Trojaner-Board
Seite 1 von 3 1 23
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Browser lassen sich nach Troj.-Befall nicht öffnen windows\system32\svchost.exe Trojan.Downloader (https://www.trojaner-board.de/92139-browser-lassen-troj-befall-oeffnen-windows-system32-svchost-exe-trojan-downloader.html)

desos 23.10.2010 13:37
Browser lassen sich nach Troj.-Befall nicht öffnen windows\system32\svchost.exe Trojan.Downloader
 
Hallo miteinander,

ich habe ein hartnäckiges Problem auf einem Rechner, welcher einen Trojaner-Befall hat/hatte. Auch nach durchlaufen aller Programme und Tools gemäß der Anleitung hier, ist es weiterhin so, dass sich sowohl Internet Explorer als auch Safari nicht öffnen lassen. Beim InternetExplorer war es teilweise so, dass er sich gleich wieder geschlossen hat oder abgestürzt ist (MS-Windows-Fehlermeldung).

Bevor ich die Tools gemäß der Anleitung hier genutzt habe, hatte ich bereits einmal MBAM laufen lassen. Daher habe ich im Anhang zwei Logfiles von MBAM. Daneben habe ich unter Software eine Zylon-Toolbar installiert und ein Programm "Uninstall 1.0.0.1".
MBAM hat bei einem zweiten Durchlauf nichts mehr gefunden, aber weiterhin bestand die Problematik, dass sich der InternetExplorer nicht öffnen ließ. Dabei fiel mir auf, dass die Norton Internet Security beim Versuch diesen zu öffnen einen Angriff über die Datei c:\windows\system32\svchost.exe meldete. Dies ist auch der Grund, warum diese von mir temporär auf _svchost.exe umbenannt wurde.

Danach habe ich die Vorgehensweise gemäß Eurer FAQ vollzogen und dementsprechend lade ich im Anhang die Logfiles hoch.

Ich danke Euch bereits im Voraus für Eure Hilfe.

Viele Grüße


Heiko

P.S.: Ich habe versucht alle Eure Regeln und Anforderungen die Ihr zu Recht an einen Hilfesuchenden stellt versucht zu befolgen. Sollte ich etwas übersehen haben, so bitte ich um Nachsicht und einen dementsprechenden Hinweis, dass ich darauf im weiteren Verlauf achten kann.

cosinus 23.10.2010 20:40
Beende alle Programme, starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)


Code:
:OTL
DRV - File not found [Kernel | Boot | Stopped] -- C:\WINDOWS\System32\drivers\kdyhul.sys -- (egaqf)
O33 - MountPoints2\{a2f66cc4-ddcb-11df-93dc-00218509bf1c}\Shell - "" = AutoRun
O33 - MountPoints2\{a2f66cc4-ddcb-11df-93dc-00218509bf1c}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{a2f66cc4-ddcb-11df-93dc-00218509bf1c}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -- File not found
O33 - MountPoints2\{a2f66cc5-ddcb-11df-93dc-00218509bf1c}\Shell\AutoRun\command - "" = G:\Programs\nu2menu\nu2menu.exe -- File not found
O33 - MountPoints2\{ec26bc50-e6ba-11dd-8fc1-00218509bf1c}\Shell - "" = AutoRun
O33 - MountPoints2\{ec26bc50-e6ba-11dd-8fc1-00218509bf1c}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\LaunchU3.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O36 - AppCertDlls: dplaclip - (C:\WINDOWS\cdinnsvr.dll) - C:\WINDOWS\cdinnsvr.dll ()
Drivers32: wave1 - c_080857.nls File not found
Drivers32: wave2 - c_080857.nls File not found
[2010.10.23 11:25:20 | 000,000,000 | ---D | C] -- C:\AAA
[2010.08.16 15:30:01 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen\Anwendungsdaten\Zynga
[2010.10.22 14:04:51 | 000,053,248 | -H-- | M] () -- C:\WINDOWS\cdinnsvr.dll
:Commands
[purity]
[resethosts]
[emptytemp]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

desos 24.10.2010 23:19
Hallo Arne,

herzlichen Dank für die Hilfe!
Habe den "Fix" wie beschrieben mit dem benutzerdefinierten Text von Dir durchgeführt.
OTL wollte einen Neustart, nach welchem der Nachfolgende Text in einem Log angezeigt wurde. Ich habe den Rechner weiterhin nicht ans Netzwerk angeschlossen. Internet Explorer hat sich nach dem anklicken geöffnet, hängt allerdings mit Sanduhr. Safari ließ sich öffnen. Internet Explorer bei einem zweiten Versuch nach killen der iexplore-Prozesse auch. Allerdings bei einem weiteren Versuch hing er wieder.

Danke schon mal für weitere Hilfe und Input, ob ich noch etwas in Sachen Problembehebung machen muss, was die Schadsoftware angeht oder ob ich wieder ans Netz kann und ggf. den Internet Explorer neu installieren muss?!

Viele Grüße


Heiko

Code:
All processes killed
========== OTL ==========
Service egaqf stopped successfully!
Service egaqf deleted successfully!
File C:\WINDOWS\System32\drivers\kdyhul.sys not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a2f66cc4-ddcb-11df-93dc-00218509bf1c}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a2f66cc4-ddcb-11df-93dc-00218509bf1c}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a2f66cc4-ddcb-11df-93dc-00218509bf1c}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a2f66cc4-ddcb-11df-93dc-00218509bf1c}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a2f66cc4-ddcb-11df-93dc-00218509bf1c}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a2f66cc4-ddcb-11df-93dc-00218509bf1c}\ not found.
File move failed. F:\LaunchU3.exe scheduled to be moved on reboot.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a2f66cc5-ddcb-11df-93dc-00218509bf1c}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a2f66cc5-ddcb-11df-93dc-00218509bf1c}\ not found.
G:\Programs\Nu2Menu\nu2menu.exe moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ec26bc50-e6ba-11dd-8fc1-00218509bf1c}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ec26bc50-e6ba-11dd-8fc1-00218509bf1c}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ec26bc50-e6ba-11dd-8fc1-00218509bf1c}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ec26bc50-e6ba-11dd-8fc1-00218509bf1c}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F\ not found.
File move failed. F:\LaunchU3.exe scheduled to be moved on reboot.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session manager\\BootExecute:autocheck autochk * deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls\\dplaclip:C:\WINDOWS\cdinnsvr.dll deleted successfully.
C:\WINDOWS\cdinnsvr.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\\wave1 deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\\wave2 deleted successfully.
C:\AAA folder moved successfully.
C:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen\Anwendungsdaten\Zynga\Logs folder moved successfully.
C:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen\Anwendungsdaten\Zynga folder moved successfully.
File C:\WINDOWS\cdinnsvr.dll not found.
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
[EMPTYTEMP]
 
User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: All Users
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 16786 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 0 bytes
 
User: User
->Temp folder emptied: 1296478 bytes
->Temporary Internet Files folder emptied: 32902 bytes
->Java cache emptied: 0 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 19175 bytes
RecycleBin emptied: 751 bytes
 
Total Files Cleaned = 1,00 mb
 
 
OTL by OldTimer - Version 3.2.16.0 log created on 10252010_000315

Files\Folders moved on Reboot...
File\Folder F:\LaunchU3.exe not found!
File\Folder C:\WINDOWS\temp\Perflib_Perfdata_88c.dat not found!

Registry entries deleted on Reboot...

cosinus 25.10.2010 09:17
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Lade dir ComboFix hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.
http://saved.im/mtm0nzyzmzd5/cofi.jpg
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

desos 25.10.2010 15:11
Hallo Arne,

herzlichen Dank. Habe Deine Anweisungen befolgt und schilder nachfolgend in kurzer Zusammenfassung, da ich hoffe alles korrekt verstanden und durchgeführt zu haben:
Habe erst den CCleaner ausgeführt (erst Cleander, dann Registry mehrfach mit Sicherungen). Nachdem alles behoben war, habe ich wie empfohlen Combofix als cofi.exe umbenannt gestartet. In meinem Fall wollter er die Wiederherstellungskonsole installieren, weswegen ich kurz das Netzwerkkabel für die Internetverbindung angeschlossen habe. Nach erfolgter Installation hat Combofix gestartet und konnte einen Rootkit auffinden, weswegen es zu einem Neustart aufgefordert hat. Bei diesem habe ich auch die Gelegenheit genutzt und das Netzkwerkkabel wieder abgezogen. Nach dem Neustart ist Combofix weiter durchgelaufen. Ich habe dabei den Hinweis befolgt keine weiteren Programme zu starten. Da auch der Hinweis dabei war währenddessen keine Maus und Tastatur zu nutzen, habe ich Autostartprogramme nicht manuell abgebrochen, sondern ganz normal starten lassen und gar nichts am Rechner gemacht. Hoffe das ist richtig so oder hätte ich die Autostartprogramme schließen sollen?

Das Logfile von Combofix poste ich nachfolgend:
[CODE]
Combofix Logfile:
Code:
ComboFix 10-10-24.05 - User 25.10.2010  15:37:48.1.2 - x86
Microsoft Windows XP Professional  5.1.2600.3.1252.49.1031.18.1791.1317 [GMT 2:00]
ausgeführt von:: c:\dokumente und einstellungen\All Users\Desktop\MFtools\trojanerboard_tip2\ComboFix\cofi.exe
AV: Norton Internet Security *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: FEC Secure IPSec Client Firewall *disabled* {33F684F9-95EF-4FC3-9196-012CF0A4D310}
FW: Norton Internet Security *disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
.

((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.

D:\resycled

.
(((((((((((((((((((((((  Dateien erstellt von 2010-09-25 bis 2010-10-25  ))))))))))))))))))))))))))))))
.

2010-10-25 13:21 . 2010-10-25 13:22        --------        d-----w-        C:\32788R22FWJFW
2010-10-25 13:16 . 2010-10-25 13:16        --------        d-----w-        c:\programme\CCleaner
2010-10-24 22:03 . 2010-10-24 22:03        --------        d-----w-        C:\_OTL
2010-10-23 10:10 . 2010-10-23 10:11        --------        d-----w-        c:\programme\ERUNT
2010-10-22 22:15 . 2010-10-22 22:15        --------        d-sh--w-        c:\dokumente und einstellungen\Administrator\IETldCache
2010-10-22 20:26 . 2010-07-13 01:20        369072        ----a-r-        c:\windows\system32\drivers\symtdi.sys
2010-10-22 20:26 . 2010-07-29 03:33        666672        ----a-r-        c:\windows\system32\drivers\SymEFA.sys
2010-10-22 20:26 . 2010-07-29 02:54        50096        ----a-r-        c:\windows\system32\drivers\srtspx.sys
2010-10-22 20:26 . 2010-06-27 04:05        134704        ----a-r-        c:\windows\system32\drivers\Ironx86.sys
2010-10-22 20:26 . 2010-06-13 10:50        339504        ----a-r-        c:\windows\system32\drivers\SymDS.sys
2010-10-22 20:26 . 2010-10-22 20:28        --------        d-----w-        c:\windows\system32\drivers\NIS\1201000.025
2010-10-22 11:19 . 2010-04-29 13:39        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys
2010-10-22 11:19 . 2010-04-29 13:39        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys
2010-10-20 19:31 . 2010-10-20 19:31        --------        d-----r-        c:\dokumente und einstellungen\LocalService\Favoriten
2010-10-20 08:13 . 2010-10-20 08:15        51712        ---ha-w-        c:\windows\system32\cdinnsvr.dll
2010-10-20 08:13 . 2010-10-20 08:13        --------        d-----w-        c:\dokumente und einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\Adobe
2010-10-19 16:06 . 2010-10-19 16:06        --------        d-sh--w-        c:\dokumente und einstellungen\LocalService\IETldCache
2010-10-18 17:31 . 2010-10-18 17:31        --------        d-----w-        c:\programme\Gemeinsame Dateien\Adobe
2010-10-18 16:41 . 2010-10-18 16:41        --------        d-----r-        c:\dokumente und einstellungen\NetworkService\Favoriten
2010-10-17 20:27 . 2010-10-17 20:27        --------        d-sh--w-        c:\dokumente und einstellungen\NetworkService\IETldCache
2010-10-14 09:38 . 2010-09-18 06:52        974848        -c----w-        c:\windows\system32\dllcache\mfc42.dll
2010-10-14 09:38 . 2010-09-18 06:52        953856        -c----w-        c:\windows\system32\dllcache\mfc40u.dll
2010-10-14 09:38 . 2010-08-23 16:11        617472        -c----w-        c:\windows\system32\dllcache\comctl32.dll
2010-09-27 13:56 . 2010-09-27 13:56        --------        d-----w-        c:\programme\iPod
2010-09-27 13:56 . 2010-09-27 13:57        --------        d-----w-        c:\programme\iTunes
2010-09-27 13:54 . 2010-09-27 13:54        159744        ----a-w-        c:\programme\Internet Explorer\PLUGINS\npqtplugin7.dll
2010-09-27 13:54 . 2010-09-27 13:54        159744        ----a-w-        c:\programme\Internet Explorer\PLUGINS\npqtplugin6.dll
2010-09-27 13:54 . 2010-09-27 13:54        159744        ----a-w-        c:\programme\Internet Explorer\PLUGINS\npqtplugin5.dll
2010-09-27 13:54 . 2010-09-27 13:54        159744        ----a-w-        c:\programme\Internet Explorer\PLUGINS\npqtplugin4.dll
2010-09-27 13:54 . 2010-09-27 13:54        159744        ----a-w-        c:\programme\Internet Explorer\PLUGINS\npqtplugin3.dll
2010-09-27 13:54 . 2010-09-27 13:54        159744        ----a-w-        c:\programme\Internet Explorer\PLUGINS\npqtplugin2.dll
2010-09-27 13:54 . 2010-09-27 13:54        159744        ----a-w-        c:\programme\Internet Explorer\PLUGINS\npqtplugin.dll
2010-09-27 13:53 . 2010-09-27 13:54        --------        d-----w-        c:\programme\QuickTime
2010-09-27 13:52 . 2010-09-27 13:52        --------        d-----w-        c:\programme\Bonjour

.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-22 20:27 . 2009-01-14 15:10        60808        ----a-w-        c:\windows\system32\S32EVNT1.DLL
2010-10-22 20:27 . 2009-01-14 15:10        126512        ----a-w-        c:\windows\system32\drivers\SYMEVENT.SYS
2010-09-18 10:22 . 2006-12-14 13:45        974848        ----a-w-        c:\windows\system32\mfc42u.dll
2010-09-18 06:52 . 2006-11-01 19:17        953856        ----a-w-        c:\windows\system32\mfc40u.dll
2010-09-18 06:52 . 2004-08-04 04:00        974848        ----a-w-        c:\windows\system32\mfc42.dll
2010-09-18 06:52 . 2004-08-04 04:00        954368        ----a-w-        c:\windows\system32\mfc40.dll
2010-09-10 05:47 . 2007-04-18 12:44        916480        ----a-w-        c:\windows\system32\wininet.dll
2010-09-10 05:47 . 2004-08-04 04:00        43520        ----a-w-        c:\windows\system32\licmgr10.dll
2010-09-10 05:47 . 2004-08-04 04:00        1469440        ------w-        c:\windows\system32\inetcpl.cpl
2010-09-08 09:17 . 2010-09-08 09:17        94208        ----a-w-        c:\windows\system32\QuickTimeVR.qtx
2010-09-08 09:17 . 2010-09-08 09:17        69632        ----a-w-        c:\windows\system32\QuickTime.qts
2010-09-05 07:23 . 2010-09-05 07:24        73728        ----a-w-        c:\windows\system32\javacpl.cpl
2010-09-05 07:23 . 2010-09-05 07:24        411368        ----a-w-        c:\windows\system32\deploytk.dll
2010-09-01 11:50 . 2004-08-04 04:00        285824        ----a-w-        c:\windows\system32\atmfd.dll
2010-09-01 07:54 . 2007-03-08 15:32        1852928        ----a-w-        c:\windows\system32\win32k.sys
2010-08-27 08:01 . 2005-10-17 21:20        119808        ----a-w-        c:\windows\system32\t2embed.dll
2010-08-27 05:57 . 2004-12-07 19:33        99840        ----a-w-        c:\windows\system32\srvsvc.dll
2010-08-27 01:43 . 2010-07-22 06:19        5632        ----a-w-        c:\windows\system32\xpsp4res.dll
2010-08-26 13:39 . 2005-05-10 00:17        357248        ----a-w-        c:\windows\system32\drivers\srv.sys
2010-08-23 16:11 . 2004-08-04 04:00        617472        ----a-w-        c:\windows\system32\comctl32.dll
2010-08-17 13:17 . 2005-06-10 23:53        58880        ----a-w-        c:\windows\system32\spoolsv.exe
2010-08-16 08:44 . 2004-08-04 04:00        590848        ----a-w-        c:\windows\system32\rpcrt4.dll
2010-07-27 16:44 . 2010-07-27 16:44        91424        ----a-w-        c:\windows\system32\dnssd.dll
2010-07-27 16:44 . 2010-07-27 16:44        107808        ----a-w-        c:\windows\system32\dns-sd.exe
.

((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PC Suite Tray"="c:\programme\Nokia\Nokia PC Suite 7\PCSuite.exe" [2009-06-25 1414144]
"swg"="c:\programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-01-26 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LaunchApp"="Alaunch" [X]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-11-28 8491008]
"nwiz"="nwiz.exe" [2007-11-28 1626112]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-11-28 81920]
"RTHDCPL"="RTHDCPL.EXE" [2008-01-29 16859648]
"AzMixerSel"="c:\programme\Realtek\Audio\InstallShield\AzMixerSel.exe" [2006-07-17 53248]
"Acer Empowering Technology Monitor"="c:\windows\system32\SysMonitor.exe" [2008-01-03 49152]
"eLockMonitor"="c:\acer\Empowering Technology\eLock\Monitor\LaunchMonitor.exe" [2006-03-31 16384]
"eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2007-09-28 342528]
"FLMBROWSEMOUSE"="c:\programme\Browser PS2 mouse\mouse32a.exe" [2008-11-12 360448]
"FLMK08KB"="c:\programme\Multimedia keyboard utility\1.3\MMKEYBD.EXE" [2008-11-12 207360]
"Google Desktop Search"="c:\programme\Google\Google Desktop Search\GoogleDesktop.exe" [2010-06-26 30192]
"SunJavaUpdateSched"="c:\programme\Java\jre6\bin\jusched.exe" [2010-09-05 149280]
"HP Software Update"="c:\programme\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152]
"AppleSyncNotifier"="c:\programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-09-08 47904]
"NcpBudgetGui"="c:\programme\Funkwerk Secure IPSec Client\NcpBudgetGui.exe" [2009-11-05 968192]
"NcpPopup"="c:\programme\Funkwerk Secure IPSec Client\ncppopup.exe" [2009-08-26 578560]
"NcpMonitor"="c:\programme\Funkwerk Secure IPSec Client\ncpmon.exe" [2009-11-23 6587904]
"NcpRsuGui"="c:\programme\Funkwerk Secure IPSec Client\rwsrsu.exe" [2009-10-12 819712]
"IntelliPoint"="c:\programme\Microsoft IntelliPoint\ipoint.exe" [2009-11-11 1468256]
"QuickTime Task"="c:\programme\QuickTime\qttask.exe" [2010-09-08 421888]
"iTunesHelper"="c:\programme\iTunes\iTunesHelper.exe" [2010-09-24 421160]
"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM"="c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 59392]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"IMEKRMIG6.1"="c:\windows\ime\imkr6_1\IMEKRMIG.EXE" [2004-08-04 44032]
"eRecoveryService"="c:\acer\Empowering Technology\eRecovery\eRAgent.exe" [2007-07-11 421888]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\GEMEIN~1\MICROS~1\DW\dwtrig20.exe" [2008-11-03 435096]

c:\dokumente und einstellungen\All Users\Startmen\Programme\Autostart\
VR-NetWorld Auftragsprfung.lnk - c:\programme\VR-NetWorld\vrtoolcheckorder.exe [2008-11-12 565248]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=c_080857.nls
"mixer2"=c_080857.nls
"midi2"=c_080857.nls
"aux2"=c_080857.nls
"mixer1"=c_080857.nls
"midi1"=c_080857.nls

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute        REG_MULTI_SZ          \0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programme\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Downloads\\Fernwartung\\server.exe"=
"c:\\Programme\\ICQ6.5\\ICQ.exe"=
"c:\\Programme\\StarMoney 7.0\\ouservice\\StarMoneyOnlineUpdate.exe"=
"c:\\Programme\\StarMoney 7.0\\app\\StarMoney.exe"=
"c:\\Programme\\Bonjour\\mDNSResponder.exe"=
"c:\\Programme\\iTunes\\iTunes.exe"=

R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NIS\1201000.025\SymDS.sys [22.10.2010 22:26 339504]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NIS\1201000.025\SymEFA.sys [22.10.2010 22:26 666672]
R1 BHDrvx86;BHDrvx86;c:\dokumente und einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20101001.001\BHDrvx86.sys [01.09.2010 00:57 692272]
R1 bizVSerial;Franson VSerial;c:\windows\system32\drivers\bizVSerialNT.sys [12.11.2008 15:54 14949]
R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NIS\1201000.025\Ironx86.sys [22.10.2010 22:26 134704]
R2 cjpcsc;cyberJack PC/SC COM Service ;c:\windows\system32\cjpcsc.exe [12.11.2008 15:54 668976]
R2 eLock2BurnerLockDriver;eLock2BurnerLockDriver;c:\windows\system32\eLock2BurnerLockDriver.sys [08.06.2006 17:54 17664]
R2 eLock2FSCTLDriver;eLock2FSCTLDriver;c:\windows\system32\eLock2FSCTLDriver.sys [06.06.2006 18:36 90112]
R2 Fabs;FABS - Helping agent for MAGIX media database;c:\programme\Gemeinsame Dateien\MAGIX Services\Database\bin\FABS.exe [03.02.2009 14:53 1155072]
R2 ICQ Service;ICQ Service;c:\programme\ICQ6Toolbar\ICQ Service.exe [21.10.2009 17:35 222968]
R2 LockServ;LockServ;c:\acer\Empowering Technology\eLock\LockServ.exe -p --> c:\acer\Empowering Technology\eLock\LockServ.exe -p [?]
R2 ncpclcfg;ncpclcfg;c:\programme\Funkwerk Secure IPSec Client\ncpclcfg.exe [08.02.2010 16:40 86016]
R2 ncprwsnt;ncprwsnt;c:\programme\Funkwerk Secure IPSec Client\NCPRWSNT.EXE [08.02.2010 16:40 1085960]
R2 NcpSec;NcpSec;c:\programme\Funkwerk Secure IPSec Client\NCPSEC.EXE [08.02.2010 16:40 32768]
R2 Network Management Utility Service;Network Management Utility;c:\programme\Network Management Utility\JavaService.exe -ms4m -mx32m --> c:\programme\Network Management Utility\JavaService.exe -ms4m -mx32m [?]
R2 NIS;Norton Internet Security;c:\programme\Norton Internet Security\Engine\18.1.0.37\ccSvcHst.exe [22.10.2010 22:26 126904]
R2 rwsrsu;RwsRsu;c:\programme\Funkwerk Secure IPSec Client\rwsrsu.exe [08.02.2010 16:40 819712]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\programme\Gemeinsame Dateien\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [23.10.2010 10:08 102448]
R3 IDSxpx86;IDSxpx86;c:\dokumente und einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20101021.003\IDSXpx86.sys [19.10.2010 22:36 341880]
R3 NcpFiltMP;NcpFiltMP;c:\windows\system32\drivers\ncpvaxp.sys [08.02.2010 16:40 81224]
S2 gupdate;Google Update Service (gupdate);c:\programme\Google\Update\GoogleUpdate.exe [30.01.2010 18:23 135664]
S2 StarMoney 7.0 OnlineUpdate;StarMoney 7.0 OnlineUpdate;c:\programme\StarMoney 7.0\ouservice\StarMoneyOnlineUpdate.exe [25.06.2010 19:17 541192]
S3 Acer ODDSpeedControl;Acer ODDSpeedControl;c:\acer\Empowering Technology\eAcoustics\ODDSpeedCtl\speedcontrol.exe [12.11.2008 14:12 81920]
S3 cjusb;REINER SCT cyberJack pinpad/e-com USB;c:\windows\system32\drivers\cjusb.sys [12.11.2008 15:54 23040]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\programme\Gemeinsame Dateien\MAGIX Services\Database\bin\fbserver.exe [07.08.2008 10:10 3276800]
S3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\programme\Google\Google Desktop Search\GoogleDesktop.exe [02.12.2008 15:21 30192]
S3 NcpFilt;Ncp Filter Service;c:\windows\system32\drivers\ncpvaxp.sys [08.02.2010 16:40 81224]
S3 ncpvaxp;NCP Secure Client Virtual Adapter Driver;c:\windows\system32\drivers\ncpvaxp.sys [08.02.2010 16:40 81224]

--- Andere Dienste/Treiber im Speicher ---

*Deregistered* - Ndisprot.sys

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt        REG_MULTI_SZ          hpqcxs08
.
Inhalt des "geplante Tasks" Ordners

2010-09-27 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\programme\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]

2010-10-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programme\Google\Update\GoogleUpdate.exe [2010-01-30 16:23]

2010-10-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programme\Google\Update\GoogleUpdate.exe [2010-01-30 16:23]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = about:blank
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -

Toolbar-Locked - (no file)



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2010-10-25 15:52
Windows 5.1.2600 Service Pack 3 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, hxxp://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8A32A446]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xba0ecf28
\Driver\ACPI -> ACPI.sys @ 0xb9f7ecb8
\Driver\atapi -> atapi.sys @ 0xb9f10852
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8
 ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
 SecurityProcedure -> ntkrnlpa.exe @ 0x80583d4a
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8
 ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
 SecurityProcedure -> ntkrnlpa.exe @ 0x80583d4a
NDIS: NVIDIA nForce Networking Controller -> SendCompleteHandler -> NDIS.sys @ 0xb9d09bb0
 PacketIndicateHandler -> NDIS.sys @ 0xb9cf8a0d
 SendHandler -> NDIS.sys @ 0xb9d0cb40
user & kernel MBR OK

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NIS]
"ImagePath"="\"c:\programme\Norton Internet Security\Engine\18.1.0.37\ccSvcHst.exe\" /s \"NIS\" /m \"c:\programme\Norton Internet Security\Engine\18.1.0.37\diMaster.dll\" /prefetch:1"
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

- - - - - - - > 'explorer.exe'(1416)
c:\windows\system32\MSNCHATHOOK.DLL
c:\windows\system32\sysenv.dll
c:\windows\system32\CryptoAPI.dll
c:\windows\system32\ShowErrMsg.dll
c:\windows\system32\MFC71U.DLL
c:\programme\iTunes\iTunesMiniPlayer.dll
c:\programme\iTunes\iTunesMiniPlayer.Resources\de.lproj\iTunesMiniPlayerLocalized.dll
c:\programme\iTunes\iTunesMiniPlayer.Resources\iTunesMiniPlayer.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\programme\Nokia\Nokia PC Suite 7\PhoneBrowser.dll
c:\programme\Nokia\Nokia PC Suite 7\NGSCM.DLL
c:\programme\Nokia\Nokia PC Suite 7\Lang\PhoneBrowser_ger.nlr
c:\programme\Nokia\Nokia PC Suite 7\Resource\PhoneBrowser_Nokia.ngr
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\programme\Browser PS2 mouse\MOUDL32A.DLL
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\System32\SCardSvr.exe
c:\acer\Empowering Technology\ePerformance\MemCheck.exe
c:\programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\programme\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
c:\programme\Bonjour\mDNSResponder.exe
c:\programme\Java\jre6\bin\jqs.exe
c:\programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
c:\acer\Empowering Technology\eLock\LockServ.exe
c:\programme\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
c:\programme\Network Management Utility\JavaService.exe
c:\programme\Network Management Utility\jre1.1\bin\jre.exe
c:\windows\system32\nvsvc32.exe
c:\programme\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\windows\system32\RUNDLL32.EXE
c:\windows\RTHDCPL.EXE
c:\programme\Multimedia keyboard utility\1.3\KbdAp32A.exe
c:\acer\Empowering Technology\eLock\Monitor\LockMon.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\programme\Microsoft IntelliPoint\dpupdchk.exe
c:\acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
c:\windows\system32\wscntfy.exe
c:\programme\iPod\bin\iPodService.exe
c:\programme\PC Connectivity Solution\ServiceLayer.exe
c:\programme\PC Connectivity Solution\Transports\NclUSBSrv.exe
c:\programme\PC Connectivity Solution\Transports\NclRSSrv.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2010-10-25  15:58:34 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2010-10-25 13:58

Vor Suchlauf: 16 Verzeichnis(se), 78.261.805.056 Bytes frei
Nach Suchlauf: 19 Verzeichnis(se), 78.212.055.040 Bytes frei

WindowsXP-KB310994-SP2-Pro-BootDisk-DEU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - ECC8BA002CC56B3F34D106A133882EB7
--- --- ---


Herzlichen Dank vorab für weitere Hilfe.

Viele Grüße



Heiko

cosinus 25.10.2010 17:46
Combofix - Scripten

1. Starte das Notepad (Start / Ausführen / notepad[Enter])

2. Jetzt füge mit copy/paste den ganzen Inhalt der untenstehenden Codebox in das Notepad Fenster ein.

Hinweis: Falls Du Deinen Benutzernamen unkenntlich gemacht hast, musst Du das Ausgesternte in Deinen richtigen Benutzernamen wieder verwandeln, sonst funktioniert das Script nicht!!

Code:
Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=-
"mixer2"=-
"midi2"=-
"aux2"=-
"mixer1"=-
"midi1"=-
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"=-
3. Speichere im Notepad als CFScript.txt auf dem Desktop.

4. Deaktivere den Guard Deines Antivirenprogramms und eine eventuell vorhandene Software Firewall.
(Auch Guards von Ad-, Spyware Programmen und den Tea Timer (wenn vorhanden) !)

5. Dann ziehe die CFScript.txt auf die cofi.exe, so wie es im unteren Bild zu sehen ist. Damit wird Combofix neu gestartet.

http://users.pandora.be/bluepatchy/m...s/CFScript.gif

6. Nach dem Neustart (es wird gefragt ob Du neustarten willst), poste bitte die folgenden Log Dateien:
Combofix.txt

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

desos 25.10.2010 20:26
Habe Combofix mit dem Script ausgeführt. Es wurde erneut ein Rootkit erkannt und neu gestartet. Nach dem Durchlaufen des Programms wurde die nachfolgende Logdatei angezeigt:

[CODE]
Combofix Logfile:
Code:
ComboFix 10-10-24.05 - User 25.10.2010  20:00:39.2.2 - x86
Microsoft Windows XP Professional  5.1.2600.3.1252.49.1031.18.1791.1313 [GMT 2:00]
ausgeführt von:: c:\dokumente und einstellungen\All Users\Desktop\MFtools\trojanerboard_tip3\cofi.exe
Benutzte Befehlsschalter :: c:\dokumente und einstellungen\All Users\Desktop\MFtools\trojanerboard_tip3\CFScript.txt
AV: Norton Internet Security *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: FEC Secure IPSec Client Firewall *disabled* {33F684F9-95EF-4FC3-9196-012CF0A4D310}
FW: Norton Internet Security *disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
.

(((((((((((((((((((((((  Dateien erstellt von 2010-09-25 bis 2010-10-25  ))))))))))))))))))))))))))))))
.

2010-10-25 13:16 . 2010-10-25 13:16        --------        d-----w-        c:\programme\CCleaner
2010-10-24 22:03 . 2010-10-24 22:03        --------        d-----w-        C:\_OTL
2010-10-23 10:10 . 2010-10-23 10:11        --------        d-----w-        c:\programme\ERUNT
2010-10-22 22:15 . 2010-10-22 22:15        --------        d-sh--w-        c:\dokumente und einstellungen\Administrator\IETldCache
2010-10-22 20:26 . 2010-07-13 01:20        369072        ----a-r-        c:\windows\system32\drivers\symtdi.sys
2010-10-22 20:26 . 2010-07-29 03:33        666672        ----a-r-        c:\windows\system32\drivers\SymEFA.sys
2010-10-22 20:26 . 2010-07-29 02:54        50096        ----a-r-        c:\windows\system32\drivers\srtspx.sys
2010-10-22 20:26 . 2010-06-27 04:05        134704        ----a-r-        c:\windows\system32\drivers\Ironx86.sys
2010-10-22 20:26 . 2010-06-13 10:50        339504        ----a-r-        c:\windows\system32\drivers\SymDS.sys
2010-10-22 20:26 . 2010-10-22 20:28        --------        d-----w-        c:\windows\system32\drivers\NIS\1201000.025
2010-10-22 11:19 . 2010-04-29 13:39        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys
2010-10-22 11:19 . 2010-04-29 13:39        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys
2010-10-20 19:31 . 2010-10-20 19:31        --------        d-----r-        c:\dokumente und einstellungen\LocalService\Favoriten
2010-10-20 08:13 . 2010-10-20 08:15        51712        ---ha-w-        c:\windows\system32\cdinnsvr.dll
2010-10-20 08:13 . 2010-10-20 08:13        --------        d-----w-        c:\dokumente und einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\Adobe
2010-10-19 16:06 . 2010-10-19 16:06        --------        d-sh--w-        c:\dokumente und einstellungen\LocalService\IETldCache
2010-10-18 17:31 . 2010-10-18 17:31        --------        d-----w-        c:\programme\Gemeinsame Dateien\Adobe
2010-10-18 16:41 . 2010-10-18 16:41        --------        d-----r-        c:\dokumente und einstellungen\NetworkService\Favoriten
2010-10-17 20:27 . 2010-10-17 20:27        --------        d-sh--w-        c:\dokumente und einstellungen\NetworkService\IETldCache
2010-10-14 09:38 . 2010-09-18 06:52        974848        -c----w-        c:\windows\system32\dllcache\mfc42.dll
2010-10-14 09:38 . 2010-09-18 06:52        953856        -c----w-        c:\windows\system32\dllcache\mfc40u.dll
2010-10-14 09:38 . 2010-08-23 16:11        617472        -c----w-        c:\windows\system32\dllcache\comctl32.dll
2010-09-27 13:56 . 2010-09-27 13:56        --------        d-----w-        c:\programme\iPod
2010-09-27 13:56 . 2010-09-27 13:57        --------        d-----w-        c:\programme\iTunes
2010-09-27 13:54 . 2010-09-27 13:54        159744        ----a-w-        c:\programme\Internet Explorer\PLUGINS\npqtplugin7.dll
2010-09-27 13:54 . 2010-09-27 13:54        159744        ----a-w-        c:\programme\Internet Explorer\PLUGINS\npqtplugin6.dll
2010-09-27 13:54 . 2010-09-27 13:54        159744        ----a-w-        c:\programme\Internet Explorer\PLUGINS\npqtplugin5.dll
2010-09-27 13:54 . 2010-09-27 13:54        159744        ----a-w-        c:\programme\Internet Explorer\PLUGINS\npqtplugin4.dll
2010-09-27 13:54 . 2010-09-27 13:54        159744        ----a-w-        c:\programme\Internet Explorer\PLUGINS\npqtplugin3.dll
2010-09-27 13:54 . 2010-09-27 13:54        159744        ----a-w-        c:\programme\Internet Explorer\PLUGINS\npqtplugin2.dll
2010-09-27 13:54 . 2010-09-27 13:54        159744        ----a-w-        c:\programme\Internet Explorer\PLUGINS\npqtplugin.dll
2010-09-27 13:53 . 2010-09-27 13:54        --------        d-----w-        c:\programme\QuickTime
2010-09-27 13:52 . 2010-09-27 13:52        --------        d-----w-        c:\programme\Bonjour

.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-22 20:27 . 2009-01-14 15:10        60808        ----a-w-        c:\windows\system32\S32EVNT1.DLL
2010-10-22 20:27 . 2009-01-14 15:10        126512        ----a-w-        c:\windows\system32\drivers\SYMEVENT.SYS
2010-09-18 10:22 . 2006-12-14 13:45        974848        ----a-w-        c:\windows\system32\mfc42u.dll
2010-09-18 06:52 . 2006-11-01 19:17        953856        ----a-w-        c:\windows\system32\mfc40u.dll
2010-09-18 06:52 . 2004-08-04 04:00        974848        ----a-w-        c:\windows\system32\mfc42.dll
2010-09-18 06:52 . 2004-08-04 04:00        954368        ----a-w-        c:\windows\system32\mfc40.dll
2010-09-10 05:47 . 2007-04-18 12:44        916480        ----a-w-        c:\windows\system32\wininet.dll
2010-09-10 05:47 . 2004-08-04 04:00        43520        ----a-w-        c:\windows\system32\licmgr10.dll
2010-09-10 05:47 . 2004-08-04 04:00        1469440        ------w-        c:\windows\system32\inetcpl.cpl
2010-09-08 09:17 . 2010-09-08 09:17        94208        ----a-w-        c:\windows\system32\QuickTimeVR.qtx
2010-09-08 09:17 . 2010-09-08 09:17        69632        ----a-w-        c:\windows\system32\QuickTime.qts
2010-09-05 07:23 . 2010-09-05 07:24        73728        ----a-w-        c:\windows\system32\javacpl.cpl
2010-09-05 07:23 . 2010-09-05 07:24        411368        ----a-w-        c:\windows\system32\deploytk.dll
2010-09-01 11:50 . 2004-08-04 04:00        285824        ----a-w-        c:\windows\system32\atmfd.dll
2010-09-01 07:54 . 2007-03-08 15:32        1852928        ----a-w-        c:\windows\system32\win32k.sys
2010-08-27 08:01 . 2005-10-17 21:20        119808        ----a-w-        c:\windows\system32\t2embed.dll
2010-08-27 05:57 . 2004-12-07 19:33        99840        ----a-w-        c:\windows\system32\srvsvc.dll
2010-08-27 01:43 . 2010-07-22 06:19        5632        ----a-w-        c:\windows\system32\xpsp4res.dll
2010-08-26 13:39 . 2005-05-10 00:17        357248        ----a-w-        c:\windows\system32\drivers\srv.sys
2010-08-23 16:11 . 2004-08-04 04:00        617472        ----a-w-        c:\windows\system32\comctl32.dll
2010-08-17 13:17 . 2005-06-10 23:53        58880        ----a-w-        c:\windows\system32\spoolsv.exe
2010-08-16 08:44 . 2004-08-04 04:00        590848        ----a-w-        c:\windows\system32\rpcrt4.dll
.

((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PC Suite Tray"="c:\programme\Nokia\Nokia PC Suite 7\PCSuite.exe" [2009-06-25 1414144]
"swg"="c:\programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-01-26 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LaunchApp"="Alaunch" [X]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-11-28 8491008]
"nwiz"="nwiz.exe" [2007-11-28 1626112]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-11-28 81920]
"RTHDCPL"="RTHDCPL.EXE" [2008-01-29 16859648]
"AzMixerSel"="c:\programme\Realtek\Audio\InstallShield\AzMixerSel.exe" [2006-07-17 53248]
"Acer Empowering Technology Monitor"="c:\windows\system32\SysMonitor.exe" [2008-01-03 49152]
"eLockMonitor"="c:\acer\Empowering Technology\eLock\Monitor\LaunchMonitor.exe" [2006-03-31 16384]
"eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2007-09-28 342528]
"FLMBROWSEMOUSE"="c:\programme\Browser PS2 mouse\mouse32a.exe" [2008-11-12 360448]
"FLMK08KB"="c:\programme\Multimedia keyboard utility\1.3\MMKEYBD.EXE" [2008-11-12 207360]
"Google Desktop Search"="c:\programme\Google\Google Desktop Search\GoogleDesktop.exe" [2010-06-26 30192]
"SunJavaUpdateSched"="c:\programme\Java\jre6\bin\jusched.exe" [2010-09-05 149280]
"HP Software Update"="c:\programme\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152]
"AppleSyncNotifier"="c:\programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-09-08 47904]
"NcpBudgetGui"="c:\programme\Funkwerk Secure IPSec Client\NcpBudgetGui.exe" [2009-11-05 968192]
"NcpPopup"="c:\programme\Funkwerk Secure IPSec Client\ncppopup.exe" [2009-08-26 578560]
"NcpMonitor"="c:\programme\Funkwerk Secure IPSec Client\ncpmon.exe" [2009-11-23 6587904]
"NcpRsuGui"="c:\programme\Funkwerk Secure IPSec Client\rwsrsu.exe" [2009-10-12 819712]
"IntelliPoint"="c:\programme\Microsoft IntelliPoint\ipoint.exe" [2009-11-11 1468256]
"QuickTime Task"="c:\programme\QuickTime\qttask.exe" [2010-09-08 421888]
"iTunesHelper"="c:\programme\iTunes\iTunesHelper.exe" [2010-09-24 421160]
"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM"="c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 59392]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"IMEKRMIG6.1"="c:\windows\ime\imkr6_1\IMEKRMIG.EXE" [2004-08-04 44032]
"eRecoveryService"="c:\acer\Empowering Technology\eRecovery\eRAgent.exe" [2007-07-11 421888]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\GEMEIN~1\MICROS~1\DW\dwtrig20.exe" [2008-11-03 435096]

c:\dokumente und einstellungen\All Users\Startmen\Programme\Autostart\
VR-NetWorld Auftragsprfung.lnk - c:\programme\VR-NetWorld\vrtoolcheckorder.exe [2008-11-12 565248]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute        REG_MULTI_SZ          \0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programme\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Downloads\\Fernwartung\\server.exe"=
"c:\\Programme\\ICQ6.5\\ICQ.exe"=
"c:\\Programme\\StarMoney 7.0\\ouservice\\StarMoneyOnlineUpdate.exe"=
"c:\\Programme\\StarMoney 7.0\\app\\StarMoney.exe"=
"c:\\Programme\\Bonjour\\mDNSResponder.exe"=
"c:\\Programme\\iTunes\\iTunes.exe"=

R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NIS\1201000.025\SymDS.sys [22.10.2010 22:26 339504]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NIS\1201000.025\SymEFA.sys [22.10.2010 22:26 666672]
R1 BHDrvx86;BHDrvx86;c:\dokumente und einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20101001.001\BHDrvx86.sys [01.09.2010 00:57 692272]
R1 bizVSerial;Franson VSerial;c:\windows\system32\drivers\bizVSerialNT.sys [12.11.2008 15:54 14949]
R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NIS\1201000.025\Ironx86.sys [22.10.2010 22:26 134704]
R2 cjpcsc;cyberJack PC/SC COM Service ;c:\windows\system32\cjpcsc.exe [12.11.2008 15:54 668976]
R2 eLock2BurnerLockDriver;eLock2BurnerLockDriver;c:\windows\system32\eLock2BurnerLockDriver.sys [08.06.2006 17:54 17664]
R2 eLock2FSCTLDriver;eLock2FSCTLDriver;c:\windows\system32\eLock2FSCTLDriver.sys [06.06.2006 18:36 90112]
R2 Fabs;FABS - Helping agent for MAGIX media database;c:\programme\Gemeinsame Dateien\MAGIX Services\Database\bin\FABS.exe [03.02.2009 14:53 1155072]
R2 ICQ Service;ICQ Service;c:\programme\ICQ6Toolbar\ICQ Service.exe [21.10.2009 17:35 222968]
R2 ncpclcfg;ncpclcfg;c:\programme\Funkwerk Secure IPSec Client\ncpclcfg.exe [08.02.2010 16:40 86016]
R2 ncprwsnt;ncprwsnt;c:\programme\Funkwerk Secure IPSec Client\NCPRWSNT.EXE [08.02.2010 16:40 1085960]
R2 NIS;Norton Internet Security;c:\programme\Norton Internet Security\Engine\18.1.0.37\ccSvcHst.exe [22.10.2010 22:26 126904]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\programme\Gemeinsame Dateien\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [23.10.2010 10:08 102448]
R3 IDSxpx86;IDSxpx86;c:\dokumente und einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20101021.003\IDSXpx86.sys [19.10.2010 22:36 341880]
R3 NcpFiltMP;NcpFiltMP;c:\windows\system32\drivers\ncpvaxp.sys [08.02.2010 16:40 81224]
S2 gupdate;Google Update Service (gupdate);c:\programme\Google\Update\GoogleUpdate.exe [30.01.2010 18:23 135664]
S2 LockServ;LockServ;c:\acer\Empowering Technology\eLock\LockServ.exe -p --> c:\acer\Empowering Technology\eLock\LockServ.exe -p [?]
S2 NcpSec;NcpSec;c:\programme\Funkwerk Secure IPSec Client\NCPSEC.EXE [08.02.2010 16:40 32768]
S2 Network Management Utility Service;Network Management Utility;c:\programme\Network Management Utility\JavaService.exe -ms4m -mx32m --> c:\programme\Network Management Utility\JavaService.exe -ms4m -mx32m [?]
S2 rwsrsu;RwsRsu;c:\programme\Funkwerk Secure IPSec Client\rwsrsu.exe [08.02.2010 16:40 819712]
S2 StarMoney 7.0 OnlineUpdate;StarMoney 7.0 OnlineUpdate;c:\programme\StarMoney 7.0\ouservice\StarMoneyOnlineUpdate.exe [25.06.2010 19:17 541192]
S3 Acer ODDSpeedControl;Acer ODDSpeedControl;c:\acer\Empowering Technology\eAcoustics\ODDSpeedCtl\speedcontrol.exe [12.11.2008 14:12 81920]
S3 cjusb;REINER SCT cyberJack pinpad/e-com USB;c:\windows\system32\drivers\cjusb.sys [12.11.2008 15:54 23040]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\programme\Gemeinsame Dateien\MAGIX Services\Database\bin\fbserver.exe [07.08.2008 10:10 3276800]
S3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\programme\Google\Google Desktop Search\GoogleDesktop.exe [02.12.2008 15:21 30192]
S3 NcpFilt;Ncp Filter Service;c:\windows\system32\drivers\ncpvaxp.sys [08.02.2010 16:40 81224]
S3 ncpvaxp;NCP Secure Client Virtual Adapter Driver;c:\windows\system32\drivers\ncpvaxp.sys [08.02.2010 16:40 81224]

--- Andere Dienste/Treiber im Speicher ---

*Deregistered* - Ndisprot.sys

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt        REG_MULTI_SZ          hpqcxs08
.
Inhalt des "geplante Tasks" Ordners

2010-09-27 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\programme\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]

2010-10-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programme\Google\Update\GoogleUpdate.exe [2010-01-30 16:23]

2010-10-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programme\Google\Update\GoogleUpdate.exe [2010-01-30 16:23]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = about:blank
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2010-10-25 20:10
Windows 5.1.2600 Service Pack 3 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, hxxp://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe catchme.sys CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8A355446]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xba0ecf28
\Driver\ACPI -> ACPI.sys @ 0xb9f7ecb8
\Driver\atapi -> atapi.sys @ 0xb9f10852
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8
 ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
 SecurityProcedure -> ntkrnlpa.exe @ 0x80583d4a
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8
 ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
 SecurityProcedure -> ntkrnlpa.exe @ 0x80583d4a
NDIS: NVIDIA nForce Networking Controller -> SendCompleteHandler -> NDIS.sys @ 0xb9d09bb0
 PacketIndicateHandler -> NDIS.sys @ 0xb9cf8a0d
 SendHandler -> NDIS.sys @ 0xb9d0cb40
user & kernel MBR OK

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NIS]
"ImagePath"="\"c:\programme\Norton Internet Security\Engine\18.1.0.37\ccSvcHst.exe\" /s \"NIS\" /m \"c:\programme\Norton Internet Security\Engine\18.1.0.37\diMaster.dll\" /prefetch:1"
.
Zeit der Fertigstellung: 2010-10-25  20:13:38
ComboFix-quarantined-files.txt  2010-10-25 18:13
ComboFix2.txt  2010-10-25 13:58

Vor Suchlauf: 17 Verzeichnis(se), 78.197.252.096 Bytes frei
Nach Suchlauf: 18 Verzeichnis(se), 78.187.622.400 Bytes frei

- - End Of File - - C3A65560AC41BCC37F6C5EABF86D9027
--- --- ---

cosinus 25.10.2010 21:30
Combofix - Scripten

1. Starte das Notepad (Start / Ausführen / notepad[Enter])

2. Jetzt füge mit copy/paste den ganzen Inhalt der untenstehenden Codebox in das Notepad Fenster ein.

Hinweis: Falls Du Deinen Benutzernamen unkenntlich gemacht hast, musst Du das Ausgesternte in Deinen richtigen Benutzernamen wieder verwandeln, sonst funktioniert das Script nicht!!

Code:
File::
c:\windows\system32\cdinnsvr.dll
3. Speichere im Notepad als CFScript.txt auf dem Desktop.

4. Deaktivere den Guard Deines Antivirenprogramms und eine eventuell vorhandene Software Firewall.
(Auch Guards von Ad-, Spyware Programmen und den Tea Timer (wenn vorhanden) !)

5. Dann ziehe die CFScript.txt auf die cofi.exe, so wie es im unteren Bild zu sehen ist. Damit wird Combofix neu gestartet.

http://users.pandora.be/bluepatchy/m...s/CFScript.gif

6. Nach dem Neustart (es wird gefragt ob Du neustarten willst), poste bitte die folgenden Log Dateien:
Combofix.txt

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

desos 25.10.2010 22:35
Vorgehensweise wie beim letzten Mal. Logfile nachfolgend:

[CODE]
Combofix Logfile:
Code:
ComboFix 10-10-24.05 - User 25.10.2010  23:17:27.3.2 - x86
Microsoft Windows XP Professional  5.1.2600.3.1252.49.1031.18.1791.1313 [GMT 2:00]
ausgeführt von:: c:\dokumente und einstellungen\All Users\Desktop\MFtools\trojanerboard_tip4\cofi.exe
Benutzte Befehlsschalter :: c:\dokumente und einstellungen\All Users\Desktop\MFtools\trojanerboard_tip4\CFScript.txt
AV: Norton Internet Security *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: FEC Secure IPSec Client Firewall *disabled* {33F684F9-95EF-4FC3-9196-012CF0A4D310}
FW: Norton Internet Security *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}

FILE ::
"c:\windows\system32\cdinnsvr.dll"
.

((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\cdinnsvr.dll

.
(((((((((((((((((((((((  Dateien erstellt von 2010-09-25 bis 2010-10-25  ))))))))))))))))))))))))))))))
.

2010-10-25 13:16 . 2010-10-25 13:16        --------        d-----w-        c:\programme\CCleaner
2010-10-24 22:03 . 2010-10-24 22:03        --------        d-----w-        C:\_OTL
2010-10-23 10:10 . 2010-10-23 10:11        --------        d-----w-        c:\programme\ERUNT
2010-10-22 22:15 . 2010-10-22 22:15        --------        d-sh--w-        c:\dokumente und einstellungen\Administrator\IETldCache
2010-10-22 20:26 . 2010-07-13 01:20        369072        ----a-r-        c:\windows\system32\drivers\symtdi.sys
2010-10-22 20:26 . 2010-07-29 03:33        666672        ----a-r-        c:\windows\system32\drivers\SymEFA.sys
2010-10-22 20:26 . 2010-07-29 02:54        50096        ----a-r-        c:\windows\system32\drivers\srtspx.sys
2010-10-22 20:26 . 2010-06-27 04:05        134704        ----a-r-        c:\windows\system32\drivers\Ironx86.sys
2010-10-22 20:26 . 2010-06-13 10:50        339504        ----a-r-        c:\windows\system32\drivers\SymDS.sys
2010-10-22 20:26 . 2010-10-22 20:28        --------        d-----w-        c:\windows\system32\drivers\NIS\1201000.025
2010-10-22 11:19 . 2010-04-29 13:39        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys
2010-10-22 11:19 . 2010-04-29 13:39        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys
2010-10-20 19:31 . 2010-10-20 19:31        --------        d-----r-        c:\dokumente und einstellungen\LocalService\Favoriten
2010-10-20 08:13 . 2010-10-20 08:13        --------        d-----w-        c:\dokumente und einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\Adobe
2010-10-19 16:06 . 2010-10-19 16:06        --------        d-sh--w-        c:\dokumente und einstellungen\LocalService\IETldCache
2010-10-18 17:31 . 2010-10-18 17:31        --------        d-----w-        c:\programme\Gemeinsame Dateien\Adobe
2010-10-18 16:41 . 2010-10-18 16:41        --------        d-----r-        c:\dokumente und einstellungen\NetworkService\Favoriten
2010-10-17 20:27 . 2010-10-17 20:27        --------        d-sh--w-        c:\dokumente und einstellungen\NetworkService\IETldCache
2010-10-14 09:38 . 2010-09-18 06:52        974848        -c----w-        c:\windows\system32\dllcache\mfc42.dll
2010-10-14 09:38 . 2010-09-18 06:52        953856        -c----w-        c:\windows\system32\dllcache\mfc40u.dll
2010-10-14 09:38 . 2010-08-23 16:11        617472        -c----w-        c:\windows\system32\dllcache\comctl32.dll
2010-09-27 13:56 . 2010-09-27 13:56        --------        d-----w-        c:\programme\iPod
2010-09-27 13:56 . 2010-09-27 13:57        --------        d-----w-        c:\programme\iTunes
2010-09-27 13:54 . 2010-09-27 13:54        159744        ----a-w-        c:\programme\Internet Explorer\PLUGINS\npqtplugin7.dll
2010-09-27 13:54 . 2010-09-27 13:54        159744        ----a-w-        c:\programme\Internet Explorer\PLUGINS\npqtplugin6.dll
2010-09-27 13:54 . 2010-09-27 13:54        159744        ----a-w-        c:\programme\Internet Explorer\PLUGINS\npqtplugin5.dll
2010-09-27 13:54 . 2010-09-27 13:54        159744        ----a-w-        c:\programme\Internet Explorer\PLUGINS\npqtplugin4.dll
2010-09-27 13:54 . 2010-09-27 13:54        159744        ----a-w-        c:\programme\Internet Explorer\PLUGINS\npqtplugin3.dll
2010-09-27 13:54 . 2010-09-27 13:54        159744        ----a-w-        c:\programme\Internet Explorer\PLUGINS\npqtplugin2.dll
2010-09-27 13:54 . 2010-09-27 13:54        159744        ----a-w-        c:\programme\Internet Explorer\PLUGINS\npqtplugin.dll
2010-09-27 13:53 . 2010-09-27 13:54        --------        d-----w-        c:\programme\QuickTime
2010-09-27 13:52 . 2010-09-27 13:52        --------        d-----w-        c:\programme\Bonjour

.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-22 20:27 . 2009-01-14 15:10        60808        ----a-w-        c:\windows\system32\S32EVNT1.DLL
2010-10-22 20:27 . 2009-01-14 15:10        126512        ----a-w-        c:\windows\system32\drivers\SYMEVENT.SYS
2010-09-18 10:22 . 2006-12-14 13:45        974848        ----a-w-        c:\windows\system32\mfc42u.dll
2010-09-18 06:52 . 2006-11-01 19:17        953856        ----a-w-        c:\windows\system32\mfc40u.dll
2010-09-18 06:52 . 2004-08-04 04:00        974848        ----a-w-        c:\windows\system32\mfc42.dll
2010-09-18 06:52 . 2004-08-04 04:00        954368        ----a-w-        c:\windows\system32\mfc40.dll
2010-09-10 05:47 . 2007-04-18 12:44        916480        ----a-w-        c:\windows\system32\wininet.dll
2010-09-10 05:47 . 2004-08-04 04:00        43520        ----a-w-        c:\windows\system32\licmgr10.dll
2010-09-10 05:47 . 2004-08-04 04:00        1469440        ------w-        c:\windows\system32\inetcpl.cpl
2010-09-08 09:17 . 2010-09-08 09:17        94208        ----a-w-        c:\windows\system32\QuickTimeVR.qtx
2010-09-08 09:17 . 2010-09-08 09:17        69632        ----a-w-        c:\windows\system32\QuickTime.qts
2010-09-05 07:23 . 2010-09-05 07:24        73728        ----a-w-        c:\windows\system32\javacpl.cpl
2010-09-05 07:23 . 2010-09-05 07:24        411368        ----a-w-        c:\windows\system32\deploytk.dll
2010-09-01 11:50 . 2004-08-04 04:00        285824        ----a-w-        c:\windows\system32\atmfd.dll
2010-09-01 07:54 . 2007-03-08 15:32        1852928        ----a-w-        c:\windows\system32\win32k.sys
2010-08-27 08:01 . 2005-10-17 21:20        119808        ----a-w-        c:\windows\system32\t2embed.dll
2010-08-27 05:57 . 2004-12-07 19:33        99840        ----a-w-        c:\windows\system32\srvsvc.dll
2010-08-27 01:43 . 2010-07-22 06:19        5632        ----a-w-        c:\windows\system32\xpsp4res.dll
2010-08-26 13:39 . 2005-05-10 00:17        357248        ----a-w-        c:\windows\system32\drivers\srv.sys
2010-08-23 16:11 . 2004-08-04 04:00        617472        ----a-w-        c:\windows\system32\comctl32.dll
2010-08-17 13:17 . 2005-06-10 23:53        58880        ----a-w-        c:\windows\system32\spoolsv.exe
2010-08-16 08:44 . 2004-08-04 04:00        590848        ----a-w-        c:\windows\system32\rpcrt4.dll
.

(((((((((((((((((((((((((((((  SnapShot@2010-10-25_18.10.59  )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-10-25 21:14 . 2010-10-25 21:14        16384              c:\windows\temp\Perflib_Perfdata_888.dat
+ 2010-10-25 21:13 . 2010-10-25 21:13        16384              c:\windows\temp\Perflib_Perfdata_78c.dat
+ 2010-10-25 21:13 . 2010-10-25 21:13        16384              c:\windows\temp\Perflib_Perfdata_49c.dat
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PC Suite Tray"="c:\programme\Nokia\Nokia PC Suite 7\PCSuite.exe" [2009-06-25 1414144]
"swg"="c:\programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-01-26 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LaunchApp"="Alaunch" [X]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-11-28 8491008]
"nwiz"="nwiz.exe" [2007-11-28 1626112]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-11-28 81920]
"RTHDCPL"="RTHDCPL.EXE" [2008-01-29 16859648]
"AzMixerSel"="c:\programme\Realtek\Audio\InstallShield\AzMixerSel.exe" [2006-07-17 53248]
"Acer Empowering Technology Monitor"="c:\windows\system32\SysMonitor.exe" [2008-01-03 49152]
"eLockMonitor"="c:\acer\Empowering Technology\eLock\Monitor\LaunchMonitor.exe" [2006-03-31 16384]
"eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2007-09-28 342528]
"FLMBROWSEMOUSE"="c:\programme\Browser PS2 mouse\mouse32a.exe" [2008-11-12 360448]
"FLMK08KB"="c:\programme\Multimedia keyboard utility\1.3\MMKEYBD.EXE" [2008-11-12 207360]
"Google Desktop Search"="c:\programme\Google\Google Desktop Search\GoogleDesktop.exe" [2010-06-26 30192]
"SunJavaUpdateSched"="c:\programme\Java\jre6\bin\jusched.exe" [2010-09-05 149280]
"HP Software Update"="c:\programme\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152]
"AppleSyncNotifier"="c:\programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-09-08 47904]
"NcpBudgetGui"="c:\programme\Funkwerk Secure IPSec Client\NcpBudgetGui.exe" [2009-11-05 968192]
"NcpPopup"="c:\programme\Funkwerk Secure IPSec Client\ncppopup.exe" [2009-08-26 578560]
"NcpMonitor"="c:\programme\Funkwerk Secure IPSec Client\ncpmon.exe" [2009-11-23 6587904]
"NcpRsuGui"="c:\programme\Funkwerk Secure IPSec Client\rwsrsu.exe" [2009-10-12 819712]
"IntelliPoint"="c:\programme\Microsoft IntelliPoint\ipoint.exe" [2009-11-11 1468256]
"QuickTime Task"="c:\programme\QuickTime\qttask.exe" [2010-09-08 421888]
"iTunesHelper"="c:\programme\iTunes\iTunesHelper.exe" [2010-09-24 421160]
"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM"="c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 59392]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"IMEKRMIG6.1"="c:\windows\ime\imkr6_1\IMEKRMIG.EXE" [2004-08-04 44032]
"eRecoveryService"="c:\acer\Empowering Technology\eRecovery\eRAgent.exe" [2007-07-11 421888]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\GEMEIN~1\MICROS~1\DW\dwtrig20.exe" [2008-11-03 435096]

c:\dokumente und einstellungen\All Users\Startmen\Programme\Autostart\
VR-NetWorld Auftragsprfung.lnk - c:\programme\VR-NetWorld\vrtoolcheckorder.exe [2008-11-12 565248]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute        REG_MULTI_SZ          \0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programme\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Downloads\\Fernwartung\\server.exe"=
"c:\\Programme\\ICQ6.5\\ICQ.exe"=
"c:\\Programme\\StarMoney 7.0\\ouservice\\StarMoneyOnlineUpdate.exe"=
"c:\\Programme\\StarMoney 7.0\\app\\StarMoney.exe"=
"c:\\Programme\\Bonjour\\mDNSResponder.exe"=
"c:\\Programme\\iTunes\\iTunes.exe"=

R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NIS\1201000.025\SymDS.sys [22.10.2010 22:26 339504]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NIS\1201000.025\SymEFA.sys [22.10.2010 22:26 666672]
R1 BHDrvx86;BHDrvx86;c:\dokumente und einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20101001.001\BHDrvx86.sys [01.09.2010 00:57 692272]
R1 bizVSerial;Franson VSerial;c:\windows\system32\drivers\bizVSerialNT.sys [12.11.2008 15:54 14949]
R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NIS\1201000.025\Ironx86.sys [22.10.2010 22:26 134704]
R2 cjpcsc;cyberJack PC/SC COM Service ;c:\windows\system32\cjpcsc.exe [12.11.2008 15:54 668976]
R2 eLock2BurnerLockDriver;eLock2BurnerLockDriver;c:\windows\system32\eLock2BurnerLockDriver.sys [08.06.2006 17:54 17664]
R2 eLock2FSCTLDriver;eLock2FSCTLDriver;c:\windows\system32\eLock2FSCTLDriver.sys [06.06.2006 18:36 90112]
R2 Fabs;FABS - Helping agent for MAGIX media database;c:\programme\Gemeinsame Dateien\MAGIX Services\Database\bin\FABS.exe [03.02.2009 14:53 1155072]
R2 ICQ Service;ICQ Service;c:\programme\ICQ6Toolbar\ICQ Service.exe [21.10.2009 17:35 222968]
R2 ncpclcfg;ncpclcfg;c:\programme\Funkwerk Secure IPSec Client\ncpclcfg.exe [08.02.2010 16:40 86016]
R2 ncprwsnt;ncprwsnt;c:\programme\Funkwerk Secure IPSec Client\NCPRWSNT.EXE [08.02.2010 16:40 1085960]
R2 NIS;Norton Internet Security;c:\programme\Norton Internet Security\Engine\18.1.0.37\ccSvcHst.exe [22.10.2010 22:26 126904]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\programme\Gemeinsame Dateien\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [23.10.2010 10:08 102448]
R3 IDSxpx86;IDSxpx86;c:\dokumente und einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20101021.003\IDSXpx86.sys [19.10.2010 22:36 341880]
R3 NcpFiltMP;NcpFiltMP;c:\windows\system32\drivers\ncpvaxp.sys [08.02.2010 16:40 81224]
S2 gupdate;Google Update Service (gupdate);c:\programme\Google\Update\GoogleUpdate.exe [30.01.2010 18:23 135664]
S2 LockServ;LockServ;c:\acer\Empowering Technology\eLock\LockServ.exe -p --> c:\acer\Empowering Technology\eLock\LockServ.exe -p [?]
S2 NcpSec;NcpSec;c:\programme\Funkwerk Secure IPSec Client\NCPSEC.EXE [08.02.2010 16:40 32768]
S2 Network Management Utility Service;Network Management Utility;c:\programme\Network Management Utility\JavaService.exe -ms4m -mx32m --> c:\programme\Network Management Utility\JavaService.exe -ms4m -mx32m [?]
S2 rwsrsu;RwsRsu;c:\programme\Funkwerk Secure IPSec Client\rwsrsu.exe [08.02.2010 16:40 819712]
S2 StarMoney 7.0 OnlineUpdate;StarMoney 7.0 OnlineUpdate;c:\programme\StarMoney 7.0\ouservice\StarMoneyOnlineUpdate.exe [25.06.2010 19:17 541192]
S3 Acer ODDSpeedControl;Acer ODDSpeedControl;c:\acer\Empowering Technology\eAcoustics\ODDSpeedCtl\speedcontrol.exe [12.11.2008 14:12 81920]
S3 cjusb;REINER SCT cyberJack pinpad/e-com USB;c:\windows\system32\drivers\cjusb.sys [12.11.2008 15:54 23040]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\programme\Gemeinsame Dateien\MAGIX Services\Database\bin\fbserver.exe [07.08.2008 10:10 3276800]
S3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\programme\Google\Google Desktop Search\GoogleDesktop.exe [02.12.2008 15:21 30192]
S3 NcpFilt;Ncp Filter Service;c:\windows\system32\drivers\ncpvaxp.sys [08.02.2010 16:40 81224]
S3 ncpvaxp;NCP Secure Client Virtual Adapter Driver;c:\windows\system32\drivers\ncpvaxp.sys [08.02.2010 16:40 81224]

--- Andere Dienste/Treiber im Speicher ---

*Deregistered* - Ndisprot.sys

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt        REG_MULTI_SZ          hpqcxs08
.
Inhalt des "geplante Tasks" Ordners

2010-09-27 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\programme\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]

2010-10-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programme\Google\Update\GoogleUpdate.exe [2010-01-30 16:23]

2010-10-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programme\Google\Update\GoogleUpdate.exe [2010-01-30 16:23]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = about:blank
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2010-10-25 23:27
Windows 5.1.2600 Service Pack 3 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, hxxp://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe catchme.sys CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8A326446]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xba0ecf28
\Driver\ACPI -> ACPI.sys @ 0xb9f7ecb8
\Driver\atapi -> atapi.sys @ 0xb9f10852
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8
 ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
 SecurityProcedure -> ntkrnlpa.exe @ 0x80583d4a
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8
 ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
 SecurityProcedure -> ntkrnlpa.exe @ 0x80583d4a
NDIS: NVIDIA nForce Networking Controller -> SendCompleteHandler -> NDIS.sys @ 0xb9d09bb0
 PacketIndicateHandler -> NDIS.sys @ 0xb9cf8a0d
 SendHandler -> NDIS.sys @ 0xb9d0cb40
user & kernel MBR OK

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NIS]
"ImagePath"="\"c:\programme\Norton Internet Security\Engine\18.1.0.37\ccSvcHst.exe\" /s \"NIS\" /m \"c:\programme\Norton Internet Security\Engine\18.1.0.37\diMaster.dll\" /prefetch:1"
.
Zeit der Fertigstellung: 2010-10-25  23:30:21
ComboFix-quarantined-files.txt  2010-10-25 21:30
ComboFix2.txt  2010-10-25 18:13
ComboFix3.txt  2010-10-25 13:58

Vor Suchlauf: 17 Verzeichnis(se), 78.180.626.432 Bytes frei
Nach Suchlauf: 18 Verzeichnis(se), 78.168.948.736 Bytes frei

- - End Of File - - FD089508316B760D1DD187A42C9182DB
--- --- ---

cosinus 27.10.2010 08:24
Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten. GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus

Downloade Dir anschließend bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.
  • Doppelklick auf die MBRCheck.exe.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Das Tool braucht nur eine Sekunde.
  • Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.
Poste mir bitte den Inhalt des .txt Dokumentes

desos 27.10.2010 11:38
Dankeschön. Nachfolgend die gewünschten Logs



GMER Logfile:
Code:
GMER 1.0.15.15477 - hxxp://www.gmer.net
Rootkit scan 2010-10-27 11:49:42
Windows 5.1.2600 Service Pack 3
Running: f838zelx.exe; Driver: C:\DOKUME~1\User\LOKALE~1\Temp\kfniqfog.sys


---- System - GMER 1.0.15 ----

SSDT            89CCB150                                                                                                                                                ZwAlertResumeThread
SSDT            89CCC6E0                                                                                                                                                ZwAlertThread
SSDT            89D9C478                                                                                                                                                ZwAllocateVirtualMemory
SSDT            89D47BA0                                                                                                                                                ZwAssignProcessToJobObject
SSDT            8A0E2528                                                                                                                                                ZwConnectPort
SSDT            \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation)                                                              ZwCreateKey [0xAFFDF720]
SSDT            89AD50C8                                                                                                                                                ZwCreateMutant
SSDT            89AA7E90                                                                                                                                                ZwCreateSymbolicLinkObject
SSDT            89DC9818                                                                                                                                                ZwCreateThread
SSDT            8A07B738                                                                                                                                                ZwDebugActiveProcess
SSDT            \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation)                                                              ZwDeleteKey [0xAFFDF9A0]
SSDT            \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation)                                                              ZwDeleteValueKey [0xAFFDFF00]
SSDT            89D91218                                                                                                                                                ZwDuplicateObject
SSDT            89D8AD48                                                                                                                                                ZwFreeVirtualMemory
SSDT            89CC9008                                                                                                                                                ZwImpersonateAnonymousToken
SSDT            89CCA5D8                                                                                                                                                ZwImpersonateThread
SSDT            89CC57E0                                                                                                                                                ZwLoadDriver
SSDT            89DCB1C0                                                                                                                                                ZwMapViewOfSection
SSDT            89CC9C10                                                                                                                                                ZwOpenEvent
SSDT            89DB1A08                                                                                                                                                ZwOpenProcess
SSDT            89CCE168                                                                                                                                                ZwOpenProcessToken
SSDT            89D61FD0                                                                                                                                                ZwOpenSection
SSDT            89DA7280                                                                                                                                                ZwOpenThread
SSDT            88EB76E8                                                                                                                                                ZwProtectVirtualMemory
SSDT            89CCD0F0                                                                                                                                                ZwResumeThread
SSDT            89CCD928                                                                                                                                                ZwSetContextThread
SSDT            89D90B50                                                                                                                                                ZwSetInformationProcess
SSDT            89D5D1E0                                                                                                                                                ZwSetSystemInformation
SSDT            \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation)                                                              ZwSetValueKey [0xAFFE0150]
SSDT            895B46D0                                                                                                                                                ZwSuspendProcess
SSDT            89CCD268                                                                                                                                                ZwSuspendThread
SSDT            89CCF9C8                                                                                                                                                ZwTerminateProcess
SSDT            89CCD710                                                                                                                                                ZwTerminateThread
SSDT            89CCDB40                                                                                                                                                ZwUnmapViewOfSection
SSDT            89D8FC20                                                                                                                                                ZwWriteVirtualMemory

Code            \??\C:\DOKUME~1\User\LOKALE~1\Temp\catchme.sys                                                                                                          pIofCallDriver

---- Kernel code sections - GMER 1.0.15 ----

.text          ntkrnlpa.exe!ZwCallbackReturn + 2E08                                                                                                                    805046A4 4 Bytes  CALL 6CD9321F
.text          C:\WINDOWS\system32\DRIVERS\nv4_mini.sys                                                                                                                section is writeable [0xB70A8360, 0x30AD87, 0xE8000020]
?              C:\DOKUME~1\User\LOKALE~1\Temp\mbr.sys                                                                                                                  Das System kann die angegebene Datei nicht finden. !
?              C:\DOKUME~1\User\LOKALE~1\Temp\catchme.sys                                                                                                              Das System kann die angegebene Datei nicht finden. !
?              C:\WINDOWS\system32\Drivers\PROCEXP113.SYS                                                                                                              Das System kann die angegebene Datei nicht finden. !

---- User code sections - GMER 1.0.15 ----

.text          C:\WINDOWS\explorer.exe[524] ntdll.dll!NtProtectVirtualMemory                                                                                          7C91D6EE 5 Bytes  JMP 00D6000A
.text          C:\WINDOWS\explorer.exe[524] ntdll.dll!NtWriteVirtualMemory                                                                                            7C91DFAE 5 Bytes  JMP 00D7000A
.text          C:\WINDOWS\explorer.exe[524] ntdll.dll!KiUserExceptionDispatcher                                                                                        7C91E47C 5 Bytes  JMP 00D5000C
.text          C:\WINDOWS\system32\wuauclt.exe[528] ntdll.dll!NtProtectVirtualMemory                                                                                  7C91D6EE 5 Bytes  JMP 00BC000A
.text          C:\WINDOWS\system32\wuauclt.exe[528] ntdll.dll!NtWriteVirtualMemory                                                                                    7C91DFAE 5 Bytes  JMP 00BD000A
.text          C:\WINDOWS\system32\wuauclt.exe[528] ntdll.dll!KiUserExceptionDispatcher                                                                                7C91E47C 5 Bytes  JMP 00BB000C
.text          C:\WINDOWS\System32\svchost.exe[1612] ntdll.dll!NtProtectVirtualMemory                                                                                  7C91D6EE 5 Bytes  JMP 006E000A
.text          C:\WINDOWS\System32\svchost.exe[1612] ntdll.dll!NtWriteVirtualMemory                                                                                    7C91DFAE 5 Bytes  JMP 006F000A
.text          C:\WINDOWS\System32\svchost.exe[1612] ntdll.dll!KiUserExceptionDispatcher                                                                              7C91E47C 5 Bytes  JMP 006D000C
.text          C:\WINDOWS\System32\svchost.exe[1612] USER32.dll!GetCursorPos                                                                                          7E37974E 5 Bytes  JMP 00E5000A
.text          C:\WINDOWS\System32\svchost.exe[1612] ole32.dll!CoCreateInstance                                                                                        774CF1AC 5 Bytes  JMP 00E2000A

---- Devices - GMER 1.0.15 ----

Device                                                                                                                                                                  Ntfs.sys (NT File System Driver/Microsoft Corporation)
Device                                                                                                                                                                  Fastfat.SYS (Fast FAT File System Driver/Microsoft Corporation)

AttachedDevice  \Driver\Tcpip \Device\Ip                                                                                                                                SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice  \Driver\Tcpip \Device\Tcp                                                                                                                              SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)

Device          \Driver\atapi -> DriverStartIo \Device\Ide\IdePort0                                                                                                    8A326292
Device          \Driver\atapi -> DriverStartIo \Device\Ide\IdePort1                                                                                                    8A326292
Device          \Driver\atapi -> DriverStartIo \Device\Ide\IdePort2                                                                                                    8A326292
Device          \Driver\atapi -> DriverStartIo \Device\Ide\IdePort3                                                                                                    8A326292
Device          \Driver\atapi -> DriverStartIo \Device\Ide\IdeDeviceP3T0L0-10                                                                                          8A326292

AttachedDevice  \Driver\Tcpip \Device\Udp                                                                                                                              SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice  \Driver\Tcpip \Device\RawIp                                                                                                                            SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)

Device                                                                                                                                                                  mrxsmb.sys (Windows NT SMB Minirdr/Microsoft Corporation)

AttachedDevice                                                                                                                                                          fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

Device                                                                                                                                                                  Cdfs.SYS (CD-ROM File System Driver/Microsoft Corporation)
Device          \Device\Ide\IdeDeviceP2T0L0-5 -> \??\IDE#DiskWDC_WD3200AAJS-22B4A0___________________01.03A01#5&7bd0008&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}  device not found

---- EOF - GMER 1.0.15 ----
--- --- ---



OSAM-Log:

OSAM Logfile:
Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 12:19:28 on 27.10.2010

OS: Windows XP Professional Service Pack 3 (Build 2600)
Default Browser: Microsoft Corporation Internet Explorer 8.00.6001.18702

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Common]
-----( %SystemRoot%\Tasks )-----
"AppleSoftwareUpdate.job" - "Apple Inc." - C:\Programme\Apple Software Update\SoftwareUpdate.exe
"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"cjtpl.cpl" - " REINER SCT" - C:\WINDOWS\system32\cjtpl.cpl
"infocardcpl.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\infocardcpl.cpl
"javacpl.cpl" - "Sun Microsystems, Inc." - C:\WINDOWS\system32\javacpl.cpl
"nvcpl.cpl" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvcpl.cpl
"nvtuicpl.cpl" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvtuicpl.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"mlcfg32.cpl" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\MLCFG32.CPL
"NokiaConnectionManager" - "Nokia" - C:\PROGRA~1\Nokia\NOKIAP~1\CONNEC~1.CPL
"QuickTime" - "Apple Inc." - C:\Programme\QuickTime\QTSystem\QuickTime.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"Aspi32" (Aspi32) - "Adaptec" - C:\WINDOWS\System32\drivers\aspi32.sys
"BHDrvx86" (BHDrvx86) - "Symantec Corporation" - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20101001.001\BHDrvx86.sys
"catchme" (catchme) - ? - C:\DOKUME~1\User\LOKALE~1\Temp\catchme.sys  (File not found)
"Changer" (Changer) - ? - C:\WINDOWS\system32\drivers\Changer.sys  (File not found)
"eLock2BurnerLockDriver" (eLock2BurnerLockDriver) - "Windows (R) 2000 DDK provider" - C:\WINDOWS\system32\eLock2BurnerLockDriver.sys
"eLock2FSCTLDriver" (eLock2FSCTLDriver) - "Windows (R) 2000 DDK provider" - C:\WINDOWS\system32\eLock2FSCTLDriver.sys
"EraserUtilRebootDrv" (EraserUtilRebootDrv) - "Symantec Corporation" - C:\Programme\Gemeinsame Dateien\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
"Franson VSerial" (bizVSerial) - "franson.biz" - C:\WINDOWS\System32\drivers\bizVSerialNT.sys
"i2omgmt" (i2omgmt) - ? - C:\WINDOWS\system32\drivers\i2omgmt.sys  (File not found)
"IDSxpx86" (IDSxpx86) - "Symantec Corporation" - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20101021.003\IDSxpx86.sys
"int15" (int15) - "Acer, Inc." - C:\WINDOWS\system32\drivers\int15.sys
"kfniqfog" (kfniqfog) - ? - C:\DOKUME~1\User\LOKALE~1\Temp\kfniqfog.sys  (Hidden registry entry, rootkit activity | File not found)
"lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys  (File not found)
"mbr" (mbr) - ? - C:\DOKUME~1\User\LOKALE~1\Temp\mbr.sys  (Hidden registry entry, rootkit activity | File not found)
"NAVENG" (NAVENG) - "Symantec Corporation" - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20101022.025\NAVENG.SYS
"NAVEX15" (NAVEX15) - "Symantec Corporation" - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20101022.025\NAVEX15.SYS
"Ncp Filter Service" (NcpFilt) - "NCP Engineering GmbH" - C:\WINDOWS\System32\DRIVERS\ncpvaxp.sys
"NCP Secure Client Virtual Adapter Driver" (ncpvaxp) - "NCP Engineering GmbH" - C:\WINDOWS\System32\DRIVERS\ncpvaxp.sys
"NcpFiltMP" (NcpFiltMP) - "NCP Engineering GmbH" - C:\WINDOWS\System32\DRIVERS\ncpvaxp.sys
"Ndisprot.sys" (Ndisprot.sys) - "Windows (R) Codename Longhorn DDK provider" - C:\WINDOWS\system32\drivers\Ndisprot.sys
"PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys  (File not found)
"PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys  (File not found)
"PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys  (File not found)
"PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys  (File not found)
"PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys  (File not found)
"psdfilter" (psdfilter) - "HiTRUST" - C:\WINDOWS\system32\Drivers\psdfilter.sys
"psdvdisk" (psdvdisk) - "HiTRUST" - C:\WINDOWS\system32\Drivers\psdvdisk.sys
"Symantec Data Store" (SymDS) - "Symantec Corporation" - C:\WINDOWS\System32\drivers\NIS\1201000.025\SYMDS.SYS
"Symantec Eraser Control driver" (eeCtrl) - "Symantec Corporation" - C:\Programme\Gemeinsame Dateien\Symantec Shared\EENGINE\eeCtrl.sys
"Symantec Extended File Attributes" (SymEFA) - "Symantec Corporation" - C:\WINDOWS\System32\drivers\NIS\1201000.025\SYMEFA.SYS
"Symantec Iron Driver" (SymIRON) - "Symantec Corporation" - C:\WINDOWS\system32\drivers\NIS\1201000.025\Ironx86.SYS
"Symantec Network Dispatch Driver" (SYMTDI) - "Symantec Corporation" - C:\WINDOWS\system32\drivers\NIS\1201000.025\SYMTDI.SYS
"Symantec Network Filter Driver" (SYMFW) - ? - C:\WINDOWS\System32\Drivers\NIS\1007020.00B\SYMFW.SYS  (File not found)
"Symantec Network Filter Driver" (SYMIDS) - ? - C:\WINDOWS\System32\Drivers\NIS\1007020.00B\SYMIDS.SYS  (File not found)
"Symantec Network Filter Driver" (SYMNDIS) - ? - C:\WINDOWS\System32\Drivers\NIS\1007020.00B\SYMNDIS.SYS  (File not found)
"Symantec Real Time Storage Protection" (SRTSP) - "Symantec Corporation" - C:\WINDOWS\System32\Drivers\NIS\1201000.025\SRTSP.SYS
"Symantec Real Time Storage Protection (PEL)" (SRTSPX) - "Symantec Corporation" - C:\WINDOWS\system32\drivers\NIS\1201000.025\SRTSPX.SYS
"SYMDNS" (SYMDNS) - ? - C:\WINDOWS\system32\drivers\NIS\1002000.007\SYMDNS.SYS  (File not found)
"SymEvent" (SymEvent) - "Symantec Corporation" - C:\WINDOWS\system32\Drivers\SYMEVENT.SYS
"SYMREDRV" (SYMREDRV) - ? - C:\WINDOWS\system32\drivers\NIS\1002000.007\SYMREDRV.SYS  (File not found)
"tvicport" (tvicport) - "EnTech Taiwan" - C:\WINDOWS\system32\drivers\tvicport.sys
"Upper Class Filter Driver" (NTIDrvr) - "NewTech Infosystems, Inc." - C:\WINDOWS\System32\DRIVERS\NTIDrvr.sys
"WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys  (File not found)
"zntport" (zntport) - "Zeal SoftStudio" - C:\WINDOWS\system32\drivers\zntport.sys

[Explorer]
-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----
{89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{32505114-5902-49B2-880A-1F7738E5A384} "Data Page Plugable Protocal mso-offdap11 Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBCOM~1\11\OWC11.DLL
{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{653DCCC2-13DB-45B2-A389-427885776CFE} "Activities Property Page" - "Microsoft Corporation" - C:\Programme\Microsoft IntelliPoint\ipcplact.dll
{124597D8-850A-41AE-849C-017A4FA99CA2} "Buttons Property Page" - "Microsoft Corporation" - C:\Programme\Microsoft IntelliPoint\ipcplbtn.dll
{42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? - deskpan.dll  (File not found)
{1CDB2949-8F65-4355-8456-263E7C208A5D} "Desktop Explorer" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll
{1E9B04FB-F9E5-4718-997B-B8DA88302A47} "Desktop Explorer Menu" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll
{88895560-9AA2-1069-930E-00AA0030EBC8} "Erweiterung für HyperTerminal-Icons" - ? -  (File not found | COM-object registry key not found)
{1D2680C9-0E2A-469d-B787-065558BC7D43} "Fusion Cache" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{3BEABCC1-BF31-42df-88D9-A2955D6B8528} "IntelliPoint Sensitivity Property Page" - "Microsoft Corporation" - C:\Programme\Microsoft IntelliPoint\ipcplsens.dll
{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Programme\iTunes\iTunesMiniPlayer.dll
{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? -  (File not found | COM-object registry key not found)
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office12\msohevi.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll
{00020D75-0000-0000-C000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\MLSHEXT.DLL
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll
{416651E4-9C3C-11D9-8BDE-F66BAD1E3F3A} "Nokia Phone Browser" - "Nokia" - C:\Programme\Nokia\Nokia PC Suite 7\PhoneBrowser.dll
{1E9B04FB-F9E5-4718-997B-B8DA88302A48} "nView Desktop Context Menu" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll
{0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\OLKFSTUB.DLL
{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll
{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? -  (File not found | COM-object registry key not found)
{e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll
{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Web Folders" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\MSONSEXT.DLL
{AF90F543-6A3A-4C1B-8B16-ECEC073E69BE} "Wheel Property Page" - "Microsoft Corporation" - C:\Programme\Microsoft IntelliPoint\ipcplwhl.dll
{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - ? - C:\Programme\WinRAR\rarext.dll
{20082881-FC36-4E47-9A7A-644C95FF749F} "Wireless Property Page" - "Microsoft Corporation" - C:\Programme\Microsoft IntelliPoint\ipcplwir.dll

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "Google Toolbar" - "Google Inc." - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll
ITBar7Height "ITBar7Height" - ? -  (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? -  (File not found | COM-object registry key not found)
<binary data> "Norton Toolbar" - "Symantec Corporation" - C:\Programme\Norton Internet Security\Engine\18.1.0.37\coIEPlg.dll
<binary data> "{EF99BD32-C1FB-11D2-892F-0090271D4F88}" - ? -  (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA} "Java Plug-in 1.4.2_05" - "JavaSoft / Sun Microsystems, Inc." - C:\Programme\Java\j2re1.4.2_05\bin\npjpi142_05.dll / hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_17" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_17.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} "Java Plug-in 1.6.0_17" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_17.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_17" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_17.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
{166B1BCA-3F9C-11CF-8075-444553540000} "Shockwave ActiveX Control" - "Adobe Systems, Inc." - C:\WINDOWS\system32\Adobe\Director\SwDir.dll / hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
{E2883E8F-472F-4FB0-9522-AC9BF37916A7} "{E2883E8F-472F-4FB0-9522-AC9BF37916A7}" - ? -  (File not found | COM-object registry key not found) / hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
"ICQ6" - "ICQ, LLC." - C:\Programme\ICQ6.5\ICQ.exe
{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
<binary data> "Acer eDataSecurity Management" - "HiTRUST" - C:\WINDOWS\system32\eDStoolbar.dll
<binary data> "Google Toolbar" - "Google Inc." - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll
{855F3B16-6D32-4fe6-8A56-BBB695989046} "ICQToolBar" - "ICQ" - C:\Programme\ICQ6Toolbar\ICQToolBar.dll
{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} "Norton Toolbar" - "Symantec Corporation" - C:\Programme\Norton Internet Security\Engine\18.1.0.37\coIEPlg.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
{AA58ED58-01DD-4d91-8333-CF10577473F7} "Google Toolbar Helper" - "Google Inc." - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} "Google Toolbar Notifier BHO" - "Google Inc." - C:\Programme\Google\GoogleToolbarNotifier\5.6.5612.1312\swg.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jp2ssv.dll
{E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
{6D53EC84-6AAE-4787-AEEE-F4628F01010C} "Symantec Intrusion Prevention" - "Symantec Corporation" - C:\Programme\Norton Internet Security\Engine\18.1.0.37\IPSBHO.DLL
{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} "Symantec NCO BHO" - "Symantec Corporation" - C:\Programme\Norton Internet Security\Engine\18.1.0.37\coIEPlg.dll
{02478D38-C3F9-4efb-9B51-7695ECA05670} "{02478D38-C3F9-4efb-9B51-7695ECA05670}" - ? -  (File not found | COM-object registry key not found)

[Logon]
-----( %AllUsersProfile%\Startmenü\Programme\Autostart )-----
"desktop.ini" - ? - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini
"VR-NetWorld Auftragsprüfung.lnk" - "VR-NetWorld Software" - C:\Programme\VR-NetWorld\VRToolCheckOrder.exe  (Shortcut exists | File exists)
-----( %UserProfile%\Startmenü\Programme\Autostart )-----
"desktop.ini" - ? - C:\Dokumente und Einstellungen\User\Startmenü\Programme\Autostart\desktop.ini
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"PC Suite Tray" - "Nokia" - "C:\Programme\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
"swg" - "Google Inc." - "C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"Acer Empowering Technology Monitor" - " " - C:\WINDOWS\system32\SysMonitor.exe
"Adobe ARM" - "Adobe Systems Incorporated" - "C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe"
"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"AppleSyncNotifier" - "Apple Inc." - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleSyncNotifier.exe
"AzMixerSel" - "Realtek Semiconductor Corp." - C:\Programme\Realtek\Audio\InstallShield\AzMixerSel.exe
"eDataSecurity Loader" - "HiTRUST" - C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 0
"eLockMonitor" - " " - C:\Acer\Empowering Technology\eLock\Monitor\LaunchMonitor.exe
"eRecoveryService" - "Acer Inc." - C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
"FLMBROWSEMOUSE" - ? - C:\Programme\Browser PS2 mouse\mouse32a.exe
"FLMK08KB" - ? - C:\Programme\Multimedia keyboard utility\1.3\MMKEYBD.EXE
"Google Desktop Search" - "Google" - "C:\Programme\Google\Google Desktop Search\GoogleDesktop.exe" /startup
"HP Software Update" - "Hewlett-Packard Co." - C:\Programme\HP\HP Software Update\HPWuSchd2.exe
"IntelliPoint" - "Microsoft Corporation" - "C:\Programme\Microsoft IntelliPoint\ipoint.exe"
"iTunesHelper" - "Apple Inc." - "C:\Programme\iTunes\iTunesHelper.exe"
"LaunchApp" - "Acer Inc." - Alaunch
"MSPY2002" - ? - C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC  (File signed by Microsoft | File found, but it contains no detailed information)
"NcpBudgetGui" - ? - "C:\Programme\Funkwerk Secure IPSec Client\NcpBudgetGui.exe" -start  (File found, but it contains no detailed information)
"NcpMonitor" - "NCP engineering GmbH" - "C:\Programme\Funkwerk Secure IPSec Client\ncpmon.exe" autorun
"NcpPopup" - ? - "C:\Programme\Funkwerk Secure IPSec Client\ncppopup.exe" noerrmsg  (File found, but it contains no detailed information)
"NcpRsuGui" - ? - "C:\Programme\Funkwerk Secure IPSec Client\rwsrsu.exe" -gui  (File found, but it contains no detailed information)
"nwiz" - "NVIDIA Corporation" - nwiz.exe /install
"QuickTime Task" - "Apple Inc." - "C:\Programme\QuickTime\qttask.exe" -atboottime
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Programme\Java\jre6\bin\jusched.exe"

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"Microsoft Shared Fax Monitor" - ? - FXSMON.DLL  (File not found)

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
".NET Runtime Optimization Service v2.0.50727_X86" (clr_optimization_v2.0.50727_32) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
"Acer ODDSpeedControl" (Acer ODDSpeedControl) - "TODO: <公司名稱>" - C:\Acer\Empowering Technology\eAcoustics\ODDSpeedCtl\speedcontrol.exe
"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe
"ASP.NET-Zustandsdienst" (aspnet_state) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
"cyberJack PC/SC COM Service " (cjpcsc) - "REINER SCT" - C:\WINDOWS\system32\cjpcsc.exe
"Dienst "Bonjour"" (Bonjour Service) - "Apple Inc." - C:\Programme\Bonjour\mDNSResponder.exe
"FABS - Helping agent for MAGIX media database" (Fabs) - "MAGIX AG" - C:\Programme\Gemeinsame Dateien\MAGIX Services\Database\bin\FABS.exe
"Firebird Server - MAGIX Instance" (FirebirdServerMAGIXInstance) - "MAGIX®" - C:\Programme\Gemeinsame Dateien\MAGIX Services\Database\bin\fbserver.exe
"Google Desktop Manager 5.9.1005.12335" (GoogleDesktopManager-051210-111108) - "Google" - C:\Programme\Google\Google Desktop Search\GoogleDesktop.exe
"Google Software Updater" (gusvc) - "Google" - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe
"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe
"hpqcxs08" (hpqcxs08) - "Hewlett-Packard Co." - C:\Programme\HP\Digital Imaging\bin\hpqcxs08.dll
"ICQ Service" (ICQ Service) - ? - C:\Programme\ICQ6Toolbar\ICQ Service.exe
"InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1150\Intel 32\IDriverT.exe
"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Programme\iPod\bin\iPodService.exe
"Java Quick Starter" (JavaQuickStarterService) - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jqs.exe
"LightScribeService Direct Disc Labeling Service" (LightScribeService) - "Hewlett-Packard Company" - c:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
"LiveUpdate" (LiveUpdate) - "Symantec Corporation" - C:\Programme\Symantec\LiveUpdate\LuComServer_3_4.EXE
"LockServ" (LockServ) - ? - C:\Acer\Empowering Technology\eLock\LockServ.exe  (File found, but it contains no detailed information)
"Memory Check Service" (AcerMemUsageCheckService) - "Acer Inc." - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE
"ncpclcfg" (ncpclcfg) - "NCP engineering GmbH" - C:\Programme\Funkwerk Secure IPSec Client\ncpclcfg.exe
"ncprwsnt" (ncprwsnt) - "NCP Engineering GmbH" - C:\Programme\Funkwerk Secure IPSec Client\ncprwsnt.exe
"NcpSec" (NcpSec) - ? - C:\Programme\Funkwerk Secure IPSec Client\ncpsec.exe  (File found, but it contains no detailed information)
"Network Management Utility" (Network Management Utility Service) - ? - C:\Programme\Network Management Utility\JavaService.exe  (File found, but it contains no detailed information)
"Norton Internet Security" (NIS) - "Symantec Corporation" - C:\Programme\Norton Internet Security\Engine\18.1.0.37\ccSvcHst.exe
"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE
"RwsRsu" (rwsrsu) - ? - C:\Programme\Funkwerk Secure IPSec Client\rwsrsu.exe  (File found, but it contains no detailed information)
"ServiceLayer" (ServiceLayer) - "Nokia." - C:\Programme\PC Connectivity Solution\ServiceLayer.exe
"SQL Server (MSSMLBIZ)" (MSSQL$MSSMLBIZ) - "Microsoft Corporation" - C:\Programme\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
"SQL Server VSS Writer" (SQLWriter) - "Microsoft Corporation" - C:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe
"SQL Server-Startdienst für Business Contact Manager" (BcmSqlStartupSvc) - "Microsoft Corporation" - C:\Programme\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
"StarMoney 7.0 OnlineUpdate" (StarMoney 7.0 OnlineUpdate) - "Star Finanz - Software Entwicklung und Vertriebs GmbH" - C:\Programme\StarMoney 7.0\ouservice\StarMoneyOnlineUpdate.exe
"Windows CardSpace" (idsvc) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
"Windows Presentation Foundation Font Cache 3.0.0.0" (FontCache3.0.0.0) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe

[Winlogon]
-----( HKCU\Control Panel\IOProcs )-----
"MVB" - ? - mvfs32.dll  (File not found)
-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )-----
"WgaLogon" - "Microsoft Corporation" - C:\WINDOWS\system32\WgaLogon.dll

[Winsock Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----
"mdnsNSP" - "Apple Inc." - C:\Programme\Bonjour\mdnsNSP.dll

===[ Logfile end ]=========================================[ Logfile end ]===
--- --- ---

--- --- ---

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru[/CODE]

MBRCheck-Log:
Code:
MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:                       
Windows Version:                Windows XP Professional
Windows Information:                Service Pack 3 (build 2600)
Logical Drives Mask:                0x000000fd

Kernel Drivers (total 136):
  0x804D7000 \WINDOWS\system32\ntkrnlpa.exe
  0x806E5000 \WINDOWS\system32\hal.dll
  0x8A349000 \WINDOWS\system32\KDCOM.DLL
  0xBA4BC000 \WINDOWS\system32\BOOTVID.dll
  0xB9F78000 ACPI.sys
  0xBA5A8000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
  0xB9F67000 pci.sys
  0xBA0A8000 isapnp.sys
  0xBA670000 pciide.sys
  0xBA328000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
  0xBA0B8000 MountMgr.sys
  0xB9F48000 ftdisk.sys
  0xBA5AA000 dmload.sys
  0xB9F22000 dmio.sys
  0xBA330000 PartMgr.sys
  0xBA0C8000 VolSnap.sys
  0xB9F0A000 atapi.sys
  0xBA0D8000 disk.sys
  0xBA0E8000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
  0xB9EEA000 fltmgr.sys
  0xB9E93000 SYMDS.SYS
  0xB9E81000 sr.sys
  0xB9DD8000 SYMEFA.SYS
  0xB9DC1000 KSecDD.sys
  0xB9DAE000 WudfPf.sys
  0xB9D21000 Ntfs.sys
  0xB9CF4000 NDIS.sys
  0xB9CDA000 Mup.sys
  0xBA1A8000 \SystemRoot\system32\DRIVERS\intelppm.sys
  0xBA1B8000 \SystemRoot\system32\DRIVERS\serial.sys
  0xB9C92000 \SystemRoot\system32\DRIVERS\serenum.sys
  0xBA3C8000 \SystemRoot\system32\DRIVERS\fdc.sys
  0xBA1C8000 \SystemRoot\system32\DRIVERS\i8042prt.sys
  0xBA3D0000 \SystemRoot\system32\DRIVERS\kbdclass.sys
  0xBA3D8000 \SystemRoot\system32\DRIVERS\point32.sys
  0xBA3E0000 \SystemRoot\system32\DRIVERS\mouclass.sys
  0xBA3E8000 \SystemRoot\system32\DRIVERS\nvsmu.sys
  0xBA3F0000 \SystemRoot\system32\DRIVERS\usbohci.sys
  0xB7867000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
  0xBA3F8000 \SystemRoot\system32\DRIVERS\usbehci.sys
  0xB783F000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
  0xBA1D8000 \SystemRoot\system32\DRIVERS\imapi.sys
  0xBA1E8000 \SystemRoot\system32\DRIVERS\cdrom.sys
  0xBA1F8000 \SystemRoot\system32\DRIVERS\redbook.sys
  0xB781C000 \SystemRoot\system32\DRIVERS\ks.sys
  0xBA630000 \SystemRoot\system32\DRIVERS\NTIDrvr.sys
  0xBA400000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
  0xB870C000 \SystemRoot\system32\DRIVERS\nvnetbus.sys
  0xB7735000 \SystemRoot\system32\DRIVERS\NVNRM.SYS
  0xB70A8000 \SystemRoot\system32\DRIVERS\nv4_mini.sys
  0xB7094000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
  0xB8CD4000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
  0xBA7A8000 \SystemRoot\system32\DRIVERS\audstub.sys
  0xB86FC000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
  0xB8CD0000 \SystemRoot\system32\DRIVERS\ndistapi.sys
  0xB707D000 \SystemRoot\system32\DRIVERS\ndiswan.sys
  0xB86EC000 \SystemRoot\system32\DRIVERS\raspppoe.sys
  0xB86DC000 \SystemRoot\system32\DRIVERS\raspptp.sys
  0xBA408000 \SystemRoot\system32\DRIVERS\TDI.SYS
  0xB706C000 \SystemRoot\system32\DRIVERS\psched.sys
  0xB86CC000 \SystemRoot\system32\DRIVERS\msgpc.sys
  0xBA410000 \SystemRoot\system32\DRIVERS\ptilink.sys
  0xBA418000 \SystemRoot\system32\DRIVERS\raspti.sys
  0xB7059000 \SystemRoot\system32\DRIVERS\ncpvaxp.sys
  0xB7029000 \SystemRoot\system32\DRIVERS\rdpdr.sys
  0xB86BC000 \SystemRoot\system32\DRIVERS\termdd.sys
  0xBA632000 \SystemRoot\system32\DRIVERS\swenum.sys
  0xB6FCB000 \SystemRoot\system32\DRIVERS\update.sys
  0xB8740000 \SystemRoot\system32\DRIVERS\mssmbios.sys
  0xB1F1B000 \SystemRoot\System32\Drivers\NDProxy.SYS
  0xB1F0B000 \SystemRoot\system32\DRIVERS\usbhub.sys
  0xB15B4000 \SystemRoot\system32\DRIVERS\USBD.SYS
  0xB1EFB000 \SystemRoot\system32\DRIVERS\NVENETFD.sys
  0xB016E000 \SystemRoot\system32\drivers\RtkHDAud.sys
  0xB014A000 \SystemRoot\system32\drivers\portcls.sys
  0xB1EDB000 \SystemRoot\system32\drivers\drmk.sys
  0xB1910000 \SystemRoot\system32\DRIVERS\flpydisk.sys
  0xB15B0000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
  0xB12CA000 \SystemRoot\System32\Drivers\Null.SYS
  0xB1471000 \SystemRoot\System32\Drivers\Beep.SYS
  0xB1900000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
  0xB1576000 \SystemRoot\System32\drivers\vga.sys
  0xB146F000 \SystemRoot\System32\Drivers\mnmdd.SYS
  0xB146D000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
  0xB156E000 \SystemRoot\System32\Drivers\Msfs.SYS
  0xB1566000 \SystemRoot\System32\Drivers\Npfs.SYS
  0xB1311000 \SystemRoot\system32\DRIVERS\rasacd.sys
  0xB00C7000 \SystemRoot\system32\DRIVERS\ipsec.sys
  0xB006E000 \SystemRoot\system32\DRIVERS\tcpip.sys
  0xB0015000 \SystemRoot\system32\drivers\NIS\1201000.025\SYMTDI.SYS
  0xAFFEF000 \SystemRoot\system32\DRIVERS\ipnat.sys
  0xAFFC9000 \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS
  0xBA288000 \SystemRoot\system32\DRIVERS\wanarp.sys
  0xAC639000 \SystemRoot\system32\DRIVERS\netbt.sys
  0xAC08E000 \SystemRoot\System32\drivers\afd.sys
  0xB2674000 \SystemRoot\system32\DRIVERS\netbios.sys
  0xABCE5000 \SystemRoot\system32\drivers\NIS\1201000.025\Ironx86.SYS
  0xA7C85000 \SystemRoot\system32\drivers\NIS\1201000.025\SRTSPX.SYS
  0xA6C92000 \SystemRoot\system32\DRIVERS\rdbss.sys
  0xA83BC000 \systemroot\system32\drivers\Ndisprot.sys
  0xA6C22000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
  0xA7C75000 \SystemRoot\System32\Drivers\Fips.SYS
  0xA6BC4000 \??\C:\Programme\Gemeinsame Dateien\Symantec Shared\EENGINE\eeCtrl.sys
  0xA6BA7000 \??\C:\Programme\Gemeinsame Dateien\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
  0xA9728000 \SystemRoot\System32\drivers\bizVSerialNT.sys
  0xA6AFB000 \??\C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20101001.001\BHDrvx86.sys
  0xA7533000 \SystemRoot\System32\Drivers\Cdfs.SYS
  0xA6AE3000 \SystemRoot\System32\Drivers\dump_atapi.sys
  0xBA62C000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
  0xBF800000 \SystemRoot\System32\win32k.sys
  0xA8259000 \SystemRoot\System32\drivers\Dxapi.sys
  0xA7E0F000 \SystemRoot\System32\watchdog.sys
  0xBF000000 \SystemRoot\System32\drivers\dxg.sys
  0xBA6D0000 \SystemRoot\System32\drivers\dxgthk.sys
  0xBF012000 \SystemRoot\System32\nv4_disp.dll
  0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
  0xB1F90000 \SystemRoot\system32\DRIVERS\ndisuio.sys
  0xA5CEE000 \SystemRoot\system32\DRIVERS\mrxdav.sys
  0xBA490000 \SystemRoot\System32\drivers\aspi32.sys
  0xA5C39000 \SystemRoot\system32\drivers\wdmaud.sys
  0xA7553000 \SystemRoot\system32\drivers\sysaudio.sys
  0xB2780000 \??\C:\WINDOWS\system32\eLock2BurnerLockDriver.sys
  0xA5ABB000 \??\C:\WINDOWS\system32\eLock2FSCTLDriver.sys
  0xA7E07000 \??\C:\WINDOWS\system32\drivers\int15.sys
  0xA5923000 \SystemRoot\system32\DRIVERS\srv.sys
  0xA545A000 \??\C:\WINDOWS\system32\drivers\tvicport.sys
  0xBA6F2000 \??\C:\WINDOWS\system32\drivers\zntport.sys
  0xBA430000 \??\C:\DOKUME~1\User\LOKALE~1\Temp\mbr.sys
  0xBA420000 \??\C:\DOKUME~1\User\LOKALE~1\Temp\catchme.sys
  0xBA5EC000 \??\C:\WINDOWS\system32\Drivers\PROCEXP113.SYS
  0xA4FEF000 \SystemRoot\System32\Drivers\Fastfat.SYS
  0xA722F000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
  0xA46CB000 \??\C:\DOKUME~1\User\LOKALE~1\Temp\kfniqfog.sys
  0xA3C53000 \SystemRoot\system32\drivers\kmixer.sys
  0xA3B5B000 \??\C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20101026.001\IDSxpx86.sys
  0x7C910000 \WINDOWS\system32\ntdll.dll

Processes (total 44):
      0 System Idle Process
      4 System
    1192 C:\WINDOWS\system32\smss.exe
    1264 csrss.exe
    1288 C:\WINDOWS\system32\winlogon.exe
    1336 C:\WINDOWS\system32\services.exe
    1348 C:\WINDOWS\system32\lsass.exe
    1516 C:\WINDOWS\system32\svchost.exe
    1568 svchost.exe
    1612 C:\WINDOWS\system32\svchost.exe
    1664 C:\WINDOWS\system32\svchost.exe
    1724 svchost.exe
    1816 svchost.exe
    128 C:\WINDOWS\system32\spoolsv.exe
    276 scardsvr.exe
    440 svchost.exe
    684 C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
    740 C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    764 C:\Programme\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
    800 C:\Programme\Bonjour\mDNSResponder.exe
    860 C:\WINDOWS\system32\cjpcsc.exe
    952 C:\Programme\Gemeinsame Dateien\MAGIX Services\Database\bin\FABS.exe
    1076 C:\Programme\ICQ6Toolbar\ICQ Service.exe
    1180 C:\Programme\Java\jre6\bin\jqs.exe
    1252 C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
    1900 C:\Programme\Funkwerk Secure IPSec Client\ncpclcfg.exe
    2076 C:\Programme\Funkwerk Secure IPSec Client\NCPRWSNT.EXE
    2184 C:\Programme\Norton Internet Security\Engine\18.1.0.37\ccSvcHst.exe
    2256 C:\WINDOWS\system32\nvsvc32.exe
    2696 C:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe
    2772 C:\Programme\Norton Internet Security\Engine\18.1.0.37\ccSvcHst.exe
    984 C:\WINDOWS\system32\svchost.exe
    2412 C:\WINDOWS\system32\wbem\wmiapsrv.exe
    3276 C:\WINDOWS\system32\wscntfy.exe
    3288 alg.exe
    524 C:\WINDOWS\explorer.exe
    304 C:\WINDOWS\system32\ctfmon.exe
    4076 C:\WINDOWS\system32\wuauclt.exe
    528 C:\WINDOWS\system32\wuauclt.exe
    1084 C:\Dokumente und Einstellungen\All Users\Desktop\MFtools\trojanerboard_tip5\osam_autorun_manager_5_0_portable\osam.exe
    1832 C:\WINDOWS\system32\wuauclt.exe
    272 wmiprvse.exe
    3160 C:\WINDOWS\system32\wuauclt.exe
    2036 C:\Dokumente und Einstellungen\User\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000002`70a00000  (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000026`83700000  (NTFS)

PhysicalDrive0 Model Number: WDCWD3200AAJS-22B4A0, Rev: 01.03A01

      Size  Device Name          MBR Status
  --------------------------------------------
    298 GB  \\.\PhysicalDrive0  Unknown MBR code
            SHA1: 75374D27B77E61C9316E27BACDEE41C1E2C9874E


Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:

cosinus 27.10.2010 17:00
Hast Du außer WinXP noch andere Betriebssysteme installiert?

desos 27.10.2010 17:06
Zitat:
Zitat von cosinus (Beitrag 582845)
Hast Du außer WinXP noch andere Betriebssysteme installiert?
Nein bisher nicht (auf diesem Rechner).

Hätte das einen Vorteil oder fragst Du wegen einem Log und suchst nach einer Erklärung?
Falls letzteres der Fall ist - es war ein USB-Stick (Cruzer) am Rechner auf welcher eine Funktion hat, die ein CD-Rom-Laufwerk (und ggf. auch ein OS?!) emuliert.

cosinus 27.10.2010 17:41
Wir müssen den MBR neu schreiben. Deswegen.

Starte den Rechner neu und wähle im Bootmenü die Wiederherstellungskonsole aus.

Tipp dort den Befehl fixmbr ein (dann Enter, mit j bestätigen) danach den Befehl fixboot (dann Enter, mit j bestätigen)

Mit exit (dann enter drücken) wird der Rechner neu gestartet. Führe im normalen Windowsmodus den Bootkit Remover nochmals aus und poste das neue Log.

desos 27.10.2010 21:51
Zitat:
Zitat von cosinus (Beitrag 582871)
Mit exit (dann enter drücken) wird der Rechner neu gestartet. Führe im normalen Windowsmodus den Bootkit Remover nochmals aus und poste das neue Log.
Hoffe das ist jetzt keine "saudumme Frage" und begebe mich mal noch gleich auf die Suche, aber welches der Programme, die ich bisher genutzt habe ist der Bootkit Remover? Oder kann es sein, dass ich das bisher noch nicht genutzt habe und es das unter folgendem Link ist?:

hxxp://www.trojaner-board.de/86574-bootkit-remover.html


Alle Zeitangaben in WEZ +1. Es ist jetzt 10:51 Uhr.
Seite 1 von 3 1 23
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131