,Inc." C:\Programme\DivX\DivX Web Player\npdivx32.dll File exists
|||| {8100D56A-5661-482C-BEE8-AFECE305D968} "Facebook Photo Uploader 5 Control"
hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab "The Facebook" C:\WINDOWS\Downloaded Program Files\PhotoUploader55.ocx File exists
{D8089245-3211-40F6-819B-9E5E92CD61A2} "FlashXControl Object"
https://royaljoker.microgaming.com/deutsch/FlashAX.cab "Microgaming Systems" C:\WINDOWS\system32\FlashAX\FlashAX.ocx File exists
{3B36B017-7E49-426B-95B0-B5CECD83C2E2} "IfolorUploader Control"
hxxp://chkr-web.ifolor.net/ORDERINGGENERAL/LowRes/app_support/ActiveX/IfolorUploader_chkr.cab "Ifolor AG" C:\WINDOWS\DOWNLO~1\IFOLOR~1.OCX File exists
|||| {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} "Image Uploader Control"
hxxp://www.extrafilm.ch/ImageUploader5.cab "Aurigma, Inc." C:\WINDOWS\Downloaded Program Files\ImageUploader5.ocx File exists
|||| {CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA} "Java Plug-in 1.5.0_05"
hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_05-windows-i586.cab "Sun Microsystems, Inc." C:\Programme\Java\jre1.5.0_05\bin\npjpi150_05.dll File exists
|||| {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} "Java Plug-in 1.5.0_06"
hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab "Sun Microsystems, Inc." C:\Programme\Java\jre1.5.0_06\bin\npjpi150_06.dll File exists
|||| {CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA} "Java Plug-in 1.5.0_08"
hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_08-windows-i586.cab "Sun Microsystems, Inc." C:\Programme\Java\jre1.5.0_08\bin\npjpi150_08.dll File exists
|||| {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} "Java Plug-in 1.5.0_09"
hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_09-windows-i586.cab "Sun Microsystems, Inc." C:\Programme\Java\jre1.5.0_09\bin\npjpi150_09.dll File exists
|||| {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} "Java Plug-in 1.5.0_10"
hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab "Sun Microsystems, Inc." C:\Programme\Java\jre1.5.0_10\bin\npjpi150_10.dll File exists
|||| {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} "Java Plug-in 1.5.0_11"
hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab "Sun Microsystems, Inc." C:\Programme\Java\jre1.5.0_11\bin\npjpi150_11.dll File exists
|||||| {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} "Java Plug-in 1.6.0_02"
hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab "Sun Microsystems, Inc." C:\Programme\Java\jre1.6.0_02\bin\npjpi160_02.dll File exists
|||||| {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} "Java Plug-in 1.6.0_03"
hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab "Sun Microsystems, Inc." C:\Programme\Java\jre1.6.0_03\bin\npjpi160_03.dll File exists
|||| {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} "Java Plug-in 1.6.0_05"
hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab "Sun Microsystems, Inc." C:\Programme\Java\jre1.6.0_05\bin\npjpi160_05.dll File exists
|||| {8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_17"
hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab "Sun Microsystems, Inc." C:\Programme\Java\jre6\bin\npjpi160_17.dll File exists
|||| {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} "Java Plug-in 1.6.0_17"
hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab "Sun Microsystems, Inc." C:\Programme\Java\jre6\bin\npjpi160_17.dll File exists
|||| {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_17"
hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab "Sun Microsystems, Inc." C:\Programme\Java\jre6\bin\npjpi160_17.dll File exists
Microsoft XML Parser for Java "Microsoft XML Parser for Java"
file://C:\WINDOWS\Java\classes\xmldso.cab File not found | COM-object registry key not found
|||||| {166B1BCA-3F9C-11CF-8075-444553540000} "Shockwave ActiveX Control"
hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab "Adobe Systems, Inc." C:\WINDOWS\system32\Adobe\Director\SwDir.dll File exists
|||||| {D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object"
hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab "Adobe Systems, Inc." C:\WINDOWS\system32\Macromed\Flash\Flash10b.ocx File exists
|||| {17492023-C23A-453E-A040-C7C580BBF700} "Windows Genuine Advantage Validation Tool"
hxxp://go.microsoft.com/fwlink/?linkid=39204 "Microsoft Corporation" C:\WINDOWS\system32\legitcheckcontrol.dll File exists
{02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} "{02BF25D5-8C17-4B23-BC80-D3488ABDDC6B}"
hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab File not found | COM-object registry key not found
HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions
|||||| "Exec" C:\WINDOWS\bdoscandel.exe File found, but it contains no detailed information
|| "PartyPoker.com" C:\Programme\PartyGaming\PartyPoker\RunApp.exe File exists
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "Adobe PDF Reader Link Helper" C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll File not found
|||| {DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" "Sun Microsystems, Inc." C:\Programme\Java\jre6\bin\jp2ssv.dll File exists
|||| {E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class" "Sun Microsystems, Inc." C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll File exists
Logon
%AllUsersProfile%\Startmenü\Programme\Autostart
|||| "Adobe Reader - Schnellstart.lnk" "Adobe Systems Incorporated" C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe Shortcut exists | File exists
|||||| "DESKTOP.INI" C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\DESKTOP.INI File exists
|||| "Microsoft Office.lnk" "Microsoft Corporation" C:\Programme\Microsoft Office\Office10\OSA.EXE Shortcut exists | File exists
%UserProfile%\Startmenü\Programme\Autostart
|||||| "DESKTOP.INI" C:\Dokumente und Einstellungen\Thomas\Startmenü\Programme\Autostart\DESKTOP.INI File exists
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
|||||| "avgnt" "Avira GmbH" "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min File exists
|||| "CtrlVol" "Wistron" C:\Program Files\Launch Manager\CtrlVol.exe File exists
|||| "LaunchAp" C:\Program Files\Launch Manager\LaunchAp.exe File exists
|||| "LManager" "Wistron" C:\Program Files\Launch Manager\HotkeyApp.exe File exists
|||| "LMgrOSD" C:\Program Files\Launch Manager\OSDCtrl.exe File exists
|||| "PCMService" "CyberLink Corp." "C:\Program Files\Arcade\PCMService.exe" File exists
|||| "PowerKey" "C:\Program Files\Launch Manager\PowerKey.exe" File exists
|| "preload" "Wistron" C:\Windows\RUNXMLPL.exe File exists
|||| "RemoteControl" "Cyberlink Corp." C:\Programme\CyberLink\PowerDVD\PDVDServ.exe File exists
|||| "Samsung PanelMgr" C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe /autorun File exists
|||| "SunJavaUpdateSched" "Sun Microsystems, Inc." "C:\Programme\Java\jre6\bin\jusched.exe" File exists
|||| "Wbutton" "C:\Program Files\Launch Manager\Wbutton.exe" File exists
|||||| "{1290A33C-85F5-4164-A1BE-7DD299D4986A}" "CyberLink Corp." C:\Programme\CyberLink\PowerBackup\PBKScheduler.exe File exists
Services
HKLM\SYSTEM\CurrentControlSet\Services
"Anwendungsverwaltung" (AppMgmt) C:\WINDOWS\System32\appmgmts.dll File not found
|||||| "Avira AntiVir Guard" (AntiVirService) "Avira GmbH" C:\Programme\Avira\AntiVir Desktop\avguard.exe File exists
|||||| "Avira AntiVir Planer" (AntiVirSchedulerService) "Avira GmbH" C:\Programme\Avira\AntiVir Desktop\sched.exe File exists
"HID Input Service" (HidServ) C:\WINDOWS\System32\hidserv.dll File not found
|||||| "Java Quick Starter" (JavaQuickStarterService) "Sun Microsystems, Inc." C:\Programme\Java\jre6\bin\jqs.exe File exists
|||||| "McciCMService" (McciCMService) "Motive Communications, Inc." C:\Programme\Gemeinsame Dateien\Motive\McciCMService.exe File exists
|||||| "Notebook Manager Service" (anbmService) "OSA Technologies Inc." C:\Acer\eManager\anbmServ.exe File exists
Winlogon
HKCU\Control Panel\Desktop
|||||| "SCRNSAVE.EXE" C:\WINDOWS\ACER.SCR File found, but it contains no detailed information
HKCU\Control Panel\IOProcs
"MVB" mvfs32.dll File not found
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions
{c6dc5466-785a-11d2-84d0-00c04fb169f7} "Softwareinstallation" appmgmts.dll File not found
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
|||| "WgaLogon" "Microsoft Corporation" C:\WINDOWS\system32\WgaLogon.dll File exists

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

Auszug aus dem remover.exe Text

unknown boot code has been found on some of your physical disks
To inspect the boot code manually, dump the master boot sector:
remover.exe dump device name output_file
To disinfect the master boot sector, use the following command:
remover.exe fix device name

Downloade Dir bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.

Doppelklick auf die MBRCheck.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Das Tool braucht nur eine Sekunde.
Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.

Poste mir bitte den Inhalt des .txt Dokumentes

hier das file

Zitat:

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Home Edition
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x0000001c

Kernel Drivers (total 172):
0x804D7000 \WINDOWS\system32\ntkrnlpa.exe
0x806D1000 \WINDOWS\system32\hal.dll
0xFB090000 \WINDOWS\system32\KDCOM.DLL
0xFAFA0000 \WINDOWS\system32\BOOTVID.dll
0xFAA60000 ACPI.sys
0xFB092000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xFAA4F000 pci.sys
0xFAB90000 isapnp.sys
0xFABA0000 ohci1394.sys
0xFABB0000 \WINDOWS\system32\DRIVERS\1394BUS.SYS
0xFAFA4000 compbatt.sys
0xFAFA8000 \WINDOWS\system32\DRIVERS\BATTC.SYS
0xFB158000 pciide.sys
0xFAE10000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xFB094000 aliide.sys
0xFB096000 intelide.sys
0xFB098000 toside.sys
0xFB09A000 viaide.sys
0xFB09C000 cmdide.sys
0xFAA31000 pcmcia.sys
0xFABC0000 MountMgr.sys
0xFAA12000 ftdisk.sys
0xFAFAC000 ACPIEC.sys
0xFB159000 \WINDOWS\system32\DRIVERS\OPRGHDLR.SYS
0xFAE18000 PartMgr.sys
0xFABD0000 VolSnap.sys
0xFAFB0000 cpqarray.sys
0xFA9FA000 \WINDOWS\system32\DRIVERS\SCSIPORT.SYS
0xFA9E2000 atapi.sys
0xFAFB4000 aha154x.sys
0xFAE20000 sparrow.sys
0xFAFB8000 symc810.sys
0xFABE0000 aic78xx.sys
0xFAFBC000 dac960nt.sys
0xFABF0000 ql10wnt.sys
0xFAFC0000 amsint.sys
0xFAE28000 asc.sys
0xFAFC4000 asc3550.sys
0xFAE30000 mraid35x.sys
0xFAE38000 i2omp.sys
0xFAFC8000 ini910u.sys
0xFAC00000 ql1240.sys
0xFAC10000 aic78u2.sys
0xFAE40000 symc8xx.sys
0xFAE48000 sym_hi.sys
0xFAE50000 sym_u3.sys
0xFAE58000 ABP480N5.SYS
0xFAE60000 asc3350p.sys
0xFB09E000 cd20xrnt.sys
0xFAC20000 ultra.sys
0xFA9C9000 adpu160m.sys
0xFAE68000 dpti2o.sys
0xFAC30000 ql1080.sys
0xFAC40000 ql1280.sys
0xFAC50000 ql12160.sys
0xFAE70000 perc2.sys
0xFB0A0000 perc2hib.sys
0xFAE78000 hpn.sys
0xFAFCC000 cbidf2k.sys
0xFA99D000 dac2w2k.sys
0xFAC60000 disk.sys
0xFAC70000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xFA97D000 fltmgr.sys
0xFA96B000 sr.sys
0xFA947000 Fastfat.sys
0xFA930000 KSecDD.sys
0xFA91D000 WudfPf.sys
0xFA8F0000 NDIS.sys
0xFAC80000 sisagp.sys
0xFAC90000 viaagp.sys
0xFAE80000 viaagp1.sys
0xFA8D6000 Mup.sys
0xFACA0000 gagp30kx.sys
0xFACB0000 alim1541.sys
0xFACC0000 amdagp.sys
0xFACD0000 agp440.sys
0xFACE0000 agpCPQ.sys
0xFAD00000 \SystemRoot\system32\DRIVERS\AmdK8.sys
0xFA775000 \SystemRoot\system32\DRIVERS\vtmini.sys
0xFA761000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xFA73E000 \SystemRoot\system32\DRIVERS\i2220ntx.sys
0xFAEE0000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0xFA71A000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xFAEE8000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xFAD10000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0xFA6ED000 \SystemRoot\system32\DRIVERS\SynTP.sys
0xFB0B4000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xFAEF0000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xFAEF8000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xFA6D9000 \SystemRoot\system32\DRIVERS\parport.sys
0xFAF00000 \SystemRoot\system32\DRIVERS\nscirda.sys
0xFB048000 \SystemRoot\system32\DRIVERS\irenum.sys
0xFB050000 \SystemRoot\System32\Drivers\cdrbsvsd.SYS
0xFAD20000 \SystemRoot\system32\DRIVERS\imapi.sys
0xFAD30000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xFAD40000 \SystemRoot\system32\DRIVERS\redbook.sys
0xFA6B6000 \SystemRoot\system32\DRIVERS\ks.sys
0xFA699000 \SystemRoot\system32\drivers\viaudios.sys
0xFA675000 \SystemRoot\system32\drivers\portcls.sys
0xFAD50000 \SystemRoot\system32\drivers\drmk.sys
0xFA550000 \SystemRoot\system32\DRIVERS\AGRSM.sys
0xFAF08000 \SystemRoot\System32\Drivers\Modem.SYS
0xFB060000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0xFB2CE000 \SystemRoot\system32\DRIVERS\audstub.sys
0xFAF10000 \SystemRoot\system32\DRIVERS\rasirda.sys
0xFAF18000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xFAD60000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xFB068000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xFA511000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xFAD70000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xFAD80000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xFA460000 \SystemRoot\system32\DRIVERS\psched.sys
0xFAD90000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xFAF20000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xFAF28000 \SystemRoot\system32\DRIVERS\raspti.sys
0xFADA0000 \SystemRoot\system32\DRIVERS\termdd.sys
0xFB0B6000 \SystemRoot\system32\DRIVERS\swenum.sys
0xFA402000 \SystemRoot\system32\DRIVERS\update.sys
0xFB074000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xFADC0000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xFADD0000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xFA7FE000 \SystemRoot\System32\Drivers\i2omgmt.SYS
0xFB0DA000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xFB15D000 \SystemRoot\System32\Drivers\Null.SYS
0xFB0DC000 \SystemRoot\System32\Drivers\Beep.SYS
0xFAF50000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0xFAF58000 \SystemRoot\System32\drivers\vga.sys
0xFB0DE000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xFB0E0000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xFAF60000 \SystemRoot\System32\Drivers\Msfs.SYS
0xFAF68000 \SystemRoot\System32\Drivers\Npfs.SYS
0xFA7F6000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xF92ED000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xF9294000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xF926C000 \SystemRoot\system32\DRIVERS\netbt.sys
0xF924A000 \SystemRoot\System32\drivers\afd.sys
0xFADE0000 \SystemRoot\system32\DRIVERS\netbios.sys
0xF921F000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xF91AF000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xFA7B7000 \SystemRoot\System32\Drivers\Hotkey.SYS
0xFAE00000 \SystemRoot\System32\Drivers\Fips.SYS
0xF9161000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xFA8C6000 \SystemRoot\system32\DRIVERS\wanarp.sys
0xF9145000 \SystemRoot\system32\DRIVERS\avipbb.sys
0xFB0EE000 \??\C:\Programme\Avira\AntiVir Desktop\avgio.sys
0xFAF70000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0xFA54C000 \SystemRoot\system32\DRIVERS\hidusb.sys
0xFA886000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0xFA548000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0xFA544000 \SystemRoot\system32\DRIVERS\mouhid.sys
0xFA876000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xF9065000 \SystemRoot\System32\Drivers\dump_atapi.sys
0xFB0F0000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xFA530000 \SystemRoot\System32\drivers\Dxapi.sys
0xFAF78000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xFB1C6000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF012000 \SystemRoot\System32\vtdisp.dll
0xF06F9000 \SystemRoot\system32\DRIVERS\avgntflt.sys
0xF05A3000 \SystemRoot\system32\DRIVERS\irda.sys
0xF06CD000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xF0436000 \SystemRoot\system32\DRIVERS\mrxdav.sys
0xF90E5000 \SystemRoot\system32\DRIVERS\secdrv.sys
0xF01FF000 \SystemRoot\system32\DRIVERS\srv.sys
0xEFF1A000 \SystemRoot\system32\drivers\wdmaud.sys
0xF0097000 \SystemRoot\system32\drivers\sysaudio.sys
0xEFDEB000 \SystemRoot\System32\Drivers\HTTP.sys
0xFB2BC000 \??\C:\Program Files\Launch Manager\POWERKEY.sys
0xEFA28000 \??\C:\DOKUME~1\Thomas\LOKALE~1\Temp\uwdoafoc.sys
0xEF932000 \SystemRoot\system32\drivers\kmixer.sys
0x7C910000 \WINDOWS\System32\ntdll.dll

Processes (total 44):
0 System Idle Process
4 System
552 C:\WINDOWS\System32\SMSS.EXE
624 csrss.exe
648 C:\WINDOWS\System32\winlogon.exe
692 C:\WINDOWS\System32\SERVICES.EXE
704 C:\WINDOWS\System32\LSASS.EXE
876 C:\WINDOWS\System32\svchost.exe
988 svchost.exe
1028 C:\WINDOWS\System32\svchost.exe
1064 C:\WINDOWS\System32\svchost.exe
1188 svchost.exe
1244 svchost.exe
1692 C:\WINDOWS\System32\spoolsv.exe
1728 C:\Programme\Avira\AntiVir Desktop\sched.exe
1772 svchost.exe
1852 C:\Acer\eManager\anbmServ.exe
260 C:\Programme\Avira\AntiVir Desktop\avguard.exe
308 C:\Programme\Java\jre6\bin\jqs.exe
392 C:\Programme\Gemeinsame Dateien\Motive\McciCMService.exe
524 C:\WINDOWS\System32\svchost.exe
1512 C:\WINDOWS\System32\Wbem\WMIAPSRV.EXE
1468 alg.exe
1280 C:\WINDOWS\EXPLORER.EXE
1240 C:\Programme\Synaptics\SynTP\SynTPLpr.exe
200 C:\Programme\Synaptics\SynTP\SynTPEnh.exe
1824 C:\Program Files\Launch Manager\LaunchAp.exe
1972 C:\Program Files\Launch Manager\Powerkey.exe
192 C:\Program Files\Launch Manager\HotkeyApp.exe
140 C:\Program Files\Launch Manager\CtrlVol.exe
1084 C:\Program Files\Launch Manager\OSDCtrl.exe
760 C:\Program Files\Launch Manager\WButton.exe
2016 C:\WINDOWS\System32\VTTrayp.exe
1168 C:\WINDOWS\System32\VTTimer.exe
1520 C:\WINDOWS\AGRSMMSG.exe
1720 C:\Program Files\Arcade\PCMService.exe
2100 C:\Programme\Java\jre6\bin\JUSCHED.EXE
2132 C:\Programme\CyberLink\PowerDVD\PDVDServ.exe
2164 C:\Programme\Avira\AntiVir Desktop\avgnt.exe
2248 C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe
2320 C:\WINDOWS\System32\ctfmon.exe
2360 C:\Programme\Messenger\msmsgs.exe
3760 C:\Programme\Internet Explorer\iexplore.exe
1496 C:\Dokumente und Einstellungen\Thomas\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`89c3b200 (FAT32)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000004`e7920000 (FAT32)

PhysicalDrive0 Model Number: HTS424040M9AT00, Rev: MA2OA71A

Size Device Name MBR Status
--------------------------------------------
37 GB \\.\PhysicalDrive0 Unknown MBR code
SHA1: BEA90D9A447A4AF731FA0CC4A45E68FA2DFCAE6E

Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:

Done!

Gehe auf die Mircosoft Seite => http://support.microsoft.com/?scid=kb%3Bde%3B310994&x=21&y=12

Wähle den Download, der für dein Betriebssystem bestimmt ist:
Hinweis: Für WinXP Sp3 wähle die Sp2 Version.

http://i94.photobucket.com/albums/l8...ungskonsol.png

Lade die Datei herunter und speichere diese mit dem original Namen, neben ComboFix.exe ab.

http://i94.photobucket.com/albums/l8...onsole_ani.gif

Nun schließe alle offenen Programme und Fenster, inklusive der Antiviren und Antimalware Programme. Dies ist notwendig, damit kein Program den Suchlauf von ComboFix behindert.

Ziehe die Setupdatei auf ComboFix.exe und lasse es los.
Folge den Aufforderungen um ComboFix zu starten und wenn Du dazu aufgefordert wirst, stimme den Nutzungsbedingungen zu um die Wiederherstellungskonsole zu installieren.
Bei der nächsten Eingabeaufforderung, klicke auf "Yes" um den vollständigen Suchlauf von ComboFix zu starten.
Bitte poste mir den Inhalt von C:\ComboFix.txt hier in den Thread.

hier das log.txt

Combofix Logfile:

Code:

ComboFix 10-09-27.05 - Thomas 30.09.2010  21:49:13.2.1 - FAT32x86

Microsoft Windows XP Home Edition  5.1.2600.3.1252.41.1031.18.191.98 [GMT 2:00]

ausgeführt von:: c:\dokumente und einstellungen\Thomas\Desktop\cofi.exe

Benutzte Befehlsschalter :: c:\dokumente und einstellungen\Thomas\Desktop\WindowsXP-KB310994-SP2-Pro-BootDisk-DEU.exe

AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

AV: AntiVir PersonalEdition Classic Virenschutz *On-access scanning enabled* (Outdated) {00000000-0000-0000-0000-000000000000}

AV: AntiVir PersonalEdition Classic Virenschutz *On-access scanning enabled* (Updated) {00000000-FFA4-00EB-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virenschutz *On-access scanning enabled* (Updated) {804FD0EC-FFA4-00EB-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virenschutz *On-access scanning enabled* (Updated) {804FD2B8-FFA4-00EB-0D24-347CA8A3377C}

AV: AntiVir PersonalEdition Classic Virenschutz *On-access scanning enabled* (Updated) {804FD2B8-FFA4-00FC-0D24-347CA8A3377C}

.
 

(((((((((((((((((((((((   Dateien erstellt von 2010-08-28 bis 2010-09-30  ))))))))))))))))))))))))))))))

.
 

2010-09-30 10:56 . 2010-09-30 10:56        --------        d-----w-        C:\_OTL

2010-09-27 18:30 . 2010-09-27 18:30        --------        d-----w-        c:\windows\system32\NtmsData

2010-09-14 20:21 . 2010-09-14 20:21        --------        d-----w-        c:\dokumente und einstellungen\Thomas\Anwendungsdaten\Malwarebytes

2010-09-14 19:43 . 2010-04-29 10:19        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys

2010-09-14 19:41 . 2010-09-14 19:41        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes

2010-09-14 19:41 . 2010-04-29 10:19        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys

2010-09-14 19:40 . 2010-09-14 19:40        --------        d-----w-        C:\Malwarebytes' Anti-Malware

2010-09-13 16:44 . 2010-09-13 16:44        --------        d-----w-        c:\windows\BDOSCAN8
 

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-08-17 13:17 . 1979-12-31 22:00        58880        ----a-w-        c:\windows\system32\spoolsv.exe

2010-07-22 15:48 . 1979-12-31 22:00        590848        ----a-w-        c:\windows\system32\rpcrt4.dll

2010-07-22 06:19 . 2008-05-05 05:25        5632        ----a-w-        c:\windows\system32\xpsp4res.dll

2005-10-23 09:59 . 2005-10-23 09:59        16384        ------w-        c:\programme\ltmoh

.
 

(((((((((((((((((((((((((((((   SnapShot@2010-09-28_20.16.29   )))))))))))))))))))))))))))))))))))))))))

.

+ 2010-09-30 16:32 . 2010-09-30 16:32        16384              c:\windows\Temp\Perflib_Perfdata_134.dat

+ 2007-01-29 07:58 . 2010-06-21 14:46        46080              c:\windows\system32\tzchange.exe

- 2007-01-29 07:58 . 2010-04-21 13:28        46080              c:\windows\system32\tzchange.exe

+ 2006-12-14 20:06 . 2010-02-22 14:22        18808              c:\windows\system32\spmsg.dll

- 2006-12-14 20:06 . 2009-05-26 09:01        18808              c:\windows\system32\spmsg.dll

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"preload"="c:\windows\RUNXMLPL.exe" [2004-04-20 40960]

"SynTPLpr"="c:\programme\Synaptics\SynTP\SynTPLpr.exe" [2004-05-07 98304]

"SynTPEnh"="c:\programme\Synaptics\SynTP\SynTPEnh.exe" [2004-05-07 536576]

"LaunchAp"="c:\program files\Launch Manager\LaunchAp.exe" [2004-08-06 32768]

"PowerKey"="c:\program files\Launch Manager\PowerKey.exe" [2002-08-30 94208]

"LManager"="c:\program files\Launch Manager\HotkeyApp.exe" [2004-07-15 49152]

"CtrlVol"="c:\program files\Launch Manager\CtrlVol.exe" [2004-01-28 184320]

"LMgrOSD"="c:\program files\Launch Manager\OSDCtrl.exe" [2004-09-08 245760]

"Wbutton"="c:\program files\Launch Manager\Wbutton.exe" [2004-08-13 73728]

"VTTrayp"="VTtrayp.exe" [2004-06-22 143360]

"VTTimer"="VTTimer.exe" [2004-09-01 53248]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2004-07-13 4141056]

"AGRSMMSG"="AGRSMMSG.exe" [2003-07-25 88363]

"PCMService"="c:\program files\Arcade\PCMService.exe" [2004-08-27 81920]

"SunJavaUpdateSched"="c:\programme\Java\jre6\bin\jusched.exe" [2010-05-18 149280]

"RemoteControl"="c:\programme\CyberLink\PowerDVD\PDVDServ.exe" [2004-06-28 32768]

"{1290A33C-85F5-4164-A1BE-7DD299D4986A}"="c:\programme\CyberLink\PowerBackup\PBKScheduler.exe" [2004-06-08 69721]

"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

"Samsung PanelMgr"="c:\windows\Samsung\PanelMgr\SSMMgr.exe" [2008-08-08 524288]
 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
 

c:\dokumente und einstellungen\All Users\Startmen\Programme\Autostart\

Microsoft Office.lnk - c:\programme\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

Adobe Reader - Schnellstart.lnk - c:\programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-4-23 29696]
 

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001
 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\WINDOWS\\System32\\javaw.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"d:\\eMule\\eMule.exe"=

"c:\\Programme\\Microsoft Games\\Age of Empires II\\age2_x1\\AGE2_X1.ICD"=
 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"4662:TCP"= 4662:TCP:Emule

"4672:UDP"= 4672:UDP:Emule2
 

R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [24.03.2009 18:33 108289]

R3 POWERKEY;POWERKEY;c:\program files\Launch Manager\POWERKEY.SYS [01.01.2003 23:29 2343]

S1 mailKmd;mailKmd; [x]

S2 Ca533av;Polaroid Digital Cam Video;c:\windows\system32\Drivers\Ca533av.sys --> c:\windows\system32\Drivers\Ca533av.sys [?]

S2 SSPORT;SSPORT;\??\c:\windows\system32\Drivers\SSPORT.sys --> c:\windows\system32\Drivers\SSPORT.sys [?]

S3 IPN2220;acer IPN2220 Wireless LAN Card Driver;c:\windows\system32\drivers\i2220ntx.sys [16.09.2004 18:58 140288]
 

--- Andere Dienste/Treiber im Speicher ---
 

*NewlyCreated* - UWDOAFOC

*Deregistered* - uwdoafoc

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://www.bluewin.ch/

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uDefault_Search_URL = hxxp://www.google.com/ie

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: &HTPE - c:\programme\hattriX\HTPE.htm

IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000

DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab

DPF: {3B36B017-7E49-426B-95B0-B5CECD83C2E2} - hxxp://chkr-web.ifolor.net/ORDERINGGENERAL/LowRes/app_support/ActiveX/IfolorUploader_chkr.cab

DPF: {DBC4B41E-1BEE-4FC3-A27D-5CF30D11056C} - hxxps://hpt.sso.bluewin.ch/res/js/thirdparty/imageuploader/CM4allUploader.cab

.
 

**************************************************************************
 

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2010-09-30 21:56

Windows 5.1.2600 Service Pack 3 FAT NTAPI
 

Scanne versteckte Prozesse... 
 

Scanne versteckte Autostarteinträge... 
 

Scanne versteckte Dateien... 
 

Scan erfolgreich abgeschlossen

versteckte Dateien: 0
 

**************************************************************************

.

--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
 

- - - - - - - > 'explorer.exe'(2564)

c:\programme\CyberLink\Shared Files\CLRCEngine.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

Zeit der Fertigstellung: 2010-09-30  22:00:12

ComboFix-quarantined-files.txt  2010-09-30 20:00

ComboFix2.txt  2010-09-28 20:19
 

Vor Suchlauf: 3'633'053'696 Bytes frei

Nach Suchlauf: 3'661'561'856 Bytes frei
 

WindowsXP-KB310994-SP2-Pro-BootDisk-DEU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

UnsupportedDebug="do not select this" /debug

multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect
 

- - End Of File - - E109C5ED57B3761ECA1A18538BBFF5A6

--- --- ---

Starte den Rechner neu und wähle im Bootmenü die Wiederherstellungskonsole aus.

Tipp dort den Befehl fixmbr ein (dann Enter, mit j bestätigen) danach den Befehl fixboot (dann Enter, mit j bestätigen)

Mit exit (dann enter drücken) wird der Rechner neu gestartet. Führe im normalen Windowsmodus den Bootkit Remover nochmals aus und poste das neue Log.

jetzt ist das MBR in Ordnung

Hast mit MBRCheck nachgeprüft?

Wenn ja => Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

ja, MBRCheck ist in Ordnung,aber Malwarebytes hat leider wieder was gefunden

Zitat:

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4739

Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.11

04.10.2010 16:28:25
mbam-log-2010-10-04 (16-28-25).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Durchsuchte Objekte: 194487
Laufzeit: 2 Stunde(n), 10 Minute(n), 33 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 2

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\System Volume Information\_restore{20805B88-0A57-49FE-94C0-35B1D4357244}\RP950\A0246989.exe (Trojan.Dropper.PGen) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{20805B88-0A57-49FE-94C0-35B1D4357244}\RP952\A0251353.exe (Trojan.Dropper.PGen) -> Quarantined and deleted successfully.

Deaktiviere die Systemwiederherstellung, im Verlauf der Infektion wurden auch Malwaredateien in Wiederherstellungspunkten mitgesichert - die sind alle nun unbrauchbar, da ein Zurücksetzen des Systems durch einen Wiederherstellungspunkt wahrscheinlich wieder eine Infektion nach sich ziehen würde.

ok, das hab ich gemacht. Wie gehts weiter und wann soll ich die Systemwiederherstellung wieder einschalten?
Danke

Der Scan mit SASW steht doch noch aus!

sorry hier das Logfile
nur Adware cookies wurden gefunden

Zitat:

SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 10/05/2010 at 06:36 PM

Application Version : 4.44.1000

Core Rules Database Version : 5631
Trace Rules Database Version: 3443

Scan type : Complete Scan
Total Scan Time : 02:38:41

Memory items scanned : 457
Memory threats detected : 0
Registry items scanned : 5971
Registry threats detected : 0
File items scanned : 65134
File threats detected : 3

Adware.Tracking Cookie
C:\Dokumente und Einstellungen\***\Cookies\***@adtech[1].txt
C:\Dokumente und Einstellungen\***\Cookies\***@bs.serving-sys[1].txt
C:\Dokumente und Einstellungen\***\Cookies\***@serving-sys[2].txt